core/docs/analysis/verified-serving-wiring-scoping-2026-06-08.md

# VERIFIED serving-wiring — `verified_serving_enabled` — scoping brief

**Date:** 2026-06-08 · **Status:** scoping (NO CODE) · **HOLD for review** ·
**Branch:** `docs/serving-integration-scoping`

**What this brief is.** The scope for the served-surface decision the VERIFIED lane
deferred. The off-serving VERIFIED lane is complete and on main:

```text
P1-A  the VERIFIED contract        (verified_contract.py — two independent reads converge)
P1-B  gold-setup-backed producer   (evals/constraint_oracle/verified_producer.py — OFF-SERVING)
P1-C  bound_slots_digest           (a separable, load-bearing proof obligation)
```

P1-B verifies 7/13 real R2 problems with wrong=0 — but it is **gold-setup-backed**, so
it is structurally off-serving: the independent read is the INV-25 hand-authored gold
SETUP, which is not available at serving time. This brief scopes what a *serving-time*
VERIFIED would require — and why it cannot reuse P1-B. **No code here.**

> Companions: [[ask-serving-integration-scoping-2026-06-08]] (the ASK half of the same
> "where off-serving stops" line), [[VERIFIED-canonical-comparison-scoping-2026-06-06]]
> (the validate-first probe that already KILLED the naive fold-reader producer),
> [[stage2-epistemic-disclosure-bus-verified-v1-scoping-2026-06-08]] (Doc 1).

---

## 1. The seam (grounded) — and why it is still inert by design

`generate/derivation/verify.py::_canonically_verified(verified, problem_text, policy)`
is the ADR-0206 §5 VERIFIED gate — *the only thing that may license a math answer past
gold* (resolve a disagreement STRICT refuses). It **returns `None` today**, so the
widening is structurally inert: disagreement refuses regardless of `policy`, preserving
absolute `wrong == 0`. Its own docstring states the bright line this brief must honour:

> "A reliability *license* (statistical) must NEVER substitute here: math serving is
> absolute-wrong=0, not disclosed like the cognition path."

So VERIFIED serving = replacing that `return None` with a producer that returns a
derivation **only when it is canonically VERIFIED** (proven correct, not merely sound),
behind a kill switch, proven on a holdout. Everything below is the eligibility bar for
that producer.

---

## 2. The five things this decision must pin

```text
1. the gold-free independent-reader requirement   — the crux
2. verified_serving_enabled                        — the kill switch
3. holdout gates                                    — validate-first, no quiet widening
4. proof-producer eligibility                       — what may plug into _canonically_verified
5. the explicit ban on eval-gold-backed serving     — why P1-B cannot serve
```

---

## 3. The gold-free independent-reader requirement (the crux)

VERIFIED means **two independent reads that converge on one canonical structure**
(P1-A): a faithful solve of a *wrong read* is caught because the independent read
disagrees. P1-B's two reads are `read_constraint_problem` (the engine reader) vs the
**gold-authored setup**. At serving time there is no gold. So serving-time VERIFIED
needs a **second, gold-free reader** whose disagreement is the safety mechanism.

The hard constraints, from the killed-probe doc and CLAUDE.md:

- **Independence must be in the READING, not the solving.** Back-substitution catches
  solve-errors, never read-errors. Two solvers over one reading is *fake* independence.
  The second reader must parse the problem into the same `ConstraintProblem` structure
  by a **genuinely different route** (different lineage, asserted by the
  `SAME_READER_LINEAGE` firewall / INV-27 reader-disjointness), and converge on the
  same canonical signature.
- **No eval gold in the read** (§7). The second reader may not consult, hash, or be
  derived from any gold artifact — not the answer, not the setup. If it needs gold to
  read, it is P1-B, and P1-B does not serve.
- **Conservative refuse-on-doubt carries wrong=0.** The second reader, like the first,
  refuses when uncertain. VERIFIED fires only on *agreement of two confident,
  independent reads*; any refusal or disagreement → STRICT refuses (today's behaviour).

**Eligibility, stated as a gate:** a serving-time VERIFIED producer is eligible **only
if** it exhibits two reads with (a) distinct, firewall-asserted lineages, (b) neither
read derived from gold, (c) convergence on one canonical `ConstraintProblem` signature,
(d) back-substitution + boundary-clear + bound-slots (the P1-A/P1-C obligations), and
(e) refuse-preferring failure. Absent any one, it stays `None`.

Whether such a second R2 reader *exists yet* is the open empirical question — the killed
fold-reader probe is the cautionary precedent: complementary readers were ~98% wrong on
the refused set. **This brief does not assume one exists; it sets the bar a candidate
must clear, validate-first, before any wiring.**

---

## 4. `verified_serving_enabled` — the kill switch

Add `verified_serving_enabled: bool = False` to `core/config.py` (sibling of
`estimation_enabled`). Default **off**. When off, `_canonically_verified` returns `None`
unconditionally (today's inert state) regardless of any producer being present. The
switch is the single audited place that lights the seam, and it stays off until §5.

---

## 5. Holdout gates — validate-first, no quiet widening

VERIFIED may not widen live until proven on a **held-out** set it never trained or
tuned on (INV-25 discipline; the killed-probe doc's validate-first rule). The gate, in
order:

1. **Holdout probe (off-serving):** run the candidate producer over a held-out R2 set
   with gold answers withheld; require **wrong == 0** on everything it marks VERIFIED,
   and that everything it cannot independently verify it *refuses* (over-refusal is
   acceptable; one wrong is disqualifying).
2. **Seal byte-identity:** the GSM8K candidate-graph serving seal (pinned SHAs) stays
   byte-identical — VERIFIED widens a *different* surface (R2 constraint answers), it
   must not perturb the sealed lane.
3. **Disagreement-still-refuses:** a test proving that with the producer wired and the
   switch ON, a faithful solve of a deliberately wrong read still refuses (the P1-A
   poison test, now on the served path).
4. Only then does `verified_serving_enabled` go on, **one surface at a time** (R2
   first; R4 second), each with its own holdout pass.

---

## 6. The served surface — a distinct `[verified]` disclosure

When wired and enabled, a VERIFIED R2 answer is served under its **own** disclosure
claim/marker — the locked decision from Doc 1's review: *VERIFIED gets a distinct
served disclosure mode + `[verified]` prefix, NEVER reused from `[approximate]`*.
VERIFIED is a *license* claim (more licensed than gold-strict), not a *speculation*
claim. The route to it is the only sanctioned one: `disclosure_for_verification(result)`
→ `(EpistemicState.VERIFIED, DisclosureClaim.VERIFIED)` → `ServedDisposition.DISCLOSE`
under the P0-3 guard (which already degrades an unbacked VERIFIED claim to COMMIT).

---

## 7. The explicit ban on eval-gold-backed serving (the load-bearing non-claim)

**P1-B must never become a serving producer.** It is gold-setup-backed: its independent
read is the hand-authored gold SETUP. Wiring it into `_canonically_verified` would mean
the engine "verifies" by consulting the answer key's structure — circular, and a
wrong=0 fiction (it would serve VERIFIED on exactly the problems it was handed the setup
for). The ban, stated so a test can enforce it:

- `_canonically_verified` (and any serving producer behind it) may import **nothing**
  from `evals/` — no gold loader, no `gold_to_problem`, no `r2_gold`. An AST/import test
  asserts the serving path is gold-free, the mirror of the off-serving AST tests.
- P1-B stays in `evals/` precisely so this boundary is structural: `evals → core` is the
  allowed direction; `core/generate serving → evals` is forbidden.
- "Verified on a holdout" (§5) is **not** the same as "verified by gold at serving" —
  the holdout *measures* a gold-free producer; it never *feeds* gold into one.

This is the VERIFIED analogue of the GSM8K "candidate-graph owns the metric; no bridge
re-enables without sealed/independent wrong=0" discipline.

---

## 8. What this is NOT

- **Not** a claim that a serving-time VERIFIED producer exists — §3 sets the eligibility
  bar; whether an R2 second reader clears it is an open, validate-first question.
- **Not** a reliability/statistical license at the math seam — that path is the
  cognition `[approximate]` disclosure; math serving is absolute wrong=0 (§1 bright line).
- **Not** a GSM8K-seal move — VERIFIED widens R2 constraint answers, seal stays
  byte-identical (§5.2).
- **Not** P1-B promoted to serving — explicitly banned (§7); P1-B stays off-serving.

---

## 9. The questions for the ruling

1. **Eligibility bar:** adopt §3 (a)–(e) as the gate any serving VERIFIED producer must
   clear — gold-free second reader, independence-in-the-reading, refuse-preferring? (rec: yes)
2. **Gate:** add `verified_serving_enabled = False` (sibling of `estimation_enabled`),
   `_canonically_verified` stays `None` while off? (rec: yes)
3. **Holdout:** require the §5 validate-first sequence (wrong=0 on holdout + seal
   byte-identity + disagreement-still-refuses) before the switch, R2-first? (rec: yes)
4. **Gold ban:** enforce the §7 import ban (serving path imports nothing from `evals/`)
   with a test, keeping P1-B off-serving forever? (rec: yes)
5. **Surface:** serve VERIFIED under its distinct `[verified]` marker via
   `disclosure_for_verification` only? (rec: yes — the locked Doc 1 decision)

No served-surface code until this brief is reviewed. Pairs with
[[ask-serving-integration-scoping-2026-06-08]] — together they draw the full line where
off-serving stops.