investigated, four new entries from L8
Audit milestone: all 9 substrate layers audited. L8 (PR #250) and
L9 (PR #249) merged to close the audit phase. The ratchet transitions
from "audit-driven entry addition" to "wiring-progress driven
closure."
Status updates:
- W-004 ✅ CLOSED via PR #251 (first non-trivial wiring closure from
the audit). Vault recall now stamps E2 EnergyProfile per ADR-0006.
Unlocks W-005 (energy-modulated readback now meaningful).
- W-015 ⏳ INVESTIGATED via PR #252 (Sonnet). Verdict (c) confirmed
with bimodal-distribution evidence across 4,138 samples. Root cause:
_slerp_toward interpolates on S^31 but versor manifold is a proper
subset. Fix in flight (rotor geodesic via Lie group exponential).
Four new W-NNN entries from L8 audit:
- W-016 — Contemplation operates without vault probe. Independent
mechanical fix at ChatRuntime._emit_discovery_candidates call site.
- W-017 — Automated T1/T2 → T3 promotion absent (ADR-0055's own
"what is missing"). Chained: needs W-009 (HITL async queue) +
W-016 (vault probe) first.
- W-018 — ADR-0080 contemplation not autonomous. Chained: needs W-008
(L10 runtime model) first.
- W-019 — from_miner.py / from_curriculum.py test-live only. Operator
decision: CLI wiring (smallest), runtime invocation (via W-017), or
document as offline-library-only.
L9 audit added no new W-NNN entries; the refusal-reason
materialization matrix consolidates prior findings (W-011, W-012)
from the verdict-surface side. Safety, opt-in ethics, default-audit
ethics, and hedge injection all CLOSED in the matrix per design.
Updated:
- Title v3 → v4
- Subtitle "L0-L7 + L10 scope" → "L0-L9 + L10 scope"
- Dependency graph: W-004 marked FIXED, W-015 marked INVESTIGATED,
new entries placed in their dependency lanes
- Suggested next-ADR sequence reordered: W-015 fix leads (in flight),
followed by W-011, W-012, W-016 as the quick-wins lane
- Items-deferred section transitioned from "L8-L9 pending" to "audit
complete; future revisions are wiring-progress driven"
Tally so far: 5 of 19 W-NNN entries closed (W-001, W-002, W-004
fully closed; W-015 investigated and fix in flight; the rest of the
quick-wins lane is now safely dispatchable post-L9).
Instruments _anchor_pull to measure versor_condition(pulled_F) before
unitize_versor across 4,138 samples from session/chat test suites.
Verdict: (c) upstream construction violation. _slerp_toward operates on
S^31 (the 32D unit sphere) rather than the Spin sub-manifold, producing
off-manifold state with vc up to 38.58 for non-negligible field-to-anchor
angles. Distribution is strictly bimodal: vc < 1e-6 when theta ≈ 0 (slerp
is near-identity), otherwise vc >> 1e-3 — confirming the slerp is the
sole source.
Recommended fix (separate PR): replace _slerp_toward with rotor geodesic
interpolation via the Lie group exponential map (same principle as
rotor_power used in generate/stream.py:220), eliminating the post-slerp
unitize by construction.
Closes W-004 wiring debt surfaced by L2 audit (#238) and predicted
by L1 audit's forward note (#237). ADR-0006 §"Integration Points"
states: "Vault recall re-activates the region to E2 transiently,
then lets it cool again." Prior to this commit, vault.recall()
returned entries with no energy field at all — the re-thaw was
spec-only.
Changes:
- vault/store.py: import EnergyClass / EnergyProfile from
core.physics.energy. Define module-level _VAULT_RECALL_RETHAW_ENERGY
singleton (raw=0.50, energy_class=E2, mid-band). Both .recall() and
.recall_batch() stamp each returned entry with the re-thaw profile
via a new "energy_profile" key in the result dict.
- tests/test_vault_recall_rethaw.py: 6 tests pinning the contract —
recall returns E2 profile, recall_batch returns E2 profile,
singleton is byte-identical across calls (replay determinism),
empty vault is no-op, min_status filtering preserves the field,
raw value sits unambiguously in E2 band [0.37, 0.62).
Architectural notes:
- The re-thaw is *declared* by the vault, not derived through the
energy operator. ADR-0006 makes the assertion directly; vault
recall is the moment the assertion applies.
- The singleton (rather than a per-call construction) preserves
byte-identical replay: same recall sequence => identical
EnergyProfile object => stable trace if downstream folds it.
- Cool-down per ADR-0006 is downstream field propagation's
responsibility via FieldEnergyOperator's natural recency decay.
Once the recalled entry is no longer being injected into the
active field state, recency drops and energy class falls.
- "energy_profile" is added to recall result dicts, alongside the
existing "epistemic_state" field. Existing consumers (generate/
stream.py:169, chat/runtime.py:1643, vault/decompose.py:124,179,
session/context.py:347) ignore unknown keys — no breakage.
Unlocks W-005 (energy-modulated surface readback) — now that E0/E2
distinction exists at the runtime data shape, downstream readback
modulation can become meaningful instead of moot.
Verification:
- tests/test_vault_recall_rethaw.py: 6 passed
- tests/test_vault_*.py: 48 passed, 4 skipped (no regression)
- core test --suite smoke: 67 passed
- core test --suite cognition: 120 passed, 1 skipped
- core test --suite algebra: 82 passed, 50 skipped
- scripts/verify_lane_shas.py: 7/7 match pinned SHAs (byte-identity preserved)
W-015: session/context.py:207-246 post-generation unitize is
test-covered but not ADR-documented as an allowed normalization
boundary. Surfaced by L6 audit (#246) answering L1's forward note
(#237).
Per CLAUDE.md normalization rules, sanctioned unitize sites are
ingest/gate.py, language_packs/compiler.py, and algebra/versor.py.
The session/context.py site is not in that list — either an
undocumented allowed boundary or a discipline violation.
Recommended resolution path: investigate root cause first; if
unitize is masking an upstream construction violation, fix upstream.
If it's a legitimate boundary, write ADR sanctioning it. If it's
pure drift repair, refactor to remove (per CLAUDE.md "do not add
drift repair").
Updated dependency graph and suggested-sequence list to include
W-015 as a discipline-question entry.
Progress note updated: L0-L7 audited (7 of 9 layers); L8-L9 pending.
Five new wiring-debt entries from L4 (recognition) and L5
(cognition pipeline) audits:
- W-010 — L4 recognition bypasses L3 vocabulary (operator decision:
intentional token-level or wire VocabManifold consumption).
- W-011 — Typed recognition refusals dropped at pipeline boundary
(mechanical fix, small; closes recognition audit-trail gap).
- W-012 — InnerLoopExhaustion not caught in ChatRuntime.chat()
(mechanical fix, small; sibling of W-011; closes ADR-0142 debt #3).
- W-013 — core/cognition/explain.py dormant (operator decision:
wire, relocate, or delete).
- W-014 — core/cognition/provenance.py partially live, evals-only
(operator decision: lighter version of W-013).
Reordered suggested next-ADR sequence to lead with mechanical quick
wins (W-011, W-012, W-004) before operator-decision items (W-006,
W-013/14, W-010), before second-order changes (W-005), before the
big L10 unit (W-008). Reasoning documented inline: early measurable
progress, no architectural risk, demonstrates audit-to-fix loop
closes.
Updated dependency graph to show the three independent groups
(mechanical, operator-decision, L10-gated chain).
L0-L5 audited; L6-L9 pending. Ratchet stays append-only; v2 marker
in title and "L0-L5 + L10 scope" in subtitle.
The test asserts ledger status is in {reasoning-capable, audit-passed},
but ADR-0120 (PR #195, dec98ea) promoted mathematics_logic to expert
without updating this test. Test was failing on main as part of the
full suite (surfaced during PR #239 verification: Codex's versor-
threshold fix ran full suite, found this unrelated failure).
Test's docstring explicitly states the invariant is reasoning_capable
holding while "the status string moves with later promotions" — so
the fix is to extend the expected tuple, not to revert the promotion.
Cleanup per feedback-cleanup-as-you-find: the orphan was a follow-on
of ADR-0120 that should have shipped with the promotion PR.
Verified: 14/14 passing locally.
Verdict: PARTIAL.
Updates the substrate liveness registry with the L1 field substrate audit, including ADR enumeration, module/caller mapping, suite lane evidence, cross-layer contract findings, and downstream notes.
Cleanup: none; no unambiguously dead L1 code was found. Test-only helpers and pulse-only field operators are documented for review instead of deleted.
Verification: python3 -m core.cli test --suite smoke -q; python3 -m core.cli test --suite algebra -q; python3 -m core.cli test --suite pulse -q; python3 scripts/verify_lane_shas.py.
Names the missing prerequisite that recognizer-storage v2 and
substrate-liveness-audit v2 both flagged: the process shape in which
the engine accumulates capability over its lifetime, survives reboot
as recovery, and presents a narrow async HITL ratification entrypoint.
Cross-reference discipline applied up-front (per
feedback-adr-cross-reference-discipline memory entry — fourth
iteration; this time grep BEFORE draft). Existing ADRs identified
as load-bearing: ADR-0040 (telemetry sink, persistent audit trail),
ADR-0041/0042 (operator surface + audit-tour), ADR-0055 (four-tier
memory: T1 session vault → T4 ratified packs; explicitly names
"what survives across all sessions and reboots"), ADR-0056/0080
(contemplation loop), ADR-0057 (proposal review machinery this
scope must build on), ADR-0014 (vault promotion gate, currently
dormant — L2 audit will verify), ADR-0027/0029/0033 (identity/
safety/ethics packs, currently startup-loaded).
Current state honestly mapped: every entry is a one-shot CLI
command via argparse in core/cli.py; ChatRuntime is per-invocation;
no long-lived process exists.
Four sub-questions framed:
1. Process shape — long-lived daemon vs. hybrid (state externalized
+ restored) vs. one-shot CLI with audit-trail-as-lifetime.
2. State partitioning — session-state (ephemeral) / engine-state
(live, persistent across reboot) / substrate-state (cold,
persistent).
3. Reboot recovery — what verifies, what reloads vs. rederives, what
records.
4. HITL async entrypoint — queue shape, backpressure, operator
interaction model.
Cross-references shelved project-engine-identity-candidate (DNA-
analog EngineIdentity) as potential primitive if sub-question 3
demands cross-reboot identity verification. Does NOT un-shelve it;
flags trigger.
Explicit rejections: database persistence (per ADR-0055 north-star);
network primary entrypoint (per user-circumstances memory entry,
always-on-internet unsafe to assume); multi-tenant; re-architecting
ChatRuntime.
Constraints inherited from CLAUDE.md: deterministic replay, no
hidden state, HITL is narrow entrypoint, reboot is recovery not
control flow, append-only artifacts stay append-only, no drift
repair / hot-path normalization.
This is a scope, not a decision. Spike/ADR decides; audit findings
(L4-L9) inform.
First per-layer audit of the substrate-liveness program. Establishes the
registry shape and standard of evidence for subsequent layers.
L0 (algebra primitives) is foundation; verdict CLOSED:
- 4 ADRs in scope (ADR-0001 versor invariant, ADR-0003 coordinate
dissolution, ADR-0004 rotor as operator, ADR-0009 compositional
physics).
- 6 modules (versor, rotor, cga, cl41, holonomy, backend); every
module has at least 2 live-import sites outside the package and
outside tests (38 distinct caller files overall).
- core test --suite algebra exercises every L0 module: 82 passed, 50
skipped (Rust-parity tests, Python-only env — not a closure gap).
- Cross-layer contract pass 1 (mechanical): every exposed symbol has
at least one downstream consumer.
- Cross-layer contract pass 2 (semantic): versor_condition < 1e-6
invariant is measured per turn (core/cognition/trace.py:34), folded
into deterministic trace payload, surfaced to operator via CLI, and
gated at the eval boundary (evals/cognition/runner.py:60). Matches
CLAUDE.md discipline of "measure and surface, don't weaken."
No cleanup performed — no dead code, no redundant modules, no
orphaned tests found at L0. Foundation is honest.
One scope-hypothesis correction: layering table cited "algebra/backend/"
(directory); reality is "algebra/backend.py" (file). Hypothesis drift,
recorded for amendment if it matters elsewhere.
Three forward-pointing notes left for downstream auditors:
- L1 should verify field propagation correctness is tested
independently of L5's downstream versor_condition measurement.
- L2 should verify vault honors exact-CGA-recall end-to-end, not just
at the algebra layer.
- ADR-0020 (Rust parity) is cross-cutting; audit when Rust integration
is live rather than at any single layer.
Format established for subsequent per-layer commits. Audit progress
table in registry root tracks pending layers; resume-after-interruption
is "look at the progress table, start with the first pending layer."
* docs(audit): scope substrate liveness audit (system-of-systems closure)
The recognizer-storage v1→v2 revision surfaced a pattern: CORE
contains ~140 ADRs, many marked Implemented, but several have
spec-in-code that nothing live calls (e.g., VaultPromotionPolicy in
core/physics/learning.py — imported by no module outside its package).
The engine today executes a subset of its own design.
Per the operator's system-of-systems framing (human body / universe /
ecosystem: subsystems achieve closure together; a half-built layer
degrades the whole organism silently): this scope defines a layered
audit that walks from the foundation outward to identify, per ADR
and per module, which subsystems are closed (designed + wired +
exercised + cross-layer consistent), which are partial, and which
are open.
The audit method is mechanical: grep + caller-trace + end-to-end test
verification + cross-layer contract check. Two reviewers running the
audit should produce identical verdicts. No refactoring, no new ADRs,
no subjective judgment — just evidence.
The output is two artifacts: a closure registry (per-layer, per-ADR
verdicts with evidence) and a ratchet plan (wiring sequence in
dependency order). Both append-only / revisable; both committed to
the repo as audit artifacts.
First-pass layering (L0 algebra primitives → L11 forever-running
engine, with L10 runtime model named as the missing prerequisite)
is a hypothesis the audit will refine. Layers L0–L3 are expected to
be closed (foundation); L4–L9 are expected to be partial; L10–L11
are explicitly open and depend on the audit + the runtime-model
scope.
Applies feedback-adr-cross-reference-discipline (the memory entry
this revision flagged): explicit cross-references to ADR-0006/0014/
0055/0056/0057/0142/0143/0144 and the existing scope docs.
This is a scope, not an audit. Audit deliverables (registry, ratchet)
are separate work.
* docs(audit): revise substrate-liveness-audit scope to v2 (self-review fixes)
Self-review surfaced two HIGH, three MEDIUM gaps in v1. Notably,
v1 of the scope that creates cross-reference discipline still
committed the documented mistake — third consecutive iteration of
the same failure mode in one session (recognizer-storage v1
substrate overclaim → recognizer-storage v2 drop-off invention →
audit-scope v1 ADR range mis-grouping). New "Self-review
acknowledgment" section records the pattern's durability and
states the structural mitigation: the audit's mechanical
deliverables make the discipline impossible to skip silently,
which is more rigorous than the memory entry alone.
HIGH-1 — ADR range mis-grouping. v1 layering table listed
"ADR-0055..0064" as L7 (teaching loop); verification showed
ADR-0058-0064 are predominantly L6 (surface composition,
correction telemetry, cross-pack resolution). Fixed L7 to cite
only ADR-0057; added explicit note that ADR-range citations
are starting points and the audit's first act per layer is
re-enumeration.
HIGH-2 — Audit tractability buried in risks. ~140 ADRs requires
structural handling, not just a risk warning. Promoted "per-layer
commits + per-layer handoff to subagents + progress tracking in
registry + optional per-layer file splitting" to a first-class
Step 0 in the audit method. The audit is explicitly framed as the
archetypal parallel-agent handoff candidate.
MEDIUM-1 — Expected-status column anchored the auditor. v1's
table had my predictions ("Closed (foundation)", "Live but
session-bounded"). Removed; replaced with a "Where to look first"
column. Explicit note: "No expected-status column intentionally
— predictions are the failure mode this scope was meant to
prevent."
MEDIUM-2 — "End-to-end test" criterion maps awkwardly onto CORE's
suite-lane organization. Reframed Step 4 to "Identify the
exercising suite lane" with concrete `core test --suite {…}` /
`core eval …` invocations. A module whose only test coverage is
in `tests/` files not reached by any suite lane is a closure gap.
MEDIUM-3 — Cross-layer contract check was hand-wavy. Made
Step 5 explicitly two-pass: mechanical (grep for at least one
consumer per exposed field/method) carries full verdict authority;
judgment-required semantic mismatches are flagged for operator
review rather than verdicted mechanically.
LOW fixes: softened "two reviewers identical" claim; L10/L11
explicitly marked not-audit-targets; per-layer file splitting
flagged as auditor's choice; closure-criteria item 4 wording
aligned with new Step 4.
Frontmatter status bumped to "Draft v2"; date line records
revision provenance.
* docs(recognition): scope recognizer storage against existing thermodynamic substrate
Two changes:
1. New scope: docs/decisions/recognizer-storage-scope.md (draft v1).
Reframes the recognizer-storage question against ADR-0006 (field
energy operator) and ADR-0014 (vault promotion policy) — the
thawed ↔ crystallized lattice already implemented under
core/physics/{energy,learning}.py. The three-candidate framing
(pack / vault / substrate) was drafted without acknowledging this
substrate; once it's in view, the storage question collapses to:
how does a derived recognizer participate in the existing
excitation / cooling / coherence-settling / promotion / re-thaw
dynamics, and what extension is needed for HITL-gated drop-off.
Names three measurements that need definition (recognizer
excitation, coherence residual, promotion criteria), one sibling
ADR (drop-off / deprecation), and the forever-running runtime
principle. Explicitly rejects pack-as-recognizer-container,
vault-without-substrate-reframe, per-session re-derivation, and
approximate match.
2. Amendment to docs/decisions/teaching-derived-recognition-scope.md.
Appends a "Connection to existing thermodynamic substrate" section
acknowledging the three-candidate omission, citing ADR-0006/0014,
and pointing forward to the recognizer-storage scope. The original
framing is preserved for history.
Neither doc proposes a decision. Both define the question.
Process note: the omission this corrects motivated saving a project
memory (feedback-adr-cross-reference-discipline) to prevent
independent reinvention in future ADR work.
* docs(recognition): revise recognizer-storage scope to v2 (self-review fixes)
Self-review surfaced two HIGH and two MEDIUM gaps in v1.
HIGH-1 — Substrate liveness overclaim. v1 described the entire
field-energy + vault-promotion lattice as live. Verified: only the
energy half is wired (FieldEnergyOperator called by ingest/gate.py,
field/propagate.py, language_packs/compiler.py); core/physics/learning.py
(VaultPromotionPolicy) is imported by no module outside core/physics/.
Added "Substrate liveness audit" subsection that honestly accounts for
which pieces are live vs. dormant, and explicitly states that the
recognizer-storage ADR must deliver both wiring the dormant promotion
path AND extending it for recognizers as content type.
HIGH-2 — Meta-irony: v1's drop-off section invented a HITL ratification
path without cross-referencing ADR-0057's existing teaching-chain
review/replay/append-only-log machinery — exactly the failure mode the
new feedback-adr-cross-reference-discipline memory was meant to prevent.
Added explicit cross-reference: drop-off reuses ADR-0057's review-and-log
plumbing; load-bearing originality is the recency-driven trigger and
the (non-replay-equivalence) gate. Plus HITL latency named as a
load-bearing architectural constraint, not just queue plumbing.
MEDIUM-1 — "Forever-running runtime" was framed as an assumption. Honest
status: current runtime is session-bounded (core chat is a CLI; each
invocation builds a fresh ChatRuntime; no long-lived process). Reframed
as a prerequisite (own scope, gates this one), not an assumption.
MEDIUM-2 — "Substrate-resident destination" was named but never sketched,
making the IOU concrete-free. Added a one-paragraph sketch (recognizer
as versor; recognizer as null-cone region) to keep the destination
honest. Explicitly illustrative, not committed.
LOW corrections inline: recognizer-excitation temporal-direction note;
0.05 residual threshold marked as default; cold-path latency reframed
as a general vault concern recognizers inherit rather than introduce.
Frontmatter status bumped to "Draft v2"; date line records revision
provenance.
When a pinned lane drifts, the script prints actual/expected SHAs but
gives no guidance. Authors then have to look up that --update exists
and that CLAIMS.md needs regenerating alongside.
Adds a remediation block printed only on mismatch, listing the most
common drift sources (core/cognition/result.py, chat/runtime.py,
generate/realizer.py, capability registries) and the two commands
needed to re-pin: --update + generate_claims.py.
Why this is the right scope: branch protection now blocks merge on
red lane-shas CI (enabled 2026-05-24), so the remaining gap is
discoverability — telling authors what to do, not enforcing that
they do it. A one-line message change carries that signal without
adding hooks, templates, or infrastructure.
No behavior change on success.
566-line scope document defining the next recognition phase after
ADR-0144's epistemic carrier. Not a decision — defines the question
the follow-up ADR must answer.
v2 reframes from v1:
- feature-bundle outputs whose type emerges from lifted features (not
pre-decided proposition categories)
- evidence-bound lifts with span pointers + contradiction detection
for adversarial robustness
- multi-resolution decoding (chunked-first / word-by-word fallback)
Companion to docs/decisions/proposition-graph-scope.md (shipped with
ADR-0144). Anchored to the decoding-not-generating thesis.
Three lane SHA pins drifted because intentional surface/serialization
changes shipped without re-running scripts/verify_lane_shas.py --update.
Bisect attributing the drift:
- demo_composition + public_demo broke at 5cad0a4 (#118 ADR-0110
mathematics_logic → expert_demo) — the demos enumerate the expert set.
- demo_composition drifted a second time at ab4c7cb (#220 Phase 3
state tagging spine) — additional epistemic fields shifted the surface.
- domain_contract_validation broke at a45eab1 (#219 Phase 2 epistemic
bug repairs) — normative/epistemic field shape changed.
The in-tree canonical report for fabrication_control_summary was also
stale vs. its (correct) pin; refreshed here for byte-alignment.
After this commit: 7/7 lanes match pinned SHAs; verify_lane_shas.py
runs green locally and in CI.
Followup (separate PR): hook/template guard so future PRs that touch
core/cognition/result.py, chat/runtime.py, or capability registries
re-run --update before merge.
Implements the PropositionGraph epistemic carrier (ADR-0144):
recognition/carrier.py — EpistemicTransition, EpistemicNode, EpistemicGraph.
Frozen, JSON-serializable, byte-deterministic. EpistemicNode wraps a
RecognitionOutcome with an append-only provenance chain; epistemic_state
property tracks last transition's to_state or outcome.state when empty.
recognition/connector.py — epistemic_node_to_graph_node(). Maps an admitted
EpistemicNode's FeatureBundle (agent/relation/count/unit) to a GraphNode
for the generation-side articulation planner.
CognitiveTurnPipeline gains a recognizer: DerivedRecognizer | None param
(default None — all existing callers unaffected). When attached, run()
calls recognize() at the top of every turn and wraps admitted outcomes in
an EpistemicGraph. CognitiveTurnResult.epistemic_graph carries it.
RuntimeConfig.recognition_grounded_graph: bool = False — opt-in flag that
replaces the intent-derived PropositionGraph with one derived from the
admitted EpistemicNode via the connector.
RatificationOutcome gains three specific PASSTHROUGH sub-values
(PASSTHROUGH_NO_FIELD / NO_VOCAB / NO_VERSOR) for _ratify_intent
observability (ADR-0142 debt 1). All normalise to "passthrough" before
trace_hash so pre-ADR-0144 hashes are byte-identical.
24/24 acceptance tests pass; 67/67 smoke tests pass; no regressions.
* feat(epistemic): populate normative_detail on TurnEvent and ChatResponse
Adds normative_detail_from_verdicts() to core.epistemic_state and wires
it into both the stub and main ChatResponse/TurnEvent construction sites.
The field carries a sorted comma-separated list of violated boundary or
commitment IDs when normative clearance is VIOLATED or SUPPRESSED; empty
string otherwise.
* docs(ADR-0142): ratify epistemic state taxonomy — 14-state vocabulary + normative clearance axis
Formalises the six-subsystem Framing 1 audit findings into a first-class
decision. Accepts the 14-state taxonomy and companion 4-value normative
clearance axis. Documents Phase 3 deliverables already landed and defers
structured provenance + cross-subsystem transition machinery to ADR-0144.
* feat(recognition): output contract + ADR-0143
Adds recognition/outcome.py: RecognitionOutcome, FeatureBundle,
BoundFeature, EvidenceSpan, NegativeEvidence, the three typed refusal
classes (ShapeRefusal, FeatureEvidenceRefusal, FeatureConsistencyRefusal),
and RecognitionProvenance. Frozen dataclasses, JSON-serializable,
byte-deterministic invariants enforced in __post_init__.
ADR-0143 commits to Mechanism D (multi-resolution anti-unification over
token sequences) and defines the two-phase acceptance test.
* feat(recognition): derive phase1 anti-unifier
Adds recognition/outcome.py: RecognitionOutcome, FeatureBundle,
BoundFeature, EvidenceSpan, NegativeEvidence, the three typed refusal
classes (ShapeRefusal, FeatureEvidenceRefusal, FeatureConsistencyRefusal),
and RecognitionProvenance. Frozen dataclasses, JSON-serializable,
byte-deterministic invariants enforced in __post_init__.
ADR-0143 commits to Mechanism D (multi-resolution anti-unification over
token sequences) and defines the two-phase acceptance test.
* feat(epistemic): populate normative_detail on TurnEvent and ChatResponse
Adds normative_detail_from_verdicts() to core.epistemic_state and wires
it into both the stub and main ChatResponse/TurnEvent construction sites.
The field carries a sorted comma-separated list of violated boundary or
commitment IDs when normative clearance is VIOLATED or SUPPRESSED; empty
string otherwise.
* docs(ADR-0142): ratify epistemic state taxonomy — 14-state vocabulary + normative clearance axis
Formalises the six-subsystem Framing 1 audit findings into a first-class
decision. Accepts the 14-state taxonomy and companion 4-value normative
clearance axis. Documents Phase 3 deliverables already landed and defers
structured provenance + cross-subsystem transition machinery to ADR-0144.
* feat(epistemic): add first-class state enums
* feat(epistemic): tag TurnEvent with state axes
* feat(epistemic): serialize turn state axes
* feat(packs): tag curated and inferred unit entries
* feat(epistemic): expose word-level state on manifold
* feat(epistemic): expose vault status mapping
* feat(epistemic): preserve pack entry states through compiler
* test(epistemic): cover phase 3 state tagging spine
* feat(runtime): wire epistemic_state + normative_clearance into ChatResponse
Add first-class epistemic_state and normative_clearance fields to
ChatResponse (defaulting to "undetermined"/"unassessable" for backward
compat). Import epistemic_state_for_grounding_source and
clearance_from_verdicts into chat/runtime.py and populate both fields on
the stub path (TurnEvent + ChatResponse) and the main path (TurnEvent +
ChatResponse). Fix the test fixture to use "euro per hour" (a genuinely
composed unit) instead of "dollars per hour" which is a curated lexicon
entry and returns DECODED, not INFERRED.
* test(cognition): update term_capture_rate baseline from 0.9167 to 1.0
unknown_logos_019 now correctly surfaces "light" as a pack-resident
token near the logos versor — producing term_capture_rate 1.0 on both
main and Phase 3. The 0.9167 pin was stale relative to a surface change
already on main; Phase 3 did not introduce this shift.
* docs(epistemic-scope): mark Framing 1 audit complete across all six subsystems
Teaching pipeline (47 pts, 0 new states), cognition pipeline (42 pts,
0 new states, 1 EPISTEMIC_STATE_NEEDED placeholder), and chat runtime
(47 pts, 0 new states, 6 provenance gaps) audits complete. Taxonomy
confirmed stable; remaining work is implementation debt and provenance,
not taxonomy extension.
* feat(epistemic): add first-class state enums
* feat(epistemic): tag TurnEvent with state axes
* feat(epistemic): serialize turn state axes
* feat(packs): tag curated and inferred unit entries
* feat(epistemic): expose word-level state on manifold
* feat(epistemic): expose vault status mapping
* feat(epistemic): preserve pack entry states through compiler
* test(epistemic): cover phase 3 state tagging spine
* feat(runtime): wire epistemic_state + normative_clearance into ChatResponse
Add first-class epistemic_state and normative_clearance fields to
ChatResponse (defaulting to "undetermined"/"unassessable" for backward
compat). Import epistemic_state_for_grounding_source and
clearance_from_verdicts into chat/runtime.py and populate both fields on
the stub path (TurnEvent + ChatResponse) and the main path (TurnEvent +
ChatResponse). Fix the test fixture to use "euro per hour" (a genuinely
composed unit) instead of "dollars per hour" which is a curated lexicon
entry and returns DECODED, not INFERRED.
* test(cognition): update term_capture_rate baseline from 0.9167 to 1.0
unknown_logos_019 now correctly surfaces "light" as a pack-resident
token near the logos versor — producing term_capture_rate 1.0 on both
main and Phase 3. The 0.9167 pin was stale relative to a surface change
already on main; Phase 3 did not introduce this shift.
* fix(epistemic): make empty resonance evidence undetermined
* fix(evals): classify verified realizer failures separately
* fix(packs): treat absent domain manifests as valid noop
* test(packs): cover missing manifests and scope boundary domains
* test(epistemic): cover phase 2 known bug fixes
* fix(vault): make FALSIFIED exclusion explicit in _status_admits
FALSIFIED entries previously fell through to the ADMISSIBLE_AS_EVIDENCE
set-check, which excluded them correctly but left the distinction between
CONTRADICTED (FALSIFIED) and UNVERIFIED-POSSIBLE (SPECULATIVE) implicit.
Add an early guard so FALSIFIED is explicitly rejected before the tier
filter, matching the CONTRADICTED semantics from the epistemic taxonomy.
Vault, language-packs, and runtime-packs audits complete. Findings:
- Ratifies INFERRED (14th epistemic state): derived from DECODED
primitives by ratified deterministic rule; composite never curated.
Grounded by language_packs composition rules (per/square/cubic unit
synthesis). Sits between DECODED and UNVERIFIED-POSSIBLE in the
epistemic progression.
- Ratifies normative clearance axis as orthogonal companion to the
epistemic axis. Safety/ethics verdicts are not epistemic states;
they answer a different question (normative compliance vs. truth-
value). Four clearance states: CLEARED, VIOLATED, UNASSESSABLE,
SUPPRESSED. Every proposition in ChatResponse/TurnEvent carries
both an epistemic_state and a normative_clearance tag.
- Closes open question 5 (identity/safety/ethics interaction):
identity grounds the epistemic axis; safety/ethics live on the
normative axis; they coexist without collapsing.
- Updates RecognitionOutcome shape with both axes.
- Marks all four subsystem audits complete in Framing 1 block;
documents vault implementation debt (_status_admits conflation)
and deferred candidate (COMPOSED_RECOGNITION).
- Records four Phase 2 implementation bugs in summary:
evidence.py empty-pairs silent-FALSIFIED, runner DECODED-
UNARTICULATED misclassification, domain_contract present=False
inconsistency, _status_admits FALSIFIED/SPECULATIVE conflation.
Taxonomy is now stable. Phase 2 (bug fixes) and Phase 3 (first-class
state tagging in ChatResponse/TurnEvent) are the remaining work.
Math-subsystem audit (40 decision points, 9 files) confirmed the 9-state
starter taxonomy was too coarse. Ratifies four new states surfaced as
EPISTEMIC_STATE_NEEDED gaps:
- EVIDENCED-INCOMPLETE: lift completed for a sub-span; proposition
structurally partial but not contradicted (grounded by orphan-rate
refusal in math parser)
- DECODED-UNARTICULATED: trace is replay-equal; surface realization
path broke — exposes a runner misclassification where RealizerError
on a verified trace is currently outcome="wrong"
- SCOPE_BOUNDARY: engine recognized the proposition type; refuses
because the type is outside the current capability envelope, not
because the lift failed
- COMPUTATIONALLY_BOUNDED: search budget exhausted before answers were
enumerated; distinct from AMBIGUOUS (no answers compared) and
UNDETERMINED (text likely has structure)
Also: updates primitives mapping table, marks Framing 1 audit complete
for math subsystem, closes the "too coarse" risk item (9 → 13 states),
and records the runner misclassification as a load-bearing correctness
issue for the next runner revision.
* feat(ADR-0141): multiply as CGA dilator versor (positive non-zero)
Adds `multiply(scale)` to `generate/math_versor_arithmetic.py` as the
standard CGA dilator for multiplicative scaling along e1, restricted to
`scale > 0`. All ten ADR-0141 assertion families pass.
Preliminary measurement confirmed:
N = n_o ∧ n_inf: component -1 at index 15 (blade (3,4) = e4∧e5)
N² = +1.0 (pure scalar) → closed-form D_s = cosh(α/2) + sinh(α/2)·N
n_o · n_inf = -1; n_o² = n_inf² = 0
Because N² = +1, the cosh/sinh expansion is exact in float64 and
D_s · ~D_s = cosh² − sinh² = 1 holds to machine epsilon.
The sandwich D_s·X·~D_s produces a null point with n_inf normalization
1/s. `decode_quantity` is updated to divide by that factor, recovering
value · s. For translator outputs (normalization = 1) the result is
identical to the previous direct e1 read; all 152 prior add/subtract
tests pass unchanged.
`embed_quantity` is updated to embed directly in float64, eliminating
float32 quantization error for values like 0.01 (float32(0.01) ≠ 0.01);
all prior test-case values were exactly representable in float32.
* docs(ADR-0141): add decision document for multiply-as-dilator spike
The ADR doc was drafted in a separate branch and not present when the
implementation worktree was created from origin/main. Adding it now so
the decision record lands on main with the implementation it specifies.
Content unchanged from the draft — same spec the implementation already
satisfies (10 assertion families, fixed test cases, falsification
discipline, deferred scope for negative / zero / divide / Rate).
No code or test changes in this commit.
Extends generate/math_versor_arithmetic.py with one new function:
def subtract(addend: float) -> np.ndarray:
return translator(-float(addend))
Single-line delegate to translator(); no new algebra.
Adds tests/test_arithmetic_subtract_and_group.py covering all nine
ADR-0140 acceptance families:
Families 1-6 (ADR-0139 families applied to subtract):
1. Embedding well-formedness — null cone preserved for subtract cases
2. Translator-of-negative well-formedness — versor_condition < 1e-6
3. Closure — sandwich result stays on null cone
4. Arithmetic correctness — decoded value == a − b within 1e-9
5. Replay determinism — byte-identical across runs
6. Composability — subtract(c) ∘ subtract(b) decodes to a − b − c
New group-property families (structural verification of ADR-0139 claim):
7. Inverse composition — T_{-b} * T_b = identity (max residual: 0.000e+00)
8. Round-trip closure — versor_apply(T_{-b}, versor_apply(T_b, X)) → (a, u)
9a. Sum composition — T_a * T_b = T_{a+b} (max residual: 0.000e+00)
9b. Commutativity — T_a * T_b byte-equals T_b * T_a (all 10 cases)
All 96 tests pass. Group residuals are exactly 0.0 in float64.
The additive subgroup of Cl(4,1) translators along e1 is abelian and
closed; ADR-0139's algebraic claim holds at the group level.
First step of the Engine A lift program (CLAUDE.md commits the project to a
single deterministic cognitive engine; Engine B / math pipeline was always
intentional scaffolding per math_solver.py:24). Proves the load-bearing
unknown: one arithmetic operation can be represented as a closed versor at
the required tolerance, with no new normalization and no weakened invariant.
Scope (frozen by ADR-0139):
- One operation: add
- Single-axis embedding: quantities on e1 axis
- No graph wiring, no pipeline integration, no GSM8K case routed
- Unit carried as caller metadata
Construction:
- embed_quantity(v, u) = embed_point([v, 0, 0]) (existing CGA primitive)
- translator(b) = 1 - 0.5 * (b*e1 * n_inf) (textbook CGA translator)
- decode_quantity(F, u) = (F[1], u) (e1 coordinate)
Measured values (all 11 fixed cases + composability):
a b vcond(T) |<R,R>| decode_err
0.0 0.0 0.000e+00 0.000e+00 0.000e+00
0.0 1.0 0.000e+00 0.000e+00 0.000e+00
1.0 0.0 0.000e+00 0.000e+00 0.000e+00
3.0 4.0 0.000e+00 0.000e+00 0.000e+00
7.0 -3.0 0.000e+00 0.000e+00 0.000e+00
0.25 0.75 0.000e+00 0.000e+00 0.000e+00
1.5 2.5 0.000e+00 0.000e+00 0.000e+00
-5.0 5.0 0.000e+00 0.000e+00 0.000e+00
-2.0 -3.0 0.000e+00 0.000e+00 0.000e+00
100.0 1.0 0.000e+00 0.000e+00 0.000e+00
1.0 100.0 0.000e+00 0.000e+00 0.000e+00
compose (2, 3, 5) → 10: |<R2,R2>| = 0.000e+00, decode_err = 0.000e+00
Every residual is exactly 0.0 in float64. The construction is algebraically
closed: T_t * reverse(T_t) = 1 - 0.25*B^2 where B = t*n_inf, and B^2 = 0
because (e14)^2 + (e15)^2 = -1 + 1 and cross-terms cancel. No machine-epsilon
drift accumulates because the relevant cancellation happens at the algebraic
level before float arithmetic.
ADR-0139 acceptance items 1-6 (one parametrized test family each):
1. Embedding well-formedness — test_family1_embedding_is_null (11 cases)
2. Translator well-formedness — test_family2_translator_unit_versor (11 cases)
3. Closure — test_family3_sandwich_preserves_null (11 cases)
4. Arithmetic correctness — test_family4_decode_matches_sum (11 cases)
5. Replay determinism — test_family5_replay_byte_identical (11 cases)
6. Composability — test_family6_two_translators_compose (1 case)
Total: 56 tests, all passing.
Lift program decision: proceeds. Follow-on ADRs (subtract, multiply, Rate,
compare, MathProblemGraph → PropositionGraph, pipeline integration, first
GSM8K case end-to-end through Engine A) are now justified by a concrete
algebraic foundation rather than design speculation.
Out of scope per ADR-0139:
- No modifications to algebra/, core/cognition/, chat/, math_solver.py,
math_verifier.py, math_realizer.py, math_candidate_parser.py
- No GSM8K runner changes
- No pack changes
- Engine B continues serving GSM8K unchanged; the 3/50 admission set is
preserved
CLI lanes intentionally not run — main has known test-rot orthogonal to
this PR. The 56 new tests are self-contained and the diff touches only
three new files.
Adds a 3-line TODO comment above `_score_one_candidate_graph` in
evals/gsm8k_math/runner.py. No behavior change.
Flags that `report.json` metrics may not credit candidate-graph
admissions routed through this branch (Stage 1 candidate-graph
parse + internal solve path) the same way `_score_one` admissions are
credited. Aggregation in calling code needs an audit before the
canonical run.honest_runner.json artifact can be trusted for
cross-phase comparison.
This is Piece A of a three-piece hygiene split. The MEMORY.md
compaction and worktree audit pieces are deferred — they need
human judgment (re-shaping vs. truncating) and an OS-correct date
predicate (BSD vs. GNU), neither of which fits a one-shot script
pass.
No tests run — this change is comment-only and has zero runtime
effect.
* content(packs): update relations checksum
* revert transient relations manifest checksum
* content(packs): extend relations lexicon additively
* content(teaching): extend relations chains additively
* content(packs): ratify relations manifest checksum
* test(packs): accept additive relations lemma extension
* test(packs): add relations v1 extension regressions
* fix(tests): align relations extension lemma set
* content(packs): add relations mastery report
* content(packs): drop unused .mastery_report.json sidecar
Language packs do not consume mastery reports — the pattern is from
identity packs (packs/identity/) and has no consumer in language_packs/
loader.py or compiler.py. The added sidecar's self-seal hash also did
not validate against sha256(json.dumps(body, sort_keys=True,
separators=(',', ':'))).
Drop the file. The actual ratification surface for this pack is the
manifest.json lexicon_checksum, which still matches lexicon.jsonl
bytes (verified).
A small typed linguistic layer (FractionOperand, ComparativeOperand,
QuantityReference, ReferenceTarget) replacing the closed-and-deferred
ADR-0137 with a shape-driven design. Justified by the rescan-v3 ledger
showing 7 cases under fraction_operand + compound_comparative that
share a common deep structure (value relative to literal or
prior-sentence anchor) with multiple surface shapes.
Key commitments:
- Three typed phrase structures handle the closed surface set
(frac/percent of X, N times as much/greater than X, frac more/less
than X), where X is either a sentence-internal literal or a
QuantityReference to a prior grounded quantity.
- Binding pass is minimal: sentence-order lookup of QuantityReference
against prior grounded candidates with unique-match gating. No
generic DeferredCandidate apparatus.
- Pinned English convention: "N times greater" = N+1 multiplier
(documented + tested). Other reading requires explicit revisit.
- Supersedes ADR-0137 in scope; the deferral note's reopen criterion
is met by this lighter, more specific design.
- S.1/S.2 short-circuits stay as joins of grounded candidates;
this ADR does not subsume them.
Forcing case for cross-sentence binding: gsm8k-0029 ("three times
greater than the cost of the mouse" + "the mouse cost $16"). Clean,
unambiguous, two-sentence binding.
Self-correction caught before push: gsm8k-0010 was initially framed
as the forcing case, but its expected dataset answer requires a
non-standard English parse of "1/4 more than X" (the natural reading
gives 17; the dataset says 9, requiring X/4 + 7). Per non-negotiable
#2 the binding pass MUST refuse on this; 0010 is reclassified from
"expected admission" to "negative probe." 0029 takes the forcing-case
slot.
Honest expected admission delta: +1 to +2 (0005, 0029 high
confidence; 0041, 0043 partial credit only).
In scope: in the same PR family, fix the issue gsm8k-0029 surfaces by
implementing the binding pass. Out of scope: inverse arithmetic
(0004), multi-term aggregate references (0036), pronoun anchoring,
self-referential cycles.
S.4 extends initial-state parsing with two closed subject-slot widenings:
- Indefinite-article: `A <noun> has N <unit>` (gsm8k-0046 sentence 1)
- Prepositional-prefix existential: `In a <place>, there are N <unit>...`
(gsm8k-0038 sentence 1)
Design choice: sibling regexes (_INITIAL_HAS_INDEF_RE,
_INITIAL_THERE_ARE_PREFIX_RE) rather than widening the global _ENTITY
pattern — preserves existing behavior across all other initial-state
extractors (cascade-safety).
Per the S.x corridor discipline: no new short-circuit; new candidates
flow through extract_initial_candidates and the existing graph machinery.
No solver/graph/verifier changes.
Honest delta:
- Direct admissions: 0 (admission set unchanged at {0014, 0018, 0042})
- Barrier shifts: +2 (gsm8k-0038: novel_initial_form → compound_comparative;
gsm8k-0046: novel_initial_form → fraction_operand)
- wrong == 0 on every lane
Bundled with this PR for ledger currency:
1. tests/test_rescan_v3_invariants.py refactored to read frozen on-disk
v3 artifacts only (no more re-running build_rescan against live
parser). The previous design tied a historical snapshot to live code
and broke the moment any new phase landed.
2. rescan_v4.py + refusal_rescan_v4.json + refusal_taxonomy_v4.json +
tests/test_rescan_v4_invariants.py — the current live snapshot.
Shifts: exactly 2 (0038, 0046). Same pattern as v3.
Sonnet wrote: S.4 parser/axis-lane/tests/ADR.
Opus wrote: rescan_v4.py + v3 test refactor + bundling.
Files:
- generate/math_candidate_parser.py (+142 lines)
- evals/math_capability_axes/S4_novel_initial_form/v1/ (20-case lane)
- tests/test_adr_0136_S4_novel_initial_form.py (40 tests)
- docs/decisions/ADR-0136.S.4-novel-initial-form.md
- evals/gsm8k_math/train_sample/v1/{rescan_v4.py, *_v4.json}
- tests/test_rescan_v4_invariants.py (8 tests)
- tests/test_rescan_v3_invariants.py (refactored to artifact-only)
Re-runs parse_and_solve on the 50-case GSM8K train sample on current
main (post-S.3) and compares to v2. Result: admitted=3/50 (unchanged),
wrong=0, exactly 1 barrier shifted v2→v3.
Shift: gsm8k-0010 (compound_statement → fraction_operand). S.3's
_INIT_MUTATION_RE resolves "Yun had 20 paperclips initially, but then
lost 12" to InitialPossession(Yun, 8, paperclips). First refusal moved
to sentence 2: "Marion has 1/4 more than what Yun currently has, plus
7" — needs fraction-operand + coreference-quantity + comparative-additive
arithmetic.
Top blockers (v3):
compound_statement 5 (was 6)
novel_initial_form 5 (unchanged)
fraction_operand 4 (was 3 — gsm8k-0010 moved here)
novel_initial_verb 4 (unchanged)
Artifacts:
- evals/gsm8k_math/train_sample/v1/rescan_v3.py
- evals/gsm8k_math/train_sample/v1/refusal_rescan_v3.json
- evals/gsm8k_math/train_sample/v1/refusal_taxonomy_v3.json
- docs/decisions/ADR-0136.S3-post-rescan.md
- tests/test_rescan_v3_invariants.py (7 tests; determinism + admission
set unchanged + exactly-one-shift + 0010-specific shift assertions)
PR #204 (ADR-0137 retrospective binding, rescoped to subsumption-only)
was drafted then closed without merging. The deferral reason is
structural: the DeferredCandidate/BindingProof apparatus is the right
shape for true retrospective binding (first-pass candidate has open
slots awaiting later evidence), but re-examination showed neither S.1
nor S.2 short-circuit fits that definition — both join two fully
grounded candidates. With no kind that has open slots in the v2
ledger, the machinery would degenerate to a join everywhere, which is
speculative infrastructure ahead of a forcing function (CLAUDE.md
warns against this pattern).
Update appended to the post-rescan notes so the deferral lives in the
repo, not just in a closed PR thread. Includes a reopen criterion:
ADR-0137 (or successor) may return when a case appears whose first-pass
candidate has genuinely open slots only later-sentence evidence can
close. Until then the unlock vehicle is S.x.
The S.1/S.2 short-circuits remain as tactical bridges; the canonical
runner staleness is better fixed in the runner than in a binding
layer.
Measurement-only branch. Re-runs parse_and_solve on all 50 GSM8K train-sample
cases against the current parser (post-S.1/S.2) and produces a barrier-shift
ledger comparing v1 taxonomy to current behavior.
Results: admitted=3/50 (0014, 0018, 0042), wrong=0, barrier_shifted=27/50.
Context-filler dominance collapsed from 23→3 cases; compound_statement (6)
and novel_initial_form (5) are now the largest buckets.
Subsumption directive pinned: ADR-0137 SHALL re-derive all short-circuit
admissions as (DeferredCandidate, evidence, BindingProof) triples.
