Shay c5f0c90738 feat(derivation): math-serving reach seam — select_self_verified is policy-aware (ADR-0206 §5)

Completes the ADR-0206 §5 math-serving deferral in its own careful PR. The GSM8K
wrong=0 serving gate, select_self_verified, now takes a ReachPolicy. This changes
NO serving behavior today — it is the safe, byte-identical, sanctioned first edit to
the most wrong=0-critical line, with a live-wiring test, so a future VERIFIED
widening has a precise, proven integration point.

Why it can't actually widen yet (the tension scoping surfaced): GSM8K wrong=0 is
ABSOLUTE (zero wrong, ever); a reliability license is STATISTICAL (a 0.99 Wilson
floor); math answers aren't disclosed like the cognition path (E). So widening the
math serve on a statistical license would eventually serve a SILENT wrong. ADR-0206
§4 foresaw this: VERIFIED is "the only state that will license widening past gold,"
and it is reserved pending a canonical-comparison pass (the soundness≠correctness
gap) that is unbuilt.

Design (safe by construction):
- select_self_verified(..., policy=STRICT_POLICY). STRICT (the default every one of
  the 5 callers passes) is the prior logic verbatim — unique answer → Resolution;
  zero-verify or disagreement → refuse. Byte-identical: the pinned serving-lane SHAs
  (demo_composition 3a3d09f3, fabrication 01e1b6b7, math_teaching_corpus eaf160d1)
  are unchanged; Resolution is unchanged; no import cycle.
- A wider reach resolves a disagreement ONLY via _canonically_verified — the VERIFIED
  gate — whose body returns None (capability unbuilt). So the widening is
  STRUCTURALLY inert: a disagreement refuses regardless of policy. wrong=0 holds by
  construction, not caller discipline. A statistical reliability license is NOT
  consulted by the math path (the cognition/math asymmetry is deliberate: cognition
  discloses, math is absolute).
- test_seam_is_live_wiring injects the gate to prove the consumer fires under a wider
  reach — and STRICT still refuses even then.

Verified: smoke (90), invariants (56), governance + selfverify + ms2 (354 incl. the
new seam tests), GSM8K serving regression byte-identical (the one red,
test_serving_unchanged_by_search expecting stale 6/44, fails identically on clean
main — a pre-existing stale artifact, not this change). Three-lens adversarial review
(byte-identity/seal, structural wrong=0 inertness, no-overclaim): all held.

The real unlock — a VERIFIED canonical-comparison producer — is scoped in
docs/analysis/VERIFIED-canonical-comparison-scoping-2026-06-06.md (recommended:
back-substitution / constraint-satisfaction on a checkable problem class). Still
deferred: SITUATE (stakes), the live FEED-BACK loop, reach_level JSONL emission.

2026-06-06 15:46:14 -07:00

3.1 KiB

Raw Permalink Blame History

Math-serving reach seam (ADR-0206 §5)

Date: 2026-06-06 · Branch: feat/math-serving-reach-seam

What this is

Parameterize select_self_verified (the GSM8K wrong=0 serving gate) with a ReachPolicy, completing the ADR-0206 §5 math-serving deferral in its own careful PR. It changes no serving behavior today — it is the safe, byte-identical, sanctioned first edit to the most wrong=0-critical line, with a live-wiring test, so the future VERIFIED widening has a precise, proven integration point.

The tension it resolves (why scope-first mattered)

GSM8K wrong == 0 is absolute (zero wrong, ever).
A reliability license (Step E's mechanism) is statistical (a 0.99 Wilson floor).
Math answers are not disclosed ([approximate]) like the cognition path.

⇒ Widening the math serve on a statistical license would eventually serve a silent wrong — breaching the absolute invariant + the sealed lane SHAs. ADR-0206 §4 foresaw this: VERIFIED is "the only state that will license widening past gold," and it is reserved because it needs a canonical-comparison pass (the soundness ≠ correctness gap) that is unbuilt.

Design (safe by construction)

select_self_verified(..., policy=STRICT_POLICY):

STRICT (the default every one of the 5 callers passes): the prior logic verbatim — unique self-verifying answer → Resolution; zero-verify or disagreement → refuse. Byte-identical; the pinned serving-lane SHAs (demo_composition 3a3d09f3…, fabrication 01e1b6b7…, math_teaching_corpus eaf160d1…) are unchanged.
Wider reach + disagreement: resolve only via _canonically_verified — the VERIFIED gate. Its body returns None (the capability is unbuilt), so the widening is structurally inert: a disagreement refuses regardless of policy. wrong=0 holds by construction, not by caller discipline — even a future caller that wrongly passes a wider policy still refuses until a real VERIFIED producer exists.
A statistical reliability license is not consulted here (the cognition/math asymmetry is deliberate: cognition discloses, math is absolute).

test_seam_is_live_wiring injects _canonically_verified to return a winner and proves a wider reach then resolves the disagreement — and STRICT still refuses even then. So the seam is live wiring, not dead code; the consumer is proven for the day VERIFIED lands.

Invariants

Byte-identity — STRICT path unchanged; Resolution unchanged; no caller passes a policy; the import adds no cycle and no serialized-output change (verified: the three fast serving-lane report hashes are identical before/after).
wrong=0 — structurally inert widening; absolute invariant preserved.
No overclaim — serving is unchanged today; the docstrings say so.

Out of scope (the real unlock)

The VERIFIED canonical-comparison producer — scoped separately in VERIFIED-canonical-comparison-scoping-2026-06-06.md. Also still deferred: SITUATE (stakes), the live FEED-BACK loop, and reach_level JSONL emission (a frozen-gate re-pin).

3.1 KiB Raw Permalink Blame History