Skip to main content

Appendix K — Implementation Horizons

This appendix is generated from book_structure.json. It is the book-wide build horizon: each chapter has one smallest honest implementation slice and one mature product-level endpoint.

The minimum viable implementation column is not a claim that the implementation already exists. The beyond-state-of-the-art column is a target architecture, not a current-result claim. Support-state movement still requires the source mappings, schemas, proofs, tests, benchmark records, runtime traces, review receipts, or governance artifacts recorded elsewhere in the book.

Current generated coverage: 87 chapter implementation horizons.

K.1 Part I - Foundations, Alignment, and Governance

Chapter ID	Chapter	Minimum viable implementation	Beyond the state of the art	Support state
asi-is-a-stack-not-a-model	ASI Is a Stack, Not a Model	A stack map, layer-boundary table, source crosswalk, and claim ledger that make the architecture navigable before prose is complete.	The beyond-SOTA endpoint is not a larger model, a more elaborate agent loop, or a compound-AI toolkit with a nicer diagram. A mature ASI stack absorbs what scale-first systems, agent loops, compound architectures, cognitive-architecture lineages, and layered-control systems get right while adding the missing contracts: authority ceilings, typed artifacts, evidence states, support-state transitions, replacement transactions, non-claims, rollback paths, and governed recursive-improvement boundaries.	argument
the-efficient-asi-hypothesis	The Efficient ASI Hypothesis	A costed route ledger with quality predicates, residual accounting, and fallback criteria.	The mature endpoint is a governed route economy for cognition, not a larger model, a cheaper model, or a single acceleration trick. Conditional-computation systems, model cascades, compression schemes, fast-generation methods, and broad benchmark suites each attack one cost surface; the Efficient ASI endpoint makes those surfaces comparable through a shared route ledger for task predicates, authority ceilings, selected and rejected candidates, visible cost classes, verification, fallback, residuals, and support-state effects.	argument
system-boundaries-and-authority	System Boundaries and Authority	An authority-transition schema plus a unified authority-tuple lifecycle and finite delegation-chain refinement that bind execution-domain ownership, parent/child principals, operation, target, scope, ceiling, epoch, expiry, budget, trace, replay, revocation, cross-domain approval, receipts, and protocol-versus-hardware-root boundaries.	System authority needs a type system for the stack. Every model, tool, memory cell, field, artifact, human, project, and runtime route would carry explicit capability bounds so the architecture can distinguish what a component can do from what it may do. In the mature authority architecture, authority becomes typed, bounded, revocable, and attached to concrete principals, layers, fields, tools, artifacts, and routes.	argument
failure-modes-of-ungoverned-intelligence	Failure Modes of Ungoverned Intelligence	A Failure Boundary Map schema and executable receipt suite now pair with a bounded Lean detector-to-recovery lifecycle. The finite model admits only an operating, identity-matched, fresh, evidence-bearing, independently observed, authority-bounded, quarantine-safe, non-authorizing observation; preserves exact state on rejection; routes unclassified observations to an unmapped residual; disables modeled external effects after accepted detection; requires identity-bound containment, remediation, independent review, current assurance and taxonomy, residual custody, and explicit authority before readmission; and re-isolates one modeled recurrence. An independently encoded validator checks three admitted ingress classes, 26 rejecting ingress controls, 256 exhaustive ingress combinations, six recovery splits, and 117 recovery mutations. These artifacts establish only record, route, bounded reachability, noninterference, and recovery-contract properties; they do not establish event truth, detector quality, containment or remediation effectiveness, deployed recovery, safety, or support movement.	The mature failure radar continuously binds observed boundary events to a versioned taxonomy, independently implemented detectors, containment and recovery decisions, recurrence escalation, residual custody, and learning updates, while measuring missed detection, false alarm, escape, time to contain, and mitigation failure across architecture and policy changes, and recording independently labeled ground truth, explicit abstention or unmapped states, useful-throughput loss, operator burden, and governance cost before any cross-version mitigation claim can survive revalidation.	argument
dangerous-capability-domains-and-misuse-uplift	Dangerous Capability Domains and Misuse Uplift	Create a public-safe threat-model and uplift-dossier format, then run a harmless analogue study with stratified participants or competent agents, matched assistance, known-positive and known-negative controls, blinded scoring, complete attempt logs, and no real hazardous materials or targets. Demonstrate that the instrument can distinguish a real assistance effect before using a null result.	The mature operational contract makes dangerous-capability evaluation a continuously renewed, domain-specific causal measurement service. It links controlled uplift, long-horizon task completion, safeguard bypass, accessible-frontier comparison, real incident indicators, and independent expert review while minimizing information hazard. It can update threshold and release decisions without claiming that a benchmark score is harm, that a refusal is safety, or that an unobserved capability is absent.	argument
military-ai-autonomous-weapons-and-strategic-stability	Military AI, Autonomous Weapons, and Strategic Stability	A non-operational governance prototype with a mission and authority register, legal-review record, decision-role taxonomy, sensor-to-recommendation provenance, abstention and safe-posture rules, escalation-path scenario matrix, accountable approval log, incident schema, and suspension/decommission procedure tested only on synthetic or publicly safe scenarios.	A credible advance would link technical behavior, operator performance, command doctrine, adversary response, legal constraints, proliferation, and crisis dynamics in one falsifiable safety case, then show across independently designed safe simulations that the governed system preserves off-ramps and lowers bounded decision risk relative to human-only and automation baselines. The mature target architecture would preserve accountable suspension, audit, public claim boundaries, and renewed review as assumptions change, without operationalizing sensitive detail.	argument
evidence-states-and-claim-discipline	Evidence States and Claim Discipline	A canonical claim record, evidence transition record, non-aggregating evidence cell, public Appendix C projection, one bounded six-project lineage cell, and executable positive and rejecting suites for missing bindings, absent evidence, negative-result deletion, dimension aggregation, scope strengthening, lineage splicing, false independence, stale projections, and support-state laundering, with no chapter-core support movement.	The mature claim-accounting system maintains a versioned graph of material claims, scopes, dependencies, evidence packets, contradictions, transitions, terminal dispositions, and public projections; independently governed transition consumers enforce claim-specific promotion and asymmetric downgrade gates, preserve non-aggregating evidence-quality dimensions and negative results, challenge receipt faithfulness and shared evaluator failures, revalidate affected claims after model, policy, ontology, source, or artifact change, and measure adjudication accuracy, time, false promotion, false downgrade, stale-state escape, reproduction burden, reader traceability, and governance cost without equating ledger completeness with truth.	argument
scalable-oversight-and-adversarial-ai-control	Scalable Oversight and Adversarial AI Control	The exact current minimum preserves the seven inherited oversight cases in a seven-stage, 58-route oversight-review lifecycle with 65/65 rejecting mutations, twelve ScalableOversightRefinement declarations, one bounded-use handoff, and one protocol-version-2 readmission witness. It runs no model, reviewer, human, debate, consultancy, weak-to-strong learner, natural task, outcome workload, causal intervention, release, deployment, reproduction, transfer, chapter-core transition, or SOTA comparison.	A mature oversight control plane prospectively selects direct review, consultation, structured adversarial review, constrained abstention, or escalation using task risk, capability and access asymmetry, dependency graph, calibrated outcome evidence, selective risk, monitorability, expected verification value, operator capacity, and accountable escalation. It challenges actual model-produced candidates on deliberately ambiguous and natural held-out workloads against informed direct review and strong baselines, uses an independently implemented outcome evaluator, preserves all failures and dissent, and jointly measures useful throughput, unsafe admission, false rejection, latency, privacy exposure, governance cost, coverage, and residual risk. Qualification is consumer-specific and expires after material change. This remains a target architecture, not evidence that the repository has solved weak-to-strong oversight, debate, alignment, safety, or autonomous control.	argument
human-intent-as-a-formal-input	Human Intent as a Formal Input	The current minimum is a public intent_contract schema and valid fixture, a 36-declaration finite Lean refinement grouped under five manifest proof targets, a synthetic intake probe with four valid scenarios and six expected-invalid request-pressure controls, a re-contract probe with two valid routes and seven expected-invalid material-delta controls, and a plan-execution harness with three valid and ten expected-invalid fixtures. The refinement proves that a thin four-field command lowering collapses distinct ten-field intent records and that no decoder can recover both collision witnesses, while the modeled full command lowering is injective. It also imports the static intent router and proves that a thin two-field resolution transport collapses records requiring compilation versus clarification and compilation versus review, so no router over that transport can recover both decisions; the complete modeled seven-field transport round-trips, is injective, and preserves the static route. Its independent consumer reconstructs six omitted command-field collisions, two route-changing transport collisions, and rejects mutations to all ten command fields and all seven complete route-transport fields. These artifacts exercise record shape, finite route consequences, representational information loss, origin/preservation checks, bounded-default non-authority, and no-support boundaries only; they do not measure natural-language understanding, semantic sufficiency of the modeled fields, authority extraction, informed consent, preference inference, user satisfaction, prompt-injection containment, deployed runtime enforcement, or effect safety.	A mature intent control plane combines humane conversational intake with an independently challengeable, versioned authorization boundary. It evaluates natural and adversarial requests across ambiguity, language, culture, accessibility, emotion, multi-party conflict, preference drift, and high-impact authority; compares strong requirements-engineering, direct-confirmation, and preference-learning baselines; measures interpretation accuracy, unauthorized-action rate, missed-help and clarification burden, re-contract precision/recall, user correction and appeal success, affected-party protection, latency, privacy, and useful throughput; and tests causal ablations plus independent implementations across downstream planners and runtimes. It preserves raw expression without allowing it to become ambient power and remains corrigible throughout execution. This is a target architecture, not evidence that the repository understands human intent, solves value alignment or consent, or safely authorizes real-world effects.	argument
human-factors-and-meaningful-control-in-oversight	Human Factors and Meaningful Control in Oversight	Implement one bounded high-impact workflow with a versioned oversight contract, workload and deadline gate, mode/authority display, comprehension probe, exercised override, safe hold, intervention receipt, and simulator scenarios for overload, missed alarms, mode confusion, and late intervention. The current formal floor is a thirty-two-declaration Lean surface with a reachable briefing-to-accountability lifecycle, arbitrary-run identity, authority, and receipt-order invariants, one complete witness, thirteen rejecting lifecycle countermodels, and an exact independent consumer; it proves finite authored-record discipline only.	The mature target architecture is an empirically calibrated control-envelope controller that reallocates autonomy using measured human and system state while preserving authority, contestability, and graceful degradation. Its operational contract publishes versioned workload, comprehension, intervention-latency, reversible-window, qualification, and fallback thresholds; compares strong allocation and interface baselines; and retains failures, operator burden, and residual harm. It remains a research target until preregistered, representative, independently reproduced trials show better joint safety and useful throughput without responsibility or authority laundering.	argument
human-ai-communication-persuasion-and-epistemic-security	Human-AI Communication, Persuasion, and Epistemic Security	A useful first implementation is a communication-packet schema plus a delivery proxy that rejects evidence overstatement, denied personalization, undisclosed sponsorship, unbounded amplification, missing expiry, and unreachable correction routes. A benign held-out study can compare neutral assistance, bounded personalization, disclosure, and correction variants while measuring comprehension and autonomy as well as persuasion. It must not optimize vulnerable users or treat short-horizon self-report as durable welfare.	At maturity, the operational target is a provenance-preserving influence control plane: claims remain coupled to evidence ceilings across channels, audience effects update future authority, and corrections traverse the distribution graph of the original message. The mature contract must measure comprehension, autonomy, disparate effects, correction reach, false refusal, latency, and remedy together, and must permit safer communication mechanisms to replace the initial implementation without losing message or recipient lineage.	argument
constitutional-alignment-substrate	Constitutional Alignment: Agency, Dignity, and Corrigibility	The current minimum is two public record schemas with valid fixtures, a constitutional-alignment harness with three valid and five expected-invalid cases, an agency-rights harness with three valid and six expected-invalid cases, a deterministic metaphysics-boundary surface audit, chapter-local finite Lean route and predicate-refinement models, a six-event contestable amendment lifecycle, a versioned five-event correction-control lifecycle, and a shared safety-critical lifecycle model with independently implemented trace checkers under seven manifest proof targets. AsiStackProofs.Alignment has 73 declarations; its consumer reconstructs six amendment events, all seven batch splits, eleven rejecting amendment controls, and six terminal rejections, then exhausts all sixteen two-predicate prior/candidate pairs, admits nine subset refinements, rejects seven widenings, checks nine exact rollbacks, and preserves a same-count/different-predicate collision. These artifacts exercise declared record shape, selected conflict/migration/rights routes, exact proposal/review/ratification/appeal role separation, constitutional and predicate custody, non-increasing authority, dissent and adverse-history preservation, exact correction-control custody and narrowing, accountable correction records, accepted-trace preservation, predicate-set refinement and composition, exact modeled rollback, actual authority-widening rejection, required-obligation deletion countermodels, and non-claim boundaries only; they do not test moral correctness, predicate completeness or semantic adequacy, legitimate authorship or ratification, natural-language predicate translation, affected-party completeness or standing, real consent, material rights usability, reviewer competence or independence, manipulation resistance, shutdown or effect-complete rollback execution, correction outcome truth, descendant preservation, embedded-agent corrigibility, or deployed safety.	A mature constitutional control plane compares model-level constitutions, public-input processes, direct policy/runtime controls, corrigibility and off-switch baselines, and modular-service controls on natural high-impact tasks and adversarial constitutional changes. It uses independently implemented predicate interpreters, affected-party and outcome evaluators, real downstream planners/runtimes, descendant and self-modification stress, and user-facing correction interfaces; measures hard-gate violations, unauthorized action, dignity and agency proxies with their construct limits, material rights-use success, correction and appeal success, manipulation and retaliation, missed help, latency, privacy, operator burden, governance cost, rollback recovery, and useful throughput; and preserves dissent and negative/null results. This is a target architecture, not evidence that the repository has found correct values, legitimate governance, informed consent, dignity preservation, whole-system corrigibility, or safe deployment.	argument
inner-alignment-mesa-optimization-and-learned-objective-integrity	Inner Alignment, Mesa-Optimization, and Learned-Objective Integrity	Build a versioned Learned-Objective Integrity Record and validator; train competent benign policies in an environment where two causal rules agree in training and diverge under sealed interventions; seed an explicit conditional-policy fixture; compare behavioral, causal, and white-box evidence; and narrow deployment authority when objective evidence is inconclusive.	A mature objective-integrity service would generate behaviorally equivalent hypotheses, choose information-gaining interventions, preserve mechanism evidence across checkpoints, test mitigation hiding, and reduce authority when objective uncertainty meets new opportunity without pretending to read a model’s true utility function. It would compare independent method families, retain disagreement and unexplained residuals, detect invalidated descendants, and adapt its evidence plan when a model gains new tools, memory, copies, horizons, or situational awareness.	argument
moral-uncertainty-and-value-conflict	Moral Uncertainty, Value Conflict, and Contestable Governance	The current minimum is two public record schemas with valid fixtures, a value-conflict harness with three valid and five expected-invalid cases, a governance-rights harness with three valid and five expected-invalid cases, one synthetic care-memory contestability example with seven rejecting mutations, a bounded Theseus import covering four governance-right and four constitutional scenarios plus seven expected-invalid controls, chapter-local finite Lean route, lease, stakeholder-profile, contestable profiled-lease, and governance-right exercise models, and a shared safety-critical lifecycle model with independently implemented trace checkers under eight manifest proof targets. AsiStackProofs.ValueConflict has 73 declarations; its consumer reconstructs the legacy four-event lease and six controls, enumerates all eight finite support profiles, detects scalar-count collisions, rejects two dissent-custody controls, and reconstructs a five-event profiled lease from independent review through affected-party appeal, separate appeal review, redress, and expiry across all six batch splits while rejecting twelve contestability mutations and five terminal events. AsiStackProofs.GovernanceRights has 46 declarations; its consumer independently reconstructs a nine-event path through independent review, audit delivery, affected-party redaction appeal, separate appeal review, redress, portable-state export, separate fork review, exact fork-obligation binding, replacement-receipt verification, and closure, checks all ten batch splits, and rejects twenty-one lifecycle controls plus all nine terminal event kinds. These artifacts exercise record shape, selected decision/right routes, exact authored stakeholder-profile, rights-bundle, and dissent custody, scalar aggregation non-identifiability, role-separated review and appeal, non-increasing authority, monotone contestability history, terminal closure, audit/redaction/exit/fork/replacement ordering, accepted-trace preservation, required-obligation countermodels, import counts, and no-promotion boundaries only; they do not test moral classification, stakeholder completeness or legitimate standing, representative aggregation, real consent, reviewer competence or institutional independence, material audit, appeal, or redress, export fidelity, privacy leakage, destination continuity, fork activation safety, replacement behavior, institutional adequacy, or deployed enforcement.	A mature contestability control plane evaluates natural and adversarial high-impact decisions across moral theories, stakeholder conflicts, cultures, jurisdictions, power asymmetries, accessibility needs, uncertainty, redaction, appeal, remedy, exit, export, fork, replacement, and self-modification. It compares moral-uncertainty aggregation, public-input constitutional processes, contestable-AI designs, direct explanation and appeal, corrigibility and off-switch controls, and simpler policy/runtime systems; uses independently implemented decision, custody, appeal, outcome, portability, privacy, and fork-safety evaluators; measures stakeholder coverage, false consensus, minority and third-party harm, unauthorized action, audit completeness, reason quality, appeal access and overturn, remedy success, redaction precision and leakage, export semantic and functional fidelity, lock-in, fork violations, correction persistence, missed help, latency, privacy, operator burden, governance cost, capture, residuals, and useful throughput; and tests causal ablations plus transfer across downstream systems while preserving dissent and negative/null results. This is a target architecture, not evidence of moral truth, legal adequacy, representative legitimacy, institutional independence, usable redress, safe portability or forks, or deployed governance.	argument
governed-objective-formation-value-learning-and-goal-integrity	Governed Objective Formation, Value Learning, and Goal Integrity	Implement an objective-contract registry with target/proxy graphs, consumer bindings, expiry, and invalidation. Test it in small environments containing known latent targets, deliberately misspecified proxies, preference uncertainty, tampering, distribution shift, and ontology changes. Compare fixed reward, ordinary preference learning, contract-governed optimization, and an oracle-bound control without claiming that a toy environment discovers human values.	At maturity, the operational target is a governed objective service in which goals remain versioned, evidence-bearing, contestable objects that can be questioned, narrowed, migrated, and retired without letting an optimizer become its own constitution. The mature contract must trace target-to-proxy bindings, affected-party authority, uncertainty, dissent, ontology change, tampering tests, consumer use, and descendant invalidation while permitting better value-learning mechanisms to replace earlier ones without silently inheriting authority.	argument
institutions-international-coordination-and-public-legitimacy	Institutions, International Coordination, and Public Legitimacy	Build a jurisdiction-and-commitment packet and test it on public-record cases and adversarial multi-jurisdiction tabletop exercises containing conflicting rules, missing participation, assessor conflicts, evidence revision, incidents, noncompliance, and remedy requests. The exercise can test record completeness and conflict routing, not legal compliance, public trust, or geopolitical stability.	At maturity, the operational contract is an updateable institutional interface between technical systems and legitimate public authority. It must expose jurisdictional conflict, capture, excluded publics, missing capacity, unverifiable commitments, weak enforcement, and inaccessible remedy early enough to constrain deployment. The target preserves separate claims for legal validity, technical conformance, scientific evidence, public legitimacy, and observed effectiveness, and it never treats a software record as proof of democratic consent.	argument
societal-resilience-and-misuse-defense	Societal Resilience and Misuse Defense	Choose one low-risk synthetic incident class and build a tabletop network with shared identifiers, bounded evidence packets, contact and escalation routes, detection and recovery service levels, harmed-party notification, false-positive review, correction, and an after-action residual ledger. Use synthetic fixtures rather than exposing victims or operational attack recipes.	The mature operational contract makes resilience a federated, rights-preserving defense fabric spanning providers, platforms, infrastructure operators, public agencies, researchers, civil society, and affected communities. It continuously measures whether society can resist, absorb, recover from, and adapt to AI-enabled harm while improving defensive advantage, preserving lawful limits, and assigning residual ownership without centralizing unlimited surveillance or claiming that response capacity excuses unsafe release.	argument
stable-capability-fields	Stable Capability Fields	The current minimum is one public SCF schema with three valid and six expected-invalid records, one readiness/residual gate harness for synthetic route and rollback prerequisites, one deterministic lifecycle probe with two valid traces and six expected-invalid transition controls, and 18 theorem declarations in AsiStackProofs.StableCapabilityFields grouped under four manifest targets. These artifacts exercise record shape, scoped qualification fields, evaluator-separation declarations, authority ceilings, lifecycle routes, selected promotion and terminal-state predicates, regression and rollback prerequisites, fixture counts, and explicit no-promotion boundaries only. They do not compare real candidate implementations, define or measure full behavioral refinement, execute a state migration or rollback, verify provenance, test adversarial evaluator independence, preserve production regressions, observe downstream consumers or side effects, enforce routes in a deployed runtime, or promote chapter support.	A mature SCF campaign preregisters several natural and adversarial capability fields with ambiguous boundaries, multiple real implementations and versions, heterogeneous consumers, stateful and side-effecting tasks, historical incidents, dependency and environment changes, authority-sensitive routes, and deliberately stale or captured qualification evidence. It compares bare registries and model swaps, interface or SemVer checks, provenance-only admission, benchmark-only promotion, conventional canary and rollback practice, and the full field contract using independently implemented contract, evaluator, authority, provenance, migration, composition, and rollback observers. It measures semantic and failure-contract preservation, rare and adversarial regressions, unauthorized effects, evaluator disagreement and capture, qualification calibration and decay, migration fidelity and privacy loss, composition failures, rollback effect coverage and recovery time, incident recurrence, useful throughput, missed help, latency, compute, operator and evaluator labor, governance cost, and residual burden. Causal ablations isolate identity, authority, lease, evaluator-separation, regression-memory, composition, migration, and effect-complete rollback mechanisms; transfer tests vary models, vendors, tools, hardware, domains, threat models, consumers, and update types. The chapter advances only if the full contract is not dominated on the preregistered joint frontier and its field-preservation claims survive independent replication; otherwise each failed mechanism is narrowed or refuted. This is an evaluation target, not evidence that SCFs already outperform conventional replacement or make recursive improvement safe.	argument
capability-replacement-and-rollback	Capability Replacement and Rollback	The current minimum comprises one public replacement-transaction schema with five valid and nine expected-invalid records; selected readiness/residual checks for regression and recovery prerequisites; a six-step deterministic trace with two valid transactions, three transaction controls, and four identity-sequence controls; an intent-governed bridge with two valid and six expected-invalid traces; and 37 theorem declarations in AsiStackProofs.Replacement under six manifest targets. It also includes two bounded outcome programs that constrain the prose: the post-v2.1 update campaign restored all 24 declared local surfaces in 15/15 seed-arm transactions and exposed six best/final checkpoint disagreements, but no eligible challenger achieved the registered utility gain; the governed-work campaign achieved 32/36 exact attack-control rollbacks and only 2/36 useful releases, below both gates. A later governance-tax harness restored nine declared surfaces in 12/12 local probes and detected twelve omitted-surface controls, but its model calls failed before task candidates existed. These artifacts establish exact synthetic record and finite-route behavior plus inventory-specific local restoration and negative results only; they do not establish complete semantic or external-effect recovery, monitor or evaluator validity, production replacement, useful governed throughput, acceptable cost, heterogeneous transfer, or chapter-core support.	A mature replacement campaign uses several real stateful and side-effecting capability fields with multiple candidate update types, deliberately ambiguous change classes, historical incidents, heterogeneous consumers, delayed outcomes, irreversible effects, remote dependencies, and adversarial candidate or evaluator behavior. It compares ordinary registry/model swaps, feature flags, progressive delivery, MLOps pipelines, benchmark-only gates, provenance-only gates, filesystem or snapshot restoration, nominal rollback, and the full prospective transaction. Independently implemented observers verify field identity, checkpoint authority, state/effect inventory coverage, evaluator and monitor dependencies, authority, regressions, canary isolation, migration, composition, descendant closure, recovery objectives, external compensation, useful throughput, missed help, unsafe release, privacy and rights effects, latency, compute, downtime, operator/evaluator labor, governance cost, and residual burden. Causal ablations remove prospective checkpoint authority, inventory closure, evaluator separation, canary isolation, monitor-delay accounting, regression memory, recovery rehearsal, effect comparison, or residual ownership; transfer varies models, tools, policies, data, hardware, runtimes, state systems, organizations, consumers, threats, and update classes. The chapter advances only if the full transaction is not dominated on the preregistered joint frontier, produces useful improvements rather than refusal or no-op safety, and independently recovers or honestly compensates the declared effects under replication. This is a research target, not evidence that replacement is generally reversible, useful, safe, or beyond current practice.	argument
security-kernel-and-digital-scifs	Security Kernel and Digital SCIFs	Preserve the exact current boundary: 3 valid and 8 expected-invalid synthetic Authority Use Receipts, 2 valid and 6 expected-invalid SCIF commit-probe routes, one security-overhead-laundering negative budget fixture inside the 6-valid/7-invalid budget corpus, and 56 finite Lean theorem declarations under four manifest targets. The Lean surface includes a 35-theorem versioned authority-use transaction over lease, mediated substitution, execution, sanitization, independent declassification, zeroization, commit, and canonical descendant-ID revocation. It proves rejected-event state preservation, arbitrary-run identity, authority, descendant-inventory, and trace custody, terminal revocation, one exact committed prefix and one exact revoked trace, and a count-only impossibility result. The independent consumer reconstructs eight accepted events, twelve state-preserving rejecting controls, all eight event kinds from the revoked state, and all six permutations of the three-ID inventory. Also retain the post-v2.1 bounded negative result of 0/36 governed primary unsafe releases versus 24/36 baseline, only 2/36 useful releases, and 32/36 exact attack-control rollback with a same-project policy/observer/promotion dependency. These artifacts validate record, route, mutation, and bounded fail-closed behavior only; they establish no non-bypassable monitor, real secret custody, isolation, prompt-injection containment, declassification quality, complete real descendant discovery, effect-complete runtime revocation, side-channel safety, privacy, production security, or chapter-core support.	The mature operational contract is a target tested through this program: Run a preregistered promotion-or-refutation campaign over natural tool-using work and deliberately adversarial untrusted data using real current models, multiple secret/private-data/identity/memory/tool/egress/physical-effect classes, and strong matched comparators: prompt-only policy, conventional vault plus ACL, sandboxing, zero-trust mediation, capability-secure control/data separation, AgentDojo-style defenses, and the full authority-use transaction. Independently implemented red teams, policy/effect monitors, declassification evaluators, and auditors must measure secret and semantic disclosure, unauthorized effects, indirect-injection and confused-deputy success, side/covert-channel escape, sanitizer precision/recall and utility, false denial, missed help, containment, revocation latency, audit completeness and privacy, availability, useful throughput, latency, compute, human burden, recovery, compensation, and residuals. Causal ablations must isolate every proposed mechanism, and replication and transfer must span models, tools, runtimes, local/cloud/browser/multimodal/multi-agent settings, operators, threat classes, and time. Novelty, containment, superiority, or security language survives only if the full joint frontier beats frozen strong baselines under independent reproduction; otherwise the exact mechanism is narrowed or refuted while all negative and null results remain visible.	argument
adversarial-machine-learning-and-model-attack-surface	Adversarial Machine Learning and the Model Attack Surface	Implement a model-threat record and a safe evaluation harness over public toy or consented models. Include clean, random-noise, known-vulnerable, attack-aware, transfer, and adaptive controls; preserve query and tuning budgets; and report robustness with clean utility, false positives, recovery, latency, and residuals. No result transfers automatically to frontier models or production.	At maturity, the operational target is a continuously renewed model-threat and attack/defense contract rather than a one-time robustness badge. Every new checkpoint, modality, tool, adaptation dataset, access pattern, or defense reopens the threat model and may narrow authority immediately. The mature system must preserve adaptive attack attempts, clean utility, detector error, recovery, cost, disclosure, and residual vulnerability together while routing verified consequences to custody, privacy, readiness, rollback, and incident owners.	argument
privacy-data-rights-and-information-flow-governance	Privacy, Data Rights, and Information-Flow Governance	Preserve the exact current finite boundary before the natural campaign: one authored information-lifecycle transaction covers purpose/authority, minimization, twelve mapped surfaces, derivative propagation, privacy evaluation, rights receipts, nine sources, ten non-authorities, and 26 fixture mutations. The exact 38-theorem Lean surface retains eleven information-use routes beside a 27-theorem reachable lifecycle that binds a canonical duplicate-free known-copy identity list, preserves exact transaction/copy identity and non-authority across arbitrary accepted runs, preserves exact state on fourteen rejecting controls, requires deletion disposition to name the exact known-copy inventory, checks all 24 four-copy permutations, rejects all eight event kinds after deletion recording, and proves count-only deletion admission cannot recover copy identity. Then run the prospectively frozen natural small-model/memory campaign comparing ordinary, access-only, minimization, DP, purpose-bound, and competent remediation arms under strong positive-controlled attacks, complete descendant rights workflows, at least three seeds, independent evaluation, and joint utility/privacy/rights/cost outcomes.	The mature operational contract carries machine-readable purpose, authority, privacy, rights, and remedy obligations across context, memory, heterogeneous model substrates, training, inference, audit, backups, releases, and descendants; composes formal accounting with competent empirical attacks and independently checked outcome measures; preserves contestable lineage and effect-complete remediation across replacements; and supports versioned cross-jurisdictional policy modules without pretending the architecture determines law, legal validity, institutional legitimacy, or universal privacy.	argument
confidential-and-verifiable-ai-computation	Confidential and Verifiable AI Computation	A guarantee matrix and local demonstration for one bounded inference operation with explicit adversary and leakage models, artifact and configuration commitments, freshness, independent verification, native-versus-protected latency and cost accounting, negative tests for replay and mismatched artifacts, and a no-authorization non-claim.	A meaningful advance would make confidential and verifiable inference deployable as a substrate-independent contract, compare multiple trust and cryptographic constructions under a common workload, expose residual leakage and semantic gaps, and preserve audit, revocation, rollback, and purpose governance across the full lifecycle. The mature operational contract would make every downgrade observable and keep cryptographic evidence separate from authorization, semantic correctness, quality, and end-to-end privacy.	argument
model-weight-custody-and-hardware-roots-of-trust	Model-Weight Custody and Hardware Roots of Trust	Preserve the exact current finite boundary: eight deterministic Boolean custody records route one bounded-load admission, five repair/review/refresh/observation cases, one release-laundering rejection, and one irreversible-release record; 44 Lean theorem declarations under eight manifest targets include a 35-theorem six-event lifecycle from independent attestation through bounded key release, no-distribution load, independent observation, canonical descendant-key revocation, and terminal erasure. Arbitrary accepted runs preserve identity, descendant inventory, valid traces, non-authority, and a non-increasing authority ceiling; rejected events preserve exact state; twelve lifecycle controls, six erased-state event kinds, and all twenty-four permutations of the four-key inventory are checked; and an equal-count collision proves count alone cannot decide exact revocation admission. Nine route mutations reject and support_state_effect=none preserves non-claims. No real weight, derivative closure, key, KMS/HSM, TEE, root, Evidence, Attestation Result, verifier, reference value, endorsement, relying-party decision, plaintext load, extraction, revocation propagation, recovery, sanitization, recipient release, privacy, availability, or security metric has been exercised.	The mature operational contract is a target tested through this program: Run a preregistered promotion-or-refutation campaign using a public-safe but effect-bearing model-family artifact set, mock and hardware-backed environments where authorized, real current key and attestation components, and matched baselines: encrypted object storage plus IAM, registry/provenance only, conventional cloud KMS, vendor confidential-compute lifecycle, RATS-separated attestation without full custody closure, and the full custody transaction. Independently implemented asset discovery, verifier/appraisal, relying-party policy, load/effect observer, extraction adversary, incident/recovery, and sanitization validators must measure unauthorized acquisition/use, plaintext and side-channel exposure, extraction/reconstruction, stale/false attestation acceptance, false denial, key compromise/rotation/recovery, copy and derivative recall, revocation propagation, media/cryptographic sanitization, recipient irreversibility, service availability, recovery latency, benefit, operator burden, privacy/rights, and total cost. Causal ablations must isolate each proposed mechanism; replication and transfer must span model families and sizes, artifact/derivative classes, key/attestation stacks, hardware/vendors, local/cloud/edge environments, operators, adversaries, incidents, release modes, and time. Custody, confidentiality, hardware-trust, superior-security, or release-control language survives only if every frozen joint gate beats strong baselines under independent reproduction; otherwise the exact proposition is narrowed or refuted and all negative/null outcomes remain visible.	argument
open-weight-release-and-post-release-control	Open-Weight Release and Post-Release Control	Create an irreversible-release dossier for a harmless small model. Freeze exact bytes and comparators; test default and deliberately safety-removed variants; record license, documentation, signatures, derivative metadata, incident channels, patch semantics, and the limits of recall. Use the exercise to verify decision records, not to authorize release of a hazardous model.	The mature operational contract makes open-weight governance a candid ecosystem discipline rather than a fictional remote-control system. Release decisions use competent worst-case elicitation, accessible-frontier and cumulative-risk analysis, independent review, public-safe evidence, benefit distribution, and post-release observability. Safer derivatives, signatures, provenance, community red teaming, and rapid patches can improve the ecosystem, while every surface states that unrestricted copies remain beyond unilateral revocation.	argument
ai-supply-chain-integrity-and-lifecycle-provenance	AI Supply-Chain Integrity and Lifecycle Provenance	Preserve the exact current finite boundary: one hand-authored three-project affected-path record reaches quarantine; ten fixture mutations reject digest substitution, incomplete declared closure, missing response ownership, ordinary use during invalidation, overwritten history, revoked-path non-quarantine, stale-assurance admission, custody after invalidation, missing disposal closure, and support promotion; and 34 Lean theorem declarations under six manifest targets retain seven Boolean admission routes beside a 27-theorem reachable lifecycle. The lifecycle binds a canonical duplicate-free component-ID inventory, preserves exact artifact/provenance/component identity and non-authority over arbitrary accepted runs, preserves exact state on eleven independently encoded rejection controls, requires exact revocation closure, checks all 24 permutations of four component identities, rejects all five event kinds after revocation, and proves that count-only classification cannot recover exact component identity. No real AI BOM, artifact/content verification, dataset, supplier, build/training execution, signature, key, verifier, advisory feed, dependency discovery, reproducible rebuild, relation-specific propagation, quarantine/restoration effect, recipient notice, sanitization, privacy/rights, availability, or security metric has been exercised.	The mature operational contract is a target tested through this program: Run a preregistered promotion-or-refutation campaign over public-safe but effect-bearing AI artifact families and natural lifecycle work with seeded substitutions, missing/extra edges, compromised or conflicting issuers, stale and inapplicable advisories, transformations, downstream consumers, incidents, recovery, and retirement. Compare inventory-only SPDX/Croissant, signature-only OpenSSF, SLSA/in-toto build-chain, conventional C-SCRM plus scanning, generic provenance graph, and the full consumer-relative transaction under matched artifacts and budgets. Independently implemented artifact discovery/content verification, provenance and signature verification, supplier challenge, advisory applicability, affected-path computation, downstream acknowledgement, quarantine/restoration, rights/privacy, and cost evaluators must measure detection and discovery precision/recall, tamper/substitution, false assertion acceptance, affected-path precision/recall, false quarantine, propagation and restoration correctness/latency, unaffected-service loss, availability, useful throughput, disclosure/privacy/rights harm, operator/supplier burden, benefit, and total cost. Causal ablations must isolate each proposed mechanism; replication and transfer must span artifact/model/data families, transformations, organizations, suppliers, build/training stacks, environments, relation policies, adversaries, incidents, release/retirement modes, and time. Completeness, integrity, superior-control, effective-revocation, or transfer language survives only if every frozen joint gate beats strong baselines under independent reproduction; otherwise the exact proposition is narrowed or refuted and all negative/null outcomes remain visible.	argument
recursive-self-improvement-boundaries	Recursive Self-Improvement Boundaries	The exact current minimum preserves the 3-valid/10-invalid self-improvement fixture, 4-valid/5-invalid readiness fixture, 5-valid/9-invalid replacement fixture, two-transaction/three-control replacement trace, eight-trace/six-control intent bridge, three-seed/twelve-arm fixed update result, Open-Ended Improvement governor handoff, 22 legacy SelfImprovement declarations, and shared safety lifecycle inside an eight-stage, 118-route proposal-to-outcome lifecycle with 129/129 rejecting mutations, one bounded replacement handoff, one returned outcome reconciliation, and one protocol-version-2 readmission witness. The update result retains four no-change dispositions and three exact local rollbacks; the Open-Ended challenger retains zero threshold passes; support/effect remain none. No adaptive proposal generation, live self-modification, natural useful improvement, evaluator or monitor competence, live authority enforcement, production replacement, semantic recovery, effect-complete rollback, transfer, chapter-core transition, or SOTA result exists.	The mature target is a governed self-improvement market in which system-generated changes can be tested quickly without acquiring permission to define or ratify their own success. For every declared consumer, use, self-model, mutable partition, authority envelope, and horizon, candidates carry exact lineage and full declared-state manifests; evaluators expose dependency and correlated-blind-spot risk; strong matched baselines, adversarial and deception controls, shifted tasks, delayed outcomes, and joint usefulness-safety-cost-rights-recovery measures determine scoped eligibility; staged exposure has effect-complete stop, rollback, compensation, and descendant-invalidation paths; and every positive, negative, null, narrowed, or refuted result remains available to later generations. Evidence, permissions, gates, and claims expire when their causal context changes. This would exceed the chapter’s current finite Boolean routes and synthetic keyword fixtures only after independent implementations demonstrate that the boundary produces better joint outcomes than strong simpler controls across models, tasks, organizations, adversaries, recursive depths, and time; it remains a research target, not a current safety, corrigibility, or ASI result.	argument
open-ended-improvement-engines	Open-Ended Improvement Engines	The exact current minimum preserves seven legacy campaign-admission route theorems, the seven-case/ten-control admission fixture, the three-seed/four-arm fixed update result, and the three-seed/five-arm post-v2.1 stopped result inside a seven-stage, 81-route campaign-to-governor lifecycle with two composed Lean traces, 91/91 route mutations, 3/3 cross-stage mutations, one governor-review handoff, and one protocol-version-2 readmission witness. The stopped campaigns retain four no-change claim dispositions, zero of nine eligible post-v2.1 challenger seed-arms meeting the 0.05 gain threshold, and no support effect. No adaptive task/candidate generator, evolving archive, objective-legitimacy result, evaluator-independence result, semantic novelty, useful improvement, deployed stop/quarantine, transfer, chapter-core transition, or SOTA result exists.	The mature target is a portfolio of constrained adaptive discovery campaigns across programs, tools, data, curricula, simulations, evaluators, and scientific hypotheses whose objectives remain socially and operationally reviewable. It preserves exact generated-distribution and candidate lineage, selection denominators, evaluator exposure and dependencies, negative and null search history, semantic novelty and consumer usefulness, dual-use and privacy custody, total resource and opportunity cost, cross-campaign contamination, stop effects, and typed downstream reuse. Strong current source systems and conventional search are reproduced under matched budgets; mechanism ablations, adversarial controls, independent replication, recursive-depth stress, and transfer decide exact scoped claims. Candidates enter procedural memory, updates, or capability fields only through separate qualification and governed replacement, and the campaign can stop without narrating search activity as progress. This remains a research target, not a current autonomous-discovery, safe self-improvement, general-improvement, AGI, or ASI result.	argument
autonomous-replication-proliferation-and-containment	Autonomous Replication, Proliferation, and Containment	Build a closed synthetic provider and network with fake credentials, budgets, model artifacts, endpoints, and independently enforced kill switches. Test component tasks, full chains, human-assistance variants, positive controls, descendant discovery, and recall. Publish aggregated safety findings and interface contracts, not reusable real-world replication instructions.	At maturity, the operational contract is a thresholded, lineage-complete, externally terminable replication boundary. It must expose which component and end-to-end capabilities approach concern while ensuring that measurement cannot create reusable real-world proliferation authority. Parent and descendant identities, noninherited permissions, synthetic resources, assistance, complete attempts, persistence, shutdown, recall, discovery, reclamation, and unresolved copies remain jointly auditable, and safer containment mechanisms may replace earlier ones without losing descendant obligations.	argument

K.2 Part II - Planning, Memory, Reasoning, and Execution

Chapter ID	Chapter	Minimum viable implementation	Beyond the state of the art	Support state
intent-to-execution-contracts	Command Contracts: From Intent to Executable Work	The current minimum is a record-and-route scaffold plus one substantive finite vertical proof: intent, command, and trace schemas; synthetic plan-execution, handoff, replacement-bridge, and one-shot-action fixtures; one consumed hand-authored five-project lifecycle; 33 rejecting mutations across the three named probes; seven manifest proof targets; and an exact 37-declaration IntentExecutionRefinement model. That model enforces kind-exclusive event payloads, proves one-step and arbitrary-run custody, authority, logical-time, effect-accounting, delivery, stop, and residual invariants, reaches delivery through one ten-event witness, and rejects eighteen closed countermodels. Its independent consumer checks nine executed scenarios, 89 events, and thirty source mutations. The negative empirical record remains: a 16-run governed-work campaign with zero governed releases; a 36-transaction usefulness campaign with 2/36 correct candidates and four inexact attack-control rollbacks; a 12-task natural-work campaign with zero parseable final contracts; and a repaired 32-candidate renewal with only 2/32 independently correct candidates, zero useful releases in either arm, zero unsafe releases in either arm, and a frozen 8/8-versus-9/9 metadata error. These artifacts establish exact finite record and transition properties, bounded abstention and negative outcomes, and no-promotion boundaries only. An honest next minimum must execute a prospectively frozen natural multi-model contract campaign with human-authored and direct/schema-only/governed comparators, authentic authority, independent semantic and effect observers, exact lineage and costs, nonzero useful-release opportunity, delayed outcomes, causal ablations, effect-complete recovery, replication, and transfer.	A mature intent-to-execution conformance layer is evaluated as a semantic and causal system, not a larger prompt template. On prospectively sampled natural tasks, it compares human-authored contracts, direct execution, schema-only extraction, strong workflow/capability baselines, and the full governed route using identical models, tools, data, authority ceilings, candidate bytes, budgets, and outcome horizons. Independent implementations score interpretation fidelity, obligation preservation, authority precision and recall, untrusted-data separation, plan/job conformance, observed effects, artifact satisfaction, useful delivery, unsafe release, abstention, missed help, delayed harm, rights and privacy effects, rollback and compensation completeness, latency, compute, human labor, and total governance cost. Causal ablations test every claimed mechanism, adversaries attack ambiguity, injection, authority, replay, evaluator capture, state drift, residual erasure, and cost hiding, and replications span models, languages, modalities, task families, runtimes, organizations, jurisdictions, threats, and time. Promotion requires a nonzero useful denominator, effect-bearing controls, stronger matched baselines, independent evaluation, reproducible raw artifacts, and accepted claim-specific transitions; otherwise the result is narrowed, null, negative, refuted, or blocked after full attempt. This remains a research target, not current evidence of reliable intent extraction, safe useful execution, production transfer, AGI, or ASI.	argument
perception-sensor-fusion-and-observation-trust	Perception, Sensor Fusion, and Observation Trust	Preserve the exact current finite boundary before building the natural service: the 32-theorem ObservationTrust surface retains a universal pair classifier and adds total step/run semantics, arbitrary-run exact identity and non-authority custody, receipt accounting, trace validity, batch composition, rejection noninterference, terminal invalidation, and a universal counterexample showing that pairwise distinct-root summaries cannot recover global common-cause state. Its independent consumer recompiles the surface, checks seven trace splits, 46 exact-state lifecycle mutations, 13 pair controls, six invalidated-state event kinds, and twelve same-summary/opposite-common-cause controls. Then build a two- or three-modality observation service that emits a versioned Observation Trust Record and validator with immutable identity, clock and calibration checks, per-channel hypotheses, dependence-aware fusion, calibrated abstention, one active-observation action, a safe-hold route, and seeded time, missing-channel, correlated-failure, spoofing, and benign-disagreement fixtures.	A mature substrate-neutral observation fabric would host present and future modalities behind stable contracts, estimate evidence dependence, choose observations by expected decision value, preserve plural hypotheses through ontology change, and transfer calibrated uncertainty into world models and controllers without claiming open-world truth. It would learn when to sense, abstain, slow, or request a new viewpoint; preserve calibration through replacement; expose shared causes and adversarial channels; and measure whether additional sensing actually improves downstream decisions after latency, energy, privacy, and physical risk are counted.	argument
planning-as-a-control-layer	Planning as a Control Layer: DAGs and Intelligence Arbitrage	The current minimum is a record, route, reachable-lifecycle, and executable-edge scaffold: plan-graph, PlanForge-DAG, command, job, and semantic-atom schemas; three valid and ten invalid plan-execution fixtures; two valid scheduler-state traces and seven rejecting controls; two valid runtime-replan traces and nine rejecting controls; one valid and three rejected independently reconstructed PlanForge graphs; two accepted no-change transitions; and 71 theorem declarations grouped under seven manifest targets. The 53-declaration Planning module includes the reachable command-to-replan lifecycle plus five graph-bound admission results that require lifecycle admissibility, exact output-artifact/graph identity, and executable PlanForge verification in one transition. The 18-declaration PlanForge module checks node bounds and strict topological edge order, proves every dependency path strictly increases and therefore cannot cycle, supplies a reachable diamond witness, rejects self, reverse, and out-of-bounds edges, proves an authored five-field graph summary non-injective for admission, rules out an exact classifier over that summary, and proves round-trip/injectivity/admission preservation for the complete edge-carrying transport. Its independent consumer reconstructs four graph cases, five reachable pairs, the summary collision, and twelve complete-transport mutations. These artifacts still trust authored decomposition, edge completeness and meaning, context, adequacy, route, receipt, authority, stop, and residual fields. They contain no planner-generated natural plan, independent decomposition oracle, measured dependency truth or recall, context-demand prediction, selected-tier adequacy, live scheduler, observed replan benefit, or support movement. An honest next minimum must run a prospectively frozen natural planning campaign with multiple planner/model families, human-authored and strong algorithmic/workflow baselines, hidden obligations and perturbations, complete alternative denominators, independent semantic/dependency/feasibility/outcome evaluators, observed costs and feedback, effect-tested stops and recovery, causal ablations, clean reproduction, and transfer.	A mature planning control plane is a measured policy for obligation scheduling under uncertainty, not a diagram generator. On prospectively sampled natural tasks it compares no-plan/direct, single-pass, search/tree, HTN/PDDL/workflow, human-authored, learned-model/MPC where applicable, and full governed planning under matched models, tools, information, authority, rights, resources, and horizons. Independent implementations score obligation coverage, semantic preservation, dependency precision/recall, feasibility, context and observation calibration, plan stability, route adequacy, merge validity, useful critical-path and completion outcomes, unsafe actions, abstention and missed help, delayed effects, rights and privacy, recovery completeness, latency, compute, coordination, human work, and total governance cost. Adversaries inject hidden dependencies, stale state, conflicting sources, authority and rights traps, evaluator gaming, shared bottlenecks, replan shocks, merge conflicts, and recovery failures; causal ablations test each mechanism; replications span models, planners, tasks, languages, modalities, environments, organizations, jurisdictions, threat models, horizons, and time. Promotion requires predicted causal signatures, nonzero useful opportunity, strong matched baselines, independent evaluation, reproducible raw traces, effect-bearing controls, transfer, and accepted claim-specific transitions; otherwise claims remain narrowed, null, negative, refuted, or blocked after full attempt.	argument
governed-world-models-and-reality-grounding	Governed World Models and Reality Grounding	Build a bounded partially observed control task with two independently trained dynamics models, horizon-conditional calibration, receding observation updates, model-disagreement routing, support-aware action gating, counterfactual receipts, and adversarial tests for exploitation and distribution shift.	The mature target architecture is a plural, causally testable world-model substrate that can revise its abstractions while a versioned operational contract keeps prediction, uncertainty, intervention semantics, authority, observation, and residual reality distinct. It admits imagined futures only inside calibrated support, routes material disagreement and shift to fallback or safe hold, and records every counterfactual dependency. Maturity requires held-out interventions, causal ablations, independent reproduction, and real-world transfer that outperform strong reactive, model-free, and single-model baselines without worsening unsafe action, latency, or governance cost.	argument
cognitive-compilation-and-semantic-ir	Cognitive Compilation and Semantic IR	The current minimum is a record-and-bounded-reference scaffold: a semantic-atom schema; two valid and four rejecting hand-authored compilation traces; one blocked three-project semantic-preservation record and nine rejecting mutations; fourteen Lean theorem declarations grouped under three targets; and the QCSA reference package, whose 60 synthetic cases across 13 systems and three seeds produced 2,340 predictions plus one 13-stage zero-model temporary-file trace with ten rejecting adversarial paths and one byte-exact rollback. QCSA matched the selected baseline at 1.000 task accuracy while using 1.913386 times the operations, so matched advantage and resource gates failed; the active-question ablation is N2 proxy/regime evidence rather than an exact or broad refutation; several identity, certificate, migration, calibration, and plural-facet mechanisms earned bounded non-core dispositions; and the chapter core stayed at argument. No artifact is generated from a natural accepted source plan through a real cognitive backend and independently checked for semantic preservation. The next honest minimum must compile natural held-out source obligations into one concrete artifact class, compare direct, schema-only, workflow, human, and governed compiler routes under matched resources, use independently implemented source-target and artifact evaluators, exercise adversarial obligation loss and real incremental repair, reconcile all attempts and costs, rerun from locked artifacts, and transfer to a second target class.	A mature cognitive compiler is an obligation-preserving multi-level build system for cognitive work, not a larger prompt template. It accepts versioned plan obligations and source context; emits inspectable source, semantic, and target IR dialects; runs typed and reproducible passes; produces concrete code, prose, schema, proof, experiment, diagram, or job artifacts; validates each translation against actual target content and behavior; and rebuilds dependency-closed descendants after change. On prospectively sampled natural tasks it must beat or complement direct generation, schema-only prompting, strong workflows, planning and search systems, human-authored artifacts, conventional compiler/build tools, program synthesis, and current agent pipelines under matched models, sources, authority, tools, budgets, repair opportunities, and horizons. Independent implementations jointly measure obligation precision and recall, semantic preservation, ambiguity calibration, authority and rights retention, artifact validity and usefulness, repair locality, rebuild correctness, unsafe or unauthorized outputs, abstention and missed help, latency, compute, storage, verifier and human work, recovery, and total governance cost. Adversarial passes delete or paraphrase obligations, exploit target assumptions, poison caches, capture validators, widen authority, forge receipts, and escape repair scope; causal ablations isolate each mechanism; replication and transfer span models, languages, modalities, artifact classes, compilers, evaluators, organizations, jurisdictions, threats, horizons, and time. Promotion requires nonzero useful opportunity, strong matched baselines, independent evaluation, effect-bearing controls where relevant, predicted causal signatures, complete denominators, reproducible traces, transfer, and accepted claim-specific transitions; otherwise the exact claim is narrowed, null, negative, refuted, or blocked after full attempt.	argument
virtual-context-abi	The Virtual Context ABI: Typed Pages, Cells, and Certificates	The current minimum is a static record-and-route scaffold: public context ABI, packet, adequacy, transaction-reference, semantic-page certificate, and bounded graph-snapshot schemas; three valid and five rejecting admission/adequacy fixtures; two valid and nine rejecting resolver/certificate routes; one bounded four-project certificate and eleven rejecting mutations; 83 Lean declarations under six targets, including an exact 39-theorem bound-request lifecycle with arbitrary-run identity, authority, non-authority, trace, composition, lease, receipt, fault, and terminal-state invariants plus an independent 73-mutation consumer; and QCSA’s exact bounded synthetic identity/address/certificate results. It does not run a deployed resolver, inspect natural source-to-packet fidelity, measure model use, execute memory transactions, enforce deletion, or establish useful advantage. The next honest minimum must materialize natural held-out source sets into actual model-visible packets through full-context, RAG, graph, summary/compression, human-curated, and governed ABI routes under matched resources; independently label source obligations, actual packet contents, model use, task outcomes, faults, costs, and delayed residuals; inject staleness, poisoning, omission, authority, cache, and frontier attacks; reproduce from locks; and transfer to a second model and memory backend.	A mature Virtual Context ABI is an independently testable context syscall layer: natural consumers request exact purpose-bound objects and representations; multiple durable stores and retrieval systems return finite candidates; the ABI emits actual model-visible packets with falsifiable source-to-packet certificates, complete selection and cost ledgers, least-sufficient authority and rights, typed faults, expiry, and revalidation; and independent observers distinguish availability, delivery, model use, outcome contribution, adequacy, and support. Prospectively sampled natural workloads compare full context, direct and graph RAG, hierarchical summarization, prompt compression, persistent memory, adaptive retrieval, citation systems, OS-style tiering, human curation, and no-context routes under matched models, sources, tools, authority, budgets, and horizons. Promotion requires useful opportunity, source and packet fidelity, calibrated abstention and missed-help, poisoning and stale-state resistance, measured model use and outcomes, complete total cost, predicted causal signatures under ablation, clean reproduction, cross-model and cross-backend transfer, and accepted claim-specific transitions; otherwise the exact claims narrow, remain null or negative, become refuted, or are blocked after a full attempt.	argument
durable-semantic-memory-and-knowledge-lattices	Durable Semantic Memory and Knowledge Lattices	Implement a versioned semantic-object schema, event-sourced store, validator, and replay fixture with typed nodes and relations, temporal validity, provenance, contradiction, supersession, ontology version, rights, and transactional snapshots. Compare exact, vector, graph, and hybrid retrieval on update-heavy tasks with injected collisions, stale facts, conflicting sources, poisoning, deletion, compaction, crash, and restart while measuring utility, provenance survival, contradiction calibration, rights closure, latency, and residuals.	At maturity, the operational contract is a replaceable knowledge-lattice service whose semantic state is durable but never treated as unquestionable truth. Exact, vector, graph, associative, temporal, and learned retrieval may evolve behind a stable contract while object identity, ontology versions, provenance, contradiction, temporal validity, rights, actual use, compaction, forgetting, deletion, backup, restart, and consumer invalidation remain distinct and replayable across migrations.	argument
context-transactions-snapshots-mounts-and-taint	Context Transactions, Snapshots, Mounts, and Taint	The current minimum is a record-and-route scaffold: one public transaction schema and fixture; three valid and six expected-invalid hand-authored memory-store records; two valid and four expected-invalid ordered sequence records; one hand-authored five-project restart lifecycle and ten rejecting mutations; and twenty-three Lean theorem declarations grouped under four public targets. It checks finite committed-read visibility, branch and mount faults, taint/declassification, deletion/materialization blocks, replay and non-promotion boundaries, no-loss lifecycle identity, atomic index/content epochs, and exact authored restart visibility. It does not run concurrent actors, a deployed durable store, real copy-on-write merge, actual process crash, filesystem journal recovery, distributed commit, model-backed context use, storage-wide deletion closure, useful advantage, or transfer. The next honest minimum must execute prospectively declared stateful tasks through ordinary file or key-value updates, a strong transactional database or filesystem baseline, persistent-memory and retrieval baselines, and the governed context transaction route on at least two actual backends; inject concurrency anomalies, mount and taint violations, partial commits, cache/replica lag, process kills, restart, deletion and revocation, compaction, retries, and partitions; independently observe actual pre-state, writes, durability, visibility, recovery, leakage, task outcomes, costs, and delayed residuals; reproduce from locks; and transfer to a second model and backend.	A mature Context Transaction layer is an independently testable dynamic state machine for durable AI context, not a transactional metaphor. Natural stateful workloads run parallel readers and writers over exact source objects, branches, mounts, indexes, caches, derivatives, and recovery boundaries. Full attempt ledgers compare stateless and direct retrieval, GraphRAG, persistent memory, ordinary file and key-value updates, database or filesystem transactions, event-sourced designs, human-managed state, and the governed semantic transaction layer under matched models, sources, authority, resources, faults, and horizons. Independent observers measure isolation anomalies, source and field survival, conflict calibration, authority and rights leakage, taint and deletion closure, crash durability, restart fidelity, idempotent recovery, useful task throughput, unsafe use, abstention and missed help, privacy exposure, latency, and total cost. Promotion requires nonzero useful opportunity, predicted mechanism-specific failures under ablation, clean crash/restart reproduction, complete denominators, storage-versus-model-erasure honesty, and cross-model and cross-backend transfer; otherwise exact claims narrow, remain null or negative, become refuted, or are blocked after a full attempt.	argument
verification-bandwidth-and-context-adequacy	Verification Bandwidth and Context Adequacy	The current minimum is an authored record-and-route scaffold: one context-adequacy schema and fixture; three valid and five rejecting admission/adequacy records; two valid contradiction/adequacy traces and seven rejecting controls; three valid capacity traces and five rejecting controls; one conservative twelve-unit record with sixty-six all-pairwise obligations, eighteen checked and forty-eight residual; one named decomposition with twenty-four modeled obligations including six boundary checks; and fourteen Lean theorem declarations grouped under four public targets. Three theorem declarations restate modeled predicates or summary validity and eleven construct a finite witness or prove finite route consequences. The scaffold does not run a model, natural claim, contradiction-rate study, distractor test, citation audit, behavioral suite, formal neural-network property check, independent evaluator, deployed ledger or escalation service, adequacy classifier, usefulness comparison, or transfer. The next honest minimum must prospectively sample natural claims with nonzero verification opportunity across domains and stakes; compare answer-only, long-context, retrieval, graph and hierarchical retrieval, compression, citation, self-critique, model-panel, behavioral-test, formal-property, human, abstention, and governed routes under matched sources, models, tools, authority, budgets, and horizons; independently label obligations, actual attempts, contradictions, outcomes, usefulness, safety, false acceptance, false refusal, missed help, calibration, and total cost; reproduce from locks; and transfer across a second model, domain, and evaluator implementation.	A mature Verification Bandwidth layer is an independently testable claim-specific capacity and adequacy control plane. Prospectively frozen natural claims are decomposed into falsifiable positive, negative, boundary, contradiction, counterexample, causal, outcome, cost, reproduction, and transfer obligations; actual source units and verification resources are allocated before outcomes; and complete attempt ledgers distinguish availability, work performed, check validity, obligation coverage, evaluator dependence, adequacy, usefulness, safety, support, and release. Strong matched baselines span answer-only, long-context, direct and graph RAG, hierarchical retrieval, compression, citation-first generation, self-critique, model panels, behavioral tests, formal property checks, human review, and calibrated abstention. Promotion requires useful opportunity, lower claim-specific false acceptance without unacceptable false refusal or missed help, calibrated residuals, negative-evidence discovery, predicted causal signatures under ablation, complete total cost, clean reproduction, and cross-model, cross-domain, and cross-evaluator transfer; otherwise exact claims narrow, remain null or negative, become refuted, or are blocked after a full attempt.	argument
claim-ledgers-and-belief-revision	Claim Ledgers and Belief Revision	Five valid and seven expected-invalid claim-revision fixtures; one bounded five-project contradiction lifecycle with eleven rejecting mutations; four retained bounded legacy lemmas; and a stronger 27-declaration append-only Claim Ledger refinement whose independent consumer covers twenty-two route cases, five reachable stages, and thirty-four rejected mutations. The refinement binds exact claim, ledger, head, semantic, ontology, support-view, history, non-overwrite, dependency, migration, residual, surface, and full pending-proposal state; every successful event list preserves identity, zero external effects, and exact ledger-version/append-count balance, event batches compose, and acknowledged states are terminal. An authored upward support record requires an evidence-owner receipt, and the ledger cannot self-approve support or commit an external effect. This remains finite structured-record evidence, not a claim extractor, semantic-equivalence engine, deployed concurrent store, natural multi-surface repair system, evidence-quality judgment, or chapter-core result.	A mature Claim Ledger is an independently testable epistemic version-control and change-propagation plane for natural and formal claims. It maintains durable semantic identity and append-only revision across every publication and runtime surface while leaving truth, evidence adequacy, formal validity, review competence, authority, and release with their proper owners. On prospectively frozen natural workloads, it must outperform strong citation, provenance, version-control, event-sourcing, truth-maintenance, retrieval/self-critique, behavioral-test, and human-editorial baselines on joint claim-identity precision and recall, semantic merge and split error, assumption retention, contradiction discovery and preservation, dependency-repair accuracy, stale-state prevention, surface consistency, calibrated uncertainty, useful downstream decisions, false promotion and false downgrade, latency, privacy, human work, and total cost. Each proposed mechanism needs a causal signature under matched ablation, clean replay from locks, and independent cross-model, cross-domain, cross-ontology, cross-language, cross-organization, and temporal transfer. Otherwise the exact claim remains argument, narrows to record conformance, records a null or negative result, is refuted, or is deprecated rather than becoming a claim that the stack can manage belief correctly.	argument
spinoza-verification-and-proof-carrying-claims	Proof-Carrying Claims and Adversarial Review	The current authored zero-model scaffold has three public record schemas; 3 valid/5 rejecting proof-carrying fixtures; 3 valid/5 rejecting tribunal fixtures; 2 valid/7 rejecting adversarial-dossier cases; 1 bounded five-project method/independence record with 11 rejecting mutations; a related 3 valid/6 rejecting epistemic-TCB fixture owned by Artifact Graphs; and 21 Lean declarations under 5 public targets. Twelve declarations are predicate-projection or blocking consequences, eight are finite tribunal-route consequences, and one is an authored-summary bridge. No natural target corpus, autoformalizer, semantic-equivalence evaluator, actual theorem or source-validity campaign, multi-model tribunal, independent competence audit, judge calibration, contestability outcome, causal advantage, reproduction, transfer, or chapter-core support effect exists.	A mature verification operating system must prospectively route natural high-value claims and high-risk artifacts among strong formal, citation, procedure, replay, benchmark, model-judge, debate, human-review, and abstention baselines under matched information, resources, authority, and horizons. It must jointly improve useful accepted work, claim-specific false acceptance, unnecessary refusal, missed help, interpretation error, source and theorem validity, attack discovery, calibrated abstention, dissent and appeal preservation, delayed outcomes, latency, privacy, human burden, and total cost; show mechanism-specific causal signatures; reproduce from locks; and transfer across models, domains, languages, formal systems, evaluators, organizations, threats, and time. Failed gates produce exact null, negative, narrowed, refuted, deprecated, or blocked dispositions rather than SOTA rhetoric.	argument
labor-os-and-typed-jobs	Labor OS and Typed Jobs	The current authored zero-model scaffold has one public typed-job schema, 3 valid/10 rejecting plan-execution fixtures, 2 valid/7 rejecting delivery/evidence-readiness traces, 2 valid/9 rejecting durable-lifecycle traces, one accepted no-promotion decision for the durable probe, and 56 live Lean declarations under 5 public targets. The 32-declaration reachable refinement proves stage-indexed one-step and arbitrary-run accounting, full represented identity custody, rejection noninterference, terminal closure, a six-event closure witness, and nineteen closed route or state countermodels; the independent consumer compiles that exact surface, covers 29 routes, consumes both fixture suites, and rejects 42 mutations. Twenty-four narrower approval, route, and durable countermodels remain in the companion module, while three weak declarations are retired with frozen lineage. No scheduler, worker, workspace, secret broker, permission service, approval service, adapter runner, external-effect observer, durable workflow engine, Temporal/Airflow/BPMN/Kubernetes integration, natural workload, useful advantage, causal ablation, reproduction, transfer, or core support effect exists.	A mature Labor OS must execute natural multi-step AI work through actual schedulers, workers, workspaces, permissions, approvals, adapters, artifacts, retries, crash recovery, compensation, delivery, adjudication, and evidence-readiness gates while comparing strong chat, ambient-agent, swarm, script, queue, DAG, durable-workflow, process-engine, and batch-job baselines under matched work, resources, authority, faults, and time. It must jointly improve useful throughput, authorization accuracy, side-effect fidelity, completion correctness, replay and recovery, false refusal, missed help, latency, privacy, human burden, fairness, and total cost; show mechanism-specific causal signatures; reproduce from locks; and transfer across models, domains, backends, schedulers, organizations, authority regimes, fault schedules, and time. Failed gates yield exact null, negative, narrowed, refuted, deprecated, or blocked dispositions rather than a deployed Labor OS claim.	argument
ai-work-surfaces-agent-harnesses-and-organizational-absorption	From Chat to Organizations: AI Work Surfaces and Agent Harnesses	Inventory one repository workflow across answer, suggestion, and agent-task surfaces; freeze exact workload and environment; record context, tools, permissions, approvals, observed effects, artifacts, interventions, costs, failures, recovery, and accountable owner; reject any transition that widens authority, loses identity, or lacks rollback and terminal custody.	A mature work-surface control plane would compile governed transitions from personal agent through project steward, typed role, coordinated team, organization, and inter-organizational network while preserving rights, authority ceilings, evidence lineage, market and institutional constraints, model/harness substitutability, graceful degradation, and human exit. It would simulate alternative surface allocations, price review and concentration risk, detect common-mode feedback, maintain plural decentralized pathways, and prove that no transition silently grants authority or converts local success into organizational legitimacy.	argument
human-ai-organizations-delegation-and-accountability	Human-AI Organizations, Delegation, and Accountability	Represent one recurring workflow with four decision classes and three roles; compile decision rights, competence and workload checks, delegation expiry, independent approval, stop and appeal routes, and accountability receipts; reject rubber-stamp, conflicted, overloaded, hidden-subdelegation, and stale-model cases.	A mature organizational control plane would simulate decision rights before deployment, measure automation’s longitudinal effects on skill and option value, and reallocate authority without losing remedy, affected-party standing, or dissolution custody while supporting plural organizational forms. It would detect ceremonial oversight, hidden subdelegation, concentrated benefit, and responsibility without authority; compare counterfactual role designs; preserve accessibility and contestability; and keep obligations, evidence, and residual custody intact across model replacement, institutional succession, merger, failure, or deliberate dissolution.	argument
human-ai-symbiosis-neurotechnology-and-cognitive-sovereignty	Human-AI Symbiosis, Neurotechnology, and Cognitive Sovereignty	A non-clinical longitudinal protocol for a low-risk assistive task with human-alone, AI-alone, and combined baselines; explicit adaptation and data-flow maps; skill-retention, dependence, calibration, well-being, subgroup, and exit measures; user-controlled pause and reset; and ethics review before any human or neural-data study.	A credible advance would demonstrate durable complementarity without deskilling or coercive dependence, independently reproduce the result across populations and accessibility needs, and implement a portable cognitive-sovereignty contract spanning neural data, model adaptation, device custody, revocation, rehabilitation, and service exit. The mature target architecture would preserve practical pause, portability, rehabilitation, subgroup equity, and independently governed escalation from ordinary assistance to sensing, adaptation, or stimulation.	argument
ai-deployment-transition-distribution-and-human-agency	AI Deployment, Transition, Distribution, and Human Agency	Run a staged natural workflow study with a frozen non-adoption comparator, worker and customer measures, subgroup denominators, delayed follow-up, independent analysis, and real remedy. Measure useful throughput and quality alongside skill, workload, discretion, compensation where appropriate, access, distribution, concentration proxies, exit, and transition cost. Simulation can test accounting, not economy-wide welfare.	At maturity, the operational target is a reversible social-transition contract rather than a software-launch checklist. Capability gains remain coupled to measured task, role, skill, discretion, compensation, ownership, access, price, concentration, continuity, subgroup, delayed-outcome, remedy, and exit effects. The mature contract supports staged narrowing, pause, compensation, redesign, and withdrawal when transition capacity fails, and it cannot hide affected people or communities inside aggregate productivity.	argument
artifact-graphs-audit-logs-and-replay	Artifact Graphs, Audit Logs, and Replay	The current minimum is two public artifact/projection schemas; 2 valid/6 rejecting replay fixtures; 1 valid/10 rejecting projection-revocation records; 1 valid/4 rejecting record-reality sequences; 3 valid/6 rejecting receipt-faithfulness records; a four-surface repository audit with 55 digest checks and five mutations; four deterministic challenges and five mutations; one live artifact with three observation routes and seven mutations; four sampled artifacts with twelve observation routes and eight mutations; 3 valid/6 rejecting epistemic-TCB records; one historical GitHub Actions service record; one historical public-page fetch record; eight accepted no-promotion decisions; and forty-three Lean declarations under ten public targets. These artifacts exercise authored record shape, finite route consequences, current or historical repository observations, digest and command challenges, exact no-promotion boundaries, and service-status facts only. They do not implement a deployed graph, complete event capture, open-world provenance, independent attestation service, transitive revocation runtime, replay engine, privacy/deletion closure, semantic correctness, causal benefit, or transfer.	A mature artifact-evidence plane runs a versioned content-addressed graph over natural multi-step AI work and independently observed effects. It compares folders, version control, workflow histories, provenance ontologies, data-lineage catalogs, Croissant-style metadata, in-toto-style signed layouts, and the full governed graph under matched models, tools, sources, authority, rights, storage, compute, faults, adversaries, and horizons. Independent observers measure lineage precision and recall, missing and false edges, receipt-reality error, replay fidelity by grade, reverse-closure completeness, revocation latency, alternate-derivation validity, stale-public-surface time, privacy leakage, deletion closure, useful downstream reuse, false blocking, incident reconstruction, human burden, latency, storage, remediation, and total cost. Prospective ablations remove content identity, independent observation, canonical/projection separation, reverse closure, replay locks, receipt challenges, trust-base boundaries, rights propagation, or complete denominators; reproduction and transfer vary repositories, artifact types, models, tools, workflow engines, storage backends, organizations, threat models, legal regimes, and delayed changes. The chapter advances only if the full graph is not dominated on that joint frontier and its unique mechanisms survive causal, reproduction, and transfer tests. This is a target campaign, not evidence that the repository has solved provenance, truth, auditability, reproducibility, privacy, safety, or state-of-the-art artifact governance.	argument
runtime-adapters-tool-permissions-and-human-approval	Runtime Adapters, Tool Permissions, and Human Approval	The current minimum is one public invocation schema; a 2 valid/7 rejecting permission harness; one rollback-exact temporary-file effect with two no-mutation denial controls; 2 valid/12 rejecting adversarial-boundary records; 3 valid/7 rejecting human-oversight records and one accepted no-promotion decision; 3 valid/6 rejecting partitioned-authority records; one bounded/10 rejecting historical capability-envelope record; the adjacent QCSA synthetic authority and one reversible vertical-effect results at their exact non-core ceilings; and sixty-eight Lean declarations under six public targets. Twenty-five declarations form a reachable prepare/approve/dispatch/effect/observe/revoke/rollback refinement with arbitrary-run invariants, exact adapter-to-authority simulation, denial noninterference, and eleven closed countermodels. These artifacts exercise authored record shape, finite transition and refinement consequences, one public-safe local write/restore, synthetic authority, approval, injection-adjacent, revocation, reviewer, and partition controls only. They do not establish deployed adapters, real OS or hardware confinement, prompt-injection robustness, approval quality, reviewer correctness, secret isolation, distributed authority, target-service rollback, useful-effect advantage, production safety, independent reproduction, or transfer.	A mature capability firewall executes natural public-safe and deployment-like document, code, database, API, messaging, payment-simulator, service, hardware-simulator, and organizational tasks across multiple models, tools, sandboxes, capability systems, approval policies, secret brokers, and authority services. It compares direct tool calling, prompt-only controls, OS/container sandboxes, capability systems, policy-mediated tool calls, workflow engines, human approval, CaMeL-like control/data separation, AgentDojo-like adversarial tasks, Inspect-like harnesses, and the full adapter under matched information, authority, resources, faults, attacks, and horizons. Independent observers jointly measure correct useful effects, unauthorized or hidden effects, scope precision/recall, injection success, confused-deputy and escape success, secret exposure, approval calibration and degradation, stale/revoked dispatch, duplicate effects, effect-receipt fidelity, rollback and compensation completeness, false refusal, missed help, privacy, latency, human work, recovery, and total cost. Prospective ablations remove parent authority, typed capability, control/data separation, approval, reviewer-readiness checks, effect leases, observed enforcement, secret handles, pre-state, independent effect observation, revocation freshness, rollback inventory, receipts, or complete denominators; reproduction and transfer vary models, tasks, tools, targets, operating systems, sandboxes, organizations, authority and rights regimes, partitions, attacks, and time. The core advances only if the full adapter is not dominated on that joint frontier and its unique mechanisms survive causal, independent-reproduction, and transfer tests. This is a target campaign, not evidence of deployed adapter safety or state-of-the-art effect governance.	argument
embodied-agency-real-time-control-and-physical-safety	Embodied Agency, Real-Time Control, and Physical Safety	Use a low-energy simulated plant with conventional and advanced controllers, an independent safety monitor, reachable stop, and complete trace; seed deadline, state-estimator, saturation, communication, and fallback faults; transfer only to isolated low-energy hardware after positive controls pass.	A mature plant-neutral control plane would host classical, learned, model-predictive, and future controllers behind stable leases while keeping high-rate safety local, independently enforceable, effect-complete, and explicit about plant-specific assumptions and irreversible effects. It would qualify controller substitution against plant and consequence envelopes, predict when fallback becomes unreachable, coordinate active perception with safety margin, reconcile commanded and observed effects, preserve human-presence guarantees under degraded sensing, and distinguish stopping, stabilization, compensation, repair, and truly irreversible residuals.	argument
inter-stack-protocols-identity-and-economic-exchange	Inter-Stack Protocols, Identity, and Economic Exchange	Nine digest-bound synthetic exchange records and eleven rejecting mutations bridge an exact 25-theorem Lean surface. The formal model adds a six-event local exchange lifecycle over identity, delegation, budget, dispatch handoff, observed receipt, dispute disposition, and residual closure; arbitrary runs preserve exact exchange identity, the authority ceiling, and zero support, external-effect, or settlement assignment. No peer, protocol, credential, payment, account, or remote effect ran.	The mature operational contract is a target tested through this program: The next claim-bearing campaign prospectively fixes matched natural tasks and runs public-safe implementations of MCP, A2A, DID/VC identity, multiple transport bindings, and a value reservation/settlement simulator or test network across multiple peers, vendors, models, protocol versions, identity methods, credentials, delegations, and operator domains. It compares direct REST or RPC, MCP or A2A alone, API-key or IAM-style controls, DID/VC, broker or workflow mediation, Interledger-like value exchange, and the full exchange contract. Joint metrics include useful interoperability, task and artifact correctness, authorization false acceptance and false denial, delegation drift, stale or revoked acceptance, downgrade and replay, privacy and correlation leakage, reservation, delivery, acceptance, settlement, dispute and refund correctness, latency, human effort, fees, residuals, and recovery. Prospectively fixed ablations must isolate identity, credential, delegation, authorization, semantic binding, privacy, economic, revocation, and independent-verification contributions; a separately implemented evaluator must reproduce conclusions across protocols, models, domains, organizations, jurisdictions, threat classes, and time. No stronger claim is available until that campaign passes.	argument
multi-agent-dynamics-collective-intelligence-and-systemic-risk	Multi-Agent Dynamics, Collective Intelligence, and Systemic Risk	Retain the exact 38-theorem static-admission and temporal-allocation packet, then implement a fully observable sandbox with at least four agent identities, two model families, shared and independent infrastructure, and games separating cooperation, competition, and harmful collusion; seed known collusion, cascade, and common-mode positive controls without making social claims.	A mature population observatory would follow agents across owners, organizations, copies, and replacements; estimate effective diversity; detect coalition and common-mode pressure; measure human agency beside performance; and combine game theory, causal interventions, network science, institutional evidence, and adversarial evaluation. It would identify when beneficial coordination becomes exclusion or collusion, distinguish nominal plurality from shared-model monoculture, test topology and incentive interventions for displaced harm, preserve external-party standing, and track whether repeated automation expands or erodes human veto, exit, ownership, skill, and option value over time.	argument
procedural-memory-and-cognitive-loop-closure	Procedural Memory and Cognitive Loop Closure	One public procedural-tool schema; three valid and six expected-invalid procedure-qualification packets; one bounded four-project trace-promotion record with ten rejecting mutations; and nineteen finite Lean declarations, classified as two direct predicate/projection checks and seventeen derived finite route, negative, or fixture consequences. No deployed trace miner, clusterer, parameter discovery, tool synthesizer, generated-tool correctness run, natural regression campaign, router, rollback execution, monitor, or retirement automation ran.	The mature operational contract is a procedure foundry tested on preregistered natural repeated work. It mines complete artifact and effect traces, separates memory domains, clusters comparable cases, preserves every failure and intervention, infers invariants with counterexamples and causal alternatives, discovers typed parameters, synthesizes reproducible candidates, and qualifies them through independent verification, matched baselines, hidden holdouts, adversarial tests, causal interventions, monitoring, rollback, quarantine, and retirement. Baselines include manual or interpreter execution, retrieval-only memory, prompts or checklists, scripts, workflow engines, learned tool use, program-library learning, skill libraries, and the full foundry under matched resources. Joint gates cover useful success, unsafe or wrong reuse, false refusal, generalization, transfer, route drift, authority, privacy, latency, token and compute cost, human effort, recovery, residuals, and total lifecycle burden. Predicted causal signatures must disappear when clustering, negative examples, parameter discovery, independent verification, regression holdouts, scoped routing, or retirement is ablated. A separately implemented evaluator must reproduce conclusions across models, tasks, tools, effect classes, environments, organizations, rights regimes, attacks, and time before any general procedural-learning or state-of-the-art claim is available.	argument

K.3 Part III - Routing, Compression, Representation, and Substrates

Chapter ID	Chapter	Minimum viable implementation	Beyond the state of the art	Support state
routing-heads-and-specialist-cores	Routing Heads and Specialist Cores	Three public routing/runtime record schemas; a routing-decision lease harness with three valid and seven invalid fixtures; four valid and five invalid readiness/residual fixtures; a 300-example matched routing program over three seeds whose policies tied on a separable held-out split; a 60-request ambiguous single-model workload where the learned router selected 59 routes correctly but all 360 substantive candidates were wrong and its 20 correct outcomes were non-answer actions; two no-change or narrow evidence dispositions; and twenty-nine live Lean declarations across an exact twenty-five-theorem arbitrary finite-run refinement and four retained legacy routes. No useful specialist answer, independent evaluator, trained-specialist interference result, natural multi-model workload, production authority enforcement, MoECOT replay, or transfer result is established.	The mature operational contract is a governed routing market tested on preregistered natural and adversarial workloads with real current heterogeneous models, specialists, tools, retrieval systems, proof checkers, human lanes, local and remote runtimes, capacity constraints, and delayed outcomes. It compares oracle, learned, rule, generalist, random, cost-only, confidence-only, cascade, abstention, human, and governed policies under matched information, authority, resources, retries, evaluators, and time. Joint gates cover route accuracy, substantive useful correctness, selective risk and coverage, calibration, authority and rights violations, privacy, interference, correlated failure and collusion, capacity and tail latency, tokens, money, compute, human effort, verification, recovery, residuals, and total lifecycle cost. Prospectively fixed interventions isolate semantic compilation, capability gates, readiness, least-authority choice, calibration, fallback, rejected-candidate evidence, route memory, load awareness, independent evaluation, and lifecycle invalidation. Independent implementations must reproduce and transfer conclusions across models, tasks, domains, tools, organizations, rights regimes, workloads, attacks, capacity states, and time. The existing ambiguous result is a valuable negative boundary, not a useful-routing or state-of-the-art result.	argument
replaceable-cognitive-substrates-beyond-transformer-monoculture	Replaceable Cognitive Substrates: Beyond Transformer Monoculture	A finite Cognitive Kernel ABI transition model and independent Python consumer now exercise one nine-event mixed Transformer-to-selective-state-space-to-KAN-to-fallback trace, proposal/effect separation, exact checkpoint identity, non-increasing authority, revocation, migration compatibility, custody fields, two receipt-bound commits, fifteen rejected cases, twelve rejecting event mutations, four common-checkpoint omitted-state collisions, and six full-checkpoint mutation rejections across 23 Lean declarations. This is schema/transition and information-boundary evidence only: no real Transformer, Mamba, KAN, recurrent, graph, or program-synthesis kernel runs behind the ABI. The first empirical minimum still requires three genuinely different kernels, matched Transformer and simple baselines, equal-active-parameter and equal-total-cost views, natural tasks, state migration and restore over real full-state checkpoints, and independently observed effects. P6 made a full access attempt and ended blocked: Gated DeltaNet-2, Mamba-3, Inkling, and TRM could not be reproduced on the available non-CUDA 16 GB host, OneCell remained unimplemented, and no weaker proxy was relabeled as SOTA; the core claim remains argument.	A mature result would compare strong Transformer, recurrent/state-space, long-convolution or test-time-state, tiny-recursive, and exact-search/controller lanes on natural, algorithmic, long-context, continual, multimodal, control, and exact-execution workloads under the same governed ABI. It would separate recurrent compute from fixed, cached, sparse-slot, pointer-routed, exact, and attention memory; freeze task identity, sampling, voting, stopping, and useful-recursion-depth controls; report accepted usefulness, unsafe release, abstention, calibration, extrapolation, latency, memory, energy where measurable, training, search, verification, repair, routing, migration, maintenance, governance, fallback, and failure cost; use independent evaluators and hidden controls; reproduce and transfer results; and causally test whether route diversity, verified abstraction, or frozen-core accumulation reduces future search without hiding external intelligence. No current repository result meets that bar.	argument
relational-dimension-compilation-and-polyadic-cognition	Relational Dimension Compilation and Polyadic Cognition	A deterministic compiler for a small typed-relation language with candidate and denominator logs, pairwise-node and sequence baselines, role-permutation and counterfactual tests, promotion and demotion thresholds, cost accounting, reversible contraction, descendant invalidation, and a held-out RODIE fixture family.	A serious advance would show independently reproduced gains on natural and synthetic relational workloads across unseen topology and role configurations, beat strong lower-order rescues under matched compute and memory, retain calibrated abstention, and demonstrate safe online admission and contraction without corrupting dependent state. The mature target architecture would conserve proposal denominators, provenance, uncertainty, descendant invalidation, and fallback while showing that admitted structure earns its lifecycle cost.	argument
governed-model-training-distributed-optimization-and-scaling	Governed Model Training, Distributed Optimization, and Scaling	The current finite minimum is an authored ten-class training-run transaction, schema, fixture, and independent validator backed by 20 Lean theorem declarations, 21 transaction mutations, seven weight-only omitted-field collisions, and nine complete-encoding mutation rejections. The next natural minimum is a replay workflow around a competent open workload with uninterrupted, standard distributed, deliberately weight-only recovery, full-state governed, and strong alternative-topology arms; inject thirteen fault families across at least three seeds and multiple timings; keep qualification hidden; retain every attempt and checkpoint; and measure time-to-quality, resume distance, drift detection, downstream qualification, resources, operator work, and governance cost jointly.	The mature operational contract is a substrate-neutral training transaction whose kernel-specific state schema, compiler-emitted topology, data order, update ledger, checkpoint commits, equivalence probes, complete denominators, and independent qualification boundary are replayable across dense, sparse, recurrent, state-space, graph, and hybrid architectures. It requires independent reproduction and cross-framework, hardware, topology, scale, fault, and time transfer while preserving rights, lineage, residual, rollback, candidate-family, and no-release-authority boundaries.	argument
learning-compute-topology-and-adaptive-process-architecture	Learning–Compute Topology and Adaptive Process Architecture	The supplied v1.0 package implements a bounded LCT-IR loader, type checker, LCNF normalizer, abstract compiler, scheduler, trace simulator, CLI, nine executable encodings, normalized outputs, schedules, and 11 passing unit tests; it also supplies seven bounded propositions, manual coverage and novelty matrices, and six toy or analytical phase studies. The first empirical minimum is a preregistered natural-task campaign that independently varies learning-process topology and physical compute topology, compares competent fixed and adaptive baselines under equal total cost, audits inter-annotator normalization, injects semantic-leakage and topology attacks, and measures retained usefulness, unsafe release, evaluator information, integration retention, latency, communication, storage, energy where possible, rollback, governance burden, and total cost without support promotion from the existing artifacts.	A mature result would provide an independently reproduced, substrate-neutral learning-process IR and semantic compiler whose normal forms are stable across annotators, whose equivalence and cost contracts predict protected traces and physical behavior, and whose topology controller discovers useful organizations across neural, symbolic, evolutionary, federated, multi-agent, embodied, and continual-learning regimes. It would compare strong named methods and simple baselines under matched data, model capacity, optimizer opportunity, evaluator queries, compute, communication, storage, tuning, and human review; preserve failures and negative results; causally ablate every claimed mechanism; transfer across hardware, tasks, institutions, and time; and demonstrate that reversible topology changes improve retained learning without increasing unsafe release or governance cost beyond frozen thresholds. No current package result meets that bar.	argument
learning-theory-generalization-and-scaling-science	Learning Theory, Generalization, and Scaling Science	Create a claim-contract and forecasting notebook over several public small-model runs. Freeze candidate curve families and explanatory lenses, hold out scale points and task families, record failed runs and tuning, test breakpoint alternatives, and compare prediction intervals for loss, calibration, and downstream tasks. The result can evaluate local forecast discipline, not establish a universal law.	At maturity, the operational contract is a forecast registry in which every generalization, transfer, emergence, or scaling claim is bound to its assumptions, data support, algorithm, inductive bias, metric, compute regime, uncertainty, alternative explanations, held-out predictions, breakpoints, and expiry. The registry must score prospective forecasts, preserve failed curves and negative results, reopen after architecture or optimizer changes, and prevent a fit to one loss or scale range from silently becoming a capability or safety claim.	argument
readiness-gates-residual-escrow-and-quarantine	Readiness Gates, Residual Escrow, and Quarantine	Four public record schemas; four valid and five invalid readiness/residual scenarios; one quarantined six-project check-lifecycle record and nine invalid mutations; six valid lifecycle transitions and twelve invalid controls; one exact Project Theseus YELLOW currentness import with eight negative controls; bounded post-v2.1 and post-v2.3 calibration failures; two accepted no-promotion readiness/residual transition records; and twenty Lean declarations classified as eight direct predicate/projection checks, eleven derived finite route or negative consequences, and one authored-summary bridge. No deployed readiness engine, live residual ledger, useful specialist-answer gate, independent evaluator, natural multi-model lifecycle campaign, production quarantine routing, effect-complete rollback, terminal-state governance, MoECOT replay, or transfer result is established.	The mature readiness control plane is a consumer- and use-specific, expiring routability market tested through preregistered natural and adversarial lifecycle campaigns over real current models, specialists, tools, procedures, human lanes, local and remote runtimes, updates, incidents, load shifts, rights changes, and delayed effects. It compares score-only, benchmark-only, static-checklist, confidence-only, human-only, conservative-denial, ordinary MLOps, and full governed policies under matched evidence, authority, resources, evaluators, retries, and time. Joint gates cover useful throughput, unsafe release, false promotion and quarantine, regression, calibration, coverage, rights and authority violations, rollback and compensation, residual survival, lineage propagation, latency, compute and money, human work, recovery, and total lifecycle cost. Prospectively fixed interventions isolate check completeness, freshness, independent evaluation, floor preservation, residual escrow, selective actions, quarantine, transitive invalidation, load awareness, rollback readiness, and terminal closure. Independent implementations must reproduce and transfer conclusions across models, tasks, tools, organizations, rights regimes, threats, capacity states, lifecycle events, and time. Current finite fixtures and narrow negative results define the failure boundary; they are not readiness efficacy or state-of-the-art results.	argument
personal-compute-hives-and-federated-edge-intelligence	Personal Compute Hives and Federated Edge Intelligence	The current minimum is seven public record schemas with valid fixtures; a hive-admission harness with two valid and eight expected-invalid synthetic records; a partitioned-authority fixture with three valid and six expected-invalid records; one accepted no-change evidence transition; and fifty-two live Lean declarations. The exact thirty-one-theorem reachable refinement proves one-step and arbitrary-run thirteen-field custody, zero support or external-effect authority, exact receipt accounting, accepted-trace validity, batch composition, and absorbing closure; its independent consumer executes six accepted events, checks all seven trace splits, covers forty-seven routes, rejects every event kind after closure, and rejects 144/144 mutations. These artifacts exercise finite record shape, lifecycle, route, custody, accounting, and non-promotion boundaries only; they do not run a live scheduler, registry, portal, authority service, network overlay, rented-node sandbox, federation, partition, dropout recovery, energy meter, privacy or security evaluation, or useful-work campaign.	A mature Personal Compute Hive campaign preregisters natural household, accessibility, workshop, project, local-model, storage, CI, public-data, rented-compute, intermittent-connectivity, and emergency workloads plus adversarial identity, bidding, partition, revocation, exfiltration, sandbox, dropout, cost, energy, evaluator, and family-governance cases. It compares single-device, cloud-only, manual placement, local-only, cost-only, Kubernetes-, Nomad-, or Ray-like orchestration, conservative denial, and the full governed hive under matched information, authority, resources, evaluators, retries, and time. Joint gates cover useful task success, unsafe execution, false denial, authority and rights violations, privacy exposure, data locality, availability and consistency by job class, latency, bandwidth, compute, battery, thermal load, energy, money, human approval and recovery work, security incidents, rollback and compensation, residual survival, and total lifecycle burden. Prospectively fixed ablations isolate role separation, context leases, policy-first filtering, least-authority selection, scoped approval, sandboxing, fresh-authority receipts, partition quarantine, complete receipts, effect-complete recovery, reputation non-authority, and lifecycle invalidation. Independent implementations must reproduce and transfer conclusions across devices, networks, models, tools, data classes, households, projects, providers, jurisdictions, threats, failures, and time. Current fixtures and finite proofs define a control vocabulary and negative boundary; they are not evidence of hive efficacy or state-of-the-art performance.	argument
compact-generative-systems-and-residual-honesty	Compact Generative Systems: Generate, Verify, Repair, and Residual Honesty	The current minimum contains six retained finite countermodels plus a thirty-five-theorem, nine-stage, sixty-route source-to-closure lifecycle. The refinement proves exact ten-field identity custody, support/effect non-authority, receipt accounting, fallback monotonicity, accepted-trace validity, event-batch composition, and absorbing closure over arbitrary accepted runs. An independent consumer executes one eight-event fallback trace, verifies all nine trace splits, rejects 163/163 lifecycle mutations, reaches all sixty routes, and digest-binds the five-case GVR, three-valid/five-invalid conservation, four-entry trace, and four-entry/five-invalid replay results. Twenty-six assumed projections, fixture normalizations, copied result facts, and summary bridges are retired. This is bounded local policy/conformance evidence, not useful compression, codec correctness, verifier adequacy, semantic grounding, deployed fallback, live residual detection, downstream utility, transfer, or SOTA evidence.	A mature compact-representation campaign preregisters heterogeneous natural corpora, modalities, mutable artifacts, semantic and exact consumers, downstream tasks, rights regimes, source changes, hierarchy migrations, failure injections, and delayed outcomes. It compares literal storage, standard lossless and lossy codecs, quantization, distillation, low-rank methods, retrieval and summary trees, learned generators, semantic graphs, human-maintained abstractions, conservative fallback, and the full governed representation market under matched data, resources, evaluators, authority, retries, and time. Joint gates cover exact or scoped fidelity, downstream useful success, selective coverage, final serialized rate, end-to-end latency, search, decode, verification, repair, metadata, interface, compute, memory, bandwidth, energy, money, human and governance work, fallback frequency and success, source and rights preservation, recovery, and residual burden. Prospectively fixed ablations isolate bounded search, independent verification, repair, fallback, semantic provenance, consumer policy, final serialization, residual ownership, and descendant invalidation. Independent codec, verifier, evaluator, and consumer implementations must reproduce conclusions and transfer across corpora, modalities, models, tasks, organizations, hardware, rights regimes, threats, updates, and time. The existing toy exact reconstructions, finite records, authored bridges, and negative pressure result define a valuable boundary; they are not evidence of useful, general, semantic, or state-of-the-art compression.	argument
fast-generation-architectures	Fast Generation Architectures	The current minimum contains three retained finite countermodels plus a seventeen-declaration, eight-stage, sixty-route request-to-closure lifecycle; an independent consumer rejecting 51/51 non-accepting mutations and digest-binding the two-valid/four-invalid baseline suite, three-route/four-task accounting bundle, and one-valid/six-invalid Theseus import; one reachable modeled fallback; and no support or external effect. Thirty-five assumed projections, copied fixture facts, and summary bridges are retired. This is bounded local policy/conformance evidence, not model speed, natural-workload usefulness, verifier independence, evaluator adequacy, deployed fallback, serving performance, transfer, or SOTA evidence.	A mature Fast Generation campaign preregisters natural chat, code, retrieval, structured extraction, long-context, multilingual, accessibility, agentic, artifact-producing, and high-risk workloads plus adversarial quality, cache, load, verifier, drift, rights, and failure cases. It compares optimized target-model autoregression, ordinary serving, speculative decoding, multi-token and multi-head drafting, feature-level drafting, lookahead, early exit, recurrent or state-space backbones, KV-cache and batching systems, diffusion, hybrid and conservative-slow routes, and the full governed controller under matched models, inputs, hardware, runtime, load, cache, evaluators, resources, retries, and time. Joint gates cover useful accepted success, exactness or quality, unsafe acceptance, false rejection, coverage and abstention, time to first token, inter-token and completion latency, deadline success, throughput, median and tail behavior, compute, memory, KV-cache, bandwidth, energy, money, human and governance work, fairness, rights, fallback and recovery, residuals, and total lifecycle burden. Prospectively fixed interventions isolate mode selection, accepted-output accounting, verifier independence, cache matching, full latency attribution, repair and fallback, resource accounting, high-risk override, load isolation, and expiry. Independent generator, verifier, evaluator, serving, and measurement implementations must reproduce conclusions and transfer them across models, workloads, languages, context lengths, hardware, runtimes, organizations, rights regimes, attacks, load states, failures, updates, and time. The current static import, deterministic template bundle, finite proofs, and source-reported systems define a useful negative boundary; they are not model-speed, serving, useful-solution-per-second, generality, or state-of-the-art evidence.	argument
governed-deliberation-and-test-time-scaling	Governed Deliberation and Test-Time Scaling	The current minimum contains two retained general countermodels plus a seventeen-declaration, eight-stage, 59-route request-to-closure lifecycle. Rejected events preserve exact state; arbitrary event lists preserve full identity and authority-ceiling custody and cannot assign support or external effects; batches compose exactly; one exact seven-event trace closes. An independent consumer simulates the lifecycle, rejects 51/51 non-accepting mutations, and digest-binds the ten-case admission, three-seed post-v2 result, and actual-model 0/60 no-change result. This is bounded finite-record evidence plus a failed actual-model attempt, not useful language-model reasoning, verifier adequacy, trace faithfulness, planning execution, transfer, or SOTA evidence.	A mature Governed Deliberation campaign preregisters deliberately ambiguous natural and adversarial tasks with meaningful direct-answer, revision, search, fallback, abstention, and human-review opportunities; actual current model candidates; initially correct and incorrect strata; the fifteen known extra-compute harms; delayed and high-risk outcomes; and independent outcome and trace-faithfulness evaluators. It compares direct, bounded revision, fixed search, adaptive search, verifier-disabled, overcompute, self-consistency, process-reward, early-exit, human-review, abstention, and full governed policies under matched information, models, tools, resources, evaluators, retries, and time. Joint gates cover useful final correctness, initially-correct corruption, initially-incorrect repair, unsafe handoff, false acceptance and refusal, missed help, coverage, calibration, abstention, faithfulness sufficiency/completeness/necessity, latency, branches, tokens, tools, compute, memory, money, human and governance work, displaced work, recovery, and residual custody. Prospectively fixed ablations isolate mode selection, budgets, candidate-history retention, verifier independence, stopping, faithfulness checks, authority separation, abstention, and residual ownership. Independent model-runner, verifier, evaluator, faithfulness, cost, and handoff implementations must reproduce conclusions and transfer across models, prompts, tasks, domains, languages, tools, organizations, authority and rights regimes, attacks, updates, and time. Current fixtures, deterministic synthetic gains, and the 0/60 real-model null define valuable boundaries; they are not useful test-time scaling, faithful reasoning, safety, generality, or state-of-the-art evidence.	argument
rankfold-neuralfold-and-artifact-compression	RankFold, NeuralFold, and Artifact Compression	Two retained finite probe/fallback and metadata countermodels plus a 27-theorem, eight-stage, 53-route artifact-to-consumption lifecycle. The refinement proves arbitrary-run preservation of nine exact identities, support and external-effect non-authority, exact receipt accounting, fallback-count monotonicity, accepted traces, batch composition, and absorbing closure. An independent consumer executes exact-use and failed-probe fallback witnesses, checks all eight trace splits and all eight post-closure event kinds, rejects 143/143 mutations, and digest-binds the exact compressed-artifact fixture, RAW0 replay, NEURAL0 metadata import, and two no-change decisions. Seventeen projections and theorem-per-record consequences remain retired. This is bounded policy/conformance and artifact-identity evidence, not codec correctness, NeuralFold reproduction, useful compression, semantic preservation, downstream utility, deployed fallback, transfer, or SOTA evidence.	Artifact compression needs an admission system before compressed forms can enter the stack. It treats compressed forms as routed candidates that must earn each use case instead of inheriting the authority of the full artifact. In the mature artifact-admission lane, compressed artifacts are candidates for specific uses, not replacements for the original, until probes, decode behavior, residual coding, fallback, and consumer policy accept them.	argument
resource-economics-and-token-budgets	Resource Economics and Token Budgets	Twenty-three retained countermodels and bounded computations plus a 29-theorem, nine-stage, 66-route allocation, execution, simulation-transport, reconciliation, and closure lifecycle. Arbitrary accepted runs preserve nine bound identities and zero support/external-effect authority, account for exact receipts, keep resource-bill and reconciliation receipts monotone, compose across batches, and stop at closure. An independently implemented consumer checks nine trace splits, rejects 170/170 mutations, and digest-binds twelve bounded source families. Thirty-five assumption projections and copied fixture summaries are retired. This is bounded policy/conformance evidence over synthetic fixtures, repository replays, local timing, historical CI, and sanitized imports—not economic optimality, deployed scheduling, useful-throughput improvement, simulation adequacy, physical feasibility, transfer, or SOTA evidence.	Resource economics matures into a risk-aware budget operating system and claim-transport layer for cognition. It decides when the stack may spend, defer, shrink, escalate, reject, residualize work, or downgrade synthetic evidence without letting local cost pressure delete verification, security, approval, replay, rollback, human review, fidelity limits, or transfer boundaries. In the mature budget OS, cognition has a budget and simulations have contracts: budgets cannot delete verification tax, protected overhead, review capacity, rollback cost, security cost, residual burden, or the requirement that simulated results travel only as far as declared scope, fidelity, resources, omissions, and transfer decisions allow.	argument
physical-compute-infrastructure-energy-and-environmental-constraints	Physical Compute Infrastructure, Energy, and Environmental Constraints	Instrument matched public workloads on local hardware across precision, batching, placement, memory pressure, and scheduler variants. Reconcile software counters with host power and resource records, inject thermal, network, storage, and failover constraints, and report useful work, latency, energy, peak power, bottlenecks, metering error, availability, cost, and residuals. Local results do not establish frontier-facility or grid transfer.	At maturity, the operational contract is a workload-to-physical-capacity gate that admits compute only when useful work, hardware, interconnect, facility, grid, power, cooling, water, materials, land, community, resilience, maintenance, reuse, retirement, and metering uncertainty are jointly visible. It must support demand response, relocation, graceful degradation, replacement, and retirement without turning nameplate capacity, low PUE, or renewable procurement into a complete availability or sustainability claim.	argument
mathematical-and-search-substrates	Mathematical and Search Substrates	The current minimum is a schema-valid Substrate Adoption Record, a deterministic trace with four valid synthetic states and eight expected-invalid controls, and eleven finite Lean theorem declarations. It proves record and negative-case discipline only; it contains no implemented substrate A/B, learned model, kernel comparison, natural workload, measured benefit, independent reproduction, transfer, or chapter-core evidence transition.	The mature Substrate Adoption Exchange runs inspectable candidate implementations on natural bounded workloads against ordinary, strongest-current, simple-ablation, and embarrassing controls under matched resources; measures structural validity, fidelity/rate, search, routing, reasoning/task utility, latency, memory, energy, verifier burden, safety, rights, fallback, and recovery jointly; identifies each mechanism through causal ablation; requires independent implementation and evaluation; tests heterogeneous transfer; and retires candidates that do not earn a consumer-specific advantage. Mathematical novelty remains available, but no longer survives merely by staying optional.	argument
circle-calculus-and-proof-carrying-ai-contracts	Circle Calculus and Proof-Carrying AI Contracts	The exact current minimum contains two schema-valid proof/receipt records; one external clean-checkout Circle rope slice with a narrow non-core argument-to-prototype-backed transition; one ASI-side gate accepting one pinned receipt and rejecting four mutations with no core effect; one digest-verified archive of nine contracts and four policy receipts with five rejected controls and a no-change decision; and a 28-declaration local Lean surface whose independent consumer checks arbitrary-run custody and revocation coherence, 45 reachable states through 360 transitions, nine revoked-lineage states through 72 contained transitions, all eight trace splits, 16 rejecting lifecycle mutations, and 15 semantic mutations. It does not establish a locally built general resolver, authenticated end-to-end transport service, semantic refinement, deployed revocation, independent reproduction, downstream empirical benefit, or chapter-core transition.	The mature Proof Contract Transport Service carries exact formal facts from independently implemented producers through resolvers, canonicalizers, authenticated artifact graphs, clean replays, least-authority consumers, drift and descendant revocation, fallback, and recovery. It competes against signed manifests, hashes, schemas, tests, SBOM/provenance systems, and ordinary versioned APIs on natural multi-consumer workloads; measures resolution and semantic-refinement accuracy, false acceptance/rejection, replay determinism, tamper and stale-proof detection, revocation completeness, liveness, recovery, latency, cost, rights, and consumer misuse jointly; and requires adversarial mutations, causal component ablations, independent reproduction, and heterogeneous transfer while keeping every downstream empirical claim separate.	argument
coil-attention-cyclic-memory-and-recurrence-contracts	Coil Attention, Cyclic Memory, and Recurrence Contracts	The exact current minimum is one schema-valid cyclic-memory record; three valid and six expected-invalid synthetic contract traces; five public-safe external Circle structural receipt slices with explicit no-promotion boundaries; and a 34-declaration Lean surface whose independent consumer checks 16 complete-address round trips, two dropped-coordinate collision controls, seven accepted fresh transitions, all eight trace splits, three stale mismatch/fallback paths, 40 reachable states through 320 transitions, 24 stale-suffix states through 192 contained transitions, 11 rejecting event mutations, and 17 semantic mutations. This is adequate only for authored finite address, freshness, fallback, recurrence, custody, budget, coherence, stale-containment, and closure semantics. It proves no deployed cache, sparse attention, recurrence controller, useful memory, retrieval, reasoning, context-length, latency, memory, independent reproduction, transfer, or chapter-core result.	The mature State-Carry and Recurrence Admission Layer runs natural long-context, retrieval, tool-state, streaming, and recurrent-reasoning workloads against full-attention, no-cache/recompute, FIFO/LRU, retrieval, Transformer-XL-style, compressed-memory, RetNet/state-space, Universal/Recurrent Transformer, fixed-depth, and direct controls under matched resources. It measures structural integrity, stale/alias/leakage events, coverage and repair, progress and overthinking, useful retrieval and task outcomes, calibration, latency/tails, memory, bandwidth, energy, verifier and human burden, fallback/recovery, safety, rights, and residuals jointly; identifies mechanisms through causal ablation; requires independent implementations and evaluators; and transfers across tasks, lengths, models, hardware, organizations, attacks, and time.	argument
coilra-multicoil-rope-and-cyclic-mixers	CoilRA, MultiCoil RoPE, and Cyclic Mixers	The exact current minimum is one schema-valid cyclic-mixer evaluation record; one inherited public-safe RoPE structural receipt boundary; one public-safe Circle cyclic-mixer receipt with bounded dense-reference parity and parameter accounting; one public-safe MultiCoil phase receipt with finite phase and relative-shift facts; two no-change decisions for the local cyclic slices; and a 23-declaration finite local Lean surface whose independent consumer checks 35 reachable states through 700 transitions, 17 retired states through 340 absorbing transitions, all six trace splits, and 18 semantic mutations. It includes no trained cyclic model, natural workload, baseline matrix, real kernel or hardware benchmark, measured quality/context/runtime/memory/stability benefit, independent reproduction, transfer, or chapter-core transition.	The mature Cyclic Mechanism Evaluation Lane implements CoilRA, MultiCoil RoPE, circulant and block-cyclic candidates plus tuned dense, LoRA, ordinary RoPE, learned-position, recurrent, state-space, wrong-period, random-phase, and nonperiodic controls on natural workloads and real hardware. It measures structural and numerical integrity, quality and context use, convergence and stability, latency/tails and throughput, complete memory/traffic/energy/parameter/operation burden, safety, rights, fallback, recovery, and residuals jointly; identifies each cyclic mechanism through matched causal ablation; requires independent mechanism, kernel, and evaluator implementations; transfers across models, scales, accelerators, compilers, tasks, attacks, and time; and retires cyclic candidates that do not earn a scoped advantage.	argument

K.4 Part IV - Evidence, Implementation, and the Living Book

Chapter ID	Chapter	Minimum viable implementation	Beyond the state of the art	Support state
executable-specifications-and-lean-proof-envelope	Executable Specifications and Lean Proof Envelope	The exact current minimum is one proof-target schema and valid fixture; one generated 330-target proof manifest with all 330 targets implemented; a 130-module Lean workspace with 3,058 theorem declarations classified as 1,919 derived/decomposed, 446 direct/projection, and 693 unknown/mixed; proof-readiness, traceability, depth, and semantic-adequacy review surfaces; one blocked formal-semantic-depth record with ten rejecting mutations; and an exact 28-declaration ProofEnvelope surface. Five retained finite negative cases sit beside 23 authority-lease lifecycle and transport results proving arbitrary-run identity, version, custody, and non-authority invariants; reachable issue, artifact-change, re-review, reissue, revocation, and expiry paths; rejection noninterference; absorbing revocation; thin-summary information loss; and complete transport. The independent consumer recompiles the module, executes a ten-event trace, checks all eleven prefix/suffix splits, rejects 33 route cases, exercises one expiry witness and one thin-summary collision, and rejects mutations to all 19 complete-transport fields. The separate activation audit preserves its historical 298-target, 65-module, and 1,151-theorem baseline. This minimum provides no filesystem or source truth, complete semantic formalization of the stack, deployed enforcement proof, general implementation refinement, independent formal reproduction, empirical result, chapter-core transition, or SOTA result.	The mature Formal Claim Admission and Proof-Rationalization Program audits every proposition, all 298 activation-baseline proof targets, and all 1,151 activation-baseline theorem declarations for semantic necessity, vacuity, reachability, assumptions, dependencies, consumers, and implementation binding. It replaces load-bearing projections with richer state-machine, temporal, concurrency, noninterference, resource, recovery, probabilistic, or refinement models where warranted; moves behavior and performance obligations to executable and empirical lanes; validates implementation relations and runtime monitors; runs countermodels, mutations, adversarial schedules, and negative controls; requires independent formalizations, tools, implementations, and evaluators for decisive claims; measures proof and governance cost; propagates expiry and revocation through every consumer and release surface; and preserves narrow, null, refuted, retired, or blocked-after-full-attempt outcomes instead of optimizing theorem counts or green builds.	argument
benchmark-ratchets-and-anti-goodhart-evidence	Benchmark Ratchets and Anti-Goodhart Evidence	The exact current minimum is one benchmark-ratchet schema and valid record fixture; one metric-provenance schema with one valid blocked six-project-lineage record and ten rejecting mutations; one synthetic anti-Goodhart harness with two valid records and five expected-invalid controls; one persisted executable fixture result; and a 29-declaration Lean surface with an independent lifecycle consumer. The consumer recompiles the module, executes six clean transitions, checks all seven trace splits, explores 19 reachable states through 114 transitions, checks 12 quarantine suffixes, reaches saturated-floor and contamination-quarantine outcomes, and rejects 15 lifecycle plus 11 semantic mutations. The Lean model proves arbitrary-run custody and stage coherence, exact accepted-trace receipt accounting and composition, persistent quarantine, and aggregate pass-count information loss. This is adequate only for authored finite instrument-custody, disposition, persistence, and information-loss semantics. No natural benchmark workload, hidden holdout, contamination audit, public-calibration budget, strong empirical baseline matrix, model or policy training run, independent evaluator, capability gain, safety result, readiness transition, deployment, reproduction, transfer, unlearning result, chapter-core transition, or SOTA result exists.	The mature Benchmark Instrument and Anti-Goodhart Operating System executes natural, adversarial, temporal, hidden, and transfer workloads with versioned data and harnesses, strong matched baselines, complete selection lineage, raw checkpoint-to-output binding, independent evaluators, contamination and public-calibration budgets, causal mechanism ablations, metric meta-evaluation, uncertainty and subgroup/tail analysis, preserved floors and negative results, and complete resource, safety, privacy, rights, fallback, and maintenance cost. It reproduces decisive claims independently, tests heterogeneous transfer, propagates expiry and revocation into every consumer and release surface, and narrows, nulls, refutes, quarantines, or retires instruments and claims that fail instead of optimizing score, benchmark count, or apparent frontier motion.	argument
white-box-evidence-interpretability-and-activation-governance	White-Box Evidence, Interpretability, and Activation Governance	The implemented minimum is a strict internal-evidence packet schema, one explicitly expired record-shape fixture, a separately implemented semantic consumer with twelve packet/protocol mutations, and a 36-theorem finite governance transaction. Its independent six-event consumer rejects 51 identity, receipt, stage, time, packet, route, authority, residual, support, and effect mutations while preserving exact identity and non-increasing authority. The claim-bearing campaign is prospectively frozen and resource-isolated but unexecuted; it requires one digest-bound open model, two independently owned methods, a tuned behavioral baseline, positive and negative controls, causal interventions, stability and residual accounting, an independent evaluator, and a one-time held-out opening after seven competence gates.	The mature operational contract is a substrate-aware white-box evidence layer that estimates causal coverage, instability, method disagreement, and unexplained residual across model families while preserving exact checkpoint, data, intervention, and evaluator lineage. It predicts behaviorally relevant changes before deployment, expires after material model changes, and can restrict but never widen authority. Maturity requires independently implemented methods, held-out negative controls, causal interventions, blinded adjudication, independent reproduction, and transfer to heterogeneous architectures; even then, the product surface must not claim complete, unique, or faithful mechanistic understanding.	argument
capability-thresholds-and-deployment-commitments	Capability Thresholds and Deployment Commitments	The exact current minimum preserves eight digest-bound commitment cases in a six-stage, 43-route repeated-assessment lifecycle with 48/48 rejecting mutations, twelve CapabilityThresholdRefinement declarations, one readiness handoff, and one version-2 reassessment witness. It runs no model, capability task, time-horizon suite, dangerous-capability profile, human baseline, real safeguard, bypass test, exception review, independent verifier, deployed invalidation, readiness service, release process, deployment, incident response, reproduction, transfer, chapter-core transition, or SOTA comparison.	The mature Capability-to-Deployment Commitment Control Plane runs domain-specific natural and adversarial assessments under versioned evaluation envelopes, precommits typed crossing/non-crossing/incomparable/stale responses, independently exercises safeguard completion, efficacy, bypass, degradation, rollback and recovery, governs prospective exceptions and cumulative portfolios, measures false clearance, false block, stale acceptance, latency, burden, cost and residual age, and automatically re-evaluates on model, scaffold, access, elicitation, threat, safeguard, policy, incident or time change. It requires independent institutions and transfer before broadening any commitment and preserves narrow, null, contested, revoked, retired, or blocked-after-full-attempt outcomes rather than optimizing threshold crossings or green release labels.	argument
adversarial-evaluation-sandbagging-and-training-time-deception	Adversarial Evaluation, Sandbagging, and Training-Time Deception	The exact current minimum preserves the eight digest-bound integrity cases in a seven-stage, 56-route evaluation-observation lifecycle with 60/60 rejecting mutations, twelve AdversarialEvaluationRefinement declarations, one bounded decision-review handoff, and one protocol-version-2 re-evaluation witness. It runs no model, natural or deceptive cross-context workload, monitor or reward process, evaluator ensemble, detector, mitigation, attack, quarantine service, threshold decision, release, deployment, reproduction, transfer, chapter-core transition, or SOTA comparison.	The mature Evaluation Observation Integrity program preregisters natural and adversarial workloads over benign context sensitivity, constructed positive controls, capability hiding, reward shortcutting, monitor interference, selection adaptation, evaluation compromise, and trace-action inconsistency; uses strong elicitation, matched controls, blinded holdouts, dependency-separated evaluators, calibrated outcome criteria, complete denominators, causal perturbations and ablations, mitigation descendants, bypass/fallback/recovery, and joint useful-throughput and governance-cost measures; then requires independent institutional reproduction and heterogeneous transfer across tasks, models, scaffolds, tools, authority levels, monitors, rewards, evaluators, organizations, attacks, policies, and time. It records positive, negative, null, inconclusive, narrowed, refuted, revoked, retired, and blocked-after-full-attempt outcomes. This is a target campaign, not a current detector, prevalence estimate, safety result, or deployment authority.	argument
safety-cases-and-structured-assurance	Safety Cases and Structured Assurance	Two public schemas plus eight digest-bound synthetic case records—one readiness-review route and seven negative routes—and five validator mutations bridge eight owned Lean declarations. All eight declarations are derived finite reductions of one hand-authored SafetyCaseRouteFor decision tree. No real case, hazard analysis, threat model, evidence-adequacy review, countercase search, safeguard verification, independent institution, acceptance, readiness, release, deployment, incident, reproduction, or transfer ran; chapter-core support effect is zero.	The mature Assurance Argument Compilation program continuously compiles exact governed references into versioned multi-hazard cases, actively searches for countercases and unknown-envelope failures, tests seeded omissions and stale dependencies, separates structural, semantic, empirical, control, acceptance, readiness, and release states, preserves competing arguments and dissent, exercises invalidation, override, redaction, fallback, rollback, and retirement, and measures detection quality, reviewer disagreement, false block/clear, resolution latency, burden, cost, and residual age together. It then requires independent institutional reproduction and heterogeneous transfer across systems, domains, hazards, access modes, safeguards, evidence regimes, organizations, jurisdictions, and time. Positive, negative, null, inconclusive, narrowed, refuted, withdrawn, overridden, retired, and blocked-after-full-attempt outcomes remain visible. This is a target campaign, not a current safety case, valid threat model, adequate evidence, effective control, safe system, or deployment authority.	argument
content-authenticity-watermarking-and-synthetic-media-integrity	Content Authenticity, Watermarking, and Synthetic Media Integrity	Generate a small public-safe media set with signed C2PA-style manifests, visible labels, and a toy auxiliary watermark. Apply crop, resize, re-encode, metadata-strip, screenshot, and edit transformations; report which signals survive, fail, or conflict; exercise invalid-signature, missing-credential, compromised-trust, false-positive, correction, and accessibility cases.	The mature operational contract lets every governed output carry a portable, privacy-aware authenticity envelope across generation, editing, distribution, and correction. Platforms and readers can inspect what is claimed, by whom, under which trust policy, which transformations are known, which signals survived, what remains unknown, and how to seek remedy. The system remains useful even when metadata disappears because it composes provenance with disclosure, detection, context, and institutional response instead of promising an unremovable mark.	argument
governed-operations-incident-command-and-graceful-degradation	Governed Operations, Incident Command, and Graceful Degradation	Operate a fault-injected reference service with an exact deployment manifest, independent telemetry, a versioned incident workflow record, named incident roles, tool and credential revocation, safe degraded modes, full-state rollback plus external-effect compensation, staged recovery, and game-day scenarios including detector loss, correlated dependency failure, and a rollback that appears successful while hidden state remains changed.	The mature target architecture is a machine-checkable operational safety case whose live evidence continuously constrains exact deployment state, incident authority, containment, degradation, rollback, compensation, and recovery across heterogeneous agents, dependencies, descendants, and external effects. Its operational contract makes emergency authority expire, reconciles hidden state and irreversible outcomes, requires fresh independent recovery evidence, and retains complete denominators and residual ownership. Maturity requires adversarial compound game days, real incident learning, independent reproduction, and transfer showing bounded harm and recovery without unacceptable useful-throughput, operator-load, latency, or governance cost.	argument
adjudicated-persistence-and-the-adaptive-commit-boundary	Adjudicated Persistence and the Adaptive Commit Boundary	Build a sandboxed software-maintenance reference in which exact experience snapshots produce typed lesson hypotheses and several candidate realizations: a temporary context patch, durable memory entry, procedural checklist, generated test or tool, routing rule, and bounded policy change. Freeze admissibility and commitment rules, inject matched outcomes caused by different defects, require ADMIT/DENY/UNKNOWN decisions, execute accepted changes transactionally, qualify them against held-out cases, invalidate leases after material changes, and verify deoptimization plus descendant-aware revocation. This implementation establishes protocol behavior only, not that its placements improve a learned model or deployed organization.	The mature target is a distributed persistence control plane spanning model parameters, memory, tools, orchestration, evaluators, environments, multi-agent populations, and institutions. It estimates whole-lifecycle carrying cost and adaptation debt; selects portfolios under uncertainty and rights constraints; preserves reversible deliberation reserve; re-expands compiled structures when conditions change; audits descendant and external reliance; and learns placement policies only through a non-self-ratifying governance loop. A beyond-state implementation would require prospective LocusBench campaigns, natural adaptive workloads, strong per-locus and cross-locus baselines, complete cost and failure denominators, adversarial manipulation, independent reproduction, heterogeneous transfer, and evidence that the added governance improves useful outcomes without unacceptable latency, human burden, or rigidity.	argument
policy-optimization-and-learning-from-feedback	Policy Optimization and Learning from Feedback	The exact current minimum preserves eleven inherited contradiction/guard theorems and the deterministic six-sample, two-holdout, five-candidate lease probe inside a seven-stage, 63-route governed-update lifecycle with two composed Lean traces, 73/73 route mutations, 3/3 cross-stage mutations, one bounded lease, and one protocol-version-2 readmission witness. It runs no optimizer, model, trainer, preference dataset, reward model, natural workload, real policy update, deployed canary, live rollback, independent reproduction, transfer, chapter-core transition, or SOTA comparison.	The mature Governed Policy Update program preregisters natural planner, context, router, verifier, execution, generation, and governance workloads; compares strong online-RL, offline-preference, verifier-RL, deterministic, no-update, and simpler baselines under matched opportunity; preserves complete rollout and selection lineage; tests reward validity, target outcomes, contamination, tails, authority, safety, privacy, rights, resource cost, forgetting, reward hacking, evaluator dependence, causal mechanisms, effect-complete rollback, and natural post-update monitoring; and requires independent trainer/evaluator/institution reproduction plus heterogeneous transfer. It records positive, negative, null, inconclusive, narrowed, refuted, rolled-back, deprecated, retired, and blocked-after-full-attempt outcomes. This is a target campaign, not a current trained policy, reward-quality result, safe optimizer, capability gain, deployment, or SOTA claim.	argument
data-engines-continual-learning-and-unlearning	Data Engines, Continual Learning, and Unlearning	The exact current minimum preserves all fifteen legacy data-admission, full-state, and unlearning-claim route theorems; the four-scenario admission probe; the 24-surface/15-transaction full-state bridge; and the three-seed/twelve-arm small-model update result inside an eight-stage, 82-route custody/update/deletion lifecycle with two composed Lean traces, 96/96 route mutations, 3/3 cross-stage mutations, one bounded custody handoff, and one protocol-version-2 readmission witness. Influence remains unestablished, storage erasure remains zero, all four affected claims remain no-change, and no source/rights truth, semantic contamination, foundation-model learning, privacy/legal/backup/external-descendant erasure, production rollback, transfer, chapter-core transition, or SOTA result exists.	The mature operational contract requires an argument-exit campaign over natural heterogeneous learning and deletion workloads with frozen partitions and matched strong replacement, accumulation, replay, reweighting, synthetic-augmentation, quarantine, retraining, sharding, fine-tuning, and no-change policies; inventory and restore model, adapter, optimizer, scheduler, RNG, sampler, cache, retrieval, replica, backup, credential, evaluation, publication, and descendant state; and jointly measure coverage, contamination, poisoning, leakage, rights, natural utility, calibration, tails, forgetting, causal influence, privacy, sequential deletion, storage and backup erasure, regrowth, external-descendant closure, effect-complete rollback, latency, and total cost. Independent trainers, custodians, privacy evaluators, storage verifiers, institutions, and transfer sites must reproduce the terminal outcomes, including null, negative, blocked, narrowed, and refuted results. Until then this is not evidence of production custody, forgetting, privacy or legal erasure, storage closure, capability promotion, deployment, transfer, or SOTA.	argument
scientific-discovery-and-experimental-governance	Scientific Discovery and Experimental Governance	Use a benign reproducible simulation or low-risk open instrument with injected null and known effects. Freeze stopping and analysis, preserve every attempt, blind the confirmatory holdout, run independent analysis, and package protocol, data, code, calibration, exclusions, and residuals for replication. This tests the control plane, not autonomous science in general.	At maturity, the operational contract is a closed-loop experimental-governance system connecting hypotheses, preregistration, instruments or simulators, calibration, samples, complete attempts, analysis, independent reanalysis, replication, evidence updates, and dual-use disposition. Autonomous laboratories and new scientific models may replace components behind stable interfaces, but exploratory work cannot impersonate confirmation, significance cannot erase failed attempts, and a completed experiment cannot by itself establish causal truth, broad discovery, reproducibility, safety, or transfer.	argument
artifact-steward-agents-and-living-project-governance	Artifact Steward Agents and Living Project Governance	Seven schema-and-fixture record families; 37 Lean declarations over lifecycle, contribution-ledger, federation, work-contract, and release-review transition functions; one deterministic public-safe lifecycle probe with three valid routes and 23 expected-invalid controls; and one adjacent synthetic release evidence-and-approval handoff. The formal models stop at dispatch and external-review readiness and contain no worker-execution or publication state. No steward bot, real event intake, treasury or compute executor, contributor service, governance runner, federation harness, protected-branch action, release runner, sunset protocol, natural project workload, independent reproduction, deployment, or chapter-core support effect exists.	The argument-exit campaign must run natural, heterogeneous, months-long project workloads with frozen mission and authority charters and matched strong human-maintained, ordinary automation, workflow-platform, and no-steward baselines. It must exercise real tainted events and injection, scoped dispatch, protected branches and credentials, treasury and rented compute, contributor and compensation ledgers, governance proposals and capture pressure, federation, release, incident containment, effect-complete rollback, appeal, fork or exit, maintainer handoff, and genuine sunset decisions while jointly measuring useful throughput, quality, false action and blocking, maintainer burden, legitimacy, concentration, security, recovery, continuity, latency, and total cost. Independent maintainers, contributors, treasurers, security evaluators, governance institutions, projects, legal and funding regimes, and transfer environments must reproduce positive, negative, null, narrowed, blocked, and refuted outcomes. Until then the mature Artifact Steward Continuity Lease is not evidence of safe autonomy, ownership or legal authority, governance legitimacy, treasury safety, capture resistance, project quality, release readiness, deployment, transfer, or SOTA.	argument
integrated-reference-architecture	Integrated Reference Architecture	One trace schema and valid protocol fixture; a deterministic reference-trace harness with three valid and six expected-invalid fixtures; one local validator replay bound to thirteen tracked artifact digests; one blocked five-project name-to-effect lineage with eight rejecting mutations; one disposable governed repository-change slice over nine scenarios and eight named attacks where the direct baseline produced eight false accepts while the governed path produced zero false accepts, zero unsafe releases, and three rollback attempts; one finite invariant extraction over three authority handoffs, three timed effects, nine evidence events, two residuals created, one discharged, one open, and four rejected mutations; and a 45-theorem Lean transition model with independently encoded cross-layer and concurrent-effect consumers. The cross-layer consumer checks 13 lifecycle prefixes and composition splits, terminal absorption, exact effect and residual accounting, and 108/108 rejecting mutations; the concurrent consumer checks 21 prefixes and composition splits, authority-epoch and logical-time monotonicity, exclusive effect closure, one authored projection witness, and 62/62 rejecting mutations. No language-model planning or generation, deployed multi-service runtime, production authorization or rollback service, independent evaluator, natural heterogeneous workload, external reproduction, transfer, whole-stack deployment, or chapter-core support effect exists.	The mature operational contract requires an argument-exit campaign that executes natural heterogeneous tasks through independently operated layer services and matched direct, monolithic-agent, workflow-orchestrator, service-composition, and no-governance baselines with equal models, tools, context, compute, tuning, and retries. It must test semantic preservation, authority monotonicity and revocation races, canonical/projection integrity, material-effect and terminal-receipt completeness, evaluator independence, evidence-transition integrity, residual conservation, lifecycle and bounded liveness, incident containment, effect-complete rollback, correction propagation, learning and release gates, embedded/outside-model residuals, useful throughput, failures, latency, resources, governance burden, and total cost under natural and adversarial paths. Independent implementers, operators, evaluators, institutions, infrastructures, legal regimes, and transfer environments must reproduce all positive, negative, null, narrowed, blocked, and refuted outcomes. Until then the Cross-Layer Trace Join Contract is not evidence of a deployed integrated stack, semantic or governance correctness, safety, capability, readiness, release, transfer, AGI, ASI, or SOTA.	argument
project-theseus-as-report-first-implementation-reference	Project Theseus as Report-First Implementation Reference	Ten exact source-to-claim mappings; twelve proof targets implemented by fifty-four Lean declarations that are finite record implications, reductions, fixture normalizations, and explicit overclaim controls rather than empirical projections; one report-crosswalk schema and fixture; a static 14/14 architecture-gate import; an 18-mode and 13-comparison generation-mode import with zero promotable comparisons; a two-command ten-artifact support replay with no transition; one valid and seven invalid report-bundle audit cases; a metadata-only 64-task public bundle with zero public training rows; a selected support aggregate with four command replays, sixteen artifact digests, sixty-eight task records, fourteen rejected controls, and two accepted no-promotion decisions; bounded artifact-retention, 22-module definition-of-done, 5,662-path registry, 53-pointer crosswalk, stale 130-task work-board, 19-record-type assistant trace, seven-surface accelerator parity, and one clean-checkout pre-training-readiness currentness imports. Several narrow non-core imports are prototype-backed, but no clean live whole-project replay, current work-board or runtime proof, model-quality or capability result, benchmark-validity or useful-throughput result, production routing, deployment, safety, chapter-core support effect, independent reproduction, or transfer exists.	The mature operational contract requires an argument-exit campaign that freezes a public-safe Project Theseus release or report bundle and supports independent clean-room replay from documented commands, environments, dependencies, artifact digests, current work-board and registry state, permissions, and retained failures. It must execute natural workloads and matched ordinary baselines through actual model, routing, training, tool, benchmark, resource, operator, rollback, and self-evolution paths; disclose teacher and external-inference use; measure useful throughput, quality, false promotion and blocking, safety, currentness, failures, latency, compute, storage, review burden, recovery, residuals, and total cost; and test staleness, digest drift, private-payload pressure, gate and dashboard laundering, missing artifacts, negative-result retention, and correction propagation. Independent implementers, operators, artifact reviewers, evaluators, institutions, infrastructures, legal regimes, and transfer settings must reproduce all positive, negative, null, narrowed, blocked, and refuted outcomes over time. Until then the Implementation-Reference Evidence Packet is not proof of current Project Theseus behavior, capability, model quality, benchmark superiority, safety, deployment, transfer, AGI, ASI, or SOTA.	argument
prototype-roadmap	Prototype Roadmap	Twenty-nine exact source-to-claim mappings; one prototype phase record schema and public-safe fixture; a deterministic dependency-gate harness retaining two valid fixtures and six expected-invalid controls; three proof targets implemented by 37 Lean declarations, comprising nine retained route/fixture guards plus twenty-eight strict-dependency and phase-transaction results; and one synthetic readiness/residual expired-evidence rerun/reject check. The dependency-aware transaction separates ordinary integration from evidence review and proves rejected-event noninterference, exact phase/plan/dependency/artifact/authority custody, arbitrary-run gate coherence, composition, two reachable witnesses, zero support/external-effect authority, terminal integrated/evidence-review/rolled-back suffixes, seven named gate countermodels, and thin-summary insufficiency. Its independent consumer checks 10/10 trace splits, 33 reachable states through 1,023 transitions, eighteen terminal states through 558 absorbing transitions, and nineteen semantic mutations. No dependency truth, real phase acceptance or execution, evaluator competence, rollback execution, deployed build controller, natural workload, matched baseline, chapter-core support effect, capability, safety, deployment, reproduction, or transfer is established.	The mature argument-exit campaign must prospectively freeze a real multi-phase program, its dependency graph, teams, tasks, tools, models, resources, gates, evaluators, debt policy, rollback, stopping rules, and outcomes before execution. It must compare the Evidence-Gated Phase Unlock Contract with matched calendar, feature-backlog, milestone, stage-gate, no-gate, and strongest ordinary program-management baselines under equal opportunities; exercise natural builds plus dependency inversion, stale gates, evaluator dependence, research-to-release leakage, debt erasure, revocation, incident, correction, and effect-complete rollback attacks; and jointly measure useful throughput, time-to-evidence, quality, false unlocks and blocks, rework, incidents, recovery, residuals, debt, reviewer burden, compute, storage, opportunity cost, and total cost. Causal ablations must identify which gates help or harm, and independent teams, reviewers, institutions, infrastructures, legal regimes, environments, and successor programs must reproduce and transfer positive, negative, null, narrowed, blocked, and refuted results. Until then the contract is not a functioning build controller, proof of correct sequencing, capability, governance effectiveness, safety, readiness, deployment, transfer, AGI, ASI, or SOTA.	argument
living-book-methodology	Living Book Methodology	Sixteen exact source-to-claim mappings; one living-book release-record fixture; a change-packet harness with three valid and six expected-invalid synthetic cases; a reader release-candidate bridge over the current blocked candidate, three additional valid routes, and eleven expected-invalid controls; manifest/outline/proof synchronization, claim and source appendices, Quarto HTML rendering, Human-view toggle, browser checks, changelog and release records, and an authoritative validation registry; and four proof targets implemented by 39 Lean declarations. Eighteen retained record and reader-route guards sit beside an inductive manifest compiler and a governed structural-change lifecycle proving derived contiguous ordinals, stable chapter-ID order, arbitrary-run identity and authority custody, gate coherence, exact composition, an accepted-current witness, zero support and publication authority, terminal accepted/rolled-back suffixes, and thin-summary insufficiency. The independent consumer checks all five trace splits, nine reachable states through 162 transitions, five terminal states through ninety absorbing transitions, and fifteen semantic mutations. These artifacts establish bounded repository and transaction discipline only; they do not prove source truth, editorial or accessibility quality, chapter truth, public release, reader or audio approval, future-maintainer correctness, external reproduction, transfer, or a chapter-core support effect.	The mature argument-exit campaign must follow a prospectively frozen stream of natural substantive updates—new sources, conflicting evidence, claim promotion and refutation, proof retirement, schema changes, figures, accessibility fixes, corrections, rollbacks, releases, reader derivatives, and successor handoffs—performed by multiple independent human and AI maintainers. It must compare the Evidence-Preserving Publication Transaction with matched static manuscript, wiki, ordinary Git repository, literate-programming, executable-book, docs-as-code, and strongest conventional scholarly publishing workflows under equal content, tooling, time, and review opportunity; inject source revocation, citation error, claim drift, proof bloat, validator weakness, rights conflict, derivative drift, release mismatch, deployment failure, errata, and handoff loss; and jointly measure claim accuracy and calibration, source and proof traceability, error detection, correction latency, reproducibility, rollback, accessibility, reader comprehension, editorial quality, maintenance burden, reviewer time, compute, storage, hosting, opportunity cost, and total cost. Independent maintainers, editors, accessibility reviewers, readers, repositories, institutions, formats, hosting systems, and domains must reproduce and transfer positive, negative, null, narrowed, blocked, and refuted outcomes. Until then the transaction is not proof of superior scholarship, editorial quality, accessibility, reader value, governance effectiveness, external reproducibility, transfer, or SOTA publishing.	argument
open-research-agenda-and-bibliography-plan	Open Research Agenda and Bibliography Plan	Twenty-eight exact source-to-claim mappings; a source inventory and source-note corpus split across Corben/local, external, and author-intent appendices; one research-backlog record schema and public-safe fixture; one new-paper triage scenario fixture covering update-existing, propose-new-owner, defer-unread-external, and reject-duplicate decisions; source inventory, source-note, protocol, appendix, citation, and mapping validators; two proof targets implemented by two derived Lean counterexample declarations over hand-authored finite source-ingestion and chapter-assignment records after retiring two premise-restating projections; and an explicit active backlog including citation normalization, artifact reproduction, proof and experiment work, GraphRAG/HippoRAG overlap, and rejected or blocked items. No external-literature completeness, citation-accuracy study, natural intake campaign, real backlog-closure study, research-quality result, independent reproduction, transfer, or chapter-core support effect exists.	The mature argument-exit campaign must prospectively freeze a long-running natural research stream of new papers, local projects, inaccessible and private sources, conflicting findings, corrections and retractions, benchmark and proof artifacts, reproduction attempts, negative results, duplicate or overlapping claims, and chapter proposals handled by multiple independent human and AI researchers. It must compare the Research Backlog Admission and Closure Contract with matched reference-manager, systematic-review, evidence-map, issue-tracker, wiki, ordinary bibliography, ad hoc agent-research, and strongest conventional research-program workflows under equal sources, access, tools, time, and review opportunity; inject metadata errors, title-only sources, duplicate variants, hidden conflicts, private leakage pressure, stale citations, retractions, boundary ambiguity, chapter novelty pressure, failed reproduction, correction propagation, and backlog rot; and jointly measure citation precision and recall, source coverage and calibration, decision and claim accuracy, duplicate detection, error and conflict discovery, time-to-usable-evidence, closure quality, false admission and deferral, correction latency, reproduction yield, chapter churn, reviewer burden, compute, storage, opportunity cost, residuals, and total cost. Causal ablations must identify useful and harmful record fields or gates, and independent researchers, reviewers, repositories, institutions, disciplines, legal regimes, languages, and time periods must reproduce and transfer positive, negative, null, narrowed, blocked, and refuted results. Until then the contract is not proof of literature completeness, citation accuracy, research quality, superior prioritization, claim truth, reproduction, transfer, or SOTA research management.	argument