core/docs/analysis/verified-serving-wiring-scoping-2026-06-08.md

VERIFIED serving-wiring — verified_serving_enabled — scoping brief

Date: 2026-06-08 · Status: scoping (NO CODE) · HOLD for review · Branch: docs/serving-integration-scoping

What this brief is. The scope for the served-surface decision the VERIFIED lane deferred. The off-serving VERIFIED lane is complete and on main:

P1-A  the VERIFIED contract        (verified_contract.py — two independent reads converge)
P1-B  gold-setup-backed producer   (evals/constraint_oracle/verified_producer.py — OFF-SERVING)
P1-C  bound_slots_digest           (a separable, load-bearing proof obligation)

P1-B verifies 7/13 real R2 problems with wrong=0 — but it is gold-setup-backed, so it is structurally off-serving: the independent read is the INV-25 hand-authored gold SETUP, which is not available at serving time. This brief scopes what a serving-time VERIFIED would require — and why it cannot reuse P1-B. No code here.

Companions: ask-serving-integration-scoping-2026-06-08 (the ASK half of the same "where off-serving stops" line), VERIFIED-canonical-comparison-scoping-2026-06-06 (the validate-first probe that already KILLED the naive fold-reader producer), stage2-epistemic-disclosure-bus-verified-v1-scoping-2026-06-08 (Doc 1).

---

1. The seam (grounded) — and why it is still inert by design

generate/derivation/verify.py::_canonically_verified(verified, problem_text, policy) is the ADR-0206 §5 VERIFIED gate — the only thing that may license a math answer past gold (resolve a disagreement STRICT refuses). It returns None today, so the widening is structurally inert: disagreement refuses regardless of policy, preserving absolute wrong == 0. Its own docstring states the bright line this brief must honour:

"A reliability license (statistical) must NEVER substitute here: math serving is absolute-wrong=0, not disclosed like the cognition path."

So VERIFIED serving = replacing that return None with a producer that returns a derivation only when it is canonically VERIFIED (proven correct, not merely sound), behind a kill switch, proven on a holdout. Everything below is the eligibility bar for that producer.

---

2. The five things this decision must pin

1. the gold-free independent-reader requirement   — the crux
2. verified_serving_enabled                        — the kill switch
3. holdout gates                                    — validate-first, no quiet widening
4. proof-producer eligibility                       — what may plug into _canonically_verified
5. the explicit ban on eval-gold-backed serving     — why P1-B cannot serve

---

3. The gold-free independent-reader requirement (the crux)

VERIFIED means two independent reads that converge on one canonical structure (P1-A): a faithful solve of a wrong read is caught because the independent read disagrees. P1-B's two reads are read_constraint_problem (the engine reader) vs the gold-authored setup. At serving time there is no gold. So serving-time VERIFIED needs a second, gold-free reader whose disagreement is the safety mechanism.

The hard constraints, from the killed-probe doc and CLAUDE.md:

• Independence must be in the READING, not the solving. Back-substitution catches solve-errors, never read-errors. Two solvers over one reading is fake independence. The second reader must parse the problem into the same ConstraintProblem structure by a genuinely different route (different lineage, asserted by the SAME_READER_LINEAGE firewall / INV-27 reader-disjointness), and converge on the same canonical signature.
• No eval gold in the read (§7). The second reader may not consult, hash, or be derived from any gold artifact — not the answer, not the setup. If it needs gold to read, it is P1-B, and P1-B does not serve.
• Conservative refuse-on-doubt carries wrong=0. The second reader, like the first, refuses when uncertain. VERIFIED fires only on agreement of two confident, independent reads; any refusal or disagreement → STRICT refuses (today's behaviour).

Eligibility, stated as a gate: a serving-time VERIFIED producer is eligible only if it exhibits two reads with (a) distinct, firewall-asserted lineages, (b) neither read derived from gold, (c) convergence on one canonical ConstraintProblem signature, (d) back-substitution + boundary-clear + bound-slots (the P1-A/P1-C obligations), and (e) refuse-preferring failure. Absent any one, it stays None.

Whether such a second R2 reader exists yet is the open empirical question — the killed fold-reader probe is the cautionary precedent: complementary readers were ~98% wrong on the refused set. This brief does not assume one exists; it sets the bar a candidate must clear, validate-first, before any wiring.

---

4. verified_serving_enabled — the kill switch

Add verified_serving_enabled: bool = False to core/config.py (sibling of estimation_enabled). Default off. When off, _canonically_verified returns None unconditionally (today's inert state) regardless of any producer being present. The switch is the single audited place that lights the seam, and it stays off until §5.

---

5. Holdout gates — validate-first, no quiet widening

VERIFIED may not widen live until proven on a held-out set it never trained or tuned on (INV-25 discipline; the killed-probe doc's validate-first rule). The gate, in order:

1. Holdout probe (off-serving): run the candidate producer over a held-out R2 set with gold answers withheld; require wrong == 0 on everything it marks VERIFIED, and that everything it cannot independently verify it refuses (over-refusal is acceptable; one wrong is disqualifying).
2. Seal byte-identity: the GSM8K candidate-graph serving seal (pinned SHAs) stays byte-identical — VERIFIED widens a different surface (R2 constraint answers), it must not perturb the sealed lane.
3. Disagreement-still-refuses: a test proving that with the producer wired and the switch ON, a faithful solve of a deliberately wrong read still refuses (the P1-A poison test, now on the served path).
4. Only then does verified_serving_enabled go on, one surface at a time (R2 first; R4 second), each with its own holdout pass.

---

6. The served surface — a distinct [verified] disclosure

When wired and enabled, a VERIFIED R2 answer is served under its own disclosure claim/marker — the locked decision from Doc 1's review: VERIFIED gets a distinct served disclosure mode + [verified] prefix, NEVER reused from [approximate]. VERIFIED is a license claim (more licensed than gold-strict), not a speculation claim. The route to it is the only sanctioned one: disclosure_for_verification(result) → (EpistemicState.VERIFIED, DisclosureClaim.VERIFIED) → ServedDisposition.DISCLOSE under the P0-3 guard (which already degrades an unbacked VERIFIED claim to COMMIT).

---

7. The explicit ban on eval-gold-backed serving (the load-bearing non-claim)

P1-B must never become a serving producer. It is gold-setup-backed: its independent read is the hand-authored gold SETUP. Wiring it into _canonically_verified would mean the engine "verifies" by consulting the answer key's structure — circular, and a wrong=0 fiction (it would serve VERIFIED on exactly the problems it was handed the setup for). The ban, stated so a test can enforce it:

• _canonically_verified (and any serving producer behind it) may import nothing from evals/ — no gold loader, no gold_to_problem, no r2_gold. An AST/import test asserts the serving path is gold-free, the mirror of the off-serving AST tests.
• P1-B stays in evals/ precisely so this boundary is structural: evals → core is the allowed direction; core/generate serving → evals is forbidden.
• "Verified on a holdout" (§5) is not the same as "verified by gold at serving" — the holdout measures a gold-free producer; it never feeds gold into one.

This is the VERIFIED analogue of the GSM8K "candidate-graph owns the metric; no bridge re-enables without sealed/independent wrong=0" discipline.

---

8. What this is NOT

• Not a claim that a serving-time VERIFIED producer exists — §3 sets the eligibility bar; whether an R2 second reader clears it is an open, validate-first question.
• Not a reliability/statistical license at the math seam — that path is the cognition [approximate] disclosure; math serving is absolute wrong=0 (§1 bright line).
• Not a GSM8K-seal move — VERIFIED widens R2 constraint answers, seal stays byte-identical (§5.2).
• Not P1-B promoted to serving — explicitly banned (§7); P1-B stays off-serving.

---

9. The questions for the ruling

1. Eligibility bar: adopt §3 (a)–(e) as the gate any serving VERIFIED producer must clear — gold-free second reader, independence-in-the-reading, refuse-preferring? (rec: yes)
2. Gate: add verified_serving_enabled = False (sibling of estimation_enabled), _canonically_verified stays None while off? (rec: yes)
3. Holdout: require the §5 validate-first sequence (wrong=0 on holdout + seal byte-identity + disagreement-still-refuses) before the switch, R2-first? (rec: yes)
4. Gold ban: enforce the §7 import ban (serving path imports nothing from evals/) with a test, keeping P1-B off-serving forever? (rec: yes)
5. Surface: serve VERIFIED under its distinct [verified] marker via disclosure_for_verification only? (rec: yes — the locked Doc 1 decision)

No served-surface code until this brief is reviewed. Pairs with ask-serving-integration-scoping-2026-06-08 — together they draw the full line where off-serving stops.