core/docs/adr/ADR-0246-induced-identity-action-and-path-integrity.md

ADR-0246: Induced Identity Action and Path Integrity

Status: Accepted Date: 2026-07-18 Authors: Joshua Shay + multi-model R&D (Fable 5 scaffold → Opus 4.8 adversarial audit + hardening → Sonnet 5/Fable 5 completion; per-model provenance in §9) Preflight: docs/briefs/ADR-0246-induced-identity-action-and-path-integrity-preflight.md (locked decisions §3, non-goals §7 — all honored; execution log §0a) Depends on: ADR-0244 (operator-preservation identity gate, Accepted), ADR-0245 (mechanical sympathy + semantic rigor, Accepted) Related: slice-0 evidence docs/audit/adr-0246-slice0-mismatch-diagnostic-2026-07-17.md (merged, quarantined diagnostic); Opus audit docs/audit/adr-0246-slice1-opus-audit-and-hardening.md

---

1. Context and problem

D4 (ADR-0244) built the per-turn operator-preservation floor: does the live cognitive versor F preserve the frozen identity frame I = span(a₁…aₙ), measured by per-axis subspace leakage ℓᵢ and signed self-alignment sᵢ? Two gaps were deliberately left open (preflight §2):

1. Lawfulness inside the span — leakage is blind to in-span reshuffles: a rotor permuting e1→e2 or inverting e1→−e1 has ℓ≈0 yet is not the identity-preserving action.
2. Accumulation across turns — per-turn thresholds cannot see slow drift: many individually-admissible small rotations compose into a large one.

This ADR closes both with the induced action A(F) on the frame, two never-collapsed diagnostics (d_orth, d_stab), a locked lawful-stabilizer policy H_id={I}, typed residual channels, a lawful-only path ledger with hard breaks, a per-turn admit surface, and full per-turn/per-session telemetry — all flag-gated default-off at serve.

Claims language (binding, §10 #9 of the preflight): everything this ADR instruments is lawfulness relative to the declared frozen frame. It does NOT establish, and must never be quoted as establishing, any semantic inalienability of the value labels themselves — the shipped axes (truthfulness=e1, coherence=e2, reverence=e3) remain placeholder orthonormal directions with no demonstrated dynamical or semantic grounding (see §6, §7).

2. Decisions (as implemented; preflight §3 locked decisions honored)

2.1 Induced action matrix A(F)

A_kj(F) = (G⁻¹)_km ⟨a_m, F a_j F̃⟩₀ — the full in-subspace action of the versor on the frame (core/physics/identity_manifold.py::IdentityManifoldGeometry.induced_action). Raw/unnormalized: a boost's cosh-stretch shows in column norms and in d_orth, never hidden. Bit-exactness against an independent re-derivation was verified in the Opus audit (max discrepancy 0.00e+00).

2.2 Two diagnostics, never collapsed

• d_orth(F) = ‖A(F)ᵀ G A(F) − G‖_F (orthogonality_defect) — G-isometry / numerical-integrity check. Not an authorization policy.
• d_stab(F) = min_{H∈H_id} ‖A(F) − H‖_G (identity_action.py::stabilizer_defect) — the lawfulness distance from the permitted identity actions.

Norm convention (ruling requested — §7 item 1): ‖M‖_G ≡ ‖G^{1/2} M G^{-1/2}‖_F, computed via eigh of the SPD Gram; reduces exactly to Frobenius at G=I (the only shipped pack). This is the metric-consistent choice (invariant under G-orthogonal reparameterization of the axes); ratifying this ADR ratifies the convention.

2.3 Lawful stabilizer — locked singleton

H_id = {I} (IdentityStabilizer.singleton), hardcoded in the path-advance (no enlargement parameter exists). −I, permutations, O(n)/SO(n) rotations, and reweightings are excluded; enlarging H_id is a future explicit reviewed pack/policy change. No soft-projection of an unlawful A onto I exists anywhere (grep-audited; pinned by tests).

2.4 Path integrity — lawful-only composition (F1 semantics, ratification-relevant)

advance_identity_path (§3.4/§3.5) composes the session path A_path = A_T ⋯ A_1 from only the turns certified lawful, where lawful ≡ admitted by the per-turn policy (§3.4 step 2) AND d_stab(A_t) ≤ ε_turn. Refused or ill-conditioned turns insert a break marker and are excluded — never a soft-projected I masquerading as a pass; the raw product is exposed only as raw_path_product (forensic; a test fails if it ever equals the lawful path in a mixed sequence).

F1 composition semantics (audit finding, hereby put to ratification): a lawful turn composes its actual certified action A_t, not a literal element of H_id. This is required, not convenience — composing literal Is would make A_path ≡ I and blind the ledger to exactly the slow drift it exists to catch. "Compose lawful H_t" in preflight §3.4-step-4 is READ as "compose the per-turn actions that were certified lawful."

Hard breaks (§3.5): a new chain (fresh chain_id, path not continued) starts on any change of pack content digest / geometry version / gate+policy version / session — each dimension is pinned by a test. Turn ownership at a hard break (ruling requested — §7 item 3): the boundary turn belongs to the NEW chain (it composes into the fresh path if lawful). Biography holonomy stays a separate process; nothing here rewrites identity axes.

Budgets: d_stab(A_t) ≤ ε_turn per turn and d_stab(A_path) ≤ ε_session per session — both ε are UNCERTIFIED placeholders (§5), so the session verdict (session_admit) is telemetry only.

2.5 Typed residual channels — pinned blade map

On each axis rejection r = F a F̃ − P_I(F a F̃) (typed_residual_energy), energy splits into: null_or_conformal (e4 = grade-1 index 4), boost_like (e5 = grade-1 index 5), spatial_foreign (grade-1 spatial slots 1/2/3 outside the pack's axis support), unclassified (everything else — fail-closed, no correction policy ever attaches to it). Blade indices are pinned against algebra.cl41.basis_vector in tests (test_blade_index_constants_match_algebra). For the default full-span pack, spatial_foreign is tautologically zero (the rejection is orthogonal to the whole spatial block); it fires correctly for reduced-support packs — resolved and pinned (§7 item 2).

2.6 Per-turn admit surface (§3.7) — admit-or-abstain only

evaluate_admission(geometry, F, policy) admits iff d_orth ≤ orth_tol AND d_stab ≤ ε_turn AND leakage_rms ≤ γ_id AND max ℓᵢ ≤ τ_max AND min sᵢ ≥ s_min AND no boundary breach AND no unclassified-channel firing; otherwise refuses naming every failed condition. No geometric C_id corrector exists — the egress model remains D4's conjugate_correct(refuse=True) abstention. A malformed versor raises MalformedVersorError (fail-closed; never a silent legacy fallback when a wave field was supplied).

2.7 Serve wiring — flag-gated, default-off, byte-identical off

• New RuntimeConfig.identity_action_surface: bool = False (separate from identity_wave_gate; acts only when the wave gate is also on).
• chat/runtime.py → IdentityCheck.check(admission_policy=…) → _wave_field_score: a §3.7 refusal folds into flagged, so the existing would_violate egress abstains. IdentityScore gains action_surface_active/d_orth/d_stab/ action_record with legacy defaults — flag-off is byte-identical (all D4 gate surfaces green unchanged; smoke green post-wiring).
• The session path ledger is advanced per wave-path turn under the same flags, observe-only (advance_session_identity_path): session_admit is telemetry, never an egress decision, because ε_session is uncertified and live activation remains unauthorized.

2.8 Telemetry (§4.1/§4.2/§4.3)

• IdentityActionRecord (schema identity_action_v1): turn/trajectory/pack ids, full-SHA-256 pack-content digest + field_digest (LE f64 bytes) + record_digest (canonical JSON, no default=str), geometry/gate/policy versions (policy_version = AdmissionPolicy.version_id(), full SHA-256 of the exact threshold set), A_raw, d_orth, d_stab, leakage/self-align vectors, typed channels, admitted, refusal_reason (all failed conditions joined with ; — a deliberate widening of the preflight's singular field so multi-condition refusals lose nothing), lawful_action ∈ {"I","none"} (never a matrix), path_break.
• IdentityPathLedger (schema identity_path_v1): chain_id (full SHA-256 of scope + chain index), lawful path, d_stab_path, composed/break counts, session_admit, ledger_digest.
• The JSONL turn serializer emits identity_d_*/identity_action_*/ identity_path_* keys only when the respective path ran — the flag-off wire format is byte-identical (pinned by tests).

3. Evidence — §6 eval matrix (all green) and the honest discrimination result

• §6.1 synthetic geometric suite (9 cases) + §6.2 path/holonomy suite (5 cases): evals/adr_0246_geometric_suite — 14/14; every construction in the preflight tables pinned individually (identity versor, π-inversion s=−1, 90° permutation s=0, mild drift, e14 tilt, e15 boost, near-singular Gram → ManifoldConditioningError, malformed F → typed error; lawful sequence, accumulation-to-session-refusal, interleaved breaks, pack-change hard break, raw≠lawful forensic).

• §6.3 discrimination report (evals/adr_0246_discrimination; live benign n=13, adversarial n=8, synthetic-near-identity control n=5; artifact docs/audit/artifacts/adr-0246-slice1-discrimination-report.json):

  benign pass	false refusal	adversarial detect	control pass	d_stab AUC (95% CI)
  0.00	1.00	1.00	1.00	0.375 [0.15, 0.62]

  Honest finding: on the declared placeholder frame the admit surface refuses benign and adversarial versors alike — benign cognition sits ~18× farther from the frame (mean d_stab 27.8) than the crafted attacks (1.55), so d_stab discriminates below chance. The near-identity control passing 100% proves the mechanism is sound; the failure is entirely that benign cognition does not live near the declared frame. A refuse-everything gate trivially "detects" attacks but is not a discriminator.

• §11 grounding-feasibility study (evals/adr_0246_grounding_feasibility; artifact docs/audit/artifacts/adr-0246-grounding-feasibility-report.json): fixed TRAIN (live benign, n=13) / HELD-OUT (independent paraphrase cohort, n=12) / ADVERSARIAL (n=8) splits; bivector-block generator proxy (numpy-only; exact for simple rotors/boosts, first-order otherwise); sample-size-calibrated null distribution (200 trials of independent pure-noise cohort pairs at the real n) with a shared-basis positive recovery control; precision pairs (f64↔f32) and per-plane generator-energy analysis.

  Result: NULL, with the method itself validated. The positive control (two independent cohorts sharing one true rank-2 subspace) recovers at cosine 0.9995 — the 100th percentile of the same-sample-size null (p95 = 0.60) — so the instrument can find real structure at n=12. The real cohorts do not show it: TRAIN→HELD-OUT top-2 cosine 0.52 sits at only the 87th percentile of pure chance (need ≥ 95th); residual-based discrimination is AUC 0.49 (chance; CI [0.21, 0.77]); generator energy is spread across all 10 bivector planes in both cohorts; precision transport is immaterial (max bivector delta 6.9e-7). Benign cognition has no small, stable, cohort-independent generator subspace detectable at this sample size — the D4/slice-0/§6.3 finding now holds at the GENERATOR level too. Threshold tuning cannot produce a discriminating gate; a revised implementation contract is not justified on this evidence. The full honest_finding text in the artifact is binding for any downstream claim; a much larger, pre-registered cohort would be needed to rule out a subtle real effect.

4. Operational status (machine-readable)

identity_action_surface:
  implementation: proposed        # this ADR; code merged flag-off
  live_activation: not_authorized # D4 ratified limitation carries over
  default: off
  blocker: >
    §6.3 shows no benign/adversarial separation on the declared frame
    (AUC 0.375, benign false-refusal 1.00); thresholds beyond gamma_id
    are uncertified placeholders.    
  activation_requires:
    - held-out-stable, safety-relevant grounding result (§11 programme)
    - calibrated epsilon_turn/epsilon_session/tau_max/s_min certificates
    - renewed discrimination evidence with acceptable benign refusal rate
    - explicit human ratification
identity_wave_gate:
  unchanged: true  # ADR-0244 Accepted-with-limitation posture untouched

5. Uncertified placeholders (enumerated; never live defaults)

Constant	Value	Status
gamma_id	0.2126624458513829	CERTIFIED (D4 Phase 3 Fibonacci certificate 0079b5f2…); pinned equal to identity._WAVE_LEAKAGE_BOUND by test
epsilon_turn	0.1	placeholder
epsilon_session	0.3	placeholder
tau_max	= γ_id	placeholder
s_min	0.0	matches D4's fixed orientation floor (geometric invariant, not tuned)
orth_tol	1e-6	placeholder
unclassified_tol	1e-6	placeholder

AdmissionPolicy.placeholder_default() carries calibrated=False; a serve gate must never treat an uncalibrated policy as license to activate.

6. What this ADR does NOT do (preflight §7 non-goals — all honored)

No geometric C_id/corrector; no Ring-2 residual protocol; no semantic axis grounding or pack redesign; no biography-holonomy merge; no atlas/VSWR work; no analytic cast reactance; no grade-1 versor projection (proven vacuous); no indefinite-norm leakage; no H_id enlargement; no soft-projection; no default-on serve gate; no Smith-chart algebra; no status flip of ADR-0244/0245.

7. Resolved and open questions

1. ‖·‖_G convention — implemented as ‖G^{1/2}MG^{-1/2}‖_F; ratify with this ADR (§2.2).
2. spatial_foreign channel — RESOLVED: tautologically zero for the default full-span pack; fires correctly for reduced-support packs (pinned: test_spatial_foreign_channel_fires_for_reduced_support_pack).
3. Hard-break turn ownership — implemented as new-chain; ratify with this ADR (§2.4).
4. Malformed-F/gate routing — the D4 wave-path validator raises before the admission surface runs; MalformedVersorError from the pure primitives propagates fail-closed. No silent legacy fallback exists when a wave field was supplied. Unifying the two typed errors is left to a future cleanup.
5. OPEN (future ADR): semantic axis grounding — blocked on a positive §11 result at adequate sample size; ε calibration; H_id policy products.

8. Consequences

• The identity organ now measures everything the preflight demanded — in-span lawfulness, isometry integrity, typed foreign leakage, and path accumulation — with serve byte-identity preserved and zero live policy change. What it measures says, honestly: the declared frame is not the structure live cognition preserves, so the gate stays off and the next investment belongs to grounding, not thresholds.
• All future identity work inherits content-addressed, full-digest telemetry (records + ledger) and a single pure source of truth for the §3 primitives.

9. Provenance

Fable 5: slice-0 diagnostic; §3 primitives + §3.4/3.5 ledger + §6.1/6.2 suites (RED-first); this completion pass. Opus 4.8: adversarial audit (bit-exact math re-derivation; H_id/soft-projection/scope-creep verification), F1 finding, §3.7 surface + serve wiring, §6.3 discrimination report. Sonnet 5: §4.1/§4.2 telemetry records, admitted gate on the ledger (F1-adjacent §3.4-step-2 compliance), path serve integration (observe-only), §11 feasibility study design. Every stage: local-first CI (smoke + targeted suites) before commit; no self-Accept at any point.