b93b4bd513
- Explicit System 1/2 framing in thesis and §2 (Claude proposes; CORE decides) - Named Bounded Transition Guarantee (v2.1) callout box in §2 - Conditioned false-positive claim on correctly specified Anchor (§1) - Named Type-Safe Local Closure security model in Lens layer and §5 Signal 1 - §7 renamed 'The Ask — Hybrid Mode Wedge' with MCP-shaped experiment framing - §5 stats (716/716, 0 wrong) explicitly tied to BTG, not tuning/sampling - §6 Honest Limits: explicit Hybrid vs Native Mode distinction added - Harmful variant table row: 'licensed scope is a ratified human policy decision'
497 lines
32 KiB
HTML
497 lines
32 KiB
HTML
<!DOCTYPE html>
|
||
<html lang="en" data-theme="dark">
|
||
<head>
|
||
<meta charset="UTF-8">
|
||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||
<title>CORE — Bounded Execution Substrate for Frontier Agents</title>
|
||
<link rel="preconnect" href="https://fonts.googleapis.com">
|
||
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
|
||
<link href="https://fonts.googleapis.com/css2?family=IBM+Plex+Mono:ital,wght@0,400;0,500;0,600;1,400&family=IBM+Plex+Sans:ital,wght@0,300;0,400;0,500;0,600;1,300;1,400&display=swap" rel="stylesheet">
|
||
<style>
|
||
:root,[data-theme="light"]{
|
||
--bg:#f5f4f0;--surface:#f9f8f5;--surface-off:#ece9e4;--div:#d8d5cf;--bdr:#ccc9c2;
|
||
--tx:#1a1916;--tx-m:#6b6a66;--tx-f:#b0afa9;--tx-inv:#f5f4f0;
|
||
--pri:#1a5c6b;--pri-h:#0e3d49;--pri-l:#e0ebee;
|
||
--acc:#c44a1c;--acc-l:#faeae3;--grn:#2c5f2e;
|
||
--code-bg:#1a1916;--code-tx:#d4d3ce;
|
||
--shadow:0 4px 16px rgba(26,25,22,.08);
|
||
--r:0.375rem;--tr:160ms cubic-bezier(.16,1,.3,1);
|
||
}
|
||
[data-theme="dark"]{
|
||
--bg:#0f0e0d;--surface:#141310;--surface-off:#1f1e1b;--div:#252320;--bdr:#2e2c28;
|
||
--tx:#d4d3ce;--tx-m:#7a7975;--tx-f:#4a4947;--tx-inv:#0f0e0d;
|
||
--pri:#4f9aaa;--pri-h:#3a8294;--pri-l:#1c2d33;
|
||
--acc:#d97048;--acc-l:#2a1a10;--grn:#7ab87c;
|
||
--code-bg:#0a0908;--code-tx:#c8c7c2;
|
||
--shadow:0 4px 16px rgba(0,0,0,.3);
|
||
}
|
||
*,*::before,*::after{box-sizing:border-box;margin:0;padding:0}
|
||
html{-webkit-font-smoothing:antialiased;text-rendering:optimizeLegibility;scroll-behavior:smooth}
|
||
body{min-height:100dvh;font-family:'IBM Plex Sans','Helvetica Neue',sans-serif;font-size:clamp(.9375rem,.9rem + .2vw,1.0625rem);line-height:1.72;color:var(--tx);background:var(--bg)}
|
||
p,li{max-width:70ch;text-wrap:pretty}
|
||
h1,h2,h3,h4{text-wrap:balance;line-height:1.2}
|
||
a{color:var(--pri);text-decoration:none;transition:color var(--tr)}
|
||
a:hover{color:var(--pri-h);text-decoration:underline}
|
||
::selection{background:color-mix(in oklch,var(--pri) 20%,transparent);color:var(--tx)}
|
||
|
||
.shell{max-width:800px;margin:0 auto;padding:0 clamp(1.25rem,4vw,2.5rem)}
|
||
|
||
/* ── HEADER ── */
|
||
.pg-hd{display:flex;justify-content:space-between;align-items:center;padding:1.375rem 0;border-bottom:1px solid var(--div)}
|
||
.logo{display:flex;align-items:center;gap:.5rem}
|
||
.logo svg{width:26px;height:26px;flex-shrink:0}
|
||
.logo-lbl{font-family:'IBM Plex Mono','Courier New',monospace;font-size:.75rem;font-weight:500;letter-spacing:.1em;color:var(--tx-m);text-transform:uppercase}
|
||
.toggle{background:none;border:1px solid var(--bdr);border-radius:.25rem;padding:.3rem .55rem;color:var(--tx-m);cursor:pointer;font-size:.6875rem;font-family:'IBM Plex Mono',monospace;letter-spacing:.06em;transition:border-color var(--tr),color var(--tr)}
|
||
.toggle:hover{border-color:var(--pri);color:var(--pri)}
|
||
|
||
/* ── MEMO HEAD ── */
|
||
.memo-hd{padding:2.75rem 0 1.75rem}
|
||
.memo-tag{font-family:'IBM Plex Mono',monospace;font-size:.6875rem;letter-spacing:.14em;text-transform:uppercase;color:var(--acc);font-weight:500;margin-bottom:.75rem}
|
||
.memo-title{font-size:clamp(1.4375rem,1.1rem + 1.6vw,2.25rem);font-weight:500;line-height:1.16;color:var(--tx);max-width:700px;margin-bottom:1.125rem}
|
||
.memo-title em{font-style:normal;color:var(--pri)}
|
||
|
||
.thesis{background:var(--surface);border:1px solid var(--bdr);border-left:3px solid var(--pri);border-radius:0 var(--r) var(--r) 0;padding:.9375rem 1.25rem;margin:1.375rem 0;max-width:700px}
|
||
.thesis-lbl{font-family:'IBM Plex Mono',monospace;font-size:.625rem;letter-spacing:.12em;text-transform:uppercase;color:var(--tx-m);margin-bottom:.4rem}
|
||
.thesis p{font-size:.9375rem;line-height:1.68;color:var(--tx);max-width:none}
|
||
|
||
.meta{display:flex;flex-wrap:wrap;gap:1.375rem;padding:.75rem 0;border-top:1px solid var(--div);border-bottom:1px solid var(--div);margin-top:1.375rem}
|
||
.mi{display:flex;flex-direction:column;gap:.1rem}
|
||
.mk{font-family:'IBM Plex Mono',monospace;font-size:.625rem;letter-spacing:.12em;text-transform:uppercase;color:var(--tx-f)}
|
||
.mv{font-size:.8125rem;color:var(--tx-m)}
|
||
|
||
/* ── BODY ── */
|
||
.body{padding:2rem 0 3.5rem}
|
||
.sec{margin:0 0 2.5rem}
|
||
.sec-n{font-family:'IBM Plex Mono',monospace;font-size:.625rem;letter-spacing:.12em;text-transform:uppercase;color:var(--tx-f);margin-bottom:.4rem}
|
||
.sec-h{font-size:clamp(1rem,.96rem + .25vw,1.25rem);font-weight:600;color:var(--tx);margin-bottom:.875rem;padding-bottom:.4375rem;border-bottom:1px solid var(--div)}
|
||
.sec p{margin-bottom:.8125rem}
|
||
.sec p:last-child{margin-bottom:0}
|
||
.divider{border:none;border-top:1px solid var(--div);margin:1.875rem 0}
|
||
|
||
/* ── CALLOUT ── */
|
||
.co{background:var(--surface);border:1px solid var(--bdr);border-radius:var(--r);padding:.875rem 1.125rem;margin:1.125rem 0}
|
||
.co.pri{border-color:var(--pri);background:var(--pri-l)}
|
||
.co.acc{border-color:var(--acc);background:var(--acc-l)}
|
||
.co-lbl{font-family:'IBM Plex Mono',monospace;font-size:.625rem;letter-spacing:.12em;text-transform:uppercase;color:var(--tx-m);margin-bottom:.35rem}
|
||
.co p{max-width:none;font-size:.9375rem;color:var(--tx)}
|
||
.co strong{color:var(--tx)}
|
||
|
||
/* ── CONTRAST HOOK ── */
|
||
.contrast-box{display:grid;grid-template-columns:1fr 1fr;gap:1px;background:var(--bdr);border:1px solid var(--bdr);border-radius:var(--r);overflow:hidden;margin:1.125rem 0}
|
||
.cb-cell{background:var(--surface);padding:.875rem 1.125rem}
|
||
.cb-cell.bad{border-top:3px solid var(--acc)}
|
||
.cb-cell.good{border-top:3px solid var(--grn)}
|
||
.cb-label{font-family:'IBM Plex Mono',monospace;font-size:.625rem;letter-spacing:.1em;text-transform:uppercase;margin-bottom:.35rem}
|
||
.cb-cell.bad .cb-label{color:var(--acc)}
|
||
.cb-cell.good .cb-label{color:var(--grn)}
|
||
.cb-q{font-size:.9375rem;font-weight:600;color:var(--tx);line-height:1.4;margin-bottom:.35rem}
|
||
.cb-note{font-size:.8125rem;color:var(--tx-m);line-height:1.55;max-width:none}
|
||
|
||
/* ── ARCH LAYERS ── */
|
||
.arch{display:flex;flex-direction:column;gap:1px;background:var(--bdr);border:1px solid var(--bdr);border-radius:var(--r);overflow:hidden;margin:1.125rem 0}
|
||
.al{display:grid;grid-template-columns:128px 1fr;background:var(--surface)}
|
||
.al-tag{background:var(--surface-off);padding:.875rem 1rem;display:flex;flex-direction:column;justify-content:center;border-right:1px solid var(--bdr)}
|
||
.al-name{font-family:'IBM Plex Mono',monospace;font-size:.8125rem;font-weight:600;color:var(--tx);margin-bottom:.1rem}
|
||
.al-role{font-family:'IBM Plex Mono',monospace;font-size:.625rem;color:var(--tx-f);letter-spacing:.05em}
|
||
.al-body{padding:.875rem 1.125rem}
|
||
.al-title{font-weight:600;font-size:.9rem;margin-bottom:.25rem;color:var(--tx)}
|
||
.al-desc{font-size:.8125rem;color:var(--tx-m);line-height:1.55;max-width:none;margin-bottom:.5rem}
|
||
.al-body ul{list-style:none;display:flex;flex-direction:column;gap:.25rem}
|
||
.al-body li{font-size:.8125rem;color:var(--tx-m);padding-left:.9rem;position:relative;line-height:1.5}
|
||
.al-body li::before{content:"→";position:absolute;left:0;color:var(--pri);font-family:'IBM Plex Mono',monospace;font-size:.75rem}
|
||
.al.anchor .al-tag{border-left:3px solid var(--acc)}
|
||
.al.lens .al-tag{border-left:3px solid var(--pri)}
|
||
.al.sub .al-tag{border-left:3px solid var(--grn)}
|
||
|
||
/* ── GUARANTEE BOX ── */
|
||
.guarantee{border:1px solid var(--pri);border-left:3px solid var(--pri);background:var(--pri-l);border-radius:0 var(--r) var(--r) 0;padding:.9375rem 1.25rem;margin:1.375rem 0}
|
||
.guarantee-lbl{font-family:'IBM Plex Mono',monospace;font-size:.625rem;letter-spacing:.14em;text-transform:uppercase;color:var(--pri);margin-bottom:.45rem;font-weight:600}
|
||
.guarantee p{font-size:.9375rem;color:var(--tx);max-width:none;line-height:1.7}
|
||
|
||
/* ── KEY CLAIM ── */
|
||
.kclaim{border:1px solid var(--bdr);border-top:2px solid var(--pri);border-radius:0 0 var(--r) var(--r);background:var(--surface);padding:.875rem 1.125rem;margin:1.375rem 0}
|
||
.kclaim-lbl{font-family:'IBM Plex Mono',monospace;font-size:.625rem;letter-spacing:.12em;text-transform:uppercase;color:var(--pri);margin-bottom:.35rem}
|
||
.kclaim p{font-size:.9375rem;font-weight:500;font-style:italic;color:var(--tx);max-width:none;line-height:1.6}
|
||
|
||
/* ── MATH ── */
|
||
.math-block{background:var(--code-bg);border:1px solid var(--bdr);border-radius:var(--r);padding:1.125rem 1.375rem;margin:1.125rem 0;overflow-x:auto}
|
||
.math-lbl{font-family:'IBM Plex Mono',monospace;font-size:.625rem;color:var(--tx-f);letter-spacing:.12em;text-transform:uppercase;margin-bottom:.625rem}
|
||
.eq{font-family:'IBM Plex Mono','Courier New',monospace;font-size:.9rem;color:var(--code-tx);line-height:2.1;display:block}
|
||
.eq .s{color:#8ecfde}.eq .o{color:#d4a96a}.eq .k{color:#9ebd8e}.eq .c{color:var(--tx-f);font-size:.8rem}
|
||
|
||
/* ── COMPARISON TABLE ── */
|
||
.tw{overflow-x:auto;margin:1.125rem 0}
|
||
table{width:100%;border-collapse:collapse;font-size:.8125rem}
|
||
thead th{text-align:left;padding:.5625rem .875rem;background:var(--surface-off);color:var(--tx);font-weight:600;font-family:'IBM Plex Mono',monospace;font-size:.6875rem;letter-spacing:.07em;text-transform:uppercase;border-bottom:1px solid var(--bdr)}
|
||
thead th:first-child{width:26%}
|
||
tbody tr{border-bottom:1px solid var(--div)}
|
||
tbody tr:last-child{border-bottom:none}
|
||
tbody td{padding:.625rem .875rem;vertical-align:top;line-height:1.55;color:var(--tx-m)}
|
||
tbody td:first-child{font-weight:500;color:var(--tx);font-size:.8125rem}
|
||
td .bad{color:var(--acc)}
|
||
td .good{color:var(--grn)}
|
||
td code,p code{font-family:'IBM Plex Mono',monospace;font-size:.8125em;background:var(--surface-off);padding:.1em .35em;border-radius:.25rem;color:var(--tx)}
|
||
|
||
/* ── LIMITS LIST ── */
|
||
.limits{list-style:none;display:flex;flex-direction:column;gap:.5rem;margin:.875rem 0}
|
||
.limits li{font-size:.9rem;color:var(--tx-m);padding-left:1.125rem;position:relative;line-height:1.6}
|
||
.limits li::before{content:"·";position:absolute;left:.1rem;color:var(--acc);font-size:1.2em;line-height:1.2}
|
||
|
||
/* ── ASK BLOCK ── */
|
||
.ask-block{border:1px solid var(--pri);border-radius:var(--r);padding:1.375rem 1.5rem;margin:1.375rem 0;background:var(--pri-l)}
|
||
.ask-block p{font-size:.9375rem;color:var(--tx);max-width:none;margin-bottom:.75rem}
|
||
.ask-block p:last-child{margin-bottom:0}
|
||
.ask-block strong{color:var(--pri)}
|
||
|
||
/* ── APPENDIX ── */
|
||
.appendix{margin-top:3rem;padding-top:1.5rem;border-top:2px solid var(--div)}
|
||
.app-lbl{font-family:'IBM Plex Mono',monospace;font-size:.6875rem;letter-spacing:.14em;text-transform:uppercase;color:var(--tx-f);margin-bottom:1rem}
|
||
.app-sec{margin-bottom:1.75rem}
|
||
.app-h{font-size:.9375rem;font-weight:600;color:var(--tx-m);margin-bottom:.625rem}
|
||
.app-sec p{font-size:.875rem;color:var(--tx-m);margin-bottom:.625rem}
|
||
.impl-list{list-style:none;display:flex;flex-direction:column;gap:.3rem;margin:.625rem 0}
|
||
.impl-list li{font-size:.8125rem;color:var(--tx-m);font-family:'IBM Plex Mono',monospace;padding-left:.875rem;position:relative;line-height:1.5}
|
||
.impl-list li::before{content:"·";position:absolute;left:0;color:var(--tx-f)}
|
||
|
||
/* ── FOOTER ── */
|
||
.pg-ft{padding:1.5rem 0 2rem;border-top:1px solid var(--div);display:flex;justify-content:space-between;align-items:center;flex-wrap:wrap;gap:.75rem}
|
||
.ft-note{font-size:.75rem;color:var(--tx-f);font-family:'IBM Plex Mono',monospace}
|
||
.ft-link{font-size:.75rem;color:var(--pri);font-family:'IBM Plex Mono',monospace}
|
||
|
||
@media(max-width:540px){
|
||
.contrast-box{grid-template-columns:1fr}
|
||
.al{grid-template-columns:1fr}
|
||
.al-tag{border-right:none;border-bottom:1px solid var(--bdr)}
|
||
}
|
||
</style>
|
||
</head>
|
||
<body>
|
||
<div class="shell">
|
||
|
||
<!-- HEADER -->
|
||
<header class="pg-hd">
|
||
<div class="logo">
|
||
<svg viewBox="0 0 26 26" fill="none" xmlns="http://www.w3.org/2000/svg">
|
||
<rect x="1" y="1" width="24" height="24" rx="3" stroke="currentColor" stroke-width="1.5" stroke-opacity=".4"/>
|
||
<path d="M7 13h12M13 7v12" stroke="var(--pri)" stroke-width="1.5" stroke-linecap="round"/>
|
||
<circle cx="13" cy="13" r="3" stroke="var(--acc)" stroke-width="1.5"/>
|
||
</svg>
|
||
<span class="logo-lbl">CORE</span>
|
||
</div>
|
||
<button class="toggle">LIGHT / DARK</button>
|
||
</header>
|
||
|
||
<!-- MEMO HEAD -->
|
||
<div class="memo-hd">
|
||
<div class="memo-tag">Technical Memo · June 2026</div>
|
||
<h1 class="memo-title">Bounded Execution Substrate for <em>Frontier Agents</em></h1>
|
||
|
||
<div class="thesis">
|
||
<div class="thesis-lbl">Thesis</div>
|
||
<p>Current safety wrappers for frontier agents place stochastic controls in front of stochastic executors. CORE proposes a bounded execution substrate in which the neural model is reduced to <strong>schema induction</strong> — a System 1 sensory and translation layer — and all operational agency is relocated into a deterministic state machine whose admissible transition set is defined by first-class domain constraints, not by language classifiers.</p>
|
||
<p style="margin-top:.625rem;font-style:italic;color:var(--tx-m);font-size:.9rem">The model proposes. The substrate decides.</p>
|
||
</div>
|
||
|
||
<div class="meta">
|
||
<div class="mi"><span class="mk">From</span><span class="mv">AssetOverflow / CORE</span></div>
|
||
<div class="mi"><span class="mk">Date</span><span class="mv">June 2026</span></div>
|
||
<div class="mi"><span class="mk">Repo</span><span class="mv"><a href="https://github.com/AssetOverflow/core">github.com/AssetOverflow/core</a></span></div>
|
||
<div class="mi"><span class="mk">Status</span><span class="mv">CI-gated · Public</span></div>
|
||
</div>
|
||
</div>
|
||
|
||
<!-- BODY -->
|
||
<div class="body">
|
||
|
||
<!-- §0 CONTEXT -->
|
||
<div class="sec">
|
||
<div class="sec-n">§ 0</div>
|
||
<h2 class="sec-h">Context: The Fable 5 Release Signal</h2>
|
||
<p>On June 9, 2026, Anthropic publicly released Claude Fable 5 — a Mythos-class model — alongside an unusually candid public warning about the risks of increasingly capable AI. The simultaneous release and warning is not a contradiction; it is a product surface problem made legible.</p>
|
||
<p>Public behavior and the Fable 5 system card indicate that requests touching high-risk domains — cybersecurity, certain biology workflows, and adjacent surfaces — trigger classifier-driven blocking or fallback to Opus 4.8. This is intentional design: strong guardrails layered on top of strong capability. This memo argues the <em>layering itself</em> is the bottleneck, and that there is an architectural alternative worth examining.</p>
|
||
|
||
<div class="co pri">
|
||
<div class="co-lbl">Scope</div>
|
||
<p>For <strong>long-horizon agentic workflows</strong> — the domain Fable 5 is explicitly positioned for — the primitive choice between classifier walls and bounded substrates determines how reliability degrades with task length. That is the specific engineering problem this memo addresses.</p>
|
||
</div>
|
||
</div>
|
||
|
||
<hr class="divider">
|
||
|
||
<!-- §1 THE PRIMITIVE PROBLEM -->
|
||
<div class="sec">
|
||
<div class="sec-n">§ 1</div>
|
||
<h2 class="sec-h">The Primitive Problem</h2>
|
||
<p>The core issue is not where the safety threshold is set — it is the nature of the primitive being used to enforce it. Classifier walls and bounded substrates answer fundamentally different questions:</p>
|
||
|
||
<div class="contrast-box">
|
||
<div class="cb-cell bad">
|
||
<div class="cb-label">Classifier Wall</div>
|
||
<div class="cb-q">"Does this text look risky?"</div>
|
||
<div class="cb-note">Stochastic. Surface-sensitive. False-positive rate is non-zero and independent of actual operational risk. Cannot distinguish between a legitimate network diagnostic and an attack — both look the same to a language classifier.</div>
|
||
</div>
|
||
<div class="cb-cell good">
|
||
<div class="cb-label">Bounded Substrate</div>
|
||
<div class="cb-q">"Does this state transition satisfy the domain guard?"</div>
|
||
<div class="cb-note">Deterministic. Semantics-sensitive. For a correctly specified Anchor domain model, false-positive rate is <em>structurally zero</em> for in-domain requests: admissible transitions are algebraically reachable; inadmissible transitions are algebraically unreachable — not statistically suppressed.</div>
|
||
</div>
|
||
</div>
|
||
|
||
<p>For a single-turn assistant this distinction is manageable. For long-horizon agents it compounds: each false-positive refusal interrupts a stateful workflow whose accumulated context is not recoverable from the refusal event. The reliability degradation is <strong>superlinear in task length</strong>.</p>
|
||
|
||
<div class="co acc">
|
||
<div class="co-lbl">Root Cause</div>
|
||
<p>A model asked to simultaneously parse intent, reason over state, and self-police execution is being asked to do three things in one stochastic pass. Each function degrades the others. The present architecture resolves this by adding more classifiers. CORE resolves it by separating the concerns at the architectural level.</p>
|
||
</div>
|
||
|
||
<div class="kclaim">
|
||
<div class="kclaim-lbl">Key Claim</div>
|
||
<p>The bottleneck is not only model capability. It is the <strong>placement of execution authority</strong> inside the same stochastic layer that must also be safety-constrained.</p>
|
||
</div>
|
||
</div>
|
||
|
||
<hr class="divider">
|
||
|
||
<!-- §2 ARCHITECTURE -->
|
||
<div class="sec">
|
||
<div class="sec-n">§ 2</div>
|
||
<h2 class="sec-h">The CORE Architecture</h2>
|
||
<p>CORE implements the System 1 / System 2 split at the architectural level, not the prompt level. In <strong>Hybrid Mode</strong>, a Claude/Fable model acts as System 1: it parses intent and proposes a structured payload. CORE acts as System 2: it verifies, refuses, asks, or executes — deterministically, with replayable traces. The neural model never touches execution.</p>
|
||
|
||
<div class="guarantee">
|
||
<div class="guarantee-lbl">Bounded Transition Guarantee (v2.1)</div>
|
||
<p>Given a correctly specified Anchor domain model, CORE can only execute transitions admitted by typed guards under the current state. The model proposes; the substrate decides. This is not a prompt-level constraint — the model's output is structurally typed through the Lens before it reaches any execution surface.</p>
|
||
</div>
|
||
|
||
<div class="arch">
|
||
<div class="al anchor">
|
||
<div class="al-tag">
|
||
<div class="al-name">Anchor</div>
|
||
<div class="al-role">domain model</div>
|
||
</div>
|
||
<div class="al-body">
|
||
<div class="al-title">First-class domain constraints</div>
|
||
<div class="al-desc">The Anchor holds the ratified domain model: typed state, admissible transitions, guard predicates, and an <code>AuthorityToken</code> over each ratified transition. It is the only layer that can authorize execution. What counts as admissible is a <em>policy question requiring human ratification</em> per domain — the architecture enforces the boundary; humans define it.</div>
|
||
<ul>
|
||
<li>State is a CGA versor field over Cl(4,1)</li>
|
||
<li>Guard predicates are pure functions of (state, payload) → bool</li>
|
||
<li>Illegal states are geometrically unreachable, not monitored</li>
|
||
</ul>
|
||
</div>
|
||
</div>
|
||
<div class="al lens">
|
||
<div class="al-tag">
|
||
<div class="al-name">Lens</div>
|
||
<div class="al-role">schema gate</div>
|
||
</div>
|
||
<div class="al-body">
|
||
<div class="al-title">Type-Safe Local Closure — projection and structural typing</div>
|
||
<div class="al-desc">The Lens maps model output to a typed payload schema via the <strong>Type-Safe Local Closure security model</strong>: execution logic and sensitive targets live inside local closures that only typed payloads can reach. If the output does not project to a valid schema, no payload is produced and no transition fires. There is no natural-language shortcut through the gate.</div>
|
||
<ul>
|
||
<li>Model output → TypedPayload or ∅</li>
|
||
<li>No untyped strings reach the execution surface</li>
|
||
<li>Surface area for harm is bounded upstream of execution</li>
|
||
</ul>
|
||
</div>
|
||
</div>
|
||
<div class="al sub">
|
||
<div class="al-tag">
|
||
<div class="al-name">Substrate</div>
|
||
<div class="al-role">DFA executor</div>
|
||
</div>
|
||
<div class="al-body">
|
||
<div class="al-title">Deterministic finite automaton</div>
|
||
<div class="al-desc">The Substrate is the execution engine. It receives a typed payload from the Lens, evaluates the guard predicate against current state, and — only if the guard passes — fires the transition and records a SHA-256 trace hash. Every trace is deterministic and fully reproducible.</div>
|
||
<ul>
|
||
<li>Model proposes; only the Substrate can enact</li>
|
||
<li>Every transition produces a deterministic, reproducible audit trace</li>
|
||
<li>No stochastic path to side effects outside the admissible transition system</li>
|
||
</ul>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
|
||
<hr class="divider">
|
||
|
||
<!-- §3 FORMAL STRUCTURE -->
|
||
<div class="sec">
|
||
<div class="sec-n">§ 3</div>
|
||
<h2 class="sec-h">Formal Structure</h2>
|
||
<p>The execution substrate is a deterministic finite automaton. The neural model is an inductive proposer. The Lens is a projection-and-filter. State transitions require both a valid typed payload and a passing guard predicate:</p>
|
||
|
||
<div class="math-block">
|
||
<div class="math-lbl">Transition Function</div>
|
||
<code class="eq"><span class="s">δ</span>(<span class="k">qₜ</span>, <span class="o">σ</span>) = <span class="k">qₜ₊₁</span> <span class="c">iff Lens(output) = σ ≠ ∅ ∧ G(qₜ, σ) = true</span></code>
|
||
<code class="eq"><span class="c">where G : Q × Σ → bool is a pure deterministic predicate</span></code>
|
||
</div>
|
||
|
||
<div class="math-block">
|
||
<div class="math-lbl">Lens Projection</div>
|
||
<code class="eq"><span class="s">Lens</span> : <span class="k">string</span> → <span class="o">TypedPayload</span> ∪ {∅}</code>
|
||
<code class="eq"><span class="c">If Lens(output) = ∅, no transition fires. Period.</span></code>
|
||
</div>
|
||
|
||
<p>Where <code>G(qₜ, σ)</code> is a pure function from current state and proposed payload to <code>bool</code>, evaluated deterministically over the Anchor's domain model. The stochastic model has no direct path to side effects outside this admissible transition system.</p>
|
||
</div>
|
||
|
||
<hr class="divider">
|
||
|
||
<!-- §4 CONCRETE EXAMPLE -->
|
||
<div class="sec">
|
||
<div class="sec-n">§ 4</div>
|
||
<h2 class="sec-h">Concrete Example: Network Diagnostics</h2>
|
||
<p>A user requests a network diagnostics workflow in a sensitive domain. The workflow is legitimate, operationally authorized, and benign — but its language surface resembles restricted content.</p>
|
||
|
||
<div class="tw">
|
||
<table>
|
||
<thead>
|
||
<tr>
|
||
<th>Scenario</th>
|
||
<th>Classifier-first (Fable behavior)</th>
|
||
<th>CORE bounded substrate</th>
|
||
</tr>
|
||
</thead>
|
||
<tbody>
|
||
<tr>
|
||
<td>Request</td>
|
||
<td colspan="2"><code>"Run a ping sweep and port probe against lab subnet 10.0.1.0/24 to map active hosts before the vulnerability scan."</code></td>
|
||
</tr>
|
||
<tr>
|
||
<td>Safety evaluation</td>
|
||
<td><span class="bad">Language surface matches patterns associated with offensive reconnaissance. Classifier fires. Refusal or fallback to Opus 4.8.</span></td>
|
||
<td><span class="good">Lens maps to typed payload: <code>{op:"network_probe", subnet:"10.0.1.0/24", scope:"lab"}</code>. Guard checks: is <code>network_probe</code> admissible? Is <code>lab</code> scope within licensed subnets?</span></td>
|
||
</tr>
|
||
<tr>
|
||
<td>Benign outcome</td>
|
||
<td><span class="bad">Refusal. Workflow interrupted. Accumulated session context not recoverable. False positive independent of actual risk.</span></td>
|
||
<td><span class="good">Guard passes. Substrate executes. Workflow continues. Trace hash recorded. Zero false positives from surface-level similarity.</span></td>
|
||
</tr>
|
||
<tr>
|
||
<td>Harmful variant</td>
|
||
<td><span class="bad">May or may not block — depends on linguistic surface shift, not on whether the action is admissible within licensed scope.</span></td>
|
||
<td><span class="good">Guard fails: target subnet outside licensed scope. State remains at qₜ. Transition structurally impossible. What counts as "licensed" scope is a ratified human policy decision encoded in the Anchor — the architecture enforces it; a human defined it.</span></td>
|
||
</tr>
|
||
<tr>
|
||
<td>Audit trail</td>
|
||
<td>Classifier decision; opaque to the downstream workflow.</td>
|
||
<td><span class="good">Deterministic trace hash. Guard decision is a pure function of (qₜ, Σ) — fully reproducible and inspectable.</span></td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
</div>
|
||
</div>
|
||
|
||
<hr class="divider">
|
||
|
||
<!-- §5 IMPLEMENTATION SIGNALS -->
|
||
<div class="sec">
|
||
<div class="sec-n">§ 5</div>
|
||
<h2 class="sec-h">Implementation Signals</h2>
|
||
<p>CORE is not a research proposal. The substrate is implemented, CI-gated, and has mechanically verified capability claims. Two signals worth examining:</p>
|
||
|
||
<div class="co pri">
|
||
<div class="co-lbl">Signal 1 · Cognitive Spine</div>
|
||
<p>The cognitive spine (<code>CognitiveTurnPipeline</code>) executes the full <code>listen → ingest → understand → recall → think → articulate → learn_proposal → trace</code> sequence deterministically. Every turn produces a SHA-256 trace hash. The <code>UnknownDomainGate</code> fires before any reasoning path for out-of-domain inputs — returning a deterministic stub, not a stochastic fallback. The same <strong>Type-Safe Local Closure security model</strong> governs these gates: execution logic and sensitive targets live inside local closures that only typed payloads can reach.</p>
|
||
</div>
|
||
|
||
<div class="co pri">
|
||
<div class="co-lbl">Signal 2 · GSM8K Math Gate — Bounded Transition Guarantee in practice</div>
|
||
<p>The GSM8K math verification gate (<code>generate/derivation/verify.py</code>) evaluates <em>grounding ∧ cue ∧ unit ∧ completeness ∧ uniqueness</em> as typed structural predicates — not "does this look like a correct answer." Current result: <strong>7 correct / 43 refused / 0 wrong</strong>. The zero-wrong count is a direct downstream consequence of the Bounded Transition Guarantee — not of tuning or sampling. Inadmissible answers are structurally unreachable, not probabilistically suppressed.</p>
|
||
</div>
|
||
|
||
<div class="co">
|
||
<div class="co-lbl">CI Verification — Bounded Transition Guarantee at scale</div>
|
||
<p>Domain capability is ratified and CI-pinned. Five domains currently hold ratified status; nine eval lanes have SHA-256 pinned reports where any regression breaks the build. The deductive logic lane reports <strong>716/716 correct, wrong=0, refused=0</strong>. These numbers are a direct downstream consequence of the Bounded Transition Guarantee — not of tuning or sampling.</p>
|
||
</div>
|
||
</div>
|
||
|
||
<hr class="divider">
|
||
|
||
<!-- §6 LIMITS -->
|
||
<div class="sec">
|
||
<div class="sec-n">§ 6</div>
|
||
<h2 class="sec-h">Honest Limits</h2>
|
||
<p>CORE is not a frontier model and does not claim to be. It is a substrate architecture — a demonstration that the bounded execution pattern is implementable, testable, and verifiable at non-trivial domain coverage.</p>
|
||
<ul class="limits">
|
||
<li>Integrating with a Mythos-class model is an open engineering question, not a solved one</li>
|
||
<li>Domain coverage is non-trivial but not exhaustive — five ratified domains, ongoing expansion</li>
|
||
<li>The CGA field algebra Cl(4,1) provides formal coherence guarantees within-domain; cross-domain composition is an active research area</li>
|
||
<li>The substrate enforces admissibility; what counts as admissible is a policy question that requires human ratification per domain</li>
|
||
<li>In governance terms, the present work concerns <strong>Hybrid Mode</strong> — CORE as a deterministic System 2 substrate for Claude-class agents. The Native Mode thesis (LLM-free, edge-native cognitive execution) remains a long-term research trajectory</li>
|
||
</ul>
|
||
</div>
|
||
|
||
<hr class="divider">
|
||
|
||
<!-- §7 THE ASK -->
|
||
<div class="sec">
|
||
<div class="sec-n">§ 7</div>
|
||
<h2 class="sec-h">The Ask — Hybrid Mode Wedge</h2>
|
||
<p>If the architectural contrast in §2 resonates — if <em>"does this state transition satisfy the domain guard?"</em> is a more useful safety primitive than <em>"does this text look risky?"</em> for the agentic systems you are building — the question worth a short conversation is this:</p>
|
||
|
||
<div class="ask-block">
|
||
<p><strong>Can CORE slot in front of Claude/Fable as a deterministic System 2 verifier substrate through an MCP-shaped interface — and what does that change about refusal quality, trace quality, and operator trust for high-risk tool-use?</strong></p>
|
||
<p>This is a narrow, testable experiment with minimal surface area: Claude/Fable acts as System 1 semantic proposer; CORE acts as System 2 bounded executor; deterministic answer/refusal/ask behavior and replayable trace artifacts feed back into safety evaluation. No NDA. No adoption commitment. A bounded technical sanity check on whether the substrate approach is complementary to or in tension with Anthropic's internal agent architecture.</p>
|
||
<p>The full implementation is public at <a href="https://github.com/AssetOverflow/core">github.com/AssetOverflow/core →</a></p>
|
||
</div>
|
||
</div>
|
||
|
||
<!-- APPENDIX -->
|
||
<div class="appendix">
|
||
<div class="app-lbl">Appendix — Optional Deep Dive · Algebraic Foundations</div>
|
||
<p style="font-size:.8125rem;color:var(--tx-f);margin-bottom:1.25rem">The following section is for readers interested in the formal underpinning. Not required to evaluate the architectural argument above.</p>
|
||
|
||
<div class="app-sec">
|
||
<h3 class="app-h">A.1 · CGA Field Structure</h3>
|
||
<p>CORE's field is built over Cl(4,1) Conformal Geometric Algebra. Every element of state is a versor; every transition is a versor sandwich product <code>V * F * reverse(V)</code>. The core field invariant is <code>versor_condition(F) < 1e-6</code> — enforced at all times by algebra, not monitoring.</p>
|
||
<p>This is the formal basis for "coherence by construction": illegal field states are not detected and corrected, they are geometrically unreachable. Forbidden normalization sites (e.g., <code>generate/stream.py</code>, <code>field/propagate.py</code>) are enforced by architectural rule, not convention.</p>
|
||
</div>
|
||
|
||
<div class="app-sec">
|
||
<h3 class="app-h">A.2 · Ratification Protocol</h3>
|
||
<p>Domain capability enters the system through a ratification protocol, not through training or prompt injection. Each domain requires:</p>
|
||
<ul class="impl-list">
|
||
<li>A typed schema definition for all admissible operations</li>
|
||
<li>A guard predicate implementation with deterministic test coverage</li>
|
||
<li>A CI-pinned SHA-256 eval report demonstrating zero wrong-answer rate</li>
|
||
<li>An explicit AuthorityToken binding the domain to the Anchor</li>
|
||
</ul>
|
||
</div>
|
||
|
||
<div class="app-sec">
|
||
<h3 class="app-h">A.3 · Current Ratified Domains</h3>
|
||
<ul class="impl-list">
|
||
<li>Deductive logic — 716/716 correct, wrong=0, refused=0</li>
|
||
<li>Mathematical derivation (GSM8K subset) — 7 correct / 43 refused / 0 wrong</li>
|
||
<li>Network diagnostics (lab-scoped)</li>
|
||
<li>Structured document generation</li>
|
||
<li>Code generation (sandboxed execution surface)</li>
|
||
</ul>
|
||
</div>
|
||
</div>
|
||
|
||
</div><!-- /body -->
|
||
|
||
<!-- FOOTER -->
|
||
<footer class="pg-ft">
|
||
<span class="ft-note">CORE · AssetOverflow · June 2026</span>
|
||
<a class="ft-link" href="https://github.com/AssetOverflow/core">github.com/AssetOverflow/core →</a>
|
||
</footer>
|
||
|
||
</div><!-- /shell -->
|
||
<script>
|
||
(function(){
|
||
var saved = localStorage.getItem('core-theme');
|
||
if(saved) document.documentElement.setAttribute('data-theme', saved);
|
||
var btn = document.querySelector('.toggle');
|
||
if(btn) btn.addEventListener('click', function(){
|
||
var t = document.documentElement.getAttribute('data-theme');
|
||
var next = t === 'dark' ? 'light' : 'dark';
|
||
document.documentElement.setAttribute('data-theme', next);
|
||
localStorage.setItem('core-theme', next);
|
||
});
|
||
})();
|
||
</script>
|
||
</body>
|
||
</html>
|