bc838bd1de
Weekly-audit 2026-07-22, T13 decision (2) ruling (Shay). The Shadow Coherence
Gate hard-refused open-geometry surfaces even when the surface was pack-grounded
and the openness was a geometric-coherence residual the pack never claimed to
certify — a false refusal (the warmed "What is doubt?" case:
"To doubt means to think maybe not. pack-grounded (en_core_meta_v1)." was
replaced by "I cannot certify an answer: ... contract is open (goldtether_residual).").
Fix the reading, not the question: route open-geometry-but-pack-grounded
surfaces to a hedge arm (authoritative=False), discriminated purely by grounding
provenance (structural), never by question type. The query-type classifier
bypass was rejected as a fail-open cue-table (ADR-0252 / INV-34).
- core/cognition/surface_resolution.py: the decision lives INSIDE the gate.
Predicate: pack_grounded (grounding_provenance in {pack, teaching}) AND every
open token in {versor_condition, goldtether_residual}. The ¬hazard clause is
enforced structurally by that residual allowlist — any unrecognized open token
(where a genuine safety/harm/imperative hazard lands), non-pack grounding, or a
None assessment falls through to the unchanged fail-closed refusal. New
authority tag grounded_open_hedge; hedged=True; walk/compose folds suppressed.
- core/cognition/pipeline.py: thread grounding provenance into resolve_surface
(read once at the gate seam, reused for the OOV telemetry).
- docs/adr/ADR-0254: the serving-physics decision + fail-closed argument.
- tests/test_grounded_open_hedge_arm.py: RED->GREEN unit suite + real-data
warmed-session integration.
Genuine safety/harm hazards are unaffected: they ride separate axes
(SafetyVerdict refusal, logos-morph override) that supersede this surface.
[Verification]: hedge suite 15 passed; warmed_session lane pin + architectural
invariants 85 passed (155.8s); GSM8K wrong=0 preserved (16 passed, 3 skipped);
smoke 180 passed (131.65s), exit 0. worktree core-wt-hedge @ base 19847f90.
248 lines
17 KiB
Markdown
248 lines
17 KiB
Markdown
# Weekly Audit — 2026-07-22 — cleanup-week integrity pass, stragglers, and TODO
|
||
|
||
**Scope**: main from PR #76 (`compare_multiplicative` increment plan) through
|
||
PR #97 (`logos` bulk live morph authority) — the week that landed the reader-arc
|
||
recalibration (ADR-0251), the paradigm consolidation (ADR-0252), the Master
|
||
Blueprint collision freeze (ADR-0253 + mapping), and Master Convergence
|
||
Stages 1–4 (#95) plus #96/#97. 134 files, +17,028/−770.
|
||
|
||
**Auditor**: Claude (session audit), read-only verification against
|
||
`forgejo/main` @ `f94dbd40` plus doctrine-authorized hygiene cleanup.
|
||
|
||
---
|
||
|
||
## 1. Verified sound (no action)
|
||
|
||
- **Smoke suite green on landed main**: 180 passed, 0 failed (2:17),
|
||
`uv run core test --suite smoke -q` @ `f94dbd40`.
|
||
- **`uv lock --check`**: lock file consistent with `pyproject` (217 packages).
|
||
- **ADR status registry vs. mapping doc**: ADR-0240 Proposed; 0241–0250 and
|
||
0252–0253 Accepted; 0251 partial (§§1–4 ratified) — matches
|
||
`MASTER-BLUEPRINT-2026-07-20-ADR-MAPPING.md` registry table exactly.
|
||
- **Superseded-in-place annotations** (ADR-0164, ADR-0174, ADR-0243 sketch
|
||
pins, ADR-0244 dual-mode excision rewrite) are present and accurate against
|
||
code: no `_axis_projection` / `_mean_frame_coherence` / scalar-L2 remnants in
|
||
`core/`; `tests/test_stage2_physics_hardening.py` pins the removed symbols
|
||
as absent.
|
||
- **ADR-0252 §9 retirement record**: all five formulations physically moved to
|
||
`docs/paradigm-archive/` with git history preserved (`--follow` verified);
|
||
old paths gone from `docs/analysis|handoffs|implementation`.
|
||
- **Gate defaults match doc claims**: `RuntimeConfig.identity_wave_gate = False`
|
||
(`core/config.py:301`) — consistent with ADR-0244's "live refusal remains
|
||
flag-gated" and the standing non-authorization.
|
||
- **No new TODO/FIXME/HACK markers** entered `*.py` across the whole week's
|
||
diff; no merge-conflict markers anywhere in tracked `*.py`/`*.md`.
|
||
- **New `scripts/measure_trackb_*.py`** are referenced by the Track-B research
|
||
dossiers (not orphans).
|
||
- **`epistemic-taxonomy-ownership-stage3.md`** placement in `docs/adr/` is
|
||
deliberate (binding ownership note, not an ADR renumber) — now indexed from
|
||
`docs/adr/README.md` (fixed in this PR).
|
||
|
||
## 2. Small issues fixed in this PR
|
||
|
||
1. **ADR-0132 dangling parent pointer** — pointed at
|
||
`docs/implementation/semantic-symbolic-binding-graph-proposal.md`, which
|
||
ADR-0252 §9 moved to `docs/paradigm-archive/`. Pointer updated with the
|
||
retirement annotation.
|
||
2. **Stale near-duplicate of ratified ADR-0243** —
|
||
`docs/research/ADR-0243-…md` still carried `Status: Proposed` and had
|
||
drifted from the canonical body by a few annotation lines. Replaced with a
|
||
tombstone pointing at the canonical Accepted ADR; the one annotation unique
|
||
to the copy (`modality_transition_sandwich` ingress note) is preserved in
|
||
the tombstone.
|
||
3. **`docs/adr/README.md`** — added an index entry for the binding
|
||
non-ADR ownership note (`epistemic-taxonomy-ownership-stage3.md`), which was
|
||
referenced nowhere.
|
||
|
||
## 3. Hygiene cleanup performed (session, no PR needed)
|
||
|
||
Per the merge-then-cleanup doctrine (branch AND worktree deleted immediately
|
||
after merge) — all four verified clean and fully merged before removal:
|
||
|
||
- Worktrees removed: `core-postmerge-pr87-integrity-audit` (#88),
|
||
`core-relational-operator-ablation` (#87), `core-wt-trackb` (#85),
|
||
`core-wt-trackb2` (#86); matching local branches deleted.
|
||
- Forgejo remote branches deleted (0 commits ahead of main):
|
||
`feat/trackb-symbolic-sme-s1`, `feat/trackb-symbolic-sme-s2s4`,
|
||
`fix/a2k-fraction-decrease-scale-range`.
|
||
- Local `main` fast-forwarded to `forgejo/main` (`f94dbd40`).
|
||
|
||
## 4. TODO — items needing a ruling or deeper investigation
|
||
|
||
- [ ] **T1 (governance): register convergence-era runtime invariants — or rule
|
||
that tests suffice.** `docs/specs/runtime_contracts.md` cites no ADR newer
|
||
than the 0230s. The week landed several fail-closed runtime invariants that
|
||
are currently enforced only by code + architecture tests: ADR-0244 wave-only
|
||
identity (`MissingWaveStateError`), ADR-0253 dual-pack serve boundary
|
||
(`tests/test_pack_draft_serve_boundary.py`), #96 fail-closed linguistic
|
||
governance phases, #97 bulk live morph authority. `AGENTS.md` invariants
|
||
(INV-…) also saw zero changes all week. Decide: add contract entries /
|
||
INV lines, or record explicitly that the arch-test layer is the SoT here.
|
||
- [ ] **T2 (runtime state): stale `engine_state/` checkpoint.** Smoke emits
|
||
`RuntimeWarning: engine_state checkpoint was written at revision '4b9dbe72…'
|
||
but the current revision is 'f94dbd40…'` (`chat/runtime.py:807`). Given
|
||
continuity doctrine, clearing is NOT something to do casually — decide
|
||
whether to re-baseline the checkpoint on current main or keep it and accept
|
||
the warning.
|
||
- [ ] **T3 (worktree): Antigravity worktree
|
||
`~/.gemini/antigravity/worktrees/core/implement-substrate-linguistic-anchors`**
|
||
— branch tip is ON main history (0 ahead) but the tree has 4 uncommitted
|
||
files. Likely superseded by PR #96 (linguistic governance). Reconcile the
|
||
4 files, then remove worktree + branch.
|
||
- [ ] **T4 (worktrees): two stale detached demo worktrees** —
|
||
`/private/tmp/builder-ii-flagship-demo/demo-worktree` and the
|
||
`grok-goal-…/recipe3_demo_loop/demo-worktree` under `$TMPDIR`, both clean,
|
||
detached @ `18c578d9`. Remove via `git worktree remove` once confirmed no
|
||
running demo serves from them (left alone in this pass for that reason).
|
||
- [ ] **T5 (branch garden): stale branch sweep.** ~50 local branches (many
|
||
`audit-*`, `backup/*`, `chore/*` from May–June) and ~210 `origin/*` branches
|
||
on the GitHub mirror. Needs a batched merged-vs-unmerged triage; separate
|
||
authorization before any mass deletion.
|
||
- [ ] **T6 (active experiments): ADR-0252 §5 structure-mapping worktrees** —
|
||
`core-wt-sme` (`rnd/structure-mapping-experiment`, 1 ahead) and
|
||
`core-wt-sme2` (`rnd/sme-experiment-v2`, 1 ahead + 2 untracked scripts:
|
||
`extract_sme_corpus.py`, `test_single_pair.py`). Active and authorized; track
|
||
them to a dossier/PR so the untracked scripts don't rot outside history.
|
||
- [ ] **T7 (ADR annotation): `modality_transition_sandwich` sentence** — the
|
||
annotation preserved in the ADR-0243 research tombstone exists nowhere in the
|
||
canonical ADR. If it is load-bearing for the SD-B pin record, fold it into
|
||
the canonical ADR-0243 annotation under a separate small ruling.
|
||
- [ ] **T8 (declared debt, consolidation): fold the week's declared residuals
|
||
into next-arc planning.** #97's honest accounting
|
||
(`docs/analysis/logos-bulk-live-authority-residual-2026-07-20.md`) lists six
|
||
open residuals (parallel `generate/linguistic_pipeline` cue tables, lexicon
|
||
breadth, legacy math/meaning_graph IR outside the morph seam, holonomy crown
|
||
not LIVE, disconnected pack frames, single `plural_abstain` rule type). These
|
||
are declared debt, not stragglers — but they now live only in an analysis
|
||
doc; pull them into whatever planning artifact governs the next Logos/IR arc
|
||
so they don't silently age out.
|
||
- [ ] **T9 (docs, minor): historical docs referencing pre-archive paths** —
|
||
`docs/workbench/capability-mastery-implementation-plan.md:33,85-86` and
|
||
`docs/briefs/parallel-2026-05-23/L2-opus2-binding-graph-phase1.md` cite the
|
||
retired paradigm docs at their old `docs/analysis|implementation/` paths.
|
||
Both are point-in-time records; either leave as history (default) or annotate
|
||
with the archive location. No governance weight either way.
|
||
|
||
---
|
||
|
||
## Rulings & execution addendum (2026-07-22, same day)
|
||
|
||
Shay ruled on T1–T9 (pillars: epistemic rigor / absolute provenance /
|
||
fail-closed determinism). Execution status:
|
||
|
||
| Item | Ruling | Status |
|
||
|------|--------|--------|
|
||
| T1 | Tests = executable SoT; contracts/AGENTS = governance SoT — register | **DONE** (this PR): INV-32/33/34 in `AGENTS.md` + new/updated sections in `docs/specs/runtime_contracts.md` (wave-only identity, dual-pack boundary, linguistic governance, morph authority) |
|
||
| T2 | Re-baseline to `f94dbd40` with migration trace | **DONE + root cause found.** Baseline gen-21702 @ `f94dbd404575` (turn 14990, `engine_identity` parent==self `c9e5968a…`, scheme 2, schema v2, packs byte-identical across the gap → reconcile MATCH; no `MissingWaveStateError` exposure — identity consumes the live per-turn field and Shape B+ session persistence is opt-in-off). The warning churn's root cause was the suite itself writing the live store — see T10 |
|
||
| T3 | Diff antigravity files vs #96; salvage or scrap | **DONE**: not #96 material — an un-ADR'd anchor-lens/Hamiltonian experiment (fail-open `except: pass`, unratified serving-physics mutation). Salvaged with full diff → `docs/analysis/antigravity-substrate-linguistic-anchors-salvage-2026-07-22.md`; worktree + branch scrapped |
|
||
| T4 | Nuke /tmp demo worktrees | **DONE** (both removed; worktree list is now 5, all live) |
|
||
| T5 | Hard prune all stale branches; stash unknowns | **DONE locally**: 178 local branches pruned, every tip SHA stashed in `docs/analysis/branch-prune-ledger-2026-07-22.md`. **Origin mirror (204 branches) pending**: bulk remote deletion was tool-permission blocked; operator command in the ledger doc |
|
||
| T6 | No untracked logic in active workspaces | **DONE**: both scripts formalized → `rnd/sme-experiment-v2` @ `bed29a09`. Hazard found & fixed pre-commit: the extractor's glob read ALL of `evals/gsm8k_math/**` (practice/dev/train/public), exceeding the §5 `holdout_dev/v1`-only authorization — now scope-pinned |
|
||
| T7 | Fold `modality_transition_sandwich` into canonical ADR-0243 | **DONE** (annotation folded; tombstone updated to point at it) |
|
||
| T8 | Escalate #97 residuals into this ledger | **DONE** — R1–R6 below |
|
||
| T9 | Global sweep of pre-archive paths | **DONE**: 6 references across 3 docs redirected to `docs/paradigm-archive/` with per-file provenance notes (ADR-0252 §9 retirement record + archive self-references left as deliberate history) |
|
||
|
||
### New findings from the execution pass
|
||
|
||
- [x] **T10 (FIXED + MERGED — PR #100 @ `80100c18`): the test
|
||
suite wrote the live life-store.** Module-scoped fixtures (e.g.
|
||
`tests/test_achat.py`) construct `ChatRuntime()` BEFORE the function-scoped
|
||
isolation fixture exists (pytest sets up wider scopes first), binding the
|
||
real `engine_state/`: smoke runs loaded it and committed generations
|
||
(turn_count 14989→14990 observed). Fix: session-scoped baseline fixture +
|
||
regression pin; `docs/issues/default-engine-state-test-hygiene.md` addendum.
|
||
- [x] **T11 (RULED + EXECUTED 2026-07-22): live-store provenance reset.**
|
||
DECISIVE FINDING: candidates carry NO timestamp / run-id / test-prod field
|
||
(only a `source_turn_trace` hash + `review_state`), and gen-21701 == gen-21702
|
||
were byte-identical — "the 465" was the ENTIRE live candidate corpus, not a
|
||
separable tainted subset, so a surgical per-record quarantine (the original
|
||
`TEST_TAINTED` spec) was impossible. The candidates were inert (proposal /
|
||
contemplation only, never the serving surface). **Ruling (Shay): Option (a) —
|
||
clear, don't asterisk.** Executed via
|
||
`scripts/ops/reset_candidate_corpus_t11_20260722.py`: an ADR-0219 atomic
|
||
generation reset (begin → carry recognizers/session/identity+turn_count →
|
||
empty candidate ledger → commit `keep=1`). Result: candidates 465 → 0,
|
||
`turn_count` 14990 preserved, gen-21701/21702 physically GC'd, `current` →
|
||
gen-21703 @ `9a428d84`. Idle-tick discovery repopulates organically.
|
||
**`turn_count` itself left as-is** (honest lived count; the pre-fix test turns
|
||
are not separably identifiable, and resetting the counter would fabricate a
|
||
number — the candidate corpus was the provenance hazard, not the scalar).
|
||
- [ ] **T12 (pattern watch): experiment scaffolding scope over-reach.** The T6
|
||
glob hazard suggests a cheap architecture pin: `rnd`/scripts corpus readers
|
||
should be lint-checked against sealed/practice eval paths.
|
||
|
||
### R1–R6 — PR #97 declared residuals (escalated per T8; source:
|
||
`docs/analysis/logos-bulk-live-authority-residual-2026-07-20.md`)
|
||
|
||
- [ ] **R1** — `generate/linguistic_pipeline` cue tables (English "sold"/"mkr"
|
||
hand maps) remain a parallel constraint producer on the governance demo
|
||
path; they consult no `packs/data/he_*` morphology and are not answer
|
||
authority. Migrate onto the Logos morph seam or retire.
|
||
- [ ] **R2** — lexicon breadth: only `he_logos_micro_v1` observed surfaces; no
|
||
full HE/GRC tables, no binyan universals, no GRC case→role.
|
||
- [ ] **R3** — legacy math / meaning_graph IR still parallel outside the Logos
|
||
morph seam; not migrated onto `semantic_primitives`.
|
||
- [ ] **R4** — holonomy crown not robust; no LIVE claim.
|
||
- [ ] **R5** — pack frames largely disconnected (sense disambiguation);
|
||
first-match pack semantics unchanged outside the morph rule.
|
||
- [ ] **R6** — one rule type only (`he_morph_v0.plural_abstain`);
|
||
construct-state / prep+case / aspect deferred.
|
||
- [ ] **R7** (opened by the T13 fix, 2026-07-22) — the opt-in telemetry SINK
|
||
stream (`attach_telemetry_sink`) still receives the pre-override `TurnEvent`
|
||
(pre-resolution surface + empty `trace_hash`) — the same provisional-then-
|
||
back-stamped limitation `finalize_turn_trace_hash` already carries. A single
|
||
deferred sink emission at the pipeline serve boundary would repair BOTH
|
||
surface and `trace_hash` in the durable stream. Deferred (default sink is
|
||
`None`, so no live consumer is affected today); own PR when a sink consumer
|
||
lands.
|
||
- [x] **T13 (main regression, serving-provenance — telemetry FIXED + MERGED #101):
|
||
fast lane was red on main** (was 0-red 2026-07-16):
|
||
`tests/test_warmed_session_lane.py::TestPipelineOverrideGateInvariants::test_telemetry_consistency_rate_is_one`
|
||
fails at 0.9444 (17/18). Verified pre-existing on unmodified main (fails
|
||
plain AND state-isolated; unrelated to the T10 isolation fix). Root cause:
|
||
`CognitiveTurnPipeline.run()` emits `TurnEvent` inside `runtime.chat()`
|
||
(`core/cognition/pipeline.py:287`) and only THEN applies the PR #96
|
||
fail-closed surface resolution (`resolve_surface`, line 470) and the PR #97
|
||
logos morph override (~line 517) — so an overridden turn serves a surface
|
||
telemetry never saw. Introduced by `e0d1b475` (#96). Reproducer: warmed
|
||
case "What is doubt?" — TurnEvent carries the pack-grounded surface
|
||
("To doubt means to think maybe not. pack-grounded (en_core_meta_v1).")
|
||
while the pipeline returns the typed refusal ("I cannot certify an answer:
|
||
the geometric coherence contract is open (goldtether_residual)."). Two
|
||
decisions for the fix PR: (1) restore single-point surface truth — emit
|
||
(or re-stamp) `TurnEvent` AFTER surface resolution; runtime_contracts'
|
||
selection policy + this lane must move in the same PR per the contract's
|
||
own rule; (2) rule whether an open goldtether residual should refuse a
|
||
pack-grounded, honestly-hedged definition at all (possible over-refusal —
|
||
the pack surface never claimed geometric certification). Note: smoke does
|
||
not cover this lane, and GitHub Actions are dead signals — nothing gates
|
||
fast-lane red on main right now.
|
||
|
||
**Resolution (2026-07-22, PR #101 `fix/telemetry-serve-boundary` @ `9a428d84`, MERGED):**
|
||
- **(1) FIXED** — `ChatRuntime.finalize_turn_surface` back-stamps the
|
||
pipeline's resolved surface onto `turn_log[-1]`, a sibling to
|
||
`finalize_turn_trace_hash`, called from `pipeline.py` immediately after
|
||
the trace-hash back-stamp. Lane green: `telemetry_consistency_rate`
|
||
0.9444 → 1.0 (10/10 warmed_session tests pass). `trace_hash` byte-identity
|
||
preserved — it folds the pre-decoration surface, not the served surface.
|
||
- **(2) RULED + IMPLEMENTED (PR #103, `feat/grounded-open-geometry-hedge-arm`, ADR-0254).**
|
||
Ruling: fix the READING, not the question — route open-geometry-but-**pack-grounded**
|
||
surfaces to a hedge arm (`authoritative=False`, honestly hedged), discriminated
|
||
by grounding *provenance* (structural), never by question type (the query-type
|
||
classifier bypass was REJECTED as a fail-open cue-table; ADR-0252 + INV-34).
|
||
Built: the decision lives **inside the gate** (`resolve_surface`) — predicate
|
||
`pack_grounded ∧ every open token ∈ {versor_condition, goldtether_residual}`.
|
||
`¬hazard` is enforced structurally by that residual allowlist: any unrecognized
|
||
open token (where a real safety/harm hazard lands), non-pack grounding, or
|
||
`None` assessment → unchanged hard refusal. New authority tag
|
||
`grounded_open_hedge`. Validation: RED→GREEN unit suite +
|
||
`warmed_session_consistency` real-data (the "What is doubt?" over-refusal now
|
||
hedges) + GSM8K `wrong=0` preserved + architectural invariants green.
|
||
**Deferred:** unifying the hedge marker with the ADR-0038 manifold
|
||
`preferred_hedge_soft` vocabulary (defer substrate-vocab commitment).
|
||
- **(3) RULED (Shay, 2026-07-22): local pre-push gate — IMPLEMENTED.**
|
||
`scripts/hooks/pre-push` + `scripts/hooks/install.sh` (`core.hooksPath`) run
|
||
the smoke suite **plus** the warmed_session lane pin on every push — the
|
||
targeted gate (NOT the ~9-min full fast-lane, which stays async CI).
|
||
AGENTS.md §Local-First CI Validation Protocol updated. (This PR.)
|
||
- Durable-sink residual tracked as **R7** above.
|