core/docs/decisions/ADR-0142-epistemic-state-taxonomy.md

ADR-0142: Epistemic State Taxonomy — First-Class Vocabulary

Status: Accepted (integration deferred pending ADR-0144) Date: 2026-05-24 Supersedes: none Related: epistemic-state-taxonomy-scope, ADR-0021 (teaching safety), ADR-0024 (refusal materialisation), ADR-0144 (PropositionGraph integration — gate for full cross-subsystem wiring)

---

Context

CORE's thesis commits the engine to decoding a reality that already is, not generating plausible continuations. Decoding requires the engine to hold propositions in varying degrees of grounding — not "true" vs "false" but a richer vocabulary describing how a proposition is currently known and what evidence supports that knowing.

Without an explicit vocabulary, the engine implicitly caps its epistemic scope at binary admit/refuse. Six subsystem audits (math, vault, language packs, runtime packs, teaching pipeline, cognition pipeline, and chat runtime — 136 total decision points) confirm that the engine already makes implicit epistemic distinctions across all of these subsystems: it distinguishes exact recall from decomposed recall, curated pack data from dynamically composed units, reviewed teaching chains from speculative candidates, and refusals caused by evidence absence from refusals caused by safety/ethics violations. The audits show these distinctions are consistent enough to unify under a single taxonomy.

Decision

Ratify the following 14-state epistemic vocabulary as the engine's first-class epistemic axis. Every proposition the engine reasons about carries exactly one of these states, plus structured provenance (see Provenance Requirements below).

State	Meaning	Primary source
PERCEIVED	Token/span observed in input; not yet committed to meaning	Raw ingestion
EVIDENCED	Feature lifts from specific input spans bind a proposition	Recognition layer
EVIDENCED-INCOMPLETE	Feature lift succeeded for a sub-span but the proposition is structurally partial — lift did not fail, but no consuming proposition exists yet	Recognition layer — partial structural match
VERIFIED	Cross-checked against ratified knowledge (pack / vault / teaching); consistent	Substrate cross-reference
DECODED	VERIFIED plus replay-equality from input (trace-hash invariant)	Replay machinery
DECODED-UNARTICULATED	Proposition is DECODED internally but surface realization path broke; the answer is correct but cannot be communicated. Must not be classified as wrong	Verifier pass + Realizer failure
INFERRED	Derived from DECODED components by a ratified deterministic rule; composite not itself curated	Rule application over DECODED primitives
UNVERIFIED-POSSIBLE	Consistent with verified knowledge but not directly verified; usable provisionally	Default for non-contradicting novel propositions
UNVERIFIED-NOVEL	Not contradicted; introduces structure the engine has not decoded yet; candidate for teaching expansion	OOV refusal pointing at expansion need
CONTRADICTED	Conflicts with verified knowledge; refuse unless this is a ratified correction	Verification failure
AMBIGUOUS	Input could support multiple incompatible propositions; engine cannot choose without more context	Multi-evidence-binding conflict at recognition
UNDETERMINED	Feature lifts could not complete; specific dimensions missing	Recognition-layer refusal
SCOPE_BOUNDARY	Proposition type recognized but outside current capability envelope. Distinct from UNDETERMINED (lift succeeded) and CONTRADICTED (no conflict — engine cannot decode yet)	Capability-envelope check
COMPUTATIONALLY_BOUNDED	Engine cannot determine epistemic status within resource envelope; not AMBIGUOUS, not UNDETERMINED	Search/enumeration resource-limit hit

Plus one meta-state:

| EPISTEMIC_STATE_NEEDED | None of the existing states fit; engine refuses and surfaces the gap for teaching expansion | Recursive refusal |

The meta-state is what makes the vocabulary non-capping. When no existing state fits, the engine refuses with a structured description of the gap; the teaching loop either ratifies a new state or determines an existing one covers the case.

Companion axis: Normative clearance (orthogonal)

Safety and ethics verdicts are not epistemic states. They answer a different question: has this turn's behavior complied with the active constraints? The two axes are orthogonal — a VERIFIED proposition can violate a safety boundary; an UNDETERMINED proposition can pass every ethics predicate.

Every proposition reaching ChatResponse or TurnEvent carries both axes:

Clearance state	Meaning
CLEARED	All active normative constraints (safety + ethics) passed
VIOLATED	At least one constraint breached; audit record written
UNASSESSABLE	Constraint exists but cannot be evaluated at runtime
SUPPRESSED	A refusal commitment fired; proposition replaced with typed refusal before reaching the surface

normative_detail carries the violated boundary/commitment IDs when clearance is VIOLATED or SUPPRESSED; empty string otherwise.

Provenance requirements

Every assignment of a state to a proposition must carry structured provenance:

• Source: which subsystem assigned this state
• Evidence span(s): which input or knowledge spans supported the assignment
• Transition history: if the proposition was previously in another state, what evidence caused the transition

Provenance is what distinguishes thesis-aligned epistemic tracking from confidence scores. A confidence score is a number; provenance is a trace the engine can replay, audit, and correct.

Full provenance enforcement is deferred to ADR-0144 integration. Phase 3 (this ADR) establishes the vocabulary and wires state labels onto runtime artifacts. Phase 4 (post ADR-0144) adds structured provenance records.

What Phase 3 delivers (already landed)

The following is implemented and merged:

• core/epistemic_state.py — EpistemicState and NormativeClearance enums, clearance_from_verdicts(), epistemic_state_for_grounding_source(), normative_detail_from_verdicts(), coerce_* helpers.
• core/physics/identity.py — TurnEvent carries epistemic_state, normative_clearance, normative_detail.
• chat/runtime.py — ChatResponse carries all three fields; both stub and main paths populate them from verdicts and grounding source.
• chat/telemetry.py — serializes state axes into JSONL turn events.
• language_packs/loader.py — UnitEntry carries epistemic_state; curated entries tagged DECODED, composition-rule entries tagged INFERRED.
• vocab/manifold.py — add() accepts epistemic_state; add_transient() tags words UNVERIFIED_NOVEL; epistemic_state_for_word() exposed.
• language_packs/compiler.py — passes epistemic_state through compile, clone, and cached-load paths.
• vault/store.py — epistemic_state_for_vault_status() mapping; epistemic_state stamped into metadata on store(); recall results expose the field.
• Phase 2 bug fixes (PR #219): FALSIFIED/SPECULATIVE explicitly distinguished in _status_admits; mean_pair_score([]) returns NaN; RealizerError on verified trace routes to decoded_unarticulated outcome; domain contract present=False is valid=True; domain_id:unknown routes to scope_boundary.

What remains gated on ADR-0144

• Cross-subsystem transition machinery. How a proposition carries its state and provenance as it moves between subsystems (recognition → verifier → vault) requires the PropositionGraph as the carrier. ADR-0144 defines that graph.
• Structured provenance records. Per-assignment provenance objects (source, span, transition history) add overhead that needs the PropositionGraph as a home before they can be allocated.
• CognitiveTurnResult.refusal_reason materialisation. The field is populated by ChatRuntime (PR #222) but the cognition pipeline does not yet read it back for trace folding. Full wiring is post-ADR-0144.
• State storage layer. Where states are persisted per-session vs. per-proposition vs. in the vault is an open question (see scope doc Q2).

Implementation debts to resolve before full cross-subsystem integration

From the six-subsystem audit:

1. Cognition pipeline cold-start PASSTHROUGH (pipeline.py:_ratify_intent) collapses three distinct conditions (no field_state, no vocab, no prompt_versor) into one indistinguishable PASSTHROUGH outcome. Extend RatificationOutcome to distinguish them.

2. Chat runtime grounding-source dispatcher (runtime.py:831–1012) does not record which sources were attempted or why each fell through. Six provenance gaps cluster around this site. Add an explicit dispatch trace structure once the PropositionGraph carrier exists.

3. Teaching pipeline watched-metrics tuple (replay.py) should be a named, versioned MetricSet dataclass to survive future metric additions without breaking trace byte-identity.

Consequences

• The vocabulary is non-negotiable going forward. New subsystem work must assign one of these states (or emit EPISTEMIC_STATE_NEEDED) to every proposition it handles.
• The normative clearance axis is orthogonal. Safety/ethics machinery must not modify epistemic state and must not be expressed as an epistemic state.
• DECODED is the strongest positive state the engine can assign. VERIFIED is one step below it (cross-checked but not yet replay-equal). Nothing stronger than DECODED is defined; the engine does not claim certainty beyond replay equality.
• EPISTEMIC_STATE_NEEDED is the escape hatch that keeps the taxonomy from capping the engine's scope. Every EPISTEMIC_STATE_NEEDED emission is a teaching opportunity.