Shay 7cb826a548 feat(determine): calibrated disclosed estimation — the engine earns the right to guess (Step E)

The final AGI-spine step (A INSTRUMENT → B WIRE → C DEEPEN → D CLOSE → E ESTIMATION).
The engine may now SERVE a DISCLOSED estimate for a query it would otherwise refuse —
but only for a predicate-class that has measured itself reliable, and never as fact.

This executes the ADR-0206 §5 cognition-path widening: the bridge's LICENSE node
(reliability_gate.license_for), previously "built — not yet called from serving", is now
called. govern_response returns APPROXIMATE iff a genuine licensed Action.SERVE
LicenseDecision is passed (STRICT for every other input — so every existing serving call
site is byte-identical); shape_surface DISCLOSES the estimate as "[approximate] …".

Mechanism:
- generate/determine/estimate.py — a BLIND converse-guesser: told p(a,b), asked p(b,a),
  it commits the converse. It never reads the pack's symmetry metadata; whether the guess
  is right is MEASURED, not assumed.
- evals/determination_estimation/ — the gold lane: run_practice (sealed, ADR-0199) folds
  the converse-guesser over symmetric (sibling_of) vs directed (parent_of) cases, scored
  against the pack's graph.edge.symmetric truth (gold independent of the solver). The gate
  DISCRIMINATES: sibling_of earns SERVE (660 correct → Wilson floor 0.990046 ≥ θ_SERVE),
  parent_of does not (660 wrong → 0.0). The license is earned by VOLUME — 657 perfect
  commits is the exact θ_SERVE=0.99 threshold (656 is below).
- generate/determine/data/estimation_ledger.json — the ratified committed ledger,
  hash-verified on load (a hand-edited ledger raises RatifiedLedgerError); it IS the
  deterministic sealed-practice output (a GSM8K-style --check test pins this).
- chat/runtime.py — when a converse query is refused and the class holds a SERVE license,
  the disclosed estimate is surfaced through the bridge (gated by config.estimation_enabled,
  default OFF; only meaningful with accrue_realized_knowledge).

Invariants:
- wrong=0 by construction — an estimate is ALWAYS disclosed ([approximate]), never a silent
  commit (UNVERIFIED_POSSIBLE is never in APPROXIMATE's admissible set), and only a genuine
  ratified license widens (a forged {"licensed":True} dict / a PROPOSE license / an
  unlicensed SERVE all stay STRICT). Defense-in-depth: type-gate ∧ admissible-set ∧
  hardcoded disclosed state.
- never self-authored — ceilings stay at safe defaults (θ_SERVE=0.99); the engine cannot
  raise its own bar. The ledger is sealed practice, hash-verified.
- session/serving only — no corpus/pack/identity/proposal/vault mutation; the HITL teaching
  path is untouched. Deterministic; no clock/random.
- byte-identical for every non-E turn (the 2643 govern_response call passes no license).

Out of scope (separate ADR-0206 §5 PRs): the math-serving seam (select_self_verified,
touches the sealed metric), SITUATE (stakes), and the live FEED-BACK loop.

Verified green: smoke (90), architectural invariants (56), response_governance (321,
incl. the new license-gated widening test), the determination-estimation lane (12), and
the B/D/determine regression net. Four-lens adversarial review (disclosure/wrong=0,
calibration integrity, byte-identity, boundary/determinism): all held. Design:
docs/analysis/E-estimation-design-2026-06-06.md.

2026-06-06 13:49:07 -07:00

5 KiB

Raw Blame History

Step E — ESTIMATION: calibrated, disclosed estimation via the ADR-0206 reach bridge

Date: 2026-06-06 Branch: feat/learned-estimation Sequence: A INSTRUMENT → B WIRE → C DEEPEN → D CLOSE → E ESTIMATION (last) Executes: ADR-0206 §5 (cognition-path widening) — the LICENSE node ("built — not yet called from serving") finally called from serving.

What E is (and is not)

E lets the engine commit a disclosed estimate for a class it has measured itself reliable on, instead of always refusing past proof. It is not generic guessing, not a probabilistic model, and it does not touch the sealed GSM8K serving metric (that is a separate, riskier ADR-0206 §5 PR — select_self_verified).

The whole step is one wire: govern_response consults reliability_gate.license_for(…, Action.SERVE); a licensed class reaches ReachLevel.APPROXIMATE; shape_surface discloses the estimate with an [approximate] prefix.

Why it is wrong=0-safe by construction

shape_surface(APPROXIMATE) never commits an estimate silently — it prefixes [approximate]. So an estimate that is wrong is a disclosed-wrong, categorically different from the silent/asserted wrong the wrong=0 invariant forbids. The reliability gate (θ_SERVE=0.99 on a committed ClassTally) governs when the disclosed estimate is even offered. Two independent guards: disclosure (honesty) + license (calibration).

The estimator — a blind converse-guesser

Given a realized p(a, b) and a query p(b, a), the estimator commits the converse as a candidate. It is blind — it never reads the pack's symmetry metadata. Therefore:

on a symmetric predicate (sibling_of, spouse_of, equal_to, distinct_from, adjacent_to, overlaps_event — graph.edge.symmetric) the converse is true;
on a directed predicate (parent_of, less_than, before_event, … — graph.edge.directed) the converse is false.

The engine does not know which is which. It measures its converse-guess precision per predicate-class over a gold lane and earns a SERVE license only where the measured floor clears θ. That is calibrated learning (ADR-0175): reliability is commitment precision, earned by volume. The symmetry metadata is the gold (the GoldTether's truth), never a serving-time shortcut.

The committed ledger (real, sealed, HITL-ratified)

evals/determination_estimation/gold.py deterministically generates the gold cases: 657+ symmetric converse cases for the licensed class (gold=true) and a directed class (gold=false). 657 is the Wilson volume floor: a perfect record clears θ_SERVE=0.99 at n/(n+z²) ≥ 0.99, z=2.576 ⇒ n ≥ 657. Reliability is earned by volume, never a lucky streak — so the gold lane is sized to that bar, not the bar to the lane.
core.learning_arena.run_practice folds a DomainSolver (the converse-guesser) + GoldTether (symmetry-as-truth) over the cases → dict[str, ClassTally].
The resulting ledger (per-class committed counts) is frozen as a ratified artifact (evals/determination_estimation/ratified_ledger.json) with an expected-hash. Committing it via a reviewed PR is the HITL ratification. Ceilings stay at safe defaults (θ_SERVE=0.99) — no override, so the engine never raises its own bar (invariant #4).

The wire (E-3, the delicate part)

In chat/runtime.py, gated by a new config flag (default OFF): when a turn is a converse query (p(b,a) asked, p(a,b) realized, p(b,a) not directly determinable) whose predicate-class holds a committed license_for(SERVE).licensed, pass that real LicenseDecision into govern_response → it emits APPROXIMATE → shape_surface discloses the converse estimate as [approximate] …. Every other turn, and every unlicensed class, stays STRICT (byte-identical, wrong=0 untouched). Never a designed-in default: absent a cleared committed tally, refuse.

Falsification — `evals/determination_estimation`

A frozen replay asserts:

Discriminating gate: the symmetric class is SERVE-licensed; the directed class is not (its converse-guess reliability is ~0 over the committed lane).
Disclosed estimate: a licensed converse query yields an [approximate]-prefixed surface; an unlicensed one stays STRICT-refuse, byte-identical to pre-E.
No silent estimate: every reach > STRICT carries the disclosure prefix.
wrong=0 (silent): zero silently-committed wrong answers — every estimate is disclosed.
Volume floor: below 657 committed the symmetric class is NOT licensed (the bar binds).
Determinism: the ledger + verdicts reproduce byte-identically (frozen expected hash).

Out of scope (separate PRs)

The math-serving seam (select_self_verified) — ADR-0206 §5, touches the sealed metric.
SITUATE (stakes/gravity) and the live FEED-BACK loop (serving outcome → ledger) — ADR-0206 §1 "designed, not built". E uses an offline, sealed, ratified ledger.
EXTRAPOLATE / CREATIVE reach levels (need VERIFIED / novelty capabilities).

5 KiB Raw Blame History