core/docs/handoff/proof-carrying-wiring-scope-2026-06-14.md

Scope: wiring proof-carrying coherence promotion (the decision)

Date: 2026-06-14 Status: decision scope — no code; nothing wired without your call. Context: the epistemic-coherence finding (docs/analysis/epistemic-coherence-architecture-2026-06-14.md) established that the speculative ceiling does not blunt learning. The only genuine epistemic lever is wiring the proof-carrying promotion path. This doc scopes that decision. Builds on the existing design doc docs/issues/proof-carrying-coherence-promotion.md (ADR-0218) — read it first; this adds the bootstrapping analysis and frames the call.

What the path actually is (precise)

teaching/proof_promotion.certify_promotion + vault/store.py::apply_certified_promotion promote a SPECULATIVE vault claim to COHERENT iff a PromotionCertificate fail-closes through all of:

1. the certificate replays/verifies under the pinned deductive engine (DEDUCTIVE_ENGINE_PIN) — independent re-verification, not trust;
2. the claim is SPECULATIVE, reading_certified, and its propositional_form matches the certificate;
3. every premise is reading_certified, form-matched, and already COHERENT (vault/store.py:475-507).

It is built, sound, and proven (tests/test_adr_0218_proof_promotion.py, INV-29). It has zero runtime callers — only tests + the demo invoke it.

The bootstrapping reality (the load-bearing subtlety)

The path is the inductive step only: coherent premises + verified proof → coherent conclusion. But every realized fact is born SPECULATIVE (realize.py:217), and promotion fail-closes on any non-coherent premise. So the path can lift nothing until a coherent base case exists — and nothing in the runtime mints one. In the tests the coherent premises are hand-injected (_coherent_premises stores entries directly as COHERENT).

Therefore wiring is two halves, and half (a) is the real decision:

• (a) A curator-certified coherent base. A small, deliberate set of base facts/readings a curator declares COHERENT (axioms / ground readings). The design doc is explicit that the base + reading-certification stay curator-mediated initially — "entailment automated, reading human, the honest first cut" (proof-carrying-coherence-promotion.md:214-216). Without this, half (b) is inert.
• (b) The runtime trigger. Call certify_promotion → apply_certified_promotion when the determine/derive path produces a SPECULATIVE propositional claim that is deductively entailed by coherent premises in the vault. Narrow surface: it only fires for certified propositional forms (the deductive-logic flagship), not arbitrary cognition facts.

What wiring buys (honest framing)

This is an honesty/disclosure upgrade, not a learning fix. Per the finding, learning already works at the speculative ceiling. What changes:

• determine._basis could return "verified" (vs "as_told") for a deductively proven propositional conclusion — the engine would honestly distinguish "I proved this" from "I was told this" (render.py:31).
• The COHERENT-gated recall probe (chat/runtime.py:195, min_status=COHERENT) would have content to return.

Scope of "verified" stays narrow and defensible: only propositional-entailment conclusions from curator-certified coherent premises. That is exactly the verified flagship (sound+complete propositional logic) — surfacing it honestly is pitch-relevant ("watch it refuse to say verified unless it actually proved it").

wrong=0 analysis

The promotion path itself cannot false-promote: it fail-closes on a failed replay, a non-SPECULATIVE claim, an uncertified reading, a form mismatch, or any non-coherent premise — and it never vacuously entails (refuses inconsistent premise sets; test_inconsistent_coherent_premises_refuse_never_vacuously_entail). The entire risk shifts to half (a): the soundness of "verified" reduces to the soundness of the curator-certified coherent base. Garbage in the base → sound proofs over garbage → false "verified". So the base set must be small, auditable, and genuinely curator-reviewed. The runtime trigger adds no risk the fail-closed gate doesn't already cover.

Work required (if you decide to wire)

1. Base set (curated, reviewed): a small certified-coherent axiom/reading set in the vault/seed — the deliberate ground for entailment. This is the real review work; keep it minimal.
2. Runtime trigger (small): invoke certify_promotion/apply_certified_promotion from the determine/derive path for certified propositional claims; fold the promotion digest into the turn trace_hash (the code notes this is the missing D4 step). Default-off flag first (mirror vault_promotion_enabled).
3. Disclosure + tests: verified now reachable → update docs/runtime_contracts.md, a non-vacuous test that a proof-backed claim becomes verified AND a non-proof-backed one stays as_told, and confirm no path emits verified without a replayed certificate.

The decision (yours)

Three honest options:

1. Wire it (narrow, deliberate): stand up a minimal curator-certified base + the runtime trigger, default-off → on after review. Buys: honest "verified" for proven propositional conclusions. Cost: the base-curation + a ratified-ADR commitment to runtime coherence promotion. My lean if you value the honesty capability for the pitch — it's the one real, wrong=0-safe epistemic upgrade.
2. Record "curator-mediated by design" (cheapest honest): the design doc's own fallback (proof-carrying-coherence-promotion.md:232-234) — decide the logical arm isn't worth wiring now, amend the paper §3.4 to stop forward-referencing it, and leave promotion curator-mediated. Zero risk, zero capability gain.
3. Defer: keep it designed-but-unwired (status quo), revisit when a concrete use case (a demo, a pitch beat) needs runtime "verified".

Recommendation: this is not urgent (it doesn't unblock learning), but it is the single honest "the engine earns verified" capability. If the pitch wants that beat, do (1) narrowly; otherwise (2) is the honest, cheap close. Either way, the current "all speculative" state is not a defect to rush-fix.