Skip to main content

9  Human Intent as a Formal Input

9.1 Chapter status

Field	Value
Chapter ID	human-intent-as-a-formal-input
Part	Part I - Foundations, Alignment, and Governance
Status	conceptual
Manuscript maturity	v0.2 manuscript draft
Last updated	2026-08-02
Primary source records	viea, software_magic_grimoire, planforge, cognitive_compilation, talos; external positioning: ext_goal_oriented_requirements_engineering_2001, ext_cooperative_inverse_rl_2016, ext_deep_rl_human_preferences_2017
Claim label	Design rationale
Evidence level	argument
Source queue	primary: viea; supporting: software_magic_grimoire, planforge, cognitive_compilation, talos; external variants: ext_goal_oriented_requirements_engineering_2001, ext_cooperative_inverse_rl_2016, ext_deep_rl_human_preferences_2017
Source loading state	source notes: viea, software_magic_grimoire, planforge, cognitive_compilation, talos, ext_goal_oriented_requirements_engineering_2001, ext_cooperative_inverse_rl_2016, ext_deep_rl_human_preferences_2017, ext_cultural_alignment_llms_2024; raw cache: viea, software_magic_grimoire, planforge, cognitive_compilation, talos
Test state	AsiStackProofs.IntentContracts retains 20 finite resolution/admission branches, while AsiStackProofs.IntentResolutionRefinement imports the static router and supplies 36 declarations for exact event write ownership, arbitrary-run root/ceiling custody, valid traces, batch composition, versioned re-contract semantics, command-lowering information loss, route-changing thin-transport collisions, exact-router impossibility, and complete route-transport preservation. python3 scripts/validate_intent_resolution_refinement.py passes over 4 traces/14 events, 14 invariant prefixes, 18 batch compositions, 4 valid/6 invalid intake cases, 2 valid/7 invalid re-contract cases, 13 plan fixtures, 40/40 state-noninterfering lifecycle mutations, 6 omitted command-field collisions, 2 route-changing transport collisions, 10/10 full command-field mutations, and 7/7 complete route-transport mutations. No natural-language-understanding, semantic-sufficiency, authentic-authority-extraction, valid-consent, prompt-injection-containment, deployed-dispatch, user-satisfaction, reproduction, transfer, or support-promotion claim.

9.2 Drafting guardrail

A request enters the stack as material to interpret and constrain, not as an ambient grant of permission. The intent boundary preserves purpose, uncertainty, affected parties, limits, and stop conditions before any planner can turn helpfulness into authority. Source notes supply design vocabulary; executable support remains limited to the schemas, fixtures, and proofs actually present in the repository.

It starts the second movement of Part I. The first five chapters establish the stack, evidence, and failure discipline; this chapter introduces the first live boundary where that discipline meets a person asking the system to do work.

That boundary has to be humane and mechanical at the same time. A person should be able to state a purpose in ordinary language, but the system should not convert that purpose into hidden authority. The intent contract is the first artifact that makes the request inspectable by both humans and downstream machinery.

9.3 Human Reading Path

Concrete lens. The naive baseline treats “clean up” as permission to delete and push. The governed path preserves the raw request, admits inspection, and leaves destructive means and remote effects unresolved.

The authority frame now has to meet a real request without turning eagerness into permission. The operational path from human purpose into the stack begins here. It asks how a request becomes a contract without letting ambiguity become permission.

Intent is not merely text. It includes requirements, constraints, assumptions, stop conditions, approvals, and unresolved questions. A governed system should preserve those pieces before planning or execution tries to be helpful, because the first loss of alignment often happens when a useful interpretation quietly becomes the authorized one. The request should become clearer as it moves inward, not broader and harder to contest. Formal input should narrow agency before power is handed off.

The safest translation of intent is one that exposes ambiguity early enough for correction. Good intent capture slows the first handoff just enough to prevent downstream authority mistakes.

The first contract should protect the requester from the system’s eagerness to help.

Intent capture should make the next handoff narrower, not more presumptive. Good intake preserves ambiguity where ambiguity is real and consequential for action.

9.4 Problem

A natural-language request can mix desired outcome, preferences, emotion, assumptions, source and privacy constraints, affected parties, risk tolerance, authority, acceptance evidence, and stop conditions, then be lowered into planning or action as though one plausible interpretation were explicit permission.

Human intent enters the stack as language, but the system cannot treat language as direct execution. A request can contain a goal, preference, hidden ambiguity, implied authority, risk tolerance, source constraints, emotional context, and unstated stop conditions in the same sentence. If the stack passes that sentence directly to planning or tools, ambiguity becomes action.

VIEA frames the corrective move: intent becomes a command contract before it becomes work. Software Magic Grimoire adds the language discipline: operative words should carry role, objective, context, constraints, procedure, output, verification, and failure behavior. PlanForge and Cognitive Compilation then consume that contract as source material for plans and semantic IR. Talos consumes only the authorized job form, not the user’s raw wish.

This makes intent a scoped authority lease. The lease can authorize drafting, planning, tool use, publication, spending, deployment, or self-modification only when those powers are named or separately approved. If the request is emotionally clear but operationally ambiguous, the stack may still help by producing a draft, option set, or clarification artifact, but it should not silently expand the lease.

An intent contract should also preserve the human texture of the request without letting that texture carry authority by itself. A user can express urgency, uncertainty, trust, frustration, taste, or aspiration. Those signals matter for service quality and interpretation. They do not automatically authorize broader means, weaker evidence, skipped approvals, or irreversible side effects.

The same boundary applies to approval fatigue and human oversight degradation. A user may confirm intent, and a reviewer may approve a later action, but those are different control states. Intent capture should preserve what the human asked for, what remains unresolved, and what still needs review; it should not treat a tired approval click, a trust-laden request, or an automation-shaped suggestion as durable authority for downstream execution.

9.5 Why existing approaches are insufficient

Prompts, goal-oriented requirements models, preference feedback, inferred rewards, conversational confirmations, and approval clicks can each communicate useful information while leaving authorization, allowed means, affected parties, evidence duties, expiry, and re-contract triggers unresolved. None of them alone establishes the person’s complete preference, valid consent, or authority for downstream effects.

Prompt-only workflows encourage helpfulness to fill gaps. That is useful for conversation and dangerous for execution. “Build this,” “fix it,” “publish it,” and “make it amazing” are not contracts by themselves. They need scope, allowed means, source boundaries, authority ceilings, acceptance criteria, evidence requirements, and stop conditions. Otherwise the next layer cannot tell whether it should clarify, draft, implement, ask for approval, abstain, or stop.

The failure is goal misbinding. The system satisfies an interpretation that was never actually authorized. A subtler failure is scope accretion: each helpful step adds a plausible means until the action surface is larger than the grant. The stack treats both as contract failures.

Misplaced politeness can be just as damaging as over-questioning. A system can avoid asking a useful question because it wants to keep momentum, then compensate by making assumptions that shape the work. The governed alternative is not constant interruption; it is visible assumption handling. Low-risk assumptions can be recorded as bounded defaults, while authority-changing assumptions require re-contracting.

The key insufficiency is assumption laundering. An assumption starts as a helpful guess, then becomes a plan constraint, then becomes a job, then becomes an external effect. The intent layer should stop that chain by marking every assumption as confirmed, bounded default, clarification required, or unauthorized.

Intent must therefore become a formal input rather than a conversational preface. Later layers should not have to infer whether a goal was real, whether a method was allowed, or whether a missing constraint was intentionally omitted. They should receive a record that can be challenged, narrowed, cited, and revised before work becomes difficult to unwind.

External positioning: Human Intent as a Formal Input now has source-noted comparators through ext_goal_oriented_requirements_engineering_2001, ext_cooperative_inverse_rl_2016, and ext_deep_rl_human_preferences_2017. Goal-oriented requirements engineering grounds the broader practice of refining stakeholder goals and constraints into explicit requirements. CIRL grounds uncertainty about the human objective in a cooperative formal setting. Deep RL from human preferences grounds preference-feedback communication for complex goals. These sources make the outside baseline visible, but they do not reproduce a requirements-engineering tool, CIRL policy, preference-learning run, natural-language parser, authority extractor, stop-condition checker, or execution handoff here.

9.6 Core Claim

[human-intent-as-a-formal-input.core, label: Design rationale, support: argument] A governed stack admits human intent only as a versioned interpretation contract that preserves the raw request while separately recording the desired outcome; allowed and forbidden means; authority basis, ceiling, and affected parties; source, privacy, and publication boundaries; acceptance and evidence requirements; field provenance; confirmed assumptions, bounded defaults, contested or open ambiguities; stop, expiry, revocation, appeal, and re-contract conditions; and permitted downstream consumers. The accepted contract may bound planning only after its owning policy and authority gates admit it; it cannot by itself prove the person’s complete preference, value alignment, informed consent, satisfaction, affected-party authorization, or permission for training, publication, deployment, spending, tool use, or other external effects.

Reader claim. A short request can be operationally incomplete even when its goal sounds obvious; preserving the raw words and the unresolved choices is part of faithful execution.

Operational rule. Compile only the constraints and authority the person actually supplied or explicitly confirmed. Route unresolved scope, destructive effects, publication, spending, credential use, and changes of means to clarification or review; never fill them from convenience.

9.6.1 Worked intent contract: “clean up the repo”

Suppose the user says, “clean up the repo.” A plausible but unsafe parser could delete generated files, rewrite history, remove old experiments, push changes, and call the result complete. The contract first preserves the exact sentence. It then separates a likely outcome—make the repository easier to navigate—from unanswered questions: which repository, whether “clean up” means organize or delete, whether untracked files belong to the user, whether history may change, whether remote publication is authorized, and what evidence will count as done.

With deletion and push authority absent, the admitted first step is read-only inspection. Duplicate or generated artifacts can be proposed for removal, but not removed; a dirty worktree remains protected; branch and remote changes remain outside the contract. If the user later authorizes a bounded reorganization, the accepted contract records the selected paths, preservation rules, validation, stop condition, and rollback point. The local intent-resolution model exercises four accepted scenarios and six invalid controls; hidden overrides, missing constraints, authority widening, and changed downstream means route to clarification, review, or re-contract. That finite result checks record behavior, not natural-language understanding or user satisfaction.

The claim remains at argument support. All five local raw-cache mappings now carry reviewed passage references: VIEA for the structured intent-to-command contract spine; Software Magic Grimoire for bounded instruction fields, verification, and failure behavior; PlanForge for natural-language goal decomposition into typed primitive plans; Cognitive Compilation for source plans, semantic IR, ambiguity flags, and verifier-backed lowering; and Talos for contract locks, risk/ambiguity gates, clearance, and authorized execution boundaries. None of that source context authorizes hidden execution or proves natural-language intent parsing is solved.

9.6.2 Claim-source mapping status

Appendix C now maps this core intent claim to all assigned source notes, and all five local source mappings include reviewed raw-cache passage references. The mappings support the contract boundary for intent, not a solved parser or autonomous execution permission.

Source	What it supports	Limit
viea	Human intent becomes structured command contracts with role, objective, context, constraints, procedure, output contract, verification, failure behavior, artifacts, routing, runtime execution, feedback, residuals, and regressions.	Does not prove automated intent parsing, hidden-authority inference, or deployed behavior.
software_magic_grimoire	Instructions as bounded operational language with roles, objectives, constraints, procedure, output, verification, failure behavior, handoff artifacts, guards, entry/exit rules, loops, recursion, and recovery paths.	Vocabulary and promptcraft framework only; no empirical prompt-performance result or local test.
planforge	Natural-language goals compiled into decomposed, dependency-aware, tier-annotated plans with primitive schemas, scheduling, fallback, and failure-driven replanning.	No verified implementation, scheduler run, or benchmark result is present.
cognitive_compilation	Goals, constraints, interfaces, resources, and quality gates lowered into source plans, typed semantic atoms, target instructions, validators, DAGs, and repairable artifacts.	No local compiler, task trace suite, or empirical ablation validates the pipeline.
talos	Only authorized work lowers into typed jobs with contract locks, adjudication, delivery, feedback, audit, replay, residuals, approval gates, and controlled runtime adapters.	Does not prove tool-effect enforcement, approval behavior, or benchmark/security claims.

9.6.3 Publication placement and preserved technical ownership

In the consolidated architecture reference, this chapter is the technical detail route beneath Intent-to-Execution Contracts. The parent owns the consumer-relative conformance relation from an accepted receipt through lowering, authority, plan, job, dispatch, effect, artifact, verification, delivery, feedback, compensation, and residuals. This route continues to own the interpretation boundary before that lineage begins: raw request, requested outcome, allowed and forbidden means, authority basis and ceiling, affected parties, privacy and publication boundaries, assumptions, ambiguities, evidence and acceptance duties, stop rules, revocation, appeal, expiry, and re-contract.

An accepted intent record does not establish complete preference recovery, informed consent, satisfaction, affected-party authorization, or faithful execution. A conformant command lineage does not establish that the initial interpretation was correct or that missing authority may be inferred. This route retains its local claims, source mappings, proof targets, tests, failure modes, evidence exit, non-claims, support ceiling, identity, and legacy URL. The editorial nest grants no permission, parser correctness, semantic completeness, execution result, support movement, deployment, publication, AGI, or ASI inference.

9.7 Mechanism

The stack admits human purpose through an Intent Contract: a loss-control boundary between a request and any machine work that follows. The contract does not pretend to recover the user’s complete inner preference. It records the smallest authorized interpretation durable enough for alignment review, planning, execution, and evidence. That humility is important: the contract is not the person, and it should remain corrigible when the person clarifies, rejects, or narrows it.

flowchart LR
  A["Natural-language request"] --> B["Intent intake"]
  B --> C["Goal / means / authority split"]
  C --> D{"Ambiguity, missing authority, or high risk?"}
  D -- "yes" --> E["Clarify, bounded draft, abstain, or residual"]
  D -- "no" --> F["Intent Contract"]
  F --> G["Alignment admissibility check"]
  G --> H["Command contract or plan source"]
  H --> I["Authorized typed work"]
  I --> J["Artifact, evidence, and feedback"]
  E --> K["Residual review or clarification loop"]
  J --> K

How to read the intent narrowing flow: The request is narrowed before it becomes work. Ambiguity, missing authority, or high risk branches toward clarification or residual review, while only a bounded Intent Contract moves into alignment checks, command contracts, and authorized typed work.

The contract compiles the request into an explicit objective, constraints, authority ceiling, source boundary, acceptance criteria, evidence requirement, and stop condition. Its central move is separation: desired outcome is not allowed means, and a useful interpretation is not permission. The raw request remains useful as context, but execution consumes the bounded contract.

When ambiguity remains, the stack should not pretend to have resolved it. It can ask for clarification, choose a bounded default with visible assumptions, produce a draft-only artifact, or refuse the transition to execution.

Every inferred or omitted material field receives an explicit disposition: confirmed, bounded default, clarification required, authority pending, contested, unknown, or unauthorized. Bounded defaults are permitted only for low-risk, reversible planning. They carry field provenance, scope, rollback, and expiry; they cannot create publication, deployment, spending, tool, privacy, training, or affected-party authority.

Preference comparisons, learned rewards, predicted objectives, emotion, urgency, trust, silence, and approval behavior can inform interpretation or expose ambiguity. They are not authority grants. When several interpretations remain admissible, the intake layer chooses the least-authority reversible interpretation that still meets the declared outcome and evidence requirements, or returns for clarification when the difference is material.

Contract change rules belong in the intent record. A plan that changes allowed means, adds a new tool class, expands publication surface, drops a stop condition, weakens evidence requirements, or changes the affected parties is not merely a better plan. It is a new authority question. This gives later governance, execution, and implementation-reference chapters a clean test: did the work stay inside the lease that the human actually granted?

The state labels matter because they decide what kind of help is allowed. A draft, clarification, plan source, approval request, and rejected residual can all be useful, but they are not the same authority state. Conflating them is how helpful intake turns into hidden power.

9.7.1 Intent checksum, assumption diff, and the no-silent-authority rule

A form is not the only way to make intent explicit. VIEA proposes a friction gradient in which a person can begin with ordinary language while the system drafts more structure as consequence rises. For medium- or high-consequence work, the intake packet should expose an intent checksum—a short statement of what outcome the system thinks matters—and an assumption diff listing the audience, artifact type, evidence standard, tone, time horizon, affected parties, and means it inferred. One adversarial prompt asks what the command must not optimize. The person confirms or corrects the material delta rather than rubber-stamping a long generated form.

This does not make the model an intent oracle. The checksum and diff are contestable projections of the raw request, and their value is measured by material correction rate, missed-authority errors, clarification burden, and downstream re-contracts. The governing invariant is sharper than “confirm important fields”: the system may infer structure, but it may not silently infer authority. An ambiguous request can produce a draft contract, options, or reversible planning; it cannot silently become publication, spending, tool-use, data-access, deployment, fabrication, or actuation permission.

9.7.2 Intent intake states

Intent intake should use explicit states:

State	Meaning	Allowed downstream movement
raw_request	The user’s natural-language expression has been captured.	Interpretation and review only.
interpreted	A structured reading exists, but open assumptions remain.	Drafting, option generation, or clarification.
bounded_default	A low-risk assumption is recorded with scope and rollback.	Planning only inside the default’s boundary.
clarification_required	Missing information would materially change outcome, authority, or evidence.	No dispatch until resolved or narrowed.
authority_pending	The desired outcome is understood, but required means are not authorized.	Approval request, alternative route, or draft-only output.
accepted_contract	Objective, means, evidence, and stop conditions are sufficiently bounded.	May lower into command contracts and plan sources.
recontract_required	A downstream change would alter means, authority, affected parties, publication, evidence, or stop conditions.	Return to the human/governance boundary.
rejected_or_expired	The request is denied, stale, superseded, or outside policy.	Archive as lineage/residual only.

These states keep user intent alive as a controlled artifact. They make it possible to help quickly when the risk is low, while still refusing to turn a guess into permission.

9.8 Interfaces

The Intent Contract is also the first cross-layer interface:

• Scalable Oversight may supply clarification, disagreement, or review evidence, but it cannot convert a reviewer or model inference into the principal’s authorization.
• Constitutional Alignment consumes the accepted contract and may narrow, refuse, or require appeal or re-contract under rights and policy predicates. It may not widen the principal’s grant.
• Command Contracts and Planning consume the exact accepted version as a bounded source and return a delta/re-contract request rather than silently changing means, authority, affected parties, evidence, publication, or stop conditions.
• Runtime Adapters and Readiness consume only separately authorized command or job grants derived from the contract. Raw text, inferred preference, and an Intent Receipt are never direct tool, release, spending, or deployment authority.
• Evidence States compares delivered artifacts and effects with exact acceptance and evidence requirements while preserving unresolved ambiguity; contract validity cannot establish satisfaction or support movement.
• Policy Optimization may consume separately admitted preference or feedback records under an update lease, but learned rewards and preference predictions cannot widen the contract or execution authority.

Minimum fields:

• intent_id
• request_summary
• desired_outcome
• allowed_means
• forbidden_means
• authority_ceiling
• source_boundaries
• acceptance_criteria
• evidence_requirements
• escalation_conditions
• stop_conditions
• open_ambiguities

Alignment filters the contract before planning. Planning lowers accepted contracts into source plans, DAGs, semantic atoms, or typed jobs. Execution consumes only authorized job contracts. Evidence compares the delivered artifact against the acceptance criteria and unresolved ambiguities.

Raw request preservation and contract authority stay split at the intent boundary. The raw request is useful for empathy, intent recovery, and later review; the contract is what grants operational authority. That split lets the book support natural human expression while still giving planners, routers, tools, and report-first implementations an auditable boundary.

Lowering the contract emits an Intent Receipt when it produces:

• request_digest
• contract_version_and_digest
• intake_state
• field_provenance
• confirmed_assumptions
• bounded_defaults
• unauthorized_means
• unresolved_ambiguities
• required_approvals
• recontract_triggers
• human_review_refs
• permitted_consumers
• downstream_contract_refs
• expiry_revocation_and_appeal_state

The receipt is what later chapters need when they ask whether a plan, job, adapter invocation, or report-first implementation still traces back to what was actually authorized.

9.9 Invariants

• Raw request text and surrounding conversational context are preserved for recovery but never override the accepted contract or create authority by themselves.
• A desired outcome, helpful interpretation, inferred preference, emotional signal, urgency, trust, silence, or approval click is not permission for undeclared means or effects.
• Authority-changing, irreversible, high-risk, privacy-sensitive, publication, deployment, spending, or affected-party assumptions cannot be admitted as bounded defaults.
• Every material field retains provenance and disposition. Ambiguity that can change outcome, means, authority, affected parties, evidence, publication, or stop conditions blocks executable admission or narrows it to draft-only work.
• Constraints, forbidden means, authority ceiling, source/privacy boundaries, acceptance/evidence requirements, and stop conditions remain attached through every lowering. Loss or precedence reversal routes to repair or re-contract.
• A material downstream change requires a new version and re-contract decision. Stale, expired, revoked, superseded, or wrong-consumer contracts cannot authorize work.
• The requester’s contract cannot waive rights, consent, or authority belonging to affected parties or override constitutional and policy predicates.
• Preference inference and feedback learning remain epistemic inputs under uncertainty and never become execution, training, publication, or deployment authority without their separate owning gates.
• A valid contract record proves neither complete inner intent, value alignment, informed consent, user satisfaction, downstream preservation, nor safe effects.

The important invariant is preservation: downstream plans may refine the contract, but they may not drop constraints, stop conditions, or authority ceilings. If a planner cannot satisfy the contract without changing it, that is a re-contracting event, not a silent optimization.

A related invariant is least authority. When multiple interpretations satisfy the visible request, the system should prefer the interpretation with narrower means, clearer evidence, and easier rollback unless the user explicitly grants broader scope. This keeps helpfulness from becoming a source of accidental power.

9.10 Failure modes

• Goal misbinding: optimize a plausible interpretation the principal did not accept.
• Scope accretion: add individually plausible means until the work or effect surface exceeds the original grant.
• Implicit-permission laundering: treat a desired outcome as approval for any convenient tool, source, expenditure, publication, deployment, or side effect.
• Assumption laundering: convert an unconfirmed guess into a plan constraint, job, and effect without disposition or re-contract.
• Raw-context override or instruction injection: let conversational text, retrieved content, or a later hidden directive supersede the contract.
• Approval laundering: treat urgency, trust, silence, automation bias, habituation, or a fatigued click as durable informed authorization.
• Preference laundering: turn a learned reward, predicted preference, style signal, or local comparison into an authority or consent claim.
• Requirements precision theater: produce a complete-looking contract while stakeholder conflicts, affected parties, authority basis, or evidence duties remain false or absent.
• Affected-party erasure: let the requester bind people, data, rights, or resources they do not control.
• Stale-contract reuse: continue work after expiry, revocation, supersession, material context change, or consumer mismatch.
• Evidence or stop erosion: preserve the desired outcome while weakening acceptance criteria, source boundaries, verification, rollback, or termination duties during lowering.
• Clarification overload: miscalibrate least authority so aggressively that benign reversible help is blocked, users route around governance, or useful throughput collapses.

Goal misbinding happens when the system optimizes the wrong interpretation. Scope creep happens when the system turns an open-ended wish into unbounded work. Implicit permission happens when the system treats a desired outcome as approval for any convenient means. All three should produce a visible residual or clarification path before execution.

The deeper failure is contract substitution. The system receives a human purpose, then substitutes its own inferred plan, tone preference, or completion heuristic as the governing object. That substitution can feel helpful in a conversation, but it is dangerous in an execution stack because downstream layers inherit a contract the person never granted. Intent handling should therefore make ambiguity, missing authority, and contested assumptions visible before planning or tool use begins.

9.11 Minimum Viable Implementation

The current minimum is a public intent_contract schema and valid fixture; a 36-declaration finite Lean refinement grouped under five manifest proof targets; a synthetic intake probe with four valid scenarios and six expected-invalid request-pressure controls; a re-contract probe with two valid routes and seven expected-invalid material-delta controls; and a plan-execution harness with three valid and ten expected-invalid fixtures. These artifacts exercise record shape, finite route consequences, representational information loss, origin and preservation checks, bounded-default non-authority, and no-support boundaries only. They do not measure natural-language understanding, authority extraction, informed consent, preference inference, user satisfaction, prompt-injection containment, deployed runtime enforcement, or effect safety.

A small corpus of deliberately underspecified requests is the first serious test bed. Each example should produce a contract, open ambiguities, bounded defaults, and a list of actions that remain unauthorized. The corpus would make the difference between “understood the user” and “received permission to act” visible in test data.

The corpus should include one request that sounds urgent, one that implies trust, one that omits allowed means, and one that conflicts with a policy predicate. Passing the test means the contract preserves ambiguity and refusal paths, not that the system fully understands intent.

The current formal slice models only structured records after intake fields exist, but it is no longer limited to the first resolution branch. It checks the older resolution cases for missing text, prohibited actions, ambiguity, conflict, high-impact authority, and irreversibility; it also checks an admission lifecycle where hidden overrides reject, unresolved ambiguity and missing constraints request clarification, constraint-precedence and preservation gaps block admission, missing or widened authority routes to review, downstream changes trigger re-contracting, missing non-claim boundaries block admission, and complete records admit. The synthetic intent intake probe adds the first finite raw-request corpus: urgency cannot skip validation, trust cannot authorize publication, vague broad-means language blocks dispatch, private-source publication pressure stays forbidden, declared stop conditions must survive, and bounded defaults cannot become authority grants.

The Intent re-contract trigger probe adds the next executable slice: valid_no_material_delta_continue continues under the accepted contract, valid_publication_surface_delta_recontracts routes back through re-contracting when publication surface changes and a re-contract record is present, and seven expected-invalid controls block material deltas before dispatch. Those controls are invalid_authority_delta_without_recontract, invalid_private_source_delta_without_recontract, invalid_stop_condition_erasure_without_recontract, invalid_evidence_bar_weakening_without_recontract, invalid_affected_party_widening_without_recontract, invalid_means_expansion_without_recontract, and invalid_support_state_promotion_without_recontract. This is useful for the gate shape, but it is a no natural-language-intent-understanding, deployed-parser-quality, deployed-authority-extraction, prompt-injection-containment, runtime-dispatch, approval-service, user-satisfaction, or support-state-promotion claim.

The executed resolution-to-contract refinement now composes those surfaces into reachable finite state. Its 36 declarations preserve root-intent identity, the original authority ceiling, and approved-authority boundedness over arbitrary successful runs; extract recursively valid traces; compose event batches; and restrict contract payload writes to parse or accepted re-contract transitions. Four witnesses cover direct acceptance with re-contract, clarification, unchanged continuation, and rejection. A command-lowering boundary makes information loss explicit: a four-field projection omits forbidden means, authority basis, affected parties, privacy boundary, acceptance evidence, and permitted consumers, so distinct ten-field intent records can map to the same command and no decoder can recover both collision witnesses. The corresponding full modeled lowering is injective, and changing affected-party or privacy fields changes its output.

The same module now closes the previously implicit bridge to the static router. A thin lifecycle transport carrying only prohibition and ambiguity maps a conflict-free record and an otherwise identical conflicting record to the same value even though one compiles and the other requests clarification. A second collision hides high-impact reversibility and collapses compilation versus review. Therefore an exact router cannot be reconstructed from the thin conflict transport alone. A complete transport carrying all seven fields used by the authored router round-trips to the original record, is injective, and preserves its route. This establishes a precise minimum information boundary for this finite router, not that seven Boolean fields are a semantically complete account of human intent.

The independent consumer binds the intake, re-contract, and complete 13-fixture plan inventory by digest, checks all 14 witness prefixes and 18 batch splits, rejects 40/40 lifecycle mutations without changing the accepted prefix state, reconstructs six omitted command-field collisions and two route-changing transport collisions, and rejects mutations to all ten full command fields and all seven complete route-transport fields. The resulting evidence is stronger at the structured-record boundary, not at natural-language semantics: the theorems prove information preservation only for the modeled fields, while field meanings, hashes, labels, authority, consent, and receipts remain trusted inputs and the model stops before dispatch or effect.

9.12 Mature Research Target

A mature intent control plane combines humane conversational intake with an independently challengeable, versioned authorization boundary. It evaluates natural and adversarial requests across ambiguity, language, culture, accessibility, emotion, multi-party conflict, preference drift, and high-impact authority. It compares strong requirements-engineering, direct-confirmation, and preference-learning baselines and measures interpretation accuracy, unauthorized-action rate, missed help, clarification burden, re-contract precision and recall, user correction and appeal success, affected-party protection, latency, privacy, and useful throughput.

The mature campaign uses causal ablations and independently implemented intake and outcome evaluators across downstream planners and runtimes. Raw expression stays available for empathy, correction, and recovery without becoming ambient power. Refusal, clarification, bounded drafting, acceptance, re-contract, revocation, and appeal remain durable states throughout execution rather than conversational moods.

This is a target architecture, not evidence that the repository understands human intent, solves value alignment or consent, or safely authorizes real-world effects. Intent formalization remains at argument until natural workloads, authority and ambiguity labels, preservation traces, affected-party controls, strong baselines, independent evaluation, and accepted evidence transitions support narrower conclusions.

Crucially, a successful result must improve useful assistance as well as authority precision; clarification that merely prevents all action is not adequate intent handling.

9.13 Codex test plan

Test	Purpose	Status
Intent contract fixture validation	Check that the intent contract fixture matches the public schema.	implemented by protocol validation; validated locally
Intent resolution and admission route proof	Check that structured intent records route missing text, prohibited actions, hidden overrides, unresolved ambiguity, constraint-precedence gaps, preservation failures, missing or widened authority, downstream re-contract triggers, and missing non-claim boundaries away from admission before compilation.	implemented in Lean; finite records only
Executed Human Intent resolution-to-contract refinement	Check reachable root, version, constraint/stop, authority, ambiguity, material-delta, re-contract custody, command-lowering information loss, and static-route transport completeness against the bounded intake, re-contract, and plan-fixture surfaces.	implemented by python3 scripts/validate_intent_resolution_refinement.py; 36 Lean declarations, 4 valid/6 invalid intake cases, 6 signals, 2 valid/7 invalid re-contract cases, 13 plan fixtures, a 5-event version-2 witness, 40/40 rejected lifecycle mutations, 6 thin command-lowering collisions, 2 thin route-transport collisions, 10/10 rejected full command-field mutations, and 7/7 rejected complete route-transport mutations; support-state effect none; no natural-language understanding, semantic sufficiency, authentic authority, valid consent, deployed dispatch, reproduction, or transfer claim
Intent-origin preservation fixture	Check that explicit intent constraints, forbidden means, stop conditions, re-contract triggers, and authority ceiling survive into command and plan records.	implemented by synthetic plan-execution contract harness; no natural-language parser or authority-extraction claim
Ambiguity dispatch block fixture	Check that an unresolved ambiguity fixture cannot be validated for planning or dispatched.	implemented by synthetic plan-execution contract harness; no parser-quality claim
Hidden override rejection fixture	Check that hidden override requests cannot authorize planning unless rejected, quarantined, or ignored.	implemented by synthetic plan-execution contract harness; no deployed prompt-injection containment claim
Intent intake probe	Check finite raw-request transformations for urgency, trust, omitted means, private-source publication pressure, stop-condition preservation, and bounded-default non-authority.	implemented by python3 scripts/validate_intent_intake_probe.py; 4 valid scenarios and 6 expected-invalid controls; no deployed parser, authority-extraction, prompt-injection containment, runtime-dispatch, or support-state claim
Intent parsing ambiguity test	Check that ambiguous requests produce open ambiguities, clarification, or bounded defaults rather than executable certainty.	partially implemented by synthetic intent intake probe for vague broad-means dispatch blocking; deployed parser quality not run
Authority extraction test	Check that desired outcomes and allowed means are separated and authority ceilings are explicit.	partially implemented by synthetic intent intake probe for urgency, trust, and private-source authority laundering; deployed authority-extraction quality not run
Stop-condition preservation test	Check that stop conditions survive lowering into plans, semantic atoms, and jobs.	partially implemented by synthetic intent intake probe and plan-execution contract harness for finite record preservation only; runtime preservation not run
Re-contract trigger test	Check that changed means, authority, publication surface, affected parties, evidence requirements, source boundary, support-state effect, or stop conditions return to the contract boundary.	implemented by python3 scripts/validate_intent_recontract_probe.py; valid_no_material_delta_continue, valid_publication_surface_delta_recontracts, and seven expected-invalid controls; no natural-language-intent-understanding, deployed-parser-quality, deployed-authority-extraction, prompt-injection-containment, runtime-dispatch, approval-service, user-satisfaction, or support-state-promotion claim
Bounded-default audit	Check that low-risk assumptions are recorded with scope, rollback, and non-authority status before planning uses them.	partially implemented by synthetic intent intake probe; deployed intake UI not run

9.13.1 Formalization hooks

Tag	Module	Target	Status
lean:intent.contract.operational_invariant	AsiStackProofs.IntentResolutionRefinement	Every successful finite run preserves root-intent identity, the original authority ceiling, and approved-authority boundedness; only parse or accepted re-contract events can write contract payload, and accepted traces compose across event batches.	implemented
lean:intent.contract.failure_blocks_promotion	AsiStackProofs.IntentResolutionRefinement	The model and independent consumer reject payload, prohibition, override, lineage, authority, clarification, constraint/stop, material-delta, rejection, and re-contract faults across four traces, every prefix and batch split, and forty state-noninterfering mutations.	implemented
lean:intent.resolution.route_envelope	AsiStackProofs.IntentResolutionRefinement	Structured intent-resolution records route missing text, prohibited actions, ambiguity, conflicts, and high-impact authority or reversibility gaps before compilation; a thin two-field transport has route-changing conflict and reversibility collisions that no exact router can recover, while the complete seven-field transport round-trips, is injective, and preserves the static route.	implemented
lean:intent.intake.probe_fixture_bridge	AsiStackProofs.IntentResolutionRefinement	The bounded intake, re-contract, and plan-fixture surfaces are digest-bound to an independent consumer with four reachable traces, fourteen invariant prefixes, eighteen batch compositions, and forty state-noninterfering mutations.	implemented
lean:intent.lowering.information_boundary	AsiStackProofs.IntentResolutionRefinement	A thin lowering that omits forbidden means, authority basis, affected parties, privacy boundary, acceptance evidence, and permitted consumers has distinct-intent collisions and no decoder can recover both witnesses, while the modeled full ten-field lowering is injective and changes when affected-party or privacy fields change.	implemented

All five targets now resolve to AsiStackProofs.IntentResolutionRefinement, which imports the static router retained in AsiStackProofs.IntentContracts. The reachable model proves exact bounded write ownership, arbitrary-run root/ceiling/approved-authority preservation, valid-trace extraction, material-delta custody, batch composition, versioned re-contract consequences, one explicit lossy command-projection collision, decoder impossibility for the colliding pair, and injectivity of the modeled full command projection. The route bridge proves two route-changing thin-transport collisions, impossibility of recovering both conflict routes from that transport, and round-trip, injectivity, and route preservation for the complete seven-field transport. The independent consumer binds the existing structured records, rejects 40 state-noninterfering lifecycle mutations, reconstructs six omitted command-field and two route-changing transport collisions, and rejects ten command-field plus seven complete-transport mutations. Five assumption-restating or literal-summary declarations were physically retired with frozen lineage preserved. This proof packet does not prove natural-language parsing, semantic sufficiency of the modeled fields, legitimate authority extraction, valid consent, user preference fidelity, prompt-injection containment, private-source safety, deployed end-to-end lowering, dispatch/effects, user satisfaction, natural-workload usefulness, reproduction, transfer, or chapter-core support.

9.14 Source crosswalk

Source ID	Title	Layer	Planned use	Readiness
viea	Verified Intent-to-Execution Architecture	whole_stack_execution_spine	Keystone source. Human intent -> command contracts -> artifacts -> routing -> runtime targets -> verification -> deployment -> feedback.	source note available; local raw cache available
software_magic_grimoire	Software Magic Grimoire	command_contracts_promptcraft	Structured command contracts and semantic density of software words.	source note available; local raw cache available
planforge	PlanForge	planning_control	Planning substrate. Goal-to-execution compilation, hierarchical decomposition, DAG planning, scheduling, intelligence arbitrage.	source note available; local raw cache available
cognitive_compilation	Cognitive Compilation	planning_semantic_ir	Compiler framing for LLM-centered planning, semantic IR, target compilation, incremental repair.	source note available; local raw cache available
talos	Talos Protocol	labor_execution_os	AI labor OS. Deterministic cognitive manufacturing, typed jobs, control planes, auditability, tool isolation.	source note available; local raw cache available
ext_goal_oriented_requirements_engineering_2001	Goal-Oriented Requirements Engineering: A Guided Tour	requirements_engineering	External comparator for refining stakeholder goals, constraints, responsibilities, obstacles, and conflicts into explicit requirements.	source note available
ext_cooperative_inverse_rl_2016	Cooperative Inverse Reinforcement Learning	human_intent_alignment	External comparator for objective uncertainty, cooperative value learning, active teaching, and communicative action.	source note available
ext_deep_rl_human_preferences_2017	Deep Reinforcement Learning from Human Preferences	human_feedback_learning	External comparator for communicating complex goals through preference comparisons over behavior segments.	source note available

The crosswalk names the source family for intent contracts. The passage-reviewed mappings support stronger drafting traceability, and the external comparators position the chapter against requirements engineering, cooperative objective inference, and preference-feedback learning. None of these records promotes any claim until parser tests, authority-extraction tests, stop-condition tests, accepted evidence transitions, or stronger proof artifacts justify that movement.

9.14.1 Manifest source assignment reconciliation

These rows keep Human Intent as a Formal Input’s manifest assignments visible at their recorded review boundary. Passage review does not establish local reproduction, performance, safety, deployment, or support-state movement.

Source	Intake role	Boundary
ext_cultural_alignment_llms_2024	Metadata-first comparator: Investigating Cultural Alignment of Large Language Models. Empirical study of cultural alignment patterns in selected language models and measurements. It supports explicit population, language, and instrument scope; it does not establish stable national values or a universal measure of cultural alignment.	No passage-level source claim, local implementation, reproduction, safety, performance, deployment, support-state, or ASI result is established by this reconciliation row.

9.15 Culture and language are part of the intent contract

Intent parsing can appear semantically complete while missing culturally specific norms, indirect requests, politeness strategies, kinship and role obligations, dialect, code-switching, or the institutional meaning of a term. The cultural-alignment literature recorded as ext_cultural_alignment_llms_2024 is evidence that these differences deserve measurement, not evidence that a nation or language has one stable value set.

The intake record therefore declares language, locale, translation path, relevant community or institutional context, interpreter or accessibility support, and unresolved cultural ambiguity. It never infers that a demographic label supplies consent or authority. Where translation could materially change scope, affected parties, constraints, or stop conditions, the system preserves the original text, alternatives, translator provenance, and confirmation record. A high-confidence dominant-language parse cannot silently stand in for the user’s own meaning.

9.16 Summary

Human Intent as a Formal Input is the stack’s entry adapter. It turns natural-language purpose into a bounded artifact that planning, alignment, execution, and evidence can inspect.

The core discipline is separation: wanted outcome is not allowed means, context is not authority, helpfulness is not permission, and ambiguity is not consent. Everything downstream depends on that boundary.

Those bounded intents still need constraints before they become plans or tool calls. Intent can say what a person asked for; the constitutional substrate says which predicates, cautions, and review duties still bind the system even when the request is clear.

Later implementation-reference chapters inherit this test. A report-first system is only governed if its reports can show which human intent contract authorized the work, which authority lease was used, and where the system stopped rather than guessing.

9.17 Evidence reconciliation (2026-07-16)

The invariant protocol, field meanings, and inference limits are stated once in Living Book Methodology. This packet contains only the chapter-specific projection; its authoritative per-atom rows are the human-intent-as-a-formal-input slice of experiments/claim_family_terminal_coverage/results/result.json.

The core remains blocked after full attempt at argument support. The strongest family attempt was Safety-critical lifecycle consumer trace. Its exact boundary is: Finite local fixture consumer only; no authentic deployment, general alignment, evaluator independence, or broad security claim. Across 45 atoms, the terminal ledger records 45 blocked_after_full_attempt.

Chapter-specific field	Value
Family / atom denominator	CF-02 / 45 atoms
Terminal dispositions	45 blocked_after_full_attempt
Core	human-intent-as-a-formal-input.core: blocked_after_full_attempt at argument
Core attempted / missing lanes	executable, formal, source-synthesis / causal, empirical, normative, transfer
Attempted local lanes	executable, formal, source-synthesis
Missing or unproved lanes	causal, empirical, executable, formal, normative, transfer
Strongest family bundle	Safety-critical lifecycle consumer trace (end_to_end): Ten finite lifecycle receipts spanning bounded effects, denials, residual accounting, and safety-critical state transitions.
Negative controls	five explicit denials with residuals; eight rejecting mutations.
Accepted transitions	none
Maximum inference	Finite local fixture consumer only; no authentic deployment, general alignment, evaluator independence, or broad security claim.
Reproduction / next burden	Replay scripts/validate_safety_critical_lifecycle_consumer_trace.py and scripts/validate_claim_family_terminal_program.py; fill the named atom-specific lanes under a new prospective protocol.

9.18 Handoff

Intent contracts can preserve what a person asked for, but they do not prove that an assigned human role can exercise the promised control. Human Factors and Meaningful Control in Oversight receives the accepted request, consequence class, authority ceiling, review obligations, and intervention points and tests whether the responsible person has compatible information, competence, time, workload, authority, alternatives, and a usable fallback. Constitutional Alignment then decides which dignity, consent, contestability, refusal, correction, and appeal remain usable. Its least-sufficient-power predicates still constrain the work.