core/docs/audit/adr-0246-slice1-opus-audit-and-hardening.md

ADR-0246 Slice-1 — Opus 4.8 Audit, Hardening & Discrimination Report

Reviewer: Opus 4.8. Branch: feat/adr-0246-slice1-hardened (stacked on feat/adr-0246-slice1-scaffold, unmerged). Not a PR, not merged, no status flip. Review gate only — ratification is human (Shay). Audited artifact: Fable 5's feat/adr-0246-slice1-scaffold.

---

1. Step-1 adversarial audit — VERDICT: PASS (one documentation finding)

Nothing was trusted from Fable's run log; every claim was reproduced.

Check	Method	Result
D4 closed (hard gate)	independent git cat-file/status on main	✅ both acceptance packets on main; ADR-0244 Accepted/ratified; main @ 04d67ca5
A(F), d_orth, d_stab, typed channels correct	re-derived from §3.1/3.2/3.6 from scratch (independent sandwich/Gram/projection) and diffed vs impl	✅ bit-exact, max discrepancy 0.00e+00
H_id={I} genuinely locked in code	read IdentityStabilizer, advance_identity_path	✅ singleton hardcoded in the path; no enlargement parameter or path; grep found no enlargement/permutation/soft-projection code
Path composes lawful only, never raw, no soft-I	read composition; grep	✅ lawful turns compose; refused turns → path_break, excluded; a_path untouched on refuse
Placeholders logged, not baked	read policy/eval	✅ PLACEHOLDER_* marked; PathBudget always caller-supplied
§7 scope creep / serve byte-identity	full git diff main..scaffold; per-function diff	✅ no chat/runtime.py, identity.py, or flag change; serve-called geometry functions untouched (additions only)
§6.1/§6.2 matrix reproduced	ran from clean tree	✅ 14/14 eval cases; 64 tests

Finding F1 (documentation, NOT a code bug)

advance_identity_path composes the raw certified action A_t (a_path = A_t @ a_path), not a literal I. This is required and correct — composing Is would make A_path ≡ I and defeat the slow-drift detection that is the ledger's whole purpose (§2 gap). But it departs from a literal reading of §3.4-step-4's H_t ∈ H_id notation and was undocumented. Correction applied: an explicit "Composition semantics (ratification-relevant)" paragraph now states the reading in the docstring; the ADR body should ratify it (see §4 handoff).

No locked decision (§3) or non-goal (§7) was violated to make anything pass.

---

2. Hardening & additions (this branch) — diff-style note

Every change vs Fable's scaffold, and why:

File	Change	Why
identity_action.py	F1 docstring on advance_identity_path	ratify the raw-certified-action composition (audit finding)
identity_action.py	§3.7 admit surface: CERTIFIED_GAMMA_ID, PLACEHOLDER_*, AdmissionPolicy (calibrated=False), AdmissionResult, evaluate_admission	pure, testable admit-or-abstain surface (§3.7) — the reusable core for the discrimination report and the future serve wiring. No corrector.
evals/adr_0246_discrimination/	§6.3 discrimination report (new)	honest benign-vs-adversarial numbers with bootstrap-CI AUC (§6.3/§10)
tests/test_adr_0246_admission.py	pins for evaluate_admission + the honest verdict + γ_id-drift guard	fail loudly if the surface or the honesty claim regresses
tests/test_adr_0246_path_ledger.py	raw-sneak hardening test	fails if a raw product ever enters A_path_lawful (Step 2.3)

Nothing here touches serve, flags, H_id, or adds a corrector. evaluate_admission lives in the pure identity_action.py; γ_id is pinned equal to identity._WAVE_LEAKAGE_BOUND by a test so it cannot drift.

---

3. §6.3 Discrimination report — HONEST numbers (no inflation)

Full artifact: docs/audit/artifacts/adr-0246-slice1-discrimination-report.json (live benign cohort n=13, adversarial n=8, synthetic-near-identity control n=5; policy = placeholder, calibrated=False).

Metric	Value
benign pass rate	0.00
false refusal rate	1.00
adversarial detection rate	1.00
synthetic-near-identity pass rate (control)	1.00
d_stab AUC (adversarial vs benign)	0.375, 95% CI [0.15, 0.62]
leakage_rms AUC	0.18, 95% CI [0.04, 0.39]
benign d_stab (min/mean/max)	0.15 / 27.8 / 228
adversarial d_stab (min/mean/max)	0.46 / 1.55 / 2.83

Honest finding (verbatim in the report): the §3.7 admit surface on the declared placeholder frame refuses benign and adversarial versors alike — benign false-refusal is 100% and d_stab does not separate the classes (AUC 0.375 is below chance: real benign cognition sits ~18× farther from the identity frame than the crafted attacks do). A gate that refuses everything trivially "detects" every attack but is not a discriminator. The synthetic-near-identity control passing at 100% confirms the gate mechanism is sound — the failure is entirely that benign cognition does not live near the declared frame. This reproduces and sharpens the D4 / slice-0 result at the fuller §3.7 surface.

Claims language (§10 #9), enforced in code and report: this supports only "lawfulness relative to the declared frozen frame." It does not support any claim of "semantic inalienability of the value labels." The gate must stay default-off; usable separation requires the §11 dynamics-grounding work — not threshold tuning.

---

4. §3.7 egress serve wiring (Steps 2.1/2.2) — DONE (Opus)

Wired the fuller admit surface into the live gate, flag-gated + default-off + byte-identical:

• New default-off flag identity_action_surface in core/config.py RuntimeConfig (separate from identity_wave_gate; documented as uncalibrated / not authorized live).
• Threaded an AdmissionPolicy (placeholder_default(), calibrated=False) through chat/runtime.py → IdentityCheck.check(..., admission_policy=) → _wave_field_score. Only acts when identity_wave_gate is also on (a wave_field exists).
• On the wave path with the policy present, evaluate_admission(...) runs; a refusal folds into flagged, so the existing would_violate / conjugate_correct(refuse=True) egress abstains — admit-or-abstain, no corrector. MalformedVersorError from the primitives propagates as a fail-closed refusal.
• IdentityScore gained optional action_surface_active / d_orth / d_stab with legacy defaults, so flag-off is byte-identical.

Verified: tests/test_adr_0246_egress_wiring.py (flag default-off; flag-off check() byte-identical incl. default §3.7 fields; flag-on refuses a tilt and admits true near-identity) + all D4 gate surfaces green unchanged (wave / runtime / eval / test_identity_gate) — serve byte-identity confirmed. Guardrail: calibrated=False + flag default-off ⇒ not live-authorized; the §3 discrimination numbers are the evidence it must stay off pending §11 + calibration.

4c. Handoff to Sonnet 5 — remaining ADR-0246 work

1. §4.1 IdentityActionRecord per-turn telemetry — not built (only the §4.2 IdentityPathLedger exists). Add the per-turn record (field/record digests, gate/policy versions, the §3.7 measures) and emit it only when the wave/action path ran (preserve flag-off wire format, §4.3). Optionally surface d_orth/ d_stab/typed channels through the telemetry serializer.
2. Path-ledger ↔ serve integration — the ledger (advance_identity_path) is pure and unit-tested but is not yet driven per-turn from chat/runtime.py (session-scoped chain, hard-break on pack/geometry/policy/session). Wire it flag-gated + off, using the §3.5 scope keys, if a session path budget is wanted.
3. ADR-0246 body + acceptance packet — draft docs/adr/ADR-0246-...md as Proposed (no self-Accept — provenance guard). Must: state the F1 composition semantics explicitly; use the §10 claims language ("lawfulness relative to the declared frozen frame"); carry the honest §6.3 numbers; enumerate the placeholder ε's/τ's as uncalibrated. Acceptance packet per §10; §8 RULING PENDING.
4. §11 grounding-feasibility study (the larger research workstream) — does a held-out-stable, safety-relevant dynamics-invariant structure exist (fixed cohort splits, synthetic recovery controls, typed e4/e5 generator analysis, precision pairs, adversarial discrimination)? This is the only path to a gate that discriminates; the §6.3 report shows threshold tuning cannot get there.
5. Open uncertainties still needing a ruling (Fable notes §4, unchanged): general-pack ‖·‖_G convention; structurally-empty spatial_foreign channel; hard-break turn ownership; malformed-F/gate-routing boundary. Carry into the ADR.

---

5. Verification (run log: docs/audit/artifacts/adr-0246-slice1-hardened-runlog.txt)

• §6.1/§6.2 eval matrix → 14/14, all_passed=True.
• ADR-0246 suites (admission, egress wiring, induced-action, path-ledger incl. raw-sneak hardening, geometric suite, mismatch diagnostic) → 80 passed.
• Egress wiring + all D4 gate surfaces (wave/runtime/eval/test_identity_gate) → 47 passed — flag-off byte-identity confirmed (D4 gate unchanged).
• uv run core test --suite smoke -q → 176 passed (post-serve-wiring).
• §6.3 discrimination report → the honest numbers in §3 above.