core/docs/position_paper.md

# Decoding, Not Generating: A Geometric Architecture for Aligned Cognition

**Josh Shay** · ACB Content / CORE

---

## Abstract

Current AI systems generate plausible outputs by sampling from distributions over
tokens. This paper argues that generation and cognition are architecturally
distinct: cognition is the decoding of structure that already exists, not the
synthesis of structure from statistical residue. We describe CORE , a cognitive architecture grounded entirely in
Conformal Geometric Algebra Cl(4,1), where memory is versor stabilization,
reasoning is field propagation, and alignment properties are substrate invariants
— not training objectives, prompt constraints, or classifier overlays. The
architecture is running, deterministically reproducible, and falsifiable at every
claimed property.

---

## 1. The Problem Is Not Scale

The dominant framing of AI alignment treats the problem as a property of
sufficiently capable generative systems: how do we ensure that a powerful sampler
pursues human-intended goals? This framing inherits a prior that is worth
questioning: that sampling from a learned distribution is what intelligence is.

The problems alignment research works hardest on — hallucination, sycophancy,
goal misgeneralization, prompt injection, identity instability under adversarial
input — are not failure modes of an otherwise-sound architecture. They are
structural consequences of building cognition on top of stochastic generation. A
system that samples cannot have a well-defined identity, because identity is a
trajectory property, not a token property. A system that samples cannot have
verified knowledge, because verification requires a fixed epistemic state to
verify against, and a sampling system's epistemic state is the weights — which
are frozen at training time and invisible at inference time. A system that samples
cannot refuse to fabricate, because fabrication is the mechanism. Confident-
sounding output is the signal the training process rewarded.

These are not bugs. They are the architecture.

---

## 2. The Thesis

**Cognition is the decoding of a reality that already is. It is not the
generation of plausible completions.**

More precisely: a cognitive system does not produce meaning from a probability
distribution. It finds the nearest point on a structured manifold — the point
that is already there — and names it. The distinction has architectural
consequences.

A generative system has no manifold. It has a weight matrix and a temperature
parameter. When it is wrong, there is no geometric fact about why it is wrong —
only a gradient signal saying the output should have been different.

A decoding system has an invariant. When it decodes incorrectly, the error is
locatable: a versor violated closure, a recall missed the correct neighbor, the
proposition graph was underspecified. These are failures with structure.
Structured failures are fixable. Stochastic failures are regularizable.

The falsifiable form of this claim is: a system built on geometric decoding
rather than statistical generation can maintain strict factual invariants across
a test set where a generative system cannot, without retraining, gradient descent,
or prompt engineering. The current evidence is in §4.

---

## 3. The Architecture as Direct Consequence

If cognition is decoding, the architecture follows from three geometric facts.

### 3.1 State is a field, not a flat array

Meaning is relational. A token out of context has no meaning. A field over a
structured space has meaning at every point because the space encodes
relationships geometrically. CORE's state is a single multivector in Cl(4,1) —
the Conformal Geometric Algebra of 3D space — a 32-dimensional object where every
grade carries a distinct geometric role: scalars, vectors, bivectors, trivectors,
quadvectors, pseudoscalar.

Cl(4,1) was chosen for one reason: it is the minimal algebra where all conformal
transformations — rotations, translations, dilations, inversions — are versors.
Every cognitive operation is algebraically closed. There is no "translation
handling" bolted on as a special case. The algebra is closed over the full
conformal group by construction.

### 3.2 Every transition is a versor product

```
F_new = V · F · reverse(V)
```

This is the only allowed field transition. The sandwich product with a versor
preserves grade structure, preserves the versor manifold, and has an analytic
inverse. The non-negotiable invariant is:

```
versor_condition(F) = ‖F · reverse(F) − 1‖_F < 1e-6
```

This scalar is zero on the versor manifold. Every input is verified at the
injection gate. Every accepted field state satisfies this condition. There is no
drift correction, no repair monitor, no normalization callback — these were all
deleted because they only exist when the algebra is not closed. The algebra is
closed.

### 3.3 Recall is exact conformal distance

For null vectors X, Y in Cl(4,1):

```
X · Y = −(1/2) d(X, Y)²
```

The CGA inner product *is* Euclidean distance in conformal embedding. Vault
recall is:

```
best_match = argmax_i { Q · V_i }
```

No ANN index. No approximate neighbor structure. No tunable similarity threshold.
The recall is exact, and exactness is not a performance tradeoff — it is what
makes the recalled result verifiable. A recall hit is a geometric fact, not a
probabilistic suggestion.

### 3.4 Learning requires review

Knowledge enters the runtime field through one path: the reviewed teaching loop.
Every new correction enters at `EpistemicStatus.SPECULATIVE`. Promotion to
`COHERENT` — the only status admissible as evidence in downstream inference —
requires a **coherence judgment** against the existing reviewed field. The
admission signal is coherence and only coherence: source authority, institutional
credentials, and the system's own *asserted* output carry no standing. Provenance
is retained for audit and revision, never as a promotion signal.

That judgment is curator-mediated today, and for most corrections it must be. The
fallible step is not the logic but the *reading* — translating a natural-language
claim into the field's propositional form, and selecting which reviewed claims it
bears on. A sound inference over a misread premise is a sound proof of the wrong
thing, so a human certifies the reading before a correction enters the reviewed
structure.

One subclass is different in principle. A claim that is *deductively entailed* by
claims already marked `COHERENT` is not new information and is not the system's own
opinion — it makes explicit what the reviewed field already contains. For that
subclass the entailment proof *is* the coherence judgment, and CORE's sound,
independently-checked deductive engine (`deductive_logic_v1`, §4) can certify it
deterministically, with the proof chain as the audit artifact — the logical form
of the *"structural coherence metric"* ADR-0021 names as the successor to curator
mediation. What review still gates there is the faithfulness of the reading, not
the deduction. This proof-carrying promotion path is now ratified and implemented
for the narrow deductively entailed subclass: curator-certified readings,
already-COHERENT premises, replay-verified proof, and vault-owned mutation.
Runtime turn integration remains separate; no open-world autonomous learning
claim follows from this path.

This is not a safety overlay. It is a consequence of the decoding thesis: if the
system decodes a reality that already is, then inputs that contradict — or merely
fail to follow from — reviewed structure need review before they enter that
structure. A system that accepts any confident-sounding correction without review
is a generative system in different clothing.

Two invariants enforce this at the architecture level, not the policy level.

**One-mutation-path invariant.** Knowledge enters the runtime field through
exactly one reviewed path. Every module that writes to the vault is explicitly
allowlisted in `tests/test_architectural_invariants.py::TestINV21OneMutationPath`.
Adding a new write path requires editing the allowlist with a documented
justification — the CI failure is the prompt to do so, not a roadblock to route
around. Any backdoor — a debug endpoint, an admin override, a fast-path for
"known good" sources — collapses the guarantee. The test makes that collapse
visible at commit time.

**Non-hardening invariant.** No claim is ever locked. Even `COHERENT` is
revisable. There is no `final`, `frozen`, `axiom`, or `permanent` flag in the
codebase — their absence is enforced by test. `FALSIFIED` claims are retained for
audit and remain eligible for reinvestigation if new coherence emerges. A system
that cannot revise a settled belief because doing so would threaten its identity
has ossified. CORE cannot ossify by construction.

---

## 4. Evidence

The following properties are currently measured, reproducible, and falsifiable.
Every claim maps to a reproducible command in `evals/CLAIMS.md`.

### The zero-wrong invariant — everywhere, without exception

On the real GSM8K train sample (50 problems drawn from the actual benchmark
distribution), CORE currently scores: **correct=3, refused=47, wrong=0**.

The natural reaction to seeing 3/50 correct is that this is a weak result. It is
not. It is the most important number in this paper, and understanding why requires
understanding what the alternatives mean.

A frontier LLM scores approximately 90%+ correct on GSM8K. It also produces wrong
answers — answers where it ran to completion, produced a number, and the number
was wrong. The model cannot distinguish its correct answers from its wrong ones.
From the inside, they look identical: a confident surface string. The only way to
know which is which is to check against ground truth. A system that confabulates
at 10% on a math benchmark is confabulating at some unknown rate on every other
domain it touches — and the confabulation is invisible, because the surface is
always confident.

CORE's current math score is 3/50 correct. But wrong=0 is not a constraint
imposed on the architecture. It is a property of the architecture. The system
cannot produce a wrong answer because it cannot complete a generation walk that
lacks geometric grounding. When the parser does not find an admissible candidate
for a statement or question, it refuses — with a named reason. There is no path
from "ungrounded input" to "completed output."

The refusal taxonomy for the 47 refused cases is fully enumerated by the
candidate-graph pipeline. Each refusal carries a named shape category — the
recognizer saw a statement shape its registered injector could not turn into
typed solver state, so the candidate refuses instead of fabricating a guess.

| Barrier category | Count | Description |
|---|---|---|
| `recognized_but_uninjectable(discrete_count_statement)` | 21 | Multi-word possession / acquisition shapes ("Lily has three boxes of pencils") whose v1 injector covers only the single-word DCS surface |
| `no_admissible_candidate` | 10 | Statement shape unrecognized by the v1 parser AND no registered recognizer matched — refuses cleanly, no admissible branch enumerated |
| `recognized_but_uninjectable(multiplicative_aggregation)` | 5 | Multi-quantity composition shapes ("3 vet appointments cost $400 each") — recognizer detects the shape; injector for the composed operand is the ADR-0169 frontier |
| `recognized_but_uninjectable(currency_amount)` | 4 | Currency-amount detections without per-unit framing — recognizer detects; v1 injector deliberately deferred |
| `recognized_but_uninjectable(rate_with_currency)` | 3 | Per-unit-rate statements ("$18 per hour") — detection works; rate→initial injection is the next deferred shape |
| `recognized_but_uninjectable(descriptive_setup_no_quantity)` | 2 | Setup sentences with no quantity to compose — contributing zero math state is correct; the refusal here is the no-admissible-candidate failure mode |
| `recognized_but_uninjectable(temporal_aggregation)` | 2 | Event-count-per-window patterns ("10 oysters in 5 minutes") — needs a rate primitive in the algebra |

Every refusal has a named reason. Not "low confidence," not "out of distribution"
— a specific shape category the recognizer detected but the injector has not yet
been wired to turn into typed solver state. This is a work queue, not a mystery.
Each named barrier corresponds to one or two extension PRs in the active backlog.
As coverage grows, correct count grows. Wrong count stays 0 by architectural
guarantee, not by tuning.

The question a generative system cannot answer: "which of my answers are wrong?"
CORE's answer is always: "none — and here is exactly what I couldn't solve and
why."

### Deterministic replay

Any fixed `(state, vocab, persona, admissibility_region, mode)` tuple produces
bit-identical output across reruns. Verified by 5-rerun byte-identity tests across
every generation path. Determinism is not a configuration option. It is the
default behavior of a system with no sampling temperature.

### Versor closure

`versor_condition(F) < 1e-6` holds on every accepted field state in every test
suite. Verified at the injection boundary. If it fails, the failure is at the
operator or construction boundary — not masked downstream.

### Identity protection under adversarial input

Attempts to rewrite identity — novel phrasings, indirect approaches, prompt
injection patterns — are rejected by two independent layers: syntactic pattern
detection and a geometric check on the versor-field trajectory the correction
would produce. The geometric layer is paraphrase-invariant by construction.
Rejection rate on the adversarial identity eval: 100%.

### Epistemic honesty

Claims backed by unreviewed knowledge are marked `SPECULATIVE` at the surface
layer. `articulation_of_status` eval lane current false certainty rate: 0.00.
`refusal_calibration` lane: 1.00 refusal rate on out-of-grounding probes, 0.00
fabrication.

---

## 5. Honest Gaps

**Math injector coverage is the active frontier.** The 47 refusals on the train
sample are not failures of reasoning — they are failures of injection. The
solver, once a problem reaches it, produces correct answers (3 cases, 100%
solve rate on admitted problems). The recognizer already detects most refused
shapes; what's missing is the per-shape injector that turns a recognized
statement into typed solver state without fabricating quantities the source
does not contain. The architecture for closing this gap — a reviewed
composition-pattern registry consumed by a registry-driven injector — is in
place; new shape coverage ships as per-shape matcher extensions that publish
pre-composed candidates the registry gates. These are enumerated, not
estimated.

**The holdout is sealed.** The real GSM8K test set (1,319 cases) is
age-encrypted and has not been run against a system with sufficient parser
coverage to produce meaningful correct counts. When it is opened, the zero-wrong
guarantee will either hold or falsify the architecture. There is no middle ground.

**The vocabulary manifold is finite and curated.** CORE does not generalize to
arbitrary domains through gradient descent. Extending to a new domain requires
constructing pack vocabulary, establishing coherence with existing reviewed
claims, and passing the eval lane. This is deliberately slow. Whether it scales
to the full breadth of human knowledge is an open question. Whether it can be
done without confabulation is not.

**Vision, audio, and motor modalities are planned, not built.** The
`ProjectionHead` protocol supports them architecturally. The projection heads do
not yet exist.

---

## 6. Why This Matters for Alignment

The alignment problem, stated geometrically: how do you ensure that the system's
behavior remains within an intended region of possibility space as the system
becomes more capable?

In a generative system, the answer is: train it toward intended behavior, then
add classifiers, prompt constraints, and RLHF. These work until they don't. The
failure modes are structural — a sampling system can always produce output outside
the intended region given sufficient context pressure, because the constraint is
behavioral, not algebraic.

In CORE, the answer is: the intended region is the admissibility region, enforced
at every generation step by the admissibility gate. A token is admitted if and
only if its versor aligns with the relation blade within the admissibility margin.
A rotor is admitted if and only if the field it would produce remains within the
frame versor's half-space. These are hard constraints on every step, not soft
regularizers on the training objective.

The teaching safety properties follow from the same logic. A system that cannot
accept arbitrary identity rewrites is not one that was trained to resist them. It
is one where identity is a geometric trajectory, and a rewrite is a geometric
violation detectable independently of the phrasing used to attempt it.

A concrete example: during architecture audit, CORE was found to have a
self-reinforcing fabrication path — the system could recall its own prior output
as evidence, cite it, and compound it across turns. This is not a hypothetical
failure mode; it is the epistemic structure of every system that stores its own
outputs without epistemic tagging. The path was found and closed architecturally:
every vault write now stamps an `EpistemicStatus`, the default is `SPECULATIVE`,
and any inference path that feeds the user-facing surface must pass
`min_status=COHERENT`. The fabrication loop cannot reopen quietly — the
one-mutation-path invariant ensures any new vault write path triggers a CI
failure until explicitly reviewed.

The deeper alignment claim: if cognition is decoding, then the space being decoded
has structure that exists independently of the system decoding it. Truth is
coherent. A system built to find coherent structure is, by construction, built to
be correctable — not because it was trained to be, but because its correction
mechanism operates on the same geometric substrate as its cognition. Review is
coherence judgment, not authority assertion. Falsified claims are retained, not
erased. No claim is ever locked.

This does not solve alignment. It relocates the hard problem from "how do we
train a sampler to stay in bounds" to "how do we specify the right admissibility
region." The second problem is harder to obscure and easier to audit. That is the
point.

---

## 7. Relationship to Existing Work

**Interpretability research** asks: what are the circuits inside a trained model
doing? CORE inverts the question: what geometry must the architecture have so that
behavior is interpretable by construction? Every field transition is a named
versor product. Every recall hit is a geometric distance. Every admitted claim
carries an epistemic status. There are no circuits to reverse-engineer because
there are no learned weights.

**Mechanistic alignment** (superposition work, SAE probing, etc.) seeks to
identify features in trained models. CORE's features are explicit — they are pack
lexicon entries with geometric coordinates. The cost is that domain coverage
requires curation. The benefit is that a feature's meaning is exact and auditable,
not inferred from probing.

**RLHF / Constitutional AI** shapes model behavior through feedback. CORE's
teaching loop shapes field structure through reviewed correction. The distinction:
in RLHF, the corrected behavior is baked into weights that are opaque. In CORE,
the corrected knowledge is a reviewed claim with a named epistemic status, a
SHA-256 provenance hash, and a deterministic replay trace. The correction is
auditable at the level of individual claims.

**Formal verification of AI** asks whether model properties can be proven. CORE's
invariants — versor closure, deterministic replay, zero confabulation, identity
protection — are not proven in the theorem-prover sense. They are verified by
construction and by eval: a falsifying case would be visible in the test suite.
That is a weaker guarantee than formal proof and a stronger guarantee than
behavioral testing of a black-box sampler.

---

## Concrete Evidence — Merged Demos (2026-06-11)

The claims in §4 are abstract without pointers to reproducible artifacts. This
section ties those properties to merged demos, trace hashes, and runnable
commands. The demos are not all the same kind of evidence. #687 routes through the
real derivation and ASK machinery and is the substrate-capability anchor. #688 is
an interface-contract demo. #690 is a local epistemic-state authority demo using a
sealed fixture corpus. They prove that proposer-held status cannot cross the typed
boundary, but they must not be mistaken for production tool safety or arbitrary
evidence evaluation.

### Authority over claims — PR #687, merge `3ba65d51`

`demos/claude_hybrid_verification/` demonstrates the full authority boundary for
claim verification across five typed outcomes. A frontier-style proposer submits a
math problem as a typed tool call. CORE re-derives from the problem text and holds
sole accept/refuse/ask/invalid authority. The proposer appears nowhere in
`authority_path`.

Representative trace hashes (SHA-256 of response envelope):
- Verified: `c9b26b346d9539bd…` (Sara problem, 26 dollars, faithful 3-step derivation)
- Refused / disagreement: `c73e264092bb6940…` (two "complete" paths that disagree — CORE refuses rather than guessing)
- Ask / under-specified: `3c751beda82ca08c…` (grounded clarifying question, not fabricated answer)
- Refused / envelope: `48d5b24a135bb855…` (correct derivation but outside committed serving envelope)
- Invalid / smuggling: `22748265a24cc919…` (schema rejects `proposed_answer` field before evaluation)

Run: `python demos/claude_hybrid_verification/run_demo.py`

The hard finding — that reasoning-path agreement is not reliable safety — is
demonstrated concretely by the refused-disagreement scenario. Two derivation paths
independently agree the problem is solvable, produce well-formed arithmetic, and
disagree on the answer. The authority boundary catches this; a consensus-of-outputs
architecture would not.

### Authority over proposed tool actions — PR #688, merge `c55f7dfb`

`demos/claude_tool_authority/` demonstrates the same typed boundary for proposed
digital actions across four outcomes. A model-style proposer submits action
proposals; the local authority envelope authorizes, asks, refuses, or invalidates.
Authorized outputs are inert `licensed_action` artifacts; `execution_performed:
false` on every scenario.

Representative trace hashes:
- Authorized (inert): `9e797710ed34dfa5…` (`write_local_note`, `proposer_trace_hash_ignored: true`)
- Ask (confirmation required): `eeb8ed87e83ed410…` (`send_external_email`, confirmation gate)
- Refused: `fa1d2511f953306f…` (`delete_system_file`, not in envelope)
- Invalid / smuggling: `a336294778c1f496…` (`authorization_status` field rejected before evaluation)

Run: `python demos/claude_tool_authority/run_demo.py`

Evidence caveat: #688 is an interface-contract demo. It proves no proposer can
self-authorize, smuggle a license, provide a trusted trace hash, or cause a side
effect through this boundary. It does not prove production MCP integration or
general autonomous tool-safety reasoning; its decision core is intentionally a
small local envelope.

### Authority over epistemic state assignment — PR #690, merge `e80c8eae`

`demos/epistemic_truth_state/` demonstrates the same typed boundary for epistemic
state assignment across seven outcomes. A model-style proposer submits a claim,
sealed evidence references, and a `proposed_state`; the demo assigns a canonical
state from committed corpus records whose content hashes must match.
`proposer_state_ignored: true` on every non-invalid output.

Typed state vocabulary: `verified`, `evidenced`, `inferred`, `contradicted`,
`undetermined`, `scope_boundary`. A proposer that injects `assigned_state` or
`authority_path` into the request payload is rejected at the typed schema boundary
before evaluation.

Representative trace hashes:
- Verified: `fd0042f5f2bea77d…` (2 sealed corpus records with distinct provenance roots, `normative_clearance: unassessable`)
- Evidenced: `c4fcd4ae033cad4f…` (1 item, below threshold — proposer proposed `verified`)
- Inferred: `3d7e92fceeba3281…` (entailment-decided premise evidence — proposer proposed `verified`)
- Unrelated premise: `48c9932a5dd99f1a…` (resolvable but unrelated premise, engine returns `unknown`)
- Undetermined: `80559d4b02668e36…` (off-topic evidence)
- Refused: `f1d8936f7616d273…` (outside epistemic envelope)
- Invalid: `18dda5b4017b223b…` (5 smuggled output fields rejected)

Run: `python demos/epistemic_truth_state/run_demo.py`

**Honesty note:** `normative_clearance` is `"unassessable"` on every non-invalid
scenario; the invalid scenario has `null` because evaluation never reached the
authority path. The demo runs no normative, safety, or ethics clearance pass. The
evidence corpus is local fixture evidence, so #690 should be read as a
state-authority demo over a sealed local corpus, not as proof that CORE evaluates
arbitrary evidence sources. Proof-carrying promotion is demonstrated separately by
#696 for the narrow, curator-certified, deductively entailed subclass; it is not
runtime turn integration or open-world autonomous learning.

---

## Conclusion

The question is not how to make generative AI safer. The question is whether
generation is the right substrate for cognition in the first place.

CORE is a running argument that it is not. The argument is not in this paper. It
is in the versor invariant, the zero-wrong eval gate, the deterministic trace
hash, the reviewed teaching path, the two-layer identity firewall, and the public
authority-demo stack. The strongest current demo proves substrate authority over
claims; the surrounding boundary demos expose the exact places where broader
action and epistemic authority still need harder evidence.

The code is open source under the CORE Non-Commercial License.
All commercial licensing inquiries: shayj292@gmail.com

---

*CORE is developed independently. All work was done on personal hardware.*