Reconcile the living docs with the shipped Vault evidence surface:
- README "Shipped surfaces": record the Vault P0 (honest empty/unavailable
framing, #760), P1 (inspector depth + status/facet/text filters +
evidence-rail progression, #762/#763/#764), and P2 (read-only exact-CGA
recall, #766) arc as complete; enrich the Vault entry row. Read-only
throughout — no runtime controls.
- wave-R: extend the Vault surface bullet with the recall endpoint and the
P0/P1/P2 completion note + the +inf-self-match-sentinel honesty point.
- api-contract-v1: add GET /vault/entries/{index}/recall (purpose, errors,
trust boundary, cross-link to the data shape).
- data-shapes-v1: add VaultRecallHit / VaultRecall types.
- UI-UX-GUIDE: enrich the Vault row (inspector depth, filters, rail, opt-in
exact-CGA recall; read-only).
Docs-only; no code or contract behavior change.
Adds W1-T: an observational telemetry leaf for idle_tick's learning flywheel,
modeled on core.cognition.leeway (the B4 precedent). Never gates, refuses,
or alters trace_hash.
New core/cognition/backpressure.py:
BackpressureRecord(pending_proposals, candidate_backlog, cap, headroom,
contemplated_this_tick, created_this_tick, at_fixed_point, did_work)
build_backpressure_record(...) — pure function, resolves ADR-0161 cap from
env (CORE_HITL_PENDING_CAP or 256), derives headroom = max(0, cap-pending),
at_fixed_point = (candidate_backlog==0 and created_this_tick==0).
chat/runtime.py:
IdleTickResult gains backpressure: BackpressureRecord | None = None (always
set on a completed tick).
idle_tick builds the record from counts already computed (pending_proposals,
candidate_backlog, contemplated_count, created, did_work) — no new
computation, no serving-path change.
Appends one JSONL line per tick to engine_state/idle_telemetry.jsonl
(best-effort, never crashes the continuous life; accumulates across all
generations so history survives reboot independently of the checkpoint).
tests/test_idle_backpressure_telemetry.py (16 tests):
- field derivation: headroom, cap, at_fixed_point (holds + bites)
- cap resolution: default 256, env override, invalid env fallback
- firewall proof: trace_hash of a served turn is byte-identical whether
idle_tick ran before it or not (the load-bearing invariant)
- integration: record fields on a fresh runtime; telemetry written to
engine_state dir; history accumulates across ticks
All 16 tests pass. ADR-0161 cap and queue_full control logic untouched.
Close the deferred Vault item 4: a read-only endpoint proving a selected
vault entry is recallable by CORE's actual exact CGA machinery, surfaced
in the entry inspector.
Backend (read-only, cold-persisted only):
- GET /vault/entries/{index}/recall rehydrates the persisted VaultStore
(VaultStore.from_dict — bit-exact versors, no reprojection) and runs the
real VaultStore.recall using the entry's own stored versor as the query.
Exact cga_inner scan — never ANN / cosine / approximate.
- recall's +inf exact-self-match sentinel never crosses the boundary: the
genuine finite cga_inner is reported plus an exact_self_match flag. The
raw versor never leaves the engine — only content-addressed digests.
- Trust boundary: caller-controlled index -> 404 (out of range / non-int);
absent persisted snapshot -> 501. The file is never written; the live
runtime is never touched; recall is deterministic over persisted bytes.
Frontend:
- "Exact CGA Recall" inspector panel, collapsed by default so the read is
opt-in (the query hook only mounts on expand). Copy says "exact CGA
recall" / cga_inner — never similarity / relevance / score / ANN /
cosine. Honestly surfaces that a byte-identical self-match is promoted
ahead of metric ranking (CGA null-vector self inner-product ~0).
INV-24: register workbench/readers.py in VAULT_RECALL_SITES as
EVIDENCE_TELEMETRY (operator inspection evidence, not claim-shaping), and
tighten the recall-site detector to recognise VaultStore.from_dict factory
bindings so the obligation is real rather than silently bypassed.
Tests: backend 501/404/self-recall/determinism/no-mutation/JSON-safety +
API status codes; frontend collapsed-doctrine + expanded self-recall
evidence. Full workbench suite (192) + architectural invariants (61) +
vault-touching vitest (70) all green.
Adds the P5a recall-precision predicate that was listed as NOT_COVERED in
the L10 continuity lane. Closes the gap in the schema-as-proof discipline
(CLAUDE.md): every predicate must have both a *_holds test (real soak) and
a *_bites mutation test so a passing lane cannot silently miss the violation
it nominally catches.
Changes:
- runner.py: ProbeRecord dataclass + probe_at/verify_probes_at params on
run_soak(). Registers a field state (float32 bytes, matching vault's
_exact_index dtype) at a named turn and recalls it against the vault at a
later turn — including after a reboot, which is the cross-reboot claim.
- predicates.py: evaluate_p5a_recall_precision — fails if any ProbeRecord
has rank=None or rank>top_k, or if no cross-reboot probe was recorded.
- report.py: wires P5a into build_report(); probe registered at turn 1,
verified at reboot_turn+2 (intentionally before the vault's
null_project auto-reproject cycle at store_count=20, which would destroy
all CGA inner-product scores — documented as a real finding, deferred to
a follow-up increment); NOT_COVERED is now empty ().
- contract.md: P5a row in the predicate table + reprojection-boundary
scope note.
- test_l10_continuity.py: 4 tests — holds (real 6-turn soak across reboot)
+ 3 bites (rank=None, no cross-reboot probe, empty probe_records).
Key finding: vault.null_project() fires every vault_reproject_interval=20
stores and produces CGA-orthogonal versors (inner product → 0.0 with the
original), completely destroying both exact-match and ranked recall. This
is a long-horizon vault stability issue, recorded here rather than silently
avoided. The P5a probe window is constrained to the pre-reproject interval
to keep wrong=0 intact while documenting the gap.
Closes the cross-file checkpoint-atomicity gap in ADR-0156. The four
checkpoint files now live in a committed gen-NNNN/ directory; the single
atomic os.replace of a 'current' pointer file is the commit boundary.
A kill before the pointer swap leaves the prior committed generation
intact; a kill after commits the new generation. Unreferenced gen dirs
are ignored. ADR-0156's deferred parent-dir fsync is also closed.
Key changes:
- engine_state/__init__.py: begin_generation() + commit_generation() +
_resolve_dir() for all load_* methods. Flat-layout legacy checkpoints
migrate into gen-0000 on first begin_generation call. GC retains K=2
committed generations.
- chat/runtime.py: checkpoint_engine_state uses the two-phase commit;
finalize_turn_trace_hash no longer writes discovery_candidates outside
the generation sequence (the second unguarded write path is closed).
- evals/l10_continuity/runner.py: _inject_orphan_tmp updated to inject
the two orphan shapes of the generation model.
- tests/test_adr_0219_generation_checkpoint.py: 18 tests, one per
acceptance-gate bullet + biting mutation variant each.
L10 lane: all_gates_pass=true; versor_condition<1e-6 throughout.
Smoke: 95 passed. Runtime: 20 passed.
Stop the rail reading as a wall of 'not applicable to vault entries':
- each dim stage now carries a specific honest reason (intent: a stored
field has no originating user intent; authority: vault recall is
read-only; action: no emission)
- replay lights on the recorded versor_digest exactly as a turn lights
on its trace_hash — a content-addressable fingerprint, NOT a verified
replay claim (honesty contract sanctioned)
- provenance/admissibility derivations enriched (versor_digest + metadata;
epistemic_state / epistemic_status)
Fixed 7-stage spine and honesty contract preserved; labels unchanged.
Strengthened the meaningfully-fail test to cover replay + dim stages.
Make a populated vault navigable beyond opaque digests:
- status facet: 'all' + the distinct epistemic_status values present in
the loaded entries (derived, never a hardcoded closed set — the status
vocabulary is engine-owned)
- text search now reaches metadata keys/values, not just the epistemic
labels + index
- boolean facets: 'Has proposition' (propositional_form) and 'Has
promotion digest' (promotion_certificate_digest); dropped 'has replay
hash' — no such field exists
- filter-empty stays filter-empty (not persistence guidance)
No new endpoint; filters operate on already-loaded entries.
Surface a selected vault entry's real evidence instead of just
epistemic_state + a digest:
- widen VaultEntrySubjectData to carry epistemic_status + the full
metadata dict (data already reaches the inspector at runtime; this is
a type-only unlock, no new fetch/endpoint)
- inspector shows epistemic_status and epistemic_state distinctly, core
identity rows (turn, role) with honest 'not recorded' when absent,
present-only rows (corrected, energy_*, promotion_certificate_digest),
a propositional_form headline when present, copyable vault:<index> and
versor_digest handles, and a collapsible key-sorted raw metadata drawer
- curated rows key off fields that actually exist on vault entries; the
raw drawer is the catch-all as the open metadata schema grows
Exact-recall doctrine preserved: no similarity/relevance/score text.
* feat(l10): autonomous idle frontier-contemplation — the always-on life learns on its own
Frontier survey move #2, path (c): give the always-on idle life a stream of experience via
SYMBOLIC intake (not the afferent→field seam, which is deferred pending a commensurability
ruling — docs/analysis/afferent-field-ingest-scope-2026-06-15.md). The idle heartbeat
converges (idle_tick drains a finite backlog + saturates is-a closure, then does nothing
forever); this makes it autonomously MINE its frontier with no user turn.
Reuse-heavy (the mechanism largely existed): a gated idle pass wires ADR-0080 contemplation
into the always-on loop.
- core/config.py: contemplate_frontier_during_idle (default off → no behavior change).
- chat/runtime.py: idle_tick pass 2b — when on, runs core.contemplation.run_contemplation()
(mines the checked-in frontier-compare reports) and persists a reviewable ContemplationRun
to <engine_state>/contemplation_runs/idle_<substrate_hash>.json. IDEMPOTENT per frontier
(an already-mined frontier is not re-persisted → the life converges, no churn) and MEMOIZED
per session (the static frontier is mined once, not re-read every beat). SPECULATIVE-only
(ADR-0080: ContemplationFinding.__post_init__ RAISES if not SPECULATIVE → wrong=0 by
construction; never ratified here — the HITL path is untouched). IdleTickResult gains
frontier_findings.
- chat/always_on.py: run_continuous did_work + HeartbeatRecord count frontier work, so the
heartbeat/soak convergence (H3) stays honest.
- core/cli.py: `core always-on --contemplate-frontier` (explicit learning-daemon mode) +
honest per-beat log ("+N findings").
Adversarial 3-lens review (wrong=0/convergence, determinism/trust-boundary, test-vacuity)
found 7; fixed the real ones: the MEDIUM torn-write (write_contemplation_run is now atomic
temp+os.replace — the indefinite-uptime daemon expects SIGKILL mid-write, and the skip-guard
would never repair a torn canonical file), the gitignore breadth (contemplation_runs/ at any
engine-state root), the 64-bit filename truncation (full substrate_hash), and the
re-mine-every-beat cost (session memoization). Deferred + documented: the shared
contemplation miner embeds absolute report paths in finding CONTENT — a portability wrinkle
that does NOT affect wrong=0/convergence/soak determinism (those key on the content-only
substrate_hash) and touches shared code + its test surface; a follow-up.
Tests (non-vacuous): 7 — off-by-default (no behavior change), mines-when-enabled,
findings-SPECULATIVE (wrong=0), converges-idempotent, heartbeat-mines-then-converges,
mines-once-per-session (memoization), atomic-no-orphan. 55 idle/contemplation/always-on +
96 invariants/contemplation + 28 smoke green; `core always-on --contemplate-frontier` mines
end-to-end. engine_state contemplation_runs are per-life runtime state (gitignored).
* fix(l10): isolate idle frontier pass + persist frontier_findings (#758)
Three review blockers on the autonomous idle frontier-contemplation pass:
1. Daemon isolation. idle_tick's pass 2b called run_contemplation /
write_contemplation_run bare inside the always-on loop (run_continuous
wraps idle_tick in nothing but an exit-checkpoint finally), so a malformed
frontier report or a transient FS fault would propagate out and KILL the
continuous life. Wrap the optional pass best-effort (the exit-checkpoint
boundary idiom): degrade to 0 findings + RuntimeWarning, leave did_work
untouched, let a later beat retry.
2. Durable did_work explanation. HeartbeatRecord carried frontier_findings
but serialize_report omitted it and AlwaysOnReport had no run total, so
lived_life.json could show did_work=true with facts=0/proposals=0 and no
persisted cause. Persist frontier_findings per-record + total_frontier_findings.
3. Honest HITL claim. The docstring/CLI/config said findings are "reviewable
via the HITL path", but the existing HITL queue + workbench reader scan
<repo>/contemplation/runs while the pass writes <engine_state>/contemplation_runs/.
Narrow the claim to "persisted reviewable artifact, not yet in the HITL
queue" (wiring that discovery is a follow-up).
Tests: 4 new non-vacuous regressions (mining-failure degrade, write-failure
degrade, always-on loop survives frontier failure, lived_life persists
frontier_findings) — all fail against the unpatched pass. 38 L10/always-on/
workbench tests green.
The always-on PROCESS shipped (run_continuous + daemon + CLI), but the claim "it holds
over uptime" was UNFALSIFIED: the existing evals/l10_continuity soak drives the TURN loop
and is disjoint from run_continuous; the daemon path was covered only by ≤5-beat unit
tests. This lane converts "built" → "proven over horizon" for the idle path.
evals/l10_always_on/ mirrors the l10_continuity predicate/mutation harness but drives the
IDLE heartbeat: it seeds a real continuous life (held self + a cognitive turn to excite the
field), runs N beats with NO user turn, and gates four falsifiable predicates, each with a
*_holds (real soak) AND a *_bites (mutation) test per CLAUDE.md schema-as-proof:
- H1 closure — every observed idle beat versor_condition < 1e-6 (held over uptime, READ
never repaired); bites on a breached beat AND on a vacuous no-field soak.
- H2 bounded idle — a no-work beat adds NOTHING to the vault (no idle leak — invisible at
5 beats, fatal at 100k); bites on idle vault growth.
- H3 convergence — a saturated idle life SETTLES and stays settled (no re-awakening), at
rest at the end, closure intact on the tail; bites on never-settling + on re-awakening.
- H4 reboot resume — a reboot mid-soak resumes the SAME life (strict identity guard passes,
pre-reboot DERIVED learning survives, post-reboot closure holds); bites on failed
resume + on lost learning.
Measured (5000 idle beats, reboot@2500, ~20s): ALL gates pass — versor_condition flat at
1.389e-07 (no drift, no repair), vault bounded at 6 (no idle leak), converged at beat 1
with a 4999-beat at-rest tail, reboot resumed the same life with learning intact. This is
the empirical resolution of the L10 riskiest-unknown FOR THE IDLE PATH (the closure-by-
construction ruling covered the field-transition walk; this covers indefinite idle uptime).
Honestly NOT covered (recorded in the report, no silent skip): the continuously-LEARNING
life's resource cost under a sustained new-fact stream (O(n²) snapshot; per-run lived_life)
— out of scope until an afferent/intake feed + incremental persistence exist (the next
frontier).
Run on demand: PYTHONPATH=. python -m evals.l10_always_on [n_beats] [reboot_beat]. Path-
scoped out of CI smoke (like l10_continuity); runs in post-merge full-pytest. Additive — a
new eval lane, no existing files touched. 12/12 lane tests + architectural invariants green.
The wave-* planning docs record their wave, not current state. Add a
consistent "Historical record — superseded" banner to each, pointing to
README (Current Status), UI-UX-GUIDE, and the route registry as the live
sources. wave-1/R/M-worthiness/M-consolidation covered.
Docs only.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Bring the four living workbench docs up to date with what actually
shipped, and document the TruncatedCell full-content reveal.
- README: route count 14 -> 16; add Lived Life (Evidence) and CORE-Logos
(Substrate) to the shipped-surfaces table; full Trace tab list; add the
TruncatedCell reveal to cross-cutting; link the visual-evidence handoff;
bump status date.
- UI-UX-GUIDE: §12 now reflects the built read-only /logos reader vs the
unbuilt Studio; §13 moves the cognitive-pipeline visualizer, field/
versor_condition reader, and identity-continuity items from "absent" to
"shipped"; new §14 documents the truncated-cell reveal pattern + the
<a>/<Link> non-nesting boundary; bump date.
- ui-component-map: add TruncatedCell to shared data viewers.
- design-system: add the Truncated Cell Reveal shared-component note.
Docs only; no code change.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Add a handoff brief with five screenshots captured by driving the real
vite-preview build with Playwright (mocked API), confirming the
full-content reveal works across the originally reported proposal queue
table, the trace propagation edges, and the trace selection rails — with
the row staying unselected on reveal (stopPropagation holds).
Verification only; no code change. Records the harness gotcha that a
role-by-name query resolves to the row, not the icon trigger.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
The L10 heartbeat loop (run_continuous) had no process to drive it; `core always-on`
is that process — the T-experience spine made runnable. It ticks idle_tick on a wall-clock
cadence so the engine LIVES and LEARNS with no user turn, persists lived_life.json (the
workbench Lived Life surface) + the checkpoint, and resumes the SAME life on restart.
- chat/always_on.py: run_continuous gains unbounded operation (heartbeats=None, runs until
stop) + an interruptible inter-beat wait (_sleep_until_stop) so shutdown latency is one
slice, not the cadence interval. Persists the run's identity pack ids (resume-verdict
faithfulness). on_heartbeat is now best-effort (a broken log pipe can't kill the life).
- chat/always_on_daemon.py (new): the daemon shell — a single-instance OS lock (fcntl.flock:
kernel-held, atomic, auto-released on death — no stale window, no PID-reuse, no half-written
race), SIGINT/SIGTERM -> graceful stop (handlers saved/restored), the continuous-life config
FORCED on, ephemeral (--no-load-state) writes no durable artifact. Foreground + explicit:
no hidden background execution (CLAUDE.md); only writes the engine-state dir it was given.
- core/cli.py: `core always-on [--interval --max-beats --no-load-state --quiet]` with per-beat
+ summary logging; validates --interval; reports IdentityContinuityError / IncompatibleEngine
StateError (the "different life / newer build" cases) as clean refusals, not tracebacks.
- workbench/readers.py: ENGINE_STATE_ROOT now honors CORE_ENGINE_STATE_DIR (= the daemon's
resolved dir), so the workbench can't be split-brained (reading REPO_ROOT/engine_state while
the daemon writes elsewhere); the Lived Life resume verdict recomputes from the persisted
pack config, not a default config (no false substrate_changed for a non-default-pack life).
- Lived Life absence state now points at the real `core always-on` command (loop closed).
Adversarial 4-lens review (lock/concurrency, signals/shutdown, invariants/trust-boundary,
test-vacuity/CLI) caught 16 findings; this fixes all real ones — the HIGH lock races (two
daemons over one life), the env split-brain, the IO-kill, the uncaught identity/schema errors,
the unvalidated interval, the ephemeral-artifact shadow, and the resume-verdict pack-id bug —
and closes the two test-coverage gaps it flagged (real SIGTERM path + config-forcing-at-the-
runtime boundary).
Tests (non-vacuous): 11 daemon (flock live-holder refusal, leftover-lock reclaim, unbounded+
stop, interruptible sleep, forced-config-at-boundary, no-load-state guard, REAL SIGTERM
subprocess) + the reader pack-id discrimination test (fails under the old default-config bug).
245 workbench+invariants+always-on Python green; frontend tsc + vitest green; `core always-on`
verified end-to-end (bounded, real SIGTERM graceful stop, interval rejection).
engine_state/always_on.lock is runtime state (gitignored, ADR-0146 pattern).
The /health endpoint was the only W-026 API route with no UI consumer.
Surface it as a liveness indicator (colored dot + label) in the status
footer, isolated from /runtime/status so a live server still reads
"Healthy" even when runtime status is degraded.
- types: HealthStatus matching the server's {"status":"ok"} payload
- client: fetchHealth() with a short 3s timeout for fast failure
- queries: useHealth() polling every 15s, retry disabled
- footer: HealthIndicator rendered in both normal and degraded branches;
any non-ok status fails safe to "Unhealthy"
- tests: healthy / errored / non-ok / checking / survives-runtime-failure
Follow-up to #749, which deliberately scoped TruncatedCell to the
non-virtualized columnar tables and left trace edges + single-column
selection rails as-is. Wire it into those too so every truncated data
cell in the workbench has the same full-content reveal (popover +
copy + modal-for-long).
Component:
- Add `align` prop ("start" | "end"). `end` hugs the right edge and
right-justifies the display, for right-aligned columns like the trace
`to_stage` cell. Defaults to "start" (unchanged).
Wiring:
- Trace propagation edges: from_stage / to_stage (to_stage align=end).
- Trace pipeline stage rail: stage label + summary.
- Trace turns rail: prompt + surface excerpts.
- Runs rail: session_id. Replay rail: prompt excerpt. Packs rail:
pack_id. CORE-Logos pack rail: pack_id. Logos alignment rail: edge
(rich source→target display, plain-text value for copy/reveal).
- Contemplation run rail: run_id; stage-evidence ids.
- Demos rail: title; scenario trace hash.
- Proposal detail: replay-equivalence hash, evidence hashes;
proposal chain provenance.
Two row elements that were real <button>s (trace stage rail,
contemplation run row) are converted to <div role="button"> with an
Enter/Space onKeyDown handler — the codebase's established selectable-row
pattern (ProposalTable, RowShell) — so nesting TruncatedCell's button
trigger is valid HTML rather than a button-in-button.
Intentionally left as-is (documented):
- RunsRoute TurnRefRow is an <a>/<Link> row; nesting an interactive
trigger inside an anchor is invalid HTML. The surface excerpt is
reachable by following the link.
- Digests everywhere keep DigestBadge (already copy + full-value title).
- Section headings (e.g. the trace stage-detail <h3>) are not data cells.
Evidence: workbench-ui `pnpm build` (tsc -b) green; full vitest suite
535 passed / 60 files, incl. a new align assertion on TruncatedCell.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Workbench grid tables truncate dense cells (proposal ids, source kinds,
case ids/reasons, lexicon/morphology rows, artifact paths) with `...`,
leaving the full value unreachable except via a native title tooltip.
Add a reusable `TruncatedCell` (design/components): keeps the compact
display, attaches one hover/focus-revealed trigger that opens an
accessible Radix popover with the complete value (selectable, scrollable)
plus one-click copy, and — for long/structured values — an "Open full
view" button into a dynamic Radix Dialog modal. One component delivers
both the lightweight reveal and the interactive modal.
The reveal trigger calls stopPropagation, so it never steals a row's
click/select behaviour — revealing a value and selecting the row stay
independent. Digests keep `DigestBadge` (already copy + full-value title).
Wired into the non-virtualized + contents grid tables: Proposal queue
(id, source), eval wrong=0 case ledger (case id, reason), CORE-Logos
lexicon/glosses/morphology rows, and proposal artifact paths. Trace
propagation edges (short, right-aligned stage names) and single-column
selection rails / detail cards keep current behaviour.
Evidence: workbench-ui `pnpm build` (tsc -b) green; full vitest suite
525 passed / 59 files, including 5 new TruncatedCell tests (display +
title, popover reveal + copy, modal-only-for-long, no row-click bubble).
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
The L10 heartbeat (chat/always_on, #747) holds CORE alive over uptime but had no
surface. This adds the read-only Lived Life route that renders the continuous-life
evidence: the heartbeat over uptime + the resume-as-same-life verdict — both halves
of "one continuous life" on one surface.
Persist-first, never recompute engine-owned values:
- chat/always_on: serialize_report + write_lived_life persist a run deterministically
(sorted keys) to engine_state/lived_life.json; run_continuous gains an opt-in
report_path so a real continuous-life run leaves its evidence where the workbench
reads it. closure_ceiling is persisted so the artifact is self-describing.
- workbench/lived_life.py: projection + a fail-closed validate() gate — the wrong=0
analogue for the continuity surface: closure_held/closure_observed/totals/converged
are each re-checked against the per-beat measurements, and resume_status is re-checked
against identity-vs-current-substrate, so a tampered artifact RAISES rather than
rendering a false claim (a beat lying about a breached ceiling, an inflated closure,
a miscounted total, a falsely-claimed resume).
- workbench/readers.lived_life(): reads the artifact, computes the resume verdict from
the persisted identity vs the canonical engine_identity_for_config (fail-soft ->
"unknown", like IdentityContinuity). Honest absence when no run has been persisted.
- GET /lived-life + LivedLife/LivedLifeHeartbeat schemas (snapshot regenerated; the
schema-drift gate proves every field is mirrored in src/types/api.ts).
The resume verdict made felt: would_resume / substrate_changed / unknown IS the L11
reboot guarantee (a reboot recomputes identity and refuses if it differs) — so the
surface shows this life wakes up as ITSELF, not a copy. The per-reboot lineage chain
stays owned by Runs > Identity (honest cross-link).
Frontend: /lived-life route (Evidence section, route count 15 -> 16). Renders the
headline (heartbeats, closure-held-by-construction, learned-while-idle, at-rest, resume
pill), the summary, the heartbeat timeline (closure flat below the ceiling — read, never
repaired), and the resume verdict. Honest absence + ADR-0162 route conformance
(loading/error/empty), fail-closed like Vault/Calibration.
Tests (non-vacuous): 12 backend (every tamper case raises; resume tracks identity vs
substrate; run_continuous(report_path) round-trips a readable+valid artifact) + 4
frontend render tests (recorded life renders; a breached beat shows the warning, never a
false "held"; a changed substrate shows would-refuse, never a false resume; absent shows
honest absence). All workbench Python (167) + affected vitest (167) + tsc + vite build
green; architectural invariants green.
engine_state/lived_life.json is runtime state (gitignored, ADR-0146 pattern).
The 'one continuous life' telos had three built pieces (turn loop, Shape B+ resume,
idle_tick learning) but no process holding the engine alive+learning over uptime. This
adds that heartbeat loop: chat/always_on.run_continuous ticks idle_tick on a cadence so
the engine LIVES and LEARNS even when no one is talking to it, READS (never repairs) the
closure invariant as evidence each beat, and persists so the life survives interruption
and resumes as the SAME life.
Proven by 3 falsifiable soak tests (non-vacuous): lives (closure observed + held, real
field excited, ~7x under the 1e-6 ceiling); learns while idle (Step-D consolidation
DERIVES and STORES member(socrates,mortal) during idle — absent before the heartbeat,
present after); converges (saturated life stops churning); survives interruption as the
SAME life (strict identity guard enforces it on reboot + the consolidated STORED record
survives, not mere re-derivation); never repairs (field byte-identical after the run).
Safety by composition, no new authority: idle_tick stays proposal-only (HITL untouched)
+ sound proof-gated SPECULATIVE session-memory consolidation; closure owned by
algebra/versor.py (heartbeat only reads versor_condition — no hot-path repair).
Adversarial 3-reviewer panel: no-hot-path-repair PASS, wrong=0 PASS; the panel's
proof-quality findings are fixed — removed the tautological identity_continuous claim
(engine identity is config-derived, invariant by construction), reframed the resume test
to prove ACCUMULATED learning survived (stored record, not re-derivation) under the strict
identity guard, surfaced final_checkpoint_ok (no silent swallow), and softened the
docstring (this is the heartbeat LOOP a daemon runs; the daemon shell is a follow-up).
Scope: the reusable loop ships; a production daemon (CLI entry, real cadence, signals)
is a thin follow-up. Purely additive (no existing file touched).
First phase of the domain-general compositional reading layer (the comprehension
coverage wall is composition — docs/analysis/comprehension-coverage-wall-map-2026-06-14.md).
M1 is a pure PARITY refactor on the flagship logic path, no new capability:
- new generate/composition/ package: LogicChainPlan (plan.py) + lower_logic_chain
(lower_logic.py), the is-a chain lowering extracted BYTE-IDENTICALLY from
determine.py::_verify_subsumption.
- _verify_subsumption now builds a plan -> lowers it -> routes through the UNCHANGED
evaluate_entailment gate. The composer proposes structure; the sound ROBDD gate
remains the sole wrong=0 firewall.
- only the logic instantiation ships; no math lowering, no join-op vocabulary
(defer-substrate-vocab-commitment — the chain discriminates on its relational
predicate, an explicit join-op field lands when a second op dispatches on it).
Verification: byte-identical lowering (3-reviewer adversarial panel: byte-parity PASS
char-for-char, wrong=0 PASS — the instance-of-fallacy refusal mutation-proven
load-bearing); 5 new non-vacuous lowering tests; 28 determine/transitive/consolidation
+ 163-test broad sweep (incl. gsm8k serving + ADR-0218) green; cognition eval 100%.
Evidence-based map of the comprehension coverage wall (the C decision). GSM8K
diagnostic: 4/0/46, no single barrier >10%, ~24 fragmented primary barriers with
heavy multi-barrier co-occurrence (compound+comparative+fraction+coreference stack
on the same cases). Capability lanes are narrow curated-gold conformance
(combined-rate: 6 solvable shapes, 19/19 oracle). Single-shape recognizers are
proven metric-inert (4th confirmation). Diagnosis: shape-recognizers don't COMPOSE
within compound statements / across coreference. Leverage: Tier 1 recognizer
additions ~+5 cases then cap; Tier 2 compositional reading is the only real lever
(architectural, must stay wrong=0). Recommendation: don't add isolated recognizers;
design a compositional reader.
The only genuine epistemic lever (per the finding). Scopes the ADR-0218 path: it
is the inductive step (coherent premises + verified proof -> coherent conclusion),
fail-closed and sound, but needs a curator-certified COHERENT base that nothing
mints today (bootstrapping). Wiring buys an honesty/disclosure upgrade (verified
for proven propositional conclusions), NOT a learning fix. wrong=0 risk shifts
entirely to the curator-certified base. Three options framed (wire narrowly /
record curator-mediated-by-design / defer) with recommendation.
7-agent architecture audit + adversarial verification refutes the intuition that
all-speculative packs cap the model's learning. The reasoning/learning loop is
blind to epistemic_status (recall_realized ignores it; speculative facts chain to
deductive-closure fixed point). Lexicon-status promotion is compile-and-display-only
(runtime epistemic state comes from grounding_source, not the lexical row). The
verified/as_told distinction is honesty-disclosure-only and intentional. All three
coherence-promoters are dormant (proof-carrying demo-only, energy-policy default-off,
review never sets coherent). Conclusion: do NOT promote-to-coherent for learning
(cosmetic at best, false-verified wrong=0 hazard for facts); the only genuine lever
is wiring the sound, fail-closed proof-carrying path — a separate deliberate decision.
A1 (substrate fix, not UI): en_collapse_anchors_v1 declared only love/peace/justice,
but the logos packs reference covenant_love/shalom/tzedek + heart/soul/breath/holy/time.
Declare all 8 with their real ADR-0073 provenance (source-concept names where they
exist) and recompute the lexicon checksum. Now every cross_lang.no_english_collapse
edge resolves to a real declared entry — grc_logos_cognition_v1 and he_core_cognition_v1
go from 7 invalid targets to 0 (verdict warning -> unknown; never CLEAR while holonomy
proof is absent). The geometry resolves; the check is NOT suppressed (the LG-1
relation/prefix carve-out stays removed). Test updated to assert real resolution;
invalid-detection branch still covered by the ghost-target fixture.
A2: Identity tab shows the real pack manifest (now fetched via /contents) instead of
an overview projection — the actual passport, data already present.
NOTE (curation follow-up): love (Greek agape collapse) and covenant_love (Hebrew chesed
collapse) may be intentionally distinct per-language anchors or duplicates of one
concept — left both declared rather than gamble on consolidating curated theology.
Backend 25 + frontend 520 tests pass; tsc + build clean.
Measuring the holonomy tri-language resonance (intended for a Studio proof-card)
showed it is NOT a robust proof: the engine's own holonomy_similarity (CGA inner
product) anti-correlates, and the Euclidean 'aligned closer than misaligned'
claim passes only via averaging in the close Hebrew distance + one cherry-picked
negative (1.3% margin) — the aligned Greek clause is itself farther than the
negative, and the verdict flips ±20-55% under other negatives. Decoration, not
proof (CLAUDE.md, Schema-Defined Proof Obligations).
- docs/analysis/holonomy-resonance-proof-not-robust-2026-06-14.md: the rigorous
finding (numbers), why a Holonomy proof tab cannot be built honestly yet
(stays missing_evidence), and bounded research questions.
- Downgrade the two clause-resonance decoration tests to honest tripwires that
assert the true state and fail (pointing to the doc) if the resonance becomes
real. Token-pair cga_inner tests left intact + flagged as a separate, un-audited
claim.
70 holonomy-adjacent tests pass.
- New docs/workbench/EVALUATOR.md: a falsifiable 10-minute guided path for an
external technical evaluator (tour -> replay hash -> wrong=0 ledger ->
calibration arena -> logos geometry), an honest-scope section (verified
flagship = propositional entailment; GSM8K diagnostic; field = coherence-gate
not reasoner; holonomy = roadmap), and a 'verify, don't trust' section. Every
reference points at a real file/surface (checked).
- README: 'fourteen' -> 'fifteen' routes + add CORE-Logos (LG-2/3/4 drift fix);
point new evaluators at EVALUATOR.md.
Two UX wrinkles surfaced while exercising the CORE-Logos Studio:
- DAG viewport: tall, few-layer graphs (e.g. the 408x1890, 2-layer/55-node
alignment fan) were squished by viewBox-meet into an unreadable sliver. Render
at natural height (scale ~1) inside a bounded, scrollable box; small graphs are
unaffected (>= the caller height). Golden layout unchanged (layoutDag untouched).
- Click-to-copy: new shared useCopyToClipboard hook gives every copy affordance a
tooltip + transient confirmation. StatusFooter SHA now confirms 'Copied' (was a
silent copy that read as 'does nothing'); 'Read Only' is labeled a non-interactive
status (not a toggle); checkpoint-revision gains an explanatory tooltip.
DigestBadge + MetadataTable copy buttons route through the hook + gain titles.
Full workbench-ui vitest: 520 passed (+4), clean exit; tsc + build clean.
The trilingual resonance centerpiece, read-only over GET /logos/packs/{id}/alignment:
- deterministic DagViewer (he -> grc -> en longest-path) + selectable edge list;
alignmentToDag is a pure projection pinned by a golden-file layout test
- invalid alignment targets surfaced honestly (the undeclared en-collapse-*
anchors render a warning, never smoothed over)
- logos_alignment_edge evidence subject (logos_alignment_edge:<packId>/<edgeId>)
with RightInspector projection + EvidenceChainRail derivation
- holonomy stays absent: no tab, no proof card, no success element (guard test)
Full workbench-ui vitest: 516 passed, clean exit; build clean.
Read-only contents tabs over GET /logos/packs/{id}/contents:
- Lexicon (VirtualizedList + SearchInput + status/domain filters; dangling-link
flag cross-referenced from the safety report, never recomputed)
- Glosses (linked entry ids) and Morphology (operator chain rendered in schema
order — root/prefix/stem/suffix never re-sorted)
- three pack-scoped evidence subjects (logos_entry/gloss/morphology) with
logos_*:<packId>/<subId> address grammar, RightInspector projections, and
EvidenceChainRail derivations
- contents fetched eagerly on pack-select; /alignment stays deferred to LG-4
Full workbench-ui vitest: 506 passed, clean exit; build clean.
