core/docs/plans/curriculum-license-loop-2026-07-25.md

Curriculum License Loop — Plan of Record

Date: 2026-07-25 · Status: ACTIVE · Base: main @ 0a26787f (post ADR-governance pin, PR #114)

Successor to generalization-arc-2026-07-24.md, which closed its Tier F/O/S arc, and to the assessment-verification arc (PR #113). Division of work across tiers: docs/handoff/curriculum-license-loop-2026-07/DIVISION-OF-WORK.md (binding — read it before starting any unit).

---

1. Why this arc exists

Two arcs closed on the same stated conclusion: the binding constraint is ratified curriculum volume, not machinery. That conclusion is half right, and the wrong half is load-bearing. Verified 2026-07-25 by reading code:

1. evals/curriculum_serve/practice/ does not exist. The deduction analogue (evals/deduction_serve/practice/{gold,runner}.py) is what folds run_practice over a corpus into per-band ClassTally. Curriculum has no producer.
2. seal_ledger exists only for deduction (evals/deduction_serve/practice/runner.py:96). chat/curriculum_serve_license.py's own docstring names evals.curriculum_serve.practice.runner.seal_ledger as "the only writer" of the artifact it reads. That writer was never built, and chat/data/curriculum_serve_ledger.json does not exist.
3. The ceremony stops short. teaching/ratification.py::RatificationReceipt carries pending_stages = ("arena_queue_entry", "ledger_reseal") — it grows the corpus and explicitly neither practices it nor reseals the ledger.

So the pipeline is author → ratify chain → ??? → ??? → license → serve, with two unbuilt segments. Authoring curriculum today cannot earn a license at any volume. Content is necessary and currently insufficient.

The build is nonetheless modest, because the expensive pieces already exist: evals/curriculum_serve/oracle.py is already an independent decision procedure usable as the gold tether, and ADR-0263 already extracted the sealers (core/ratified_ledger.py) for precisely a third instance.

2. Two measured facts that shape the content work

• refuted has never been produced. The physics lane gold is entailed 14 / unknown 12 / declined 6 — zero refuted. The verdict exists in CurriculumDecision.verdict; no corpus row can express it.
• Bands key on (domain, operator_family) (chat/curriculum_surface.py:184). Negative content must therefore live inside operator_family: "modal" with a row-level polarity marker. A separate modal_negative family would create a new band at n=0 instead of adding refuted volume to the target band. This is the easiest available way to waste the entire authoring effort.

3. Decisions taken (2026-07-25, Shay)

Decision	Choice
Leading track	Close the license loop (not articulation, not substrate)
First content target	physics · modal — n=9, closest of eleven bands (24× short)
refuted representation	Explicit negative edges, polarity inside the existing family
Reseal trigger	Explicit core proposal-queue reseal verb, never automatic on ratify

Reseal is explicit because AGENTS.md forbids ratification automation, and because an auto-reseal per ratified row would churn the ledger's content_sha256 on every append.

4. Phases

Phase A — Negative-curriculum epistemology (design only; gates everything)

ADR deciding how an explicitly-taught negative coexists with the open-world reading. Binding constraints: absent edge ⇒ UNKNOWN (never "no"); explicit negative edge ⇒ REFUTED; polarity is a row-level field or intent value, never a new operator_family; evals/curriculum_serve/oracle.py must learn polarity independently of the serving path, since that independence is the whole evidentiary value.

Touches: teaching/domain_chains/physics_chains_v1.jsonl schema, teaching/curriculum_premises.py, teaching/ratification.py::validate_admissible, evals/curriculum_serve/oracle.py, lane contract anti-recall probes.

Done when: ADR Accepted; schema shape fixed; no code written.

Phase B — The volume-honesty invariant (the anti-gaming gate)

Failing tests written before any producer code. The generator must emit at most one committed case per distinct (relation, direction, polarity, question-shape) tuple and must never paraphrase-pad. S6 already proved conservative_floor cannot distinguish "657 independent facts" from "16 facts asked 41 times," so an unbounded generator would clear the Wilson floor without earning anything.

Done when: tests exist, fail for the right reason, and fail under mutation (pad the generator ⇒ red).

Phase C — The producer (implementation against Phase B)

evals/curriculum_serve/practice/{__init__,generator,runner}.py, mirroring evals/deduction_serve/practice/ topology exactly — producer in evals/, artifact next to its reader in chat/data/.

Reuse, do not rewrite: evals/curriculum_serve/oracle.py (gold tether), core/learning_arena/engine.py::run_practice, core/ratified_ledger.py::{seal_artifact, tally_dict, write_sealed_ledger}, core/reliability_gate::{Action, Ceilings, ClassTally, license_for}, chat/curriculum_surface.py (solver under test).

Done when: Phase B tests green; wrong=0 on the physics lane.

Phase D — Close the ceremony's pending_stages

core proposal-queue reseal verb; ratify_chain records the enqueue. Files: teaching/ratification.py, core/cli_proposal_queue.py.

Done when: the verb produces a SHA-sealed chat/data/curriculum_serve_ledger.json, and curriculum_serve_license() reads a real (still-unearned) ledger rather than an absent one.

Phase E — Honesty seams (parallel, no dependency on A–D)

• E1 — audit-ledger R7. Defer the single sink emission to the pipeline serve boundary (chat/runtime.py::finalize_turn_surface; spec at docs/specs/runtime_contracts.md:448-456). Repairs the stale surface and stale trace_hash together. Default sink is None, so no deployment risk. Independent of the hash_surface-on-TurnEvent ruling.
• E2 — assert_corpus_sound name collision. Two functions, one name: evals/deduction_serve/practice/gold.py:1163 (no args, practice corpus) vs evals/curriculum_serve/runner.py:71 (domain, cases, lane contract). Must land before Phase C adds a third caller.
• E3 — ADR status vocabulary normalization. 27 unparseable status lines plus draft/ratified/active/accepted. variants across 312 files; then widen tests/test_adr_status_governance.py to a closed vocabulary.

Phase F — Content (the actual constraint)

Author + ratify physics · modal volume: ≈219 distinct taught modal relations for the entailed bucket, plus matching refuted/unknown. Measure with teaching.ratification._count_chains and evals/vocab_trigger_instrument.py --compare admissions delta.

Relations must be true. Drafting candidates is delegable; ratification is Shay's.

Phase G — The flag (Shay only)

Only after a band clears θ=0.99 at n≥657 with a genuine outcome mix: propose flipping curriculum_serving_enabled. On earned evidence, never on proximity.

5. Deferred, decision-gated (a ruling, not effort)

• Band-level capability index — 25 near-1.0 entries would inflate coverage_geomean against the index's own anti-gaming property. Needs a scoring decision before any schema change.
• Discovery-yield stratification — blocked on new persisted per-source counters in the engine_state manifest (teaching/discovery_yield.py:67-70 reads one monotonic turn_count).
• hash_surface on TurnEvent — self-verifying telemetry vs replay-only. Current contract states recomputation is unsupported and correct to be so.

6. Off this arc's critical path

• Articulation depth (Phase 5 / core_logos). EntailmentTrace carries five opaque BDD node keys; generate/proof_chain/entail.py:125-190 decides via is_tautology. There are no intermediate steps, so nothing is dropped and the stated trigger describes an event that cannot occur. CORE's decision procedure is complete but not explanatory. Next deliverable is a feasibility study for proof-term extraction over the ROBDD — a derivation calculus with a real soundness surface, not a data-structure refactor. Highest intellectual value, least schedulable.
• Substrate. CORE_BACKEND=rust bit-exact parity is now answerable locally (cargo 1.97.1 + registry cache present; core-rs/tests/test_crdt_hash_parity.rs exists; needs PYO3_PYTHON=/opt/homebrew/bin/python3.12). Then Rust typestate (UnverifiedClaim → VersorClaim) — zero determinism cost, greenfield. The real hot path is cga_inner → geometric_product, 33,986 calls/turn, ~73% of turn time. Not the diagonal shortcut — not bit-exact (954/4000 in f32). Refuted, do not revisit: .metal kernel, MLX fusion, bf16.
• Math. Phase 4.2 case-first is falsified on a count — cases 0000/0001/0148/0082 affect 1 and 2 cases out of 500. Only remaining lever is the q:complex decomposition study (101 cases, one label). Low expected value.

7. Dependencies

• A gates B (polarity shapes the generator's enumeration — building C before A means building it twice).
• B gates C (tests first; the invariant is the specification).
• E2 lands before C. E1/E3 fully parallel.
• C + D gate F's measurement, and F gates G.
• Phase 6 items independent and parallel throughout.

8. Non-goals

• Flipping any flag without explicit ratification.
• Adding band entries to the capability index before the scoring decision.
• Paraphrase-padding practice volume to reach the Wilson floor.
• Renumbering or overwriting Accepted ADRs.