nsaspy/prolog-rlm

Fork 0

[EPIC][expert] Planner / coordinator expert: symbolic decomposition, expert assignment, and bounded replanning #419

New issue

Open

opened 2026-09-08 01:29:22 +00:00 by nsaspy · 7 comments

nsaspy commented

2026-09-08 01:29:22 +00:00

Owner

Parent: #376
Depends on: #377, #378
Integrates with: #288, #68–#71, #355
Research input: #397 #401A

Goal

Add a reusable Planner / Coordinator Expert that turns a Frozen Spec plus current evidence and admitted procedural knowledge into a validated dependency graph of typed goals/operations and assigns expert-owned work to appropriate registered experts.

The coordinator is symbolic first. It is not a second scheduler: #288 / the existing graph runtime remains authoritative for execution ordering, readiness, cancellation and aggregate bounds.

MACHINE-SPIRIT #401A refinement — procedure selection/decomposition before expert assignment

Depth 4A found that the previous planner contract compressed several distinct procedural roles into one generic decomposition oracle. Refine the normal path to:

Frozen obligation / compound task
        ↓
find applicable admitted procedural methods
        ↓
select method under explicit control/preference policy
        ↓
decompose method to typed partial-order task network
        ↓
validate network against Frozen Spec/context/resources
        ↓
compile admitted task network to #288 plan graph
        ↓
for expert-owned ready tasks: #377 expert selection
for #355 plan-native tasks: canonical plan-native path

Hard distinction:

method selection != expert selection
procedure/method knowledge != plan instance

An expert is a solver/knowledge source for a typed task. The procedural method says how an abstract task is decomposed and should remain reusable when expert implementations/versions change.

Known-method-first policy

For ordinary known work, prefer in order:

admitted exact/specific procedural method;
bounded method alternatives under explicit preference/control rules;
validated case-based adaptation proposal where configured;
bounded classical/operator search for a small procedural gap;
explicit model/generative decomposition fallback only when enabled.

Do not make free-form decomposition the default when reusable procedural knowledge already exists.

Procedural network semantics

Support task networks that preserve:

compound and primitive tasks;
partial ordering rather than forced total ordering;
preconditions/applicability;
data/causal dependencies;
resource/temporal constraints where supported;
expected postconditions/effects;
success/failure conditions;
alternatives/branches;
explicit recovery method refs;
provenance and method/version identity.

Predicted effects are planning semantics, not fresh observations and cannot satisfy #384 VERIFY by themselves.

Responsibilities

inspect the exact Frozen Spec and current project/evidence state;
derive unmet obligations and prerequisite observations;
normalize obligations into typed compound/primitive procedural tasks;
select/decompose admitted procedural methods where available;
preserve partial-order/dependency/resource relations;
build/repair dependency relations;
distinguish expert-owned reasoning goals from deterministic plan-native operations;
ask the canonical expert registry to select specialist experts only after task/method decomposition determines the work class;
validate capabilities/preconditions before execution;
accept typed method/procedure proposals from control rules, diagnostic repair, or CBR only through the same validation path;
replan after structured failure/unknown/blocked outcomes without weakening the Frozen Spec;
stop on success, blocked state, cancellation, exhausted bound or no progress.

Required routing semantics

sync_remote/run/index/delete -> plan-native per #355
edit/create                  -> Write Expert
project/source questions     -> Project Knowledge Expert
repository state/history     -> Git Expert
missing evidence/retrieval   -> Retrieval Expert
verification                 -> Verify Expert
failure diagnosis            -> Repair/Diagnosis Expert
adversarial final review     -> Review/Critic Expert

The mapping is resolved through the expert registry and applicability rules, not hard-coded trusted closures in model-authored plan data.

Symbolic planning

Use ordinary Prolog graph/search/constraint techniques where useful:

method applicability/unification;
HTN-like task decomposition;
dependency closure;
topological readiness;
best-first / priority work queues;
prerequisite and control rules;
cost/work ordering;
explicit unknown dependencies;
repeated-state/no-progress fingerprints;
plan validity against Frozen Spec;
bounded backtracking over method/expert/strategy alternatives;
bounded classical operator search only where policy admits it.

All decomposition/search needs explicit limits on method alternatives, network size, recursion/decomposition depth and work. Resource exhaustion returns a structured undecided/resource-limited outcome rather than arbitrary first-found success.

An LLM may optionally propose a decomposition for genuinely unmodeled tasks, but such output is inert candidate procedural/plan data and must pass the same closed vocabulary, dependency, SPEC, procedure, capability and authority validation.

Logical coordination-board integration

#401A adopts blackboard ideas only as typed shared coordination state, not a scheduler. The coordinator may consume/propose board entries such as:

goal / subgoal
observation / evidence_gap
hypothesis / diagnostic_conflict
method_candidate / plan_candidate
expert_proposal / repair_candidate
review_finding / blocked_reason

A board/proposal record is never automatically scheduled. The coordinator admits valid procedural/network changes into the #288 graph. #288 remains the only scheduler.

Replanning contract

A replan may:

add evidence-acquisition steps;
select another applicable method;
choose another applicable expert for an expert-owned task;
change dependency order where valid;
use a validated case-based adaptation proposal;
replace a failed strategy with another permitted strategy;
add diagnostic/repair work;
abandon a non-required branch with reason.

A replan may not:

delete a Frozen Spec obligation;
change the Frozen Spec fingerprint;
treat a procedural predicted effect as observed evidence;
widen capability/authority;
treat a failed verifier as success;
manufacture missing evidence;
promote a case/example into a trusted method/rule implicitly.

Acceptance

Deterministic fixture selects an admitted method and decomposes a Frozen-Spec obligation into a valid partial-order task network with zero model calls.
Method selection and expert selection are separately inspectable decisions.
The same method may bind to different compatible expert implementations without changing method identity.
Partial ordering survives compilation into #288 rather than becoming arbitrary total order.
Expert-owned goals resolve through #377 rather than embedded closures.
D6-11 operations stay plan-native and are rejected from expert assignment.
Predicted operator/postcondition data alone cannot satisfy current VERIFY evidence.
Missing expert/capability becomes structured blocked/unsupported state.
Failure causes a bounded valid replan while preserving the exact Frozen Spec fingerprint.
Replanning cannot drop an obligation.
Recursive method cycle is rejected/bounded before effect execution.
Method-alternative explosion respects explicit resource bounds and does not silently choose first result.
Case-based adaptation remains a candidate until normal procedural/network validation succeeds.
Repeated equivalent state triggers no-progress termination.
Cancellation prevents further scheduling/invocation.
Optional model-proposed decomposition is validated identically and separately metered.
Plan/method decision and expert assignment are explainable from facts, procedure provenance, dependencies and registry selection.

Non-goals

No second plan interpreter or scheduler.
No concrete filesystem/Git/process implementation.
No authority widening by planning.
No ambient unrestricted classical-plan search.
No automatic rule/method promotion from successful cases; #404 owns promotion policy.

Refs #376 #377 #378 #288 #355 #68 #69 #70 #71 #397 #401.

Parent: #376 Depends on: #377, #378 Integrates with: #288, #68–#71, #355 Research input: #397 #401A ## Goal Add a reusable **Planner / Coordinator Expert** that turns a Frozen Spec plus current evidence and admitted procedural knowledge into a validated dependency graph of typed goals/operations and assigns expert-owned work to appropriate registered experts. The coordinator is symbolic first. It is **not a second scheduler**: #288 / the existing graph runtime remains authoritative for execution ordering, readiness, cancellation and aggregate bounds. ## MACHINE-SPIRIT #401A refinement — procedure selection/decomposition before expert assignment Depth 4A found that the previous planner contract compressed several distinct procedural roles into one generic decomposition oracle. Refine the normal path to: ```text Frozen obligation / compound task ↓ find applicable admitted procedural methods ↓ select method under explicit control/preference policy ↓ decompose method to typed partial-order task network ↓ validate network against Frozen Spec/context/resources ↓ compile admitted task network to #288 plan graph ↓ for expert-owned ready tasks: #377 expert selection for #355 plan-native tasks: canonical plan-native path ``` Hard distinction: ```text method selection != expert selection procedure/method knowledge != plan instance ``` An expert is a solver/knowledge source for a typed task. The procedural method says how an abstract task is decomposed and should remain reusable when expert implementations/versions change. ### Known-method-first policy For ordinary known work, prefer in order: 1. admitted exact/specific procedural method; 2. bounded method alternatives under explicit preference/control rules; 3. validated case-based adaptation proposal where configured; 4. bounded classical/operator search for a small procedural gap; 5. explicit model/generative decomposition fallback only when enabled. Do not make free-form decomposition the default when reusable procedural knowledge already exists. ### Procedural network semantics Support task networks that preserve: - compound and primitive tasks; - partial ordering rather than forced total ordering; - preconditions/applicability; - data/causal dependencies; - resource/temporal constraints where supported; - expected postconditions/effects; - success/failure conditions; - alternatives/branches; - explicit recovery method refs; - provenance and method/version identity. Predicted effects are planning semantics, **not fresh observations** and cannot satisfy #384 VERIFY by themselves. ## Responsibilities - inspect the exact Frozen Spec and current project/evidence state; - derive unmet obligations and prerequisite observations; - normalize obligations into typed compound/primitive procedural tasks; - select/decompose admitted procedural methods where available; - preserve partial-order/dependency/resource relations; - build/repair dependency relations; - distinguish expert-owned reasoning goals from deterministic plan-native operations; - ask the canonical expert registry to select specialist experts only after task/method decomposition determines the work class; - validate capabilities/preconditions before execution; - accept typed method/procedure proposals from control rules, diagnostic repair, or CBR only through the same validation path; - replan after structured failure/unknown/blocked outcomes without weakening the Frozen Spec; - stop on success, blocked state, cancellation, exhausted bound or no progress. ## Required routing semantics ```text sync_remote/run/index/delete -> plan-native per #355 edit/create -> Write Expert project/source questions -> Project Knowledge Expert repository state/history -> Git Expert missing evidence/retrieval -> Retrieval Expert verification -> Verify Expert failure diagnosis -> Repair/Diagnosis Expert adversarial final review -> Review/Critic Expert ``` The mapping is resolved through the expert registry and applicability rules, not hard-coded trusted closures in model-authored plan data. ## Symbolic planning Use ordinary Prolog graph/search/constraint techniques where useful: - method applicability/unification; - HTN-like task decomposition; - dependency closure; - topological readiness; - best-first / priority work queues; - prerequisite and control rules; - cost/work ordering; - explicit unknown dependencies; - repeated-state/no-progress fingerprints; - plan validity against Frozen Spec; - bounded backtracking over method/expert/strategy alternatives; - bounded classical operator search only where policy admits it. All decomposition/search needs explicit limits on method alternatives, network size, recursion/decomposition depth and work. Resource exhaustion returns a structured undecided/resource-limited outcome rather than arbitrary first-found success. An LLM may optionally propose a decomposition for genuinely unmodeled tasks, but such output is inert candidate procedural/plan data and must pass the same closed vocabulary, dependency, SPEC, procedure, capability and authority validation. ## Logical coordination-board integration #401A adopts blackboard ideas only as **typed shared coordination state**, not a scheduler. The coordinator may consume/propose board entries such as: ```text goal / subgoal observation / evidence_gap hypothesis / diagnostic_conflict method_candidate / plan_candidate expert_proposal / repair_candidate review_finding / blocked_reason ``` A board/proposal record is never automatically scheduled. The coordinator admits valid procedural/network changes into the #288 graph. #288 remains the only scheduler. ## Replanning contract A replan may: - add evidence-acquisition steps; - select another applicable method; - choose another applicable expert for an expert-owned task; - change dependency order where valid; - use a validated case-based adaptation proposal; - replace a failed strategy with another permitted strategy; - add diagnostic/repair work; - abandon a non-required branch with reason. A replan may **not**: - delete a Frozen Spec obligation; - change the Frozen Spec fingerprint; - treat a procedural predicted effect as observed evidence; - widen capability/authority; - treat a failed verifier as success; - manufacture missing evidence; - promote a case/example into a trusted method/rule implicitly. ## Acceptance - [ ] Deterministic fixture selects an admitted method and decomposes a Frozen-Spec obligation into a valid partial-order task network with zero model calls. - [ ] Method selection and expert selection are separately inspectable decisions. - [ ] The same method may bind to different compatible expert implementations without changing method identity. - [ ] Partial ordering survives compilation into #288 rather than becoming arbitrary total order. - [ ] Expert-owned goals resolve through #377 rather than embedded closures. - [ ] D6-11 operations stay plan-native and are rejected from expert assignment. - [ ] Predicted operator/postcondition data alone cannot satisfy current VERIFY evidence. - [ ] Missing expert/capability becomes structured blocked/unsupported state. - [ ] Failure causes a bounded valid replan while preserving the exact Frozen Spec fingerprint. - [ ] Replanning cannot drop an obligation. - [ ] Recursive method cycle is rejected/bounded before effect execution. - [ ] Method-alternative explosion respects explicit resource bounds and does not silently choose first result. - [ ] Case-based adaptation remains a candidate until normal procedural/network validation succeeds. - [ ] Repeated equivalent state triggers no-progress termination. - [ ] Cancellation prevents further scheduling/invocation. - [ ] Optional model-proposed decomposition is validated identically and separately metered. - [ ] Plan/method decision and expert assignment are explainable from facts, procedure provenance, dependencies and registry selection. ## Non-goals - No second plan interpreter or scheduler. - No concrete filesystem/Git/process implementation. - No authority widening by planning. - No ambient unrestricted classical-plan search. - No automatic rule/method promotion from successful cases; #404 owns promotion policy. Refs #376 #377 #378 #288 #355 #68 #69 #70 #71 #397 #401.

nsaspy commented

2026-09-08 01:46:30 +00:00

Author

Owner

Machine Spirit #401B canonical handoff — monitored epistemic procedural policies

Depth 4B materially refines this coordinator contract. Treat this as required design input for the next body reconciliation/implementation slice.

Required additions

Evaluate procedural guards through #400 epistemic semantics, preserving satisfied/refuted/unknown/conflicted/blocked/unsupported; raw failure-to-prove is not universal false.
Distinguish hard_guard, observation_gate, branch_guard, explicit assumption, monitor_invariant, and success_condition.
Keep method_applicable != method_admissible != plan_instance_valid != action_authorized != action_ready.
Allow admitted methods to carry explicit nondeterministic guarantee classes (deterministic/weak/strong/strong_cyclic/best_effort) plus versioned fairness/environment assumptions. Strong-cyclic retry is not unconditional progress.
Add current-time/resource admission before effectful execution. Deadlines, durative invariants, resource capacity/calendars/leases, mutex and required-concurrency constraints are live validity conditions.
Compile only semantically safe concurrency: absence of an ordering edge is insufficient when causal/effect/resource/authority interference exists.
Maintain a bounded execution frontier over the current method/version, evidence generation, open tasks/observations, temporal/resource constraints, observed outcomes and exogenous events.
On new observations/events, re-evaluate affected guards/causal links/invariants and choose the smallest valid response: continue, declared contingent branch, discriminator, plan-instance repair, method reselection, or blocked/resource-limited.
Preserve four repair layers: dispatch/continuation repair; plan-instance repair; method reselection; inert method-defect/supersession candidate. Never mutate trusted method knowledge because one run failed.
Method preferences are typed/partial/scoped (specificity, safety, guarantee class, current feasibility, verified competence, reversibility, cost, validity), never silent clause/source order.
CBR adaptation must pass an explicit semantic compatibility contract; nearest-neighbor similarity cannot admit a procedure.

All admitted work still compiles to #288. This does not authorize a second scheduler or executor.

Full research/sources and B1-B28 adversarial fixtures: #401 Depth-4B comment.

## Machine Spirit #401B canonical handoff — monitored epistemic procedural policies Depth 4B materially refines this coordinator contract. Treat this as required design input for the next body reconciliation/implementation slice. ### Required additions - Evaluate procedural guards through #400 epistemic semantics, preserving `satisfied/refuted/unknown/conflicted/blocked/unsupported`; raw failure-to-prove is not universal false. - Distinguish `hard_guard`, `observation_gate`, `branch_guard`, explicit `assumption`, `monitor_invariant`, and `success_condition`. - Keep `method_applicable != method_admissible != plan_instance_valid != action_authorized != action_ready`. - Allow admitted methods to carry explicit nondeterministic guarantee classes (`deterministic/weak/strong/strong_cyclic/best_effort`) plus versioned fairness/environment assumptions. Strong-cyclic retry is not unconditional progress. - Add current-time/resource admission before effectful execution. Deadlines, durative invariants, resource capacity/calendars/leases, mutex and required-concurrency constraints are live validity conditions. - Compile only semantically safe concurrency: absence of an ordering edge is insufficient when causal/effect/resource/authority interference exists. - Maintain a bounded **execution frontier** over the current method/version, evidence generation, open tasks/observations, temporal/resource constraints, observed outcomes and exogenous events. - On new observations/events, re-evaluate affected guards/causal links/invariants and choose the smallest valid response: continue, declared contingent branch, discriminator, plan-instance repair, method reselection, or blocked/resource-limited. - Preserve four repair layers: dispatch/continuation repair; plan-instance repair; method reselection; inert method-defect/supersession candidate. Never mutate trusted method knowledge because one run failed. - Method preferences are typed/partial/scoped (specificity, safety, guarantee class, current feasibility, verified competence, reversibility, cost, validity), never silent clause/source order. - CBR adaptation must pass an explicit semantic compatibility contract; nearest-neighbor similarity cannot admit a procedure. All admitted work still compiles to #288. This does **not** authorize a second scheduler or executor. Full research/sources and B1-B28 adversarial fixtures: #401 Depth-4B comment.

nsaspy commented

2026-09-08 01:46:30 +00:00

Author

Owner

Machine Spirit #401C handoff — planner consumes admitted procedural projections

Depth 4C's PIFF result tightens the planner boundary:

planner may select native reusable procedural artifacts/methods through their versioned PSC/bridge contracts;
it must consume/compile only an execution-admitted host-specific projection into #288;
foreign Golog/ConGolog, Behavior Tree, BPMN/workflow or temporal-PDDL control semantics must not be silently flattened into a plan DAG;
unbound/unsupported/lossy/noncomposable semantics remain explicit;
expert-owned tasks bind by goal contract through #377, not persisted remote expert IDs;
procedure/role portability transfers no principal identity, capability or authority.

#288 remains the sole scheduler. Full research and C1-C28 interoperability fixtures are on #401; #401D owns incremental/scaling/runtime realization.

## Machine Spirit #401C handoff — planner consumes admitted procedural projections Depth 4C's PIFF result tightens the planner boundary: - planner may select native reusable procedural artifacts/methods through their versioned PSC/bridge contracts; - it must consume/compile only an **execution-admitted host-specific projection** into #288; - foreign Golog/ConGolog, Behavior Tree, BPMN/workflow or temporal-PDDL control semantics must not be silently flattened into a plan DAG; - unbound/unsupported/lossy/noncomposable semantics remain explicit; - expert-owned tasks bind by goal contract through #377, not persisted remote expert IDs; - procedure/role portability transfers no principal identity, capability or authority. #288 remains the sole scheduler. Full research and C1-C28 interoperability fixtures are on #401; #401D owns incremental/scaling/runtime realization.

nsaspy commented

2026-09-08 01:46:31 +00:00

Author

Owner

Machine Spirit #401D canonical handoff — DPEC execution semantics

Depth 4 is now design-complete. #401D selects DPEC — Demand-Driven Procedural Execution & Conformance Graph as the computational realization of PIF/MEPP/PIFF.

Planner/Coordinator implications:

demand-index candidate methods/PSCs/bridges before decomposition; do not scan/materialize the whole procedural theory;
preserve alternatives as a packed AND/OR + guard/constraint decomposition DAG/forest;
classify recursive HTN hierarchy cycles/search guarantees explicitly; a depth/work limit is a safety bound, not proof that no plan exists;
host-specific execution projections are versioned derived state keyed by procedure/PSC/bridge/binding/expert-registry/epistemic/resource-policy inputs;
invalidation follows actual dependencies and may stop only when the selected profile proves the observable projection/interface digest unchanged;
validate PSC/host projection compatibility before #288 admission;
absence of an ordering edge does not prove concurrency safety: causal/effect/resource/temporal/formalism constraints must admit overlap;
preserve source partial order; global optimal reordering/deordering/makespan is optional bounded optimization, not normal planning semantics;
MEPP monitors produce typed deltas consumed by replan/repair; they do not schedule independently;
return explicit resource_limited / incomplete-search status rather than arbitrary first-method success;
supported heterogeneous projections need formalism-specific reference/differential conformance receipts before being claimed semantics-preserving;
all executable work still compiles to #288 / rlm_plan; no second procedural interpreter/scheduler.

Fresh HTN research materially strengthens the cycle/verification requirements: Yousefi et al. ICAPS 2025 show A* can be incomplete even for totally ordered HTN problems due hierarchy-induced cycles (https://ojs.aaai.org/index.php/ICAPS/article/view/36107), while Lauer/Lin/Bercher ICAPS 2025 show lifted HTN verification/bounded existence complexity depends sharply on fragment restrictions (https://ojs.aaai.org/index.php/ICAPS/article/view/36102).

Full design + D1-D34 fixtures are preserved on #401.

## Machine Spirit #401D canonical handoff — DPEC execution semantics Depth 4 is now design-complete. #401D selects **DPEC — Demand-Driven Procedural Execution & Conformance Graph** as the computational realization of PIF/MEPP/PIFF. Planner/Coordinator implications: - demand-index candidate methods/PSCs/bridges before decomposition; do not scan/materialize the whole procedural theory; - preserve alternatives as a packed AND/OR + guard/constraint decomposition DAG/forest; - classify recursive HTN hierarchy cycles/search guarantees explicitly; a depth/work limit is a safety bound, **not proof that no plan exists**; - host-specific execution projections are versioned derived state keyed by procedure/PSC/bridge/binding/expert-registry/epistemic/resource-policy inputs; - invalidation follows actual dependencies and may stop only when the selected profile proves the observable projection/interface digest unchanged; - validate PSC/host projection compatibility before #288 admission; - absence of an ordering edge does not prove concurrency safety: causal/effect/resource/temporal/formalism constraints must admit overlap; - preserve source partial order; global optimal reordering/deordering/makespan is optional bounded optimization, not normal planning semantics; - MEPP monitors produce typed deltas consumed by replan/repair; they do not schedule independently; - return explicit `resource_limited` / incomplete-search status rather than arbitrary first-method success; - supported heterogeneous projections need formalism-specific reference/differential conformance receipts before being claimed semantics-preserving; - all executable work still compiles to #288 / `rlm_plan`; no second procedural interpreter/scheduler. Fresh HTN research materially strengthens the cycle/verification requirements: Yousefi et al. ICAPS 2025 show A* can be incomplete even for totally ordered HTN problems due hierarchy-induced cycles (https://ojs.aaai.org/index.php/ICAPS/article/view/36107), while Lauer/Lin/Bercher ICAPS 2025 show lifted HTN verification/bounded existence complexity depends sharply on fragment restrictions (https://ojs.aaai.org/index.php/ICAPS/article/view/36102). Full design + D1-D34 fixtures are preserved on #401.

nsaspy commented

2026-09-08 01:46:31 +00:00

Author

Owner

MACHINE-SPIRIT #404A handoff — learned procedural/control candidates

EPOCH makes the #401/#379 case boundary explicit for learning:

verified case / EBG result / ILP hypothesis
    -> candidate method/control rule
    -> #404 promotion receipt
    -> admitted semantic procedural/control knowledge
    -> ordinary #401 DPEC validation/admission
    -> #288 plan graph

A successful case never auto-registers a method. Learned strategy statistics may influence method-choice preference only as versioned operational evidence. Candidate/admitted learned methods must preserve exact origin experiences, assumptions, learner/profile, counterexamples, promotion policy/version and supersession state. Predicted learned postconditions remain non-observational and final success still belongs to #384 VERIFY.

Ref #404A EPOCH.

## MACHINE-SPIRIT #404A handoff — learned procedural/control candidates EPOCH makes the #401/#379 case boundary explicit for learning: ```text verified case / EBG result / ILP hypothesis -> candidate method/control rule -> #404 promotion receipt -> admitted semantic procedural/control knowledge -> ordinary #401 DPEC validation/admission -> #288 plan graph ``` A successful case never auto-registers a method. Learned strategy statistics may influence method-choice preference only as versioned operational evidence. Candidate/admitted learned methods must preserve exact origin experiences, assumptions, learner/profile, counterexamples, promotion policy/version and supersession state. Predicted learned postconditions remain non-observational and final success still belongs to #384 VERIFY. Ref #404A EPOCH.

nsaspy commented

2026-09-08 01:46:31 +00:00

Author

Owner

Machine Spirit #404B / CITADEL-EPOCH handoff

When learned method/control/strategy profiles affect planning, preserve the decision population and selection context so later promotion cannot mistake self-selected easy work for general improvement.

Required lineage should include applicable method alternatives, selection/control policy version, task/context signature, evidence generation, baseline/admitted method, chosen strategy and resulting VERIFY/diagnosis outcome.

Learned routing statistics remain operational evidence only. They cannot mutate Frozen Spec, drop difficult obligations, suppress evidence-acquisition branches, alter epistemic truth, or grant authority. If the candidate changes which tasks it sees, raw success-rate comparison is selection-biased until #404's evaluation profile resolves that bias. Refs #404B CITADEL B15-B20.

## Machine Spirit #404B / CITADEL-EPOCH handoff When learned method/control/strategy profiles affect planning, preserve the decision population and selection context so later promotion cannot mistake self-selected easy work for general improvement. Required lineage should include applicable method alternatives, selection/control policy version, task/context signature, evidence generation, baseline/admitted method, chosen strategy and resulting VERIFY/diagnosis outcome. Learned routing statistics remain operational evidence only. They cannot mutate Frozen Spec, drop difficult obligations, suppress evidence-acquisition branches, alter epistemic truth, or grant authority. If the candidate changes which tasks it sees, raw success-rate comparison is selection-biased until #404's evaluation profile resolves that bias. Refs #404B CITADEL B15-B20.

nsaspy commented

2026-09-08 01:46:31 +00:00

Author

Owner

Machine Spirit #404C handoff — target-local procedural admission

A procedure/method learned and admitted elsewhere is not automatically an admitted local method. #379 should consume foreign PACT-EPOCH artifacts only after target semantic/profile compatibility, #401 PSC/PIFF mapping and target promotion/admission checks.

source admitted method
  != target compatible
  != target admitted
  != expert bound
  != capability/authority admitted

Lossy ontology/action/guard mappings must weaken or invalidate transferred guarantees. External expert compositions remain declarative candidate task/goal contracts, never handlers. Full design: #404C.

## Machine Spirit #404C handoff — target-local procedural admission A procedure/method learned and admitted elsewhere is **not** automatically an admitted local method. #379 should consume foreign PACT-EPOCH artifacts only after target semantic/profile compatibility, #401 PSC/PIFF mapping and target promotion/admission checks. ```text source admitted method != target compatible != target admitted != expert bound != capability/authority admitted ``` Lossy ontology/action/guard mappings must weaken or invalidate transferred guarantees. External expert compositions remain declarative candidate task/goal contracts, never handlers. Full design: #404C.

nsaspy commented

2026-09-08 01:46:31 +00:00

Author

Owner

#405B AEGIS-MS planner handoff: evidence may influence method/plan/expert choices only through trusted closed selection policies whose identity/generation is in the run receipt. Model/source/learned plan data cannot choose authority policy, verifier policy, capability ceilings or trusted host bindings merely by supplying a valid identifier. Effectful plan nodes should carry expected target-binding/preimage dependencies for dispatch-time revalidation, but plan-time checks do not become durable authority. This preserves method selection != expert selection != effect authorization and #288 as sole scheduler.

#405B AEGIS-MS planner handoff: evidence may influence method/plan/expert choices only through **trusted closed selection policies** whose identity/generation is in the run receipt. Model/source/learned plan data cannot choose authority policy, verifier policy, capability ceilings or trusted host bindings merely by supplying a valid identifier. Effectful plan nodes should carry expected target-binding/preimage dependencies for dispatch-time revalidation, but plan-time checks do not become durable authority. This preserves method selection != expert selection != effect authorization and #288 as sole scheduler.