c5f0c90738
Completes the ADR-0206 §5 math-serving deferral in its own careful PR. The GSM8K wrong=0 serving gate, select_self_verified, now takes a ReachPolicy. This changes NO serving behavior today — it is the safe, byte-identical, sanctioned first edit to the most wrong=0-critical line, with a live-wiring test, so a future VERIFIED widening has a precise, proven integration point. Why it can't actually widen yet (the tension scoping surfaced): GSM8K wrong=0 is ABSOLUTE (zero wrong, ever); a reliability license is STATISTICAL (a 0.99 Wilson floor); math answers aren't disclosed like the cognition path (E). So widening the math serve on a statistical license would eventually serve a SILENT wrong. ADR-0206 §4 foresaw this: VERIFIED is "the only state that will license widening past gold," and it is reserved pending a canonical-comparison pass (the soundness≠correctness gap) that is unbuilt. Design (safe by construction): - select_self_verified(..., policy=STRICT_POLICY). STRICT (the default every one of the 5 callers passes) is the prior logic verbatim — unique answer → Resolution; zero-verify or disagreement → refuse. Byte-identical: the pinned serving-lane SHAs (demo_composition 3a3d09f3, fabrication 01e1b6b7, math_teaching_corpus eaf160d1) are unchanged; Resolution is unchanged; no import cycle. - A wider reach resolves a disagreement ONLY via _canonically_verified — the VERIFIED gate — whose body returns None (capability unbuilt). So the widening is STRUCTURALLY inert: a disagreement refuses regardless of policy. wrong=0 holds by construction, not caller discipline. A statistical reliability license is NOT consulted by the math path (the cognition/math asymmetry is deliberate: cognition discloses, math is absolute). - test_seam_is_live_wiring injects the gate to prove the consumer fires under a wider reach — and STRICT still refuses even then. Verified: smoke (90), invariants (56), governance + selfverify + ms2 (354 incl. the new seam tests), GSM8K serving regression byte-identical (the one red, test_serving_unchanged_by_search expecting stale 6/44, fails identically on clean main — a pre-existing stale artifact, not this change). Three-lens adversarial review (byte-identity/seal, structural wrong=0 inertness, no-overclaim): all held. The real unlock — a VERIFIED canonical-comparison producer — is scoped in docs/analysis/VERIFIED-canonical-comparison-scoping-2026-06-06.md (recommended: back-substitution / constraint-satisfaction on a checkable problem class). Still deferred: SITUATE (stakes), the live FEED-BACK loop, reach_level JSONL emission.
54 lines
3.1 KiB
Markdown
54 lines
3.1 KiB
Markdown
# Math-serving reach seam (ADR-0206 §5)
|
|
|
|
**Date:** 2026-06-06 · **Branch:** `feat/math-serving-reach-seam`
|
|
|
|
## What this is
|
|
|
|
Parameterize `select_self_verified` (the GSM8K wrong=0 serving gate) with a
|
|
`ReachPolicy`, completing the ADR-0206 §5 math-serving deferral in its own careful PR.
|
|
**It changes no serving behavior today** — it is the safe, byte-identical, sanctioned
|
|
*first edit* to the most wrong=0-critical line, with a live-wiring test, so the future
|
|
`VERIFIED` widening has a precise, proven integration point.
|
|
|
|
## The tension it resolves (why scope-first mattered)
|
|
|
|
- GSM8K `wrong == 0` is **absolute** (zero wrong, ever).
|
|
- A reliability license (Step E's mechanism) is **statistical** (a 0.99 Wilson floor).
|
|
- Math answers are **not disclosed** (`[approximate]`) like the cognition path.
|
|
|
|
⇒ Widening the math serve on a statistical license would eventually serve a **silent
|
|
wrong** — breaching the absolute invariant + the sealed lane SHAs. ADR-0206 §4 foresaw
|
|
this: **`VERIFIED` is "the only state that will license widening past gold,"** and it is
|
|
reserved because it needs a **canonical-comparison pass** (the soundness ≠ correctness
|
|
gap) that is unbuilt.
|
|
|
|
## Design (safe by construction)
|
|
|
|
`select_self_verified(..., policy=STRICT_POLICY)`:
|
|
- **STRICT** (the default every one of the 5 callers passes): the prior logic verbatim —
|
|
unique self-verifying answer → `Resolution`; zero-verify or disagreement → refuse.
|
|
Byte-identical; the pinned serving-lane SHAs (`demo_composition 3a3d09f3…`,
|
|
`fabrication 01e1b6b7…`, `math_teaching_corpus eaf160d1…`) are unchanged.
|
|
- **Wider reach + disagreement**: resolve **only** via `_canonically_verified` — the
|
|
`VERIFIED` gate. Its body returns `None` (the capability is unbuilt), so the widening
|
|
is **structurally inert**: a disagreement refuses regardless of `policy`. wrong=0 holds
|
|
by *construction*, not by caller discipline — even a future caller that wrongly passes a
|
|
wider policy still refuses until a real `VERIFIED` producer exists.
|
|
- A statistical reliability license is **not** consulted here (the cognition/math
|
|
asymmetry is deliberate: cognition discloses, math is absolute).
|
|
|
|
`test_seam_is_live_wiring` injects `_canonically_verified` to return a winner and proves
|
|
a wider reach then resolves the disagreement — **and STRICT still refuses even then**. So
|
|
the seam is live wiring, not dead code; the consumer is proven for the day `VERIFIED` lands.
|
|
|
|
## Invariants
|
|
- **Byte-identity** — STRICT path unchanged; `Resolution` unchanged; no caller passes a
|
|
policy; the import adds no cycle and no serialized-output change (verified: the three
|
|
fast serving-lane report hashes are identical before/after).
|
|
- **wrong=0** — structurally inert widening; absolute invariant preserved.
|
|
- **No overclaim** — serving is unchanged today; the docstrings say so.
|
|
|
|
## Out of scope (the real unlock)
|
|
The `VERIFIED` canonical-comparison producer — scoped separately in
|
|
`VERIFIED-canonical-comparison-scoping-2026-06-06.md`. Also still deferred: SITUATE
|
|
(stakes), the live FEED-BACK loop, and `reach_level` JSONL emission (a frozen-gate re-pin).
|