# M2 — Afferent Boundary

**Kind:** layer · **Parent:** CORE · **Assessor:** Opus 5 (Phase 2)
**Re-verified:** `39331dbc` (2026-07-28) — see the arc note below.
**Verified at:** `8927c563` (2026-07-27)
**Liveness:** `partial-wiring-debt` (text) / `inert` (non-text) · **Fitness:** `strained` · **Topology role:** runtime boundary

> World → field. M2 is where untrusted reality becomes admissible structure, and it is the only layer whose failure mode is *contamination* rather than error: everything downstream inherits whatever M2 admits. Its philosophical charge is that admission is an act with consequences — the gate does not merely parse, it *vouches*. Every entry point is therefore a trust boundary, and normalization is permitted here precisely because this is a declared construction boundary, not a repair site.

**Telos stages:** listen/ingest
**Macro role:** Admits input into the field under a closure-preserving construction boundary, or refuses it.


**Arc note — 2026-07-28 (`39331dbc`).** PR-7 wrote the M2 trust-boundary table (`docs/specs/runtime_contracts.md`). Measured against formation's six declared boundaries: two already met, **three are category differences and are now CLOSED** (they presuppose a persisted artifact with citations, which this boundary does not produce), one real delta — no audit record per rejection. Forensic, not containment.

---

## What it is / What it does

`ingest/gate.py::inject` is the live text path: it converts tokens into field excitation and is one of the explicitly **allowed normalization boundaries** in `AGENTS.md` — permitted because injection is construction, not drift repair. `core_ingest/` (7 modules) is the ingest compiler. `ingest/` itself is small (2 modules). OOV policy is applied at the same seam via `packs.OOVPolicy`.

`sensorium/` (59 modules — the largest non-test, non-generate package after `core/`) is the afferent track for non-text modalities, plus `sensorium.environment.falsification` (ADR-0211), a deterministic replay surface comparing expected against actual `ObservationFrame` evidence with a closed two-verdict set (`SUPPORTED` / `FALSIFIED`). Neither verdict promotes anything to reviewed memory or mutates packs, vault, identity, or policy.

**Verified at this SHA: `sensorium` is imported by neither `chat/runtime.py` nor `core/cognition/pipeline.py`.** The afferent track is off the serving path entirely — consistent with the map's `inert` label for `sensorium-afferent`, and consistent with the position paper's honest statement that vision, audio, and motor modalities are *planned, not built*: the `ProjectionHead` protocol supports them architecturally; the projection heads do not exist.

---

## Contract

- **Inputs:** raw user text; (designed) non-text modality frames.
- **Outputs:** injected `FieldState` satisfying `versor_condition < 1e-6`, OOV decisions, `ObservationFrame` evidence, falsification verdicts.
- **Invariants:**
  - Every accepted field state satisfies the versor condition **at the gate** — pin: algebra/ingest suites — status: running.
  - Normalization is allowed **only** at declared construction boundaries (`ingest/gate.py` is named explicitly); drift repair is forbidden and may not be disguised by naming.
  - Falsification bench forbids raw pixels/PCM/event streams/byte payloads/actuator traces in traces; forbids motor-efferent units in v1; forbids learned latents as substrate; forbids probabilistic confidence or tolerance thresholds in verdicts; forbids `generate/*` dependencies and vault mutation — pin: sensorium suite (21 files) — status: running.
  - Trust-boundary defaults: explicit opt-in for arbitrary execution; reject unsafe paths before filesystem access; no hidden background execution.

---

## Design vs build

- **Design:** ADR-0007 (ingest → `CandidateGeometricPressure` → `FieldState`), ADR-0211 (environmental falsification), ADR-0243 §multimodal ingress, `AGENTS.md` allowed-normalization-boundaries rule, formation's six trust boundaries as the adjacent standard (M5).
- **Build:** text path `partial-wiring-debt`; non-text `inert`.
- **Evidence:**
  - `inject` is the live serving entry — code-read — `chat/runtime.py:115 from ingest.gate import inject` — would-fail-if-absent: **yes**.
  - Sensorium is absent from both serving entrypoints — code-read (negative) — would-fail-if-absent: **n/a; this is evidence of absence**.
  - `sensorium` suite exists with 21 test files — code-read — `core/cli_test.py` — would-fail-if-absent: **yes** (the falsification bench is genuinely exercised).
  - `unified_ingest=False` (`core/config.py:243`) — measurement — the unified ingest path is built and **off by default**.

---

## Capacity

- **Designed:** any modality admitted through a closure-preserving, trust-bounded gate.
- **Measured:** text only, in production. Non-text afferent machinery is substantial (59 modules) and exercised by its own suite, but reaches no serving path.
- **Ceilings:** no projection heads exist for vision/audio/motor. The falsification bench is deliberately v1-closed (two verdicts, no probabilistic confidence, no tolerance thresholds) — a scoping decision, not a defect.

---

## Dependencies & provenance

**feeds** → M0 (field excitation), M3 (tokens, OOV decisions); **reads** → M1 (packs, OOV policy, vocabulary); **verified-by** → MV.

---

## Stage coverage

| Stage | Verdict | Evidence |
|---|---|---|
| listen/ingest (text) | **covered** | `inject` is on the live path and gate-checks closure |
| listen/ingest (non-text) | **uncovered** | Sensorium imports nowhere on the serving path; no projection heads exist |

**Zone roster:** `ingest-boundary`, `ingest-compiler`, `sensorium-afferent` (inert, **confirmed** by import evidence), `sensorium-falsification` ⚑ (live-internal; zero subsystems mapped).

**⚑ Zero-subsystem zone.** `sensorium-falsification` is the fourth unmapped zone and the only one outside M3. What is known: it corresponds to `sensorium.environment.falsification` under ADR-0211 with a closed verdict set and an explicit forbidden-list, and its suite runs. What is unmapped: internal decomposition and the boundary against the rest of `sensorium/`. The system map labels it layer **"L12"** — a stratum no other CORE document uses. That label should be either adopted deliberately or dropped; it currently exists only in a local, gitignored artifact.

**Rollup note:** weakest-link rollup, and here it is genuinely informative rather than misleading: M2's text half serves and its non-text half does not.

---

## Judgment

**Fitness: `strained`.** The text gate is sound and correctly privileged as a construction boundary. The strain is proportional: **59 modules of afferent machinery reach no serving path**, which is the largest quantity of built-and-disconnected code the assessment has located. That is not automatically waste — a deliberately staged capability awaiting projection heads is legitimate — but it is a large standing bet whose entry criterion is nowhere stated.

**Honest wrinkles:**
- The single most consequential asymmetry in this layer: **M5's formation pipeline declares six explicit trust boundaries with content-addressed inputs and outputs and an audit record for every rejection; M2 — the boundary that actually faces untrusted user text in production — has no comparable declared table.** Both are "the place the world gets in," and only one of them has a published contract of that rigor. This is a Phase 4 item and, in this assessor's reading, the strongest single hindrance-audit lead outside M6: the standard exists in-repo and has not been applied where the exposure is highest.
- `sensorium-falsification`'s "L12" layer label exists in one local artifact and no ratified document. Minor, but it is exactly how a phantom stratum enters an architecture.
- `unified_ingest` is built and off; like M5's learning flags, the gap between built and on is undocumented.
- The falsification bench's explicit prohibition on motor/efferent units in v1 is the **only** place in the corpus that takes a position adjacent to Candidate CR-3 (efferent action) — and it is a scoping constraint on one bench, not a system-level ruling. CR-3 remains unruled.

**Open questions:**
- Should M2 adopt formation's trust-boundary table format? (→ Phase 4 / ruling)
- What is the entry criterion for the sensorium track reaching serving? (→ ruling)
- Adopt or drop the "L12" label (→ Phase 1 taxonomy amendment or ruling)