7cb826a548
The final AGI-spine step (A INSTRUMENT → B WIRE → C DEEPEN → D CLOSE → E ESTIMATION).
The engine may now SERVE a DISCLOSED estimate for a query it would otherwise refuse —
but only for a predicate-class that has measured itself reliable, and never as fact.
This executes the ADR-0206 §5 cognition-path widening: the bridge's LICENSE node
(reliability_gate.license_for), previously "built — not yet called from serving", is now
called. govern_response returns APPROXIMATE iff a genuine licensed Action.SERVE
LicenseDecision is passed (STRICT for every other input — so every existing serving call
site is byte-identical); shape_surface DISCLOSES the estimate as "[approximate] …".
Mechanism:
- generate/determine/estimate.py — a BLIND converse-guesser: told p(a,b), asked p(b,a),
it commits the converse. It never reads the pack's symmetry metadata; whether the guess
is right is MEASURED, not assumed.
- evals/determination_estimation/ — the gold lane: run_practice (sealed, ADR-0199) folds
the converse-guesser over symmetric (sibling_of) vs directed (parent_of) cases, scored
against the pack's graph.edge.symmetric truth (gold independent of the solver). The gate
DISCRIMINATES: sibling_of earns SERVE (660 correct → Wilson floor 0.990046 ≥ θ_SERVE),
parent_of does not (660 wrong → 0.0). The license is earned by VOLUME — 657 perfect
commits is the exact θ_SERVE=0.99 threshold (656 is below).
- generate/determine/data/estimation_ledger.json — the ratified committed ledger,
hash-verified on load (a hand-edited ledger raises RatifiedLedgerError); it IS the
deterministic sealed-practice output (a GSM8K-style --check test pins this).
- chat/runtime.py — when a converse query is refused and the class holds a SERVE license,
the disclosed estimate is surfaced through the bridge (gated by config.estimation_enabled,
default OFF; only meaningful with accrue_realized_knowledge).
Invariants:
- wrong=0 by construction — an estimate is ALWAYS disclosed ([approximate]), never a silent
commit (UNVERIFIED_POSSIBLE is never in APPROXIMATE's admissible set), and only a genuine
ratified license widens (a forged {"licensed":True} dict / a PROPOSE license / an
unlicensed SERVE all stay STRICT). Defense-in-depth: type-gate ∧ admissible-set ∧
hardcoded disclosed state.
- never self-authored — ceilings stay at safe defaults (θ_SERVE=0.99); the engine cannot
raise its own bar. The ledger is sealed practice, hash-verified.
- session/serving only — no corpus/pack/identity/proposal/vault mutation; the HITL teaching
path is untouched. Deterministic; no clock/random.
- byte-identical for every non-E turn (the 2643 govern_response call passes no license).
Out of scope (separate ADR-0206 §5 PRs): the math-serving seam (select_self_verified,
touches the sealed metric), SITUATE (stakes), and the live FEED-BACK loop.
Verified green: smoke (90), architectural invariants (56), response_governance (321,
incl. the new license-gated widening test), the determination-estimation lane (12), and
the B/D/determine regression net. Four-lens adversarial review (disclosure/wrong=0,
calibration integrity, byte-identity, boundary/determinism): all held. Design:
docs/analysis/E-estimation-design-2026-06-06.md.
83 lines
5 KiB
Markdown
83 lines
5 KiB
Markdown
# Step E — ESTIMATION: calibrated, disclosed estimation via the ADR-0206 reach bridge
|
|
|
|
**Date:** 2026-06-06
|
|
**Branch:** `feat/learned-estimation`
|
|
**Sequence:** A INSTRUMENT → B WIRE → C DEEPEN → D CLOSE → **E ESTIMATION** (last)
|
|
**Executes:** ADR-0206 §5 (cognition-path widening) — the `LICENSE` node ("built — not yet called from serving") finally called from serving.
|
|
|
|
## What E is (and is not)
|
|
|
|
E lets the engine **commit a disclosed estimate** for a class it has *measured itself
|
|
reliable on*, instead of always refusing past proof. It is **not** generic guessing,
|
|
not a probabilistic model, and it does **not** touch the sealed GSM8K serving metric
|
|
(that is a separate, riskier ADR-0206 §5 PR — `select_self_verified`).
|
|
|
|
The whole step is one wire: `govern_response` consults `reliability_gate.license_for(…,
|
|
Action.SERVE)`; a licensed class reaches `ReachLevel.APPROXIMATE`; `shape_surface`
|
|
**discloses** the estimate with an `[approximate]` prefix.
|
|
|
|
## Why it is wrong=0-safe by construction
|
|
|
|
`shape_surface(APPROXIMATE)` never commits an estimate silently — it prefixes
|
|
`[approximate]`. So an estimate that is wrong is a **disclosed**-wrong, categorically
|
|
different from the silent/asserted wrong the `wrong=0` invariant forbids. The reliability
|
|
gate (θ_SERVE=0.99 on a committed `ClassTally`) governs *when* the disclosed estimate is
|
|
even offered. Two independent guards: disclosure (honesty) + license (calibration).
|
|
|
|
## The estimator — a blind converse-guesser
|
|
|
|
Given a realized `p(a, b)` and a query `p(b, a)`, the estimator commits the **converse**
|
|
as a candidate. It is **blind** — it never reads the pack's symmetry metadata. Therefore:
|
|
|
|
- on a **symmetric** predicate (`sibling_of`, `spouse_of`, `equal_to`, `distinct_from`,
|
|
`adjacent_to`, `overlaps_event` — `graph.edge.symmetric`) the converse is **true**;
|
|
- on a **directed** predicate (`parent_of`, `less_than`, `before_event`, … —
|
|
`graph.edge.directed`) the converse is **false**.
|
|
|
|
The engine does not *know* which is which. It **measures** its converse-guess precision
|
|
per predicate-class over a gold lane and earns a SERVE license only where the measured
|
|
floor clears θ. That is calibrated learning (ADR-0175): reliability is commitment
|
|
precision, earned by volume. The symmetry metadata is the **gold** (the `GoldTether`'s
|
|
truth), never a serving-time shortcut.
|
|
|
|
## The committed ledger (real, sealed, HITL-ratified)
|
|
|
|
- `evals/determination_estimation/gold.py` deterministically generates the gold cases:
|
|
657+ symmetric converse cases for the licensed class (gold=true) and a directed class
|
|
(gold=false). 657 is the Wilson volume floor: a perfect record clears θ_SERVE=0.99 at
|
|
`n/(n+z²) ≥ 0.99`, `z=2.576` ⇒ `n ≥ 657`. Reliability is earned by volume, never a
|
|
lucky streak — so the gold lane is sized to that bar, not the bar to the lane.
|
|
- `core.learning_arena.run_practice` folds a `DomainSolver` (the converse-guesser) +
|
|
`GoldTether` (symmetry-as-truth) over the cases → `dict[str, ClassTally]`.
|
|
- The resulting ledger (per-class committed counts) is frozen as a **ratified artifact**
|
|
(`evals/determination_estimation/ratified_ledger.json`) with an expected-hash. Committing
|
|
it via a reviewed PR **is** the HITL ratification. Ceilings stay at safe defaults
|
|
(θ_SERVE=0.99) — no override, so the engine never raises its own bar (invariant #4).
|
|
|
|
## The wire (E-3, the delicate part)
|
|
|
|
In `chat/runtime.py`, gated by a new config flag (default OFF): when a turn is a
|
|
**converse query** (`p(b,a)` asked, `p(a,b)` realized, `p(b,a)` not directly
|
|
determinable) whose predicate-class holds a committed `license_for(SERVE).licensed`,
|
|
pass that real `LicenseDecision` into `govern_response` → it emits `APPROXIMATE` →
|
|
`shape_surface` discloses the converse estimate as `[approximate] …`. Every other turn,
|
|
and every unlicensed class, stays `STRICT` (byte-identical, wrong=0 untouched). Never a
|
|
designed-in default: absent a cleared committed tally, refuse.
|
|
|
|
## Falsification — `evals/determination_estimation`
|
|
|
|
A frozen replay asserts:
|
|
- **Discriminating gate:** the symmetric class is SERVE-licensed; the directed class is
|
|
not (its converse-guess reliability is ~0 over the committed lane).
|
|
- **Disclosed estimate:** a licensed converse query yields an `[approximate]`-prefixed
|
|
surface; an unlicensed one stays STRICT-refuse, byte-identical to pre-E.
|
|
- **No silent estimate:** every reach > STRICT carries the disclosure prefix.
|
|
- **wrong=0 (silent):** zero silently-committed wrong answers — every estimate is disclosed.
|
|
- **Volume floor:** below 657 committed the symmetric class is NOT licensed (the bar binds).
|
|
- **Determinism:** the ledger + verdicts reproduce byte-identically (frozen expected hash).
|
|
|
|
## Out of scope (separate PRs)
|
|
- The **math-serving seam** (`select_self_verified`) — ADR-0206 §5, touches the sealed metric.
|
|
- **SITUATE** (stakes/gravity) and the live **FEED-BACK** loop (serving outcome → ledger) —
|
|
ADR-0206 §1 "designed, not built". E uses an offline, sealed, ratified ledger.
|
|
- `EXTRAPOLATE` / `CREATIVE` reach levels (need `VERIFIED` / novelty capabilities).
|