57a0e38f0b
A narrow, auditable proof path for the hybrid-mode boundary: a Claude/Fable-style System 1 proposer submits an MCP-shaped tool call (core.semantic_derivation.verify); CORE re-derives via the ADR-0184 derivation lane, keeps sole acceptance authority, refuses or asks when it cannot honestly answer, and emits a deterministic replay/provenance trace for every decision. Boundary properties (each pinned by a failing-if-removed test): - the proposer has no commit path: additionalProperties:false schema, and the demo modules import nothing from generate.* (AST-scanned with a planted-bypass self-test) — the lane is consumed only through the ADR-0184 S4b audited trace facade; - 'verified' requires pool commit AND clean commit-law/faithfulness audits AND a gold-audited envelope.json entry AND byte-match to the pinned derivation trace (measured: 118 of the off-serving pool's 231 corpus commits disagree with lane gold, so a bare pool commit is never served — scenario s4 shows the refusal on a commit that even matches gold); - the ask leg is the real Q1 stack (router -> limitation -> Q1-D producer -> carried handle -> gated serving), dark by default, tamper-fail-closed on the content hash; - authority_path names only consulted authorities; responses are deterministic (double-run byte-identical) and pinned under expected/. No serving/runtime change; no CLAIMS/metrics/telemetry/lane-pin movement; no network or Anthropic API dependency (System 1 payloads are clearly-labeled static fixtures).
17 lines
1.2 KiB
JSON
17 lines
1.2 KiB
JSON
{
|
|
"_doc": "Demo serving envelope (ADR-0184 hybrid verification demo). The ONLY problems the demo may serve as verified: each entry was audited against its lane gold at pin time, and a live run must reproduce the pinned derivation trace byte-for-byte (derivation_trace_sha) before the answer is served. A pool commit without an authorized entry is refused (outside_demo_serving_envelope): measured on the 937-problem ADR-0184 equivalence corpus, 118 of the off-serving pool's 231 commits disagree with lane gold, so a bare pool commit is not a serving license. Adding an entry requires: lane gold provenance, a reviewed diff, and tests/test_claude_hybrid_verification_demo.py green (it re-audits every entry against the named lane file).",
|
|
"entries": {
|
|
"05c04e82e9d39fb57f1d9581e61968ff4410a65f999638b69145d9cadc76f4d6": {
|
|
"answer": 26.0,
|
|
"answer_unit": "dollars",
|
|
"derivation_trace_sha": "093816f1c077ad63e3e5c4648c5f721875b126bbba6aaa41173fa5c2643798ea",
|
|
"gold": {
|
|
"case_id": "gma-141",
|
|
"expected_answer": 26.0,
|
|
"expected_unit": "dollars",
|
|
"lane": "evals/gsm8k_math/public/v1/cases.jsonl"
|
|
},
|
|
"preview": "Sara has 32 dollars. Sara earns 15 dollars. She uses 21 dollars."
|
|
}
|
|
}
|
|
}
|