71bf04fb44
Squashes the arc's work into one commit; the workflow-file edit it originally carried is excluded (see the end of this message). ## Lane 1 — Workbench recorded a proved answer as ungrounded With deduction_serving_enabled ratified ON (ADR-0256), workbench/api.py's live chat route builds a bare ChatRuntime(), so the deduction composer decides Workbench turns and stamps grounding_source="deduction" — but _coerce_grounding_source carried a hand-copied whitelist of the six pre-arc labels and silently rewrote anything else to "none". The runtime comment reasoned this was inert because "REPL turns do not flow through Workbench's CognitivePipelineRecord path". True, and irrelevant: the traffic flows the other way. Stale since 2026-07-24. Scope is one field. workbench/api.py:818 prefers TurnEvent.epistemic_state, which read epistemic_state_needed — honest. So the UNregistered path degraded honestly while the hand-copied whitelist asserted a falsehood; a second copy of a closed enum was worse than no copy. Hence registration AND derivation: GROUNDING_SOURCES exposes the Literal's members, and the coercion reads it. workbench-ui badges/tokens/snapshot follow; enumCoverage.test.ts forces atomicity. ## Lane 2 — the ratification ceremony The discovery loop was instrumented but not closed. teaching/ratification.py turns a reviewed decision into a chain record, a corpus commit, and a receipt. Its design turns on one observation: _ratified_rows DROPS unadmissible rows silently — correct when serving, a trap when ratifying, because the file grows, the commit lands, and the band count does not move. So the ceremony refuses to call an append a ratification until it has re-read the curriculum through the real loader and seen the chain arrive; a non-admitted append is rolled back. Validation is a pre-flight courtesy, admission is the proof. Arena queue entry and ledger reseal are deliberately NOT performed (bridge rule 1); the receipt names them. Front door: `core proposal-queue ratify`, a sibling of `review` rather than a flag on it. ## Lane 3 — structural closures - ADR-0263 gains rule 5: absence policy is DECLARED in CAPABILITY_LEDGERS, not passed at the call site. An AST-matched test fails if a serving path passes missing_ok again. - Deductive suite added WHOLE to the pre-push gate: 285 tests in 29s against smoke's 216 in 62s, so no coverage trade was needed. - Smoke/CI parity assertion made bidirectional. It was one-directional, and had drifted. - test_prior_surface_deduction_binding.py pins correction binding on the deduction path. The review's diagnosis did NOT reproduce — hash_surface moves in lockstep — so it pins what is there. Mutation-checked. - Domain-keyed ADR index over 312 flat-numbered files, explicitly partial. - Arc-close brief template, plus this arc's own brief filled in against it. ## Lanes 4 and 5 — two premises falsified by measurement, one of them mine Math 4.2: baseline reproduced (correct=5 wrong=0 refused=495); all four named cases traced to one seam with each gap isolated by one-variable probes. Then the number that changes the recommendation: the gap blocking case 0000 affects 1 case in 500, the 'than' gap blocking 0001 affects 2. ADR-0251's prohibition on per-case growth now rests on a count. No reader change made. CGA: versor_condition is 0.22% of a turn, not the "~10x proof latency" I claimed — that multiplied an isolated microbenchmark by a call count and compared it to a single verdict's latency. The real cost is geometric_product at 33,986 calls/turn (~73%) via cga_inner in search paths. The obvious closed form is NOT bit-exact (954/4000 in f32); backend.vault_recall's serial fold IS (3000/3000, worst-rel 0) and is the correct target. cargo test could not run — static.crates.io is denied by the sandbox network policy — so the Rust parity question stays open and the typestate lane is carried forward, not shipped uncompiled. ## Not landed: three lines owed to .github/workflows/smoke.yml The CI smoke gate is narrower than the local one — test_pack_draft_serve_boundary.py (ADR-0253 INV-33) has been local-only, unseen because the parity pin checked one direction. The edit was authored and rejected at push for lacking the `workflow` OAuth scope, so it is recorded as a named, dated PENDING_IN_CI exception rather than dropped: the assertion still fires on any new divergence, and a second guard fires once the three land. [Verification]: pre-push gates all green — smoke 236 passed, warmed_session 10 passed, deductive 285 passed. Ratification 14, ADR index 5, CLI suites 10. Grounding/epistemic sweep 741 passed 1 skipped. workbench-ui 598 passed across 73 files, tsc -b clean. capability index 11 passed, digest unchanged. Math holdout correct=5 wrong=0 refused=495. Committed chain corpora byte-unchanged after the tests that write to them. Environment caveat: the repo pins requires-python ==3.12.13, which uv cannot fetch for linux-x86_64, so `uv sync --locked` fails. All Python runs used a scratch venv on 3.12.11 with declared deps — not the locked universe, not the full ~12k suite. The pin was left untouched. Re-run on a 3.12.13 host before treating this as merge evidence. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FduW6Krm3PPQv3P5iwBYtx
8.8 KiB
8.8 KiB
ADR index, keyed by domain
docs/adr/ holds 312 files under a flat, purely sequential numbering. Sequence
records when a decision was made and nothing about what it governs, so
answering "which ADRs constrain the serving flag contract?" or "what governs
the register axis?" currently means grepping. Past ~300 files that is how a
decision corpus becomes a write-only archive.
This index is the lightweight fix: a maintained table keyed by capability
domain and cross-referenced by the files each ADR actually governs. It is not
a renumbering, and it does not replace README.md (which owns the
Master-Blueprint collision reconciliation and the binding non-ADR notes).
Scope, stated honestly
This index covers the live serving, telemetry, and governance surfaces — the domains a Phase 5 / next-arc session needs to query. It is not a complete index of all 312 ADRs, and it does not pretend to be: an index asserting coverage it does not have is worse than none, because it converts "I should grep" into "I already checked."
Maintenance rule: index on mint. Adding a row when you write an ADR is cheap; back-filling 300 is not. Rows below carry the files each ADR governs so a reader can jump from a decision to its enforcement site.
Deduction serving (the deduction-serve arc)
| ADR | Decision | Governs |
|---|---|---|
| 0256 | Deduction serving governed by an earned reliability license; flag ratified ON 2026-07-24 | chat/deduction_serve_license.py, chat/data/deduction_serve_ledger.json, core/config.py::deduction_serving_enabled |
| 0257 | Band v2-EN — English-clause opaque-atom propositional serving; realizer-guard exemption for quoted templates | generate/proof_chain/english.py, chat/runtime.py (guard exemption sites) |
| 0258 | Band v3-MEM — singular membership + universal premises | generate/proof_chain/categorical.py |
| 0259 | Band v4-CM — conditional-membership fusion | generate/proof_chain/cond_member.py |
| 0260 | Band v5-VP — verb-predicate arguments | generate/proof_chain/verb.py |
| 0261 | Band v6-EX — existential witnesses; anonymous witness never transfers to a named individual | generate/proof_chain/exist.py |
Engine underneath all six: generate/proof_chain/entail.py (ROBDD tautology
check). Surfaces: generate/proof_chain/render.py, chat/deduction_surface.py.
Curriculum serving
| ADR | Decision | Governs |
|---|---|---|
| 0262 | Exams answered from the ratified curriculum, read OPEN-world; §5 records that curriculum volume is the binding constraint (~25× gap) | chat/curriculum_surface.py, chat/curriculum_serve_license.py, evals/curriculum_serve/runner.py |
Reliability licensing and the ledger bridge
| ADR | Decision | Governs |
|---|---|---|
| 0175 | Two regimes under wrong=0; θ_SERVE Wilson floor; an engine cannot raise its own bar | core/reliability_gate.py, generate/determine/estimation_license.py |
| 0263 | Seal → ratify → SHA-verify → serve-gate, extracted from three instances. Rule 5 (2026-07-25): absence policy is declared in CAPABILITY_LEDGERS, not passed at the call site |
core/ratified_ledger.py, all three license adapters |
| 0206 | Response governance bridge (govern_response / shape_surface) |
generate/determine/ |
Grounding sources and the epistemic taxonomy
| ADR | Decision | Governs |
|---|---|---|
| 0142 | Epistemic state as first-class vocabulary | core/epistemic_state.py |
| 0048 / 0050 | Pack-grounded cold-start DEFINITION / RECALL / COMPARISON | chat/pack_grounding.py |
| 0052 | Teaching-grounded cold-start CAUSE / VERIFICATION | chat/teaching_grounding.py |
| 0064 | Cross-pack residency + cross-corpus chain lookup for the discovery gate | teaching/discovery.py |
The closed set itself lives at core/epistemic_state.py::GroundingSource.
Registration is a three-part cross-stack change — see
docs/specs/runtime_contracts.md § "Grounding-source registration".
Register axis and the realizer guard
| ADR | Decision | Governs |
|---|---|---|
| 0069 | Realizer register parameter; invariant C — register must not move trace_hash |
core/cognition/surface_resolution.py, core/cognition/pipeline.py |
| 0071 | Seeded surface variation + discourse markers; pre_decoration_surface |
chat/register_variation.py |
| 0075 | Realizer slot-type guard (C1 coherence floor). Deduction surfaces are exempt — quoted templates are not slot-composed articulations (rationale documented at both guard sites) | chat/runtime.py (stub + main guard sites) |
| 0077 | Substantive register knobs (R6); register_canonical_surface |
chat/register_substantive.py |
Telemetry, trace, and audit
| ADR | Decision | Governs |
|---|---|---|
| 0039 | TurnVerdicts bundle, stub-path TurnEvent, hedge_injected |
chat/runtime.py |
| 0153 | TurnEvent trace_hash back-stamp (W-020a) |
core/cognition/pipeline.py, chat/runtime.py |
| 0255 | Discovery-yield-per-served-turn baseline; fail-closed on a missing baseline | teaching/discovery_yield.py |
| 0018 | Typed deterministic operators folded into trace_hash |
core/cognition/trace.py |
trace_hash is not reconstructable from TurnEvent — see
docs/specs/runtime_contracts.md. Audit-ledger R7 (telemetry sink receives
the pre-override event) is open and recorded there.
Workbench and the cross-stack UI contract
| ADR | Decision | Governs |
|---|---|---|
| 0160 | Operator/auditor UI before public chat | workbench/ |
| 0161 | HITL async queue | teaching/proposals.py, core proposal-queue CLI |
| 0162 | Design system v1; §3d — engine enums bind to UI badges, enforced by a build-time coverage test | workbench-ui/src/design/, workbench-ui/enum-snapshot.json |
Teaching, proposals, and review
| ADR | Decision | Governs |
|---|---|---|
| 0057 | Teaching-chain proposal + review + replay-equivalence gate | teaching/proposals.py, teaching/review.py, teaching/store.py |
| 0254 | Grounded-open hedge arm for the shadow-coherence gate | chat/runtime.py |
Reader arc / math capability
| ADR | Decision | Governs |
|---|---|---|
| 0251 | Halt bespoke per-case regex work; clean-base reset. The prohibition that governs every math reader increment | generate/math_roundtrip.py, generate/math_candidate_parser.py |
Companion evidence: docs/research/reader-arc-overfit-inventory-2026-07-19.md,
docs/research/math-reader-phase-4-1-status-2026-07-24.md (Phase 4.1 =
complete-with-null-yield).
Substrate, field, and packs
| ADR | Decision | Governs |
|---|---|---|
| 0180 | Delta-CRDT sharded substrate | core-rs/src/vault.rs, engine_state/ |
| 0243 | Wave-field cognitive lifecycle | field/ |
| 0244 | Wave-field identity manifold | persona/, chat/runtime.py |
| 0253 | Blueprint collision resolution + dual-pack serve boundary (INV-33) | packs/ |
Numbering note
The corpus is at ADR-0263 and minted eight ADRs in roughly 48 hours during the generalization arc. Sequential numbering is fine and should stay — the cost it imposes is discoverability, which is what this file pays down. ADR-0300 is a near-term milestone with no structural meaning; do not treat it as one.
The ADR-0206/ADR-0256 numbering collision that had to be resolved in doc form is the concrete failure this index is meant to make less likely: a domain-keyed view shows an in-flight number before it is minted twice.