audit(L2): vault — PARTIAL

First per-layer audit of the substrate-liveness program. Establishes the
registry shape and standard of evidence for subsequent layers.

L0 (algebra primitives) is foundation; verdict CLOSED:

- 4 ADRs in scope (ADR-0001 versor invariant, ADR-0003 coordinate
  dissolution, ADR-0004 rotor as operator, ADR-0009 compositional
  physics).
- 6 modules (versor, rotor, cga, cl41, holonomy, backend); every
  module has at least 2 live-import sites outside the package and
  outside tests (38 distinct caller files overall).
- core test --suite algebra exercises every L0 module: 82 passed, 50
  skipped (Rust-parity tests, Python-only env — not a closure gap).
- Cross-layer contract pass 1 (mechanical): every exposed symbol has
  at least one downstream consumer.
- Cross-layer contract pass 2 (semantic): versor_condition < 1e-6
  invariant is measured per turn (core/cognition/trace.py:34), folded
  into deterministic trace payload, surfaced to operator via CLI, and
  gated at the eval boundary (evals/cognition/runner.py:60). Matches
  CLAUDE.md discipline of "measure and surface, don't weaken."

No cleanup performed — no dead code, no redundant modules, no
orphaned tests found at L0. Foundation is honest.

One scope-hypothesis correction: layering table cited "algebra/backend/"
(directory); reality is "algebra/backend.py" (file). Hypothesis drift,
recorded for amendment if it matters elsewhere.

Three forward-pointing notes left for downstream auditors:
- L1 should verify field propagation correctness is tested
  independently of L5's downstream versor_condition measurement.
- L2 should verify vault honors exact-CGA-recall end-to-end, not just
  at the algebra layer.
- ADR-0020 (Rust parity) is cross-cutting; audit when Rust integration
  is live rather than at any single layer.

Format established for subsequent per-layer commits. Audit progress
table in registry root tracks pending layers; resume-after-interruption
is "look at the progress table, start with the first pending layer."

docs/audit/substrate-liveness-registry.md

@@ -0,0 +1,300 @@
+# Substrate Liveness Registry
+
+**Scope:** [substrate-liveness-audit-scope](../decisions/substrate-liveness-audit-scope.md) (v2)
+**Status:** Active audit — append-only as layers are completed.
+**Discipline:** [feedback-adr-cross-reference-discipline](../../../.claude/projects/-Users-kaizenpro-Projects-core/memory/feedback-adr-cross-reference-discipline.md), [feedback-cleanup-as-you-find](../../../.claude/projects/-Users-kaizenpro-Projects-core/memory/feedback-cleanup-as-you-find.md)
+
+## Audit progress
+
+| Layer | Status | Verdict | Cleanup performed | Last audited |
+|---|---|---|---|---|
+| L0 — Algebra primitives | ✅ Audited | **CLOSED** | None — no dead code found | 2026-05-24 |
+| L1 — Field substrate | ⏳ Pending | — | — | — |
+| L2 — Vault | ✅ Audited | **PARTIAL** | None — flagged learning as wiring debt | 2026-05-24 |
+| L3 — Language packs | ⏳ Pending | — | — | — |
+| L4 — Recognition | ⏳ Pending | — | — | — |
+| L5 — Cognition pipeline | ⏳ Pending | — | — | — |
+| L6 — Chat runtime + surface composition | ⏳ Pending | — | — | — |
+| L7 — Teaching loop | ⏳ Pending | — | — | — |
+| L8 — Inter-session memory + contemplation | ⏳ Pending | — | — | — |
+| L9 — Epistemic state + verdicts | ⏳ Pending | — | — | — |
+
+L10 / L11 are not audit targets (no design to audit; flagged in scope as
+gaps the audit will surface need for).
+
+---
+
+## L0 — Algebra primitives
+
+**Audit date:** 2026-05-24
+**Auditor:** primary agent (Claude)
+**Verdict:** **CLOSED**
+
+### Scope-hypothesis correction (per audit step 0)
+
+The scope's layering table cited `algebra/backend/` (directory). Reality:
+`algebra/backend.py` (single 267-line file). Hypothesis drift, not a
+finding — recorded so the scope's layering map can be amended if it
+matters elsewhere.
+
+### ADRs in scope for L0
+
+Triaged from the broader algebra/versor/CGA keyword grep against
+`docs/decisions/`:
+
+| ADR | Title | Status | Belongs at L0? |
+|---|---|---|---|
+| ADR-0001 | VocabManifold Versor Invariant | Accepted | Yes — defines the `versor_condition < 1e-6` invariant L0 must preserve |
+| ADR-0003 | Coordinate System Dissolution | Accepted | Yes — algebraic foundation |
+| ADR-0004 | Rotor as Operator, Not Vocabulary Property | Accepted | Yes — defines rotors as L0 primitives |
+| ADR-0009 | Compositional Physics | Accepted | Yes — versor composition rules |
+
+Other ADRs surfaced by the grep but assigned to higher layers (not
+audited at L0): ADR-0006 (L1), ADR-0019 (L2), ADR-0010 (L3 identity),
+ADR-0021/0022/0023/0024/0025 (L5 policy), ADR-0020 (cross-cutting Rust
+parity, audit when relevant).
+
+### Modules in scope for L0
+
+| Module | Lines | Live-import sites (outside `algebra/`, outside `tests/`) | Test-import sites |
+|---|---|---|---|
+| `algebra/__init__.py` | 5 | (re-export shim) | — |
+| `algebra/backend.py` | 267 | 21 | 16 |
+| `algebra/cga.py` | 84 | 16 | 17 |
+| `algebra/cl41.py` | 165 | 8 | 10 |
+| `algebra/holonomy.py` | 100 | 2 | 5 |
+| `algebra/rotor.py` | 179 | 5 | 8 |
+| `algebra/versor.py` | 180 | 20 | 19 |
+
+Every module has at least 2 live-import sites outside `algebra/`. No
+dormant modules at L0.
+
+### Caller-trace evidence
+
+Sample of live callers (full grep: `grep -rn "from algebra\|import algebra" --include="*.py" | grep -v "^algebra/" | grep -v "tests/"` — 38 distinct caller files):
+
+- `field/propagate.py:23` — versor application during field propagation (L1 → L0)
+- `ingest/gate.py:33` — versor/energy at injection boundary (L1 → L0)
+- `language_packs/compiler.py:14` — versor construction during pack compilation (L3 → L0)
+- `chat/runtime.py` — versor operations in the live turn loop (L6 → L0)
+- `generate/intent_ratifier.py`, `generate/admissibility.py`, `generate/proposition.py` — versor-gated generation (L5 → L0)
+- `core/cli.py:446-469` — versor diagnostics surfaced to operator (CLI → L0)
+
+Every live caller traces back to the runtime entry through at least one
+of: `core chat`, `core eval cognition`, or the field/ingest pipeline.
+
+### Exercising suite lane
+
+`core test --suite algebra` — 13 test files, every L0 module covered:
+
+| Module | Tests in algebra suite |
+|---|---|
+| `versor.py` | test_versor_closure, test_holonomy, test_energy, test_motor, test_versor_condition_rust_parity, test_versor_apply_rust_parity |
+| `rotor.py` | test_versor_closure, test_energy |
+| `holonomy.py` | test_holonomy, test_holonomy_resonance |
+| `cga.py` | test_holonomy_resonance, test_null_cone, test_vault_recall |
+| `cl41.py` | test_vault_recall_vectorised |
+| `backend.py` | test_vault_recall_vectorised, test_vault_recall_rust_parity, test_cga_inner_rust_parity, test_geometric_product_rust_parity, test_versor_condition_rust_parity, test_versor_apply_rust_parity |
+
+**Verification:** `python3 -m core.cli test --suite algebra -q` →
+**82 passed, 50 skipped** (skipped are Rust-parity tests on a Python-
+only environment; not a closure gap).
+
+### Cross-layer contract check
+
+**Pass 1 — mechanical (consumer-exists per exposed symbol):**
+
+| Exposed symbol | Consumer evidence |
+|---|---|
+| `versor_apply` | `field/propagate.py`, `generate/stream.py`, `chat/runtime.py` (3+ live consumers) |
+| `versor_condition` | `core/cognition/trace.py:34`, `evals/cognition/runner.py:60` (gated in evals at `< 1e-6`) |
+| `normalize_to_versor` | `generate/intent_ratifier.py`, `generate/admissibility.py` |
+| `cga_inner` | `vault/store.py`, `algebra/backend.py` (`_CGA_INNER_METRIC`), `evals/lab/vault_epistemic_trace.py` |
+| `embed_point`, `is_null`, `null_project` | `vault/store.py`, `language_packs/compiler.py`, `field/operators.py` |
+| `using_rust`, `vault_recall` (backend) | `vault/store.py`, all Rust-parity tests |
+| `word_transition_rotor`, `make_rotor_from_angle` | `field/operators.py`, `generate/intent_ratifier.py` |
+| `holonomy_encode`, `holonomy_similarity` | `vault/store.py`, `evals/lab/` |
+| `N_COMPONENTS` (cl41) | `algebra/backend.py`, `algebra/cga.py` |
+
+No exposed L0 symbol with zero downstream consumers.
+
+**Pass 2 — semantic (judgment-required):**
+
+ADR-0001's `versor_condition < 1e-6` invariant is the primary semantic
+contract. Verified:
+
+- **Measured per turn:** L0's `versor_condition()` is computed and
+  folded into the deterministic trace payload (`core/cognition/trace.py:34,70`)
+  on every turn.
+- **Surfaced to operator:** displayed by `core chat` and `core` info
+  commands (`core/cli.py:398,461,469`).
+- **Gated at eval boundary:** evals refuse to count a turn as
+  `versor_ok` if `versor_condition >= 1e-6` (`evals/cognition/runner.py:60`,
+  `evals/run_cognition_eval.py:54`).
+- **NOT enforced inline as exception:** a turn with `vc >= 1e-6` still
+  completes; the violation is visible in trace + eval, not raised as
+  an error. This matches CLAUDE.md's discipline ("Do not weaken this
+  threshold to make tests pass. Fix the operator/construction
+  boundary that violated it.") — violations are surfaced for fix,
+  not catastrophically refused at runtime.
+
+**Semantic mismatches flagged for human review:** none. The contract
+is consistently consumed.
+
+### Closure criteria scorecard
+
+| Criterion | Status | Evidence |
+|---|---|---|
+| 1. Design artifact | ✅ | ADR-0001, ADR-0003, ADR-0004, ADR-0009 |
+| 2. Code artifact | ✅ | `algebra/{backend,cga,cl41,holonomy,rotor,versor}.py` |
+| 3. Live caller | ✅ | 38 distinct caller files outside `algebra/` and `tests/` |
+| 4. Exercised by suite lane | ✅ | `core test --suite algebra` — 82/82 non-skipped pass; every L0 module covered |
+| 5. Cross-layer consistency | ✅ | All exposed symbols consumed; `versor_condition` invariant measured + traced + gated |
+
+**Verdict:** **CLOSED.**
+
+### Cleanup performed
+
+**None.** Audit found no dead, redundant, superseded, or orphaned code
+at L0. Every module has live callers; every exposed symbol is consumed;
+the suite lane exercises every module; the invariant is preserved
+end-to-end.
+
+### Findings / notes for downstream layers
+
+- **L1 (Field substrate) auditor:** L0's `versor_condition` is consumed
+  at L5 (trace) and at the eval boundary, but L1 itself does not appear
+  to enforce the invariant — L1's propagation produces field states
+  that may later violate the invariant, with measurement deferred to
+  L5. Worth verifying that L1's propagation correctness is itself
+  tested independently of L5's downstream measurement.
+- **L2 (Vault) auditor:** `vault/store.py` is one of the heaviest
+  consumers of L0 (cga_inner, embed_point, is_null, holonomy_encode).
+  L2's closure depends on L0's exact-CGA-recall guarantees; the L2
+  audit should verify the vault honors the exact-match discipline
+  end-to-end, not just at the algebra layer.
+- **L6 (Chat runtime) auditor:** ADR-0020 (Phase 5 / Rust Parity
+  Sequencing) is cross-cutting; the 50 skipped tests in the algebra
+  suite are Rust-parity tests skipped in a Python-only environment.
+  Audit ADR-0020 wherever Rust integration is live (when it lands)
+  rather than at any single layer.
+
+### Audit method footnote
+
+This entry follows the per-layer audit format established here:
+ADRs in scope → modules in scope → caller traces → suite lane
+exercise → cross-layer contract (mechanical + semantic) → closure
+scorecard → cleanup → notes for downstream. Subsequent layers should
+follow the same format so the registry is uniformly machine- and
+human-scannable.
+
+---
+
+## L2 — Vault
+
+**Audit date:** 2026-05-24
+**Auditor:** primary agent (Gemini)
+**Verdict:** **PARTIAL**
+
+### Scope-hypothesis correction (per audit step 0)
+
+None. The scope's layering table correctly maps Layer L2 concerns (exact CGA recall, indexing, batching, promotion gate) to `vault/store.py` and `core/physics/learning.py`.
+
+### ADRs in scope for L2
+
+Triaged from Keyword grep (vault / recall / crystallization / promotion / settled / coherence-residual) against `docs/decisions/`:
+
+| ADR | Title | Status | Belongs at L2? |
+|---|---|---|---|
+| ADR-0014 | `train/` Learning Loop | Accepted (Stub) | Yes — specifies learning constraints and the Supervised Seeding Epoch (which owns `VaultPromotionPolicy`) |
+| ADR-0019 | Exact Vault Recall Acceleration | Accepted | Yes — defines Stages 1-3 of vectorised scan, norm-bucketing, and layered store |
+| ADR-0054 | Vault Recall: Matrix-Cache Indexing + Batched API; Holdout Split Wired | Accepted | Yes — defines `VaultStore` matrix cache, batched recall API, and `--split holdout` |
+
+Other ADRs/Scope files surfaced and assigned to adjacent layers:
+- ADR-0006: Implemented. Belongs at L1, but specifies L2 integration points (vault recall transiently raising region to E2).
+- ADR-0045: Accepted. Belongs at L6/Evals, but provides needle-in-a-haystack verification of exact recall.
+- ADR-0055: Accepted. Belongs at L8, but catalogs Tier 1 (VaultStore) as session memory.
+
+### Modules in scope for L2
+
+| Module | Lines | Live-import sites (outside `vault/`, outside `tests/`) | Test-import sites |
+|---|---|---|---|
+| `vault/__init__.py` | 10 | (re-export shim) | — |
+| `vault/store.py` | 301 | 1 (`session/context.py`) | 7 |
+| `vault/decompose.py` | 224 | 1 (`chat/runtime.py`) | 1 |
+| `core/physics/learning.py` | 33 | 0 (re-exported in `core/physics/__init__.py` but not imported downstream) | 0 |
+
+`core/physics/learning.py` (`VaultPromotionPolicy` / `PromotionDecision`) is confirmed dormant with 0 live callers outside its own package and 0 test callers. Per the L2-specific cleanup instruction, it is retained as future-wiring debt instead of being deleted.
+
+### Caller-trace evidence
+
+Sample of live callers (grep: `grep -rn "from vault\|import vault" --include="*.py" | grep -v "^vault/" | grep -v "tests/"`):
+
+- `session/context.py:25` — imports `VaultStore` for ephemeral session-level storage, storing input/output states and performing exact recall.
+- `chat/runtime.py:94` — imports `default_decomposer` and `default_gate` to perform check gates before planning.
+- `generate/stream.py:169` — invokes `vault.recall` during generation walk telemetry.
+- `vault/decompose.py:124, 179` — invokes `vault.recall` during fallback grade-split decomposition and domain gate checks.
+
+Every live caller traces back to the runtime entry through `core chat`, `core trace`, `core eval`, or the session/dialogue pipeline.
+
+### Exercising suite lane
+
+- `core test --suite algebra` — Exercises `tests/test_vault_recall.py`, `tests/test_vault_recall_vectorised.py`, and `tests/test_vault_recall_rust_parity.py`.
+- `core test --suite full` — Exercises `tests/test_vault_store.py` and `tests/test_vault_recall_indexing_batch.py`.
+
+**Verification:**
+- `python3 -m core.cli test --suite algebra -q` → **82 passed, 50 skipped**
+- `python3 -m pytest tests/test_vault_*.py -q` → **42 passed, 4 skipped**
+
+### Cross-layer contract check
+
+**Pass 1 — mechanical (consumer-exists per exposed symbol):**
+
+| Exposed symbol | Consumer evidence |
+|---|---|
+| `VaultStore` | `session/context.py:25` |
+| `VaultStore.store` | `session/context.py:149, 289, 300` |
+| `VaultStore.recall` | `session/context.py:347`, `chat/runtime.py:1643`, `generate/stream.py:169`, `vault/decompose.py:124, 179` |
+| `VaultStore.recall_batch` | None (exposed for batched querying, e.g. for offline evaluation or future batching) |
+| `VaultStore.reproject` | `session/context.py:125` |
+| `FieldDecomposer`, `default_decomposer` | `chat/runtime.py:94, 1649` |
+| `UnknownDomainGate`, `default_gate` | `chat/runtime.py:94, 1645` |
+| `VaultPromotionPolicy` | None (dormant) |
+
+No exposed L2 symbol other than the batched API (`recall_batch`) and the dormant `VaultPromotionPolicy` lacks consumption. Note that `recall_batch` is fully tested and verified in `tests/test_vault_recall_indexing_batch.py` but not called in the main production path (which uses single-query `recall` at runtime).
+
+**Pass 2 — semantic:**
+
+We verified three load-bearing invariants:
+1. **Exact-CGA-recall**: Checked `vault/store.py` and `algebra/backend.py`'s `vault_recall` and `vault_recall_batch`. There are no ANN, HNSW, cosine similarity, or other approximations on the recall path. It strictly uses vectorised exact scans via diagonal CGA inner-product metric, satisfying CLAUDE.md and ADR-0019/0054.
+2. **Promotion-path liveness**: Confirmed that `VaultPromotionPolicy` (`core/physics/learning.py`) has 0 live/test callers. Flagged clearly as wiring debt. Verdict is **PARTIAL**.
+3. **Re-thaw path**: Traced `vault.recall` callers to check if recall transiently raises the energy profile of a region to E2 (per ADR-0006 §"Integration Points"). Checked `vault/store.py` and its callers (`session/context.py`, `chat/runtime.py`). Verified that recall does **not** update or re-raise the energy class/profile of recalled entries. Flagged as `specified-not-verified-live`.
+
+### Semantic mismatches flagged for human review
+
+- **Re-thaw path integration**: The spec in ADR-0006 for vault recall to "transiently raise region to E2, then let it cool again" is not currently implemented. The system operates on exact recall returning data structures without modifying their companion field energy values or re-injecting them into the propagating field state. Flagged for review on whether this integration is needed or if the design has moved on.
+- **Batched recall usage**: `VaultStore.recall_batch` is implemented and verified but has no caller in the main runtime path. Review if it should be wired to support batch processing of turn sequences.
+
+### Closure criteria scorecard
+
+| Criterion | Status | Evidence |
+|---|---|---|
+| 1. Design artifact | ✅ | ADR-0014, ADR-0019, ADR-0054 |
+| 2. Code artifact | ✅ | `vault/store.py`, `vault/decompose.py`, `core/physics/learning.py` |
+| 3. Live caller | ⚠️ PARTIAL | `session/context.py` and `chat/runtime.py` consume store/decompose; but `core/physics/learning.py` has no live caller |
+| 4. Exercised by suite lane | ✅ | `algebra` suite lane exercises recall; `full` lane exercises store/indexing |
+| 5. Cross-layer consistency | ⚠️ PARTIAL | Exchanged symbols match expectations, but `VaultPromotionPolicy` is dormant and the re-thaw path is not wired |
+
+**Verdict:** **PARTIAL** (due to dormant promotion policy and unwired re-thaw path).
+
+### Cleanup performed
+
+**None.** Checked `vault/` files (`store.py`, `decompose.py`). Both modules have live callers and tests. `core/physics/learning.py` is dormant but retained as future-wiring debt per L2-specific cleanup rules.
+
+### Findings / notes for downstream layers
+
+- **L3 (Language packs) auditor**: Lexicons and identity packs specify aspect-class weights (e.g. yiqtol, qatal) which feed into field energy calculation (ADR-0006). Since the L2 vault recall does not currently implement the re-thaw path (raising energy back to E2), downstream language readback rules receive vaulted E0 crystalline concepts rather than transiently warmed E2 concepts. The L3 audit should look at whether language readback rules actually handle E0 vs E2 correctly at the surface.
+- **L8 (Inter-session memory + contemplation) auditor**: ADR-0055 details Tier 1 session vault (`vault/store.py`) and its relation to Tier 3/4 memory. Contemplation and memory discovery will need to query the session vault. Ensure that the lack of re-thaw path and the dormant `VaultPromotionPolicy` do not block Tier 1 to Tier 3/4 promotion/crystallization logic when those layers are audited.
+
+---
+