core/docs/decisions/ADR-0206-response-governance-bridge.md

ADR-0206 — Response Governance Bridge (scaffold)

• Status: Accepted (scaffold step) — cognition-path widening landed 2026-06-06 (Step E: the license-gated APPROXIMATE rung). The math-serving seam (§5) remains deferred.
• Date: 2026-06-03 (amended 2026-06-06)
• Supersedes / relates to: ADR-0175 (calibrated-learning reliability gate), the Epistemic-State program (Phase 3, core/epistemic_state.py)
• Scope of THIS PR: purely additive — design on record + cognition-path seam, STRICT-only, no behavior change.

2026-06-06 amendment (Step E — cognition-path widening landed). The LICENSE node is now called from serving: govern_response returns APPROXIMATE_POLICY for a genuine licensed Action.SERVE LicenseDecision (STRICT for everything else, so every existing call site is byte-identical). The first consumer is the converse-guess estimator (generate.determine.estimate): a refused converse query whose predicate-class earned SERVE on the ratified reliability ledger (generate/determine/data/estimation_ledger.json) is served as a disclosed [approximate] estimate via shape_surface. wrong=0 is preserved by construction (disclosure) + by the gate (θ_SERVE=0.99, earned by volume). Still deferred: the math-serving seam (select_self_verified, §5), SITUATE (stakes), and the live FEED BACK loop — E uses an offline, sealed, hash-verified ledger. Lane: evals.determination_estimation.

Context — the consumption gap

CORE has two built epistemic substrates:

1. A ratified decode-state taxonomy — core/epistemic_state.py, a @unique 15-member EpistemicState enum plus an orthogonal NormativeClearance axis. Every chat turn is labeled with its decode-state (derived from the grounding source) and the label is stamped onto TurnEvent / ChatResponse and emitted to telemetry.

2. A deterministic risk-reward gate — core/reliability_gate/ (ADR-0175). license_for(class, action, ceilings) decides whether a class has earned an action via measured_reliability / θ_required ≥ 1.

A source audit (2026-06-03) established the load-bearing fact this ADR addresses:

The decode-state taxonomy is LABEL-ONLY. No consumer reads a decode-state to weigh stakes, modulate response risk, or gate approximation/creativity. Every read is a stamp, serialize, badge, or filter. The reliability gate is likewise explicitly not serving-wired (core/reliability_gate/__init__.py: "NOT wired into the serving/eval path"). The loop that would let these substrates govern response behavior has zero consumers.

This is the same shape as the ratify-vs-consume gap: the artifacts exist, the runtime does not read them to act.

Decision

Introduce the Response Governance Bridge — the missing consumer that reads the two substrates and produces a per-response ReachPolicy governing how far into uncertainty a response may reach. This ADR ships only the scaffold: the design on record + a live but inert seam on the cognition path. The risk-reward widening logic and the math-serving seam are explicitly deferred (§5).

§1 — The governing loop (designed; not all built)

flowchart LR
  T[turn] --> S[SITUATE<br/>stakes/gravity]
  S --> L[LICENSE<br/>reliability_gate.license_for]
  L --> G[GOVERN<br/>govern_response → ReachPolicy]
  G --> H[SHAPE<br/>shape_surface reads policy]
  H --> D[DISCLOSE<br/>decode-state label]
  D --> F[FEED BACK<br/>outcome → ledger]
  F -. next turn .-> L

Step	Status
SITUATE (stakes/gravity from intent + domain + decode-state)	designed — not built
LICENSE (reliability_gate.license_for)	built + called from serving (Step E, 2026-06-06)
GOVERN (govern_response → ReachPolicy)	STRICT, + license-gated APPROXIMATE (Step E)
SHAPE (shape_surface, response path reads policy)	STRICT = identity; APPROXIMATE = disclosed
DISCLOSE (decode-state label)	built
FEED BACK (outcome → reliability ledger)	designed — not built

Only GOVERN + SHAPE ship here. SITUATE and FEED-BACK are named and deferred to follow-ups.

§2 — The reach policy

core/response_governance/policy.py defines:

• ReachLevel — STRICT < APPROXIMATE < EXTRAPOLATE < CREATIVE. Only STRICT is emitted today; the rest name the spectrum the bridge will earn entry to via the reliability gate.
• ReachPolicy(level, admissible_states, rationale, license_ratio) — the inspectable per-response decision (same discipline as reliability_gate.LicenseDecision).
• govern_response(*, epistemic_state, license_decision, stakes) — the decision point. Scaffold: returns STRICT_POLICY for every input.
• shape_surface(policy, *, committed_surface, decode_state, disclosed_alternative) — the consumer. At STRICT it is the IDENTITY transform. Higher levels surface a disclosed alternative for non-admissible decode-states — real, policy-sensitive code so the seam is live, but unreachable in production because govern_response never emits them.

§3 — Why STRICT-only scaffold

The scaffold makes the email's "in active development" claim true the moment it lands while guaranteeing wrong == 0 is untouched:

• govern_response → STRICT is the single load-bearing return. The cognition response surface now flows through shape_surface, but STRICT is identity, so the path is byte-identical to pre-bridge.
• The seam is live wiring, not dead code: test_seam_is_live_wiring forces APPROXIMATE and proves the same consumer the production path calls yields a different surface. The cognition path's strictness is held by exactly the STRICT return — mutate it and the proofs diverge.
• The math-serving chokepoint (select_self_verified) is not touched. It is the single most load-bearing line for wrong == 0; after the ProofNode lesson (a merge silently killed a guard) it does not get its first edit in a scaffold PR. The deferred math seam (§5) carries its own widening test.

§4 — Taxonomy scoping (honestly scoped, not half-dead)

Source-verified split of the 15 EpistemicState members (2026-06-03, including the mapping functions in epistemic_state.py): 9 produced, 6 never produced. (The earlier audit's "7 never produced" over-counted — its grep excluded epistemic_state.py, where the partial→EVIDENCED_INCOMPLETE mapping lives. EVIDENCED_INCOMPLETE is produced; corrected count is 6.)

Role	Count	States	Consumed by loop as
ACTIVE (produced + consumed)	9	DECODED, EVIDENCED_INCOMPLETE, INFERRED, UNVERIFIED_POSSIBLE, UNVERIFIED_NOVEL, CONTRADICTED, AMBIGUOUS, UNDETERMINED, EPISTEMIC_STATE_NEEDED	strict-admissible / approximate+ / extrapolate+ / creative / force-refuse / sentinel
RESERVED (named trigger, not produced)	5	VERIFIED, COMPUTATIONALLY_BOUNDED, SCOPE_BOUNDARY, PERCEIVED, DECODED_UNARTICULATED	each gated on a capability that must land first
RECONCILE (drift, own PR)	1	EVIDENCED	declared but never produced; recognition/outcome.py owns its own "evidenced"

Reserved triggers:

• VERIFIED — needs a canonical-comparison pass (the soundness ≠ correctness gap); the only state that will license widening past gold.
• COMPUTATIONALLY_BOUNDED — search-budget exhausted; generate/derivation/search.py is the near-term emitter.
• SCOPE_BOUNDARY — out-of-domain refusal with a reason; needs domain-scope detection.
• PERCEIVED — raw ingest pre-comprehension; needs a perception lane.
• DECODED_UNARTICULATED — decoded but no realizer surface; articulation-gap.

The partition is enforced by test_taxonomy_partition_is_total_and_disjoint (total + pairwise-disjoint over the live enum), so adding an enum member without scoping it fails the build.

§5 — Deferred (one kind of change per PR)

• Math-serving seam — LANDED 2026-06-06 (its own PR, as planned). select_self_verified now takes policy=STRICT_POLICY; STRICT is byte-identical (every caller passes it → the pinned serving-lane SHAs are unchanged). A disagreement may widen past gold ONLY via _canonically_verified — the VERIFIED (soundness ≠ correctness) gate, which is unbuilt and returns None, so the widening is structurally inert: even a wider reach refuses, preserving the absolute wrong == 0 by construction (not convention). A statistical reliability license is deliberately NOT consulted here — math serving is absolute-wrong=0, not disclosed like the cognition path. test_seam_is_live_wiring injects the gate to prove the consumer fires (STRICT still refuses even then). The real widening remains blocked on a VERIFIED producer (a canonical-comparison pass) — scoped in docs/analysis/VERIFIED-canonical-comparison-scoping-2026-06-06.md.
• EVIDENCED reconcile — map recognition's outcome into EpistemicState.EVIDENCED at the boundary (or document the two axes). A real corrective defect; kept out of this purely-additive scaffold.
• JSONL emission of reach_level — reach_level is carried on TurnEvent / ChatResponse but not added to the telemetry audit dict here, so every pinned lane SHA stays byte-identical. Emission + SHA re-pin is a follow-up (re-pinning a frozen gate is not "additive").
• SITUATE / FEED-BACK / widening — the risk-reward logic itself.

Consequences

• Honest claim unlocked: decode-state taxonomy + risk-reward gate = built; the bridge that lets them govern response reach = in active development (committed seam, STRICT-only, design on record, widening gated behind wrong==0 proofs). Never "live."
• wrong == 0 preserved: STRICT identity + untouched select_self_verified; serving metric stays 3/47/0.
• No frozen gate touched: telemetry JSONL byte-identical → all pinned lane SHAs green.

Verification

• tests/test_response_governance.py — STRICT-only contract, STRICT identity, live-wiring proof (cognition path), taxonomy partition.
• Full-surface suite green (doctrine: not smoke).
• scripts/verify_lane_shas.py green; 3/47/0 preserved.