[MACHINE-SPIRIT 7/8] Meta-reasoning and bounded self-improvement: failure learning, strategy evolution, rule promotion, self-model and expert synthesis #394

Closed
opened 2026-09-08 01:29:18 +00:00 by nsaspy · 7 comments
Owner

Parent: #397
Related: #376 #377 #379 #381 #384 #385 #386 #388 #392 #395
Downstream: symbolic-memory#4 #6 #7 #9 #10 and implementation epic/slices #16 #33-#36 #43

Distinct research mandate

Treat learning how to reason better as the primary problem: symbolic experience, bounded learning, controlled promotion, rollback, self-models, expert composition, adversarial contamination control, cross-domain transfer and computational conformance.

Hard invariant: self-improvement may improve symbolic knowledge/strategy but may not silently widen host capability/authority or promote arbitrary model-generated Prolog into trusted executable code.

Depth 7 status — DESIGN-COMPLETE, IMPLEMENTATION-UNPROVEN

All four required subpasses are durably preserved in this issue's comments.

A — EPOCH: COMPLETE

Experience, Promotion & Operational Control Hierarchy establishes immutable symbolic experiences, distinct EBG / ILP-failure / case / strategy-performance candidate lanes, versioned promotion/evaluation policy, append-only admission/suspension/supersession and declarative expert composition.

experience != candidate lesson
candidate != admitted reusable knowledge
admitted knowledge != runtime handler/binding
runtime binding != capability != authority

B — CITADEL-EPOCH: COMPLETE

Contamination-Isolated, Tamper-Aware, Drift-Explicit Learning safeguards adds candidate exposure freeze, evidence-use roles, source/causal dependence, adaptive holdout accounting, metric/verifier noninterference, bounded counterexample campaigns, safe-baseline comparison, diagnosis-aware labels and drift/calibration epochs.

candidate success on influenced evidence != independent generalization evidence
record independence != source independence != causal independence
hidden test != infinitely reusable holdout
VERIFY success != reusable-policy generalization
no bounded counterexample found != universal correctness

C — PACT-EPOCH: COMPLETE

Provenance-Attested Cross-Trust Learning Interchange adds a versioned Learning Artifact Contract (LAC), typed source attestations, loss-aware transfer assessments and target-local promotion.

portable learned payload != portable promotion status
source admission attestation != target admission
source calibration/safety != target calibration/safety
multiple approvals != independent origins
signed attestation != semantic truth
semantic procedure portability != target executable authority

D — CLOCKWORK-EPOCH: COMPLETE

Conformance-Locked, Ordered, Crash-safe Knowledge-Workflows for Replayable EPOCH makes A/B/C computational.

immutable experiences / foreign LACs / source attestations
        ↓
append-only typed learning ledger
        ↓
versioned direct dependence + exposure graph
        ↓
rebuildable exact indexes + query-scoped closure
        ↓
frozen candidate + immutable EvaluationSnapshot
        ↓
 exact symbolic | bounded counterexample | paired sequential | optional OPE
        ↓
hard guards + contamination + transfer validity
        ↓
conditional promotion commit against exact dependency generations
        ↓
admit | hold | quarantine | resource_limited
        ↓
post-admission structural/statistical drift watches
        ↓
append-only suspend / supersede / retract

D hard decisions

  1. Canonical direct edges, derived closure. Persist direct experience/candidate/evidence/dependence/LAC/attestation/lifecycle events. Exposure/dependence closure is query-scoped, exact and generation-keyed; global transitive-closure materialization is not required.
  2. No probabilistic independence proof. Bloom/probabilistic indexes may conservatively signal possible exposure but cannot establish independent=true. Hidden/missing provenance yields unknown.
  3. No irreversible canonical dependence merge. DSU/union-find may be an accelerator only when semantics permit; provenance/identity/dependence can be retracted or superseded, so canonical truth remains versioned edges/events.
  4. Canonical LAC bytes. LAC v1 normalizes to a closed typed data model and deterministic CBOR profile; fingerprint is domain-separated over exact canonical payload bytes. JSON/JCS may be a distinct adapter profile, not silently byte-equivalent.
  5. Attestation integrity != semantic validity. DSSE/in-toto-style envelopes authenticate exact payload/type and issuer subject to trust-root policy; local semantic/promotion acceptance remains separate.
  6. Immutable EvaluationSnapshot. Candidate, exposure frontier, baseline, task population, semantic/environment epoch, Frozen Spec, verifier, metric/hard-guard contract, validation-origin policy, risk ledger, transfer state and dependency generations are frozen before validation evidence is consumed.
  7. Candidate-kind evaluation profiles. exact_symbolic for finite/decidable proof obligations; bounded_counterexample for bounded generators/enumeration/SMT; paired_sequential_improvement for empirical strategy improvement against admitted baseline; optional logged_off_policy only when logged-support assumptions hold.
  8. Bounded search never becomes proof. Only an actually exhaustive finite/decidable profile may emit exhaustive coverage.
  9. Anytime-valid sequential evaluation. Empirical promotion may use a declared time-uniform confidence-sequence/e-process profile. Ordinary fixed-time intervals plus "stop when green" are invalid.
  10. Adaptive candidate-family risk is budgeted. Conservative v1 example: preallocate alpha_n = alpha_family * 6/(pi^2*n^2) before candidate n consumes validation data, ensuring the family allocation remains bounded. Richer e-value/FDR policies require separate explicit profiles.
  11. No magical forever-holdout. Exposed validation results become generation/selection evidence for descendants. V1 prefers candidate freeze + fresh validation streams/origin groups + explicit risk accounting. DP reusable holdout remains a possible named future profile.
  12. Safe improvement is baseline-relative. If improvement cannot be established under the candidate's declared profile, hold the candidate; do not promote "best observed". Hard authority/spec/verifier/replay violations remain zero-tolerance regardless of average utility.
  13. Drift is scoped. Structural schema/verifier/runtime/identity/source/translation generation changes are deterministic invalidators. Statistical detectors such as ADWIN may detect numeric stream drift under their model but are not semantic-drift oracles.
  14. Privacy overlap is conservative in v1. Within one configured trust domain use opaque/keyed origin-group identifiers if available. Across domains without a comparison mechanism, origin overlap/independence is unknown; PSI/OPRF is not mandatory v1 infrastructure.
  15. Dependency-directed invalidation. Candidate/promotion/transfer views depend explicitly on payload/ancestry, exposure graph, source lifecycle, evidence, evaluator/metric/policy, baseline, semantic/profile/schema, identity, trust roots, translators, runtime/environment and drift/calibration generations.
  16. Promotion is a conditional append-only transition. Commit requires expected lifecycle version, exact EvaluationSnapshot fingerprint, matching dependency generations and an admissible decision receipt. Stale evidence produces stale_evaluation/conflict, not admission.
  17. Race order is explicit. Retraction-first makes concurrent promotion stale. Promotion-first preserves historical admission but the later retraction appends invalidation/suspension so current state is inactive.
  18. Replay is exact about nondeterminism. Historical replay resolves exact candidate/policy/verifier/LAC/observation artifacts. Live remote/model reevaluation is a new observation lineage.
  19. No new scheduler. Latency-bearing evaluation reuses existing rlm_async / #288 facilities. Learning-control state does not become an execution scheduler.
  20. Zero-model known symbolic path. Exact known candidate validation/promotion/selection conformance targets providers disabled and model_calls = 0.

Conformance direction

The #404D comment records D1-D50 falsifiable fixtures covering canonical LAC encoding/signatures, exposure/dependence/retraction, adaptive statistical evaluation, exact-vs-bounded counterexample coverage, drift/transfer invalidation, crash/retraction/promotion races, differential cold/warm/rebuilt/incremental learned-state equivalence, exact replay, authority separation, foreign import and provider-disabled known-symbolic learning.

No scale claim is accepted from prose: exposure graph, counterexample, evaluation-stream and incremental-maintenance thresholds require measured implementation benchmarks.

Reconciled Depth-7 architecture

A: EPOCH
   typed experience + candidate/promotion hierarchy
        ↓
B: CITADEL-EPOCH
   contamination / Goodhart / verifier / drift firewall
        ↓
C: PACT-EPOCH
   loss-aware cross-trust learned-artifact interchange
        ↓
D: CLOCKWORK-EPOCH
   exact indexes + evaluation profiles + crash-safe deterministic lifecycle

Repository ownership

prolog-rlm

  • EPOCH/CITADEL/PACT/CLOCKWORK schemas and validation semantics;
  • candidate-kind evaluation-profile selection;
  • exposure/independence query semantics;
  • exact-symbolic/counterexample/statistical promotion-decision logic;
  • statistical risk-budget policy;
  • LAC normalization/schema + attestation predicate semantics;
  • crash-safe promotion transition contract over a storage adapter;
  • expert/planner/VERIFY/Repair/Review integration;
  • deterministic conformance definitions in #395.

symbolic-memory

  • durable experiences/candidates/LACs/attestations/evidence-use/promotion/drift ledger;
  • direct exposure/dependence indexes and generation-keyed closure caches;
  • append-only lifecycle/frontier/replay;
  • reverse dependency invalidation;
  • durable evaluation/risk/promotion/transfer receipts;
  • implementation/failure-injection/scale benchmarks.

The library-first implementation graph #11/#16/#33-#36/#43 is the natural implementation landing zone. Existing #4/#6/#7/#9/#10 remain canonical domain contracts.

Unresolved implementation/synthesis questions

  • exact first SWI module/API split for CLOCKWORK profiles;
  • native Prolog vs audited numeric adapter for confidence sequences;
  • cross-platform numeric determinism profile for statistical replay;
  • measured threshold for optional DBSP/differential-style incrementalization;
  • production DSSE/LAC trust-root/key integration;
  • whether Machine Spirit v1 needs a DP reusable-holdout profile or fresh-stream accounting is sufficient;
  • benchmark-derived graph/closure/search/task-stream defaults;
  • which D1-D50 fixtures already have executable evidence (must be proven in #405, never assumed).

Completion statement

Depth 7 A/B/C/D is design-complete only. Implementation and Machine Spirit acceptance remain unproven.

Exact next research work: Depth 8 / #405A — baseline cross-depth synthesis and minimum Machine Spirit v1 architecture/conformance graph.

Do not start #405B/C/D until #405A is durably complete.

Parent: #397 Related: #376 #377 #379 #381 #384 #385 #386 #388 #392 #395 Downstream: symbolic-memory#4 #6 #7 #9 #10 and implementation epic/slices #16 #33-#36 #43 ## Distinct research mandate Treat **learning how to reason better** as the primary problem: symbolic experience, bounded learning, controlled promotion, rollback, self-models, expert composition, adversarial contamination control, cross-domain transfer and computational conformance. Hard invariant: self-improvement may improve symbolic knowledge/strategy but may not silently widen host capability/authority or promote arbitrary model-generated Prolog into trusted executable code. ## Depth 7 status — DESIGN-COMPLETE, IMPLEMENTATION-UNPROVEN All four required subpasses are durably preserved in this issue's comments. ### A — EPOCH: COMPLETE **Experience, Promotion & Operational Control Hierarchy** establishes immutable symbolic experiences, distinct EBG / ILP-failure / case / strategy-performance candidate lanes, versioned promotion/evaluation policy, append-only admission/suspension/supersession and declarative expert composition. ```text experience != candidate lesson candidate != admitted reusable knowledge admitted knowledge != runtime handler/binding runtime binding != capability != authority ``` ### B — CITADEL-EPOCH: COMPLETE **Contamination-Isolated, Tamper-Aware, Drift-Explicit Learning safeguards** adds candidate exposure freeze, evidence-use roles, source/causal dependence, adaptive holdout accounting, metric/verifier noninterference, bounded counterexample campaigns, safe-baseline comparison, diagnosis-aware labels and drift/calibration epochs. ```text candidate success on influenced evidence != independent generalization evidence record independence != source independence != causal independence hidden test != infinitely reusable holdout VERIFY success != reusable-policy generalization no bounded counterexample found != universal correctness ``` ### C — PACT-EPOCH: COMPLETE **Provenance-Attested Cross-Trust Learning Interchange** adds a versioned Learning Artifact Contract (LAC), typed source attestations, loss-aware transfer assessments and target-local promotion. ```text portable learned payload != portable promotion status source admission attestation != target admission source calibration/safety != target calibration/safety multiple approvals != independent origins signed attestation != semantic truth semantic procedure portability != target executable authority ``` ### D — CLOCKWORK-EPOCH: COMPLETE **Conformance-Locked, Ordered, Crash-safe Knowledge-Workflows for Replayable EPOCH** makes A/B/C computational. ```text immutable experiences / foreign LACs / source attestations ↓ append-only typed learning ledger ↓ versioned direct dependence + exposure graph ↓ rebuildable exact indexes + query-scoped closure ↓ frozen candidate + immutable EvaluationSnapshot ↓ exact symbolic | bounded counterexample | paired sequential | optional OPE ↓ hard guards + contamination + transfer validity ↓ conditional promotion commit against exact dependency generations ↓ admit | hold | quarantine | resource_limited ↓ post-admission structural/statistical drift watches ↓ append-only suspend / supersede / retract ``` #### D hard decisions 1. **Canonical direct edges, derived closure.** Persist direct experience/candidate/evidence/dependence/LAC/attestation/lifecycle events. Exposure/dependence closure is query-scoped, exact and generation-keyed; global transitive-closure materialization is not required. 2. **No probabilistic independence proof.** Bloom/probabilistic indexes may conservatively signal possible exposure but cannot establish `independent=true`. Hidden/missing provenance yields `unknown`. 3. **No irreversible canonical dependence merge.** DSU/union-find may be an accelerator only when semantics permit; provenance/identity/dependence can be retracted or superseded, so canonical truth remains versioned edges/events. 4. **Canonical LAC bytes.** LAC v1 normalizes to a closed typed data model and deterministic CBOR profile; fingerprint is domain-separated over exact canonical payload bytes. JSON/JCS may be a distinct adapter profile, not silently byte-equivalent. 5. **Attestation integrity != semantic validity.** DSSE/in-toto-style envelopes authenticate exact payload/type and issuer subject to trust-root policy; local semantic/promotion acceptance remains separate. 6. **Immutable EvaluationSnapshot.** Candidate, exposure frontier, baseline, task population, semantic/environment epoch, Frozen Spec, verifier, metric/hard-guard contract, validation-origin policy, risk ledger, transfer state and dependency generations are frozen before validation evidence is consumed. 7. **Candidate-kind evaluation profiles.** `exact_symbolic` for finite/decidable proof obligations; `bounded_counterexample` for bounded generators/enumeration/SMT; `paired_sequential_improvement` for empirical strategy improvement against admitted baseline; optional `logged_off_policy` only when logged-support assumptions hold. 8. **Bounded search never becomes proof.** Only an actually exhaustive finite/decidable profile may emit exhaustive coverage. 9. **Anytime-valid sequential evaluation.** Empirical promotion may use a declared time-uniform confidence-sequence/e-process profile. Ordinary fixed-time intervals plus "stop when green" are invalid. 10. **Adaptive candidate-family risk is budgeted.** Conservative v1 example: preallocate `alpha_n = alpha_family * 6/(pi^2*n^2)` before candidate n consumes validation data, ensuring the family allocation remains bounded. Richer e-value/FDR policies require separate explicit profiles. 11. **No magical forever-holdout.** Exposed validation results become generation/selection evidence for descendants. V1 prefers candidate freeze + fresh validation streams/origin groups + explicit risk accounting. DP reusable holdout remains a possible named future profile. 12. **Safe improvement is baseline-relative.** If improvement cannot be established under the candidate's declared profile, hold the candidate; do not promote "best observed". Hard authority/spec/verifier/replay violations remain zero-tolerance regardless of average utility. 13. **Drift is scoped.** Structural schema/verifier/runtime/identity/source/translation generation changes are deterministic invalidators. Statistical detectors such as ADWIN may detect numeric stream drift under their model but are not semantic-drift oracles. 14. **Privacy overlap is conservative in v1.** Within one configured trust domain use opaque/keyed origin-group identifiers if available. Across domains without a comparison mechanism, origin overlap/independence is `unknown`; PSI/OPRF is not mandatory v1 infrastructure. 15. **Dependency-directed invalidation.** Candidate/promotion/transfer views depend explicitly on payload/ancestry, exposure graph, source lifecycle, evidence, evaluator/metric/policy, baseline, semantic/profile/schema, identity, trust roots, translators, runtime/environment and drift/calibration generations. 16. **Promotion is a conditional append-only transition.** Commit requires expected lifecycle version, exact EvaluationSnapshot fingerprint, matching dependency generations and an admissible decision receipt. Stale evidence produces `stale_evaluation/conflict`, not admission. 17. **Race order is explicit.** Retraction-first makes concurrent promotion stale. Promotion-first preserves historical admission but the later retraction appends invalidation/suspension so current state is inactive. 18. **Replay is exact about nondeterminism.** Historical replay resolves exact candidate/policy/verifier/LAC/observation artifacts. Live remote/model reevaluation is a new observation lineage. 19. **No new scheduler.** Latency-bearing evaluation reuses existing `rlm_async` / #288 facilities. Learning-control state does not become an execution scheduler. 20. **Zero-model known symbolic path.** Exact known candidate validation/promotion/selection conformance targets providers disabled and `model_calls = 0`. ## Conformance direction The #404D comment records **D1-D50 falsifiable fixtures** covering canonical LAC encoding/signatures, exposure/dependence/retraction, adaptive statistical evaluation, exact-vs-bounded counterexample coverage, drift/transfer invalidation, crash/retraction/promotion races, differential cold/warm/rebuilt/incremental learned-state equivalence, exact replay, authority separation, foreign import and provider-disabled known-symbolic learning. No scale claim is accepted from prose: exposure graph, counterexample, evaluation-stream and incremental-maintenance thresholds require measured implementation benchmarks. ## Reconciled Depth-7 architecture ```text A: EPOCH typed experience + candidate/promotion hierarchy ↓ B: CITADEL-EPOCH contamination / Goodhart / verifier / drift firewall ↓ C: PACT-EPOCH loss-aware cross-trust learned-artifact interchange ↓ D: CLOCKWORK-EPOCH exact indexes + evaluation profiles + crash-safe deterministic lifecycle ``` ## Repository ownership ### prolog-rlm - EPOCH/CITADEL/PACT/CLOCKWORK schemas and validation semantics; - candidate-kind evaluation-profile selection; - exposure/independence query semantics; - exact-symbolic/counterexample/statistical promotion-decision logic; - statistical risk-budget policy; - LAC normalization/schema + attestation predicate semantics; - crash-safe promotion transition contract over a storage adapter; - expert/planner/VERIFY/Repair/Review integration; - deterministic conformance definitions in #395. ### symbolic-memory - durable experiences/candidates/LACs/attestations/evidence-use/promotion/drift ledger; - direct exposure/dependence indexes and generation-keyed closure caches; - append-only lifecycle/frontier/replay; - reverse dependency invalidation; - durable evaluation/risk/promotion/transfer receipts; - implementation/failure-injection/scale benchmarks. The library-first implementation graph #11/#16/#33-#36/#43 is the natural implementation landing zone. Existing #4/#6/#7/#9/#10 remain canonical domain contracts. ## Unresolved implementation/synthesis questions - exact first SWI module/API split for CLOCKWORK profiles; - native Prolog vs audited numeric adapter for confidence sequences; - cross-platform numeric determinism profile for statistical replay; - measured threshold for optional DBSP/differential-style incrementalization; - production DSSE/LAC trust-root/key integration; - whether Machine Spirit v1 needs a DP reusable-holdout profile or fresh-stream accounting is sufficient; - benchmark-derived graph/closure/search/task-stream defaults; - which D1-D50 fixtures already have executable evidence (must be proven in #405, never assumed). ## Completion statement Depth 7 A/B/C/D is **design-complete only**. Implementation and Machine Spirit acceptance remain unproven. **Exact next research work: Depth 8 / #405A — baseline cross-depth synthesis and minimum Machine Spirit v1 architecture/conformance graph.** Do not start #405B/C/D until #405A is durably complete.
Author
Owner

Machine Spirit program progression

Depth 6 / #403 A-B-C-D is now durably design-complete and reconciled; #403 is closed for design completion only.

Exact next research subpass: #404A — meta-reasoning / bounded self-improvement foundations and representative formalisms only.

Do not execute #404B/C/D in the same run. A should establish candidate architectures for symbolic experience, meta-reasoning, explanation-based/case/strategy learning, lesson/rule promotion stages, failure learning, rollback/supersession, self-model/meta-goals and expert composition while preserving the hard boundary:

observation/experience
  != candidate lesson
  != validated reusable rule/strategy
  != trusted runtime mapping
  != host authority

#403/RACE-TAPS now supplies deterministic bounded retrieval/projection receipts and strategy execution evidence that #404 may learn from; #404 must not mutate retrieval truth or silently promote operational statistics into epistemic facts.

## Machine Spirit program progression Depth 6 / #403 A-B-C-D is now durably design-complete and reconciled; #403 is closed for design completion only. **Exact next research subpass: #404A — meta-reasoning / bounded self-improvement foundations and representative formalisms only.** Do not execute #404B/C/D in the same run. A should establish candidate architectures for symbolic experience, meta-reasoning, explanation-based/case/strategy learning, lesson/rule promotion stages, failure learning, rollback/supersession, self-model/meta-goals and expert composition while preserving the hard boundary: ```text observation/experience != candidate lesson != validated reusable rule/strategy != trusted runtime mapping != host authority ``` #403/RACE-TAPS now supplies deterministic bounded retrieval/projection receipts and strategy execution evidence that #404 may learn *from*; #404 must not mutate retrieval truth or silently promote operational statistics into epistemic facts.
Author
Owner

Machine Spirit #404A — foundations / representative formalisms

Status: A COMPLETE — B NEXT.

This subpass treats meta-reasoning and bounded self-improvement as a symbolic learning/control problem, not as permission for a model or runtime to rewrite its own trusted code.

Research questions

  1. What durable symbolic object should represent a reasoning attempt, including failure, resource use, VERIFY evidence and review outcome?
  2. Which classical learning mechanisms are appropriate for learning from one explained example versus many positive/negative examples versus repeated strategy-performance observations?
  3. What is the minimum safe lifecycle from experience to reusable knowledge?
  4. How should strategy choice improve without turning latency/reward statistics into epistemic truth?
  5. How can recurring expert compositions become reusable while preserving #377 registration, #288 scheduling, capabilities and authority?
  6. How can learned knowledge be rolled back/superseded without rewriting history or invalidating replay?
  7. Which parts of self-improvement must remain bounded, testable and zero-model for already-known symbolic cases?

Primary evidence

Classical and current sources used in this pass:

These mechanisms make materially different guarantees. EBG/Soar-style chunking derives an operational generalization from an explanation/proof; ILP searches a constrained hypothesis language against examples and counterexamples; Popper's generate-test-constrain loop learns from failed hypotheses; PRODIGY emphasizes that a learned control rule is useful only if its application benefit exceeds its matching/control cost; bounded-optimality work makes resource limits part of rational strategy selection rather than an afterthought.

Repository-local precedent also matters: research/RLM-RESEARCH-008-adaptive-recursion.org already separates execution from promotion. Its deeper-recursion experiment requires live multi-fixture evidence, positive quality delta, bounded cost/latency and zero capability/budget/cancellation failures before promotion. That exact numeric gate is not universal, but the architecture is correct: successful execution is evidence for a promotion decision, not the promotion decision itself.

Candidate architectures

Candidate 1 — universal Soar-style chunking

Every solved subgoal/explanation automatically produces a reusable production/control rule.

Strengths: cheap reuse after expensive reasoning; directly connected to proof/explanation; excellent fit for deterministic symbolic subproblems.

Rejected as the universal architecture: operationality matters; generated chunks can over-specialize, over-generalize, or create expensive matching/control behavior. One successful derivation also does not justify a universal procedural/world rule. Automatic chunk admission would collapse experience into trusted policy too early.

Candidate 2 — one central ILP learner over the experience corpus

Represent successful/failed episodes as examples and learn rules/procedures with Popper/ILASP/FastLAS-style constrained search.

Strengths: explicit hypothesis language; positive/negative examples; counterexamples; interpretable learned programs; defaults/exceptions/preferences are possible in richer ILP families; learning-from-failure can prune huge hypothesis spaces.

Rejected as the sole architecture: not every improvement is a logic-program induction problem. Strategy selection, cost/latency routing, case adaptation, explanation-based specialization and expert composition have different semantics. Hypothesis search is also combinatorial and extremely sensitive to bias/example construction.

Candidate 3 — performance-only strategy portfolio

Keep fixed strategies and learn which one works best for each task/context from observed quality/cost/latency.

Strengths: bounded, practical, naturally supports meta-level resource decisions.

Rejected as the full self-improvement model: it cannot create reusable symbolic explanations, rules, procedural abstractions or expert compositions. Performance statistics alone are not semantic knowledge.

Preferred — EPOCH: Experience, Promotion & Operational Control Hierarchy

EPOCH is a staged multi-lane learning fabric over existing Machine Spirit components.

#288/#376/#403 execution + fresh observations + #384 VERIFY + #386 Review
                              ↓
                    immutable experience
                              ↓
               typed candidate-generation lanes
     ┌────────────────┬────────────────┬──────────────────┐
     │ explanation/EBG│ ILP/failure    │ strategy/case    │
     │ specialization │ induction      │ performance/meta │
     └────────────────┴────────────────┴──────────────────┘
                              ↓
                    candidate lesson
                              ↓
                promotion/evaluation policy
   schema/profile checks + counterexamples + replay + held-out/
   independent fixtures + cost/risk + shadow/canary where applicable
                              ↓
          admitted semantic rule/method/control strategy
                              ↓
          ordinary #379/#381/#377 selection machinery
                              ↓
             trusted host binding still separate

The foundational distinction is:

experience/observation
    != candidate lesson
    != validated reusable semantic rule/method/strategy
    != currently admitted control knowledge
    != trusted runtime handler/binding
    != capability
    != authority

1. Symbolic experience is first-class

A completed or aborted reasoning attempt should emit an immutable, replayable experience envelope rather than free-form retrospective prose.

Conceptual data:

meta_experience(
    ExperienceId,
    GoalClass,
    ContextRef,
    SemanticCut,
    EpistemicProfile,
    ProcedureAndStrategyRefs,
    ExpertAndBindingRefs,
    InputEvidenceRefs,
    DecisionRefs,
    ObservationRefs,
    VerifyReceipt,
    ReviewFindingRefs,
    DiagnosisRefs,
    ResourceReceipt,
    ProviderUsage,
    Outcome,
    ReplayRef,
    Provenance).

Important: the experience records what was tried and what was observed. A successful episode is not itself a rule. A failed episode is not automatically a negative example for every rule implicated in the attempt.

The envelope must distinguish predicted effects from observed effects, local strategy failure from authority denial, and semantic failure from resource exhaustion/cancellation.

2. Candidate-generation lanes stay distinct

Explanation / EBG lane

Use a trusted existing theory/explanation to derive an operational candidate from a successful or failed proof slice. Candidate stores the explanation dependency graph, operationality conditions and assumptions.

Good use: specializing a known general procedure/control rule to a recurring context.

Bad use: inventing a universal causal fact from one unexplained success.

ILP / learning-from-failures lane

For closed declared hypothesis languages, build explicit positive/negative/context-dependent examples and search bounded hypotheses. Popper-style failure constraints are attractive because a failed hypothesis prunes related hypotheses rather than merely incrementing a reward score. Fine-grained SLD failure explanations can further tighten those constraints.

This lane must declare:

hypothesis language/profile
background theory version
positive/negative/context examples
noise policy
search/size/work bounds
optimization criterion
learner/version

No unrestricted generation of arbitrary callable Prolog.

Case / procedural abstraction lane

Verified cases may propose reusable method fragments, branch policies or adaptation constraints. They remain candidates until #401/DPEC-compatible procedure validation plus promotion succeeds.

Strategy-performance lane

Maintain empirical operational profiles over existing strategies/experts/planners/retrievers:

task/context signature
applicability evidence
attempt count
VERIFY outcome distribution
resource/cost/latency distribution
model-call usage
failure classes
coverage/recency
calibration/error measurements

These statistics may drive bounded strategy choice. They are operational evidence, not epistemic warrant.

3. Promotion is an explicit lifecycle

Recommended foundational states:

proposed
schema_validated
retrospectively_evaluated
counterexample_checked
shadow_validated
canary_validated          % only where meaningful/safe
admitted
suspended
deprecated
superseded
retracted

Not every knowledge class needs every stage. Promotion policy is typed by risk/knowledge class.

Conceptual record:

meta_candidate(
    CandidateId,
    Kind,                 % rule | method | control_policy | expert_composition | mapping
    PayloadRef,
    OriginExperienceRefs,
    LearnerRef,
    Scope,
    Assumptions,
    HypothesisProfile,
    Status,
    Provenance).

meta_promotion_policy(
    PolicyId,
    CandidateKind,
    RequiredEvidence,
    IndependencePolicy,
    CounterexamplePolicy,
    EvaluationProfile,
    ResourceBounds,
    RiskClass,
    RollbackPolicy,
    Version).

meta_promotion_receipt(
    ReceiptId,
    CandidateId,
    PolicyId,
    EvaluationCuts,
    Fixtures,
    Support,
    Counterexamples,
    Metrics,
    Decision,
    DecidedAt,
    Provenance).

A candidate cannot modify its own promotion policy. Promotion policy is trusted/versioned host or admitted semantic policy, not learned merely because the learner requests it.

The existing adaptive-recursion gate is a concrete repository example of a promotion policy. EPOCH generalizes the shape, not its exact 20 trials / 3 fixtures thresholds to every rule class.

4. Meta-goals are ordinary typed symbolic goals

Do not add an ambient reflective interpreter. Meta-reasoning enters the same expert/planner machinery through explicit goals such as:

meta_goal(explain_failure, RunRef).
meta_goal(select_strategy, TaskRef).
meta_goal(estimate_computation_value, DecisionRef).
meta_goal(find_knowledge_gap, GoalRef).
meta_goal(propose_lesson, ExperienceSet).
meta_goal(validate_candidate, CandidateRef).
meta_goal(find_counterexample, CandidateRef).
meta_goal(suspend_candidate, CandidateRef).

#288 remains the scheduler. #377 remains the expert invocation boundary. #384 remains the acceptance boundary for world/task success.

5. Self-model is empirical and versioned

Machine Spirit may maintain a bounded self-model of its own observed competence:

which strategies/experts were applicable
where they succeeded/failed/abstained
cost, latency and work
model fallback frequency
common failure/diagnosis classes
known unsupported regions
coverage and evidence recency

This supports which strategy works here? and what do I not know? without claiming omniscient introspection.

Hard distinction:

observed 82% VERIFY success for strategy S in context class C
    !=
S is semantically correct
    !=
S will succeed now

Russell/Subramanian-style bounded optimality is the right direction: optimize behavior relative to architecture/task/resource constraints, rather than search forever for globally optimal reasoning.

6. Expert synthesis means declarative composition, not arbitrary handler generation

Recurring successful cooperation can yield a candidate declarative composition such as:

expert_composition(
    CompositionId,
    GoalSchema,
    [project_knowledge_expert,
     git_expert,
     write_expert,
     verify_expert],
    DependencyPolicy,
    Applicability,
    Bounds,
    Version).

This composition refers only to registered contracts and normal typed goals. Admission validates that the referenced expert versions/contracts exist and preserves the caller's capability/authority ceiling.

It does not create a new executable closure/handler. If a genuinely new expert implementation is required, that is ordinary trusted code/configuration work outside automatic promotion.

7. Rollback is append-only supersession, not history rewrite

Learned semantic/control objects are immutable/versioned. Current admission is a projection over lifecycle events:

admit(v3)
observe regression/counterexample
suspend(v3)
admit(v4)
supersede(v3,v4)

Historical runs preserve the exact strategy/rule/composition versions used. Replaying an old run must not silently substitute today's replacement rule.

8. Comparison with current Prolog-RLM / Symbolic Memory

The current architecture already has the right boundaries but no complete learning fabric:

  • #392 can represent cases/examples separately from universal rules and provides provenance/context/profile identity.
  • #393 distinguishes induced/generalized knowledge from source-explicit claims.
  • #400 supplies support/defeat/profile-relative epistemic reasoning.
  • #401/PIF+MEPP+PIFF+DPEC already says cases propose methods; they do not auto-promote.
  • #403 provides deterministic bounded retrieval/strategy execution receipts.
  • #377/#379/#385/#386 provide expert, planning, failure and review evidence that can feed experience records.
  • RLM-RESEARCH-008 already demonstrates execution-vs-promotion separation for adaptive recursion.
  • Symbolic Memory #6 supplies the append-only lifecycle needed to persist experience/candidate/promotion histories.

What #404A adds is the missing typed bridge between those experiences and admitted reusable strategy/rule knowledge.

9. Complexity / scaling

  • experience append: logical O(1) plus index maintenance; never rewrite prior episodes;
  • strategy-stat update: O(1) per relevant aggregate, with bounded context-class indexing;
  • strategy selection: O(k) over applicable candidates or less with goal/context indexes;
  • EBG: proportional to the demanded explanation/proof slice in ordinary cases, but proof/generalization structure can grow badly and must have node/depth/work bounds;
  • ILP: combinatorial/exponential hypothesis search in the general case; bound clauses/literals/variables/invented predicates/examples/solver calls/time/memory and return resource_limited, never arbitrary first hypothesis;
  • promotion replay/evaluation: proportional to declared evaluation corpus/fixtures; use provenance refs/cuts rather than copying source episodes;
  • no global relearning after every event: candidate generation is trigger/demand driven, and counterexample-driven validation may update only affected candidate families;
  • performance profiles have explicit generation/recency so concept drift can invalidate them rather than poisoning forever.

10. Epistemic / provenance implications

A learned object must expose:

origin experiences
source/observation provenance
learner + version
background theory/profile
hypothesis language / operationality criterion
training/evaluation splits or fixture lineage
supporting examples
negative/counterexamples
promotion policy/version
promotion decision receipt
subsequent regressions/suspensions/supersessions

Do not flatten this into confidence=.92.

Correlated/mirrored episodes do not count as independent validation simply because they are separate rows. #400/#402 source-dependence semantics apply to learning evidence too.

11. Safety / authority

Hard A invariants:

learned semantic action      != trusted host binding
learned policy statement     != authority policy
learned expert composition   != executable handler
high success rate            != permission
model-proposed lesson        != admitted lesson
repair success               != diagnosis proof
failure under denial         != evidence capability is defective
resource exhaustion          != negative semantic example

Learned knowledge may rank/select among already admissible strategies or propose semantic methods/rules. It may never silently create capabilities, widen read/write scope, relax Frozen Specs, mutate VERIFY criteria, or bypass effect admission.

12. Adversarial/failure review

A-foundation failure cases already visible for B to attack more deeply:

  • one lucky success overgeneralized into a universal rule;
  • training/test leakage through shared provenance;
  • duplicate/correlated experiences counted as independent evidence;
  • learner optimizes task success while increasing catastrophic side effects not represented in the objective;
  • stale historical performance drives current strategy choice after environment drift;
  • candidate rewrites its promotion criterion or verifier;
  • failed authority request becomes a bogus negative example for procedure semantics;
  • learned composition refers to removed/incompatible expert versions;
  • model-generated candidate smuggles callable Prolog or authority metadata;
  • self-generated experiences recursively validate their own rule without independent evidence;
  • shadow/canary evidence is misrepresented as production evidence;
  • success metric rewards skipping difficult VERIFY obligations.

B must attack these explicitly; A does not claim they are solved by a threshold.

13. Rejected shortcuts

  1. assertz/1 lessons after success — rejected: collapses observation, induction, validation and admission.
  2. one scalar reward/confidence for all learning — rejected: truth, utility, cost, risk, provenance and trust are different dimensions.
  3. LLM reflection text as learned policy — rejected: useful candidate generator only.
  4. global reinforcement of whichever expert won — rejected: confounds task mix, source dependence, changing versions and verification quality.
  5. self-modifying Prolog source as normal adaptation — rejected: destroys replay/authority boundaries and bypasses the semantic IR/registry contracts.
  6. one universal learner — rejected: EBG, ILP, case abstraction and strategy performance have materially different evidence/guarantees.

14. Falsifiable #404A fixtures

A1. successful episode persists as experience but creates no admitted rule automatically.
A2. failed episode persists without becoming a negative semantic example by default.
A3. identical replay records preserve exact strategy/expert/rule versions.
A4. EBG candidate exposes every proof assumption used for generalization.
A5. hidden/unproved EBG assumption blocks admission.
A6. bounded ILP fixture learns a rule covering positives and excluding negatives.
A7. one negative counterexample rejects an over-general candidate when policy requires consistency.
A8. context-dependent examples do not flatten into one global rule.
A9. hypothesis-search exhaustion returns resource_limited, not first-found promotion.
A10. model-proposed candidate remains inert before schema/profile validation.
A11. learned semantic action has zero host capability absent an existing trusted binding.
A12. learned expert composition can reference only existing compatible registered contracts.
A13. composition cannot widen caller capability/authority ceiling.
A14. unknown/removed expert version makes composition stale/unsupported.
A15. strategy statistics alter selection preference but cannot alter #400 warrant for a proposition.
A16. stale performance profile is rejected for a current-only strategy decision.
A17. two mirrored episodes do not satisfy an independence requirement for promotion.
A18. VERIFY failure prevents an episode from being labeled successful merely because the worker reports success.
A19. authority denial is preserved as policy/blocked outcome and is not learned as a system fault.
A20. resource exhaustion/cancellation is not converted into negative semantic evidence.
A21. promotion receipt names exact evaluation cuts/fixtures and policy version.
A22. candidate cannot modify its promotion policy or VERIFY acceptance rules.
A23. admitted rule can be suspended after a counterexample without deleting history.
A24. superseding v4 leaves historical v3 runs exactly replayable.
A25. canary/shadow evidence is labeled distinctly from production evidence.
A26. regression under admitted strategy produces a new experience and can trigger suspension policy.
A27. case-based procedural candidate still passes #401/DPEC validation before use.
A28. learned method still executes through #288 and requires fresh #384 VERIFY.
A29. known symbolic strategy-selection fixture completes with providers disabled and model_calls = 0.
A30. symbolic candidate-validation fixture completes with providers disabled and model_calls = 0.
A31. self-generated examples cannot alone satisfy a policy requiring independent external/held-out validation.
A32. promotion evaluation cannot weaken/remove a Frozen Spec obligation to improve its score.

Canonical issue changes required by A

  • #377: expert selection may consume versioned admitted strategy/performance profiles, but registration/selection/authority remain separate; automatic expert creation means declarative compositions over registered contracts only.
  • #379: case/EBG/ILP outputs are candidate methods/control rules until #404 promotion and ordinary DPEC admission; admitted learned strategies carry version/promotion receipt dependencies.
  • #385: diagnostic/repair episodes feed immutable learning experience; successful repair still does not prove diagnosis or auto-promote a repair rule.
  • #386: review findings/counterexamples may feed candidate evaluation but Review cannot promote or retract by prose alone.
  • #392/#393: learned/candidate/admitted rule status and learning provenance must remain distinct from source-explicit semantics.
  • Symbolic Memory #6: persist immutable experience, candidate, promotion/suspension/supersession and replay lineage; derived performance aggregates/indexes may be rebuildable.
  • Symbolic Memory #7/#9: query/native surfaces must expose learned-object status, evidence/promotion receipt and exact version rather than flattening candidates/admitted rules.

Unresolved questions reserved for later subpasses

#404B — semantic/adversarial deepening

Poisoning of experience, reward hacking/Goodhart effects, self-confirmation, label leakage, concept drift, contradictory lessons, confidence/calibration, catastrophic promotion, strategic manipulation of VERIFY, unsafe self-model loops, and promotion under noisy/partial evidence.

#404C — heterogeneity/interoperability

Transfer/federation of learned rules across theories/namespaces/ledgers, ontology mappings, heterogeneous ILP/EBG/case/performance learners, expert portfolio interoperability, cross-formalism procedural learning, and non-flattening composition of learning guarantees.

#404D — computational realization/conformance

Incremental experience indexes, hypothesis-space/search bounds, candidate invalidation, shadow/canary execution mechanics, deterministic async learning, replay, promotion dependency graphs, scale benchmarks and executable differential conformance.

A conclusion: use staged, typed, provenance-heavy learning. Machine Spirit may learn reusable semantic/control knowledge and better strategy selection, but learned knowledge never becomes its own authority plane.

Exact next legal subpass: #404B — semantic/adversarial deepening.

## Machine Spirit #404A — foundations / representative formalisms **Status: A COMPLETE — B NEXT.** This subpass treats meta-reasoning and bounded self-improvement as a *symbolic learning/control problem*, not as permission for a model or runtime to rewrite its own trusted code. ### Research questions 1. What durable symbolic object should represent a reasoning attempt, including failure, resource use, VERIFY evidence and review outcome? 2. Which classical learning mechanisms are appropriate for learning from one explained example versus many positive/negative examples versus repeated strategy-performance observations? 3. What is the minimum safe lifecycle from experience to reusable knowledge? 4. How should strategy choice improve without turning latency/reward statistics into epistemic truth? 5. How can recurring expert compositions become reusable while preserving #377 registration, #288 scheduling, capabilities and authority? 6. How can learned knowledge be rolled back/superseded without rewriting history or invalidating replay? 7. Which parts of self-improvement must remain bounded, testable and zero-model for already-known symbolic cases? ## Primary evidence Classical and current sources used in this pass: - Mitchell, Keller & Kedar-Cabelli, **Explanation-Based Generalization: A Unifying View**, *Machine Learning* 1(1), 1986, pp. 47–80. DOI: https://doi.org/10.1007/BF00116250 - Laird, Rosenbloom & Newell, **Knowledge Level Learning in Soar**, AAAI-87, 1987. https://cdn.aaai.org/AAAI/1987/AAAI87-089.pdf - Soar current official `chunk` / explanation-based chunking documentation. https://soar.eecs.umich.edu/reference/cli/cmd_chunk/ - Minton, Carbonell, Etzioni, Knoblock & Kuokka, **Acquiring effective search control rules: Explanation-based learning in the PRODIGY system**, ML Workshop, 1987. https://www.isi.edu/results/publications/19941/acquiring-effective-search-control-rules-explanation-based-learning-in-the-prodigy-system - Minton et al., **Explanation-based learning: A problem solving perspective**, *Artificial Intelligence* 40, 1989, 63–118. https://www.isi.edu/results/publications/19938/explanation-based-learning-a-problem-solving-perspective/ - Carbonell et al., **PRODIGY 4.0: The Manual and Tutorial**, CMU-RI-TR-92-10, June 1992. https://publications.ri.cmu.edu/prodigy-4-0-the-manual-and-tutorial - Russell & Subramanian, **Provably Bounded-Optimal Agents**, JAIR 2, 1995, 575–609. https://arxiv.org/abs/cs/9505103 - Cropper & Morel, **Learning programs by learning from failures**, 2020. https://arxiv.org/abs/2005.02259 - Morel & Cropper, **Learning logic programs by explaining their failures**, 2021. https://arxiv.org/abs/2102.12551 - Law, Russo & Broda / ILASP family, **Inductive Learning of Answer Set Programs**, current system/research family. https://www.ilasp.com/ - Law, Russo & Broda, **FastLAS: Scalable Inductive Logic Programming Incorporating Domain-Specific Optimisation Criteria**, AAAI 2020. https://doi.org/10.1609/aaai.v34i03.5678 - Cropper, Morel & Muggleton, **Learning higher-order logic programs**, / Playgol line of work on reusable learned programs; representative Playgol publication: https://www.ijcai.org/Proceedings/2019/0187.pdf - Furelos-Blanco et al., **Induction of Subgoal Automata for Reinforcement Learning**, AAAI 2020. https://doi.org/10.1609/aaai.v34i04.5802 These mechanisms make materially different guarantees. EBG/Soar-style chunking derives an operational generalization from an explanation/proof; ILP searches a constrained hypothesis language against examples and counterexamples; Popper's generate-test-constrain loop learns from failed hypotheses; PRODIGY emphasizes that a learned control rule is useful only if its application benefit exceeds its matching/control cost; bounded-optimality work makes resource limits part of rational strategy selection rather than an afterthought. Repository-local precedent also matters: `research/RLM-RESEARCH-008-adaptive-recursion.org` already separates execution from promotion. Its deeper-recursion experiment requires live multi-fixture evidence, positive quality delta, bounded cost/latency and zero capability/budget/cancellation failures before promotion. That exact numeric gate is not universal, but the architecture is correct: **successful execution is evidence for a promotion decision, not the promotion decision itself.** # Candidate architectures ## Candidate 1 — universal Soar-style chunking Every solved subgoal/explanation automatically produces a reusable production/control rule. **Strengths:** cheap reuse after expensive reasoning; directly connected to proof/explanation; excellent fit for deterministic symbolic subproblems. **Rejected as the universal architecture:** operationality matters; generated chunks can over-specialize, over-generalize, or create expensive matching/control behavior. One successful derivation also does not justify a universal procedural/world rule. Automatic chunk admission would collapse experience into trusted policy too early. ## Candidate 2 — one central ILP learner over the experience corpus Represent successful/failed episodes as examples and learn rules/procedures with Popper/ILASP/FastLAS-style constrained search. **Strengths:** explicit hypothesis language; positive/negative examples; counterexamples; interpretable learned programs; defaults/exceptions/preferences are possible in richer ILP families; learning-from-failure can prune huge hypothesis spaces. **Rejected as the sole architecture:** not every improvement is a logic-program induction problem. Strategy selection, cost/latency routing, case adaptation, explanation-based specialization and expert composition have different semantics. Hypothesis search is also combinatorial and extremely sensitive to bias/example construction. ## Candidate 3 — performance-only strategy portfolio Keep fixed strategies and learn which one works best for each task/context from observed quality/cost/latency. **Strengths:** bounded, practical, naturally supports meta-level resource decisions. **Rejected as the full self-improvement model:** it cannot create reusable symbolic explanations, rules, procedural abstractions or expert compositions. Performance statistics alone are not semantic knowledge. ## Preferred — **EPOCH: Experience, Promotion & Operational Control Hierarchy** EPOCH is a staged multi-lane learning fabric over existing Machine Spirit components. ```text #288/#376/#403 execution + fresh observations + #384 VERIFY + #386 Review ↓ immutable experience ↓ typed candidate-generation lanes ┌────────────────┬────────────────┬──────────────────┐ │ explanation/EBG│ ILP/failure │ strategy/case │ │ specialization │ induction │ performance/meta │ └────────────────┴────────────────┴──────────────────┘ ↓ candidate lesson ↓ promotion/evaluation policy schema/profile checks + counterexamples + replay + held-out/ independent fixtures + cost/risk + shadow/canary where applicable ↓ admitted semantic rule/method/control strategy ↓ ordinary #379/#381/#377 selection machinery ↓ trusted host binding still separate ``` The foundational distinction is: ```text experience/observation != candidate lesson != validated reusable semantic rule/method/strategy != currently admitted control knowledge != trusted runtime handler/binding != capability != authority ``` # 1. Symbolic experience is first-class A completed or aborted reasoning attempt should emit an immutable, replayable experience envelope rather than free-form retrospective prose. Conceptual data: ```prolog meta_experience( ExperienceId, GoalClass, ContextRef, SemanticCut, EpistemicProfile, ProcedureAndStrategyRefs, ExpertAndBindingRefs, InputEvidenceRefs, DecisionRefs, ObservationRefs, VerifyReceipt, ReviewFindingRefs, DiagnosisRefs, ResourceReceipt, ProviderUsage, Outcome, ReplayRef, Provenance). ``` Important: the experience records *what was tried and what was observed*. A successful episode is not itself a rule. A failed episode is not automatically a negative example for every rule implicated in the attempt. The envelope must distinguish predicted effects from observed effects, local strategy failure from authority denial, and semantic failure from resource exhaustion/cancellation. # 2. Candidate-generation lanes stay distinct ### Explanation / EBG lane Use a trusted existing theory/explanation to derive an operational candidate from a successful or failed proof slice. Candidate stores the explanation dependency graph, operationality conditions and assumptions. Good use: specializing a known general procedure/control rule to a recurring context. Bad use: inventing a universal causal fact from one unexplained success. ### ILP / learning-from-failures lane For closed declared hypothesis languages, build explicit positive/negative/context-dependent examples and search bounded hypotheses. Popper-style failure constraints are attractive because a failed hypothesis prunes related hypotheses rather than merely incrementing a reward score. Fine-grained SLD failure explanations can further tighten those constraints. This lane must declare: ```text hypothesis language/profile background theory version positive/negative/context examples noise policy search/size/work bounds optimization criterion learner/version ``` No unrestricted generation of arbitrary callable Prolog. ### Case / procedural abstraction lane Verified cases may propose reusable method fragments, branch policies or adaptation constraints. They remain candidates until #401/DPEC-compatible procedure validation plus promotion succeeds. ### Strategy-performance lane Maintain empirical operational profiles over existing strategies/experts/planners/retrievers: ```text task/context signature applicability evidence attempt count VERIFY outcome distribution resource/cost/latency distribution model-call usage failure classes coverage/recency calibration/error measurements ``` These statistics may drive bounded strategy choice. They are **operational evidence, not epistemic warrant**. # 3. Promotion is an explicit lifecycle Recommended foundational states: ```text proposed schema_validated retrospectively_evaluated counterexample_checked shadow_validated canary_validated % only where meaningful/safe admitted suspended deprecated superseded retracted ``` Not every knowledge class needs every stage. Promotion policy is typed by risk/knowledge class. Conceptual record: ```prolog meta_candidate( CandidateId, Kind, % rule | method | control_policy | expert_composition | mapping PayloadRef, OriginExperienceRefs, LearnerRef, Scope, Assumptions, HypothesisProfile, Status, Provenance). meta_promotion_policy( PolicyId, CandidateKind, RequiredEvidence, IndependencePolicy, CounterexamplePolicy, EvaluationProfile, ResourceBounds, RiskClass, RollbackPolicy, Version). meta_promotion_receipt( ReceiptId, CandidateId, PolicyId, EvaluationCuts, Fixtures, Support, Counterexamples, Metrics, Decision, DecidedAt, Provenance). ``` A candidate cannot modify its own promotion policy. Promotion policy is trusted/versioned host or admitted semantic policy, not learned merely because the learner requests it. The existing adaptive-recursion gate is a concrete repository example of a promotion policy. EPOCH generalizes the *shape*, not its exact `20 trials / 3 fixtures` thresholds to every rule class. # 4. Meta-goals are ordinary typed symbolic goals Do not add an ambient reflective interpreter. Meta-reasoning enters the same expert/planner machinery through explicit goals such as: ```prolog meta_goal(explain_failure, RunRef). meta_goal(select_strategy, TaskRef). meta_goal(estimate_computation_value, DecisionRef). meta_goal(find_knowledge_gap, GoalRef). meta_goal(propose_lesson, ExperienceSet). meta_goal(validate_candidate, CandidateRef). meta_goal(find_counterexample, CandidateRef). meta_goal(suspend_candidate, CandidateRef). ``` #288 remains the scheduler. #377 remains the expert invocation boundary. #384 remains the acceptance boundary for world/task success. # 5. Self-model is empirical and versioned Machine Spirit may maintain a bounded self-model of *its own observed competence*: ```text which strategies/experts were applicable where they succeeded/failed/abstained cost, latency and work model fallback frequency common failure/diagnosis classes known unsupported regions coverage and evidence recency ``` This supports `which strategy works here?` and `what do I not know?` without claiming omniscient introspection. Hard distinction: ```text observed 82% VERIFY success for strategy S in context class C != S is semantically correct != S will succeed now ``` Russell/Subramanian-style bounded optimality is the right direction: optimize behavior relative to architecture/task/resource constraints, rather than search forever for globally optimal reasoning. # 6. Expert synthesis means declarative composition, not arbitrary handler generation Recurring successful cooperation can yield a candidate declarative composition such as: ```prolog expert_composition( CompositionId, GoalSchema, [project_knowledge_expert, git_expert, write_expert, verify_expert], DependencyPolicy, Applicability, Bounds, Version). ``` This composition refers only to registered contracts and normal typed goals. Admission validates that the referenced expert versions/contracts exist and preserves the caller's capability/authority ceiling. It does **not** create a new executable closure/handler. If a genuinely new expert implementation is required, that is ordinary trusted code/configuration work outside automatic promotion. # 7. Rollback is append-only supersession, not history rewrite Learned semantic/control objects are immutable/versioned. Current admission is a projection over lifecycle events: ```text admit(v3) observe regression/counterexample suspend(v3) admit(v4) supersede(v3,v4) ``` Historical runs preserve the exact strategy/rule/composition versions used. Replaying an old run must not silently substitute today's replacement rule. # 8. Comparison with current Prolog-RLM / Symbolic Memory The current architecture already has the right boundaries but no complete learning fabric: - #392 can represent cases/examples separately from universal rules and provides provenance/context/profile identity. - #393 distinguishes induced/generalized knowledge from source-explicit claims. - #400 supplies support/defeat/profile-relative epistemic reasoning. - #401/PIF+MEPP+PIFF+DPEC already says cases propose methods; they do not auto-promote. - #403 provides deterministic bounded retrieval/strategy execution receipts. - #377/#379/#385/#386 provide expert, planning, failure and review evidence that can feed experience records. - `RLM-RESEARCH-008` already demonstrates execution-vs-promotion separation for adaptive recursion. - Symbolic Memory #6 supplies the append-only lifecycle needed to persist experience/candidate/promotion histories. What #404A adds is the missing **typed bridge between those experiences and admitted reusable strategy/rule knowledge**. # 9. Complexity / scaling - experience append: logical O(1) plus index maintenance; never rewrite prior episodes; - strategy-stat update: O(1) per relevant aggregate, with bounded context-class indexing; - strategy selection: O(k) over applicable candidates or less with goal/context indexes; - EBG: proportional to the demanded explanation/proof slice in ordinary cases, but proof/generalization structure can grow badly and must have node/depth/work bounds; - ILP: combinatorial/exponential hypothesis search in the general case; bound clauses/literals/variables/invented predicates/examples/solver calls/time/memory and return `resource_limited`, never arbitrary first hypothesis; - promotion replay/evaluation: proportional to declared evaluation corpus/fixtures; use provenance refs/cuts rather than copying source episodes; - no global relearning after every event: candidate generation is trigger/demand driven, and counterexample-driven validation may update only affected candidate families; - performance profiles have explicit generation/recency so concept drift can invalidate them rather than poisoning forever. # 10. Epistemic / provenance implications A learned object must expose: ```text origin experiences source/observation provenance learner + version background theory/profile hypothesis language / operationality criterion training/evaluation splits or fixture lineage supporting examples negative/counterexamples promotion policy/version promotion decision receipt subsequent regressions/suspensions/supersessions ``` Do not flatten this into `confidence=.92`. Correlated/mirrored episodes do not count as independent validation simply because they are separate rows. #400/#402 source-dependence semantics apply to learning evidence too. # 11. Safety / authority Hard A invariants: ```text learned semantic action != trusted host binding learned policy statement != authority policy learned expert composition != executable handler high success rate != permission model-proposed lesson != admitted lesson repair success != diagnosis proof failure under denial != evidence capability is defective resource exhaustion != negative semantic example ``` Learned knowledge may rank/select among already admissible strategies or propose semantic methods/rules. It may never silently create capabilities, widen read/write scope, relax Frozen Specs, mutate VERIFY criteria, or bypass effect admission. # 12. Adversarial/failure review A-foundation failure cases already visible for B to attack more deeply: - one lucky success overgeneralized into a universal rule; - training/test leakage through shared provenance; - duplicate/correlated experiences counted as independent evidence; - learner optimizes task success while increasing catastrophic side effects not represented in the objective; - stale historical performance drives current strategy choice after environment drift; - candidate rewrites its promotion criterion or verifier; - failed authority request becomes a bogus negative example for procedure semantics; - learned composition refers to removed/incompatible expert versions; - model-generated candidate smuggles callable Prolog or authority metadata; - self-generated experiences recursively validate their own rule without independent evidence; - shadow/canary evidence is misrepresented as production evidence; - success metric rewards skipping difficult VERIFY obligations. B must attack these explicitly; A does not claim they are solved by a threshold. # 13. Rejected shortcuts 1. **`assertz/1` lessons after success** — rejected: collapses observation, induction, validation and admission. 2. **one scalar reward/confidence for all learning** — rejected: truth, utility, cost, risk, provenance and trust are different dimensions. 3. **LLM reflection text as learned policy** — rejected: useful candidate generator only. 4. **global reinforcement of whichever expert won** — rejected: confounds task mix, source dependence, changing versions and verification quality. 5. **self-modifying Prolog source as normal adaptation** — rejected: destroys replay/authority boundaries and bypasses the semantic IR/registry contracts. 6. **one universal learner** — rejected: EBG, ILP, case abstraction and strategy performance have materially different evidence/guarantees. # 14. Falsifiable #404A fixtures A1. successful episode persists as experience but creates no admitted rule automatically. A2. failed episode persists without becoming a negative semantic example by default. A3. identical replay records preserve exact strategy/expert/rule versions. A4. EBG candidate exposes every proof assumption used for generalization. A5. hidden/unproved EBG assumption blocks admission. A6. bounded ILP fixture learns a rule covering positives and excluding negatives. A7. one negative counterexample rejects an over-general candidate when policy requires consistency. A8. context-dependent examples do not flatten into one global rule. A9. hypothesis-search exhaustion returns `resource_limited`, not first-found promotion. A10. model-proposed candidate remains inert before schema/profile validation. A11. learned semantic action has zero host capability absent an existing trusted binding. A12. learned expert composition can reference only existing compatible registered contracts. A13. composition cannot widen caller capability/authority ceiling. A14. unknown/removed expert version makes composition stale/unsupported. A15. strategy statistics alter selection preference but cannot alter #400 warrant for a proposition. A16. stale performance profile is rejected for a current-only strategy decision. A17. two mirrored episodes do not satisfy an independence requirement for promotion. A18. VERIFY failure prevents an episode from being labeled successful merely because the worker reports success. A19. authority denial is preserved as policy/blocked outcome and is not learned as a system fault. A20. resource exhaustion/cancellation is not converted into negative semantic evidence. A21. promotion receipt names exact evaluation cuts/fixtures and policy version. A22. candidate cannot modify its promotion policy or VERIFY acceptance rules. A23. admitted rule can be suspended after a counterexample without deleting history. A24. superseding v4 leaves historical v3 runs exactly replayable. A25. canary/shadow evidence is labeled distinctly from production evidence. A26. regression under admitted strategy produces a new experience and can trigger suspension policy. A27. case-based procedural candidate still passes #401/DPEC validation before use. A28. learned method still executes through #288 and requires fresh #384 VERIFY. A29. known symbolic strategy-selection fixture completes with providers disabled and `model_calls = 0`. A30. symbolic candidate-validation fixture completes with providers disabled and `model_calls = 0`. A31. self-generated examples cannot alone satisfy a policy requiring independent external/held-out validation. A32. promotion evaluation cannot weaken/remove a Frozen Spec obligation to improve its score. # Canonical issue changes required by A - **#377:** expert selection may consume versioned admitted strategy/performance profiles, but registration/selection/authority remain separate; automatic expert creation means declarative compositions over registered contracts only. - **#379:** case/EBG/ILP outputs are candidate methods/control rules until #404 promotion and ordinary DPEC admission; admitted learned strategies carry version/promotion receipt dependencies. - **#385:** diagnostic/repair episodes feed immutable learning experience; successful repair still does not prove diagnosis or auto-promote a repair rule. - **#386:** review findings/counterexamples may feed candidate evaluation but Review cannot promote or retract by prose alone. - **#392/#393:** learned/candidate/admitted rule status and learning provenance must remain distinct from source-explicit semantics. - **Symbolic Memory #6:** persist immutable experience, candidate, promotion/suspension/supersession and replay lineage; derived performance aggregates/indexes may be rebuildable. - **Symbolic Memory #7/#9:** query/native surfaces must expose learned-object status, evidence/promotion receipt and exact version rather than flattening candidates/admitted rules. # Unresolved questions reserved for later subpasses ## #404B — semantic/adversarial deepening Poisoning of experience, reward hacking/Goodhart effects, self-confirmation, label leakage, concept drift, contradictory lessons, confidence/calibration, catastrophic promotion, strategic manipulation of VERIFY, unsafe self-model loops, and promotion under noisy/partial evidence. ## #404C — heterogeneity/interoperability Transfer/federation of learned rules across theories/namespaces/ledgers, ontology mappings, heterogeneous ILP/EBG/case/performance learners, expert portfolio interoperability, cross-formalism procedural learning, and non-flattening composition of learning guarantees. ## #404D — computational realization/conformance Incremental experience indexes, hypothesis-space/search bounds, candidate invalidation, shadow/canary execution mechanics, deterministic async learning, replay, promotion dependency graphs, scale benchmarks and executable differential conformance. **A conclusion:** use staged, typed, provenance-heavy learning. Machine Spirit may learn reusable semantic/control knowledge and better strategy selection, but learned knowledge never becomes its own authority plane. **Exact next legal subpass: #404B — semantic/adversarial deepening.**
Author
Owner

Machine Spirit #404B — semantic/adversarial deepening

Status: B COMPLETE — C NEXT.

This pass attacks EPOCH's hidden assumption that a staged promotion lifecycle is safe merely because it has more stages. It is not. A sufficiently adaptive learner can contaminate its own validation evidence, optimize proxies until they diverge from intended quality, bias the distribution of future experiences, manipulate or overfit its verifier, and then cite those self-shaped observations as evidence that it should be trusted more.

The result is CITADEL-EPOCH — Contamination-Isolated, Tamper-Aware, Drift-Explicit Learning safeguards for EPOCH.

The core rule is:

candidate success on evidence it influenced
    != independent evidence that the candidate generalizes

and the stronger promotion boundary is:

experience
  != candidate lesson
  != evaluation evidence
  != independent evaluation evidence
  != safe improvement evidence
  != admitted reusable knowledge
  != authority

Research questions / scope

B asks:

  1. How can Machine Spirit learn from its own executions without creating a self-confirming feedback loop?
  2. What counts as genuinely independent evidence when many records share a source, derivation, tool, model, benchmark, or candidate-generated artifact?
  3. How should repeated adaptive candidate search avoid overfitting the same promotion fixtures/holdout?
  4. How do we distinguish useful optimization from Goodhart/reward-hacking behavior when candidate selection targets a proxy metric?
  5. What happens when a candidate can affect the verifier, its inputs, the tests, or the distribution of tasks that later measure the candidate?
  6. How should noisy labels, contradictory lessons, correlated evidence and selection bias affect candidate promotion?
  7. How should concept drift or a changed project/environment suspend learned rules without rewriting history?
  8. What does calibrated strategy confidence mean, and what can it not authorize?
  9. How do we prevent a learned self-model from becoming an authority amplifier or self-fulfilling competence score?
  10. Which failures should force quarantine/suspension rather than merely lowering an average score?
  11. How do deterministic symbolic-rule promotions differ from empirical strategy/policy promotions?
  12. How can we preserve zero-model evaluation/promotion for already-known symbolic cases?

Out of scope for B: heterogeneous federation of multiple learning/promotion systems is C; execution-scale/indexing/replay algorithms are D.


Primary evidence

Classical and current primary/authoritative sources used in this pass:

  • Amodei et al., Concrete Problems in AI Safety, 2016. Reward hacking, distributional shift, scalable supervision, side effects and safe exploration. https://arxiv.org/abs/1606.06565
  • Everitt, Krakovna, Orseau, Hutter & Legg, Reinforcement Learning with a Corrupted Reward Channel, IJCAI 2017. https://arxiv.org/abs/1705.08417
  • Everitt, Hutter, Kumar & Krakovna, Reward Tampering Problems and Solutions in Reinforcement Learning: A Causal Influence Diagram Perspective, Synthese 2021. DOI 10.1007/s11229-021-03141-4; https://arxiv.org/abs/1908.04734
  • Leike et al., AI Safety Gridworlds, 2017. Separates observed reward from hidden intended-performance evaluation and includes reward gaming, robustness to self-modification, distributional shift and adversaries. https://arxiv.org/abs/1711.09883
  • Manheim & Garrabrant, Categorizing Variants of Goodhart's Law, 2018. https://arxiv.org/abs/1803.04585
  • Gao, Schulman & Hilton, Scaling Laws for Reward Model Overoptimization, ICML/PMLR 2023. Optimizing an imperfect proxy can keep increasing proxy reward while gold reward degrades. https://proceedings.mlr.press/v202/gao23h.html
  • Dwork et al., Preserving Statistical Validity in Adaptive Data Analysis, STOC 2015; and The Reusable Holdout, Science 2015. https://arxiv.org/abs/1411.2664 ; DOI 10.1126/science.aaa9375
  • Kaufman, Rosset, Perlich & Stitelman, Leakage in Data Mining: Formulation, Detection, and Avoidance, ACM TKDD 2012, DOI 10.1145/2382577.2382579 (conference precursor KDD 2011 DOI 10.1145/2020408.2020496).
  • Bifet & Gavaldà, Learning from Time-Changing Data with Adaptive Windowing, SDM 2007, DOI 10.1137/1.9781611972771.42. Adaptive-window drift detection with false-positive/false-negative performance guarantees.
  • Quiñonero-Candela et al. (eds.), Dataset Shift in Machine Learning, MIT Press 2008/2009, DOI 10.7551/mitpress/9780262170055.001.0001.
  • Thomas, Theocharous & Ghavamzadeh, High-Confidence Off-Policy Evaluation, AAAI 2015, DOI 10.1609/aaai.v29i1.9541.
  • Petrik, Chow & Ghavamzadeh, Safe Policy Improvement by Minimizing Robust Baseline Regret, NeurIPS 2016. https://arxiv.org/abs/1607.03842
  • Guo, Pleiss, Sun & Weinberger, On Calibration of Modern Neural Networks, ICML 2017. https://arxiv.org/abs/1706.04599
  • Hubinger et al., Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training, 2024. https://arxiv.org/abs/2401.05566 — useful hostile evidence that passing/adapting to a training or adversarial-evaluation process is not proof that latent bad behavior is absent.

Repository evidence:

  • research/RLM-RESEARCH-008-adaptive-recursion.org already has the correct execution-vs-promotion distinction: live multi-fixture evidence is required and deterministic fixture evidence cannot self-promote deeper recursion.
  • docs/evolution-kernel.md already keeps fitness vectors, evaluator identity and candidate lineage separate, rejects arbitrary generated callable operators, and explicitly leaves promotion/rollback outside the generic evolution kernel.
  • #384 makes VERIFY the independent Frozen-Spec acceptance boundary.
  • #386 makes Review/Critic findings candidate evidence rather than final truth.
  • #400/#394 already distinguish evidence/support from profile-relative warrant.
  • #402 gives append-only/bitemporal history and source-dependence lineage.
  • #403/OATH-TAPS already establishes adversarial counterevidence/freshness/independent-origin obligations for retrieval.

These are compatible with CITADEL; they are not sufficient by themselves because a learning loop can still reuse or influence its own evaluation data.


Candidate architectures

Candidate 1 — fixed hidden benchmark / sealed regression suite

Every candidate is evaluated against a hidden, trusted benchmark; promotion occurs if its score exceeds a threshold.

Strengths:

  • simple;
  • deterministic where fixtures are deterministic;
  • candidate cannot trivially rewrite the verifier if the evaluator is host-owned.

Failure:

  • repeated adaptive search over the same holdout leaks information through scores/failures and eventually overfits it;
  • benchmark coverage drifts from production;
  • one scalar benchmark invites Goodhart optimization;
  • hidden tests provide secrecy, not a semantic independence proof;
  • a candidate may manipulate task selection or inputs without touching benchmark code.

Rejected as the complete architecture.

Candidate 2 — Bayesian/global confidence learner

Maintain posterior confidence/trust for each learned rule/strategy from successes/failures; automatically promote above a threshold and decay under failures.

Strengths:

  • naturally accumulates evidence;
  • can model noisy observations and changing confidence;
  • convenient for strategy routing.

Failure:

  • one global probability collapses source dependence, evidence class, validity scope, verifier quality, candidate exposure and causal influence;
  • a wrong likelihood/model assumption can make the confidence meaningless;
  • confidence is not authority;
  • self-generated/correlated successes can bootstrap confidence;
  • contradictory rules may be scope-specific rather than probabilistic noise.

Rejected as the universal model. Probabilistic/calibration profiles may exist for declared empirical strategy classes only.

Candidate 3 — always-online bandit/RL adaptation

Treat strategy/expert/rule selection as an online decision problem and continuously update from reward/VERIFY outcomes.

Strengths:

  • naturally responds to nonstationarity;
  • directly optimizes operational performance;
  • can explore alternatives.

Failure:

  • unsafe exploration for effectful strategies;
  • endogenous task distribution and selection bias;
  • reward/verifier tampering surface;
  • no general semantic-rule induction guarantee;
  • catastrophic regressions can occur before statistics catch up;
  • online reward does not prove causal generalization.

Accepted only as an optional bounded strategy-selection mechanism inside the stronger promotion firewall.

Preferred — CITADEL-EPOCH

CITADEL wraps EPOCH in an explicit evidence-independence, evaluator-noninterference and drift-control layer.

immutable EPOCH experiences
        ↓
provenance + causal/source-dependence + exposure graph
        ↓
candidate-generation evidence partition
        ↓
EBG / ILP / case / strategy candidate
        ↓
CANDIDATE EXPOSURE FREEZE
  what sources, rules, fixtures, metrics, verifier outputs,
  models and derived artifacts influenced this candidate?
        ↓
trusted promotion/evaluation plan
        ↓
independent evaluation lanes
  deterministic proof/reference
  held-out origin groups
  counterexample/adversarial lane
  temporal/future lane
  shadow/canary lane where safe
        ↓
metric tamperability + contamination + drift analysis
        ↓
safe-improvement decision vs admitted baseline
        ↓
admit | hold | quarantine | reject | resource_limited
        ↓
post-admission drift/violation monitoring
        ↓
suspend/supersede/retract without rewriting history

CITADEL does not add another scheduler or verifier. It defines which evidence #404 promotion may accept and how it must classify uncertainty/contamination.


1. Evaluation evidence is a separate semantic class

EPOCH A recorded experiences and promotion receipts, but B requires explicit evidence roles:

generation_evidence      used to propose the candidate
selection_evidence       used to tune/rank variants
validation_evidence      reserved to decide promotion
audit_evidence           independent hostile checks
post_admission_evidence  future monitoring

The same observation may be retained in history under several relations, but it cannot count as statistically/epistemically independent evidence merely because it has multiple IDs.

Conceptual record:

meta_evidence_use(
    CandidateId,
    EvidenceRef,
    Role,
    OriginGroup,
    CausalParents,
    ExposurePath,
    IndependenceClass,
    Time,
    Provenance).

Hard rule:

record independence != source independence != causal independence

Ten retries, ten mirrors, ten model summaries, or ten derived features from the same underlying outcome do not create ten independent validations.

2. Candidate exposure closure is first-class

Every candidate gets an exposure closure describing what could have influenced its content/parameters/selection.

Conceptually:

meta_candidate_exposure(
    CandidateId,
    SourceRefs,
    SemanticRefs,
    FixtureRefs,
    MetricRefs,
    VerifierOutputRefs,
    AncestorCandidateRefs,
    ModelOrLearnerRefs,
    Cut,
    Provenance).

A validation fixture is contaminated for that candidate if its answer/expected result/material derivation is in the candidate's exposure/causal ancestry under the configured independence policy.

Important: exact byte duplication is not required for leakage. A paraphrase, derived rule, model-generated summary, prior failed validation message, or previously promoted rule can carry the relevant information.

CITADEL therefore treats contamination as a provenance/causal relation, not only text overlap.

3. Adaptive evaluation has an explicit information budget

Dwork et al.'s adaptive-data-analysis result matters directly: repeated adaptive decisions based on one holdout can invalidate naive significance/generalization claims.

CITADEL does not require differential privacy for v1, but it adopts the architectural consequence:

  • a hidden/reserved evaluation cohort is not infinitely reusable;
  • candidate generators do not receive unlimited per-fixture detail from reserved validation;
  • if a failed holdout case is exposed for repair, it becomes training/selection evidence for descendants and must be replaced or reclassified for later independent validation;
  • promotion receipts record how many adaptive candidate/evaluation interactions occurred against each cohort;
  • statistical claims use an evaluation policy that accounts for adaptive reuse/multiple candidate selection, or return insufficient_independence.

This prevents:

candidate_1 fails hidden case H
→ generator sees exact failure
→ candidate_2 patches H
→ same H counted as independent held-out validation

H is now training evidence for candidate_2.

4. Promotion metrics are typed by semantic role and tamper surface

No universal reward or fitness scalar.

Conceptual contract:

meta_metric_contract(
    MetricId,
    Role,             % hard_guard | proxy_objective | audit | cost | coverage
    Direction,
    EvaluatorRef,
    Inputs,
    CandidateInfluence,
    ManipulabilityClass,
    CalibrationProfile,
    Version).

Roles:

  • hard_guard: invariant violation blocks promotion regardless of average score;
  • proxy_objective: may be optimized, but is explicitly a proxy;
  • audit: deliberately not a direct optimization target where possible;
  • cost: resource/latency/model usage;
  • coverage: evaluation search/fixture completeness, never correctness by itself.

Hard Goodhart rule:

optimized proxy improvement
    != intended-objective improvement

If the candidate can causally influence a metric's evaluator/input channel, that metric is tamper_exposed and cannot be the sole promotion gate.

5. VERIFY noninterference becomes a learning invariant

#384 already owns final task acceptance. B strengthens the learning use of VERIFY:

candidate may affect world/project state
candidate may NOT redefine the Frozen Spec used to judge that attempt
candidate may NOT mutate the trusted verifier/evidence policy used to promote itself
candidate-authored tests != independent validation by default

A candidate-generated test can be useful generation/selection evidence. It becomes independent validation only after a separate trusted policy admits that test without relying on the candidate's assertion of adequacy, and even then the test's provenance remains visible.

Verifier/config/spec fingerprints are frozen into each evaluation receipt. A candidate that changes the verifier, benchmark, test oracle or evidence-admission policy invalidates that evaluation lane unless the change itself is separately authorized and a fresh evaluation generation is created.

6. Hidden evaluator != sufficient evaluator

AI Safety Gridworlds' hidden performance function is a useful conceptual separation between observed reward and intended behavior, but secrecy alone is insufficient.

CITADEL prefers orthogonal evaluation channels:

deterministic semantic/proof invariants
reference/differential implementation
fresh observable-world VERIFY evidence
held-out origin groups
dedicated Review/Critic counterexamples
future temporal holdout / shadow outcomes

Different evaluator implementations are not automatically independent if they share the same source oracle/data.

7. Counterexample search is mandatory for generalization claims

For rule/method candidates, promotion includes a typed hostile search obligation:

meta_counterexample_campaign(
    CandidateId,
    TargetAssumptions,
    Generators,
    SearchSpaceProfile,
    Bounds,
    FoundCounterexamples,
    Coverage,
    Receipt).

Sources may include:

  • #386 deterministic critic rules;
  • negation/boundary/metamorphic fixtures;
  • source-independent historical cases;
  • ILP failure constraints;
  • optional model-generated adversarial candidates, which remain candidate tests until deterministically/observably evaluated.

no counterexample found under a bounded search means exactly that. It is not a proof of universal correctness unless the declared finite/decidable search space was exhaustive.

8. Safe-improvement is relative to an admitted baseline

For empirical strategy/control candidates, CITADEL requires comparison to an admitted baseline under the same declared task/context distribution.

Possible evaluation profiles:

deterministic_dominance
paired_empirical
high_confidence_off_policy
robust_baseline_regret
shadow_canary

Thomas et al. and Petrik/Chow/Ghavamzadeh provide useful precedents for lower-confidence-bound / robust-baseline reasoning when executing a poor policy is costly.

CITADEL does not claim their RL guarantees automatically transfer to arbitrary expert systems. It adopts the design requirement:

insufficient evidence to establish improvement
    → keep baseline / hold candidate

not:

best observed candidate so far
    → promote

For deterministic finite symbolic fixtures, promotion can instead be proof/differential based; do not force fake probabilities onto exact checks.

9. Selection bias and self-fulfilling competence are recorded

An admitted strategy changes which tasks it sees, which actions it attempts, which evidence is gathered and therefore what future success statistics look like.

Example failure:

strategy S avoids hard tasks
→ observed success rate rises
→ self-model says S is better
→ S receives even more easy tasks
→ apparent competence bootstraps

CITADEL records selection policy/context/eligibility for each experience. If candidate A and baseline B were not plausibly evaluated on comparable contexts, the promotion evaluator returns selection_bias_unresolved rather than treating raw success rates as causal improvement.

Where policy permits, bounded randomized/shadow challenge allocation can provide cleaner evidence. High-risk/effectful exploration remains authority- and safety-gated.

10. Concept drift creates validity epochs, not memory rewriting

Learned rules/strategy profiles are scoped to context and evaluated epochs.

Conceptually:

meta_drift_watch(
    LearnedObject,
    ContextSignature,
    SignalClass,
    DetectorProfile,
    BaselineWindow,
    CurrentWindow,
    Status,
    EvidenceRefs,
    Version).

Possible status:

stable
warning
confirmed_drift
insufficient_data
confounded

ADWIN is a strong candidate detector for streaming numeric performance/error signals because it adapts window length and has formal false-positive/false-negative bounds. It is not a universal semantic drift oracle.

Hard behavior:

confirmed material drift
   → suspend/quarantine affected admission projection
   → require reevaluation/re-promotion

not:

confirmed drift
   → rewrite old rule/history

Bitemporal #402 history preserves what was admitted, when, and under which environment generation.

11. Contradictory/noisy experience does not become majority truth

Experience labels are typed by failure/observation class and provenance.

A failed run can mean:

  • method defect;
  • plan-instance defect;
  • stale evidence;
  • authority denial;
  • resource exhaustion;
  • external transient failure;
  • verifier uncertainty;
  • genuinely wrong candidate.

Therefore:

failed episode != negative example for every candidate involved
successful episode != positive example for every candidate involved

#385 diagnosis evidence determines which learning lanes may treat an outcome as a candidate counterexample.

Correlated labels remain grouped by origin/dependence. Contradictory evidence may justify scoped alternatives/defaults rather than a global winner.

12. Calibration is an empirical property, not trust or truth

For empirical selection policies, a confidence score may be calibrated against observed correctness/outcome rates for a declared cohort/version.

Guo et al. is useful evidence that raw model confidence can be poorly calibrated and post-hoc calibration can improve probability estimates. The architectural consequence is:

raw confidence != calibrated probability
calibrated probability != epistemic warrant
calibrated probability != authority

Calibration has a domain/time/profile fingerprint and must be re-evaluated under drift.

13. Self-models are advisory and non-authoritative

EPOCH's self-model may record:

coverage
success/failure by task class
resource distributions
known unsupported regions
recent drift
calibration
strategy availability

But a self-model cannot:

  • grant capabilities;
  • widen authority;
  • weaken VERIFY;
  • lower its own promotion threshold;
  • mark evidence independent;
  • suppress counterexample obligations;
  • change Frozen Spec;
  • promote its own updater.

A self-model observation can influence which strategy to try. It cannot define what counts as successful evidence for that strategy.

14. Catastrophic violations are not averaged away

Promotion policies may declare hard zero-tolerance classes:

authority escalation
Frozen-Spec mutation
verifier/evaluator tampering
unsafe effect outside admitted scope
proven provenance leakage
replay-integrity violation
unbounded resource/cancellation violation

One such violation may quarantine a candidate even if average quality improves.

This is different from ordinary stochastic task failure.

15. Promotion lifecycle is refined

Recommended B lifecycle:

proposed
schema_validated
exposure_frozen
contamination_checked
retrospectively_evaluated
counterexample_checked
independent_validation_pending
shadow_validated
canary_validated       % when appropriate
promotion_ready
admitted

hold
quarantined
suspended_on_drift
deprecated
superseded
retracted

Not every candidate class uses all stages, but admitted must never be reachable without the required evidence roles and independence checks for its risk class.

16. Typed promotion receipt

Conceptual form:

meta_promotion_receipt(
    ReceiptId,
    CandidateId,
    CandidateVersion,
    PolicyId,
    BaselineRef,
    ExposureClosureRef,
    EvaluationPlanRef,
    EvidencePartitions,
    ContaminationFindings,
    CounterexampleReceipt,
    MetricReceipts,
    ImprovementEvidence,
    DriftStatus,
    HardGuardResults,
    CalibrationRef,
    Decision,
    Limitations,
    DecidedAt,
    Provenance).

The receipt explains both why promotion happened and what the evidence does not establish.


Complexity / performance / scaling implications

CITADEL adds real cost; it is intentionally not free.

Exposure/lineage checking

Exact candidate/evidence contamination checking is graph reachability over provenance/derivation/exposure edges. With indexed ancestry and immutable digests, ordinary checks are proportional to the demanded reachable lineage rather than the whole ledger. Worst-case ancestry can approach total history.

Use #402 shared provenance DAGs, source-dependence components and generation fingerprints. Do not duplicate entire provenance trees per candidate.

Generally combinatorial/undecidable for open rule languages. Every campaign declares:

search profile
space restrictions
time/work/memory bound
coverage status

Exhaustive claims are legal only for a declared finite/decidable fragment where exhaustive completion is proven.

Adaptive holdout

Maintaining fresh independent cohorts costs data. Candidate search cannot consume an unlimited sequence of free validation queries. D must choose practical cohort-rotation/reveal-budget mechanics.

Drift

Streaming detectors such as ADWIN can be sublinear-memory summaries; semantic-context drift may require heavier structured checks. Drift monitoring is a trigger for reevaluation, not proof of a new rule.

Strategy evaluation

High-confidence/off-policy estimators may have high variance and need substantial data; robust safe-improvement formulations can be computationally hard. Return insufficient_evidence/resource_limited instead of manufacturing confidence.


Epistemic / provenance implications

CITADEL adds new provenance classes that must remain independent of #400 epistemic warrant:

experience provenance
candidate-generation provenance
candidate-exposure provenance
evaluation/validation provenance
metric/evaluator provenance
promotion-decision provenance
post-admission monitoring provenance

A promotion receipt is operational/control knowledge. It does not make the learned proposition a source-explicit fact.

For a learned rule, explanations should answer:

What experiences generated this candidate?
Which of those were correlated?
Which evidence was reserved and independent?
What did the candidate/generator already see?
Which verifier/metric versions were used?
What counterexamples were sought/found?
What baseline was compared?
Was improvement deterministic or statistical?
What drift/calibration scope applies?
What would suspend this rule?

Safety / authority implications

Hard B invariants:

candidate data != executable code
candidate score != authority
promotion != capability grant
self-model competence != authority
success rate != permission
verifier pass != independent validation
candidate-authored test != independent oracle
hidden benchmark != universal correctness
no counterexample found != no counterexample exists
confidence != epistemic truth
calibration != trust
metric optimization != intended-goal optimization

Promotion may change which already-authorized semantic/control knowledge is selected. It may not enlarge the host's capability/authority envelope.


Adversarial review / failure cases

B explicitly rejects the following attacks/failures:

  1. Experience poisoning: malicious source injects many fabricated successful episodes.
  2. Echo amplification: same upstream episode mirrored into many memories appears as independent validation.
  3. Validation laundering: a failed holdout is revealed, patched, then counted again as unseen evidence.
  4. Fixture memorization: candidate directly keys on benchmark IDs/text.
  5. Derived leakage: benchmark answer reaches candidate through summary/rule/vector/case lineage rather than exact text.
  6. Reward hacking: proxy metric improves while gold/independent quality falls.
  7. Verifier tampering: candidate changes tests/evaluator/spec or routes around them.
  8. Verifier gaming: candidate exploits a checker blind spot while remaining semantically wrong.
  9. Task-selection gaming: strategy avoids difficult cases and reports improved success.
  10. Selective evidence acquisition: strategy gathers only observations likely to support itself.
  11. Self-model bootstrap: higher self-score causes easier routing and more apparent success.
  12. Correlated model judges: multiple evaluator calls to same model/source counted as independent agreement.
  13. Noisy outcome mislabel: authority/resource failure becomes negative example for procedural rule.
  14. Concept drift: once-good rule remains active after environment/API/ontology changes.
  15. Catastrophe averaging: one authority violation hidden by 999 successful trials.
  16. Adaptive p-hacking: thousands of candidate variants searched until one passes a fixed threshold by chance.
  17. Metric-policy mutation: candidate learns to change what metrics are reported.
  18. Calibration laundering: calibrated score from old domain/version reused after shift.
  19. Shadow-to-live mismatch: safe shadow performance assumes effects/feedback absent in production.
  20. Counterexample suppression: candidate influences retrieval so adverse cases never enter the evaluator.
  21. Review collusion: learned Review strategy becomes less likely to surface flaws in preferred candidate family.
  22. Ancestor contamination: child candidate inherits information from parent that saw reserved evidence.
  23. Temporal leakage: future result accidentally available when evaluating historical decision quality.
  24. Identity leakage: aliases/near-duplicates split across IDs defeat holdout grouping.

Rejected shortcuts

  • One scalar confidence/reward: destroys semantics and invites Goodhart optimization.
  • Majority vote of experiences: ignores source dependence, task selection and failure class.
  • More evaluator/model votes: not independent if they share source/model/training lineage.
  • Just hide the tests: adaptive feedback still leaks; secrecy is not a proof.
  • Always retrain on latest window: can chase noise and silently forget previously valid domains.
  • Automatic promotion after N successes: N correlated/manipulated successes prove little.
  • Automatic demotion after one ordinary failure: some failures are external/authority/resource/context issues.
  • Let candidate tune promotion policy: direct self-approval loop.
  • Treat VERIFY as a reward function: VERIFY is task acceptance under an exact Frozen Spec, not a universal reusable-strategy utility signal.
  • Treat Review findings as labels automatically: Review can be uncertain or wrong and still needs provenance/grounding.
  • Assume statistical CI = safety: confidence bounds are only as good as their sampling/independence assumptions.

Falsifiable B conformance fixtures

At minimum implement/prove these later; design IDs B1-B40:

  1. B1 candidate_self_success_not_rule — one verified success cannot auto-admit a universal rule.
  2. B2 source_copy_independence — 10 copies of one episode count as one origin group.
  3. B3 retry_independence — repeated retries of same state are not independent validations.
  4. B4 holdout_reveal_reclassifies — exposed failed holdout becomes training/selection evidence for descendants.
  5. B5 descendant_contamination — child candidate inherits parent exposure closure.
  6. B6 paraphrase_leakage — semantically derived/paraphrased holdout content triggers contamination even without byte match.
  7. B7 future_leakage — evidence known after decision time cannot validate historical policy as if known then.
  8. B8 identity_group_leakage — aliased versions of same entity/case remain one evaluation origin when appropriate.
  9. B9 proxy_goodhart — proxy score rises while independent gold fixture quality falls; promotion rejected/quarantined.
  10. B10 tamper_exposed_metric — candidate-influence on evaluator inputs prevents sole-gate use.
  11. B11 verifier_fingerprint_change — verifier/spec change mid-evaluation invalidates receipt generation.
  12. B12 candidate_authored_test — self-generated test is not independent validation by default.
  13. B13 hidden_test_overfit_budget — repeated adaptive holdout queries exhaust/reclassify validation budget.
  14. B14 hard_guard_dominates_average — authority violation blocks promotion despite higher mean quality.
  15. B15 baseline_insufficient_evidence — no defensible improvement vs baseline => hold, not promote.
  16. B16 deterministic_dominance — finite exact candidate can promote from exhaustive deterministic conformance without fake probabilities.
  17. B17 counterexample_bounded_honesty — bounded search returns no_counterexample_within(bounds) not universal truth.
  18. B18 exhaustive_fragment_proof — declared finite complete search may produce stronger exhaustive receipt.
  19. B19 task_selection_bias — candidate evaluated only on easier routed tasks cannot claim general improvement.
  20. B20 selective_observation_bias — candidate cannot suppress opposing evidence acquisition and claim completeness.
  21. B21 authority_failure_not_negative_rule_example — blocked authority does not train semantic/procedural rule as wrong.
  22. B22 resource_failure_not_negative_rule_example — timeout/resource limit preserves ambiguous causal label.
  23. B23 diagnosis_targets_learning_label — #385-supported diagnosis can attach a failure to the correct candidate component with provenance.
  24. B24 contradictory_lessons — two context-specific contradictory lessons remain scoped alternatives/defaults rather than last-write winner.
  25. B25 drift_suspends_current_admission — confirmed material drift suspends current use without deleting historical admission.
  26. B26 old_calibration_rejected_after_drift — calibration profile cannot silently cross changed context/version.
  27. B27 self_model_no_authority — competence estimate cannot widen capability/authority or lower promotion gate.
  28. B28 self_model_no_evidence_independence — self-model cannot mark its own supporting experience independent.
  29. B29 review_finding_not_truth — Review candidate finding alone neither promotes nor retracts a rule.
  30. B30 correlated_judges — repeated outputs sharing evaluator/model/source lineage do not become independent votes.
  31. B31 adaptive_candidate_multiplicity — search over many candidate variants records adaptive-selection count/evaluation policy.
  32. B32 shadow_live_difference — shadow-only evidence cannot establish live-effect safety when feedback/effect semantics differ.
  33. B33 canary_blast_radius — high-risk candidate cannot expand canary scope outside trusted policy.
  34. B34 quarantine_on_tampering — attempted verifier/evaluator/promotion-policy tampering yields quarantine.
  35. B35 rollback_append_only — drift/counterexample suspends/supersedes without rewriting original promotion receipt.
  36. B36 exact_historical_replay — historical run resolves exact learned-object/evaluator/policy versions it used.
  37. B37 provider_disabled_validation — known symbolic candidate validation/promotion works with providers disabled and model_calls = 0.
  38. B38 optional_model_counterexample_is_candidate_only — model-generated hostile case is inert until checked by trusted semantics/evidence.
  39. B39 metric_vector_not_scalarized_by_candidate — candidate cannot choose weights that trade away hard safety constraints.
  40. B40 promotion_policy_self_reference — candidate/promotion object cannot modify or select a weaker policy governing itself.

Canonical issue changes required by B

#404

Adopt CITADEL-EPOCH as the B refinement over EPOCH. Mark A+B COMPLETE / C NEXT. C must focus on interoperability/federation between heterogeneous learners, validators, promotion authorities, stores and organizational/domain boundaries without flattening their evidence semantics.

#397

Depth 7 becomes A+B COMPLETE / C NEXT. #404C only is authorized after this B persistence; #405 remains blocked.

#384 VERIFY Expert

Add learning-specific noninterference requirements:

  • verifier/Frozen-Spec/evidence-policy fingerprint frozen per evaluation generation;
  • candidate-authored verifier/test changes are not independent validation by default;
  • candidate cannot manipulate VERIFY and then cite resulting success for its own promotion;
  • fresh independent observation remains the acceptance boundary.

#385 Repair/Diagnosis Expert

Learning labels must consume diagnosis/failure class. A failed attempt is not automatically a negative example for every implicated rule/method/strategy. Preserve causal attribution uncertainty.

#386 Review/Critic Expert

Add candidate-independent adversarial counterexample campaigns and explicit status that Review-generated findings/tests are candidate evidence until grounded; Review cannot self-promote learned review policy.

#377/#379/#381

Learned operational statistics and self-models may influence selection only as typed advisory/control evidence. They may not change truth, authority, obligations or VERIFY. Strategy routing must preserve selection-policy/context lineage so #404 can detect self-selection bias.

#392/#394/#395

Learned candidate/admission/evaluation status remains separate from source truth and epistemic warrant. #395 should add contamination/Goodhart/drift/promotion conformance classes, especially provenance-grouped splits and candidate-exposure leakage.

symbolic-memory #6

Persist immutable experience, candidate exposure, evidence-use roles/origin groups, metric/evaluator versions, promotion/quarantine/suspension/supersession receipts and drift/calibration lineage. These are semantic/control history, not one mutable confidence field.

symbolic-memory #7

Query/explanation must expose learned-object status, applicability epoch/scope, evidence independence/contamination findings, baseline/evaluation profile, counterexamples, calibration/drift and promotion limitations.

symbolic-memory #9

Native/MCP transport must not flatten to learned=true, confidence=N, or promoted=true; preserve candidate/admitted/quarantined/suspended and evidence limitations. No transport caller may mark evidence independent merely by assertion.

symbolic-memory #10

Identity/source reconciliation must participate in evaluation-origin grouping: aliases, mirrors, same-event references and derived copies cannot defeat contamination/source-dependence checks by receiving new IDs.


Repository ownership boundary

prolog-rlm owns:

  • EPOCH/CITADEL candidate/evidence-role schemas;
  • promotion-policy semantics;
  • exposure/contamination logic over supplied provenance;
  • counterexample campaign contract;
  • metric role/tamperability semantics;
  • deterministic/statistical evaluation profile contracts;
  • interaction with #377/#379/#381/#384/#385/#386;
  • zero-model conformance for symbolic candidate validation.

symbolic-memory owns:

  • durable experience/candidate/evaluation/promotion history;
  • bitemporal admission/suspension/supersession;
  • scalable provenance/exposure/origin-group indexes;
  • drift/calibration histories;
  • query/explanation surfaces;
  • cross-memory identity/source-dependence needed for contamination checks.

Host/trusted configuration owns:

  • promotion policy registration/version;
  • hidden/reserved evaluation material and reveal policy;
  • hard-guard classes;
  • capability/authority ceilings;
  • verifier bindings;
  • canary/live blast-radius policy.

A learned object may reference these; it cannot redefine them.


Unresolved questions reserved for C

  1. How do promotion/evidence semantics compose across separate projects/memories/organizations with different trust and privacy boundaries?
  2. How can one system consume another system's learned rule without inheriting false claims of independent validation?
  3. How are evaluation-origin groups reconciled across federated ledgers without leaking private identities/content?
  4. How should different learning formalisms exchange candidate/evidence/coverage semantics: EBG, ILP, case learning, online/bandit policy, statistical learner, model-derived candidate?
  5. How do heterogeneous verifier guarantees compose or fail to compose?
  6. Can independently governed promotion authorities disagree while preserving both statuses?
  7. How should a portable learned procedure distinguish semantic admission from local execution admission?
  8. How are drift/calibration scopes translated between environments?
  9. How do we transfer a candidate when the target environment lacks the source's hidden evaluation set or baseline?
  10. How should external learned objects arrive: admitted, candidate, quarantined, or evidence-only by default?

Unresolved questions reserved for D

  • incremental exposure-closure/index algorithms at very large scale;
  • practical adaptive-holdout/reveal budgeting;
  • sequential/multiple-testing correction profile selection;
  • deterministic counterexample enumeration for admitted fragments;
  • high-confidence/off-policy estimator library choices;
  • drift detector portfolio and false-alarm budgets;
  • rolling calibration implementation;
  • promotion-cache invalidation;
  • crash-safe promotion/quarantine transitions;
  • concurrency determinism;
  • million/billion-experience scaling;
  • differential cold == warm == rebuilt == incremental conformance for promotion decisions.

B completion statement

#404B is design-complete only.

It does not prove any self-improving implementation exists, and it does not satisfy the Machine Spirit executable bar.

Surviving Depth-7 architecture after A+B:

A / EPOCH
experience → typed candidate → controlled promotion lifecycle
        ↓
B / CITADEL-EPOCH
exposure/provenance isolation + adaptive-evaluation control
+ metric tamperability + safe-baseline comparison
+ counterexample obligations + drift/calibration/self-model firewalls
        ↓
learned reusable knowledge may become operationally admitted
but never self-authorized

Exact next subpass: #404C — composition / heterogeneity / interoperability of learning, validation, promotion and self-model evidence.

Do not start #404D or #405 until #404C is durably complete.

## Machine Spirit #404B — semantic/adversarial deepening **Status: B COMPLETE — C NEXT.** This pass attacks EPOCH's hidden assumption that a staged promotion lifecycle is safe merely because it has more stages. It is not. A sufficiently adaptive learner can contaminate its own validation evidence, optimize proxies until they diverge from intended quality, bias the distribution of future experiences, manipulate or overfit its verifier, and then cite those self-shaped observations as evidence that it should be trusted more. The result is **CITADEL-EPOCH — Contamination-Isolated, Tamper-Aware, Drift-Explicit Learning safeguards for EPOCH**. The core rule is: ```text candidate success on evidence it influenced != independent evidence that the candidate generalizes ``` and the stronger promotion boundary is: ```text experience != candidate lesson != evaluation evidence != independent evaluation evidence != safe improvement evidence != admitted reusable knowledge != authority ``` --- # Research questions / scope B asks: 1. How can Machine Spirit learn from its own executions without creating a self-confirming feedback loop? 2. What counts as genuinely independent evidence when many records share a source, derivation, tool, model, benchmark, or candidate-generated artifact? 3. How should repeated adaptive candidate search avoid overfitting the same promotion fixtures/holdout? 4. How do we distinguish useful optimization from Goodhart/reward-hacking behavior when candidate selection targets a proxy metric? 5. What happens when a candidate can affect the verifier, its inputs, the tests, or the distribution of tasks that later measure the candidate? 6. How should noisy labels, contradictory lessons, correlated evidence and selection bias affect candidate promotion? 7. How should concept drift or a changed project/environment suspend learned rules without rewriting history? 8. What does calibrated strategy confidence mean, and what can it *not* authorize? 9. How do we prevent a learned self-model from becoming an authority amplifier or self-fulfilling competence score? 10. Which failures should force quarantine/suspension rather than merely lowering an average score? 11. How do deterministic symbolic-rule promotions differ from empirical strategy/policy promotions? 12. How can we preserve zero-model evaluation/promotion for already-known symbolic cases? Out of scope for B: heterogeneous federation of multiple learning/promotion systems is C; execution-scale/indexing/replay algorithms are D. --- # Primary evidence Classical and current primary/authoritative sources used in this pass: - Amodei et al., **Concrete Problems in AI Safety**, 2016. Reward hacking, distributional shift, scalable supervision, side effects and safe exploration. https://arxiv.org/abs/1606.06565 - Everitt, Krakovna, Orseau, Hutter & Legg, **Reinforcement Learning with a Corrupted Reward Channel**, IJCAI 2017. https://arxiv.org/abs/1705.08417 - Everitt, Hutter, Kumar & Krakovna, **Reward Tampering Problems and Solutions in Reinforcement Learning: A Causal Influence Diagram Perspective**, Synthese 2021. DOI 10.1007/s11229-021-03141-4; https://arxiv.org/abs/1908.04734 - Leike et al., **AI Safety Gridworlds**, 2017. Separates observed reward from hidden intended-performance evaluation and includes reward gaming, robustness to self-modification, distributional shift and adversaries. https://arxiv.org/abs/1711.09883 - Manheim & Garrabrant, **Categorizing Variants of Goodhart's Law**, 2018. https://arxiv.org/abs/1803.04585 - Gao, Schulman & Hilton, **Scaling Laws for Reward Model Overoptimization**, ICML/PMLR 2023. Optimizing an imperfect proxy can keep increasing proxy reward while gold reward degrades. https://proceedings.mlr.press/v202/gao23h.html - Dwork et al., **Preserving Statistical Validity in Adaptive Data Analysis**, STOC 2015; and **The Reusable Holdout**, Science 2015. https://arxiv.org/abs/1411.2664 ; DOI 10.1126/science.aaa9375 - Kaufman, Rosset, Perlich & Stitelman, **Leakage in Data Mining: Formulation, Detection, and Avoidance**, ACM TKDD 2012, DOI 10.1145/2382577.2382579 (conference precursor KDD 2011 DOI 10.1145/2020408.2020496). - Bifet & Gavaldà, **Learning from Time-Changing Data with Adaptive Windowing**, SDM 2007, DOI 10.1137/1.9781611972771.42. Adaptive-window drift detection with false-positive/false-negative performance guarantees. - Quiñonero-Candela et al. (eds.), **Dataset Shift in Machine Learning**, MIT Press 2008/2009, DOI 10.7551/mitpress/9780262170055.001.0001. - Thomas, Theocharous & Ghavamzadeh, **High-Confidence Off-Policy Evaluation**, AAAI 2015, DOI 10.1609/aaai.v29i1.9541. - Petrik, Chow & Ghavamzadeh, **Safe Policy Improvement by Minimizing Robust Baseline Regret**, NeurIPS 2016. https://arxiv.org/abs/1607.03842 - Guo, Pleiss, Sun & Weinberger, **On Calibration of Modern Neural Networks**, ICML 2017. https://arxiv.org/abs/1706.04599 - Hubinger et al., **Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training**, 2024. https://arxiv.org/abs/2401.05566 — useful hostile evidence that passing/adapting to a training or adversarial-evaluation process is not proof that latent bad behavior is absent. Repository evidence: - `research/RLM-RESEARCH-008-adaptive-recursion.org` already has the correct execution-vs-promotion distinction: live multi-fixture evidence is required and deterministic fixture evidence cannot self-promote deeper recursion. - `docs/evolution-kernel.md` already keeps fitness vectors, evaluator identity and candidate lineage separate, rejects arbitrary generated callable operators, and explicitly leaves promotion/rollback outside the generic evolution kernel. - #384 makes VERIFY the independent Frozen-Spec acceptance boundary. - #386 makes Review/Critic findings candidate evidence rather than final truth. - #400/#394 already distinguish evidence/support from profile-relative warrant. - #402 gives append-only/bitemporal history and source-dependence lineage. - #403/OATH-TAPS already establishes adversarial counterevidence/freshness/independent-origin obligations for retrieval. These are compatible with CITADEL; they are not sufficient by themselves because a learning loop can still reuse or influence its own evaluation data. --- # Candidate architectures ## Candidate 1 — fixed hidden benchmark / sealed regression suite Every candidate is evaluated against a hidden, trusted benchmark; promotion occurs if its score exceeds a threshold. Strengths: - simple; - deterministic where fixtures are deterministic; - candidate cannot trivially rewrite the verifier if the evaluator is host-owned. Failure: - repeated adaptive search over the same holdout leaks information through scores/failures and eventually overfits it; - benchmark coverage drifts from production; - one scalar benchmark invites Goodhart optimization; - hidden tests provide secrecy, not a semantic independence proof; - a candidate may manipulate task selection or inputs without touching benchmark code. Rejected as the complete architecture. ## Candidate 2 — Bayesian/global confidence learner Maintain posterior confidence/trust for each learned rule/strategy from successes/failures; automatically promote above a threshold and decay under failures. Strengths: - naturally accumulates evidence; - can model noisy observations and changing confidence; - convenient for strategy routing. Failure: - one global probability collapses source dependence, evidence class, validity scope, verifier quality, candidate exposure and causal influence; - a wrong likelihood/model assumption can make the confidence meaningless; - confidence is not authority; - self-generated/correlated successes can bootstrap confidence; - contradictory rules may be scope-specific rather than probabilistic noise. Rejected as the universal model. Probabilistic/calibration profiles may exist for declared empirical strategy classes only. ## Candidate 3 — always-online bandit/RL adaptation Treat strategy/expert/rule selection as an online decision problem and continuously update from reward/VERIFY outcomes. Strengths: - naturally responds to nonstationarity; - directly optimizes operational performance; - can explore alternatives. Failure: - unsafe exploration for effectful strategies; - endogenous task distribution and selection bias; - reward/verifier tampering surface; - no general semantic-rule induction guarantee; - catastrophic regressions can occur before statistics catch up; - online reward does not prove causal generalization. Accepted only as an optional bounded strategy-selection mechanism *inside* the stronger promotion firewall. ## Preferred — CITADEL-EPOCH CITADEL wraps EPOCH in an explicit evidence-independence, evaluator-noninterference and drift-control layer. ```text immutable EPOCH experiences ↓ provenance + causal/source-dependence + exposure graph ↓ candidate-generation evidence partition ↓ EBG / ILP / case / strategy candidate ↓ CANDIDATE EXPOSURE FREEZE what sources, rules, fixtures, metrics, verifier outputs, models and derived artifacts influenced this candidate? ↓ trusted promotion/evaluation plan ↓ independent evaluation lanes deterministic proof/reference held-out origin groups counterexample/adversarial lane temporal/future lane shadow/canary lane where safe ↓ metric tamperability + contamination + drift analysis ↓ safe-improvement decision vs admitted baseline ↓ admit | hold | quarantine | reject | resource_limited ↓ post-admission drift/violation monitoring ↓ suspend/supersede/retract without rewriting history ``` CITADEL does not add another scheduler or verifier. It defines which evidence #404 promotion may accept and how it must classify uncertainty/contamination. --- # 1. Evaluation evidence is a separate semantic class EPOCH A recorded experiences and promotion receipts, but B requires explicit evidence roles: ```text generation_evidence used to propose the candidate selection_evidence used to tune/rank variants validation_evidence reserved to decide promotion audit_evidence independent hostile checks post_admission_evidence future monitoring ``` The same observation may be retained in history under several relations, but it cannot count as statistically/epistemically independent evidence merely because it has multiple IDs. Conceptual record: ```prolog meta_evidence_use( CandidateId, EvidenceRef, Role, OriginGroup, CausalParents, ExposurePath, IndependenceClass, Time, Provenance). ``` Hard rule: ```text record independence != source independence != causal independence ``` Ten retries, ten mirrors, ten model summaries, or ten derived features from the same underlying outcome do not create ten independent validations. # 2. Candidate exposure closure is first-class Every candidate gets an **exposure closure** describing what could have influenced its content/parameters/selection. Conceptually: ```prolog meta_candidate_exposure( CandidateId, SourceRefs, SemanticRefs, FixtureRefs, MetricRefs, VerifierOutputRefs, AncestorCandidateRefs, ModelOrLearnerRefs, Cut, Provenance). ``` A validation fixture is contaminated for that candidate if its answer/expected result/material derivation is in the candidate's exposure/causal ancestry under the configured independence policy. Important: exact byte duplication is not required for leakage. A paraphrase, derived rule, model-generated summary, prior failed validation message, or previously promoted rule can carry the relevant information. CITADEL therefore treats contamination as a provenance/causal relation, not only text overlap. # 3. Adaptive evaluation has an explicit information budget Dwork et al.'s adaptive-data-analysis result matters directly: repeated adaptive decisions based on one holdout can invalidate naive significance/generalization claims. CITADEL does not require differential privacy for v1, but it adopts the architectural consequence: - a hidden/reserved evaluation cohort is not infinitely reusable; - candidate generators do not receive unlimited per-fixture detail from reserved validation; - if a failed holdout case is exposed for repair, it becomes training/selection evidence for descendants and **must be replaced or reclassified** for later independent validation; - promotion receipts record how many adaptive candidate/evaluation interactions occurred against each cohort; - statistical claims use an evaluation policy that accounts for adaptive reuse/multiple candidate selection, or return `insufficient_independence`. This prevents: ```text candidate_1 fails hidden case H → generator sees exact failure → candidate_2 patches H → same H counted as independent held-out validation ``` H is now training evidence for candidate_2. # 4. Promotion metrics are typed by semantic role and tamper surface No universal `reward` or `fitness` scalar. Conceptual contract: ```prolog meta_metric_contract( MetricId, Role, % hard_guard | proxy_objective | audit | cost | coverage Direction, EvaluatorRef, Inputs, CandidateInfluence, ManipulabilityClass, CalibrationProfile, Version). ``` Roles: - `hard_guard`: invariant violation blocks promotion regardless of average score; - `proxy_objective`: may be optimized, but is explicitly a proxy; - `audit`: deliberately not a direct optimization target where possible; - `cost`: resource/latency/model usage; - `coverage`: evaluation search/fixture completeness, never correctness by itself. Hard Goodhart rule: ```text optimized proxy improvement != intended-objective improvement ``` If the candidate can causally influence a metric's evaluator/input channel, that metric is `tamper_exposed` and cannot be the sole promotion gate. # 5. VERIFY noninterference becomes a learning invariant #384 already owns final task acceptance. B strengthens the learning use of VERIFY: ```text candidate may affect world/project state candidate may NOT redefine the Frozen Spec used to judge that attempt candidate may NOT mutate the trusted verifier/evidence policy used to promote itself candidate-authored tests != independent validation by default ``` A candidate-generated test can be useful *generation/selection evidence*. It becomes independent validation only after a separate trusted policy admits that test without relying on the candidate's assertion of adequacy, and even then the test's provenance remains visible. Verifier/config/spec fingerprints are frozen into each evaluation receipt. A candidate that changes the verifier, benchmark, test oracle or evidence-admission policy invalidates that evaluation lane unless the change itself is separately authorized and a fresh evaluation generation is created. # 6. Hidden evaluator != sufficient evaluator AI Safety Gridworlds' hidden performance function is a useful conceptual separation between observed reward and intended behavior, but secrecy alone is insufficient. CITADEL prefers **orthogonal evaluation channels**: ```text deterministic semantic/proof invariants reference/differential implementation fresh observable-world VERIFY evidence held-out origin groups dedicated Review/Critic counterexamples future temporal holdout / shadow outcomes ``` Different evaluator implementations are not automatically independent if they share the same source oracle/data. # 7. Counterexample search is mandatory for generalization claims For rule/method candidates, promotion includes a typed hostile search obligation: ```prolog meta_counterexample_campaign( CandidateId, TargetAssumptions, Generators, SearchSpaceProfile, Bounds, FoundCounterexamples, Coverage, Receipt). ``` Sources may include: - #386 deterministic critic rules; - negation/boundary/metamorphic fixtures; - source-independent historical cases; - ILP failure constraints; - optional model-generated adversarial candidates, which remain candidate tests until deterministically/observably evaluated. `no counterexample found` under a bounded search means exactly that. It is not a proof of universal correctness unless the declared finite/decidable search space was exhaustive. # 8. Safe-improvement is relative to an admitted baseline For empirical strategy/control candidates, CITADEL requires comparison to an admitted baseline under the same declared task/context distribution. Possible evaluation profiles: ```text deterministic_dominance paired_empirical high_confidence_off_policy robust_baseline_regret shadow_canary ``` Thomas et al. and Petrik/Chow/Ghavamzadeh provide useful precedents for lower-confidence-bound / robust-baseline reasoning when executing a poor policy is costly. CITADEL does **not** claim their RL guarantees automatically transfer to arbitrary expert systems. It adopts the design requirement: ```text insufficient evidence to establish improvement → keep baseline / hold candidate ``` not: ```text best observed candidate so far → promote ``` For deterministic finite symbolic fixtures, promotion can instead be proof/differential based; do not force fake probabilities onto exact checks. # 9. Selection bias and self-fulfilling competence are recorded An admitted strategy changes which tasks it sees, which actions it attempts, which evidence is gathered and therefore what future success statistics look like. Example failure: ```text strategy S avoids hard tasks → observed success rate rises → self-model says S is better → S receives even more easy tasks → apparent competence bootstraps ``` CITADEL records selection policy/context/eligibility for each experience. If candidate A and baseline B were not plausibly evaluated on comparable contexts, the promotion evaluator returns `selection_bias_unresolved` rather than treating raw success rates as causal improvement. Where policy permits, bounded randomized/shadow challenge allocation can provide cleaner evidence. High-risk/effectful exploration remains authority- and safety-gated. # 10. Concept drift creates validity epochs, not memory rewriting Learned rules/strategy profiles are scoped to context and evaluated epochs. Conceptually: ```prolog meta_drift_watch( LearnedObject, ContextSignature, SignalClass, DetectorProfile, BaselineWindow, CurrentWindow, Status, EvidenceRefs, Version). ``` Possible status: ```text stable warning confirmed_drift insufficient_data confounded ``` ADWIN is a strong candidate detector for streaming numeric performance/error signals because it adapts window length and has formal false-positive/false-negative bounds. It is not a universal semantic drift oracle. Hard behavior: ```text confirmed material drift → suspend/quarantine affected admission projection → require reevaluation/re-promotion ``` not: ```text confirmed drift → rewrite old rule/history ``` Bitemporal #402 history preserves what was admitted, when, and under which environment generation. # 11. Contradictory/noisy experience does not become majority truth Experience labels are typed by failure/observation class and provenance. A failed run can mean: - method defect; - plan-instance defect; - stale evidence; - authority denial; - resource exhaustion; - external transient failure; - verifier uncertainty; - genuinely wrong candidate. Therefore: ```text failed episode != negative example for every candidate involved successful episode != positive example for every candidate involved ``` #385 diagnosis evidence determines which learning lanes may treat an outcome as a candidate counterexample. Correlated labels remain grouped by origin/dependence. Contradictory evidence may justify scoped alternatives/defaults rather than a global winner. # 12. Calibration is an empirical property, not trust or truth For empirical selection policies, a confidence score may be calibrated against observed correctness/outcome rates for a declared cohort/version. Guo et al. is useful evidence that raw model confidence can be poorly calibrated and post-hoc calibration can improve probability estimates. The architectural consequence is: ```text raw confidence != calibrated probability calibrated probability != epistemic warrant calibrated probability != authority ``` Calibration has a domain/time/profile fingerprint and must be re-evaluated under drift. # 13. Self-models are advisory and non-authoritative EPOCH's self-model may record: ```text coverage success/failure by task class resource distributions known unsupported regions recent drift calibration strategy availability ``` But a self-model cannot: - grant capabilities; - widen authority; - weaken VERIFY; - lower its own promotion threshold; - mark evidence independent; - suppress counterexample obligations; - change Frozen Spec; - promote its own updater. A self-model observation can influence *which strategy to try*. It cannot define what counts as successful evidence for that strategy. # 14. Catastrophic violations are not averaged away Promotion policies may declare hard zero-tolerance classes: ```text authority escalation Frozen-Spec mutation verifier/evaluator tampering unsafe effect outside admitted scope proven provenance leakage replay-integrity violation unbounded resource/cancellation violation ``` One such violation may quarantine a candidate even if average quality improves. This is different from ordinary stochastic task failure. # 15. Promotion lifecycle is refined Recommended B lifecycle: ```text proposed schema_validated exposure_frozen contamination_checked retrospectively_evaluated counterexample_checked independent_validation_pending shadow_validated canary_validated % when appropriate promotion_ready admitted hold quarantined suspended_on_drift deprecated superseded retracted ``` Not every candidate class uses all stages, but `admitted` must never be reachable without the required evidence roles and independence checks for its risk class. # 16. Typed promotion receipt Conceptual form: ```prolog meta_promotion_receipt( ReceiptId, CandidateId, CandidateVersion, PolicyId, BaselineRef, ExposureClosureRef, EvaluationPlanRef, EvidencePartitions, ContaminationFindings, CounterexampleReceipt, MetricReceipts, ImprovementEvidence, DriftStatus, HardGuardResults, CalibrationRef, Decision, Limitations, DecidedAt, Provenance). ``` The receipt explains both *why promotion happened* and *what the evidence does not establish*. --- # Complexity / performance / scaling implications CITADEL adds real cost; it is intentionally not free. ## Exposure/lineage checking Exact candidate/evidence contamination checking is graph reachability over provenance/derivation/exposure edges. With indexed ancestry and immutable digests, ordinary checks are proportional to the demanded reachable lineage rather than the whole ledger. Worst-case ancestry can approach total history. Use #402 shared provenance DAGs, source-dependence components and generation fingerprints. Do not duplicate entire provenance trees per candidate. ## Counterexample search Generally combinatorial/undecidable for open rule languages. Every campaign declares: ```text search profile space restrictions time/work/memory bound coverage status ``` Exhaustive claims are legal only for a declared finite/decidable fragment where exhaustive completion is proven. ## Adaptive holdout Maintaining fresh independent cohorts costs data. Candidate search cannot consume an unlimited sequence of free validation queries. D must choose practical cohort-rotation/reveal-budget mechanics. ## Drift Streaming detectors such as ADWIN can be sublinear-memory summaries; semantic-context drift may require heavier structured checks. Drift monitoring is a trigger for reevaluation, not proof of a new rule. ## Strategy evaluation High-confidence/off-policy estimators may have high variance and need substantial data; robust safe-improvement formulations can be computationally hard. Return `insufficient_evidence`/`resource_limited` instead of manufacturing confidence. --- # Epistemic / provenance implications CITADEL adds new provenance classes that must remain independent of #400 epistemic warrant: ```text experience provenance candidate-generation provenance candidate-exposure provenance evaluation/validation provenance metric/evaluator provenance promotion-decision provenance post-admission monitoring provenance ``` A promotion receipt is operational/control knowledge. It does not make the learned proposition a source-explicit fact. For a learned rule, explanations should answer: ```text What experiences generated this candidate? Which of those were correlated? Which evidence was reserved and independent? What did the candidate/generator already see? Which verifier/metric versions were used? What counterexamples were sought/found? What baseline was compared? Was improvement deterministic or statistical? What drift/calibration scope applies? What would suspend this rule? ``` # Safety / authority implications Hard B invariants: ```text candidate data != executable code candidate score != authority promotion != capability grant self-model competence != authority success rate != permission verifier pass != independent validation candidate-authored test != independent oracle hidden benchmark != universal correctness no counterexample found != no counterexample exists confidence != epistemic truth calibration != trust metric optimization != intended-goal optimization ``` Promotion may change which **already-authorized** semantic/control knowledge is selected. It may not enlarge the host's capability/authority envelope. --- # Adversarial review / failure cases B explicitly rejects the following attacks/failures: 1. **Experience poisoning:** malicious source injects many fabricated successful episodes. 2. **Echo amplification:** same upstream episode mirrored into many memories appears as independent validation. 3. **Validation laundering:** a failed holdout is revealed, patched, then counted again as unseen evidence. 4. **Fixture memorization:** candidate directly keys on benchmark IDs/text. 5. **Derived leakage:** benchmark answer reaches candidate through summary/rule/vector/case lineage rather than exact text. 6. **Reward hacking:** proxy metric improves while gold/independent quality falls. 7. **Verifier tampering:** candidate changes tests/evaluator/spec or routes around them. 8. **Verifier gaming:** candidate exploits a checker blind spot while remaining semantically wrong. 9. **Task-selection gaming:** strategy avoids difficult cases and reports improved success. 10. **Selective evidence acquisition:** strategy gathers only observations likely to support itself. 11. **Self-model bootstrap:** higher self-score causes easier routing and more apparent success. 12. **Correlated model judges:** multiple evaluator calls to same model/source counted as independent agreement. 13. **Noisy outcome mislabel:** authority/resource failure becomes negative example for procedural rule. 14. **Concept drift:** once-good rule remains active after environment/API/ontology changes. 15. **Catastrophe averaging:** one authority violation hidden by 999 successful trials. 16. **Adaptive p-hacking:** thousands of candidate variants searched until one passes a fixed threshold by chance. 17. **Metric-policy mutation:** candidate learns to change what metrics are reported. 18. **Calibration laundering:** calibrated score from old domain/version reused after shift. 19. **Shadow-to-live mismatch:** safe shadow performance assumes effects/feedback absent in production. 20. **Counterexample suppression:** candidate influences retrieval so adverse cases never enter the evaluator. 21. **Review collusion:** learned Review strategy becomes less likely to surface flaws in preferred candidate family. 22. **Ancestor contamination:** child candidate inherits information from parent that saw reserved evidence. 23. **Temporal leakage:** future result accidentally available when evaluating historical decision quality. 24. **Identity leakage:** aliases/near-duplicates split across IDs defeat holdout grouping. --- # Rejected shortcuts - **One scalar confidence/reward:** destroys semantics and invites Goodhart optimization. - **Majority vote of experiences:** ignores source dependence, task selection and failure class. - **More evaluator/model votes:** not independent if they share source/model/training lineage. - **Just hide the tests:** adaptive feedback still leaks; secrecy is not a proof. - **Always retrain on latest window:** can chase noise and silently forget previously valid domains. - **Automatic promotion after N successes:** N correlated/manipulated successes prove little. - **Automatic demotion after one ordinary failure:** some failures are external/authority/resource/context issues. - **Let candidate tune promotion policy:** direct self-approval loop. - **Treat VERIFY as a reward function:** VERIFY is task acceptance under an exact Frozen Spec, not a universal reusable-strategy utility signal. - **Treat Review findings as labels automatically:** Review can be uncertain or wrong and still needs provenance/grounding. - **Assume statistical CI = safety:** confidence bounds are only as good as their sampling/independence assumptions. --- # Falsifiable B conformance fixtures At minimum implement/prove these later; design IDs B1-B40: 1. **B1 candidate_self_success_not_rule** — one verified success cannot auto-admit a universal rule. 2. **B2 source_copy_independence** — 10 copies of one episode count as one origin group. 3. **B3 retry_independence** — repeated retries of same state are not independent validations. 4. **B4 holdout_reveal_reclassifies** — exposed failed holdout becomes training/selection evidence for descendants. 5. **B5 descendant_contamination** — child candidate inherits parent exposure closure. 6. **B6 paraphrase_leakage** — semantically derived/paraphrased holdout content triggers contamination even without byte match. 7. **B7 future_leakage** — evidence known after decision time cannot validate historical policy as if known then. 8. **B8 identity_group_leakage** — aliased versions of same entity/case remain one evaluation origin when appropriate. 9. **B9 proxy_goodhart** — proxy score rises while independent gold fixture quality falls; promotion rejected/quarantined. 10. **B10 tamper_exposed_metric** — candidate-influence on evaluator inputs prevents sole-gate use. 11. **B11 verifier_fingerprint_change** — verifier/spec change mid-evaluation invalidates receipt generation. 12. **B12 candidate_authored_test** — self-generated test is not independent validation by default. 13. **B13 hidden_test_overfit_budget** — repeated adaptive holdout queries exhaust/reclassify validation budget. 14. **B14 hard_guard_dominates_average** — authority violation blocks promotion despite higher mean quality. 15. **B15 baseline_insufficient_evidence** — no defensible improvement vs baseline => hold, not promote. 16. **B16 deterministic_dominance** — finite exact candidate can promote from exhaustive deterministic conformance without fake probabilities. 17. **B17 counterexample_bounded_honesty** — bounded search returns `no_counterexample_within(bounds)` not universal truth. 18. **B18 exhaustive_fragment_proof** — declared finite complete search may produce stronger exhaustive receipt. 19. **B19 task_selection_bias** — candidate evaluated only on easier routed tasks cannot claim general improvement. 20. **B20 selective_observation_bias** — candidate cannot suppress opposing evidence acquisition and claim completeness. 21. **B21 authority_failure_not_negative_rule_example** — blocked authority does not train semantic/procedural rule as wrong. 22. **B22 resource_failure_not_negative_rule_example** — timeout/resource limit preserves ambiguous causal label. 23. **B23 diagnosis_targets_learning_label** — #385-supported diagnosis can attach a failure to the correct candidate component with provenance. 24. **B24 contradictory_lessons** — two context-specific contradictory lessons remain scoped alternatives/defaults rather than last-write winner. 25. **B25 drift_suspends_current_admission** — confirmed material drift suspends current use without deleting historical admission. 26. **B26 old_calibration_rejected_after_drift** — calibration profile cannot silently cross changed context/version. 27. **B27 self_model_no_authority** — competence estimate cannot widen capability/authority or lower promotion gate. 28. **B28 self_model_no_evidence_independence** — self-model cannot mark its own supporting experience independent. 29. **B29 review_finding_not_truth** — Review candidate finding alone neither promotes nor retracts a rule. 30. **B30 correlated_judges** — repeated outputs sharing evaluator/model/source lineage do not become independent votes. 31. **B31 adaptive_candidate_multiplicity** — search over many candidate variants records adaptive-selection count/evaluation policy. 32. **B32 shadow_live_difference** — shadow-only evidence cannot establish live-effect safety when feedback/effect semantics differ. 33. **B33 canary_blast_radius** — high-risk candidate cannot expand canary scope outside trusted policy. 34. **B34 quarantine_on_tampering** — attempted verifier/evaluator/promotion-policy tampering yields quarantine. 35. **B35 rollback_append_only** — drift/counterexample suspends/supersedes without rewriting original promotion receipt. 36. **B36 exact_historical_replay** — historical run resolves exact learned-object/evaluator/policy versions it used. 37. **B37 provider_disabled_validation** — known symbolic candidate validation/promotion works with providers disabled and `model_calls = 0`. 38. **B38 optional_model_counterexample_is_candidate_only** — model-generated hostile case is inert until checked by trusted semantics/evidence. 39. **B39 metric_vector_not_scalarized_by_candidate** — candidate cannot choose weights that trade away hard safety constraints. 40. **B40 promotion_policy_self_reference** — candidate/promotion object cannot modify or select a weaker policy governing itself. --- # Canonical issue changes required by B ## #404 Adopt CITADEL-EPOCH as the B refinement over EPOCH. Mark **A+B COMPLETE / C NEXT**. C must focus on interoperability/federation between heterogeneous learners, validators, promotion authorities, stores and organizational/domain boundaries without flattening their evidence semantics. ## #397 Depth 7 becomes **A+B COMPLETE / C NEXT**. #404C only is authorized after this B persistence; #405 remains blocked. ## #384 VERIFY Expert Add learning-specific noninterference requirements: - verifier/Frozen-Spec/evidence-policy fingerprint frozen per evaluation generation; - candidate-authored verifier/test changes are not independent validation by default; - candidate cannot manipulate VERIFY and then cite resulting success for its own promotion; - fresh independent observation remains the acceptance boundary. ## #385 Repair/Diagnosis Expert Learning labels must consume diagnosis/failure class. A failed attempt is not automatically a negative example for every implicated rule/method/strategy. Preserve causal attribution uncertainty. ## #386 Review/Critic Expert Add candidate-independent adversarial counterexample campaigns and explicit status that Review-generated findings/tests are candidate evidence until grounded; Review cannot self-promote learned review policy. ## #377/#379/#381 Learned operational statistics and self-models may influence selection only as typed advisory/control evidence. They may not change truth, authority, obligations or VERIFY. Strategy routing must preserve selection-policy/context lineage so #404 can detect self-selection bias. ## #392/#394/#395 Learned candidate/admission/evaluation status remains separate from source truth and epistemic warrant. #395 should add contamination/Goodhart/drift/promotion conformance classes, especially provenance-grouped splits and candidate-exposure leakage. ## symbolic-memory #6 Persist immutable experience, candidate exposure, evidence-use roles/origin groups, metric/evaluator versions, promotion/quarantine/suspension/supersession receipts and drift/calibration lineage. These are semantic/control history, not one mutable confidence field. ## symbolic-memory #7 Query/explanation must expose learned-object status, applicability epoch/scope, evidence independence/contamination findings, baseline/evaluation profile, counterexamples, calibration/drift and promotion limitations. ## symbolic-memory #9 Native/MCP transport must not flatten to `learned=true`, `confidence=N`, or `promoted=true`; preserve candidate/admitted/quarantined/suspended and evidence limitations. No transport caller may mark evidence independent merely by assertion. ## symbolic-memory #10 Identity/source reconciliation must participate in evaluation-origin grouping: aliases, mirrors, same-event references and derived copies cannot defeat contamination/source-dependence checks by receiving new IDs. --- # Repository ownership boundary **prolog-rlm owns:** - EPOCH/CITADEL candidate/evidence-role schemas; - promotion-policy semantics; - exposure/contamination logic over supplied provenance; - counterexample campaign contract; - metric role/tamperability semantics; - deterministic/statistical evaluation profile contracts; - interaction with #377/#379/#381/#384/#385/#386; - zero-model conformance for symbolic candidate validation. **symbolic-memory owns:** - durable experience/candidate/evaluation/promotion history; - bitemporal admission/suspension/supersession; - scalable provenance/exposure/origin-group indexes; - drift/calibration histories; - query/explanation surfaces; - cross-memory identity/source-dependence needed for contamination checks. **Host/trusted configuration owns:** - promotion policy registration/version; - hidden/reserved evaluation material and reveal policy; - hard-guard classes; - capability/authority ceilings; - verifier bindings; - canary/live blast-radius policy. A learned object may reference these; it cannot redefine them. --- # Unresolved questions reserved for C 1. How do promotion/evidence semantics compose across separate projects/memories/organizations with different trust and privacy boundaries? 2. How can one system consume another system's learned rule without inheriting false claims of independent validation? 3. How are evaluation-origin groups reconciled across federated ledgers without leaking private identities/content? 4. How should different learning formalisms exchange candidate/evidence/coverage semantics: EBG, ILP, case learning, online/bandit policy, statistical learner, model-derived candidate? 5. How do heterogeneous verifier guarantees compose or fail to compose? 6. Can independently governed promotion authorities disagree while preserving both statuses? 7. How should a portable learned procedure distinguish semantic admission from local execution admission? 8. How are drift/calibration scopes translated between environments? 9. How do we transfer a candidate when the target environment lacks the source's hidden evaluation set or baseline? 10. How should external learned objects arrive: admitted, candidate, quarantined, or evidence-only by default? # Unresolved questions reserved for D - incremental exposure-closure/index algorithms at very large scale; - practical adaptive-holdout/reveal budgeting; - sequential/multiple-testing correction profile selection; - deterministic counterexample enumeration for admitted fragments; - high-confidence/off-policy estimator library choices; - drift detector portfolio and false-alarm budgets; - rolling calibration implementation; - promotion-cache invalidation; - crash-safe promotion/quarantine transitions; - concurrency determinism; - million/billion-experience scaling; - differential `cold == warm == rebuilt == incremental` conformance for promotion decisions. --- # B completion statement **#404B is design-complete only.** It does not prove any self-improving implementation exists, and it does not satisfy the Machine Spirit executable bar. Surviving Depth-7 architecture after A+B: ```text A / EPOCH experience → typed candidate → controlled promotion lifecycle ↓ B / CITADEL-EPOCH exposure/provenance isolation + adaptive-evaluation control + metric tamperability + safe-baseline comparison + counterexample obligations + drift/calibration/self-model firewalls ↓ learned reusable knowledge may become operationally admitted but never self-authorized ``` **Exact next subpass: #404C — composition / heterogeneity / interoperability of learning, validation, promotion and self-model evidence.** Do not start #404D or #405 until #404C is durably complete.
Author
Owner

Machine Spirit #404C — composition / heterogeneity / interoperability

Status: C COMPLETE — D NEXT.

This subpass treats learned-rule/strategy portability as an interchange and transfer-validity problem, not as replication of admitted=true across systems.

Research questions / scope

  1. What exactly may cross a project/memory/organization boundary: payload, proof/explanation, empirical evidence, promotion receipt, status, calibration, authority, or some subset?
  2. How do EBG, ILP, case/procedural abstraction, statistical/online control policies, model-derived candidates and expert compositions share an envelope without pretending their guarantees are identical?
  3. When does validation on source environment A say anything defensible about target environment B?
  4. How are source/evidence-dependence groups reconciled across federated ledgers without exposing private fixture/source identities?
  5. How do multiple validators/promotion authorities compose when their policies, risk classes, verifier contracts and trust roots differ?
  6. How should drift/calibration scopes move across domains or time epochs?
  7. What is the safe default for an external learned object when the target cannot reproduce source evidence?
  8. How do portable semantic procedures remain separate from target-local host binding, capability and authority?

Primary evidence

Primary/authoritative sources used in this pass:

  • Ben-David, Blitzer, Crammer, Kulesza, Pereira & Wortman Vaughan, A theory of learning from different domains, Machine Learning 79, 2010. DOI 10.1007/s10994-009-5152-4. The target-error bound depends on source error, source/target divergence, and the existence/error of a hypothesis good for both domains: source success alone is not a target guarantee. https://link.springer.com/article/10.1007/s10994-009-5152-4
  • Mansour, Mohri & Rostamizadeh, Domain Adaptation with Multiple Sources, NIPS 2008 / proceedings 2009. Multiple sources require an explicit adaptation construction; plurality of source hypotheses is not itself a target-validity proof. https://proceedings.neurips.cc/paper/2008/hash/0e65972dce68dad4d52d063967f0a705-Abstract.html
  • Mansour, Mohri & Rostamizadeh, Domain Adaptation: Learning Bounds and Algorithms, COLT 2009. https://arxiv.org/abs/0902.3430
  • Quiñonero-Candela et al. (eds.), Dataset Shift in Machine Learning, MIT Press, 2009. The training/test joint distribution can differ through several shift mechanisms; validity is conditional on the operating distribution/assumptions. https://direct.mit.edu/books/edited-volume/3841/Dataset-Shift-in-Machine-Learning
  • W3C, PROV-DM: The PROV Data Model, Recommendation, 30 Apr 2013. Provides explicit entities, activities, agents, derivations, usage/generation and provenance bundles for interoperable provenance rather than one opaque trust score. https://www.w3.org/TR/prov-dm/
  • W3C, PROV-O, Recommendation, 30 Apr 2013. Provides an extensible interoperable provenance ontology. https://www.w3.org/TR/prov-o/
  • Torres-Arias et al., in-toto: Providing farm-to-table guarantees for bits and bytes, USENIX Security 2019. Demonstrates signed/verified attestations of how an artifact was produced without treating the artifact metadata itself as universal semantic truth. https://www.usenix.org/conference/usenixsecurity19/presentation/torres-arias
  • in-toto Attestation Framework, current specification/repository. Its Statement + typed Predicate structure is a useful precedent for a small stable envelope carrying domain-specific attestations. https://github.com/in-toto/attestation
  • SLSA v1.2 specification, current as retrieved 2026-09-06. Provenance describes where/how an artifact was produced under explicit provenance requirements; it does not make all downstream use valid. https://slsa.dev/spec/v1.2/
  • Mitchell et al., Model Cards for Model Reporting, FAT* 2019. Intended uses, evaluation conditions and performance characteristics must travel with a learned artifact rather than one context-free quality number. https://dl.acm.org/doi/10.1145/3287560.3287596
  • Gebru et al., Datasheets for Datasets, CACM 2021. Dataset composition, collection and intended-use documentation are necessary transfer context. https://dl.acm.org/doi/10.1145/3458723
  • NIST, AI Risk Management Framework 1.0, 2023. TEVV is lifecycle- and operational-context-sensitive; target-context validity cannot be inferred from a detached source score. https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf

These sources support a common conclusion: portable provenance/attestation is feasible; portable validity is conditional. Domain-adaptation theory makes the condition explicit mathematically, while provenance/attestation standards show how claims can move without becoming ambient trust.

Candidate architectures

Candidate 1 — global learned-object registry with universal status

Replicate {payload, status=admitted, confidence=.93} into every memory and let all hosts consume the same status.

Strengths: simple UX, easy dedup/federation.

Rejected. It launders source promotion authority, evaluation conditions, source dependence, drift scope and calibration into unrelated targets. admitted has no context-free meaning.

Candidate 2 — copy payload only; discard all source evaluation metadata

External rules/procedures arrive as fresh local candidates with no inherited evidence.

Strengths: safe and conceptually simple; no validation laundering.

Rejected as the full design. It throws away useful provenance, counterexamples, source assumptions, verifier receipts, failure history, applicability scopes and evidence that can cheaply guide target validation. It also makes independent-origin reasoning impossible.

Candidate 3 — federated consensus / majority promotion

If enough memories or organizations admit the same candidate, consider it admitted globally.

Rejected. Replica/source dependence and shared training/evaluation lineage can make ten approvals one causal origin. Different authorities can also have incompatible policies or environments. Vote count is not target validity.

Preferred — PACT-EPOCH: Provenance-Attested Cross-Trust Learning Interchange for EPOCH

source EPOCH/CITADEL learned object
        ↓
Learning Artifact Contract (LAC)
 payload + semantics + provenance + source admission attestation
        ↓
loss-aware semantic/profile translation
        ↓
target import state
 foreign_candidate / evidence_only / quarantined / incompatible
        ↓
source/target context + dependence + drift comparison
        ↓
target validation obligations
 exact reuse | bounded transfer check | full local revalidation
        ↓
TARGET promotion policy
        ↓
locally admitted object/version
        ↓
local expert/procedure/retrieval selection
        ↓
local binding/capability/authority admission

The central invariant is:

portable learned payload      != portable promotion status
source admission attestation  != target admission
source calibration            != target calibration
source safety result          != target safety result
same rule fingerprint         != same applicability domain
same validator name           != same validator semantics
multiple approving systems    != independent validation origins
semantic procedure portability != target executable binding/authority

1. Learning Artifact Contract (LAC)

Define a versioned typed interchange object rather than flattening all learners to one rule schema.

Conceptual shape:

meta_learning_artifact(
    ArtifactId,
    Kind,                  % ebg_rule | ilp_rule | case | method | control_policy | expert_composition | mapping
    PayloadRef,
    SemanticProfile,
    LearnerContract,
    ApplicabilityScope,
    Assumptions,
    SourceEnvironment,
    OriginRefs,
    ExposureSummary,
    EvidenceUseSummary,
    EvaluationAttestations,
    PromotionAttestations,
    DriftCalibrationScope,
    Compatibility,
    Provenance,
    Version).

Learner-specific payload/guarantee information remains typed:

EBG: explanation/theory dependencies + operationality conditions
ILP: hypothesis language + background theory + +/-/context example policy + noise/search bounds
case: situation/goal/action/adaptation/outcome + VERIFY lineage
control policy: task distribution + baseline + metric/evaluator contract + statistical evidence
expert composition: goal contracts + component/version requirements + no executable handlers
model-derived candidate: model/provider/run provenance + candidate status only

A common envelope is therefore not a common guarantee.

2. Attestations are claims, not imported truth

Use an in-toto/SLSA-like pattern:

meta_learning_attestation(
    SubjectArtifact,
    PredicateType,
    PredicatePayload,
    Issuer,
    TrustDomain,
    IssuedAt,
    SignatureOrIntegrityRef,
    Provenance).

Example predicate types:

source_promotion_receipt
source_counterexample_campaign
source_verify_receipt
source_calibration_report
source_drift_epoch
source_dependence_statement
source_policy_profile

A valid signature proves who made the claim and artifact integrity, not that the proposition is universally true.

Target policy decides which issuers/predicates are admissible evidence and at what strength.

3. Target admission always has a local state

Default import mapping:

source admitted            -> target foreign_candidate
source promotion_ready     -> target foreign_candidate
source proposed            -> target foreign_candidate
source quarantined         -> target quarantined
source suspended/retracted -> target quarantined/evidence_only by policy
unknown/incompatible LAC   -> target incompatible

A target may record:

admitted_by(source_authority, SourceReceipt)

as provenance, but that is distinct from:

locally_admitted(TargetPolicy, TargetReceipt)

Only the latter affects ordinary target control selection.

A narrowly configured same-trust-domain optimization may reuse prior validation when all material fingerprints and declared applicability/environment assumptions are equivalent and target policy explicitly permits it. The optimization is an explicit proof/receipt, never name-based trust inheritance.

4. Validation guarantees use a non-strengthening algebra

Every imported guarantee carries scope and assumptions.

Conceptual status transformation:

preserved      % target proves source assumptions/evaluator semantics equivalent
translated     % mapping is semantics-preserving under named proof/profile
weakened       % only a subset of source guarantee survives
invalidated    % target violates a required assumption
unknown        % insufficient evidence
noncomposable  % guarantees use incompatible semantics

Bridge operations may preserve or weaken a source guarantee. They may not strengthen it without new target evidence.

Examples:

source exact finite proof + identical theory/profile
    -> may preserve proof result after replay/fingerprint validation

source 95% calibration on environment A
    -> unknown/weakened on shifted environment B until target calibration evidence

source method passed verifier V1
    + target verifier V2 with stricter obligations
    -> source receipt is evidence_only; V2 obligations remain

source EBG rule whose explanation uses ontology O1
    + target maps O1 -> O2 lossily
    -> explanation guarantee weakened/noncomposable

5. Domain transfer is an explicit obligation

Ben-David-style domain-adaptation bounds motivate the correct qualitative contract:

target performance
  depends on source performance
  + source/target divergence
  + existence/error of a rule/hypothesis suitable for both

Machine Spirit should not pretend it can estimate every term universally. Instead an imported candidate declares a transfer profile:

meta_transfer_assessment(
    Artifact,
    SourceEnvironment,
    TargetEnvironment,
    ComparedDimensions,
    ShiftEvidence,
    AssumptionChecks,
    RequiredTargetEvidence,
    Status,
    Receipt).

Relevant dimensions can include schema/vocabulary, task/goal distribution, project/runtime version, data/source populations, authority policy, resource envelope, verifier semantics, platform, dependencies, temporal epoch and failure modes.

If target overlap/equivalence cannot be established, the safe result is requires_local_validation, not probably_portable.

6. Multi-source learning does not become vote counting

When several foreign memories provide related learned objects, preserve source-specific hypotheses and provenance. Composition may:

union candidates
compare assumptions
identify exact-equivalent payloads
identify conflicting payloads
construct target validation portfolio
weight/select sources under an explicit transfer algorithm/profile

Do not automatically majority-vote promotion statuses or average incomparable quality metrics.

Mansour/Mohri/Rostamizadeh multi-source adaptation is useful precisely because it treats source combination as an adaptation problem with assumptions, not as n approvals => truth.

7. Cross-ledger evidence dependence is privacy-aware but conservative

CITADEL requires causal/source independence; CLFM says ledgers are independent order/authority domains. Cross-domain interchange therefore needs an origin/dependence interface that does not require dumping private source identities.

Conceptual public claim:

meta_dependence_claim(
    ArtifactOrEvidence,
    OpaqueOriginClass,
    Relation,             % same_origin | derived_from | overlaps | asserted_disjoint | unknown
    Scope,
    Issuer,
    ProofOrAttestation,
    DisclosureClass).

Rules:

  • exact public origin IDs may be used where disclosure is safe;
  • otherwise use opaque trust-domain origin classes/commitments;
  • source assertions of disjointness are claims, not automatically local facts;
  • if privacy prevents establishing disjointness, do not count the records as independent;
  • optional future PSI/cryptographic-set-intersection mechanisms may prove overlap without revealing full sets, but are not required for v1 semantics.

Conservative failure is preferable to validation laundering.

8. Promotion authorities remain namespaced

Represent:

Authority A admitted R under policy PA
Authority B rejected R under policy PB

without selecting an ambient winner.

A target policy may explicitly trust one authority, require local validation, require multiple named authorities, or forbid external promotion evidence for a risk class.

Conflicting authority receipts are durable plural evidence. They never become one synthesized confidence number.

9. Procedure/expert portability stops before execution admission

Portable semantic method/procedure:

LAC procedure payload
   -> #401 PSC/PIFF compatibility
   -> target semantic/profile mapping
   -> target DPEC projection
   -> #377 expert availability
   -> local capability/authority/resource checks
   -> #288 execution

Therefore:

source procedure admitted != target procedure compatible
compatible != bound
bound != currently admissible
currently admissible != executed

A foreign expert composition imports only declarative goal/component contracts. It cannot import handlers, shell commands, credentials, capabilities or authority.

10. Calibration and drift are scoped artifacts

A calibration result must name:

candidate/version
environment/task distribution
time/epoch
metric definition
sampling/evaluation process
uncertainty/coverage method

Moving it across any of those dimensions creates a transfer obligation. Under distribution shift, nominal calibration/coverage need not survive; recent conformal work continues to require explicit assumptions or correction for covariate/general shift.

Target monitoring creates a new local calibration/drift lineage rather than mutating the source report.

11. Repository ownership

prolog-rlm owns

  • LAC schema and validation;
  • learner-kind contracts;
  • transfer/guarantee algebra;
  • target promotion semantics;
  • evaluator/verifier compatibility rules;
  • #377/#379/#381 consumption semantics;
  • #395 deterministic interoperability/conformance fixtures.

symbolic-memory owns

  • durable LAC/attestation/import/export history;
  • source/local promotion states side by side;
  • CLFM federation references/cuts;
  • opaque origin/dependence classes and disclosure policy metadata;
  • durable drift/calibration epochs;
  • query/projection of learning provenance;
  • identity/ontology mappings used by transfer assessments.

Dependency remains symbolic-memory -> prolog-rlm. Symbolic Memory stores portable learning artifacts and their history; Prolog-RLM defines/validates their semantics and decides target-local admission.

existing expert/runtime layer owns

No new scheduler or authority plane. #288 remains scheduler; #384 remains exact requirement acceptance boundary; ordinary capability/effect checks remain authoritative.

Complexity / performance / scaling

  • LAC validation is linear in envelope/payload metadata size plus profile-specific validation.
  • Provenance/exposure/dependence closure is graph-reachability work over selected evidence; global closure may be huge, so C requires bounded/demanded expansion and compact dependence summaries, with exact backing refs retained.
  • Cross-domain semantic mapping can be combinatorial when multiple ontology/profile mappings compete; preserve bounded alternatives or noncomposable/resource_limited rather than first-map wins.
  • Transfer evaluation cost is candidate × target-evaluation profile; source receipts may prune unnecessary work only when their guarantees actually survive the bridge.
  • Multi-source portfolios can grow with sources × candidates × mappings; exact-equivalent artifact fingerprints and provenance DAG sharing can deduplicate representation without collapsing independent source episodes.
  • Privacy-preserving overlap proof is optional and may be expensive; inability to prove independence simply prevents counting evidence as independent.
  • Imported empirical statistics are never merged by raw averaging unless metric definitions, populations and aggregation assumptions are compatible under an explicit profile.

D owns concrete indexing, cache keys, incremental invalidation, attestation verification cost, large-scale overlap/dependence structures and deterministic concurrent import/evaluation execution.

Epistemic / provenance implications

PACT-EPOCH adds a sixth important provenance concern on top of semantic/source/logical/lifecycle/runtime provenance: learning-transfer provenance.

A target explanation must be able to answer:

Where was this rule learned?
Which learner/formalism produced it?
Which evidence was generation vs validation evidence?
Which source authority admitted it?
Which source guarantee survived transfer, weakened, or failed?
Which target-local evidence caused admission?
Which identity/ontology mappings did transfer depend on?
Was evidence independence proven, asserted, unknown, or impossible to disclose?
What drift/calibration epoch applies here?

No imported confidence, approval count or signature substitutes for these answers.

Safety / authority implications

Hard invariants:

signed learned artifact != true artifact
trusted issuer != target-valid semantics
source admission != target admission
source capability != target capability
foreign expert composition != executable handler
foreign policy text != host policy
identity mapping != principal mapping
ontology compatibility != execution compatibility

External artifacts cannot mutate target promotion policy, verifier policy, Frozen Spec, read/egress policy, expert registry, host bindings or authority.

High-risk target classes may require entirely local validation regardless of external receipts.

Adversarial review / failure cases

  1. Source marks admitted; target blindly activates it.
  2. Two organizations use the same verifier name with different semantics.
  3. Source and target share fixture copies but label them independent.
  4. Ten federation replicas masquerade as ten promotion authorities.
  5. Two authorities both derive evidence from one upstream benchmark.
  6. Private provenance prevents overlap check; target assumes independence anyway.
  7. Ontology mapping changes a guard from must to should but preserves status.
  8. Unit/version mapping changes numeric applicability.
  9. Source EBG explanation depends on a theory absent in target.
  10. ILP rule transfers but target background theory changes its consequences.
  11. Case transfers between incompatible runtime/platform versions.
  12. Statistical control policy transfers under severe task-distribution shift.
  13. Source calibration report is reused after target drift.
  14. Source verifier omits a target hard guard.
  15. Source authority is cryptographically authentic but policy-untrusted.
  16. Source promotion policy itself was later retracted.
  17. Foreign object contains executable-looking Prolog/handler IDs.
  18. Imported expert composition names a local high-authority expert by lexical coincidence.
  19. Multiple source scores with different metrics are averaged.
  20. Mapping ambiguity is collapsed to the highest-confidence mapping.
  21. Target learns from source validation cases, then still counts source receipt as untouched validation.
  22. Foreign quarantine/retraction is dropped during export.
  23. Import cache survives source retraction/drift generation.
  24. Target writes admitted=true into canonical payload, losing authority namespace.
  25. Cross-memory identity merge causes unrelated project's evidence to become source-independent corroboration.
  26. Source and target clocks differ; a stale calibration epoch appears current.
  27. External redaction removes evidence needed to reproduce a source guarantee but status remains unchanged.
  28. Source LAC translator strips unsupported assumptions.

Rejected alternatives

  • universal cross-memory confidence: incomparable and launders semantics;
  • global promotion authority: destroys local policy/target context;
  • majority approval: ignores causal/source dependence and policy heterogeneity;
  • payload-only exchange: too much provenance/negative evidence is lost;
  • automatically trusting signed artifacts: integrity/authentication is not semantic validity;
  • forced universal learner representation: EBG/ILP/case/statistical guarantees are materially different;
  • automatic target execution of portable procedures: violates DPEC/capability/authority boundaries;
  • raw global origin IDs as mandatory interoperability: unnecessary privacy leak;
  • assume independence when provenance is hidden: unsafe; use unknown;
  • translate every foreign metric into one normalized score: invalid without a calibrated mapping.

Falsifiable #404C conformance fixtures

C1. source_admitted_imports_as_foreign_candidate_not_local_admitted.
C2. source_promotion_attestation_preserved_without_target_activation.
C3. source_quarantine_cannot_import_as_clean_candidate.
C4. source_retraction_invalidates_target_transfer_assumption.
C5. signed_attestation_authenticates_issuer_not_semantic_truth.
C6. unknown_issuer_policy_does_not_grant_validation_strength.
C7. same_verifier_name_different_fingerprint_is_non_equivalent.
C8. stricter_target_verifier_requires_target_validation.
C9. exact_finite_proof_replays_under_identical_theory_profile.
C10. lossy_ontology_mapping_weakens_or_invalidates_guarantee.
C11. ambiguous_mapping_remains_alternative_or_noncomposable.
C12. ebg_dependency_missing_in_target_blocks_preserved_guarantee.
C13. ilp_background_theory_change_requires_revalidation.
C14. case_platform_mismatch_requires_target_applicability_check.
C15. statistical_policy_distribution_shift_drops_source_calibration_claim.
C16. source_calibration_epoch_does_not_become_target_current_epoch.
C17. target_drift_creates_local_suspension_without_rewriting_source_history.
C18. replicas_do_not_count_as_independent_promotion_authorities.
C19. same_upstream_benchmark_collapses_dependence_across_organizations.
C20. privacy_hidden_origin_defaults_to_independence_unknown_not_independent.
C21. opaque_origin_commitments_can_signal_same_origin_without_raw_source_disclosure.
C22. unverified_disjointness_claim_does_not_count_as proven independence.
C23. two_conflicting_promotion_authorities_remain_plural_evidence.
C24. target_policy_can_require_local_validation_despite trusted source.
C25. foreign_expert_composition_imports_no_handler_or_authority.
C26. foreign_semantic_action_remains_inert_until local DPEC/binding admission.
C27. same_expert_name_cannot_rebind_principal_or_authority.
C28. metric_vectors_with_incompatible_definitions_are_not_averaged.
C29. source_validation_exposed_to_target_learning_is_reclassified_for descendants.
C30. translation_receipt_lists preserved weakened unsupported assumptions.
C31. unknown_learning_artifact_schema_fails_closed.
C32. source_policy_version_is_part_of_attestation_identity.
C33. redacted_source_evidence_downgrades reproducibility/guarantee state.
C34. cached_transfer_assessment_invalidates_on mapping/profile/drift/source-status change.
C35. multi_source_candidate_union_preserves per-source provenance.
C36. majority_source_approval_does_not_auto_promote.
C37. exact_equivalent payload fingerprints do not erase independent episode provenance.
C38. target_explanation_reports source and local promotion receipts separately.
C39. foreign artifact cannot mutate Frozen Spec/verifier/promotion policy/read scope.
C40. known symbolic import/compatibility/admission checks run with providers disabled and model_calls=0.

Concrete canonical deltas

  1. #404 should record PACT-EPOCH as C and change progression to A+B+C COMPLETE / D NEXT.
  2. #397 should authorize only #404D after reconciliation.
  3. #392 should permit learning-artifact/attestation/transfer provenance as meta-knowledge while keeping it distinct from source/world assertions.
  4. #395 should add cross-domain transfer fixtures: source-vs-target admission, verifier fingerprint mismatch, lossy mapping, source-dependence, drift/calibration scope, attestation integrity-vs-validity and zero-model transfer checks.
  5. #377/#379 should treat foreign learned policies/compositions as declarative candidate control data until local registry/procedure admission.
  6. #384 should expose verifier/evidence-policy fingerprints suitable for target compatibility checking; source VERIFY receipts remain evidence, not target acceptance.
  7. symbolic-memory #6 should persist LACs, source/local status, attestations, transfer assessments, drift/calibration and dependence claims append-only.
  8. symbolic-memory #7 should query/explain foreign-vs-local learned status and exact transfer assumptions.
  9. symbolic-memory #9 must preserve the typed LAC/attestation/transfer envelope across native/MCP rather than flattening to learned=true, approved=true, or one score.
  10. symbolic-memory #10 should support reversible identity/ontology mappings referenced by transfer receipts and keep semantic entity reconciliation separate from evidence-origin independence.

Unresolved questions reserved for D

  • canonical binary/text encoding and fingerprint of LAC/attestation predicates;
  • signature/trust-root implementation and revocation cache semantics;
  • efficient exposure/dependence closure indexes across billion-record ledgers;
  • privacy-preserving origin-overlap protocol, if any, for v1;
  • exact transfer cache key and dependency invalidation graph;
  • practical source/target divergence estimators per learned-object class;
  • sequential/multiple-testing budget across imported candidates and authorities;
  • scalable mapping-alternative representation and solver strategy;
  • crash-safe import -> validate -> promote transitions;
  • concurrency determinism when source retraction/drift races target evaluation;
  • benchmark-derived thresholds for when source evidence can reduce target validation work;
  • exact differential oracle for cold/warm/cached/incremental federated transfer.

Completion statement: #404C is design-complete only. It does not prove any learned artifact is safe to transfer, nor does it establish Machine Spirit. #404D is the only legal next subpass.

## Machine Spirit #404C — composition / heterogeneity / interoperability **Status: C COMPLETE — D NEXT.** This subpass treats learned-rule/strategy portability as an **interchange and transfer-validity problem**, not as replication of `admitted=true` across systems. ## Research questions / scope 1. What exactly may cross a project/memory/organization boundary: payload, proof/explanation, empirical evidence, promotion receipt, status, calibration, authority, or some subset? 2. How do EBG, ILP, case/procedural abstraction, statistical/online control policies, model-derived candidates and expert compositions share an envelope without pretending their guarantees are identical? 3. When does validation on source environment A say anything defensible about target environment B? 4. How are source/evidence-dependence groups reconciled across federated ledgers without exposing private fixture/source identities? 5. How do multiple validators/promotion authorities compose when their policies, risk classes, verifier contracts and trust roots differ? 6. How should drift/calibration scopes move across domains or time epochs? 7. What is the safe default for an external learned object when the target cannot reproduce source evidence? 8. How do portable semantic procedures remain separate from target-local host binding, capability and authority? ## Primary evidence Primary/authoritative sources used in this pass: - Ben-David, Blitzer, Crammer, Kulesza, Pereira & Wortman Vaughan, **A theory of learning from different domains**, *Machine Learning* 79, 2010. DOI `10.1007/s10994-009-5152-4`. The target-error bound depends on source error, source/target divergence, and the existence/error of a hypothesis good for both domains: source success alone is not a target guarantee. https://link.springer.com/article/10.1007/s10994-009-5152-4 - Mansour, Mohri & Rostamizadeh, **Domain Adaptation with Multiple Sources**, NIPS 2008 / proceedings 2009. Multiple sources require an explicit adaptation construction; plurality of source hypotheses is not itself a target-validity proof. https://proceedings.neurips.cc/paper/2008/hash/0e65972dce68dad4d52d063967f0a705-Abstract.html - Mansour, Mohri & Rostamizadeh, **Domain Adaptation: Learning Bounds and Algorithms**, COLT 2009. https://arxiv.org/abs/0902.3430 - Quiñonero-Candela et al. (eds.), **Dataset Shift in Machine Learning**, MIT Press, 2009. The training/test joint distribution can differ through several shift mechanisms; validity is conditional on the operating distribution/assumptions. https://direct.mit.edu/books/edited-volume/3841/Dataset-Shift-in-Machine-Learning - W3C, **PROV-DM: The PROV Data Model**, Recommendation, 30 Apr 2013. Provides explicit entities, activities, agents, derivations, usage/generation and provenance bundles for interoperable provenance rather than one opaque trust score. https://www.w3.org/TR/prov-dm/ - W3C, **PROV-O**, Recommendation, 30 Apr 2013. Provides an extensible interoperable provenance ontology. https://www.w3.org/TR/prov-o/ - Torres-Arias et al., **in-toto: Providing farm-to-table guarantees for bits and bytes**, USENIX Security 2019. Demonstrates signed/verified attestations of how an artifact was produced without treating the artifact metadata itself as universal semantic truth. https://www.usenix.org/conference/usenixsecurity19/presentation/torres-arias - in-toto Attestation Framework, current specification/repository. Its Statement + typed Predicate structure is a useful precedent for a small stable envelope carrying domain-specific attestations. https://github.com/in-toto/attestation - SLSA **v1.2** specification, current as retrieved 2026-09-06. Provenance describes where/how an artifact was produced under explicit provenance requirements; it does not make all downstream use valid. https://slsa.dev/spec/v1.2/ - Mitchell et al., **Model Cards for Model Reporting**, FAT* 2019. Intended uses, evaluation conditions and performance characteristics must travel with a learned artifact rather than one context-free quality number. https://dl.acm.org/doi/10.1145/3287560.3287596 - Gebru et al., **Datasheets for Datasets**, *CACM* 2021. Dataset composition, collection and intended-use documentation are necessary transfer context. https://dl.acm.org/doi/10.1145/3458723 - NIST, **AI Risk Management Framework 1.0**, 2023. TEVV is lifecycle- and operational-context-sensitive; target-context validity cannot be inferred from a detached source score. https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf These sources support a common conclusion: **portable provenance/attestation is feasible; portable validity is conditional.** Domain-adaptation theory makes the condition explicit mathematically, while provenance/attestation standards show how claims can move without becoming ambient trust. ## Candidate architectures ### Candidate 1 — global learned-object registry with universal status Replicate `{payload, status=admitted, confidence=.93}` into every memory and let all hosts consume the same status. **Strengths:** simple UX, easy dedup/federation. **Rejected.** It launders source promotion authority, evaluation conditions, source dependence, drift scope and calibration into unrelated targets. `admitted` has no context-free meaning. ### Candidate 2 — copy payload only; discard all source evaluation metadata External rules/procedures arrive as fresh local candidates with no inherited evidence. **Strengths:** safe and conceptually simple; no validation laundering. **Rejected as the full design.** It throws away useful provenance, counterexamples, source assumptions, verifier receipts, failure history, applicability scopes and evidence that can cheaply guide target validation. It also makes independent-origin reasoning impossible. ### Candidate 3 — federated consensus / majority promotion If enough memories or organizations admit the same candidate, consider it admitted globally. **Rejected.** Replica/source dependence and shared training/evaluation lineage can make ten approvals one causal origin. Different authorities can also have incompatible policies or environments. Vote count is not target validity. ### Preferred — **PACT-EPOCH: Provenance-Attested Cross-Trust Learning Interchange for EPOCH** ```text source EPOCH/CITADEL learned object ↓ Learning Artifact Contract (LAC) payload + semantics + provenance + source admission attestation ↓ loss-aware semantic/profile translation ↓ target import state foreign_candidate / evidence_only / quarantined / incompatible ↓ source/target context + dependence + drift comparison ↓ target validation obligations exact reuse | bounded transfer check | full local revalidation ↓ TARGET promotion policy ↓ locally admitted object/version ↓ local expert/procedure/retrieval selection ↓ local binding/capability/authority admission ``` The central invariant is: ```text portable learned payload != portable promotion status source admission attestation != target admission source calibration != target calibration source safety result != target safety result same rule fingerprint != same applicability domain same validator name != same validator semantics multiple approving systems != independent validation origins semantic procedure portability != target executable binding/authority ``` ## 1. Learning Artifact Contract (LAC) Define a versioned typed interchange object rather than flattening all learners to one rule schema. Conceptual shape: ```prolog meta_learning_artifact( ArtifactId, Kind, % ebg_rule | ilp_rule | case | method | control_policy | expert_composition | mapping PayloadRef, SemanticProfile, LearnerContract, ApplicabilityScope, Assumptions, SourceEnvironment, OriginRefs, ExposureSummary, EvidenceUseSummary, EvaluationAttestations, PromotionAttestations, DriftCalibrationScope, Compatibility, Provenance, Version). ``` Learner-specific payload/guarantee information remains typed: ```text EBG: explanation/theory dependencies + operationality conditions ILP: hypothesis language + background theory + +/-/context example policy + noise/search bounds case: situation/goal/action/adaptation/outcome + VERIFY lineage control policy: task distribution + baseline + metric/evaluator contract + statistical evidence expert composition: goal contracts + component/version requirements + no executable handlers model-derived candidate: model/provider/run provenance + candidate status only ``` A common envelope is therefore **not** a common guarantee. ## 2. Attestations are claims, not imported truth Use an in-toto/SLSA-like pattern: ```prolog meta_learning_attestation( SubjectArtifact, PredicateType, PredicatePayload, Issuer, TrustDomain, IssuedAt, SignatureOrIntegrityRef, Provenance). ``` Example predicate types: ```text source_promotion_receipt source_counterexample_campaign source_verify_receipt source_calibration_report source_drift_epoch source_dependence_statement source_policy_profile ``` A valid signature proves **who made the claim and artifact integrity**, not that the proposition is universally true. Target policy decides which issuers/predicates are admissible evidence and at what strength. ## 3. Target admission always has a local state Default import mapping: ```text source admitted -> target foreign_candidate source promotion_ready -> target foreign_candidate source proposed -> target foreign_candidate source quarantined -> target quarantined source suspended/retracted -> target quarantined/evidence_only by policy unknown/incompatible LAC -> target incompatible ``` A target may record: ```text admitted_by(source_authority, SourceReceipt) ``` as provenance, but that is distinct from: ```text locally_admitted(TargetPolicy, TargetReceipt) ``` Only the latter affects ordinary target control selection. A narrowly configured same-trust-domain optimization may reuse prior validation when **all material fingerprints and declared applicability/environment assumptions are equivalent and target policy explicitly permits it**. The optimization is an explicit proof/receipt, never name-based trust inheritance. ## 4. Validation guarantees use a non-strengthening algebra Every imported guarantee carries scope and assumptions. Conceptual status transformation: ```text preserved % target proves source assumptions/evaluator semantics equivalent translated % mapping is semantics-preserving under named proof/profile weakened % only a subset of source guarantee survives invalidated % target violates a required assumption unknown % insufficient evidence noncomposable % guarantees use incompatible semantics ``` Bridge operations may **preserve or weaken** a source guarantee. They may not strengthen it without new target evidence. Examples: ```text source exact finite proof + identical theory/profile -> may preserve proof result after replay/fingerprint validation source 95% calibration on environment A -> unknown/weakened on shifted environment B until target calibration evidence source method passed verifier V1 + target verifier V2 with stricter obligations -> source receipt is evidence_only; V2 obligations remain source EBG rule whose explanation uses ontology O1 + target maps O1 -> O2 lossily -> explanation guarantee weakened/noncomposable ``` ## 5. Domain transfer is an explicit obligation Ben-David-style domain-adaptation bounds motivate the correct qualitative contract: ```text target performance depends on source performance + source/target divergence + existence/error of a rule/hypothesis suitable for both ``` Machine Spirit should not pretend it can estimate every term universally. Instead an imported candidate declares a **transfer profile**: ```prolog meta_transfer_assessment( Artifact, SourceEnvironment, TargetEnvironment, ComparedDimensions, ShiftEvidence, AssumptionChecks, RequiredTargetEvidence, Status, Receipt). ``` Relevant dimensions can include schema/vocabulary, task/goal distribution, project/runtime version, data/source populations, authority policy, resource envelope, verifier semantics, platform, dependencies, temporal epoch and failure modes. If target overlap/equivalence cannot be established, the safe result is `requires_local_validation`, not `probably_portable`. ## 6. Multi-source learning does not become vote counting When several foreign memories provide related learned objects, preserve source-specific hypotheses and provenance. Composition may: ```text union candidates compare assumptions identify exact-equivalent payloads identify conflicting payloads construct target validation portfolio weight/select sources under an explicit transfer algorithm/profile ``` Do not automatically majority-vote promotion statuses or average incomparable quality metrics. Mansour/Mohri/Rostamizadeh multi-source adaptation is useful precisely because it treats source combination as an adaptation problem with assumptions, not as `n approvals => truth`. ## 7. Cross-ledger evidence dependence is privacy-aware but conservative CITADEL requires causal/source independence; CLFM says ledgers are independent order/authority domains. Cross-domain interchange therefore needs an origin/dependence interface that does not require dumping private source identities. Conceptual public claim: ```prolog meta_dependence_claim( ArtifactOrEvidence, OpaqueOriginClass, Relation, % same_origin | derived_from | overlaps | asserted_disjoint | unknown Scope, Issuer, ProofOrAttestation, DisclosureClass). ``` Rules: - exact public origin IDs may be used where disclosure is safe; - otherwise use opaque trust-domain origin classes/commitments; - source assertions of disjointness are claims, not automatically local facts; - if privacy prevents establishing disjointness, **do not count the records as independent**; - optional future PSI/cryptographic-set-intersection mechanisms may prove overlap without revealing full sets, but are not required for v1 semantics. Conservative failure is preferable to validation laundering. ## 8. Promotion authorities remain namespaced Represent: ```text Authority A admitted R under policy PA Authority B rejected R under policy PB ``` without selecting an ambient winner. A target policy may explicitly trust one authority, require local validation, require multiple named authorities, or forbid external promotion evidence for a risk class. Conflicting authority receipts are durable plural evidence. They never become one synthesized `confidence` number. ## 9. Procedure/expert portability stops before execution admission Portable semantic method/procedure: ```text LAC procedure payload -> #401 PSC/PIFF compatibility -> target semantic/profile mapping -> target DPEC projection -> #377 expert availability -> local capability/authority/resource checks -> #288 execution ``` Therefore: ```text source procedure admitted != target procedure compatible compatible != bound bound != currently admissible currently admissible != executed ``` A foreign expert composition imports only declarative goal/component contracts. It cannot import handlers, shell commands, credentials, capabilities or authority. ## 10. Calibration and drift are scoped artifacts A calibration result must name: ```text candidate/version environment/task distribution time/epoch metric definition sampling/evaluation process uncertainty/coverage method ``` Moving it across any of those dimensions creates a transfer obligation. Under distribution shift, nominal calibration/coverage need not survive; recent conformal work continues to require explicit assumptions or correction for covariate/general shift. Target monitoring creates a **new local calibration/drift lineage** rather than mutating the source report. ## 11. Repository ownership ### prolog-rlm owns - LAC schema and validation; - learner-kind contracts; - transfer/guarantee algebra; - target promotion semantics; - evaluator/verifier compatibility rules; - #377/#379/#381 consumption semantics; - #395 deterministic interoperability/conformance fixtures. ### symbolic-memory owns - durable LAC/attestation/import/export history; - source/local promotion states side by side; - CLFM federation references/cuts; - opaque origin/dependence classes and disclosure policy metadata; - durable drift/calibration epochs; - query/projection of learning provenance; - identity/ontology mappings used by transfer assessments. Dependency remains `symbolic-memory -> prolog-rlm`. Symbolic Memory stores portable learning artifacts and their history; Prolog-RLM defines/validates their semantics and decides target-local admission. ### existing expert/runtime layer owns No new scheduler or authority plane. #288 remains scheduler; #384 remains exact requirement acceptance boundary; ordinary capability/effect checks remain authoritative. ## Complexity / performance / scaling - LAC validation is linear in envelope/payload metadata size plus profile-specific validation. - Provenance/exposure/dependence closure is graph-reachability work over selected evidence; global closure may be huge, so C requires bounded/demanded expansion and compact dependence summaries, with exact backing refs retained. - Cross-domain semantic mapping can be combinatorial when multiple ontology/profile mappings compete; preserve bounded alternatives or `noncomposable/resource_limited` rather than first-map wins. - Transfer evaluation cost is candidate × target-evaluation profile; source receipts may prune unnecessary work only when their guarantees actually survive the bridge. - Multi-source portfolios can grow with sources × candidates × mappings; exact-equivalent artifact fingerprints and provenance DAG sharing can deduplicate representation without collapsing independent source episodes. - Privacy-preserving overlap proof is optional and may be expensive; inability to prove independence simply prevents counting evidence as independent. - Imported empirical statistics are never merged by raw averaging unless metric definitions, populations and aggregation assumptions are compatible under an explicit profile. D owns concrete indexing, cache keys, incremental invalidation, attestation verification cost, large-scale overlap/dependence structures and deterministic concurrent import/evaluation execution. ## Epistemic / provenance implications PACT-EPOCH adds a sixth important provenance concern on top of semantic/source/logical/lifecycle/runtime provenance: **learning-transfer provenance**. A target explanation must be able to answer: ```text Where was this rule learned? Which learner/formalism produced it? Which evidence was generation vs validation evidence? Which source authority admitted it? Which source guarantee survived transfer, weakened, or failed? Which target-local evidence caused admission? Which identity/ontology mappings did transfer depend on? Was evidence independence proven, asserted, unknown, or impossible to disclose? What drift/calibration epoch applies here? ``` No imported `confidence`, approval count or signature substitutes for these answers. ## Safety / authority implications Hard invariants: ```text signed learned artifact != true artifact trusted issuer != target-valid semantics source admission != target admission source capability != target capability foreign expert composition != executable handler foreign policy text != host policy identity mapping != principal mapping ontology compatibility != execution compatibility ``` External artifacts cannot mutate target promotion policy, verifier policy, Frozen Spec, read/egress policy, expert registry, host bindings or authority. High-risk target classes may require entirely local validation regardless of external receipts. ## Adversarial review / failure cases 1. Source marks `admitted`; target blindly activates it. 2. Two organizations use the same verifier name with different semantics. 3. Source and target share fixture copies but label them independent. 4. Ten federation replicas masquerade as ten promotion authorities. 5. Two authorities both derive evidence from one upstream benchmark. 6. Private provenance prevents overlap check; target assumes independence anyway. 7. Ontology mapping changes a guard from `must` to `should` but preserves status. 8. Unit/version mapping changes numeric applicability. 9. Source EBG explanation depends on a theory absent in target. 10. ILP rule transfers but target background theory changes its consequences. 11. Case transfers between incompatible runtime/platform versions. 12. Statistical control policy transfers under severe task-distribution shift. 13. Source calibration report is reused after target drift. 14. Source verifier omits a target hard guard. 15. Source authority is cryptographically authentic but policy-untrusted. 16. Source promotion policy itself was later retracted. 17. Foreign object contains executable-looking Prolog/handler IDs. 18. Imported expert composition names a local high-authority expert by lexical coincidence. 19. Multiple source scores with different metrics are averaged. 20. Mapping ambiguity is collapsed to the highest-confidence mapping. 21. Target learns from source validation cases, then still counts source receipt as untouched validation. 22. Foreign quarantine/retraction is dropped during export. 23. Import cache survives source retraction/drift generation. 24. Target writes `admitted=true` into canonical payload, losing authority namespace. 25. Cross-memory identity merge causes unrelated project's evidence to become source-independent corroboration. 26. Source and target clocks differ; a stale calibration epoch appears current. 27. External redaction removes evidence needed to reproduce a source guarantee but status remains unchanged. 28. Source LAC translator strips unsupported assumptions. ## Rejected alternatives - universal cross-memory `confidence`: incomparable and launders semantics; - global promotion authority: destroys local policy/target context; - majority approval: ignores causal/source dependence and policy heterogeneity; - payload-only exchange: too much provenance/negative evidence is lost; - automatically trusting signed artifacts: integrity/authentication is not semantic validity; - forced universal learner representation: EBG/ILP/case/statistical guarantees are materially different; - automatic target execution of portable procedures: violates DPEC/capability/authority boundaries; - raw global origin IDs as mandatory interoperability: unnecessary privacy leak; - assume independence when provenance is hidden: unsafe; use `unknown`; - translate every foreign metric into one normalized score: invalid without a calibrated mapping. ## Falsifiable #404C conformance fixtures C1. `source_admitted_imports_as_foreign_candidate_not_local_admitted`. C2. `source_promotion_attestation_preserved_without_target_activation`. C3. `source_quarantine_cannot_import_as_clean_candidate`. C4. `source_retraction_invalidates_target_transfer_assumption`. C5. `signed_attestation_authenticates_issuer_not_semantic_truth`. C6. `unknown_issuer_policy_does_not_grant_validation_strength`. C7. `same_verifier_name_different_fingerprint_is_non_equivalent`. C8. `stricter_target_verifier_requires_target_validation`. C9. `exact_finite_proof_replays_under_identical_theory_profile`. C10. `lossy_ontology_mapping_weakens_or_invalidates_guarantee`. C11. `ambiguous_mapping_remains_alternative_or_noncomposable`. C12. `ebg_dependency_missing_in_target_blocks_preserved_guarantee`. C13. `ilp_background_theory_change_requires_revalidation`. C14. `case_platform_mismatch_requires_target_applicability_check`. C15. `statistical_policy_distribution_shift_drops_source_calibration_claim`. C16. `source_calibration_epoch_does_not_become_target_current_epoch`. C17. `target_drift_creates_local_suspension_without_rewriting_source_history`. C18. `replicas_do_not_count_as_independent_promotion_authorities`. C19. `same_upstream_benchmark_collapses_dependence_across_organizations`. C20. `privacy_hidden_origin_defaults_to_independence_unknown_not_independent`. C21. `opaque_origin_commitments_can_signal_same_origin_without_raw_source_disclosure`. C22. `unverified_disjointness_claim_does_not_count_as proven independence`. C23. `two_conflicting_promotion_authorities_remain_plural_evidence`. C24. `target_policy_can_require_local_validation_despite trusted source`. C25. `foreign_expert_composition_imports_no_handler_or_authority`. C26. `foreign_semantic_action_remains_inert_until local DPEC/binding admission`. C27. `same_expert_name_cannot_rebind_principal_or_authority`. C28. `metric_vectors_with_incompatible_definitions_are_not_averaged`. C29. `source_validation_exposed_to_target_learning_is_reclassified_for descendants`. C30. `translation_receipt_lists preserved weakened unsupported assumptions`. C31. `unknown_learning_artifact_schema_fails_closed`. C32. `source_policy_version_is_part_of_attestation_identity`. C33. `redacted_source_evidence_downgrades reproducibility/guarantee state`. C34. `cached_transfer_assessment_invalidates_on mapping/profile/drift/source-status change`. C35. `multi_source_candidate_union_preserves per-source provenance`. C36. `majority_source_approval_does_not_auto_promote`. C37. `exact_equivalent payload fingerprints do not erase independent episode provenance`. C38. `target_explanation_reports source and local promotion receipts separately`. C39. `foreign artifact cannot mutate Frozen Spec/verifier/promotion policy/read scope`. C40. `known symbolic import/compatibility/admission checks run with providers disabled and model_calls=0`. ## Concrete canonical deltas 1. #404 should record **PACT-EPOCH** as C and change progression to `A+B+C COMPLETE / D NEXT`. 2. #397 should authorize only #404D after reconciliation. 3. #392 should permit learning-artifact/attestation/transfer provenance as meta-knowledge while keeping it distinct from source/world assertions. 4. #395 should add cross-domain transfer fixtures: source-vs-target admission, verifier fingerprint mismatch, lossy mapping, source-dependence, drift/calibration scope, attestation integrity-vs-validity and zero-model transfer checks. 5. #377/#379 should treat foreign learned policies/compositions as declarative candidate control data until local registry/procedure admission. 6. #384 should expose verifier/evidence-policy fingerprints suitable for target compatibility checking; source VERIFY receipts remain evidence, not target acceptance. 7. symbolic-memory #6 should persist LACs, source/local status, attestations, transfer assessments, drift/calibration and dependence claims append-only. 8. symbolic-memory #7 should query/explain foreign-vs-local learned status and exact transfer assumptions. 9. symbolic-memory #9 must preserve the typed LAC/attestation/transfer envelope across native/MCP rather than flattening to `learned=true`, `approved=true`, or one score. 10. symbolic-memory #10 should support reversible identity/ontology mappings referenced by transfer receipts and keep semantic entity reconciliation separate from evidence-origin independence. ## Unresolved questions reserved for D - canonical binary/text encoding and fingerprint of LAC/attestation predicates; - signature/trust-root implementation and revocation cache semantics; - efficient exposure/dependence closure indexes across billion-record ledgers; - privacy-preserving origin-overlap protocol, if any, for v1; - exact transfer cache key and dependency invalidation graph; - practical source/target divergence estimators per learned-object class; - sequential/multiple-testing budget across imported candidates and authorities; - scalable mapping-alternative representation and solver strategy; - crash-safe import -> validate -> promote transitions; - concurrency determinism when source retraction/drift races target evaluation; - benchmark-derived thresholds for when source evidence can reduce target validation work; - exact differential oracle for cold/warm/cached/incremental federated transfer. **Completion statement:** #404C is design-complete only. It does not prove any learned artifact is safe to transfer, nor does it establish Machine Spirit. #404D is the only legal next subpass.
Author
Owner

Machine Spirit #404D — computational realization / scaling / deterministic conformance

Status: D COMPLETE — Depth 7 ready for reconciliation.

This pass makes EPOCH + CITADEL + PACT executable as a bounded, replayable learning-control dataflow over the existing runtime. It does not introduce a second scheduler, a second authority plane, or a generic scalar-reward loop.

Preferred architecture: CLOCKWORK-EPOCH — Conformance-Locked, Ordered, Crash-safe Knowledge-Workflows for Replayable EPOCH.

immutable experiences / foreign LACs / source attestations
        ↓
canonical typed learning ledger
        ↓
versioned direct dependence + exposure graph
        ↓
rebuildable exact indexes / query-scoped closures
        ↓
candidate freeze + immutable EvaluationSnapshot
        ↓
        ┌─────────────────────────────────────────────┐
        │ exact symbolic / exhaustive finite checks  │
        │ bounded property/counterexample campaigns  │
        │ paired sequential safe-improvement checks  │
        │ optional logged-data/OPE profile           │
        └─────────────────────────────────────────────┘
        ↓
hard guards + contamination + transfer validity
        ↓
conditional promotion commit against dependency generations
        ↓
admitted | held | quarantined | resource_limited
        ↓
post-admission structural + statistical drift watches
        ↓
suspend / supersede / retract as append-only events

Research questions

  1. How can candidate exposure/dependence be queried at scale without global exponential closure or false claims of independence?
  2. What byte-level identity/signature contract makes PACT LACs replayable across implementations?
  3. How should repeated adaptive candidate evaluation consume statistical error budget?
  4. What concrete promotion algorithms apply to exact symbolic rules versus empirical strategy/control policies?
  5. How should counterexample search report exhaustive versus bounded coverage?
  6. How do drift, calibration, target-transfer and source retraction incrementally invalidate learned objects?
  7. What state machine prevents promotion races/crashes from producing half-admitted knowledge?
  8. What differential/concurrency fixtures are required before Depth 7 can be called computationally coherent?

Primary evidence used

  • Dwork, Feldman, Hardt, Pitassi, Reingold & Roth, The Reusable Holdout: Preserving Validity in Adaptive Data Analysis, Science 349(6248), 2015. DOI 10.1126/science.aaa9375. Shows ordinary holdout reuse is invalid under adaptive analysis and gives a principled reusable-holdout construction.
  • Dwork et al., Preserving Statistical Validity in Adaptive Data Analysis, STOC 2015; and Generalization in Adaptive Data Analysis and Holdout Reuse, NeurIPS 2015. Formalize adaptivity/data reuse as part of the statistical contract.
  • Howard, Ramdas, McAuliffe & Sekhon, Time-uniform, nonparametric, nonasymptotic confidence sequences, Annals of Statistics 49(2), 2021, DOI 10.1214/20-AOS1991. Confidence sequences remain valid uniformly over time and support optional stopping under their assumptions.
  • Ramdas, Grünwald, Vovk & Shafer, Game-Theoretic Statistics and Safe Anytime-Valid Inference, Statistical Science 38(4), 2023. Formalizes e-process / anytime-valid inference under continuous monitoring.
  • Thomas, Theocharous & Ghavamzadeh, High-Confidence Off-Policy Evaluation, AAAI 2015. Gives lower-confidence-bound off-policy evaluation from logged trajectories under its support/statistical assumptions.
  • Laroche, Trichelair & Tachet des Combes, Safe Policy Improvement with Baseline Bootstrapping, ICML 2019. Gives high-probability baseline-safe improvement guarantees for the finite-MDP Batch-RL setting; useful only for that declared profile, not as a generic self-improvement theorem.
  • Claessen & Hughes, QuickCheck: A Lightweight Tool for Random Testing of Haskell Programs, ICFP 2000. Property/generator-based counterexample search.
  • Runciman/Naylor/Lindblad, SmallCheck and Lazy SmallCheck, 2008. Exhaustive testing up to a declared finite depth.
  • de Moura & Bjørner, Z3: An Efficient SMT Solver, TACAS 2008. Representative decidable/formula-based counterexample and constraint checking.
  • Zeller & Hildebrandt, Simplifying and Isolating Failure-Inducing Input, IEEE TSE 28(2), 2002. Delta debugging/minimization of witnessed failures.
  • Bifet & Gavaldà, Learning from Time-Changing Data with Adaptive Windowing, SDM 2007. ADWIN gives stream-change detection with false-positive/false-negative bounds under its model and supports efficient adaptive windows.
  • Gupta, Mumick & Subrahmanian, Maintaining Views Incrementally, SIGMOD 1993. Classical incremental materialized-view maintenance.
  • McSherry, Murray, Isaacs & Isard, Differential Dataflow, CIDR 2013. Demonstrates efficient incremental maintenance for nested iterative computations/graph algorithms.
  • Budiu, Chajed, McSherry, Ryzhyk & Tannen, DBSP: Automatic Incremental View Maintenance for Rich Query Languages, PVLDB 16(7), 2023. Provides a general incrementalization model for rich queries including recursive forms.
  • RFC 8949, CBOR, December 2020, especially deterministic encoding requirements.
  • RFC 8785, JSON Canonicalization Scheme, June 2020, as a JSON-facing interoperability option.
  • DSSE specification: signs PAE(payloadType,payload) and intentionally authenticates exact payload bytes/type rather than relying on application reserialization.
  • in-toto Attestation Framework v1: typed Statement layer with immutable subject digests + predicateType.
  • RFC 9497, OPRFs, December 2023, reviewed as a basis for future privacy-preserving origin matching; not required for v1.

Candidate computational architectures

Candidate 1 — one global learned-state table + mutable scores

Maintain current candidate rows, a scalar score, flattened holdout status, and periodically overwrite admitted=true/false.

Rejected. It destroys historical replay, cannot represent source/causal dependence, makes adaptive holdout leakage invisible, has no principled crash/race semantics, and turns heterogeneous guarantees into one score.

Candidate 2 — fully materialized global provenance/exposure closure + universal statistical promoter

Materialize transitive closure between every source/candidate/evaluator/fixture, feed every candidate through one statistical safe-improvement evaluator, and globally union equivalent origins.

Rejected. Closure can be O(V²) or worse in dense graphs; ATMS/provenance environments can explode; irreversible union-find-style merges are wrong under retraction/versioned identity; many symbolic candidates have exact finite proof obligations rather than stochastic performance semantics; statistical evaluation cannot manufacture a theorem for semantic correctness.

Candidate 3 — event-only ledger with full recomputation on every decision

Persist only immutable events and recompute all exposure, evaluation and transfer state from genesis on every promotion.

Semantically clean but rejected as the normal execution model. It remains the correctness oracle/rebuild path, but ordinary operation requires exact rebuildable indexes and dependency-directed incremental maintenance.

Preferred — CLOCKWORK-EPOCH

1. Canonical learning ledger is append-only; indexes are disposable

Canonical durable objects/events include:

meta_experience(...).
meta_candidate(...).
meta_evidence_use(...).
meta_dependence_edge(...).
meta_lac(...).
meta_attestation(...).
meta_evaluation_snapshot(...).
meta_evaluation_observation(...).
meta_counterexample_receipt(...).
meta_promotion_event(...).
meta_drift_event(...).
meta_transfer_assessment(...).

Current candidate state, exposure closures, strategy summaries, validation eligibility and transfer caches are rebuildable derived views.

This follows the same canonical-vs-derived rule already established by #402/SAFIRE and symbolic-memory#6.

2. Exposure/dependence graph: direct facts canonical, closure query-scoped

Use typed nodes such as:

candidate / ancestor candidate
experience
source/span/semantic record
fixture/test population
verifier/evaluator/metric
learner/model artifact
baseline
trust root
ontology/translation
runtime/environment epoch

and typed directed/undirected relations such as:

derived_from
exposed_to
trained_on
selected_on
evaluated_on
shares_origin
copied_from
translated_via
attested_by
depends_on

Maintain exact adjacency indexes in both directions. Do not require global transitive-closure materialization.

A candidate's exposure closure is computed by bounded graph traversal from a frozen candidate/version and evidence frontier. Cache the normalized closure/interface digest against graph generation. Direct-edge changes invalidate only descendants/dependents known by reverse indexes.

Worst-case exact traversal remains O(V+E) over the reachable subgraph. Incremental/cache maintenance is workload optimization, not a stronger guarantee.

Important accelerator rule:

Bloom/probabilistic index may prove "possibly exposed"
Bloom/probabilistic index may NOT prove independence

A negative independence claim requires complete exact closure for the declared graph/profile. Missing/hidden provenance yields independence=unknown, never true.

Do not use irreversible DSU/union-find as canonical source-dependence truth. Active dependence equivalence/components are versioned rebuildable views because origin/identity mappings can be retracted/superseded.

For larger workloads, semi-naive/incremental view maintenance is the first implementation step. Differential-dataflow/DBSP-style machinery is optional if measurements justify nested incremental graph maintenance; no second universal runtime is required for v1.

3. LAC byte identity + attestation verification

Define a closed LAC v1 typed data model first. Reject cyclic/non-ground objects and unknown critical schema/profile fields.

Preferred cross-language canonical payload:

normalized LAC v1
  -> RFC 8949 deterministic CBOR profile
  -> payload bytes
  -> SHA-256 domain-separated artifact fingerprint

Conceptually:

lac_fp = SHA256("machine-spirit-lac/v1\0" || deterministic_cbor(LAC))

For JSON-only boundaries, RFC 8785 JCS is an allowed adapter fingerprint profile, but it is not silently considered byte-identical to CBOR. Exact numeric/rational semantics must be explicit; security-sensitive fingerprints should not depend on ambiguous host floating-point serialization.

Attestation transport:

in-toto Statement subject digest = lac_fp
predicateType = versioned Machine Spirit predicate URI
predicate = source promotion/verify/calibration/etc receipt
optional DSSE envelope signs exact payload bytes + payloadType

DSSE is preferred for signatures because PAE binds exact payload bytes and content type, avoiding reserialization confusion.

Verification returns distinct fields:

signature_valid
issuer_identity
key/trust_root_generation
predicate_schema_valid
semantic_claim_status
local_policy_acceptance

A valid signature never sets semantic_claim_status=verified by itself.

4. Candidate freeze and immutable EvaluationSnapshot

Before validation evidence is consumed, freeze:

meta_evaluation_snapshot(
    SnapshotId,
    CandidateFingerprint,
    CandidateExposureFrontier,
    BaselineFingerprint,
    TaskPopulationRef,
    SemanticAndEnvironmentEpoch,
    FrozenSpecFingerprint,
    VerifierFingerprint,
    MetricContracts,
    HardGuards,
    ValidationOriginPolicy,
    StatisticalRiskLedgerRef,
    CounterexampleProfile,
    TransferAssessmentRefs,
    TrustRootGeneration,
    ResourceBounds,
    ReplaySeedOrStreamRef,
    DependencyGenerations,
    SnapshotFingerprint).

Evaluation observations cite this snapshot exactly. A candidate/descendant exposed to an observation cannot later reclassify it as fresh validation.

5. Three primary evaluation profiles + one specialized profile

exact_symbolic

Use for finite/decidable symbolic rules, procedure invariants, schema contracts, capability boundaries and equivalent deterministic properties.

Mechanisms:

  • Prolog exhaustive enumeration over declared finite domain;
  • CLP/SMT where the admitted fragment gives a complete decision procedure;
  • exact differential/reference checks.

Only this class may report coverage=exhaustive when the declared domain/solver fragment is actually exhaustive/complete.

bounded_counterexample

Use property generators, SmallCheck-style finite-depth enumeration, QuickCheck-style seeded generators, bounded model/constraint search, and delta-debug/shrinking of found failures.

Receipt contains:

generator/version
seed
search space/depth/bounds
cases explored
coverage class
counterexamples + minimized witness
stopping reason

Hard rule:

no counterexample found under bound != proof of correctness

paired_sequential_improvement

Default empirical promotion profile when candidate and admitted baseline can both be evaluated on the same fresh target-task stream.

For each target task i, compute a predeclared bounded utility delta:

D_i = U(candidate,i) - U(baseline,i)

where utility components/weights are fixed by the metric contract and catastrophic hard guards remain separate rather than averaged into utility.

Use a time-uniform confidence sequence (empirical-Bernstein or another declared valid CS) for mean delta. Promotion requires:

lower_confidence_bound(Delta) > required_margin
AND all hard guards pass
AND exposure/independence policy passes
AND minimum coverage/task classes pass

Optional stopping is allowed only because the selected CS/e-process profile explicitly supports it.

Repeated adaptive candidate families consume a precommitted summable risk allocation. Simple v1 family-wise profile:

alpha_n = alpha_family * 6 / (pi^2 * n^2)

assigned before candidate n consumes validation data, so sum alpha_n <= alpha_family. Each candidate's sequential interval uses its allocated alpha_n. This is deliberately conservative but auditable; richer e-value/FDR policies can be separate named profiles rather than implicit upgrades.

The guarantee applies only when the candidate is frozen before its fresh validation stream and the declared CS assumptions hold. If these conditions fail, the receipt is weakened/invalidated rather than silently reused.

logged_off_policy — optional/specialized

Only for strategy/control policies where logged-action propensities/support and required statistical assumptions are actually available. High-confidence OPE lower bounds may be used. If support/propensity requirements are missing, return unsupported/hold.

SPIBB-style guarantees are restricted to an explicitly declared compatible finite-MDP/batch-RL profile. They are not the default theorem for arbitrary Prolog expert selection.

6. Reusable holdout policy: no magical forever-holdout in v1

Dwork et al. prove adaptivity must be part of the validation mechanism. CLOCKWORK therefore does not implement hidden=true as a validity guarantee.

V1 default:

  • exact exposure/reveal accounting;
  • candidate freeze before validation;
  • fresh validation stream/origin groups for empirical promotion;
  • summable sequential error budget;
  • exposed failures migrate to generation/selection evidence for descendants.

A differential-privacy reusable-holdout mechanism may be added as a named future evaluation profile with its own privacy/validity budget. It is not silently approximated.

7. Concrete safe-improvement policy

Promotion is candidate-kind specific.

symbolic theorem/invariant     -> exact_symbolic required
semantic/procedure candidate  -> exact structural/profile checks
                                + counterexample campaign
empirical strategy selector   -> paired sequential improvement
logged control policy         -> optional OPE/SPI profile
foreign learned artifact      -> target transfer assessment
                                + applicable local profile above

If evidence cannot establish improvement over the admitted baseline, the action is hold, not "best observed wins".

Hard-guard classes remain zero-tolerance regardless of average utility:

authority/capability escalation
Frozen-Spec mutation
verifier/evaluator tampering
unsafe effect boundary bypass
replay/integrity corruption
source/validation laundering

8. Drift and calibration are epoch/dependency scoped

An admitted learned object's active applicability is bound to an evaluation epoch including at least:

task population/distribution
semantic/profile/schema generation
runtime/environment/tool-binding generation
verifier + metric contract
identity/dependence generation
source/evidence frontier
transfer/translation generation
calibration/drift profile

Structural generation changes are deterministic invalidators and can immediately require reevaluation/suspension according to policy.

For numeric streaming performance/error drift, ADWIN is an admissible detector profile because it supplies explicit statistical guarantees under its model. It is not a semantic-drift oracle. Store detector version/config/input stream ordering and decision receipt so replay can reproduce the decision.

A detector observation may create drift_suspected; policy decides whether confirmation is required. A hard incompatible environment/verifier/schema change may directly make an admission stale/inapplicable without waiting for statistical detection.

9. Privacy-preserving origin overlap — conservative v1 decision

V1 does not require general cross-organization PSI/OPRF infrastructure.

Within one configured trust/federation domain, allow privacy-scoped opaque origin_group_id or keyed commitments generated by a trusted origin service. Never expose raw private fixture IDs and never use unsalted/public hashes of low-entropy private identifiers as a privacy mechanism.

Across trust domains where a shared comparison mechanism is absent:

origin_overlap = unknown
independence = unknown

not independent.

RFC 9497 VOPRF/POPRF or a dedicated PSI protocol is a legitimate later mechanism for privacy-preserving equality/intersection checks, but adding one requires its own threat model/key lifecycle and must not be smuggled into v1 merely to avoid returning unknown.

10. Incremental invalidation graph

Promotion/transfer caches depend on explicit generations:

candidate payload/ancestry
exposure/dependence graph
source lifecycle
validation evidence
verifier/evaluator/metric policy
baseline
semantic/profile/schema
identity mappings
trust roots/keys
LAC translator
runtime/environment
calibration/drift epoch

Reverse dependency indexes identify impacted candidates/transfers. Recompute only affected nodes. Propagation may stop if a recomputed normalized interface digest is unchanged.

This mirrors #402D/#403D: direct generation/delta invalidation first; DBSP/differential-style general incrementalization only after workload evidence.

11. Crash-safe promotion lifecycle

Promotion is a conditional append-only state transition, not a mutable flag.

Conceptual API:

meta_promotion_evaluate(+Candidate, +Snapshot, +Options, -DecisionReceipt).
meta_promotion_commit(+Candidate,
                      +ExpectedLifecycleVersion,
                      +EvaluationSnapshotFingerprint,
                      +ExpectedDependencyGenerations,
                      +DecisionReceipt,
                      -Outcome).

Commit atomically appends the promotion event only if:

  • candidate lifecycle version still matches;
  • EvaluationSnapshot still resolves exactly;
  • all declared dependency generations still match;
  • receipt/policy/verifier fingerprints match;
  • authority for the promotion operation is present.

Otherwise return stale_evaluation / conflict and do not admit.

No promotion transaction changes host capability/authority or executable handler registration.

12. Deterministic race semantics

Important source-retraction/evaluation race:

Case A: retraction commits first
  -> source generation changes
  -> promotion CAS fails stale_evaluation

Case B: promotion commits first
  -> admission is historically valid at its exact cut
  -> later retraction invalidates dependent current admission
  -> append suspension/invalidation event

Both produce a current state in which the candidate is not silently active, while preserving the actual historical order. Wall-clock timestamp is not the arbiter; canonical ledger/frontier order and dependency generations are.

Concurrent duplicate promotion requests use candidate/version + snapshot fingerprint idempotency. Same key/same digest returns same logical transition; same key/different digest is conflict.

13. Explainability/replay receipt

Every active learned selection can resolve:

candidate + exact version
origin experiences
learner/profile
exposure/dependence closure digest
validation evidence + role
counterexamples / coverage
baseline and safe-improvement receipt
promotion policy/version
LAC/attestation/transfer chain where foreign
current drift/calibration epoch
suspension/supersession history
runtime binding/authority decision separately

Exact historical replay requires retained nondeterministic observations/model artifacts. Re-running a remote model/evaluator later is a new observation lineage, not exact replay.

Complexity / scaling implications

  • direct evidence/dependence edge append/index: expected backend index O(log N) or backend-specific equivalent;
  • exact query-scoped exposure closure: worst-case O(V+E) reachable graph, with generation-keyed memoization;
  • materialized global transitive closure: explicitly not required because dense worst-case storage approaches O(V²);
  • counterexample enumeration: inherently profile/search-space dependent; exponential/combinatorial cases must report work/depth/case ceilings;
  • paired sequential evaluation: O(1) incremental summary per metric per observation for standard streaming CS implementations, plus retained audit samples/refs per policy;
  • drift monitor: detector-specific; ADWIN-style implementations are stream-oriented and designed for bounded adaptive windows;
  • incremental invalidation: proportional to actual affected dependency subgraph in the intended common case, with full rebuild as correctness oracle;
  • cryptographic fingerprint/signature verification: linear in canonical payload size plus signature primitive cost;
  • no million/billion-record performance claim until implementation benchmarks.

Epistemic / provenance implications

  • Statistical evidence proves only the declared empirical property under its assumptions; it does not turn operational utility into semantic truth.
  • Cryptographic attestation proves statement integrity/issuer according to key policy, not truth.
  • Exact symbolic proof is profile/domain scoped; it does not imply transfer to a changed theory/environment.
  • independence=unknown is a first-class valid result.
  • Historical admission is preserved even when current admission is suspended.
  • Candidate evaluation and final runtime authority remain separate proof trees.

Adversarial/failure review

CLOCKWORK explicitly fails closed on:

  1. forged or wrong-type LAC attestation;
  2. alternate byte encodings producing fingerprint disagreement;
  3. unknown critical schema field/version;
  4. dependence edge hidden after candidate freeze;
  5. Bloom-filter negative incorrectly offered as independence;
  6. source-copy fanout offered as corroboration;
  7. exposed validation failure reused for descendant validation;
  8. repeated optional stopping using ordinary fixed-time intervals;
  9. candidate-family p-value fishing without family budget;
  10. metric range/utility changed after snapshot;
  11. baseline changed mid-evaluation;
  12. candidate changes verifier/test generation;
  13. bounded fuzz campaign claiming exhaustive safety;
  14. SMT/CLP solver used outside declared complete fragment but labeled proof;
  15. unknown OPE propensity/support accepted as safe improvement;
  16. statistical drift detector treated as semantic-drift proof;
  17. target transfer cache survives ontology/verifier/environment change;
  18. trust-root/key rotation not invalidating attestation acceptance where policy requires it;
  19. promotion/retraction race activates stale candidate;
  20. crash after evaluation but before admission inventing admitted state;
  21. crash after admission commit but before cache update losing durable admission;
  22. current cache rebuilt from stale exposure graph;
  23. remote re-evaluation masquerading as exact historical replay;
  24. privacy-hidden origin automatically treated as independent;
  25. foreign source approval bypassing target-local promotion;
  26. promotion event widening capabilities/authority;
  27. candidate payload resolving to unregistered executable Prolog;
  28. asynchronous evaluator completion order changing normalized decision.

Rejected alternatives

  • one scalar reward/fitness: loses hard guards, provenance and guarantee classes;
  • ordinary p-values plus "stop when green": invalid under optional stopping/adaptive reuse;
  • one fixed hidden test suite forever: adaptivity leaks it into training/selection;
  • global DSU dependence truth: irreversible under provenance correction/retraction;
  • Bloom filter for independence: false positives are tolerable as conservative hints, false semantic independence is not;
  • global closure materialization: unnecessary scaling risk;
  • universal SPIBB/OPE promoter: wrong semantics for symbolic theorem/rule/procedure candidates;
  • general PSI/OPRF in v1: too much crypto/key-governance surface for a feature whose safe fallback is unknown;
  • re-run model to replay history: false replay claim;
  • promotion as handler registration: collapses knowledge into authority.

D conformance fixtures

Canonicalization / attestation

D1. Equivalent normalized LAC emits identical deterministic CBOR bytes/fingerprint.
D2. Semantically different LAC emits different fingerprint.
D3. Map/input serialization order cannot change LAC fingerprint.
D4. Unknown critical LAC schema version is quarantined.
D5. DSSE payloadType substitution invalidates signature verification.
D6. Valid source signature + untrusted issuer does not become accepted source guarantee.
D7. Trust-root rotation invalidates/reclassifies only dependent attestation views.

Exposure/dependence

D8. Ancestor candidate exposure propagates to descendant closure.
D9. Source copy/paraphrase with explicit origin edge remains dependent.
D10. Retracted mistaken dependence link changes current closure without destroying historical closure.
D11. Missing private provenance returns independence unknown.
D12. Probabilistic accelerator negative cannot produce independent=true.
D13. Cold closure == cached closure for same graph generation.
D14. One unrelated provenance edge update does not invalidate unrelated candidate closure.

Adaptive/statistical evaluation

D15. Candidate fixed before fresh validation can consume assigned alpha tranche.
D16. Candidate exposed to validation result cannot reuse that result as fresh validation.
D17. Sequential stopping at first LCB crossing preserves declared anytime-valid policy receipt.
D18. Fixed-time interval used with optional stopping is rejected by profile validation.
D19. Sum of allocated candidate-family alpha never exceeds family budget.
D20. Candidate with positive mean proxy but failed hard guard is quarantined.
D21. Candidate whose LCB never clears required margin remains held.
D22. Baseline fingerprint changes mid-run -> stale evaluation.
D23. Metric contract/range changes mid-run -> stale evaluation.
D24. Unknown OPE support/propensity -> unsupported/hold, not promoted.
D25. Exact finite symbolic candidate can promote without statistical sampling when exhaustive proof obligations pass.

Counterexamples

D26. Finite declared domain exhaustive enumeration reports exhaustive only after all cases checked.
D27. Search hitting case/work/depth limit reports bounded/resource_limited.
D28. Found property counterexample is retained with generator/seed/profile.
D29. Shrinking/delta-debugging retains a witness that still reproduces the failure.
D30. No bounded counterexample found never emits universal-correctness status.

Drift/transfer

D31. Structural verifier/schema/environment generation change invalidates dependent admission.
D32. Numeric ADWIN-style drift observation is stored as detector-relative evidence, not semantic truth.
D33. Confirmed material drift appends suspension; historical admission remains queryable.
D34. Foreign transfer cache invalidates when translator/ontology/target verifier changes.
D35. Source calibration receipt cannot satisfy target calibration after population epoch change.

Crash/race/replay

D36. Crash before promotion append -> no admitted state after restart.
D37. Crash after durable promotion append but before projection/cache write -> rebuild restores admitted state.
D38. Concurrent duplicate same transition is idempotent.
D39. Same idempotency identity + different decision digest -> conflict.
D40. Source retraction committed before promotion -> promotion stale/rejected.
D41. Promotion committed before source retraction -> later append-only invalidation/suspension; current candidate inactive.
D42. Different async evaluator completion permutations normalize to same decision for fixed evidence set/profile.
D43. Cold rebuild == warm cache == cache-drop/rebuild == incremental current learned-state view for same exact frontier/generations.
D44. Historical replay resolves exact candidate/policy/verifier/LAC versions originally used.
D45. Live remote/model re-evaluation produces new observation lineage, not exact replay.

Authority / zero-model

D46. Admitted learned semantic method does not create handler registration.
D47. Admitted expert composition resolves only registered target-local expert contracts.
D48. Promotion operation cannot widen capability/authority ceiling.
D49. Imported source admitted LAC remains target candidate until local admission.
D50. Known symbolic experience → exact candidate validation → local promotion decision → selection executes with providers disabled and model_calls=0.

Repository ownership

prolog-rlm

Own:

  • EPOCH/CITADEL/PACT/CLOCKWORK schemas and validation semantics;
  • candidate-kind evaluation profile selection;
  • exposure/independence query semantics;
  • exact-symbolic/counterexample/statistical promotion decision logic;
  • summable statistical risk-budget policy;
  • safe-improvement/hold semantics;
  • LAC normalization/schema + attestation predicate semantics;
  • crash-safe promotion transition contract over a storage adapter;
  • expert/planner/VERIFY/Repair/Review integration;
  • deterministic conformance definitions in #395.

Reuse existing rlm_async / #288 for latency-bearing evaluation. Do not create a learning scheduler.

symbolic-memory

Own:

  • durable experience/candidate/LAC/attestation/evidence-use/promotion/drift ledger;
  • direct dependence/exposure indexes and generation-keyed closure caches;
  • append-only lifecycle/frontier/replay;
  • reverse dependency invalidation;
  • persistent risk-budget/evaluation receipts where configured;
  • transfer/cache generations;
  • implementation/failure-injection/scale benchmarks.

The newly created library-first implementation graph #11/#16/#33-#36/#43 is the natural landing zone; existing #6/#7/#9/#10 remain canonical semantic-memory domain contracts.

Concrete canonical deltas

  1. #404 should be reconciled to EPOCH → CITADEL-EPOCH → PACT-EPOCH → CLOCKWORK-EPOCH, mark A/B/C/D design-complete, and close for design completion only.
  2. #397 should mark Depth 7 design-complete and authorize #405A only.
  3. #395 should add D1-D50 as learning/promotion/transfer conformance direction; deterministic replay and zero-model fixtures are mandatory.
  4. #384 promotion evidence must bind immutable EvaluationSnapshot/Frozen-Spec/verifier/metric fingerprints; VERIFY itself is not the statistical promoter.
  5. #385 diagnostic labels feed experience relevance but cannot mutate evaluation outcomes after snapshot freeze.
  6. #386 counterexample generation records generator/profile/seed/bounds and cannot label bounded search exhaustive.
  7. symbolic-memory#16/#35/#36 should implement direct-graph + exact closure, immutable EvaluationSnapshots, risk-ledger/promotion receipts, drift epochs and CAS-style lifecycle events.
  8. symbolic-memory#43 should include cold/warm/rebuilt/incremental learned-state differential tests plus retraction/promotion race/crash injection.
  9. PACT privacy overlap v1 is conservative: shared-domain opaque/keyed origin group identifiers when configured; otherwise unknown; no mandatory PSI/OPRF dependency.

Unresolved questions reserved for Depth 8 synthesis

  • exact first SWI-Prolog module split/API names for CLOCKWORK evaluation profiles;
  • whether statistical confidence-sequence implementation should be native Prolog, an audited library adapter, or a small trusted numeric component;
  • exact numeric determinism profile for cross-platform statistical replay;
  • backend/index choice and measured threshold for adopting DBSP/differential-style incrementalization;
  • first production trust-root/key-management integration for DSSE/LACs;
  • whether Depth-8 v1 requires a DP reusable-holdout profile or fresh-stream accounting is sufficient;
  • benchmark-derived graph/closure/counterexample/task-stream resource defaults;
  • whether any current implementation evidence already satisfies a subset of D1-D50 (must be proven in #405, not assumed here).

Completion statement

Depth 7D is design-complete only. This research defines executable algorithms, state transitions and falsifiable fixtures but does not claim they are implemented or that Machine Spirit exists.

After canonical reconciliation, the exact next legal research work is Depth 8 / #405A — baseline cross-depth synthesis and minimum Machine Spirit v1 architecture/conformance graph. #405B/C/D remain blocked until A completes.

## Machine Spirit #404D — computational realization / scaling / deterministic conformance **Status: D COMPLETE — Depth 7 ready for reconciliation.** This pass makes EPOCH + CITADEL + PACT executable as a bounded, replayable **learning-control dataflow** over the existing runtime. It does **not** introduce a second scheduler, a second authority plane, or a generic scalar-reward loop. Preferred architecture: **CLOCKWORK-EPOCH — Conformance-Locked, Ordered, Crash-safe Knowledge-Workflows for Replayable EPOCH**. ```text immutable experiences / foreign LACs / source attestations ↓ canonical typed learning ledger ↓ versioned direct dependence + exposure graph ↓ rebuildable exact indexes / query-scoped closures ↓ candidate freeze + immutable EvaluationSnapshot ↓ ┌─────────────────────────────────────────────┐ │ exact symbolic / exhaustive finite checks │ │ bounded property/counterexample campaigns │ │ paired sequential safe-improvement checks │ │ optional logged-data/OPE profile │ └─────────────────────────────────────────────┘ ↓ hard guards + contamination + transfer validity ↓ conditional promotion commit against dependency generations ↓ admitted | held | quarantined | resource_limited ↓ post-admission structural + statistical drift watches ↓ suspend / supersede / retract as append-only events ``` ### Research questions 1. How can candidate exposure/dependence be queried at scale without global exponential closure or false claims of independence? 2. What byte-level identity/signature contract makes PACT LACs replayable across implementations? 3. How should repeated adaptive candidate evaluation consume statistical error budget? 4. What concrete promotion algorithms apply to exact symbolic rules versus empirical strategy/control policies? 5. How should counterexample search report exhaustive versus bounded coverage? 6. How do drift, calibration, target-transfer and source retraction incrementally invalidate learned objects? 7. What state machine prevents promotion races/crashes from producing half-admitted knowledge? 8. What differential/concurrency fixtures are required before Depth 7 can be called computationally coherent? ## Primary evidence used - Dwork, Feldman, Hardt, Pitassi, Reingold & Roth, **The Reusable Holdout: Preserving Validity in Adaptive Data Analysis**, *Science* 349(6248), 2015. DOI `10.1126/science.aaa9375`. Shows ordinary holdout reuse is invalid under adaptive analysis and gives a principled reusable-holdout construction. - Dwork et al., **Preserving Statistical Validity in Adaptive Data Analysis**, STOC 2015; and **Generalization in Adaptive Data Analysis and Holdout Reuse**, NeurIPS 2015. Formalize adaptivity/data reuse as part of the statistical contract. - Howard, Ramdas, McAuliffe & Sekhon, **Time-uniform, nonparametric, nonasymptotic confidence sequences**, *Annals of Statistics* 49(2), 2021, DOI `10.1214/20-AOS1991`. Confidence sequences remain valid uniformly over time and support optional stopping under their assumptions. - Ramdas, Grünwald, Vovk & Shafer, **Game-Theoretic Statistics and Safe Anytime-Valid Inference**, *Statistical Science* 38(4), 2023. Formalizes e-process / anytime-valid inference under continuous monitoring. - Thomas, Theocharous & Ghavamzadeh, **High-Confidence Off-Policy Evaluation**, AAAI 2015. Gives lower-confidence-bound off-policy evaluation from logged trajectories under its support/statistical assumptions. - Laroche, Trichelair & Tachet des Combes, **Safe Policy Improvement with Baseline Bootstrapping**, ICML 2019. Gives high-probability baseline-safe improvement guarantees for the finite-MDP Batch-RL setting; useful only for that declared profile, not as a generic self-improvement theorem. - Claessen & Hughes, **QuickCheck: A Lightweight Tool for Random Testing of Haskell Programs**, ICFP 2000. Property/generator-based counterexample search. - Runciman/Naylor/Lindblad, **SmallCheck and Lazy SmallCheck**, 2008. Exhaustive testing up to a declared finite depth. - de Moura & Bjørner, **Z3: An Efficient SMT Solver**, TACAS 2008. Representative decidable/formula-based counterexample and constraint checking. - Zeller & Hildebrandt, **Simplifying and Isolating Failure-Inducing Input**, IEEE TSE 28(2), 2002. Delta debugging/minimization of witnessed failures. - Bifet & Gavaldà, **Learning from Time-Changing Data with Adaptive Windowing**, SDM 2007. ADWIN gives stream-change detection with false-positive/false-negative bounds under its model and supports efficient adaptive windows. - Gupta, Mumick & Subrahmanian, **Maintaining Views Incrementally**, SIGMOD 1993. Classical incremental materialized-view maintenance. - McSherry, Murray, Isaacs & Isard, **Differential Dataflow**, CIDR 2013. Demonstrates efficient incremental maintenance for nested iterative computations/graph algorithms. - Budiu, Chajed, McSherry, Ryzhyk & Tannen, **DBSP: Automatic Incremental View Maintenance for Rich Query Languages**, PVLDB 16(7), 2023. Provides a general incrementalization model for rich queries including recursive forms. - RFC 8949, **CBOR**, December 2020, especially deterministic encoding requirements. - RFC 8785, **JSON Canonicalization Scheme**, June 2020, as a JSON-facing interoperability option. - DSSE specification: signs `PAE(payloadType,payload)` and intentionally authenticates exact payload bytes/type rather than relying on application reserialization. - in-toto Attestation Framework v1: typed Statement layer with immutable subject digests + `predicateType`. - RFC 9497, **OPRFs**, December 2023, reviewed as a basis for future privacy-preserving origin matching; not required for v1. ## Candidate computational architectures ### Candidate 1 — one global learned-state table + mutable scores Maintain current candidate rows, a scalar score, flattened holdout status, and periodically overwrite `admitted=true/false`. **Rejected.** It destroys historical replay, cannot represent source/causal dependence, makes adaptive holdout leakage invisible, has no principled crash/race semantics, and turns heterogeneous guarantees into one score. ### Candidate 2 — fully materialized global provenance/exposure closure + universal statistical promoter Materialize transitive closure between every source/candidate/evaluator/fixture, feed every candidate through one statistical safe-improvement evaluator, and globally union equivalent origins. **Rejected.** Closure can be O(V²) or worse in dense graphs; ATMS/provenance environments can explode; irreversible union-find-style merges are wrong under retraction/versioned identity; many symbolic candidates have exact finite proof obligations rather than stochastic performance semantics; statistical evaluation cannot manufacture a theorem for semantic correctness. ### Candidate 3 — event-only ledger with full recomputation on every decision Persist only immutable events and recompute all exposure, evaluation and transfer state from genesis on every promotion. **Semantically clean but rejected as the normal execution model.** It remains the correctness oracle/rebuild path, but ordinary operation requires exact rebuildable indexes and dependency-directed incremental maintenance. ## Preferred — CLOCKWORK-EPOCH ### 1. Canonical learning ledger is append-only; indexes are disposable Canonical durable objects/events include: ```prolog meta_experience(...). meta_candidate(...). meta_evidence_use(...). meta_dependence_edge(...). meta_lac(...). meta_attestation(...). meta_evaluation_snapshot(...). meta_evaluation_observation(...). meta_counterexample_receipt(...). meta_promotion_event(...). meta_drift_event(...). meta_transfer_assessment(...). ``` Current candidate state, exposure closures, strategy summaries, validation eligibility and transfer caches are **rebuildable derived views**. This follows the same canonical-vs-derived rule already established by #402/SAFIRE and symbolic-memory#6. ### 2. Exposure/dependence graph: direct facts canonical, closure query-scoped Use typed nodes such as: ```text candidate / ancestor candidate experience source/span/semantic record fixture/test population verifier/evaluator/metric learner/model artifact baseline trust root ontology/translation runtime/environment epoch ``` and typed directed/undirected relations such as: ```text derived_from exposed_to trained_on selected_on evaluated_on shares_origin copied_from translated_via attested_by depends_on ``` Maintain exact adjacency indexes in both directions. **Do not require global transitive-closure materialization.** A candidate's exposure closure is computed by bounded graph traversal from a frozen candidate/version and evidence frontier. Cache the normalized closure/interface digest against graph generation. Direct-edge changes invalidate only descendants/dependents known by reverse indexes. Worst-case exact traversal remains `O(V+E)` over the reachable subgraph. Incremental/cache maintenance is workload optimization, not a stronger guarantee. Important accelerator rule: ```text Bloom/probabilistic index may prove "possibly exposed" Bloom/probabilistic index may NOT prove independence ``` A negative independence claim requires complete exact closure for the declared graph/profile. Missing/hidden provenance yields `independence=unknown`, never true. Do not use irreversible DSU/union-find as canonical source-dependence truth. Active dependence equivalence/components are versioned rebuildable views because origin/identity mappings can be retracted/superseded. For larger workloads, semi-naive/incremental view maintenance is the first implementation step. Differential-dataflow/DBSP-style machinery is optional if measurements justify nested incremental graph maintenance; no second universal runtime is required for v1. ### 3. LAC byte identity + attestation verification Define a closed **LAC v1 typed data model** first. Reject cyclic/non-ground objects and unknown critical schema/profile fields. Preferred cross-language canonical payload: ```text normalized LAC v1 -> RFC 8949 deterministic CBOR profile -> payload bytes -> SHA-256 domain-separated artifact fingerprint ``` Conceptually: ```text lac_fp = SHA256("machine-spirit-lac/v1\0" || deterministic_cbor(LAC)) ``` For JSON-only boundaries, RFC 8785 JCS is an allowed adapter fingerprint profile, but it is not silently considered byte-identical to CBOR. Exact numeric/rational semantics must be explicit; security-sensitive fingerprints should not depend on ambiguous host floating-point serialization. Attestation transport: ```text in-toto Statement subject digest = lac_fp predicateType = versioned Machine Spirit predicate URI predicate = source promotion/verify/calibration/etc receipt optional DSSE envelope signs exact payload bytes + payloadType ``` DSSE is preferred for signatures because PAE binds exact payload bytes and content type, avoiding reserialization confusion. Verification returns distinct fields: ```text signature_valid issuer_identity key/trust_root_generation predicate_schema_valid semantic_claim_status local_policy_acceptance ``` A valid signature never sets `semantic_claim_status=verified` by itself. ### 4. Candidate freeze and immutable EvaluationSnapshot Before validation evidence is consumed, freeze: ```prolog meta_evaluation_snapshot( SnapshotId, CandidateFingerprint, CandidateExposureFrontier, BaselineFingerprint, TaskPopulationRef, SemanticAndEnvironmentEpoch, FrozenSpecFingerprint, VerifierFingerprint, MetricContracts, HardGuards, ValidationOriginPolicy, StatisticalRiskLedgerRef, CounterexampleProfile, TransferAssessmentRefs, TrustRootGeneration, ResourceBounds, ReplaySeedOrStreamRef, DependencyGenerations, SnapshotFingerprint). ``` Evaluation observations cite this snapshot exactly. A candidate/descendant exposed to an observation cannot later reclassify it as fresh validation. ### 5. Three primary evaluation profiles + one specialized profile #### `exact_symbolic` Use for finite/decidable symbolic rules, procedure invariants, schema contracts, capability boundaries and equivalent deterministic properties. Mechanisms: - Prolog exhaustive enumeration over declared finite domain; - CLP/SMT where the admitted fragment gives a complete decision procedure; - exact differential/reference checks. Only this class may report `coverage=exhaustive` when the declared domain/solver fragment is actually exhaustive/complete. #### `bounded_counterexample` Use property generators, SmallCheck-style finite-depth enumeration, QuickCheck-style seeded generators, bounded model/constraint search, and delta-debug/shrinking of found failures. Receipt contains: ```text generator/version seed search space/depth/bounds cases explored coverage class counterexamples + minimized witness stopping reason ``` Hard rule: ```text no counterexample found under bound != proof of correctness ``` #### `paired_sequential_improvement` Default empirical promotion profile when candidate and admitted baseline can both be evaluated on the same fresh target-task stream. For each target task `i`, compute a predeclared bounded utility delta: ```text D_i = U(candidate,i) - U(baseline,i) ``` where utility components/weights are fixed by the metric contract and catastrophic hard guards remain separate rather than averaged into utility. Use a time-uniform confidence sequence (empirical-Bernstein or another declared valid CS) for mean delta. Promotion requires: ```text lower_confidence_bound(Delta) > required_margin AND all hard guards pass AND exposure/independence policy passes AND minimum coverage/task classes pass ``` Optional stopping is allowed only because the selected CS/e-process profile explicitly supports it. Repeated adaptive candidate families consume a **precommitted summable risk allocation**. Simple v1 family-wise profile: ```text alpha_n = alpha_family * 6 / (pi^2 * n^2) ``` assigned before candidate `n` consumes validation data, so `sum alpha_n <= alpha_family`. Each candidate's sequential interval uses its allocated `alpha_n`. This is deliberately conservative but auditable; richer e-value/FDR policies can be separate named profiles rather than implicit upgrades. The guarantee applies only when the candidate is frozen before its fresh validation stream and the declared CS assumptions hold. If these conditions fail, the receipt is weakened/invalidated rather than silently reused. #### `logged_off_policy` — optional/specialized Only for strategy/control policies where logged-action propensities/support and required statistical assumptions are actually available. High-confidence OPE lower bounds may be used. If support/propensity requirements are missing, return `unsupported/hold`. SPIBB-style guarantees are restricted to an explicitly declared compatible finite-MDP/batch-RL profile. They are **not** the default theorem for arbitrary Prolog expert selection. ### 6. Reusable holdout policy: no magical forever-holdout in v1 Dwork et al. prove adaptivity must be part of the validation mechanism. CLOCKWORK therefore does not implement `hidden=true` as a validity guarantee. V1 default: - exact exposure/reveal accounting; - candidate freeze before validation; - fresh validation stream/origin groups for empirical promotion; - summable sequential error budget; - exposed failures migrate to generation/selection evidence for descendants. A differential-privacy reusable-holdout mechanism may be added as a named future evaluation profile with its own privacy/validity budget. It is not silently approximated. ### 7. Concrete safe-improvement policy Promotion is candidate-kind specific. ```text symbolic theorem/invariant -> exact_symbolic required semantic/procedure candidate -> exact structural/profile checks + counterexample campaign empirical strategy selector -> paired sequential improvement logged control policy -> optional OPE/SPI profile foreign learned artifact -> target transfer assessment + applicable local profile above ``` If evidence cannot establish improvement over the admitted baseline, the action is **hold**, not "best observed wins". Hard-guard classes remain zero-tolerance regardless of average utility: ```text authority/capability escalation Frozen-Spec mutation verifier/evaluator tampering unsafe effect boundary bypass replay/integrity corruption source/validation laundering ``` ### 8. Drift and calibration are epoch/dependency scoped An admitted learned object's active applicability is bound to an evaluation epoch including at least: ```text task population/distribution semantic/profile/schema generation runtime/environment/tool-binding generation verifier + metric contract identity/dependence generation source/evidence frontier transfer/translation generation calibration/drift profile ``` Structural generation changes are deterministic invalidators and can immediately require reevaluation/suspension according to policy. For numeric streaming performance/error drift, ADWIN is an admissible detector profile because it supplies explicit statistical guarantees under its model. It is **not** a semantic-drift oracle. Store detector version/config/input stream ordering and decision receipt so replay can reproduce the decision. A detector observation may create `drift_suspected`; policy decides whether confirmation is required. A hard incompatible environment/verifier/schema change may directly make an admission `stale/inapplicable` without waiting for statistical detection. ### 9. Privacy-preserving origin overlap — conservative v1 decision V1 does **not** require general cross-organization PSI/OPRF infrastructure. Within one configured trust/federation domain, allow privacy-scoped opaque `origin_group_id` or keyed commitments generated by a trusted origin service. Never expose raw private fixture IDs and never use unsalted/public hashes of low-entropy private identifiers as a privacy mechanism. Across trust domains where a shared comparison mechanism is absent: ```text origin_overlap = unknown independence = unknown ``` not independent. RFC 9497 VOPRF/POPRF or a dedicated PSI protocol is a legitimate later mechanism for privacy-preserving equality/intersection checks, but adding one requires its own threat model/key lifecycle and must not be smuggled into v1 merely to avoid returning `unknown`. ### 10. Incremental invalidation graph Promotion/transfer caches depend on explicit generations: ```text candidate payload/ancestry exposure/dependence graph source lifecycle validation evidence verifier/evaluator/metric policy baseline semantic/profile/schema identity mappings trust roots/keys LAC translator runtime/environment calibration/drift epoch ``` Reverse dependency indexes identify impacted candidates/transfers. Recompute only affected nodes. Propagation may stop if a recomputed normalized interface digest is unchanged. This mirrors #402D/#403D: direct generation/delta invalidation first; DBSP/differential-style general incrementalization only after workload evidence. ### 11. Crash-safe promotion lifecycle Promotion is a conditional append-only state transition, not a mutable flag. Conceptual API: ```prolog meta_promotion_evaluate(+Candidate, +Snapshot, +Options, -DecisionReceipt). meta_promotion_commit(+Candidate, +ExpectedLifecycleVersion, +EvaluationSnapshotFingerprint, +ExpectedDependencyGenerations, +DecisionReceipt, -Outcome). ``` Commit atomically appends the promotion event only if: - candidate lifecycle version still matches; - EvaluationSnapshot still resolves exactly; - all declared dependency generations still match; - receipt/policy/verifier fingerprints match; - authority for the *promotion operation* is present. Otherwise return `stale_evaluation` / `conflict` and do not admit. No promotion transaction changes host capability/authority or executable handler registration. ### 12. Deterministic race semantics Important source-retraction/evaluation race: ```text Case A: retraction commits first -> source generation changes -> promotion CAS fails stale_evaluation Case B: promotion commits first -> admission is historically valid at its exact cut -> later retraction invalidates dependent current admission -> append suspension/invalidation event ``` Both produce a current state in which the candidate is not silently active, while preserving the actual historical order. Wall-clock timestamp is not the arbiter; canonical ledger/frontier order and dependency generations are. Concurrent duplicate promotion requests use candidate/version + snapshot fingerprint idempotency. Same key/same digest returns same logical transition; same key/different digest is conflict. ### 13. Explainability/replay receipt Every active learned selection can resolve: ```text candidate + exact version origin experiences learner/profile exposure/dependence closure digest validation evidence + role counterexamples / coverage baseline and safe-improvement receipt promotion policy/version LAC/attestation/transfer chain where foreign current drift/calibration epoch suspension/supersession history runtime binding/authority decision separately ``` Exact historical replay requires retained nondeterministic observations/model artifacts. Re-running a remote model/evaluator later is a new observation lineage, not exact replay. ## Complexity / scaling implications - direct evidence/dependence edge append/index: expected backend index `O(log N)` or backend-specific equivalent; - exact query-scoped exposure closure: worst-case `O(V+E)` reachable graph, with generation-keyed memoization; - materialized global transitive closure: explicitly **not required** because dense worst-case storage approaches `O(V²)`; - counterexample enumeration: inherently profile/search-space dependent; exponential/combinatorial cases must report work/depth/case ceilings; - paired sequential evaluation: `O(1)` incremental summary per metric per observation for standard streaming CS implementations, plus retained audit samples/refs per policy; - drift monitor: detector-specific; ADWIN-style implementations are stream-oriented and designed for bounded adaptive windows; - incremental invalidation: proportional to actual affected dependency subgraph in the intended common case, with full rebuild as correctness oracle; - cryptographic fingerprint/signature verification: linear in canonical payload size plus signature primitive cost; - no million/billion-record performance claim until implementation benchmarks. ## Epistemic / provenance implications - Statistical evidence proves only the declared empirical property under its assumptions; it does not turn operational utility into semantic truth. - Cryptographic attestation proves statement integrity/issuer according to key policy, not truth. - Exact symbolic proof is profile/domain scoped; it does not imply transfer to a changed theory/environment. - `independence=unknown` is a first-class valid result. - Historical admission is preserved even when current admission is suspended. - Candidate evaluation and final runtime authority remain separate proof trees. ## Adversarial/failure review CLOCKWORK explicitly fails closed on: 1. forged or wrong-type LAC attestation; 2. alternate byte encodings producing fingerprint disagreement; 3. unknown critical schema field/version; 4. dependence edge hidden after candidate freeze; 5. Bloom-filter negative incorrectly offered as independence; 6. source-copy fanout offered as corroboration; 7. exposed validation failure reused for descendant validation; 8. repeated optional stopping using ordinary fixed-time intervals; 9. candidate-family p-value fishing without family budget; 10. metric range/utility changed after snapshot; 11. baseline changed mid-evaluation; 12. candidate changes verifier/test generation; 13. bounded fuzz campaign claiming exhaustive safety; 14. SMT/CLP solver used outside declared complete fragment but labeled proof; 15. unknown OPE propensity/support accepted as safe improvement; 16. statistical drift detector treated as semantic-drift proof; 17. target transfer cache survives ontology/verifier/environment change; 18. trust-root/key rotation not invalidating attestation acceptance where policy requires it; 19. promotion/retraction race activates stale candidate; 20. crash after evaluation but before admission inventing admitted state; 21. crash after admission commit but before cache update losing durable admission; 22. current cache rebuilt from stale exposure graph; 23. remote re-evaluation masquerading as exact historical replay; 24. privacy-hidden origin automatically treated as independent; 25. foreign source approval bypassing target-local promotion; 26. promotion event widening capabilities/authority; 27. candidate payload resolving to unregistered executable Prolog; 28. asynchronous evaluator completion order changing normalized decision. ## Rejected alternatives - **one scalar reward/fitness:** loses hard guards, provenance and guarantee classes; - **ordinary p-values plus "stop when green":** invalid under optional stopping/adaptive reuse; - **one fixed hidden test suite forever:** adaptivity leaks it into training/selection; - **global DSU dependence truth:** irreversible under provenance correction/retraction; - **Bloom filter for independence:** false positives are tolerable as conservative hints, false semantic independence is not; - **global closure materialization:** unnecessary scaling risk; - **universal SPIBB/OPE promoter:** wrong semantics for symbolic theorem/rule/procedure candidates; - **general PSI/OPRF in v1:** too much crypto/key-governance surface for a feature whose safe fallback is `unknown`; - **re-run model to replay history:** false replay claim; - **promotion as handler registration:** collapses knowledge into authority. ## D conformance fixtures ### Canonicalization / attestation D1. Equivalent normalized LAC emits identical deterministic CBOR bytes/fingerprint. D2. Semantically different LAC emits different fingerprint. D3. Map/input serialization order cannot change LAC fingerprint. D4. Unknown critical LAC schema version is quarantined. D5. DSSE payloadType substitution invalidates signature verification. D6. Valid source signature + untrusted issuer does not become accepted source guarantee. D7. Trust-root rotation invalidates/reclassifies only dependent attestation views. ### Exposure/dependence D8. Ancestor candidate exposure propagates to descendant closure. D9. Source copy/paraphrase with explicit origin edge remains dependent. D10. Retracted mistaken dependence link changes current closure without destroying historical closure. D11. Missing private provenance returns independence `unknown`. D12. Probabilistic accelerator negative cannot produce `independent=true`. D13. Cold closure == cached closure for same graph generation. D14. One unrelated provenance edge update does not invalidate unrelated candidate closure. ### Adaptive/statistical evaluation D15. Candidate fixed before fresh validation can consume assigned alpha tranche. D16. Candidate exposed to validation result cannot reuse that result as fresh validation. D17. Sequential stopping at first LCB crossing preserves declared anytime-valid policy receipt. D18. Fixed-time interval used with optional stopping is rejected by profile validation. D19. Sum of allocated candidate-family alpha never exceeds family budget. D20. Candidate with positive mean proxy but failed hard guard is quarantined. D21. Candidate whose LCB never clears required margin remains held. D22. Baseline fingerprint changes mid-run -> stale evaluation. D23. Metric contract/range changes mid-run -> stale evaluation. D24. Unknown OPE support/propensity -> unsupported/hold, not promoted. D25. Exact finite symbolic candidate can promote without statistical sampling when exhaustive proof obligations pass. ### Counterexamples D26. Finite declared domain exhaustive enumeration reports `exhaustive` only after all cases checked. D27. Search hitting case/work/depth limit reports `bounded/resource_limited`. D28. Found property counterexample is retained with generator/seed/profile. D29. Shrinking/delta-debugging retains a witness that still reproduces the failure. D30. No bounded counterexample found never emits universal-correctness status. ### Drift/transfer D31. Structural verifier/schema/environment generation change invalidates dependent admission. D32. Numeric ADWIN-style drift observation is stored as detector-relative evidence, not semantic truth. D33. Confirmed material drift appends suspension; historical admission remains queryable. D34. Foreign transfer cache invalidates when translator/ontology/target verifier changes. D35. Source calibration receipt cannot satisfy target calibration after population epoch change. ### Crash/race/replay D36. Crash before promotion append -> no admitted state after restart. D37. Crash after durable promotion append but before projection/cache write -> rebuild restores admitted state. D38. Concurrent duplicate same transition is idempotent. D39. Same idempotency identity + different decision digest -> conflict. D40. Source retraction committed before promotion -> promotion stale/rejected. D41. Promotion committed before source retraction -> later append-only invalidation/suspension; current candidate inactive. D42. Different async evaluator completion permutations normalize to same decision for fixed evidence set/profile. D43. Cold rebuild == warm cache == cache-drop/rebuild == incremental current learned-state view for same exact frontier/generations. D44. Historical replay resolves exact candidate/policy/verifier/LAC versions originally used. D45. Live remote/model re-evaluation produces new observation lineage, not exact replay. ### Authority / zero-model D46. Admitted learned semantic method does not create handler registration. D47. Admitted expert composition resolves only registered target-local expert contracts. D48. Promotion operation cannot widen capability/authority ceiling. D49. Imported source `admitted` LAC remains target candidate until local admission. D50. Known symbolic experience → exact candidate validation → local promotion decision → selection executes with providers disabled and `model_calls=0`. ## Repository ownership ### `prolog-rlm` Own: - EPOCH/CITADEL/PACT/CLOCKWORK schemas and validation semantics; - candidate-kind evaluation profile selection; - exposure/independence query semantics; - exact-symbolic/counterexample/statistical promotion decision logic; - summable statistical risk-budget policy; - safe-improvement/hold semantics; - LAC normalization/schema + attestation predicate semantics; - crash-safe promotion transition contract over a storage adapter; - expert/planner/VERIFY/Repair/Review integration; - deterministic conformance definitions in #395. Reuse existing `rlm_async` / #288 for latency-bearing evaluation. Do not create a learning scheduler. ### `symbolic-memory` Own: - durable experience/candidate/LAC/attestation/evidence-use/promotion/drift ledger; - direct dependence/exposure indexes and generation-keyed closure caches; - append-only lifecycle/frontier/replay; - reverse dependency invalidation; - persistent risk-budget/evaluation receipts where configured; - transfer/cache generations; - implementation/failure-injection/scale benchmarks. The newly created library-first implementation graph #11/#16/#33-#36/#43 is the natural landing zone; existing #6/#7/#9/#10 remain canonical semantic-memory domain contracts. ## Concrete canonical deltas 1. #404 should be reconciled to **EPOCH → CITADEL-EPOCH → PACT-EPOCH → CLOCKWORK-EPOCH**, mark A/B/C/D design-complete, and close for design completion only. 2. #397 should mark Depth 7 design-complete and authorize **#405A only**. 3. #395 should add D1-D50 as learning/promotion/transfer conformance direction; deterministic replay and zero-model fixtures are mandatory. 4. #384 promotion evidence must bind immutable EvaluationSnapshot/Frozen-Spec/verifier/metric fingerprints; VERIFY itself is not the statistical promoter. 5. #385 diagnostic labels feed experience relevance but cannot mutate evaluation outcomes after snapshot freeze. 6. #386 counterexample generation records generator/profile/seed/bounds and cannot label bounded search exhaustive. 7. symbolic-memory#16/#35/#36 should implement direct-graph + exact closure, immutable EvaluationSnapshots, risk-ledger/promotion receipts, drift epochs and CAS-style lifecycle events. 8. symbolic-memory#43 should include cold/warm/rebuilt/incremental learned-state differential tests plus retraction/promotion race/crash injection. 9. PACT privacy overlap v1 is conservative: shared-domain opaque/keyed origin group identifiers when configured; otherwise `unknown`; no mandatory PSI/OPRF dependency. ## Unresolved questions reserved for Depth 8 synthesis - exact first SWI-Prolog module split/API names for CLOCKWORK evaluation profiles; - whether statistical confidence-sequence implementation should be native Prolog, an audited library adapter, or a small trusted numeric component; - exact numeric determinism profile for cross-platform statistical replay; - backend/index choice and measured threshold for adopting DBSP/differential-style incrementalization; - first production trust-root/key-management integration for DSSE/LACs; - whether Depth-8 v1 requires a DP reusable-holdout profile or fresh-stream accounting is sufficient; - benchmark-derived graph/closure/counterexample/task-stream resource defaults; - whether any current implementation evidence already satisfies a subset of D1-D50 (must be proven in #405, not assumed here). ## Completion statement Depth 7D is **design-complete only**. This research defines executable algorithms, state transitions and falsifiable fixtures but does not claim they are implemented or that Machine Spirit exists. After canonical reconciliation, the exact next legal research work is **Depth 8 / #405A — baseline cross-depth synthesis and minimum Machine Spirit v1 architecture/conformance graph**. #405B/C/D remain blocked until A completes.
Author
Owner

Depth-8 #405B cross-layer note (does not reopen Depth 7): AEGIS-MS generalizes CITADEL/CLOCKWORK contamination tracking beyond learned-candidate evaluation. When a learned candidate can influence retrieval, verifier/profile/metric/test/control selection used in a later Machine Spirit acceptance decision, that influence must appear in the end-to-end acceptance closure and may make the strong result circular/contaminated. #404's candidate freeze, exposure roles, independent evaluation and append-only lifecycle remain unchanged; #405 owns this cross-layer composition constraint.

Depth-8 #405B cross-layer note (does **not** reopen Depth 7): AEGIS-MS generalizes CITADEL/CLOCKWORK contamination tracking beyond learned-candidate evaluation. When a learned candidate can influence retrieval, verifier/profile/metric/test/control selection used in a later Machine Spirit acceptance decision, that influence must appear in the end-to-end acceptance closure and may make the strong result circular/contaminated. #404's candidate freeze, exposure roles, independent evaluation and append-only lifecycle remain unchanged; #405 owns this cross-layer composition constraint.
Author
Owner

Depth 8C cross-layer handoff — PACT remains intact

CONCORDAT-MS generalizes PACT's transfer rule across the full Machine Spirit federation boundary:

portable learned payload != portable promotion
foreign verifier/attestation != target appraisal
source calibration != target calibration

A foreign LAC now crosses through an explicit directional federation contract carrying semantic/profile mapping, provenance disclosure, source trust-root generation and target appraisal policy. It still lands as foreign_candidate|evidence_only|quarantined according to target policy; source admission cannot become target admission by signature/bridge composition.

This does not reopen Depth 7. It is a Depth 8 composition constraint feeding #405D conformance.

## Depth 8C cross-layer handoff — PACT remains intact CONCORDAT-MS generalizes PACT's transfer rule across the full Machine Spirit federation boundary: ```text portable learned payload != portable promotion foreign verifier/attestation != target appraisal source calibration != target calibration ``` A foreign LAC now crosses through an explicit directional federation contract carrying semantic/profile mapping, provenance disclosure, source trust-root generation and target appraisal policy. It still lands as `foreign_candidate|evidence_only|quarantined` according to target policy; source admission cannot become target admission by signature/bridge composition. This does **not** reopen Depth 7. It is a Depth 8 composition constraint feeding #405D conformance.
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
nsaspy/prolog-rlm#394
No description provided.