Closes the Opus share of the curriculum-license-loop arc. Three deliverables,
all docs -- no production code.
1. E1-R7-ASSERTION-SPEC.md -- the Opus half of Phase E1. The code move was
already specified by runtime_contracts.md ("defer the single sink emission
to the pipeline serve boundary"); what to ASSERT was not, and the default
sink is None, so nothing exercises the path. Eight invariants (I1-I8) plus
three mechanism rulings (M1-M3), each with the silent failure it prevents.
The three mechanism rulings are the value. M1: stage a turn_log INDEX, not
a captured TurnEvent -- a captured copy is the pre-override snapshot, i.e.
the defect with extra steps. M2: attach_telemetry_sink must NOT flush a
staged turn event, which is the OPPOSITE of what it correctly does for
_pending_reboot_payload; the reboot payload is final when buffered, a turn
event is mid-flight, and flushing on attach would silently restore R7. M3:
the runtime cannot detect whether a pipeline will run (the pipeline wraps
the runtime), so deferral must be explicit opt-in and the no-pipeline path
must stay byte-identical.
All ten source citations verified against HEAD.
2. Plan of record AMENDED with four falsified premises from Phases A/B, with
the original text preserved:
- physics·modal was the wrong first target -- its ceiling is 480 against a
657 threshold, and 8 of 11 bands cannot reach 657 at all. Vocabulary is
the constraint, not chain count. Retarget: philosophy_theology·modal.
- MAX_PREMISE_SENTENCES=16 caps a family at 16 chains, so ADR-0262 §5.1's
own remedy (~219 relations) collapses the band at row 17. No curriculum
band can earn SERVE until premise compilation is query-scoped. New
implementation phase precedes ALL content work.
- authoring a negative today serves a confident wrong "Yes", not UNKNOWN.
- 21 of 25 ratified deduction bands are short on distinct evidence.
3. DIVISION-OF-WORK updated for the handoff: §0 status table with branch names
and merge order, the revised order (E2 -> R5-R7 -> C -> D -> E1(code) ->
parity), the new R5-R7 unit specified to gate-level detail, and a standing
"do not fix" on the deduction ledger exposure.
One correction to my own earlier text: §4 told Phase C to mirror the
deduction producer "exactly". That would replicate the padding -- a flat
CASES_PER_BAND=720 cycling a 28-instance space. Phase C now points at the
`estimation` producer instead (660 distinct, zero repeats), and must
register in AUDIT_SOURCES.
[Verification]: uv sync --locked on canonical CPython 3.12.13; in-worktree
smoke 555 passed, deductive 285 passed (this branch is off main and carries
neither ADR-0264 nor the Phase B tests, so 555 is the correct baseline here,
not the 569 that holds on the stacked A+B branches).
Two prior arcs closed on "the binding constraint is ratified curriculum volume,
not machinery." Verified against code 2026-07-25: the machinery half is wrong in
a load-bearing way, and the correction is the reason this arc exists.
evals/curriculum_serve/practice/ does not exist. seal_ledger exists only for
deduction (evals/deduction_serve/practice/runner.py:96), yet
chat/curriculum_serve_license.py's own docstring names
evals.curriculum_serve.practice.runner.seal_ledger as "the only writer" of the
artifact it reads -- that writer was never built, and
chat/data/curriculum_serve_ledger.json does not exist. And the ceremony stops
short: RatificationReceipt.pending_stages = (arena_queue_entry, ledger_reseal).
So the pipeline is author -> ratify -> ??? -> ??? -> license -> serve. Authoring
curriculum today cannot earn a license at ANY volume. Content is necessary and
currently insufficient. The build is still modest, because oracle.py is already
an independent decision procedure usable as the gold tether and ADR-0263 already
extracted the sealers for exactly a third instance.
Two measured facts shape the content work. `refuted` has NEVER been produced --
the physics lane gold is entailed 14 / unknown 12 / declined 6, and no corpus row
can express it. And bands key on (domain, operator_family), so negative content
must live INSIDE operator_family "modal" with a row-level polarity marker; a
separate modal_negative family would create a new band at n=0 instead of adding
refuted volume to the target band -- the easiest available way to waste the whole
authoring effort.
DIVISION-OF-WORK.md records the tiering criterion and why it is not difficulty.
The evidence does not support a prestige split: in the same 48h window Sonnet 5
found the DEFAULT_SINK bug that wrote outside the repository and did the
six-worktree public_demo archaeology, while Opus 5 mis-diagnosed the CGA hot path
by multiplying a microbenchmark by a call count. Model tier was not the variable;
verification discipline was.
The split is therefore: would an error here be caught by a gate, or is it silent?
Two units are silent-failure BECAUSE THEY ARE THE GATE -- the negative-curriculum
epistemology (wrong => corpus encodes falsehoods and wrong=0 still passes, since
lane gold and the oracle both read the same rows) and the volume-honesty invariant
(wrong => conservative_floor cannot tell 657 independent facts from 16 asked 41
times, so the ledger clears theta=0.99 having earned nothing). Those get Opus.
Everything loud goes to the cheapest competent tier.
Also records the ordering correction: the epistemology ADR must precede the
generator, or the generator gets built twice.
[Verification]: docs-only; no code paths touched. Every referenced path confirmed
to exist and all five line citations confirmed accurate at HEAD (gold.py:1163,
curriculum_serve/runner.py:71, discovery_yield.py:67-70, entail.py:125,
curriculum_surface.py:184). Pre-push gate runs on push.
Reverts the bidirectional half of the smoke parity pin added earlier today,
and records why at the assertion site so it is not "completed" again.
I read the suite list's comment ("so the local-first pre-push gate equals the
CI gate") as promising equality, made the assertion symmetric, and reported
tests/test_pack_draft_serve_boundary.py as drift because it sits in the local
gate and not in .github/workflows/smoke.yml.
That was wrong, and AGENTS.md says so in a line I had already read: GitHub
Actions are billing-locked and produce dead signals, never chase them. The
Forgejo host (e2-micro) cannot run workflows either. CI here is run MANUALLY
in-worktree — usually faster anyway on UMA hardware with real RAM — which is
what scripts/ci/local-ci.sh now front-ends. smoke.yml is secondary
observability, not a gate.
So the local suite is the SOURCE and is free to be broader. Asserting the
reverse converts a file nobody executes into a maintenance obligation, and one
agents cannot discharge at that — pushing workflow changes needs an OAuth scope
the push credential lacks. The three "owed" lines were never owed.
The surviving direction (CI subset-of local) still protects something real: if
smoke.yml ever names a path the local gate lacks, the local gate is narrower
than a published claim about it.
Arc-close brief updated to match: the "three files owed to smoke.yml" open item
is replaced by a recorded non-finding, so the next reader does not re-derive it.
Its shipped-work table now lists what actually landed in its place — the local
CI runner, the lane-roster fix, and the proposal-sink test-isolation fix.
[Verification]: 21 passed across test_cli_test_suites, test_lane_sha_verifier,
test_adr_index; ruff clean on the changed test.
NON-CANONICAL: Python 3.12.11, not the pinned 3.12.13 (unavailable for
linux-x86_64). Hash-pinned tests reproduce committed values regardless.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FduW6Krm3PPQv3P5iwBYtx
Squashes the arc's work into one commit; the workflow-file edit it originally
carried is excluded (see the end of this message).
## Lane 1 — Workbench recorded a proved answer as ungrounded
With deduction_serving_enabled ratified ON (ADR-0256), workbench/api.py's live
chat route builds a bare ChatRuntime(), so the deduction composer decides
Workbench turns and stamps grounding_source="deduction" — but
_coerce_grounding_source carried a hand-copied whitelist of the six pre-arc
labels and silently rewrote anything else to "none". The runtime comment
reasoned this was inert because "REPL turns do not flow through Workbench's
CognitivePipelineRecord path". True, and irrelevant: the traffic flows the
other way. Stale since 2026-07-24.
Scope is one field. workbench/api.py:818 prefers TurnEvent.epistemic_state,
which read epistemic_state_needed — honest. So the UNregistered path degraded
honestly while the hand-copied whitelist asserted a falsehood; a second copy of
a closed enum was worse than no copy. Hence registration AND derivation:
GROUNDING_SOURCES exposes the Literal's members, and the coercion reads it.
workbench-ui badges/tokens/snapshot follow; enumCoverage.test.ts forces atomicity.
## Lane 2 — the ratification ceremony
The discovery loop was instrumented but not closed. teaching/ratification.py
turns a reviewed decision into a chain record, a corpus commit, and a receipt.
Its design turns on one observation: _ratified_rows DROPS unadmissible rows
silently — correct when serving, a trap when ratifying, because the file grows,
the commit lands, and the band count does not move. So the ceremony refuses to
call an append a ratification until it has re-read the curriculum through the
real loader and seen the chain arrive; a non-admitted append is rolled back.
Validation is a pre-flight courtesy, admission is the proof.
Arena queue entry and ledger reseal are deliberately NOT performed (bridge rule
1); the receipt names them. Front door: `core proposal-queue ratify`, a sibling
of `review` rather than a flag on it.
## Lane 3 — structural closures
- ADR-0263 gains rule 5: absence policy is DECLARED in CAPABILITY_LEDGERS, not
passed at the call site. An AST-matched test fails if a serving path passes
missing_ok again.
- Deductive suite added WHOLE to the pre-push gate: 285 tests in 29s against
smoke's 216 in 62s, so no coverage trade was needed.
- Smoke/CI parity assertion made bidirectional. It was one-directional, and had
drifted.
- test_prior_surface_deduction_binding.py pins correction binding on the
deduction path. The review's diagnosis did NOT reproduce — hash_surface moves
in lockstep — so it pins what is there. Mutation-checked.
- Domain-keyed ADR index over 312 flat-numbered files, explicitly partial.
- Arc-close brief template, plus this arc's own brief filled in against it.
## Lanes 4 and 5 — two premises falsified by measurement, one of them mine
Math 4.2: baseline reproduced (correct=5 wrong=0 refused=495); all four named
cases traced to one seam with each gap isolated by one-variable probes. Then the
number that changes the recommendation: the gap blocking case 0000 affects 1
case in 500, the 'than' gap blocking 0001 affects 2. ADR-0251's prohibition on
per-case growth now rests on a count. No reader change made.
CGA: versor_condition is 0.22% of a turn, not the "~10x proof latency" I claimed
— that multiplied an isolated microbenchmark by a call count and compared it to
a single verdict's latency. The real cost is geometric_product at 33,986
calls/turn (~73%) via cga_inner in search paths. The obvious closed form is NOT
bit-exact (954/4000 in f32); backend.vault_recall's serial fold IS (3000/3000,
worst-rel 0) and is the correct target. cargo test could not run —
static.crates.io is denied by the sandbox network policy — so the Rust parity
question stays open and the typestate lane is carried forward, not shipped
uncompiled.
## Not landed: three lines owed to .github/workflows/smoke.yml
The CI smoke gate is narrower than the local one —
test_pack_draft_serve_boundary.py (ADR-0253 INV-33) has been local-only, unseen
because the parity pin checked one direction. The edit was authored and rejected
at push for lacking the `workflow` OAuth scope, so it is recorded as a named,
dated PENDING_IN_CI exception rather than dropped: the assertion still fires on
any new divergence, and a second guard fires once the three land.
[Verification]: pre-push gates all green — smoke 236 passed, warmed_session 10
passed, deductive 285 passed. Ratification 14, ADR index 5, CLI suites 10.
Grounding/epistemic sweep 741 passed 1 skipped. workbench-ui 598 passed across
73 files, tsc -b clean. capability index 11 passed, digest unchanged. Math
holdout correct=5 wrong=0 refused=495. Committed chain corpora byte-unchanged
after the tests that write to them.
Environment caveat: the repo pins requires-python ==3.12.13, which uv cannot
fetch for linux-x86_64, so `uv sync --locked` fails. All Python runs used a
scratch venv on 3.12.11 with declared deps — not the locked universe, not the
full ~12k suite. The pin was left untouched. Re-run on a 3.12.13 host before
treating this as merge evidence.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FduW6Krm3PPQv3P5iwBYtx
Ratified by Shay 2026-07-24. Default flipped False -> True.
Evidence at ratification:
- 25 shape-bands, each holding SERVE at 720/720 wrong=0 on the SHA-sealed
ratified ledger (theta_SERVE=0.99, n >= 657 committed per band);
- deduction-serve lane 166/166 wrong=0 across six hand-authored splits;
- commit gate narrow by construction — a sentence-initial "therefore" IS an
argument, so the composer cannot claim turns that are not one;
- an unearned shape is still served DISCLOSED, never asserted.
Blast radius verified, not assumed: core test --suite deductive 268 passed
with the flag ON by default; a live default-config ChatRuntime decides real
English and existential arguments through grounding_source="deduction" while
ordinary turns still fall through to pack grounding; lane pins 10/11 match —
unchanged by the flip (the single miss is the pre-existing public_demo drift
documented for Tier S).
Rollback is flipping this back: flag-off remains byte-identical to pre-arc
dispatch and leaves no residue, pinned by
test_flag_off_preserves_pack_token_gloss_byte_identity.
curriculum_serving_enabled stays OFF — every curriculum band is unearned, and
the Sonnet brief now records the explicit bar for revisiting it.
Records the four completed Opus units and their commits, the server-side
push blocker (corrupt object behind PR #111's head ref blocks every push to
the repo), three measured corrections to the plan's ground truth (no biology
chain corpus; Phase 4.1 already built with null yield; no curriculum band can
earn a license from present data), the deterministic public_demo drift
evidence for S2, and a new S6 item quantifying the curriculum-volume ask.
Plan of record for the generalization arc lands here
(docs/plans/generalization-arc-2026-07-24.md) with the risk-tiered
handoff pack (docs/handoff/generalization-2026-07/); Phase 0.1 executed.
Root-caused the three stale lane pins (docs/research/lane-drift-
investigation-2026-07-24.md):
- miner/curriculum: 5c69b741 (ADR-0244 §2.7) widened content digests
16→64 hex; intentional, pins were simply never updated. Re-pinned
surgically; SHAs triple-run deterministic.
- demo_composition: a REAL serving regression. #76's canonical-first
base precedence in resolve_surface, activated when #96 routed pipeline
turns through the resolver, served the pre-R6 canonical — the register
axis (ADR-0077 R6 substantive + ADR-0071 R4 decoration) was silently
stripped from every pipeline-served turn. T13's back-stamp then made
telemetry mirror the stripped bytes; register-tour claims went red and
the e2e tests pinning the axis (outside smoke) were failing on main.
Fix: response-first base precedence (served bytes = post-guard, post-R6,
post-R4) + new SurfaceResolution.hash_surface carrying the truth-path
canonical-precedence bytes through substrate overrides, folds, hedge,
logos-morph, and the speculative marker. compute_trace_hash folds
hash_surface, so the register axis varies the served surface ONLY and
trace_hash stays register-invariant (ADR-0069 inv C). _prior_surface
(correction binding) stays on the truth path. Dead FailureClass import
and _assessment_residual removed.
Also: generate_claims.py had raised on every run since the
deduction_serve_v1 pin landed without a _LANE_ADR entry — mapping added
(ADR-0256), CLAIMS.md regenerated, --check green.
[Verification]: register tour 6/6 claims (substantive-differs restored,
all_trace_hashes_identical held); 88 tests green in-worktree
(test_surface_resolution incl. 2 new fallback tests,
test_register_substantive_consumption incl. previously-red e2e tests,
test_grounded_open_hedge_arm, test_cognitive_turn_pipeline,
test_warmed_session_lane 10/10 T13 consistency); miner/curriculum lane
SHAs byte-identical across three runs; deduction_serve + deductive_logic
lane reports byte-identical to their unchanged pins; smoke suite via
pre-push gate.
Folds in Shay's rulings on the spike:
- ERRATA sections added to ADR-0249, ADR-0250, and both acceptance-evidence docs
(statuses stay Accepted): corpus label 'real GSM8K dev holdout' -> 'CORE-authored
GSM8K-style corpus (ADR-0119.2)'. Mechanism claims (wrong=0, PARITY, conservation,
atomicity, chain-of-custody, 200/200) all stand; reframe not retraction. Covers the
#74 review comment that repeated the label. (Also fixed ADR-0250 evidence status ->
RATIFIED, which the ratification housekeeping missed.)
- Two instruments named + never-blended scoreboard: authored = mechanism-correctness
(200/200 stands as that); official holdout = generalization (5/500 symbolic / 0/500
corridor). public/dev-1 floors relabeled MECHANISM floors, composition-disclosed.
- Censored-incidence fix: parse-INDEPENDENT tagging of 100 official cases (documented
heuristic). 70/100 carry frontier markers (rate 31, fraction 28, compare_mult 20) ->
(c) refuted, frontier COMMON not rare; the table is the reader-arc curriculum by
real-world frequency.
- Reader-practice-loop design with the four non-negotiable constraints (real held-out
data only; wrong=0 gates consolidation; sealed test untouched; holdout_dev split
disjoint from the measured metric). Sequencing: capability->practice->calibration->
serve; reader is the critical path for all three; serve-landing de-prioritized (0/500).
Spike verdict for ruling; nothing built.
Instrument: the arithmetic-chain domain now routes each real GSM8K dev case to
Tier-1 (single-accumulator) or Tier-2 (multi-register / summation) and compares
the corridor to a symbolic fold of the SAME compiled program. Recorded coverage
moves 26/50 -> 50/50, 0 refused, PARITY (wrong=0) — the measurement catching up
to the capability. Scope note corrected (full holdout closed; remaining frontier
= derived-operand transfers + non-affine kinds + >5-atom deduction, all 0 on this
holdout). Updated the ADR-0249 instrument test pins (26->50, refused 24->0).
ADR-0250 (Status Proposed, no self-Accept; §10 ruling awaits Shay) + acceptance
evidence: multi-register model, relative conservation, atomicity, certified
summation, chain-of-custody, and the full-holdout 50/50 wrong=0 result.
10/10 instrument pins green.
[Verification]: uv run python -m pytest tests/test_adr_0249_arithmetic_lift.py tests/test_generalized_lift_instrument.py -q
Stamp the §10 ruling record: Status Proposed→Accepted; four design rulings
affirmed; honest-by-construction measurement (0 wrong / 26 correct / 24 refused
on real GSM8K, PARITY vs symbolic fold) affirmed as the definitive outcome.
Next arc selected: Tier-2 arithmetic (multi-entity/transfer/rate/comparison/
fraction). Acceptance-evidence status updated to RATIFIED. Doc-only.
ADR-0249 documents the reader→Hamiltonian compiler (P1-P5): thesis (composition
= certified turn sequences), the five components, anti-hollow discipline, the
Ring-2 non-mutating correction, three-tier reproducibility, Tier-1 scope +
recorded frontier, and the honest-measurement done-when. Status Proposed — no
self-Accept; §10 ruling record awaits Shay.
Acceptance evidence: phases + merge SHAs, the real GSM8K dev-holdout result
(26/50 Tier-1 ingestible, wrong=0, PARITY vs symbolic fold, 24 multi-entity
refused = recorded frontier), in-tree algebra + CNF-soundness verification, the
design corrections applied, and the honest open register.
BOUNDED AUTONOMOUS SCAFFOLD DRAFT (Fable 5) — not a PR, not merged, no status
flip, no main push. For Opus 4.8 + Shay audit before anything proceeds toward main.
Stacked on the verified §3-primitives + §3.4/3.5-ledger stack (reuse, not re-derive;
all descend from main @ 04d67ca5).
Adds (directive steps 3-4):
+ evals/adr_0246_geometric_suite/ runnable §6.1 synthetic geometric suite
(identity, pi-inversion, 90deg-permutation, mild drift, alien tilt e14,
boost e15, near-singular Gram, malformed F) + §6.2 path/holonomy suite
(lawful sequence, small-rotation session accumulation, interleaved refuse,
pack-change hard break, raw!=lawful forensic). 14/14 cases pass.
+ tests/test_adr_0246_geometric_suite.py pins every case + explicit §6.1 pins
(pi-inversion s=-1, 90deg s=0, near-singular Gram error, malformed-F error)
+ identity_manifold.py: MalformedVersorError + _validate_versor guard on
induced_action / typed_residual_energy (§6.1 fail-closed on malformed F)
+ docs/handoff/adr-0246-slice1-scaffold-notes.md placeholder list, §5-§7
uncertainties, constraint-compliance record, explicit Opus/human TODOs
+ docs/audit/artifacts/adr-0246-slice1-scaffold-runlog.txt actual run output
Constraints honored: H_id={I} only; no soft-projection of unlawful A; path
composes lawful actions only (never raw product); no C_id corrector; chat/runtime,
flags, D4 gate wiring untouched (A-04 quarantine pinned); no discrimination report,
no ADR body, no claims language (deferred TODO: Opus/human); D4 plan not modified.
epsilon_turn/epsilon_session are UNCERTIFIED PLACEHOLDERS, never baked into a
module default (PathBudget is caller-supplied) — flagged in notes + run log.
[Verification]: uv run core test --suite smoke -q => 176 passed;
python -m evals.adr_0246_geometric_suite => 14/14 all_passed;
ADR-0246 suites + adjacent D4 identity surfaces => 114 passed (see run log).
Governance flip carrying Joshua Shay's ratification provenance inline (ruling
2026-07-17: "Ratify both"). Anti-self-Accept guard satisfied — status flips are
authorized by explicit human ruling, not self-issued.
- ADR-0245 → **Accepted** (clean): mechanical-sympathy + semantic-rigor §3 gate
green — parity, f32 467× speedup, 0-LAPACK-on-repeat, collision-resistance.
- ADR-0244 → **Accepted as an implemented mechanism** with a RATIFIED
live-activation limitation: identity_wave_gate stays default-off and live
activation is NOT authorized. Acceptance covers the operator-preservation
manifold, fail-closed gate capability, γ_id calibration, telemetry, and
lifecycle contracts — not a production flip. The Phase-3 calibration explicitly
did NOT authorize activation (benign traffic not separable at the nominal
frame; best balanced error 0.346). Activation is blocked pending a separately
ratified ADR-0246 (induced action, lawful stabilizer, path integrity,
semantic-frame discrimination) + renewed discrimination evidence + acceptable
benign refusal rate + explicit human ratification.
Governance additions (per the ruling): both ADR status lines carry
"Accepted — ratified by Joshua Shay … acceptance-packet" (provenance-guard
format); ADR-0244 header carries the Operational-status limitation paragraph + a
machine-readable identity_wave_gate: ledger block (implementation: accepted /
live_activation: not_authorized / default: off); both packet §8 RULING RECORDs
RATIFIED with the "not safe-to-activate" caveat prominent. Plan doc Phase 6 → DONE.
[Verification]: smoke 176 passed; provenance/ADR pins + all ADR-0244/0245 tests
503 passed (both-Accepted-with-provenance format enforced). Docs-only.
Two D10-pattern acceptance packets submitted for Joshua's ruling:
- docs/audit/adr-0244-acceptance-packet-2026-07-17.md
- docs/audit/adr-0245-acceptance-packet-2026-07-17.md
Each is an evidence dossier (§1 claim→built→evidence→verdict table, §2 deviations,
§3 deferred, §4 gate results, §5 requested action). §8 RULING RECORD is PENDING and
both ADR status lines remain **Proposed** — the anti-self-Accept guard forbids me
flipping status without explicit ratification, so I have NOT.
The ADR-0244 packet §5 foregrounds the one caveat shaping the ruling: the identity
wave-gate is BUILT + VALIDATED but NOT live (identity_wave_gate=False; Phase-3
live-non-separation, best balanced error 0.346) — validated scaffolding pending
ADR-0246, not a live gate. The ADR-0245 §3 gate is complete (parity, f32 467×
speedup, 0-LAPACK, collision-resistance).
Plan doc Phase 6 → PACKETS DELIVERED, awaiting ratification. All build phases
(0-5) complete; the only remaining step is the human ratification gate.
[Verification]: Phase 5 gate green — smoke 176; fast lane 12032 passed / 25
skipped (core_rs built → Rust-parity + f32-speedup ran live). Docs-only commit;
both ADRs Proposed (provenance guard unaffected).
The single explicit, fail-closed f64→f32 down-cast at the certified lifecycle
egress. serving_cast(psi_steady, certificate, verdict) -> ServingState in
core/physics/cognitive_lifecycle.py:
- Casts ONLY a state that validates as a finite 32-vector, matches its
certificate psi_digest, and was verdict.admitted — an uncertified, refused, or
digest-mismatched state is never served.
- Precision-checks the f32 result (cast_error = max|f64-f32|, unit norm) and
fails closed on an f32 precision cliff (f32_precision_insufficient) rather than
serving a silently-degraded state.
- Keeps f64 as the source of truth: psi_steady and the psi_digest content-address
chain are untouched; ServingState carries provenance back (source_psi_digest,
certificate_id, measured cast_error) for audit. f64 stays inside
relaxation/eigendecomp — this is the one place f32 appears (ADR-0245 §2.2
mechanical sympathy).
Satisfies both ADR-0244 §2.5 and ADR-0245 §2.2 (one contract, two ADRs). Measured
on a real certified outcome: cast_error ~1.2e-8, unit_norm_f32 ~0.99999998.
Off-serving (A-04 guard: chat.runtime never imports it). ADR-0245 status map +
plan doc updated.
[Verification]: smoke 176 passed; fast lane 11907 passed / 109 skipped (-n auto,
not quarantine/slow); 10 targeted serving-cast tests passed.
D4 Phase 3 (§2.4). Calibrates the wave-gate leakage bound γ_id via the
bracketed-local Fibonacci section search and emits a content-addressed tuning
certificate (evals/adr_0244_gamma_calibration/). Two results, kept separate:
1. The search certifies γ* = 0.2126624458513829 (cert 0079b5f2…) separating
the geometric attack signal — in-subspace rotors admitted, axis→e4/e5
tilt/boost attacks flagged (inversions excluded: ~0-leakage, handled by the
orientation floor). Pinned as identity._WAVE_LEAKAGE_BOUND; the wave path is
decoupled from alignment_threshold (legacy path + hedge bands keep it).
2. The same bound does NOT separate real live traffic. Measured on the engine,
benign final_state.F versors do not preserve span(e1,e2,e3): leakage
0.14–0.81 (mean 0.55), self-align to −0.52, 12/13 benign false-refused at
γ*, best balanced error 0.346. The calibration certifies
flag_flip_authorized=False → identity_wave_gate stays OFF.
Root cause: the shipped value axes (truthfulness=e1, coherence=e2,
reverence=e3) are nominal basis vectors, not dynamically-preserved eigenmodes;
the field evolution gives the identity subspace no dynamical anchoring. The fix
is the ADR-0246 induced-identity-action programme (preflight brief merged). The
wave gate is validated, correctly-off scaffolding — not a live gate. A slow
drift-guard test canaries any future engine change that starts preserving
identity.
Off-serving (evals/ + tests); flag-off byte-identity preserved. ADR §4a +
plan doc + memory updated with the finding.
[Verification]: smoke 176 passed; fast lane 11897 passed / 109 skipped (-n
auto, not quarantine/slow); 59 targeted gate/calibration tests passed.
Discovered before implementing Phase 1: the live identity trajectory
final_state.F carries the invariant versor_condition(F) < 1e-6 — it is a
VERSOR (even-grade operator, grades 0/2/4, exactly zero grade-1 content).
§2.1/§2.2's literal 'project psi_traj onto the grade-1 value subspace' is
therefore VACUOUS on the real runtime object: P_id(F) = 0 identically,
flagging every trajectory — a fail-closed brick. Root cause: a versor is
an operator, not a state vector; projecting the operator into a subspace
of states is a category error.
Resolution (ratified by Joshua Shay 2026-07-17): measure whether the
versor PRESERVES the value subspace, via its action on the axes
F a_i F~ (sandwich). Two per-axis measures, both empirically verified
necessary and non-redundant:
- subspace leakage = euclidean_norm(rot_i - P_I(rot_i)) — catches a
versor tilting a value axis toward an alien dimension (e4/e5);
- signed self-alignment = <a_i, rot_i>_0 — catches in-subspace
inversion (e1 -> -e1: leakage 0 but self-align -1), the concrete
realization of the ratified 'signed overlap, never abs()' decision.
Keeps the grade-1 pack axes unchanged (no pack migration) and sharpens
inalienability: identity is invariant UNDER transformation, not a frozen
state.
§4a rewritten to the operator-preservation spec (lift_axis, gram_matrix,
subspace_project, sandwich, euclidean_norm, axis_response); governance
annotation item 12 records the reframe + ratification; plan doc §3 Fact C
+ §5 Phase 1 + progress log updated.
[Verification]: docs-only ADR/plan amendment; provenance/ADR guard
(test_adr_0241_governance_p12.py) 6 passed — ADR-0244 Status line
confirmed still 'Proposed' (the item-12 ratification text is inside the
annotation/§4a, not a status flip). All acceptance numbers pre-verified
via in-tree numerical probes against algebra.cl41.
Reconciles ADR-0244 against its own D0 blockers and commits ADR-0245 as
a real companion ADR (previously a dangling reference in ADR-0244 §4).
ADR-0244 governance annotation expanded (11 items, all body text below
preserved verbatim for R&D provenance; annotation governs on conflict):
1. Q_top proof (already landed) now explicitly drops the §2.2 egress
ΔQ_top conjunct (it is a hollow, always-true discriminator).
2. §4-vs-§2 contradiction RESOLVED — new §4a is the governing spec;
§4 kept verbatim as the (contradictory) original R&D sketch.
3. §2.1 axis construction was underspecified (packs ship dim-3
directions, not 32-vectors) — resolved via a grade-1 lift at the
e1/e2/e3 slots (algebra.cl41.basis_vector), not embed_point.
4. §2.2 amended: signed overlap (never abs()'d — anti-alignment must
stay distinguishable from orthogonality); leakage norm is the
positive-definite Euclidean coefficient norm, not the indefinite
Cl(4,1) inner product (which (+,+,+,+,-) permits to vanish for
nonzero leakage).
5. Inalienability reframed as 5 testable layers (algebraic / runtime
/ pipeline / operational / semantic) — only the first is a math
guarantee.
6. Paraphrase-invariance reworded as an empirical, measured property;
Q_top conservation scoped to pure versors only (relax_to_ground
can converge to non-versor superpositions — the ADR-0243 SD-A
subtlety).
7. boundary_ids activation (currently stored, never evaluated).
8. Identity manifold is FROZEN — biography holonomy accumulates
separately and never mutates the identity subspace.
9-11. Filename correction (multimodal_lifecycle.py doesn't exist;
real file is cognitive_lifecycle.py), ADR-0245 cross-link,
theological citation labeled ESV + analogy disclaimer.
New §4a supersedes §4 with a typed, Gram/leakage-correct specification
(ManifoldConditioningError, IdentityGateRefusal, bounded/abstaining
C_id, isfinite + shape guards — no bare assert) for Phase 1/2 to build
against under TDD.
ADR-0245 committed Proposed, verbatim from the R&D export, with a
governance annotation mapping its 4 decisions + Sec 3 acceptance gate
against what the cohesion-directive arc already landed (Rust f32 GP,
_cached_eigh, digest hot-path all done; f64->f32 cast + Sec 3's
speedup/collision proofs open — tracked as D4 Phase 4/5).
Audit doc (adr-0244-cohesion-directive-audit-2026-07-17.md) wrinkles
1-2 and Q5 sequencing updated from 'pending'/'must reconcile' to
resolved, cross-referencing this landing.
[Verification]: in-worktree smoke gate 176 passed; provenance/ADR
governance pins (test_adr_0241_governance_p12.py,
test_adr_0242_topological_quarantine.py, test_third_door_cohesion.py)
30 passed — confirms ADR-0244 stays Proposed (no status flip) and no
existing ADR provenance guard was disturbed. Docs-only change, no
executable surface touched.
Comprehensive phased plan for full ADR-0244 realization (D4) plus the
ADR-0245 companion: locked design decisions (Q_top dropped from egress,
grade-1 axis lift, signed overlap, Euclidean leakage norm, frozen
identity manifold, bounded/abstaining C_id), code-verified ground truth
(Fact A dim-3 axes, Fact B two field surfaces, boundary_ids dormant),
folded-in external-review considerations, and a per-phase progress
dashboard for seamless cross-session resume after rate-limit breaks.
[Verification]: docs-only (docs/handoff/), no executable surface; smoke
deferred to Phase 0 (first phase touching governance/ADR tests).
Phase 2 merged (#56) after the brief pack was written; feat/adr-0243-phase2-lifecycle
no longer exists. Lane B's base/worktree instructions pointed at it. All three
lanes now branch off forgejo/main directly, per the actual current state.
Orthogonal docs-only fix, direct push (no code/tests touched).
Production-line brief pack for the three independent Phase 3 wiring lanes,
each grounded in fresh read-only research against the current worktree (not
assumed from the plan text):
- Lane A (discovery wiring): is_discovery_eligible + cross_band_discovery_gate
-> DiscoveryCandidate via the contemplation runner's existing sink; live
caller for propose_kappa_line_search so kappa_search_event fires. Flags a
real open question (what feeds surprise_norm for a contemplation finding)
rather than guessing.
- Lane B (sensorium corridor eval): first live consumer of the I-04 feed —
real Audio/Vision compilers -> cognitive_lifecycle -> readback -> GoldTether,
shaped like the adr_0242_v2_energy_compare fixed-replay template.
- Lane C (biography wiring): ADR-0240 harness PASS -> integrate_biography with
I-01 closure asserts and provenance recording. Flags a genuine
identity-substrate design question (mutation vs. proposal-only) for Shay
rather than picking silently.
Corrected dependency DAG: only Lane B actually depends on Phase 2's
cognitive_lifecycle module landing. Lanes A and C touch zero Phase-2 code —
every symbol they wire already exists on forgejo/main — so they can start
immediately, in parallel with Phase 2's own review, rather than waiting.
Also fixes a stale claim this research caught: the plan's substrate table
(Sec 2) named packs/en/readback_rules.py as already-landed §2.3 readback
rules. That file was deleted under audit ratchet W-006; the live substitute
is generate/realizer.py:energy_modulated_surface. Corrected in place.
Per standing production-line-pattern + no-self-dispatch doctrine: brief pack
only, dispatch is Shay's call.
[Verification]: docs-only change, no code touched; no test suite affected.
Durable handoff brief for B4 PR-1, the first implementation step of the ADR-0222
closed-world boundary: the sealed FrameVerdict type + the isolated text-frame evaluator
+ the INV-31 two-part firewall, plus the behavior-preserving _basis lift.
Red line: PR-1 is NOT a closed-world serving feature — sealed type/evaluator + INV-31
firewall only. No runtime caller, no governance integration, no session/vault/chat wire,
no perception adapter, no CWA lane, no prose lowering.
Documentation/handoff ONLY — no implementation code in this PR. Source of truth: ADR-0222 (#780).
* docs(handoff): Step-3 relational-reasoning brief pack
Four parallel-safe briefs continuing the comprehend->determine arc after #775
(one-hop relational inference, breadth 10). Ordered OWA-first per the merge-safety
sequencing — harden unknown!=false before transitive/closed-world stress it:
1. ProofWriter-OWA refusal-floor lane (measure-only; standalone wrong=0 gate, NOT a
capability-index domain) — dispatch first.
2. Transitive relational chains (strict-order predicates only; reuses the proof_chain
ROBDD search-then-verify; non-transitive predicates must refuse).
3. overlaps_event finite-verb reader surface (closes#775's known coverage gap).
4. FrameVerdict / two-sided closed-world — DESIGN ONLY, gated behind brief 1 landing
and design ratification; no answer=False path, INV-30 preserved.
Each brief carries the shared acceptance gates (independent oracle, pos+neg fixtures,
capability-index movement, replay-stable, wrong=0, INV-30 green, no template spam) +
dispatch lines. B1/B2/B3 are file-disjoint and parallel-safe; B4 is gated.
* docs(handoff): tighten Step-3 brief dispatch semantics
* docs(handoff): address gemini-code-assist review on the Step-3 brief pack
- B1 (OWA): gold extended to {True, Unknown, False}; include gold-False items
(negation entailed). determine() is True-or-refuse, so asserting True on ANY
non-True gold (Unknown OR False) is the wrong=0 breach — strengthens the floor.
- B2 (transitive): inside_of + during_event are ALSO transitive (containment);
now explicitly DEFERRED from the first cut (admit only with their own confuser
fixtures), not silently omitted.
- B3 (finite-verb): added the finite-verb QUERY surface as scope — _read_relational_clause
requires questions to start with 'is', so an overlaps_event query is unparseable
today; pin one interrogative form (Does A overlap B?) and fail-closed, else the
symmetric case refuses and yields no coverage.
Add a handoff brief with five screenshots captured by driving the real
vite-preview build with Playwright (mocked API), confirming the
full-content reveal works across the originally reported proposal queue
table, the trace propagation edges, and the trace selection rails — with
the row staying unselected on reveal (stopPropagation holds).
Verification only; no code change. Records the harness gotcha that a
role-by-name query resolves to the row, not the icon trigger.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
The only genuine epistemic lever (per the finding). Scopes the ADR-0218 path: it
is the inductive step (coherent premises + verified proof -> coherent conclusion),
fail-closed and sound, but needs a curator-certified COHERENT base that nothing
mints today (bootstrapping). Wiring buys an honesty/disclosure upgrade (verified
for proven propositional conclusions), NOT a learning fix. wrong=0 risk shifts
entirely to the curator-certified base. Three options framed (wire narrowly /
record curator-mediated-by-design / defer) with recommendation.
The docs/proposal-artifact-substrate-v1 work (#727) — wave-m-consolidation-b3.5,
core-logos-studio-plan, proposal-artifact-substrate-v1 — is the authoritative
consolidation and supersedes the parallel 'Phase A' I'd just drafted. Reconciling
to one source of truth:
- FOLD IN the one genuine gap b3.5 missed (a design review caught it): the
Calibration centerpiece undersells — the reader reads the sub-N_MIN committed
practice report.json, so on live data no class shows licensed, while the
earned state (additive 95/5/100, PROPOSE-licensed) sits in the disagreeing
ratification_queue.json. Added as a diagnosis addendum + a Deliverable-2
acceptance criterion (make the committed practice artifacts coherent; show
≥1 earned class). Data-side fix, not a re-derivation.
- FOLD IN the grouped-navigation idea: a field on the route registry
(Deliverable 1) + the organism's-loop grouping (Converse/Cognition/Evidence/
Determinism/Discipline/Substrate/Settings), with the correction that
'core-logos' is the language/manifold Studio surface, not the cognition cluster.
- REDIRECT wave-M-worthiness.md's consolidation section to point at b3.5 instead
of defining a parallel Phase A.
- SCRAP duplicates: wave-M-phaseA-briefs (duplicated b3.5) and
workbench-ui-ux-guide-brief (superseded by b3.5 Deliverable 4).
Boils the design review and the information-architecture decision into one
integration. Phase B's heart (calibration/serving discipline) is done;
Phase A (Structure & Polish) now runs BEFORE resuming Phase C because two of
its items are structural prerequisites the Cognition cluster lands into.
Key synthesis: the command-palette drift bug and the grouped-nav idea are
the SAME fix — navigation derives from one registry that also encodes
structure. Standing IA constraint: one workbench, one address space, one
Chain Rail; grouping is a wayfinding skin, never an architectural fork; no
separate workbenches (the single evidence model is the thesis); 'levels' are
depth-within-a-surface, not top-level categories.
Phase A brief pack (wave-M-phaseA-briefs):
- A1: navigation registry (one source of truth) + grouped nav by the
organism's loop (Converse/Cognition=core-logos/Evidence/Determinism/
Discipline/Substrate/Settings) + palette fix (Demos+Calibration are
currently unreachable via ⌘K; the ⌘1-0 map is stale)
- A2: Calibration earned-state — the centerpiece undersells (reads the
sub-N_MIN report.json; the earned license lives in the disagreeing
ratification_queue). Primary fix: regenerate coherent practice artifacts;
fallback: reader surfaces both with provenance
- A3: Doctrine station ('how this UI can't lie') — elevate contracts/checks
into a first-class surface; trails, larger
Parked: B4 (needs engine-side license stamping; no re-derivation),
Calibration EvidenceSubject kind.
A teach-everything, indexed docs/workbench/UI-UX-GUIDE.md: thesis + evidence
model, the 11 routes (purpose/evidence/usage/states each), the design system
+ primitives, the full keyboard map, the doctrine gates as honesty proof,
replay-in-depth, glossary. Scoped for a mid-tier model: documentation over
shipped code, accuracy-over-completeness, Markdown-only, ground every claim
in the real components. Dispatch-ready.
Wave M takes the workbench to mastery and closes its biggest design gap:
it surfaces the teaching/ratification loop but is blind to the
calibrated-learning / serving-discipline loop (gold-tether arena, reliability
gate, Wilson floor vs θ ceiling, 'the engine earns the right to guess') and
to cognition itself (pipeline stages, field substrate, identity continuity).
Lens: Anthropic + xAI as target users who'd WANT to use it.
- wave-M-worthiness.md: full plan, Phases A–E, the missing-surfaces table,
the backend-reader-first / never-re-implement-engine-math disciplines,
execution order (B→C→D, A parallel).
- wave-M-phaseB-calibration-briefs: executable Phase B pack grounded in the
real core/reliability_gate shapes (ClassTally / conservative_floor /
license_for / Action θ) and the committed report.json evidence — B1
readers (GATING, Python), B2 Calibration route, B3 wrong=0 global frame,
B4 leeway wiring. Dependency DAG + STOP gates + no-theater rules.
First R3 (Theater) piece. Reworks the stale artifact-keyed ReplayRoute into
the turn-keyed hero over the #716 sealed-replay backend, and fully retires
the dead W-026 artifact-keyed machinery on both sides (the NOT_YET_MIRRORED
comment anticipated this).
The hero makes determinism *felt*: pick a journaled turn, CORE re-executes
its prompt in a sealed fresh runtime, and the result renders as a hash
verdict (≡ equivalent / ≠ diverged) + the original/replay DigestBadges + a
leaf diff (critical weighted above informational, each with a ≠ glyph). The
'What this proves' card surfaces comparison_basis + origin_state and states
the honest limit: a divergence means nondeterminism OR origin-state
influence, never rendered on its own as a determinism failure.
Retirement (verified zero serving uses):
- Python schemas.py: removed ReplayComparison/ReplayDivergence/ReplayStatus/
ReplayDivergenceSeverity; scripts/dump-enums.py drops the two replay enums;
both snapshots regenerated (deterministic: dump == committed)
- TS: removed ReplayComparison/ReplayDivergence/ReplayDivergenceSeverity;
added TurnReplayComparison/TurnReplayDivergence (+ basis/origin/severity
unions); NOT_YET_MIRRORED now empty (every engine schema mirrored)
- badges: removed ReplayStatusBadge + ReplayDivergenceSeverityBadge +
meta/enums + their enumCoverage cases (hero renders severity inline)
- api: fetchReplayComparison/useReplayComparison -> fetchTurnReplay/
useTurnReplay (/replay/<turnId>)
- deleted ArtifactList, ReplayComparisonPanel, ReplayDiffViewer,
ReplayMetadataTable, old replay.test.tsx
- App route /replay/:artifactId? -> /replay/:turnId?; conformance row
turn-keyed (loading 'Loading turns...', empty 'No turns recorded yet.')
Tests: ReplayRoute.test.tsx (equivalence hero + honesty card, diverged
critical leaf, informational-only label, replace-mode select, j/k spine).
Full vitest 358 green; workbench Python 34 green; both snapshots deterministic.
Follow-up flagged (not in this PR to keep it focused): the artifact query
hooks (useArtifacts/useArtifactDetail/fetchArtifacts*) are now orphaned but
entangled with the still-live artifact EvidenceSubject kind — a separate
cleanup once an Artifacts route or that subject's fate is decided.
Brief: docs/handoff/wave-R3-briefs-2026-06-13.md (all four R3 pieces).
