6c67e88df1
Rank 3 on the docket. RuntimeConfig carries 32 boolean fields and nothing in
the repository stated that set, distinguished a capability flag from a posture
flag from a deployment knob, or recorded what evidence would flip any of them.
Two independent counts of the same set differed by eleven — the assessment said
"seventeen capability flags," N-7 measured 28 default-off plus 4 default-on —
and neither was wrong about what it looked at. They counted different things
because nothing declared what the set was.
R-3 (ruled A — incomplete flag set). accrue_realized_knowledge joins
CONTINUOUS_LIFE_CONFIG_FLAGS. Step D consolidates the realized facts Step B
writes, and the daemon forced the consumer without the producer: a continuous
life consolidating an empty set, which the mastery framework calls "garbage at
high speed." It shipped that way for six weeks.
The decisive evidence was in the code, not the documents. BOTH flags' comment
blocks in core/config.py already described the corrected profile —
accrue_realized_knowledge says "the production L10 process enables it alongside
persist_session_state", consolidate_determinations says "...alongside
accrue_realized_knowledge + persist_session_state". Three records (two
docstrings and the 07-25 verification doc) agreed with each other and disagreed
with four lines of code. Dormancy was a coherent ruling and would have cost
correcting three records that were RIGHT about the design; incompleteness cost
one line.
So the planned "N-6 docstring correction" deliverable DISSOLVED rather than
shipping: adding the flag made both docstrings true. Recorded explicitly,
because a PR that quietly ships less than it promised is the same divergence
class this arc exists to close.
R-4 (ruled A) — docs/specs/flag_register.md. All 32 booleans with class,
governing ADR or an honest "none", recorded rationale, and what evidence would
flip it. The classification is the load-bearing half and is stated as a
taxonomy rather than a label:
CAPABILITY — what CORE can do; engineering may flip it on named evidence
POSTURE — what CORE serves or refuses AS TRUE; the wrong=0 boundary,
ruling-only
DEPLOYMENT — cost, lifecycle, process shape; per-deployment
estimation_enabled and composed_surface are both "= False" and are not the same
kind of thing. Nothing said so before.
Profiles are declared as the UNIT of decision (R-4's mechanism): one-shot/eval
and continuous-life. The absence of a SERVING profile is stated deliberately —
the four POSTURE serving flags each ride their own license, and grouping them
before the ledger is sealed would license by association, the outcome R-8
exists to prevent.
tests/test_flag_register.py, on the gate. BIDIRECTIONAL, because either
direction alone would have passed through both failures it exists to prevent:
a flag added to config.py and not registered fails; a register row outliving
its flag fails. The counts the register's prose states (32 / 4 ON) are pinned,
since a stale count is how this register came to be needed. Four sabotages
observed red — new unregistered flag, deleted row, orphaned row, and a flag
silently flipped ON, the last caught by two independent pins.
THREE FINDINGS THE ITEM DID NOT ANTICIPATE, all from measuring rather than
reading.
1. Accumulated permissiveness, not just hesitancy. Of the four default-ON
flags, ONE has a governing ADR (deduction_serving_enabled / ADR-0256) and
TWO have no recorded reason of any kind — allow_cross_language_recall and
use_salience carry no comment block, no ADR, no criterion. In an
architecture built on earned licenses, two permanently-on capability flags
with no recorded decision is G-8's question inverted. Registered and
deliberately NOT fixed: writing a rationale after the fact would invent a
decision nobody made, which is worse than recording the absence.
2. A hollow gate inside the governance pin itself.
test_default_on_flag_is_not_governed_by_a_proposed_adr is parameterized over
(default-ON flag x cited ADR), so the three uncited ON flags contribute ZERO
cases — it covered exactly one flag. Its non-vacuity guard asserted only
that SOME flag cites an ADR, which default-off flags satisfy in abundance.
One reformatted comment away from zero coverage with everything green: the
failure state indistinguishable from the success state, inside the module
written to prevent exactly that. Guard tightened to require a non-empty
parametrization, and observed red by stripping ADR-0256's citation.
3. The daemon's own tests ran on no gate. R-3 changes what the always-on
process does every beat, and tests/test_l10_always_on_daemon.py was in no
curated suite — so this behaviour change would have shipped guarded solely
by tests no gate invokes, which is the hollow-gate pattern landing on the
exact file covering the change. Promoted to smoke WITH the change it guards.
Measured +9.4s, +4.3% of smoke — paid deliberately, not estimated. Removed
from full_only_baseline.txt in the same edit (both-directions ratchet; the
baseline shrank 747 -> 746).
Red before green throughout: the assertion cfg.accrue_realized_knowledge is
True was added to the daemon test and OBSERVED FAILING before the flag existed.
H-8(c) closed by AMENDING the correction note rather than deleting it, and the
amendment is the more useful artifact. PR-1's note said the 07-25 document's
claim was false; R-3 then made that claim TRUE, so the correction note itself
went stale — in the direction nobody guards, a correction made wrong by its own
subject being fixed. Both notes now carry the commit window they apply to. A
dated correction survives its subject changing; an undated "this is false" does
not.
Also delivered, from the 2026-07-28 external-assessment triage: §5, the
declared-table index. Eight single-source-of-truth tables and the pin that makes
each true. A reader's aid, explicitly NOT a central contracts.toml — that would
add a fifth copy needing agreement with four generators and put four different
authorities in one merge surface.
Handed forward to PR-11: the 5000-beat soak recorded in
evals/l10_always_on/contract.md (2026-07-19) predates this change and therefore
describes a configuration that NO LONGER SHIPS. PR-11's re-run is the first soak
of the corrected profile, and Step B feeding Step D is exactly what a long
horizon stresses.
Closes G-6, G-8, H-6, H-8(c), H-8(d) — and H-8 in full. Wave 4's F-6 half-gate
is lifted; the Track C half is untouched.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Wcw2pnMBwyvmNyQg4uPEt4
15 KiB
The Flag Register
Status: live · Authority: R-3 and R-4 (docs/assessment/50-rulings.md, ruled 2026-07-28) · Register: G-8 / H-6
Enforced by: tests/test_flag_register.py — the table below and core/config.py must name exactly the same set, in both directions. A flag cannot land unregistered, and a register entry cannot outlive its flag.
RuntimeConfig is a single frozen dataclass carrying 32 boolean fields: 28 default False, 4 default True. Until this document existed, nothing in the repository stated that set, distinguished a capability flag from a posture flag from a deployment knob, or recorded what evidence would flip any of them. Two independent counts of the same set differed by eleven (the assessment said "seventeen"; N-7 measured 28 default-off) — and that disagreement was itself the finding.
0. What this register is for
A default-off flag is one of two things, and they look identical in code:
- deliberate posture — the capability works, and shipping it dark is the correct decision until named evidence arrives;
- accumulated hesitancy — nobody turned it on, nobody decided not to, and the default is an artifact of the order things were built in.
The distinction cannot be recovered from core/config.py, because both are spelled = False. This register records which is which and, for every flag, what would change the answer. A flag whose "what flips it" column reads "no criterion recorded" is not a posture. It is an open question wearing a default.
The classes — declared here, applied in the tables, and the reason the tables are separate:
| Class | What flipping it changes | Who may flip it |
|---|---|---|
| CAPABILITY | what CORE can do — a cognitive ability comes online | engineering, on the named evidence |
| POSTURE | what CORE serves or refuses as true | ruling — this is the wrong=0 boundary |
| DEPLOYMENT | cost, lifecycle, process shape — not capability, not truth | per-deployment; profiles below |
The classification is the load-bearing half. estimation_enabled and composed_surface are both = False and are not the same kind of thing: one widens a surface, the other decides whether CORE may serve an approximation as an answer.
1. The default-ON surface — four flags, and the register's sharpest finding
These four are live in every default RuntimeConfig. They are the only flags whose behaviour is on unless someone turns them off, so they carry the highest burden of justification — and three of the four carry the least.
| flag | class | governing ADR | recorded rationale | what would turn it OFF |
|---|---|---|---|---|
allow_cross_language_recall |
CAPABILITY | none | none — no comment block in core/config.py |
no criterion recorded |
use_salience |
CAPABILITY | none | none — no comment block in core/config.py |
no criterion recorded |
discourse_planner |
CAPABILITY | none | yes — builds a deterministic DiscoursePlan; BRIEF mode is byte-identical to single-clause output |
evidence that multi-clause rendering degrades a served lane |
deduction_serving_enabled |
POSTURE | ADR-0256 | yes — ROBDD entailment intercepts argument-shaped turns; 716/716 wrong=0 |
a wrong>0 result on the sealed band, which revokes the license by construction |
Finding (measured 2026-07-28). Of the four flags that are ON in production, one has a governing ADR and two have no recorded reason of any kind — no ADR, no comment, no criterion. In an architecture whose entire posture is earned licenses and refuse-don't-guess, two permanently-on capability flags with no recorded decision is the mirror image of the hesitancy problem this register was built to find: accumulated permissiveness.
This is registered, not fixed. Writing a rationale for allow_cross_language_recall after the fact would be inventing a decision that was never made, which is worse than recording that it is missing. Owed: a one-line rationale-or-flip for each, from whoever knows why they are on. Until then their "what flips it" column stays honest.
A second-order gap, closed with this register. tests/test_adr_status_governance.py::test_default_on_flag_is_not_governed_by_a_proposed_adr is parameterized over (default-on flag × cited ADR). Three of the four ON flags cite no ADR, so they generate zero cases — the pin covers exactly one flag. Its non-vacuity guard asserts that some flag cites an ADR, which stays green even if the parametrization drops to zero. That guard is tightened alongside this register.
2. POSTURE flags — the wrong=0 boundary
Flipping any of these changes what CORE serves or refuses as true. None may be flipped by engineering judgement; each needs a ruling. All are default-off.
| flag | governing ADR | posture | what flips it |
|---|---|---|---|
estimation_enabled |
ADR-0175 / ADR-0206 | a converse query CORE would refuse may return a DISCLOSED approximate estimate, if the predicate-class holds a SERVE license at θ_SERVE=0.99 | a sealed reliability ledger granting the license — deliberate posture, criterion named and unmet |
curriculum_serving_enabled |
ADR-0262 | exam-shaped polar questions answered from the ratified domain-chain curriculum, read OPEN-world (an untaught relation is UNKNOWN, never "no") | R-8's outcome-mix rule + a sealed earning ledger (PR-14). Four bands qualify on sealing |
ask_serving_enabled |
ADR-0262 | ASK serving allowed | the same ledger; no independent criterion recorded |
verified_serving_enabled |
ADR-0262 | VERIFIED serving allowed | the same ledger; no independent criterion recorded |
identity_wave_gate |
ADR-0244 | a flagged identity score becomes a typed refusal rather than a score | R-5's discrimination bar — γ_id separates attack signal from benign traffic poorly on the current nominal axis frame. Deliberate posture, criterion now named |
identity_action_surface |
ADR-0246 | the fuller induced-action admit surface layered on the wave gate | NOT AUTHORIZED for live activation. Thresholds are uncertified placeholders; §6.3 shows it refuses benign and adversarial traffic alike. Requires certification, then R-5's bar |
strict_identity_continuity |
ADR-0157 | on reboot, a changed engine identity refuses to start instead of warn-and-flag | deployment choice for hard-continuity operators — forced ON in the continuous-life profile (§4) |
ask_serving_enabled and verified_serving_enabled are the two entries here with no independent criterion. They are ADR-0262 siblings of curriculum_serving_enabled and are presumed to ride its ledger; that presumption is recorded rather than asserted, because nothing in the repository states it.
3. CAPABILITY flags — default-off, and what each is waiting for
Every entry preserves byte-identity when off; that is the design and it is why they accumulated. Grouped by what they are actually waiting on.
3a · Waiting on a transition window that has not been closed
| flag | ADR | what flips it |
|---|---|---|
forward_graph_constraint |
0046 / 0047 | closes Pillar 1→2→3 coupling on the live path. Off "during the transition window" — the window's end is not recorded |
unified_ingest |
0090 | replaces the probe-then-commit path. Off preserves bit-identity — no criterion recorded |
realizer_grounded_authority |
0088 | makes the realizer a real surface authority. Off yields <pending>/... on ungrounded graphs — no criterion recorded |
recognition_grounded_graph |
0144 | articulation graph derived from the admitted EpistemicNode rather than intent classification — no criterion recorded |
These four are the register's clearest accumulated hesitancy cluster: each shipped complete, each is off "to preserve byte-identity," and none records what would end that preservation. Byte-identity is a migration tactic, not a destination.
3b · Surface-widening composers (each a strict superset of the last)
| flag | ADR | what flips it |
|---|---|---|
composed_surface |
0062 | depth-1 follow-up chain |
transitive_surface |
0083 | multi-hop; strict superset of 0062, byte-identical at max_depth=0 |
gloss_aware_cause |
0085 | gloss-first CAUSE surfaces |
thread_anaphora |
0066 | deterministic backreference on pack/teaching-tier turns |
Deliberate posture as a group: each widens what CORE says without widening what it knows, so each needs an honesty check before it earns default-on. No per-flag criterion recorded — a shared one would suffice and is cheaper than four.
3c · The always-on life (Steps B and D, and the idle loop)
| flag | ADR | what flips it |
|---|---|---|
accrue_realized_knowledge |
— | Step B. The only turn-path writer of realized facts. Forced ON in the continuous-life profile as of 2026-07-28 (R-3) |
consolidate_determinations |
— | Step D. Consolidates soundly-derived determinations back into the held self. Forced ON in the continuous-life profile |
persist_session_state |
0056 / 0151 | Shape B+ full lived-state resume. DEPLOYMENT — O(turns) snapshot cost; forced ON in the continuous-life profile |
vault_probe_discoveries |
0021 / 0148 | session vault (T1) feeds discovery contemplation at COHERENT only |
vault_promotion_enabled |
0021 / 0148 | SPECULATIVE → COHERENT crystallization at the turn boundary |
auto_contemplate |
0056 / 0150 | contemplation over pending candidates at checkpoint |
auto_proposal_enabled |
0056 / 0151 | TeachingChainProposals from enriched candidates on load |
contemplate_frontier_during_idle |
0080 | the always-on life mines its own frontier without a user turn; SPECULATIVE-only |
review_derived_close_proposals |
— | proposal-only artifacts from proof-gated derived facts; review-gated, no corpus mutation |
discourse_contemplation |
0080 | plan-level contemplation pre-flight; read-only, SPECULATIVE-only |
R-3's resolution, recorded at the point of change. accrue_realized_knowledge was absent from CONTINUOUS_LIFE_CONFIG_FLAGS while consolidate_determinations was forced. Step D consolidates the facts Step B writes, so the daemon forced the consumer without the producer — a continuous life consolidating an empty set. Ruled incomplete flag set, not intended dormancy, because both flags' own comment blocks already described the corrected profile: accrue_realized_knowledge says "the production L10 process enables it alongside persist_session_state" and consolidate_determinations says "...alongside accrue_realized_knowledge + persist_session_state." The documents were right about the intent and the code was incomplete. Adding the flag made both statements true; the dormancy reading would have required correcting two docstrings that were correct.
3d · Undocumented
| flag | class | what flips it |
|---|---|---|
allow_cross_language_generation |
CAPABILITY | no comment block, no ADR, no criterion |
inner_loop_admissibility |
CAPABILITY | no comment block, no ADR, no criterion |
With allow_cross_language_recall and use_salience from §1, these are the four flags in RuntimeConfig with no recorded rationale whatsoever — two on, two off. They are listed rather than explained, deliberately.
3e · Deployment surfaces
| flag | class | what flips it |
|---|---|---|
review_pending_proposals |
DEPLOYMENT | read-only idle sub-pass surfacing a proposal summary; a deployment that wants the surface pays for the scan |
4. Profiles — flag sets ruled as units (R-4)
R-4's mechanism: profiles are the unit of decision, not individual flags. A profile is a named, forced set with a stated purpose; a deployment adopts a profile rather than assembling flags. CONTINUOUS_LIFE_CONFIG_FLAGS was the pattern; this generalises it.
| Profile | Declared at | Forces | Purpose |
|---|---|---|---|
| one-shot / eval | RuntimeConfig() defaults |
nothing | a fresh runtime per invocation. Must not pay for resume, accrual, or snapshotting it does not use — this is why the defaults are what they are, and it is a real reason rather than hesitancy |
| continuous-life | chat/always_on_daemon.py::CONTINUOUS_LIFE_CONFIG_FLAGS |
accrue_realized_knowledge, persist_session_state, consolidate_determinations, strict_identity_continuity |
ONE continuous life: accrue each turn, consolidate each beat, survive reboot, and refuse to resume as a different identity. Forced, not defaulted — these are not optional knobs for this process shape |
Not yet a profile, and honestly so: there is no serving profile. The four POSTURE serving flags (deduction, curriculum, ask, verified) are ruled individually today because each rides its own license. Grouping them before the ledger is sealed would license by association, which is exactly what R-8 exists to prevent.
5. The declared-table index
The repository's governing pattern is declared in the table, not the call site (ADR-0263 Rule 5). It is implemented in many places and, until now, enumerated in none — so nobody could answer "which single-source-of-truth tables exist, and what makes each one true?"
This index is a reader's aid, deliberately not a central contracts.toml. Centralizing these into one file would add a fifth copy that must agree with four generators, and would place four different authorities in one merge surface. Each table stays where its authority lives.
| Declared table | Where | What makes it true |
|---|---|---|
RuntimeConfig booleans |
core/config.py |
this register + tests/test_flag_register.py (both directions) |
CONTINUOUS_LIFE_CONFIG_FLAGS |
chat/always_on_daemon.py |
tests/test_l10_always_on_daemon.py (on the gate as of 2026-07-28) |
GroundingSource / GROUNDING_SOURCES |
core/epistemic_state.py |
closed Literal + runtime frozenset + build-time enum-coverage test under workbench-ui/ |
DOMAIN_PACKS / DOMAIN_OPERATOR_CLAIMS |
core/capability/domains.py |
tests/test_domain_pack_binding.py (both directions) + domain_contract_predicates P3 |
TEST_SUITES |
core/cli_test.py |
tests/test_suite_membership.py + tests/full_only_baseline.txt |
GATE_SUITES |
tests/test_suite_reachability.py |
verified against scripts/hooks/pre-push and scripts/ci/local-ci.sh |
QUARANTINE / SLOW_FILES / SLOW_TESTS |
conftest.py |
pytest_collection_modifyitems (stamps markers; never skips) |
PINNED_SHAS → CLAIMS.md |
the capability ledger | tests/test_claims_md_is_current.py |
6. What this register does not claim
- It does not assert that any default is wrong. It asserts that for 20 of 32 flags nothing recorded says whether the default is a decision.
- It does not invent rationales. Four flags have none, and the register says so rather than supplying one after the fact — a fabricated justification is worse than a recorded absence, and this repository has a register full of evidence for that.
- It does not flip anything. R-3's one change (
accrue_realized_knowledgeinto the continuous-life profile) was ruled before this document existed and is recorded here, not decided here.