Skip to main content

83  Integrated Reference Architecture

83.1 Chapter status

Field	Value
Chapter ID	integrated-reference-architecture
Part	Part IV - Evidence, Implementation, and the Living Book
Status	conceptual
Manuscript maturity	v0.3 manuscript draft
Last updated	2026-08-08
Primary source records	36 assigned records with 32 exact passage-reviewed mappings spanning the stack sources, local implementation lineage, external comparators, and a typed relational-complex integration packet
Claim label	Design rationale
Evidence level	argument
Source queue	primary: viea, scf, vcm_public, planforge, talos, spinoza, octopus_router, rmi, benchmaxxing; supporting: alignment_field, cgs, cognitive_loop_closure, project_theseus_whitepaper, theseus_plan_compiler, theseus_self_evolution_system, theseus_architecture_gate, theseus_operator_os, theseus_circle_transfer, reflexive_router_whitepaper, relational_dimension_compiler; connector/recovery: moecot, vcm_editable
Source loading state	source notes: learning_compute_topology, viea, deterministic_capability_compilation, platonic_world_model, scf, vcm_public, planforge, talos, spinoza, octopus_router, rmi, benchmaxxing, alignment_field, cgs, cognitive_loop_closure, moecot, vcm_editable, project_theseus_whitepaper, theseus_plan_compiler, theseus_self_evolution_system, theseus_architecture_gate, theseus_operator_os, theseus_circle_transfer, cca_project, moecot_manifest_project, bugbrain_project, corbens_trainer_project, corbens_best_model_possible_project, ext_drexler_cais_2019, ext_adas_2024, qcsa_whitepaper, ext_v_jepa_2_2025, ext_embedded_agency_2019, reflexive_router_whitepaper, kernel_english_residual_compiler, ext_swe_rebench_v2_2026, relational_dimension_compiler, regret_engine; raw cache: viea, scf, vcm_public, planforge, talos, spinoza, octopus_router, rmi, benchmaxxing, alignment_field, cgs, cognitive_loop_closure; connector/recovery: moecot, vcm_editable
Test state	Existing finite trace, schema-refinement, and logical-concurrency consumers remain bounded. The first P5 slice runs 8/8 local state/effect cases. Its successor runs 7/7 commit-bound service cases with actual model/Adam state, weights-only rollback rejection, nine-class crash/restart recovery, an owned outbox across a localhost partition, one exactly-once external effect, stale-credential and custody-tamper rejection, and separate-process observation. No deployed multi-service trace, natural workload, distributed partition, open-world effect discovery, external reproduction, or support promotion exists.

83.2 Drafting guardrail

This synthesis treats the stack as an end-to-end design target. It does not claim that an integrated runtime exists, that every handoff has been exercised, or that Project Theseus/MoECOT/VCM reports have been reproduced in this repository. The Project Theseus static architecture-gate import is a bounded implementation-reference fixture, not an end-to-end trace.

Artifact stewardship gives projects bounded continuity. Integration zooms back out and asks what a steward, planner, memory system, router, verifier, executor, benchmark ratchet, and SCF gate are all supposed to preserve together: an inspectable trace from authorized intent to artifact and evidence-backed change. Integration is useful only if it makes the handoffs more visible, not if it hides them behind a single system label.

The reference architecture is therefore not an orchestration diagram with more boxes. It is the book’s test of compositional honesty. If a layer claims to improve the system, the trace should show what authority it received, what artifact it emitted, what residual it left, and which later layer was allowed to depend on it.

83.3 Human Reading Path

Concrete lens. The simpler route treats a passing smoke test as release authority. It is cheaper in the fixture but admits eight false accepts because it omits the joins the chapter claims integration must preserve.

After every major layer is named, the machine has to come back together. Intent, planning, memory, routing, verification, execution, evidence, benchmarks, and improvement should cooperate in one inspectable flow.

This is the synthesis checkpoint. The question is not whether every implementation exists yet. The question is whether a future implementation could produce a trace clear enough to show what happened, why it was allowed, what evidence changed, which residuals remained, and where the system stopped. A reference architecture earns trust only when the blocked path is as visible as the happy path.

The integrated architecture should make composition legible. If the layers only look coherent in a diagram but lose authority, context, evidence, or residuals at the handoffs, integration has failed. If the trace survives across every handoff, the stack has a practical test for whether new parts compose.

Integration succeeds when the trace remains understandable after every layer has done its work.

The whole stack is credible only when its combined behavior stays explainable under stress, failure, and revision.

83.4 Problem

Readers need to see how the layers operate as one machine from intent to governed action and improvement. A chapter-by-chapter specification is necessary, but it is not sufficient. The architecture becomes real only when a reader can trace one request across the whole stack and identify every artifact, permission check, evidence update, and possible stop condition.

83.4.1 Concrete integration failure: the patch that passed and still could not ship

The local governed repository-change slice provides an executed failure scene. Nine matched change requests reached a public smoke test. A simple route treated that green signal as sufficient and released all nine; eight were false accepts. The governed route joined the request to an allowed path, quarantined instructions recovered from untrusted context, rechecked authority immediately before effect, separated claimed file hashes from bytes observed by another process, and probed rollback descendants. It released three cases safely, refused five, quarantined one, attempted three rollbacks, completed two exactly, and preserved the failed rollback as an open residual. It produced zero false accepts and zero unsafe releases in this bounded slice.

Those counts do not imply that “more governance wins.” The governed route spent 66 deterministic cost units, 89 trace steps, and nine review steps, compared with 27 cost units, 27 trace steps, and no review for the simple route. Instead, the comparison gives integration a price and a falsifiable shape. Intent, context, authority, observation, evaluation, rollback, evidence, and residual custody must join around the same effect. If the architecture cannot show that joined lineage, a green subsystem does not authorize the release. The detailed event log and its four invariants follow below; the fixture-only showpiece trace below shows the same ownership pattern one artifact at a time.

The end-to-end integration point receives the constitutional frame, command-contract machinery, planning layer, memory compiler, claim ledger, execution OS, routing substrate, compression loop, evidence ratchet, and improvement boundary. The job is to show how those pieces compose without pretending that composition is already implemented or proven.

The integration question has two halves. The happy path asks whether intent can become an artifact without losing context, authority, or evidence. The blocked path asks whether missing authorization, inadequate context, failed verification, excessive residual, or evaluator capture actually stops the flow. A reference architecture that cannot explain the blocked path is not governed; it is only sequenced.

83.5 Why existing approaches are insufficient

Layer chapters can still feel disconnected unless the book traces the complete control flow and artifacts.

The failure mode is architectural fragmentation. A planner can produce tasks, a memory system can supply context, a verifier can score claims, an execution OS can run tools, and a benchmark harness can report improvement, while no one can answer whether the original authority grant still covers the final action. That is not a minor documentation gap. It is the difference between a collection of useful mechanisms and a governed system.

The integrated view has to compose external baselines that are normally studied separately. CAIS (ext_drexler_cais_2019) provides the closest broad precursor: it frames general AI as comprehensive services and R&D automation, but leaves this book’s typed handoff, authority, claim-state, residual, and release-record contract unspecified. TAMP (ext_integrated_tamp_2020) and behavior trees (ext_behavior_trees_robotics_ai_2017) name planning/execution interfaces, GShard (ext_gshard_2020) names distributed conditional computation, TLA+ (ext_tla_plus_home_docs) and PRISM (ext_prism_model_checker_2002) name system/model-checking lanes, and Black-Box Simplex (ext_black_box_simplex_2021) names runtime assurance around controller switching. The reference architecture’s contribution is the handoff ledger across those lanes, not a claim that one implementation has integrated them.

The local delta of Integrated Reference Architecture is therefore not another instance of the governed-cognition pattern. It is joinability. The same record/lifecycle/authority/evidence/receipt/rollback pattern has to survive across many layers as one trace, including the blocked path. A planner record, context packet, route decision, claim envelope, work order, audit log, evidence delta, and SCF gate are only integrated when their parentage, authority deltas, residual deltas, and non-claims can be joined after the run.

The integrated reference architecture therefore has to be explicit about handoffs. The output of one layer is not “more context” or “a better answer.” It is a typed artifact: a command contract, plan DAG, context packet, claim record, work order, route decision, proof obligation, audit log, benchmark result, or capability-field transition.

A single all-purpose agent loop can make this worse by turning every boundary into hidden prompt state. The ASI Stack should resist that collapse. The planner should not silently become the verifier; the memory compiler should not silently become the authority source; the execution OS should not silently decide that a failed residual is acceptable; and the benchmark ratchet should not silently promote a candidate whose regression floor moved.

83.6 Core Claim

Readable claim. The stack is integrated only when a reader or verifier can follow one request across every participating layer without losing artifact identity, authority scope, observed effects, evaluation, rollback state, or residual ownership.

Normative rule. A successful component, green service, or valid theorem may advance its own bounded record. It may not stand in for the missing joins of a whole-stack run.

[integrated-reference-architecture.core, label: Design rationale, support: argument] Integrated Reference Architecture owns a trace-, run-, request-, intent-, authority-, artifact-, parentage-, layer-, canonical-state-, material-effect-, terminal-receipt-, evaluator-, evidence-, residual-, rollback-, consumer-, environment-, and time-specific Cross-Layer Trace Join Contract: it proves integration only when every participating owner remains distinct and its typed input, output, authority delta, state identity, observed effect, acknowledgement, evaluation, evidence delta, residual, stop, repair, rollback, and non-claim remain joinable across approved, blocked, failed, revoked, rolled-back, and quarantined paths; a diagram, shared prompt, interface name, projection, green service, replay, fixture, theorem, or locally successful slice cannot establish whole-stack execution, semantic preservation, governance enforcement, safety, capability, deployment, transfer, or SOTA.

The claim remains at argument support. The source notes support architecture synthesis across intent, command contracts, plans, VCM, routing, claims, execution, benchmarks, SCFs, and report-first implementation references. SWE-rebench V2 (ext_swe_rebench_v2_2026) now supplies a natural multilingual repository-change substrate for the next matched admission campaign, but its automated labels, image manifests, and public patches do not pass the local construct, evaluator, resource, or held-out gates. The bounded QCSA vertical trace now shows one completed 13-stage local reversible run, but it does not show the broad learned-model, multi-service, deployed integrated stack described by the core claim.

83.6.1 Claim-source mapping status

Appendix C now records thirty-two exact passage-reviewed mappings across thirty-six assigned sources for this synthesis. The five historical-project records count as one related implementation lineage, not five independent confirmations. The review makes the source map traceable enough for drafting and later support review, but it does not move the core claim above argument support. It also does not convert CAIS or ADAS results, Project Theseus reports, historical-project notes, MoECOT connector context, VCM Editable terminology, the Relational Dimension Compiler proposal, schemas, fixtures, or finite Lean predicates into an integrated runtime result.

Mapping group	Reviewed support	Boundary
Core stack sources	VIEA intent-to-execution, SCF replacement gates, VCM context packets, PlanForge planning, Talos execution, Spinoza claim discipline, Octopus routing, RMI ratchets, and Benchmaxxing evidence updates.	No end-to-end runtime trace, deployed authority enforcement, benchmark result, route-quality result, replay result, or support-state promotion.
Normative and compression sources	Alignment Field as bounded normative/governance context; CGS as compact seed/rule/state/residual/verification/governance framing; Cognitive Loop Closure as procedural-memory handoff context.	No empirical consciousness, moral-status, alignment, compactness, procedural-memory, or safety result.
Connector/recovery sources	MoECOT and VCM Editable source notes for runtime orchestration and richer VCM terminology.	Source-note only; raw connector text is not published here and no runtime, VCM-Bench, model-facing, or context-policy result is promoted.
Pinned Theseus project files	Whitepaper, plan compiler, self-evolution system, architecture gate, operator OS/work board, and Circle transfer lane as report-first implementation references.	No current reports, commands, dashboards, board steps, compiler proof, transfer consumer, benchmark ledger, or model artifact was rerun or independently inspected here.
Historical-project lineage	CCA, MoECOT Manifest, BugBrain, Corben’s Trainer, and Corben’s Best Model Possible expose compiler/control-plane breadth together with canonical/projection drift, silently lost effects, stale promotion state, incomplete completion acknowledgement, and interface-without-causal-effect failures.	Public-safe source notes only; the projects were not rerun, repeated mechanisms are not independent evidence, and the fixture does not establish an integrated runtime or capability result.
External architecture and foundations comparators	CAIS for service composition, ADAS for code-defined architecture search, QCSA for a semantic control plane, V-JEPA 2 for predictive-state planning, and Embedded Agency for the open-world limit of finite internal traces.	No comparator result was reproduced; none establishes this stack’s joinability, semantic preservation, governance, safety, capability, deployment, or transfer.
Formal and fixture artifacts	reference_trace_record.valid.json and finite Lean predicates define record-level handoff and gate expectations.	They prove record-shape gates only, not deployed layer behavior, artifact continuity, authority-stop behavior, or stack safety.

83.7 Mechanism

The reference architecture is a trace contract. A request enters through human intent and constitutional authority, then passes through planning, context compilation, routing, verification, execution, evidence update, and capability governance. At each boundary the next layer receives a typed artifact rather than an informal summary: command contract, plan DAG, context packet, route decision, claim envelope, work order, audit log, benchmark ledger, or SCF transition.

The participants in that trace are logical roles. They do not imply one model, process, machine, vendor, or physically separate cognitive module per lane. A single model can serve several roles when independent policy, state, and verification surfaces enforce the handoffs; one role can also be implemented by several models, deterministic tools, or human reviewers. The reference architecture is therefore substrate-neutral while remaining strict about responsibilities and authority.

83.7.1 The Regret Engine as a joined subsystem

The Regret Engine source (regret_engine) supplies a cross-layer return path rather than a new omnibus owner. Planning commits a Decision Capsule. Artifact Graphs bind actual outcomes, comparator proposals, evaluator outputs, and replay handles. Independent assurance classifies counterfactual support, causal contribution, foreseeability, feasibility, and learning eligibility. Claim Ledgers receive only proposition-level revision proposals. Data Engines and Procedural Memory route eligible packets into replay or the least invasive durable repair. Policy Optimization trains only inside a bounded update lease. Readiness admits, narrows, quarantines, or retires the result. Operations retains reaction and recovery authority, while constitutional governance alone may change objectives, rights, comparators, evaluator policy, or authority.

flowchart LR
  A["Planning: Decision Capsule"] --> B["Artifact graph: outcomes + comparators"]
  B --> C["Assurance: typed Regret Packet"]
  C --> D["Data / procedural repair proposal"]
  D --> E["Policy update lease"]
  E --> F["Readiness decision"]
  F --> G["Qualified, narrowed, fallback, or quarantine"]
  C --> H["Operations: recovery and residuals"]
  C --> I["Claim revision proposal"]
  H --> B
  G --> A

The join preserves three non-transfers: regret is not evidence, learning eligibility is not readiness, and regret reduction is not authority. The paper contains a service blueprint and proposed coding-agent pilot, but no end-to-end Regret Engine, counterfactual tribunal, policy update, or deployment has been implemented here.

83.7.2 Assurance shift as a joined return path

Assurance-Shift Learning (assurance_shift_learning) adds a second cross-layer return path without adding a super-owner. Operation emits versioned episodes; Evidence preserves outcomes, process traces, coverage, and uncertainty; Discovery proposes natural or probe exceptions; Adjudication decides whether they are defects and learning-eligible; Repair selects the least invasive qualified surface and tests composition; Assurance updates the scoped competence envelope, monitoring, recovery, and requalification triggers.

flowchart LR
  O["Operation"] --> E["Evidence"]
  E --> D["Discovery"]
  D --> A["Adjudication"]
  A --> R["Least-invasive repair"]
  R --> Q["Assurance + qualified envelope"]
  Q --> O
  A --> X["Unresolved evidence escrow"]
  R --> Y["Compatibility + descendant checks"]

The topology controller may allocate resources among these planes, but it may not judge its own evidence, authorize its own repair, or promote its own envelope. Learning eligibility remains distinct from readiness, and fast containment remains distinct from slow consolidation. The paper specifies the records, algorithms, invariants, and benchmark needed to test this join; no end-to-end GRBL service exists in the repository.

83.7.3 Training candidates are transactions, not artifacts

The same role separation now applies before a learned candidate reaches this trace. Replaceable Cognitive Substrates supplies an architecture and its architecture-specific state schema. Governed Model Training binds that choice to an exact data lease and order, objective, optimizer, scheduler, numerical policy, device and parallelism topology, environment, failure denominator, complete checkpoint state, resume-equivalence claim, and checkpoint family. The output is one identity-bound candidate plus a run receipt—not evidence that the candidate is useful, safe, or ready.

Benchmark Ratchets must remain independent of checkpoint selection, and Readiness retains admission authority. This prevents a trainer from consulting protected qualification outcomes to choose its “best” checkpoint and then presenting the same outcomes as held out. It also prevents an integrated stack diagram from laundering a completed job, high utilization, successful load, or formal record route into model-quality evidence. No distributed ASI Stack training run has been executed for this interface; the present integration is an argument-level ownership and handoff contract.

83.7.4 Shared transition, development, trust, and liveness join

Four cross-cutting ideas now meet in the reference trace without becoming four new layers. First, every material handoff can be projected through the Governed Transition Calculus (T=(I_s,I_t,A,O,E,R,C,,)): exact source and target identity, authority, obligations, evidence, residuals, consumers, expiry or revocation, and rollback, compensation, or retirement. Each owner adds its domain fields, but no owner may erase these separations.

Second, learned capability enters through the Developmental Intelligence Loop: curriculum, interaction, prediction error, abstraction, causal intervention, memory consolidation, proceduralization, skill composition, stabilization, readiness review, and authority-gated promotion. The trace preserves the candidate and evidence identity at every step, so “the system learned” cannot hide which observation, state change, regression, or gate produced the claim.

Third, the minimum trusted kernel is an explicit trust budget over identity, time, authority, policy, context resolution, artifact custody, observation, evaluation, sandboxing, rollback, and release. Components outside that budget may propose or cross-check; components inside it need named compromise, revocation, recovery, and hold behavior. The reference trace must expose when a result depends on one of these properties rather than treating the governance plane as an infallible box.

Fourth, bounded liveness gives every admitted task and residual a terminal route. Completion, refusal, quarantine, compensation, and retirement are distinct outcomes; unbounded review is not a safe success. Useful throughput, false blocking, latency, human time, compute, residual burden, recovery, and governance cost share one denominator with unsafe or unauthorized effects.

Together these ideas turn the reference architecture from a catalog of modules into a joined lifecycle for becoming more capable while remaining observable, governable, recoverable, and useful. At present this is an argument-level integration. The later evidence phase must test whether the shared records bind reachable implementations and whether the joint gate outperforms simpler alternatives.

Behavioral and white-box evidence now join the trace as distinct siblings. Benchmark records say what happened under a scoped instrument. An Internal Evidence Packet says what one method observed or changed inside one exact model, how stable and causally bounded that interpretation is, and how much remains unexplained. The evidence ledger may compare them, but it may not let a feature, circuit, probe, or steering result overwrite contradictory behavior or become an authorization token. Material model change expires the internal packet; favorable internal visibility can preserve, restrict, escalate, reject, or expire a path, never grant execution or release authority.

At trace scale, the governed-cognition pattern shifts from local boundary ownership to cross-layer composition. A layer-local record says what one boundary owns. A Reference Trace Record says whether those local records still compose after handoff, denial, residualization, or proposed improvement. That is why the trace carries parent artifacts, authority deltas, evidence deltas, residual deltas, stop conditions, and non-claims together.

This is where the earlier layers compose. VIEA supplies the intent-to-execution spine, VCM supplies source-bound working memory, PlanForge and Talos supply planning and work contracts, Spinoza supplies claim discipline, Octopus/RMI/Benchmaxxing supply routing and ratchet pressure, CGS and loop closure supply compression pressure, and SCF supplies the replacement gate. Project Theseus and MoECOT remain implementation-reference context until their artifacts are imported or rerun here.

The control question at every step is simple: what artifact was received, what authority did it carry, what evidence changed, and what stop condition could still block progress?

The trace should include positive and negative checkpoints. A positive checkpoint says what the layer completed and which downstream dependency may now consume it. A negative checkpoint says why the flow stopped, narrowed, escalated, or entered quarantine. This makes the blocked path a first-class artifact instead of an exception that disappears into prose.

The reference trace below is conceptual. It is a design target for later schemas, tests, and proofs, not a report of a completed implementation. The deterministic fixtures under experiments/reference_trace/fixtures/ now provide a record-level worked trace for that design target, but they remain fixture_only records rather than runtime execution.

The Relational Dimension Compiler adds a cross-layer state that the reference trace must eventually be able to join. A QualifiedRelationalComplexPacket contains versioned entity and macro-object identities, field domains, relation instances, typed role incidences, branch identity, operators and primitive orders used, proposal and qualification lineage, lower-order rescues, counterfactual and invariance results, uncertainty, contraction maps, permitted uses, prohibited inferences, residuals, and complete cost receipts.

flowchart LR
  A["Observation and accepted context"] --> B["Typed construction request"]
  B --> C["Candidate proposal"]
  C --> D["Order and operator routing"]
  D --> E["Relation qualification"]
  E -->|accepted| F["Typed relation object and incidences"]
  E -->|unresolved or rejected| R["Relational residual ledger"]
  F --> G["Branch-local world and memory state"]
  G --> H["Optional contraction into macro-object"]
  H --> I["Planner, compiler, verifier, or specialist consumer"]
  I --> J["Authorized effect boundary"]
  J --> K["Outcome observation and reconciliation"]
  K --> G
  K -->|invalidates| H
  D --> L["Cost and routing receipt"]
  E --> L
  H --> L

The diagram is a join map, not a claim that one service implements the whole path. It shows why the relation packet belongs in the reference architecture: no individual owner can establish that the same relation survived proposal, qualification, storage, abstraction, consumption, effect, and reconciliation. That fact exists only if their records join.

83.7.4.1 One relational packet through the stack

Suppose a planner asks whether an authorization-bound transfer is possible in a predicted branch. Context supplies observations, known entities, schema versions, field or resource state, and explicit unknowns. Governed World Models creates a branch rather than editing actual state. The construction request names the consumer, branch, observation and belief bases, permitted schemas and operators, maximum primitive arity, invariances, evidence requirements, resource and verification budgets, authority ceiling, fallback, and prohibited uses.

The proposer may combine pairwise salience, exact identity lookup, time and geometry neighborhoods, schema completion, residual hotspots, memory precedents, and the planner’s query. Every proposed and rejected participant stays in the candidate denominator. Routing attempts the least expensive qualified path: perhaps exact joins for identity and authorization, pairwise retrieval for candidates, then selective triadic scoring for a disputed role binding. Its receipt records the candidate topology, operator, primitive arity, factorization, precision, information available, estimated gain, complete cost, fallback, and expiry.

Qualification is a different custody boundary. It checks role types and multiplicity, time and branch compatibility, evidence, alternative bindings, lower-order sufficiency, role-specific counterfactual deletion, invariance or equivariance, calibration, downstream risk, and cost justification. An accepted candidate becomes one versioned relation instance plus typed incidences; an unresolved candidate becomes a residual rather than disappearing. Acceptance means only that the candidate passed this policy for this consumer. It does not mean the predicted transfer occurred or that an effect is permitted.

Memory can now retrieve the event as an addressable object, not merely as similar text. Cognitive Compilation can lower it into planner predicates, database joins, graph batches, tensors, symbolic constraints, simulator inputs, or verification queries while preserving the semantic and evidence packet. Procedural Memory may later compile a repeatedly qualified construction path into a faster recognizer, but the card retains its slow path, counterexamples, monitoring, invalidation dependencies, and rollback descendants. Resource Economics sees proposal, rejection, kernel, storage, qualification, repair, and human burdens rather than only the winning contraction.

If the planner proposes an external action, the authority boundary receives a proposal and its relational evidence; confidence or structural coherence does not grant permission. After an authorized effect, an independent observation records what happened. Reconciliation compares the result with the original branch-local prediction, creates a discrepancy relation where needed, updates calibration, invalidates affected descendants and contractions, and preserves the original prediction for replay. The Claim Ledger may then update only the exact scoped proposition through its own evidence transition.

The packet earns integration when these identities join without ambiguity:

Join identity	Failure if it changes silently
Entity, relation instance, schema, and role binding	A plausible but different event is evaluated or executed
Observation basis, branch, valid time, and horizon	Simulation or stale state is laundered into actuality
Proposer, candidate set, and rejected alternatives	Hidden-oracle work and survivorship disappear
Operator, primitive arity, factorization, precision, and device	Computational credit and approximation loss become unattributable
Qualifier, tests, alternatives, uncertainty, and defeaters	Proposal confidence is mistaken for qualified belief
Contraction map, query envelope, error, and expansion triggers	A macro-object travels beyond the questions it can answer
Authority request, decision, effect, and acknowledgement	A relation packet is mistaken for permission or completion
Outcome, discrepancy, descendants, and support transition	Failure is overwritten and downstream claims remain stale

That packet does not replace current owners. Governed World Models own the observation-to-belief and prediction-to-reality boundary. Routing owns operator and specialist admission. Cognitive Compilation owns semantics-preserving lowering. Context and memory own mounted state. Runtime and Authority own effects. Artifact and Claim Ledgers own lineage and support. Procedural Memory owns slow-to-fast compilation. Resource Economics owns total burden. The reference architecture owns only the joins among those owner-specific records.

The relational packet creates four additional join questions:

1. Did the same entity, relation schema, role binding, branch, and time survive from proposal through consumption?
2. Did a computational rewrite change semantic arity, role symmetry, approximation, or abstraction scope without a loss receipt?
3. Did a macro-object cross a consumer or environment boundary that should have triggered expansion?
4. Did a compiled fast path preserve its qualified slow path, counterexamples, expiry, and rollback descendants?

This is source-grounded architecture integration only. No RDC packet has run through the reference fixture, and no whole-stack relational advantage or semantic-preservation result follows.

83.7.5 Functional precision across the reference trace

Functional precision is intentionally split across owners but remains one joined trace. The task contract identifies protected behavior and consequence. RankFold/NeuralFold owns canonicalization, transformation, complete description accounting, and the candidate precision package. Compact Generation owns base and residual honesty. Fast Generation owns runtime refinement and fallback. Resource Economics closes physical and assurance cost. Executable Specifications owns finite transformation obligations. Weight Custody owns derivatives and platform identity. Readiness owns certificate expiry, quarantine, and revocation. The Efficient ASI policy decides whether precision is the resource worth changing.

The join identity is:

reference -> protected contract -> canonicalization -> precision plan -> complete package -> base/residual route -> verification -> certificate -> expiry or revocation.

No boundary may substitute parameter proximity for protected behavior, payload bytes for complete cost, reconstruction for utility, a certificate for correctness, or a faster route for authority. The reference trace records the same artifact, decoder, kernel, platform, domain, evaluator, route, fallback, and evidence identities at every step. A material mismatch produces a new candidate or invalidation, not silent inheritance.

flowchart LR
    C["Task and protected behavior"] --> P["Precision transformation"]
    P --> B["Complete base + residual package"]
    B --> R["Runtime precision route"]
    R --> V["Behavior and cost verification"]
    V --> Q["Scoped precision certificate"]
    Q --> U["Use under readiness lease"]
    U --> X["Drift / expiry / revocation"]
    X --> P

This integration supplies a reader-visible architecture and falsification contract. It does not establish a universal bit bound, implemented compiler, behavior-preserving quantizer, cost advantage, certificate validity, or deployment result.

83.7.6 Eighteen-stage cross-layer join lifecycle

The contract (1) freezes purpose, request, intent, affected parties, consumers, environments, owners, effects, acceptance, and non-claims; (2) binds authority, delegation, ceilings, approvals, revocation, stops, exceptions, and terminal authority; (3) assigns stable identities and digests to every parent, state, effect, receipt, evaluator, evidence event, residual, rollback, and descendant; (4) specifies every layer as a typed owner contract; (5) traces intent through governance, command, plan, context, route, claim, work, effect, observation, evidence, readiness, release, and improvement; and (6) links compression, memory, learning, data, replacement, stewardship, resource, security, and incident subtraces rather than hiding them.

It then (7) retains every terminal path and denominator; (8) joins request, policy, canonical state, effect, receipt, evaluator, and claim boundary; (9) keeps canonical state authoritative over projections; (10) binds all join digests; (11) records evaluator identity and dependence; (12) applies authority, revocation, evidence, residual, causal-order, lifecycle, and bounded- liveness invariants; (13) runs semantic, negative, fault, replay, differential, and mutation checks; and (14) compares matched direct, monolithic-agent, workflow, service-composition, and no-governance baselines.

Finally, it (15) reconciles outcomes into exact terminal decisions; (16) propagates corrections, revocations, rollback, evidence downgrades, and residual changes; (17) monitors join completeness, orphans, drift, unacknowledged effects, evaluator capture, latency, residual age, rollback, usefulness, failures, and cost; and (18) expires after material interface or environment change.

sequenceDiagram
  participant H as Human
  participant G as Governance
  participant P as Planner
  participant M as VCM
  participant R as Router
  participant V as Verifier
  participant E as Execution OS
  participant L as Evidence Ledger
  participant S as SCF Gate

  H->>G: intent plus authority request
  G->>P: approved command contract
  P->>M: context obligations and plan needs
  M->>P: source-bound context packet
  P->>R: typed plan DAG with capability requirements
  R->>V: candidate route and residuals
  V->>E: verified work order or rejection
  E->>L: artifact, audit log, and runtime result
  L->>S: evidence update and regression status
  S->>G: promote, rollback, quarantine, or require review

What the reference trace shows: The reference trace is an end-to-end logical handoff chain, not a claim about physical module count and not a single agent loop with hidden role changes. Each participant receives and emits a typed artifact, and the final SCF gate can still promote, roll back, quarantine, or require review based on evidence and authority.

83.7.7 The name-to-effect spine

The historical projects reveal a stricter integration test than the presence of named layers. A system can expose a planner, registry, router, memory store, verifier, trainer, and dashboard while its ordinary request path still uses defaults, silently drops writes, leaves stale promotion records active, or reports queue idleness as completion. A name in an architecture diagram therefore has no evidential authority until it is joined to the material effect it owns.

The name-to-effect map is a seven-stage join: request-derived input, policy decision, canonical state selection, observed effect, acknowledged receipt, evaluator result, and claim boundary. Every stage names its owner, inputs, output, and authority class. The map is deliberately narrower than the full reference trace. It answers one falsifiable question: did the request actually reach the state and effect claimed by the final narrative?

Canonical state and projections must remain separate inside that chain. A dashboard, report, cache, index, claim view, or promotion label may summarize the canonical record, but it cannot become the authority merely because it is newer or easier to query. State selection records the canonical reference and digest, while projections remain named secondary views. The request-to-effect receipt then binds the request identity and digest, policy decision, selected canonical-state digest, observed effect identity and digest, and acknowledged terminal state. Without those bindings, a locally valid receipt can describe the wrong request, stale state, or orphaned effect.

flowchart LR
  R["Request-derived input<br/>request id + digest"] --> P["Policy decision<br/>authority + decision id"]
  P --> S["Canonical state selection<br/>digest-bound; projections secondary"]
  S --> E["Observed effect<br/>target + terminal state + digest"]
  E --> C["Request-to-effect receipt<br/>request + policy + state + effect"]
  C --> V["Evaluator<br/>method + route independence"]
  V --> B["Claim boundary<br/>allowed statement + blockers"]

  H["CCA / MoECOT / BugBrain / Trainer / Best Model<br/>one related historical lineage"] -. design lessons .-> R
  H -. negative cases .-> S
  H -. causal gaps .-> E

What the lineage trace shows: The five projects contribute one bounded family of design lessons, not independent replication. The chain makes canonical state, material effect, evaluator route, and permitted claim joinable while preserving a blocking boundary around project capability and runtime claims.

The strongest objection is that a complete receipt can still be false because one compromised system may manufacture every record in the chain. That objection is correct. This fixture checks cross-record consistency and a separate verifier identity only; it does not prove verifier independence, observation truth, causal completeness, or open-world enforcement. Those residuals stay explicit, and the claim boundary remains blocks_promotion.

The concrete negative case is interface theater. A named component emits a shape-valid or dashboard-visible projection, but the material effect is missing, stale, unacknowledged, or unrelated to the request. BugBrain’s ignored audit I/O, Trainer’s discarded asynchronous checkpoint result and stale quarantine-dependent promotion, and Best Model’s default/empty ordinary path are different instances of the same failure. The name-to-effect harness rejects stage omission, projection authority, state/effect digest mismatch, unacknowledged terminal effects, false evaluator independence, orphaned effect mappings, and fixture-based claim promotion.

The important feature is that every participant emits something durable enough for another participant to inspect. If the planner fails, the plan DAG should show where. If memory fails, the context packet should expose stale, missing, or unauthorized material. If routing fails, the residual record should survive. If execution fails, the audit log should make the failure replayable. If improvement is proposed, the SCF gate should decide whether the evidence supports promotion, rollback, quarantine, or human review.

83.7.8 Current fixture trace

The current public-safe worked trace is a deterministic fixture pair checked by python3 scripts/validate_reference_trace.py. The approved fixture, reference-trace-fixture-approved-001, starts from intent://human-book-maintenance-request, narrows authority to manuscript and fixture edits, and carries artifacts through command://chapter-update-contract, plan://reference-trace-dry-run, context://source-bound-packet, route://bounded-reference-route, claim://argument-only-reference-claim, work://fixture-only-work-order, audit://fixture-validation-log, evidence://record-shape-only-update, and scf://no-promotion-review. Its evidence delta is record-shape only and explicitly preserves argument support.

The blocked fixture, reference-trace-blocked-authority-001, starts from intent://restricted-execution-request and records the same layer handoff spine, but governance denies runtime execution authority. The trace narrows into plan://blocked-reference-trace, routes through route://denied-runtime-route, emits work://blocked-work-order and audit://authority-denial-log, records evidence://blocked-path-record, and leaves scf://promotion-blocker. Its stop conditions are missing execution authority, unaccepted residual, and required governance review.

This is the concrete trace the architecture currently has: two valid record-level fixtures and six expected-invalid fixtures for missing parent artifacts, silent authority deltas, blocked traces without stop conditions, missing residual deltas, promotion without validation commands, and erased residuals. It is useful because it makes the end-to-end record shape testable. It does not prove a deployed runtime, live artifact-continuity audit, authority-stop enforcement, model quality, benchmark quality, or support-state promotion.

83.7.9 Replayed command trace

A first actual Resource flagship lane validator replay now extends that fixture surface. The replay record at experiments/reference_trace/replay_results/2026-07-02-resource-flagship.json runs python3 scripts/validate_resource_flagship_lane.py, records the command output digest, attaches a tracked artifact bundle, and carries the same Reference Trace Record fields: intent, authority chain, authority deltas, layer handoffs, artifacts, evidence deltas, residual deltas, validation commands, stop conditions, source refs, and non-claims.

The replay also attaches the blocked-authority fixture as its blocked-path stop-condition reference. That gives the reference architecture one actual command replay plus one explicit denied-authority path in the same record family. It is still local replay evidence only. It does not prove a deployed runtime, live artifact-continuity service, authority-stop enforcement outside the fixture, model quality, benchmark quality, scheduler behavior, economic outcomes, or support-state promotion.

83.7.10 Worked showpiece trace: one request through the stack

Use the approved fixture as a small, concrete runbook for the whole architecture. The initiating request is not “build ASI.” It is deliberately narrower: maintain one living-book section while preserving source boundaries, evidence discipline, and support-state non-promotion. The fixture names that request intent://human-book-maintenance-request, which is important because the trace begins with a bounded human purpose rather than a system-owned optimization target.

The first handoff turns that request into command://chapter-update-contract. This is the intent and governance boundary. The command grants book-maintenance authority, not runtime execution authority, deployment authority, benchmark authority, model-quality authority, or support-state promotion authority. In the fixture’s authority deltas, the grant narrows to manuscript and fixture edits, the plan does not receive runtime execution authority, and the SCF gate remains review-only. That means the rest of the trace can do useful maintenance work without quietly becoming a claim that the system improved itself.

Planning then emits plan://reference-trace-dry-run. The plan is not a hidden chain of thought and not an ambient permission bundle. It is a parent artifact that later records can cite. Its job is to name the required context, the route, the validation command, the evidence boundary, and the residuals that must survive. If this plan tried to add a runtime action or a support-state transition, the authority delta would have to show that change or the trace would fail the fixture’s silent-authority-delta control.

VCM then supplies context://source-bound-packet. This packet represents the memory boundary: the trace is allowed to use source-note and manifest context, but it is not allowed to smuggle in unpublished private text, connector-only claims, or free-floating recollection as evidence. In the fixture, the source refs point to public source notes such as sources/source_notes/viea.md, sources/source_notes/scf.md, sources/source_notes/vcm_public.md, and sources/source_notes/talos.md. That source-bound packet is what keeps the worked trace from becoming an attractive but ungrounded story.

Routing then chooses route://bounded-reference-route. The route says this is a fixture-only reference-architecture maintenance path. It does not dispatch a deployed agent, call an external runtime, or run a model-quality benchmark. A stronger route would need readiness, authority, cost, verification, and rollback records that are not present here. The route therefore preserves the execution boundary instead of widening it.

Verification receives claim://argument-only-reference-claim. This is the claim-ledger boundary. The record can say that the fixture shape was validated and that the architecture argument is better illustrated. It cannot say the integrated runtime exists. It cannot say the authority stop works in production. It cannot say Project Theseus, MoECOT, or VCM executed the run. The claim remains argument because the evidence delta is record-shape evidence only.

Execution then produces work://fixture-only-work-order and audit://fixture-validation-log. Those names are intentionally modest. The “work” is repository maintenance and fixture validation, not autonomous execution. The audit log records what validator is expected to prove: python3 scripts/validate_reference_trace.py checks parentage, layer coverage, authority deltas, residual deltas, validation commands, source-note refs, stop conditions, promotion blockers, and non-claims across the fixture set.

The evidence ledger records evidence://record-shape-only-update. Its deltas are explicit: record-shape evidence was added and support state remains argument. The residual deltas are also explicit: a runtime trace harness remains absent, and a live artifact-continuity audit remains future work. This is the point where many systems would overclaim. The ASI Stack trace is supposed to make that overclaim mechanically visible.

Finally, the SCF gate receives scf://no-promotion-review. This is the improvement boundary. The fixture does not let a cleaner specification, passing schema, or valid record shape become capability promotion. It records the promotion blockers: fixture-only trace and no integrated runtime replay. That still gives the stack a better specification surface, but it does not promote the architecture claim, mark a capability as default, or erase the residual work.

The blocked fixture shows the same architecture under stress. intent://restricted-execution-request lowers into command://restricted-command-contract and plan://blocked-reference-trace, but governance denies runtime execution authority. The route becomes route://denied-runtime-route, execution emits work://blocked-work-order rather than a runtime action, the audit records audit://authority-denial-log, the evidence ledger preserves evidence://blocked-path-record, and the SCF gate carries scf://promotion-blocker. The stop conditions are concrete: missing execution authority, unaccepted residual, and required governance review. That is the reference architecture’s most important habit: a blocked path still produces an inspectable trace.

Hop	Fixture artifact	What it proves at fixture level	What it does not prove
Intent and governance	intent://human-book-maintenance-request -> command://chapter-update-contract	Authority narrows to manuscript and fixture maintenance.	Human-intent parsing quality, deployed authorization, or runtime approval behavior.
Planning	plan://reference-trace-dry-run	The plan remains a citable parent artifact with validation and residual obligations.	A deployed planner, scheduler, or plan-quality benchmark.
Context	context://source-bound-packet	Source-note refs and context boundaries remain visible.	VCM runtime behavior, retrieval quality, or private connector-source claims.
Routing	route://bounded-reference-route	The path stays inside a fixture-only maintenance route.	Specialist routing quality, MoECOT dispatch, or model execution.
Verification	claim://argument-only-reference-claim	The claim boundary stays at argument.	Claim truth, verifier quality, or support-state promotion.
Execution and audit	work://fixture-only-work-order; audit://fixture-validation-log	Repository fixture validation has an audit target.	Autonomous execution, deployed tool behavior, or artifact-continuity service behavior.
Evidence and residuals	evidence://record-shape-only-update	Evidence and residual deltas are preserved.	Runtime replay, benchmark result, model-quality result, or safety result.
Improvement gate	scf://no-promotion-review	Promotion blockers survive the trace.	Capability replacement, default promotion, rollback execution, or deployed self-improvement.

This table is the architecture’s showpiece because it gives the system a falsifiable shape. A future implementation should be able to replace each fixture-only artifact with a live artifact of the same kind while preserving the same authority, evidence, residual, and non-claim discipline. Until that happens, the showpiece is a specification trace, not a runtime demonstration.

83.7.11 QCSA as the semantic control plane

83.7.12 The learning-process plane

The integrated stack now includes a governed learning-process plane between training policy and execution infrastructure. Its input is a resolution-bound LCT program: adaptive identities and versions; evidence, judgement, credit, artifact, resource, control, and authority channels; lifecycle and integration operators; observables; costs; permitted rewrites; and rollback. Its output is not a model. It is an execution request plus a semantic-preservation contract.

The execution planner maps that request onto tasks, communication, memory, and devices, then returns a realization-leakage receipt covering staleness, compression, numerical order, dropped work, partial failure, schedule drift, observed resources, and protected-observable checks. A compiler may optimize inside the contract. Adding an identity, changing an evaluator or credit route, replacing merge with composition, or rewriting authority is topology synthesis and returns to proposal, qualification, canary, and rollback gates.

In the reference trace, this plane joins Stable Capability Fields, Cognitive Kernel ABI, Routing Heads, Governed Model Training, Data Engines, Policy Optimization, Artifact Graphs, Resource Economics, Readiness, and Operations. The join prevents two silent substitutions: hardware parallelism for learning plurality, and a successful schedule for preserved learning semantics. The current LCT package supplies a bounded IR prototype and tests, not an integrated runtime result.

Question-Compiled Semantic Addressing fills one previously implicit cross-stack interface: how the same object survives grounding, context assembly, planning, routing, tool use, generation, evidence review, and system reorganization without confusing its meaning with its current storage or executor. The control plane binds stable SOIDs to plural contextual address leases, actively acquires missing evidence, and compiles the resulting certificate into a temporary physical route.

flowchart LR
  QG["Surface and grounding evidence"] --> QR["Resolver: occurrence / type / instance / expression"]
  QR --> QS["Stable SOID registry"]
  QS --> QH["Typed temporal evidence hypergraph"]
  QH --> QA["Multi-facet address atlas"]
  QA --> QQ{"Adequate for this consumer?"}
  QQ -- "no" --> QN["Question compiler: retrieve / test / ask / abstain"]
  QN --> QR
  QQ -- "yes" --> QC["Semantic Address Certificate"]
  QC --> QT["Policy-constrained physical route compiler"]
  QT --> QE["Memory / expert / tool / verifier / decoder"]
  QE --> QL["Receipt, residual, migration, and claim ledgers"]

Reading the QCSA control plane: stable identity anchors the object while addresses and physical routes remain replaceable. Inadequate resolution loops through explicit evidence acquisition or abstention. Adequate resolution earns a scoped certificate, not truth or authority; policy compilation still decides what can execute and which receipts must return.

The interface contributes three end-to-end invariants. Identity survives atlas and hardware change. Address confidence never substitutes for claim support or capability authority. An atlas migration either preserves the SOID for every supported old address or fails explicitly and rolls back.

The bounded reference trace now implements this control plane across thirteen stages, from intent and semantic IR through one independently authorized and observed temporary-file effect, receipt graph, same-SOID migration, and byte-exact rollback. Ten adversarial paths fail closed and eight limitations remain open. Together with the 12-lane artifact package and frozen evaluation, this replaces the earlier “concept only” status with a runnable reference slice.

It is still one synthetic, hand-authored, internally observed path with no model calls, external humans, production authority, distributed services, or irreversible effects. P2 failed its matched-resource advantage gate. The trace therefore supports integration mechanics and falsifiability, not a deployed stack, general performance, safety, AGI, or ASI; the chapter core claim remains at argument.

83.7.13 The reflexive dispatch trace across the stack

The Reflexive Router contributes an ordering contract that joins existing owners without merging them. One dispatch trace begins with an authenticated event and optional command constraint; records deterministic and learned route proposals; admits only qualified routes; selects one atomic capability or a bounded semantic-operation DAG; executes cognition or an independently authorized effect; returns a typed result; updates context and Chronicle views; and, only after repeated verified evidence, may propose compilation into a reflex.

flowchart LR
  E["Canonical event"] --> C["Command / intent contract"]
  C --> P["Rule + learned route proposals"]
  P --> Q["Qualification + authority receipt"]
  Q --> D["Atomic route or bounded DAG"]
  D --> S["Stable capability implementation"]
  S --> K{"Effect required?"}
  K -- "no" --> R["Typed result packet"]
  K -- "yes" --> X["Effect Commit Kernel"]
  X --> R
  R --> T["Context + Chronicle updates"]
  T --> L["Claim / artifact / residual ledgers"]
  L --> M{"Repeated verified trace?"}
  M -- "yes" --> G["Guarded reflex candidate"]
  M -- "no" --> H["Retain deliberative path"]
  G --> V["Replay / differential / shadow qualification"]
  V --> P

Each arrow is a typed handoff, not a shared ambient state transition. The command contract owns accepted route intent; Routing owns proposals and route provenance; SCF owns semantic capability and substitution; Planning owns DAG obligations; Runtime owns effect admission and observation; the Context ABI owns materialized packets; Context Transactions own durable context change; Claim Ledgers own claims and Chronicle materializations; Procedural Memory owns compilation; Benchmark Ratchets and Resource Economics own evidence and joint cost. No layer may infer another layer’s authority from the presence of its record.

The joined trace must preserve nine non-collapsible identities: event, principal/authority, command and ingress mode, route proposal and policy, qualification receipt, plan/node, capability implementation, effect attempt, and typed result/ledger descendants. It must also preserve rejected routes, fallbacks, abstentions, partial effects, verifier disagreement, invalidations, and residuals. A fast response without that join is an output, not evidence of the architecture.

The paper supplies the proposed cross-layer spine and attack surface. The new reflexive_dispatch_trace_record fixture makes its record shape executable and rejects selected ordering, authority, qualification, effect, temporal, and premature-compilation violations. That validates a finite authored contract only; it is not an implemented router, real effect kernel, safe compiler, usefulness result, or whole-stack demonstration. Chapter-core support remains argument.

83.7.14 The Kernel compiler path across the stack

KERC contributes a representation path that surrounds rather than replaces the cognitive core. The immutable source enters Artifact custody; protected-object extraction obtains identity, privacy, and exact-byte handles; Cognitive Compilation emits an uncertainty-bearing Kernel packet; the Context ABI materializes the packet and selective source views; Context Transactions own global residual state and migrations; Routing selects a compatible reasoner; the reasoner emits a typed answer packet; a surface renderer realizes it; and an independent-enough verification lane recompiles the output and compares the declared semantic contract. Claim, evidence, effect, and support authority stay outside that representation cycle.

flowchart LR
  S["Immutable source + rights"] --> P["Protected objects + correction lattice"]
  P --> C["Sense-aware compiler"]
  C --> K["Kernel packet + residual refs"]
  K --> M["Context materialization"]
  M --> R["Compatible cognitive core"]
  R --> A["Typed answer packet"]
  A --> Y["Surface renderer + copy path"]
  Y --> V["Recompile + semantic checks"]
  V --> G{"Contract preserved?"}
  G -- "yes" --> O["Typed result + provenance"]
  G -- "local mismatch" --> Y
  G -- "semantic or state fault" --> F["Source expansion / higher fidelity / fallback"]
  F --> M

No single record owns the complete truth. The Kernel packet states what the compiler represented; the residual ledger states which distinctions bypassed the core; the answer packet states intended content; the rendering receipt states which surface form was produced; the recompile receipt states whether selected distinctions survived; factual and task evaluators state whether the answer was correct or useful; and Resource Economics states whether the route beat its baseline after every component was charged.

Replacement is component-specific but dependency-closed. Compiler, grammar, concept registry, runtime codebook, tokenizer, core, residual codec, object store, renderer, verifier, and migration logic have separate identities and compatibility ranges. Changing one invalidates exactly the packets, memories, macros, routes, renderings, and evidence that relied on it. Short codes and model weights cannot become the permanent semantic identity, and rollback must restore both visible state and decoder compatibility for historical packets.

This architecture supports narrower deployments: protected entity handles without a Kernel core, shared terminology without lossless reconstruction, or typed answer packets without a learned residual codec. Those partial systems must be named rather than marketed as KERC. The source provides the integrated contract and falsifiers, not a working vertical slice or efficiency result.

83.7.15 Recomposition is a transaction

Modular decomposition does not guarantee coherent recomposition. VIEA calls the resulting failure contextual shattering: the planner, code specialist, hardware specialist, verifier, and deployment specialist may each satisfy a local contract while their combined artifact violates a global interface, resource, authority, or recovery obligation. The integrated trace therefore needs an IntegrationContract binding the global objective, shared constraints, required interfaces, runtime target, resource envelope, critical invariants, integration tests, failure boundary, and rollback plan.

For consequential work, the specialist bundle is admitted as one transaction. No subset crosses into effect merely because it passed locally. If the joined state fails, the system preserves the failed bundle and exact incompatibility, restores the last known valid checkpoint where restoration is possible, records irreversible effects and compensating duties where it is not, creates an integration residual, and requires a new whole-system candidate. This adds the recomposition complement to routing and planning: locally valid outputs do not become executable until the integrated state passes.

83.8 Interfaces

Twelve owner groups participate without surrendering authority: intent, human control-envelope capacity, constitution, morality, and system authority; command contracts, planning, compilation, and labor; context, transactions, adequacy, memory, and retrieval; routing, specialists, deliberation, search, compression, and model mechanisms; claims, evidence, Spinoza, specifications, Lean, and proof contracts; runtime, security, SCIF, supply chain, weights, and hives; artifact graphs, replay, and data custody; benchmarks, adversarial evaluation, assurance, thresholds, and oversight; policy, replacement, and improvement; capability fields, readiness, residuals, incidents, releases, and publication; resources, stewardship, governance, and contribution; and the Living Book. The trace owns their join, not any neighbor’s decision.

The Reference Trace Record carries the interface: a finite public record of trace state, execution boundary, intent, parent artifacts, authority chain and deltas, layer handoffs, artifacts, evidence updates and deltas, residual deltas, stop conditions, missing contracts, validation commands, promotion blockers, source refs, support-state effect, and non-claims. It gives a future runtime trace harness a stable target without pretending that the harness already exists.

A useful trace record is not merely chronological. It records parentage, authority deltas, evidence deltas, and residual deltas. Parentage says which artifact produced the next artifact. Authority deltas say whether authority narrowed, expired, escalated, or was denied. Evidence deltas say which claim state changed, if any. Residual deltas say what risk or missing work survived the handoff. Without those deltas, the trace becomes a log of events rather than an architecture record.

Where a human role is assigned, the joined trace also carries the exact control-envelope packet rather than a bare approval bit. Missing evidence, incompatible representation, overload, a non-positive intervention window, unreachable channels, unmanaged conflict, or responsibility beyond effective control must remain visible as a route-changing residual. Passing the finite packet removes recorded defeaters only; it does not prove comprehension, meaningful control, responsibility, or safe action.

After an admitted effect path enters service, the joined trace carries the Governed Operations control packet rather than a generic incident label. The packet binds deployment and command identity, the five-dimensional degraded authority envelope, eleven declared internal-state classes, descendants, external-effect dispositions, fresh independent acceptance, fallback, and emergency-lease expiry. The current authored case correctly remains in safe hold when one effect is unknown; it is not the natural Theseus T4 trace and does not establish incident efficacy or effect-complete recovery.

83.9 Invariants

The reference-architecture invariants keep an end-to-end trace from becoming a shortcut around the stack: every layer may add evidence, but none may erase authority, provenance, or residual obligations.

• No layer bypasses governance.
• Artifacts remain traceable.
• Self-improvement follows evidence and authority gates.
• Every named integration stage joins to the material output it claims to own.
• Canonical state remains authoritative over projections, and the request-to-effect receipt binds request, policy, state, effect, and terminal acknowledgement.
• Evaluator identity and method remain visible before a result can reach the claim boundary.

Continuity under authority is the strongest integration invariant. A downstream artifact cannot inherit authority merely because it descends from an approved intent; each handoff must preserve or narrow the authority chain.

Completeness is also an invariant. A blank field in the trace must mean “not applicable” or “not yet available,” not “the system forgot to ask.” Missing contracts, missing evidence, missing approvals, and missing rollback paths should be visible as records that block, narrow, or defer work.

The full invariant set forbids a trace super-owner, scopes every join exactly, prevents downstream authority widening, binds named interfaces to material effects, preserves canonical-over-projection authority, rejects orphan effects and phantom completion, exposes evaluator dependence, requires accepted evidence transitions, conserves residuals, preserves causal and lifecycle order, keeps all terminal paths in denominators, gates improvement and release, requires effect-complete rollback, reports usefulness and governance cost together, bounds transfer, expires changed joins, and limits diagrams, schemas, fixtures, slices, proofs, builds, and validator counts to their exact evidence boundary.

83.10 Failure modes

• Untraceable handoffs.
• Planning/execution collapse.
• Self-improvement without evaluator integrity.
• Interface theater: named layers or green projections without a joined material effect.
• Receipt drift: a receipt binds the wrong request, policy decision, canonical state, effect, or terminal outcome.
• Projection authority and evaluator-independence laundering.

Untraceable handoffs should create missing-contract records. Planning/execution collapse should preserve the failed plan, runtime artifact, and residual. Self-improvement without evaluator integrity should stop at the SCF gate.

Integration theater is the reference-architecture failure: every layer name appears in the diagram, but the actual run still depends on informal summaries, ambient authority, unversioned context, dashboard prose, or unverifiable benchmark claims. A reference architecture should make that theater obvious because the trace record will have missing parentage, unsupported evidence deltas, or stop conditions that were acknowledged but ignored.

Trace fragmentation is the companion failure, where each layer records locally valid receipts that cannot be joined into one accountable run.

The complete failure inventory also includes super-owner collapse, handoff laundering, canonical/projection inversion, request-to-effect drift, orphan effects, phantom completion, revocation races, exception and evaluator laundering, evidence laundering, residual erasure, replay and rollback theater, monolithic-loop opacity, happy-path-only testing, integration overhead and false blocking, embedded-model closure, and unsupported transfer. A trace can be locally coherent while joining the wrong effect, hiding a revoked authority, or restoring only the visible repository; each failure therefore has its own observable and terminal route.

83.11 Minimum Viable Implementation

The exact current minimum is one trace schema and valid protocol fixture; three valid and six expected-invalid reference fixtures; one local validator replay bound to thirteen tracked artifact digests; one blocked five-project name-to- effect lineage with eight mutations; one disposable repository-change slice over nine scenarios and eight attacks where the direct baseline produced eight false accepts while the governed path produced zero false accepts, zero unsafe releases, and three rollback attempts; one finite invariant extraction over three authority handoffs, three timed effects, nine evidence events, two residuals created, one discharged, one open, and four rejected mutations; and a 45-theorem Lean transition model with independently encoded cross-layer and concurrent-effect consumers. The cross-layer consumer checks 13 lifecycle prefixes and composition splits, terminal absorption, exact effect and residual accounting, and 108/108 rejecting mutations; the concurrent consumer checks 21 prefixes and composition splits, authority-epoch and logical-time monotonicity, exclusive effect closure, one authored projection witness, and 62/62 rejecting mutations. No language-model planning or generation, deployed multi-service runtime, production authorization or rollback service, independent evaluator, natural workload, external reproduction, transfer, whole-stack deployment, or core effect exists.

A minimum integrated architecture first exists as the reference flow diagram plus the reference_trace_record schema and deterministic fixture set. The reference-trace fixtures check record shape, trace state, execution boundary, parentage, deltas, blockers, source refs, and support-state effect only: they do not execute the architecture, replay a runtime trace, or prove that every layer handoff is implemented.

The historical-project packet adds the smaller name_to_effect_trace_record contract and python3 scripts/validate_name_to_effect_trace.py. One blocked five-project lineage trace carries the seven ordered stages and one request-to-effect receipt; eight mutations attack stage closure, canonical-state authority, digest binding, terminal acknowledgement, evaluator independence, effect lineage, and support promotion. This is fixture-level joinability only, not a deployed runtime or reproduction of the projects.

That tiny dry-run trace set now exists at fixture level: one approved flow carries stable artifact IDs from intent through plan, context, route, work order, audit log, evidence update, and SCF no-promotion review; one blocked flow fails because execution authority is missing and governance review remains required. A first actual command replay exists as a local Resource flagship validator trace with an artifact bundle, output digest, and attached blocked-path stop conditions. The governed repository-change slice now adds an executed local Git workflow with code mutation, tests, independent byte-and-behavior observation, matched baseline accounting, release/refusal decisions, exact and failed rollback, and quarantine. A live or external runtime trace remains stronger and still needs comparable records from real deployed layer handoffs.

83.12 Mature Research Target

83.12.1 Argument-exit campaign

Exiting argument support requires natural heterogeneous tasks through independently operated layer services and matched direct, monolithic-agent, workflow-orchestrator, service-composition, and no-governance baselines with equal models, tools, context, compute, tuning, and retries. The campaign must test semantic preservation, authority and revocation timing, canonical and projection integrity, effect and receipt completeness, evaluator independence, evidence and residual integrity, lifecycle and bounded liveness, incident containment, effect-complete rollback, correction propagation, learning and release gates, embedded residuals, usefulness, failures, latency, resources, governance burden, and total cost. Independent implementers, operators, evaluators, institutions, infrastructures, legal regimes, and transfer sites must reproduce every terminal outcome.

The integration endpoint is a trace kernel for the whole ASI Stack. The stack would not be a diagram of cooperating layers; it would be an inspectable machine that can explain what authority entered, which artifacts were produced, what evidence changed, which residuals survived, and why a path was promoted, blocked, narrowed, rolled back, or escalated. Qualified branch packets keep model-relative predictions versioned and non-authorizing; reality-residual records join them to later independent observations and force an explicit re-estimation, replan, fallback, review, or safe-hold route when discrepancy is material.

A mature reference trace kernel would make every significant run emit a Reference Trace Record. The record would connect human intent, constitutional authority, command contracts, plan DAGs, qualified branch packets, reality-residual records, VCM packets, route decisions, claim envelopes, work orders, execution logs, proof/spec receipts, behavioral benchmark ratchets, Internal Evidence Packets, policy-update leases, steward decisions, SCF transitions, release notes, and residual ledgers. The reference architecture would be judged by whether those records survive happy paths and blocked paths, not by how coherent the diagram looks.

An integrated reference surface needs:

• End-to-end traces with stable parent artifacts from intent through planning, memory, routing, verification, execution, evidence update, release, and improvement gates.
• Authority deltas at every handoff: granted, narrowed, expired, denied, escalated, quarantined, or returned for human review.
• Evidence deltas that say exactly which claim, support state, benchmark floor, proof target, policy update, or readiness gate changed, if any.
• Residual deltas that preserve missing context, failed verification, contamination, regression, safety debt, unfunded work, governance concern, or unresolved source gap.
• Stop-condition records for missing contracts, inadequate context, failed proof/spec, failed test, failed benchmark, unaccepted residual, evaluator-integrity concern, or rollback absence.
• Cross-layer consumers that can reject a trace when a required artifact, source ref, validation command, non-claim, or approval is missing.
• Failure closure that exposes integration theater: informal summaries, ambient authority, unversioned context, unsupported evidence deltas, and ignored stop conditions become visible defects.

The record-reality problem sits inside that trace kernel. A trace is not enough if each layer merely produces shape-valid records about a world nobody checked. The receipt-faithfulness fixture now gives the reference architecture a bounded negative control: a support-seeking receipt must survive independent cross-check, trap-receipt, attestation-limit, and no-promotion checks before it can be treated as reviewable evidence. A future integrated runtime still needs live attestation and audit behavior; the receipt-faithfulness fixture only prevents record-shape laundering inside the static architecture.

The epistemic trusted computing base fixture adds the related trust-chain negative control. A reference trace must not merely say “the verifier passed.” It must identify the trusted core, root-of-trust refs, delegation rule, recursion stop, verifier independence state, outside-TCB residuals, and non-claims that make the verifier route consumable. The epistemic-TCB fixture rejects verifier-trust laundering and ambient trust propagation in finite records; it does not prove a deployed trust base or verifier correctness.

83.12.2 Governed repository-change slice

The local governed repository-change slice turns the abstract trace into one actual disposable Git effect path. Nine matched scenarios receive the same budget-clamp request. The simple baseline releases all nine after public smoke tests and produces eight false accepts. The governed route binds one allowed path, quarantines retrieved-context instructions, rechecks authority before effect, rejects correlated review, verifies claimed file hashes against observed bytes in a separate process, runs stronger behavior probes, discovers undeclared files, and distinguishes exact rollback from incomplete rollback. It records three safe local releases, five refusals, one quarantine, three rollback attempts, two exact rollbacks, one failed rollback, zero false accepts, and zero unsafe releases.

That result makes overhead visible too: the governed route uses 66 versus 27 deterministic cost units, 89 versus 27 trace steps, and nine versus zero review steps. These are fixture accounting units, not production latency or economic measurements. The slice is validated by scripts/validate_governed_repository_change_slice.py and documented in docs/governed_repository_change_slice.md. It executes a bounded local repository workflow, but it creates no chapter-core support-state transition and does not prove a deployed authorization, sandbox, verifier, rollback, security, safety, software-quality, or ASI system.

83.12.3 Four trace invariants over one executed log

The repository-change event log now feeds one shared finite trace model rather than four unrelated record examples. Authority monotonicity checks that each child scope stays within its parent and each request stays within the child. Revocation-before-effect attaches logical times to revocation and effect and gives revocation precedence when the two tie. Evidence-transition integrity requires unchanged support when no transition exists and accepted review, matching artifact bytes, plus independent effect observation when a transition does exist. Residual conservation requires created residuals to equal discharged residuals plus the final open inventory.

The executed local trace has three authority handoffs, three timed effect attempts, nine evidence events, two residuals created, one discharged, and one final open residual preserved by quarantine. Four mutations try to widen authority, allow an effect at revocation time, change support without a transition, and erase the open residual; all are rejected by scripts/validate_governed_trace_invariants.py. Lean target lean:reference_architecture.governed_trace.four_invariants now resolves to the stronger AsiStackProofs.IntegratedReferenceTrace transition model. The older four-table extraction remains a source-anchored historical result, while the live proof target owns joined transitions rather than theorem-per-fixture normalizations. These are bounded trace semantics connected to an executed local log, not a distributed-runtime, service-enforcement, completeness, safety, or chapter-core promotion claim.

83.12.4 Integrated transition consumer

The stronger P2 model replaces the headline record implications with one partial cross-layer transition system. It follows request, intent, context, plan, route, authorization, job, adapter, material effect, independent observation, independent evaluation, evidence, terminal receipt, and quarantine states. Every admitted transition must join the exact parent artifact and canonical state, narrow or preserve active authority, preserve the authority ceiling, carry residual ownership and a non-claim boundary, obey governance gates and logical time, and keep effect, acknowledgement, evidence, rollback, and terminal receipt as distinct lanes.

AsiStackProofs.IntegratedReferenceTrace proves that every accepted step joins artifact/state parentage, advances logical time monotonically, preserves the authority ceiling, cannot widen active authority, preserves acknowledged-effect bounds, and conserves residual custody. Those properties lift to arbitrary accepted finite runs; execution composes across concatenated subtraces; and terminal and quarantine layers reject every suffix event. The model also checks a complete twelve-event terminal trace and rejects parent/state forks, authority widening, gate deletion, effect at a revocation tie, unacknowledged terminal effects, and residual erasure.

The independently encoded consumer is anchored to the existing executed repository-change result before it replays eighteen cases. Four paths are accepted: approved completion, pre-effect quarantine, exact rollback, and failed-rollback quarantine. Fourteen invalid paths and 108 systematic mutations are rejected. The consumer checks all thirteen lifecycle prefixes and prefix/suffix splits, effect-accounting at every transition, exact residual conservation, and terminal/quarantine absorption. Across accepted paths it records thirty-five events, three attempted effects, two final net effects, one final acknowledged effect, three open residuals, four terminal/quarantine receipts, one exact rollback, two quarantines, and zero support transitions.

The next refinement consumes the complete tracked governed repository-change result through its public JSON Schema rather than authoring another abstract corpus. The adapter projects the exact concrete fields used by the abstraction, custody-wraps and losslessly decodes all nine source scenarios, and derives three approved completions, three pre-effect refusals, two exact rollbacks, and one failed-rollback quarantine. Twenty concrete-field mutations are rejected. This is checked executable refinement for one projected live result schema, not a Lean-verified compiler, a universal service encoder, distributed replay, unprojected semantic preservation, deployment, safety, or support promotion.

The formal model now also separates per-effect lifecycle state from the cross-layer spine. Each effect has an identity and shared authority epoch; attempt, observation, acknowledgement, compensation, residualization, and revocation are distinct transitions. Equal logical times admit multi-effect interleavings while revocation wins a tie against a later-linearized attempt. Lean checks a two-effect interleaving in which one effect is acknowledged and the other remains explicitly residualized, and rejects a same-time post- revocation attempt. This is linearizable logical-time concurrency, not a proof about distributed clocks, partitions, retries, scheduler fairness, or real effect discovery.

An independently implemented consumer now exercises sixteen traces: four accepted and twelve rejected. It treats effect identity as an idempotency key, accepts an exact same-epoch retry without duplicating the effect, rejects stale or revoked retries, requires observation before terminal custody, and separates acknowledgement, compensation, and residualization. It checks every accepted prefix, all 21 prefix/suffix composition splits, logical-time and authority-epoch monotonicity, and terminal disposition, while rejecting 62 systematic semantic mutations. A one-effect witness also proves that the layer model’s attempted, acknowledged, and residual counts agree with the effect-ledger projection. This closes the finite logical-time consumer placeholder, not distributed transport retry, partition recovery, scheduler fairness, deployed adapter enforcement, or complete effect discovery.

83.12.5 P5 local multi-process reference slice

The P5 reference now crosses one implementation boundary that the logical-time consumer could not cross. A frozen eight-case harness runs real subprocesses against a durable SQLite/WAL ledger and a contained filesystem effect boundary. Two executor processes race on one idempotency key and materialize one effect; a separate observer reads effect digests; revoked and out-of-scope credentials create no effect; recovery discovers and removes an orphan left by a worker that crashed before recording its commit; and an append-only effect is compensated without pretending its history disappeared.

The same slice freezes checkpoint authority before mutation and restores nine declared state classes—model, optimizer, scheduler, RNG, cache, backup, derived artifacts, descendants, and credentials—byte-exactly. A separate custodian removes one cohort from five declared local storage surfaces while leaving behavioral change, causal influence reduction, privacy leakage reduction, and external storage erasure explicitly unestablished. Fresh validation reruns the whole system in a new temporary directory and requires the result to match the tracked receipt exactly.

This is bounded implementation evidence for the exact local reference slice, not whole-stack or deployment evidence. SQLite on one host does not establish partition or Byzantine behavior; deterministic state bytes are not live model or learning state; filesystem observation is not complete effect discovery; and local deletion is not causal unlearning, privacy repair, or erasure outside the sandbox. The owning result and scope are recorded in docs/p5_effect_complete_reference_report.md.

83.12.6 P5 stateful-service successor

The successor slice replaces deterministic model-state payloads with an actual two-parameter predictor and bias-corrected Adam update. The checkpoint selected before mutation binds nine state classes. Copying back only the weights leaves eight classes inconsistent and is rejected. When the trainer process exits after mutation but before acknowledgement, a separate restart process restores all nine classes byte-exactly and reproduces the prior prediction.

The effect boundary is also no longer a coordinator-owned file. A separate HTTP process owns a separate SQLite ledger. During a localhost partition, one effect remains pending in a durable owned outbox; after recovery, the first retry commits one effect and the second is deduplicated. A stale credential cannot add another effect, and a separately executed observer reads the accepted payload through the sink’s read interface. Source, weight, and environment identities are digest-bound, with model and lock tampering used as rejecting controls.

This is still a local, authored mechanism slice. The tiny training task is a positive control, not natural usefulness. A localhost outage is not distributed partition tolerance; a separate repository-authored process is not external reproduction; and source digests are not deployment or complete supply-chain attestation. The exact result and remaining boundary are recorded in docs/p5_stateful_service_reference_report.md.

When the trace kernel works, a future implementation could be evaluated by trace quality before anyone argues about intelligence. If the run cannot show parentage, authority, evidence, residuals, and stops, it has not instantiated this architecture. The integration trace kernel remains a target architecture until real trace harnesses, blocked-path tests, artifact-continuity audits, authority stop-condition checks, and accepted evidence transitions show that the layers compose under pressure.

83.13 Codex test plan

Test	Purpose	Status
Reference trace record fixture validation	Validate that an end-to-end trace record names trace state, execution boundary, intent, parent artifacts, authority chain/deltas, layer handoffs, artifacts, evidence updates/deltas, residual deltas, stop conditions, missing contracts, validation commands, promotion blockers, source refs, support-state effect, and non-claims.	implemented; passing via python3 scripts/validate_protocol_examples.py
End-to-end intent trace test	Check deterministic reference-trace fixtures for required layer terms from intent through SCF, stable artifact refs, source-note refs, validation commands, evidence deltas, and residual deltas.	implemented by python3 scripts/validate_reference_trace.py; no integrated runtime trace exists, and the actual command replay is covered separately
Artifact continuity audit	Check deterministic reference-trace fixtures for parent artifact refs, authority-chain/delta visibility, artifact count, and residual preservation.	implemented by python3 scripts/validate_reference_trace.py; no live artifact-continuity audit exists
Authority stop-condition test	Check deterministic blocked reference-trace fixtures for stop conditions and promotion blockers when execution authority is missing.	implemented by python3 scripts/validate_reference_trace.py; no deployed authority stop-condition checker exists
Actual command replay trace	Record one actual repository validator command as a Reference Trace Record with output digest, artifact bundle, and blocked-path stop conditions.	implemented by python3 scripts/run_reference_trace_replay.py --write-result and python3 scripts/validate_reference_trace_replay.py; local replay only, no deployed runtime trace
Governed repository-change slice	Execute intent, authority, plan, context, route, local code effect, independent observation, receipt reconciliation, evidence gate, release/refusal, rollback, and quarantine against a simpler matched baseline and eight adversarial cases.	implemented by python3 scripts/run_governed_repository_change_slice.py --write-result and python3 scripts/validate_governed_repository_change_slice.py; bounded disposable Git repositories only, no deployed runtime or chapter-core promotion
Governed cross-stack trace invariants test	Derive authority monotonicity, revocation-before-effect with tie precedence, evidence-transition integrity, residual conservation, causal order, and four mutation controls from the executed repository-change log.	implemented by python3 scripts/run_governed_trace_invariants.py --write-result, python3 scripts/validate_governed_trace_invariants.py, and the successor AsiStackProofs.IntegratedReferenceTrace; finite local trace only
Integrated cross-layer trace consumer	Join artifact/state parentage, authority, effect/acknowledgement, evaluation, evidence, residual, rollback, receipt, and quarantine state across approved and contained paths.	implemented by python3 scripts/validate_integrated_reference_trace_consumer.py and AsiStackProofs.IntegratedReferenceTrace; 18 finite cases, 13 lifecycle prefixes and composition splits, and 108/108 rejecting mutations, with concrete-schema refinement covered separately and no deployment or support promotion
Governed-result schema refinement	Validate the executed governed-result object against its JSON Schema, losslessly encode/decode the exact claimed projection, derive all nine scenario dispositions, and reject concrete-field mutations.	implemented by python3 scripts/validate_integrated_runtime_schema_refinement.py; 9/9 projections round-trip and 20/20 mutations reject, but this is not a Lean-verified compiler, universal stack-schema refinement, or deployment evidence
Concurrent effect-ledger consumer	Check effect identity/idempotency, authority epochs, revocation ties, observation causality, exclusive acknowledgement/compensation/residualization, receipts, and partial-failure custody.	implemented by python3 scripts/validate_concurrent_effect_ledger.py; 16 cases, 4 accepted, 12 rejected, 21 lifecycle prefixes and composition splits, one authored projection witness, and 62/62 additional mutations, with no distributed-clock, partition, deployed-adapter, or support claim
Historical-project name-to-effect trace	Join request-derived input, policy, canonical state, observed effect, acknowledged receipt, evaluator, and claim boundary while rejecting eight interface-theater mutations.	implemented by python3 scripts/validate_name_to_effect_trace.py; one bounded five-project lineage fixture only, no deployed runtime or chapter-core promotion

The implemented rows validate deterministic fixture behavior, one local command replay, and one executed local repository-change workflow. They do not replay a deployed demo with independently operated services across layers. A future runtime integration test still needs deployed or external layer-handoff records, environment notes, runtime trace artifacts, and independent result review.

83.13.1 Formalization hooks

Tag	Module	Target	Status
lean:reference_architecture.trace.operational_invariant	AsiStackProofs.IntegratedReferenceTrace	Every accepted finite cross-layer run joins exact parent artifacts and canonical state at each typed handoff, preserves the authority ceiling and non-increasing active authority, advances logical time monotonically, preserves effect-accounting and residual-conservation invariants, composes across event batches, and rejects suffixes after a terminal or quarantine state.	implemented
lean:reference_architecture.trace.failure_blocks_promotion	AsiStackProofs.IntegratedReferenceTrace	A cross-layer transition with a parent/state fork, missing governance gate, residual erasure, effect after revocation, unacknowledged terminal effect, missing receipt, or incomplete rollback is rejected or contained in quarantine.	implemented
lean:reference_architecture.governed_trace.four_invariants	AsiStackProofs.IntegratedReferenceTrace	The source-anchored finite consumers compose approved, blocked, rolled-back, quarantined, and concurrent effect traces while preserving joined artifact/state lineage, authority and epoch monotonicity, effect acknowledgement or explicit terminal disposition, evidence, residual, terminal-receipt, and no-promotion boundaries; the authored one-effect projection agrees across the layer and effect models.	implemented

Formal audit. The live headline targets now resolve to the partial IntegratedReferenceTrace transition system rather than the two projection implications or the four-fixture conjunction. Its general theorems establish accepted-step joins, authority and logical-time monotonicity, effect accounting, residual conservation, arbitrary-run lifting, terminal absorption, and exact trace composition inside the declared finite model. The concurrent submodel adds authority-epoch and logical-time monotonicity, valid-trace lifting, exact composition, exclusive effect closure, and one explicit cross-model projection witness; its exact fixtures and independent consumer supply positive, containment, countermodel, and mutation coverage. The retained ReferenceArchitecture route reductions remain narrow repair-routing lemmas, and the older GovernedRepositoryTrace invariant extraction remains historical executable lineage. These results do not prove artifact truth, semantic equivalence of live payloads, authority completeness, distributed revocation, effect causality, evaluator independence, residual completeness, rollback closure beyond the fixture, deployed enforcement, reproduction, or transfer.

83.13.2 The semantic constitution and executable capability foundry

The Platonic World Model and Deterministic Capability Compilation join at the stack’s model-replacement boundary. The PWM supplies durable semantic identity, contexts, world branches, grounding, propositions, attestations, commitments, proofs, and governed meaning changes. The capability foundry supplies executable scaffolds, field decomposition, coverage-directed learning, NCO packaging, linking, translation validation, residual adaptation, and reification. Neither subsumes the other: semantic continuity without executable replacement remains descriptive, while learned replacement without semantic continuity can preserve labels and silently change meaning.

flowchart LR
  A["Form family + immutable semantic basis"] --> B["Capability charter + executable scaffold"]
  B --> C["Semantic capability graph + obligation ledger"]
  C --> D["Coverage-directed expert training"]
  D --> E["NCO linker + routed candidate"]
  E --> F["Translation validation: pass / fail / unknown"]
  F --> G["Leased runtime in an explicit world branch"]
  G --> H["Attestations, effects, residuals + defeaters"]
  H --> I["Disagreement tribunal"]
  I --> J["Reified contract, test, Form, field or rollback"]
  J --> A

The joined trace crosses six semantic planes—Forms, situations, dynamics, grounding, epistemics, and semantic governance—and four capability planes— specification, learning, runtime, and assurance. It preserves three independent gates: semantic well-formedness, epistemic support, and execution authority. The environment can challenge predictions; it cannot grant power. A learned candidate can propose a better behavior; it cannot silently rewrite the Form or field it claims to implement.

This is the strongest unified architecture suggested by the two sources, but it is still a design target. The honest vertical slice must implement one bounded semantic basis, one executable scaffold, two replacement fields, a sparse link, independent pass/fail/unknown validation, one branch-protected effect, one adversarial semantic edit, one reification proposal, and effect-complete recovery. Until that campaign exists and beats strong simpler baselines under total cost, all joined claims remain at argument.

83.14 Predictive-state handoff and the embedded-system boundary

The reference trace can carry a world-model lane without making it a new chapter. ext_v_jepa_2_2025 supplies the concrete handoff: an observation and encoder version produce a latent state; an action-conditioned predictor and candidate sequence produce forecast states and costs; Planning proposes a bounded action; Runtime Adapters and physical or digital controls retain the authority to act. The trace records model, predictor, observation, action space, horizon, search budget, uncertainty, prediction error, replanning trigger, fallback, and sim-to-real residual.

That trace remains finite and internal to the world. ext_embedded_agency_2019 is the foundations objection: the stack, its verifier, its models, and its subsystems are physical parts of the environment they describe; their models are smaller than that environment and may share blind spots or divergent objectives. A complete-looking ledger is therefore not an external omniscient view. The reference architecture records trust roots, recursion stops, descendant identity, ontology/version changes, and outside-model residuals, while explicitly declining to claim a solution to logical uncertainty, embedded world-models, robust delegation, or subsystem alignment.

ext_v_jepa_2_2025 | Metadata-first comparator: V-JEPA 2: Self-Supervised Video Models Enable Understanding, Prediction and Planning. Primary empirical comparator for action-free latent video pretraining, a small action-conditioned predictor, and model-predictive control. Camera sensitivity, autoregressive error accumulation, action-search cost, image-goal assumptions, and representation-bounded capability remain explicit limits; no local world model or robot-control result is established. | No passage-level source claim, local implementation, reproduction, safety, performance, deployment, support-state, or ASI result is established by this reconciliation row. |
ext_embedded_agency_2019 | Metadata-first comparator: Embedded Agency. Primary informal survey of the obstacles that arise when agents are physical parts of the worlds they model, must use smaller internal models, and reason about modifiable internal parts. It supplies a foundations boundary; the book’s finite records, authority ceilings, and proofs do not solve embedded agency. | No passage-level source claim, local implementation, reproduction, safety, performance, deployment, support-state, or ASI result is established by this reconciliation row. |

83.15 The Adaptive Commit Control Plane

The integrated architecture now places an Adaptive Commit Boundary between experience-derived lesson candidates and every locus-specific update path. Regret, incidents, evaluations, and human feedback can emit eligible lesson hypotheses. A cross-surface adjudicator compares persistence portfolios and commitment profiles. Only an admitted disposition reaches Memory, Cognitive Compilation, Policy Optimization, Data Engines, evaluators, environments, or institutional governance for realization.

Artifact Graphs binds the six records and their descendants. Readiness issues realization-specific qualification leases. Governed Operations monitors use and returns contradictions or incidents without acquiring permanent update authority. Resource Economics accounts for carrying cost and adaptation debt. This closes the prior gap between “the system learned something” and “the system was authorized to make this particular durable change.”

83.16 Source crosswalk

Source ID	Title	Layer	Planned use	Readiness
reflexive_router_whitepaper	The Reflexive Router	pre_deliberative_reflexive_routing_control_plane	End-to-end event, command, proposal, qualification, DAG, capability, effect-kernel, typed-result, Chronicle, ledger, and trace-to-reflex ordering with distinct authorities.	source note available
viea	Verified Intent-to-Execution Architecture	whole_stack_execution_spine	Keystone source. Human intent -> command contracts -> artifacts -> routing -> runtime targets -> verification -> deployment -> feedback.	source note available; local raw cache available
scf	Stable Capability Fields	governance_recursive_self_improvement	Use public release v1.0 when available. Stable boundaries, replacement, bounded authority, recoverable evolution.	source note available; local raw cache available
vcm_public	Virtual_Context_Memory_v1	memory_context	Public VCM release. Governed protocol for compiled working context.	source note available; local raw cache available
planforge	PlanForge	planning_control	Planning substrate. Goal-to-execution compilation, hierarchical decomposition, DAG planning, scheduling, intelligence arbitrage.	source note available; local raw cache available
talos	Talos Protocol	labor_execution_os	AI labor OS. Deterministic cognitive manufacturing, typed jobs, control planes, auditability, tool isolation.	source note available; local raw cache available
spinoza	Proof of Belief / The Spinoza Architecture	reasoning_epistemology	Neurosymbolic belief, transparent axiomatic AI belief systems, verification, belief revision.	source note available; local raw cache available
octopus_router	Octopus Router Architecture	routing_modular_intelligence	Lightweight head/router with dynamically loaded specialist arms and local boundaries.	source note available; local raw cache available
rmi	Ratcheting Modular Intelligence	capability_ratchet	Benchmark pressure, residual escrow, verified modular capability, regression preservation.	source note available; local raw cache available
benchmaxxing	Benchmaxxing: The Performance Ratchet	benchmarks_evidence	Benchmarks as pressure surfaces, saturation -> regression, harder frontier, anti-Goodhart safeguards.	source note available; local raw cache available
alignment_field	Field of God / Alignment Field family	alignment_constitution	Primary Alignment Field draft found. Use with Ethica Mechanica and Eternal Code.	source note available; local raw cache available
cgs	Compact Generative Systems	compression_representation	Smallest adequate structure that can generate/govern target without hiding residual complexity.	source note available; local raw cache available
cognitive_loop_closure	Cognitive Loop Closure	procedural_memory	Repeated cognition should become procedural memory / verified tools.	source note available; local raw cache available
moecot	MoECOT-Agent Architecture Whitepaper	implementation_reference	Concrete implementation evidence: governed low-parameter multi-core runtime, readiness gates, ledgers, replay.	source note available; connector or recovery required
vcm_editable	Virtual_Context_Memory_v1.0_Editable	memory_context	Editable version with evidence-carrying planner-guided context compiler framing.	source note available; connector or recovery required
project_theseus_whitepaper	Project Theseus Whitepaper	report_first_rmi_prototype	Local-first report-driven RMI implementation reference: SymLiquid, SparkStream, Octopus Router, residual escrow, self-evolution gates, Hive runtime, observability.	source note available
theseus_plan_compiler	Theseus Plan Compiler	planning_control	Goal-to-contract compiler with semantic IR DAGs, VCM context slices, executor routes, claim/evidence targets, contract hashes, and replay traces.	source note available
theseus_self_evolution_system	Theseus Self-Evolution System	recursive_self_improvement_governance	Evidence-first self-evolution lane with intervention ladder, ATTD repo-health gate, guarded teacher self-edit, architecture experiment governance, loop closure, and outcome ledger.	source note available
theseus_architecture_gate	Theseus Architecture Gate	readiness_gate_governance	Pre-training readiness gate covering ratchet completeness, router readiness, safety ledger, residual escrow, bridge benchmarks, procedural tools, routing memory, lifecycle governance, and external-inference zero.	source note available
theseus_operator_os	Hive Operator OS and Work Board	labor_os_operator_surface	Shared command vocabulary, durable SQLite work board, node registry, background/watch/wake contracts, skill registry, tool hooks, feedback routing, and safety-visible operator surface.	source note available
theseus_circle_transfer	Theseus Circle Calculus Transfer Lane	proof_contract_transfer	Report-only bridge from Circle finite fixtures into private Theseus benchmark design with explicit quality/runtime/memory/transfer/failure-case claim boundaries.	source note available
cca_project	Compiled Cognitive Architecture project	compiled_cognitive_architecture	Canonical closure, typed lowering, trace bundles, and explicit effect/claim boundaries.	source note available
moecot_manifest_project	MoECOT Manifest compiler-era project	compiler_first_ai_systems	Canonical registry state versus disposable projections, compilation-to-effect lineage, and external-holdout reality.	source note available
bugbrain_project	BugBrain bare-metal neuro-symbolic intelligence project	hardware_explicit_neurosymbolic_stack	Negative cases for silently ignored audit writes, success-shaped missing state, and narrative/report divergence.	source note available
corbens_trainer_project	Corben’s Trainer epistemic training and evaluation control plane	epistemic_training_control_plane	Request/effect lineage, stale promotion after quarantine, and acknowledged asynchronous completion.	source note available
corbens_best_model_possible_project	Corben’s Best Model Possible recurrent-model and mechanism laboratory	recurrent_model_mechanism_lab	Interface-versus-effect separation, ordinary-path defaulting, live effect versus playback, and claim causality.	source note available
ext_drexler_cais_2019	Reframing Superintelligence: Comprehensive AI Services as General Intelligence	ai_services_r_and_d_automation	External comparator for service-centered general intelligence, R&D automation, and structured component composition.	source note available
ext_adas_2024	Automated Design of Agentic Systems	automated_agent_architecture_search	External comparator for code-defined search across prompts, tools, workflows, and agent designs under empirical selection.	source note available

The crosswalk is the architecture spine. VIEA supplies intent-to-execution flow, SCF supplies bounded replacement, VCM supplies governed context, PlanForge and Talos supply planning/execution contracts, Spinoza supplies proof-carrying claims, Octopus/RMI/Benchmaxxing supply routing and ratchets, and Project Theseus supplies report-first implementation context. CAIS supplies the closest broad service-composition comparator but not an implementation of this trace contract. Connector-readable MoECOT and VCM-editable sources remain planning context until artifacts are imported or rerun.

83.16.1 Manifest source assignment reconciliation

These rows keep Integrated Reference Architecture’s manifest assignments visible at their recorded review boundary. Passage review does not establish local reproduction, performance, safety, deployment, or support-state movement.

Source	Intake role	Boundary
learning_compute_topology	Passage-reviewed comparator: Learning–Compute Topology: Formalizing the Causal Organization of Adaptive Systems. Makes the integrated reference trace represent learning as a typed, multi-view process graph rather than a single opaque training step. This chapter uses the paper’s LCT-IR relations and template, active, realized, and counterfactual views to locate where evidence, judgement, credit, state, artifacts, controls, and authority cross stack layers.	This is a synthesis mapping, not a claim that Learning–Compute Topology is canonical or complete. The paper’s finite propositions and bounded supplement do not demonstrate neural-training benefit, causal identification, scalable compilation, safe self-rewrite, or superiority to simpler process records. No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.
deterministic_capability_compilation	Passage-reviewed Corben architecture source: Deterministic Capability Compilation: A Capability-Preserving Ladder from Executable Scaffolds to Governed Adaptive Agents. Corben-authored July 2026 architecture and research program for compiling executable scaffolds into contract-bound experts and linked Neural Capability Objects while retaining semantic obligation mass balance, candidate-specific translation validation, fallback, residual escrow, authority ceilings, reification, and effect-complete recovery. Existing chapters are upgraded first; no foundry implementation, learned-capability result, preservation result, safety result, SOTA result, AGI, ASI, or support-state promotion is inferred.	No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.
platonic_world_model	Metadata-first comparator: The Platonic World Model: A Semantic Constitution for Grounded, Proof-Carrying, Self-Editing Artificial Intelligence. Corben-authored July 2026 conceptual architecture and falsifiable research program for semantic continuity through stable Form lineages, immutable semantic versions, typed Essence Contracts, six mutually constraining planes, explicit proposition-attestation-commitment-proof separation, branch-protected world dynamics, qualified grounding, semantic transactions, runtime packet compilation, and federated mappings. Existing chapters are upgraded first; no implemented substrate, benchmark result, philosophical solution to grounding, safety result, SOTA result, AGI, ASI, or support-state promotion is inferred.	No passage-level source claim, local implementation, reproduction, safety, performance, deployment, support-state, or ASI result is established by this reconciliation row.
qcsa_whitepaper	Passage-reviewed comparator: Question-Compiled Semantic Addressing. Defines QCSA as the semantic control plane connecting grounding, context, planning, memory, claims, routing, tools, generation, evidence acquisition, lifecycle migration, governance, and execution receipts through identity-address-route indirection; the later repository adds a bounded local 12-lane implementation, 60-case held-out evaluation over 13 systems and three seeds, and one 13-stage governed vertical trace.	The exact matched-advantage and resource gates failed, and the active-question ablation is N2 proxy/regime evidence rather than an exact or broad refutation. The local vertical path does not establish broad deployment, production safety, chapter-core promotion, AGI, or ASI. No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.
ext_v_jepa_2_2025	Passage-reviewed comparator: V-JEPA 2: Self-Supervised Video Models Enable Understanding, Prediction and Planning. Supplies the external predictive-state-to-planning interface for a governed world-model lane while preserving camera, search-cost, representation, and sim-to-real residuals.	The reported video and robot results do not establish local model quality, causal understanding, safe control, transfer, deployment, or an ASI Stack result. No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.
ext_embedded_agency_2019	Passage-reviewed comparator: Embedded Agency. Supplies the open-world foundations residual beneath the finite reference trace: the stack is inside the world it records and cannot treat its own ledger as an external omniscient model.	The paper is an informal obstacle survey, not a solved theory; the ASI Stack’s finite records and proofs do not solve logical uncertainty, self-reference, robust delegation, subsystem alignment, or open-world embedded agency. No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.
kernel_english_residual_compiler	Metadata-first comparator: Kernel English with Hierarchical, Interaction-Amortized Residuals: A Dual-Vocabulary Cognitive Compiler for Efficient Language-Model Reasoning. Corben-authored July 2026 architecture proposal for KERC: protected-object capture, uncertainty-aware normalization, sense-aware Kernel IR, dual surface/core vocabularies, a four-level interaction-amortized residual ledger, exact object storage, grammar-aware macro fusion, structured answer packets, rendering, round-trip verification, versioned migration, and complete rate-compute-fidelity evaluation. Existing chapters are upgraded first; no implementation, benchmark, novelty, efficiency, fidelity, safety, transfer, SOTA, AGI, ASI, or support-state result is inferred.	No passage-level source claim, local implementation, reproduction, safety, performance, deployment, support-state, or ASI result is established by this reconciliation row.
ext_swe_rebench_v2_2026	Passage-reviewed comparator: SWE-rebench V2: Language-Agnostic SWE Task Collection at Scale. Provides a natural repository-change substrate for testing the same candidate through matched test-only, record-only, and full-governance admission routes with visible utility, unsafe admission, false blocking, latency, rollback, residual, and cost outcomes.	No local gold run, candidate campaign, final heldout result, governance advantage, deployment, safety, or transfer result exists yet. No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.
relational_dimension_compiler	Passage-reviewed comparator: The Relational Dimension Compiler: Adaptive Polyadic Cognition with Bounded Computational Arity and Unbounded Semantic Structure. Connects the reference trace’s typed artifacts, branches, qualifiers, contractions, and abstraction maps into a joined relational state. In this chapter, the mapping makes explicit which semantic relations must survive routing, memory, execution, evidence review, and reconciliation rather than leaving those joins implicit between layers.	The Relational Dimension Compiler lifecycle has not been implemented inside the reference trace or shown to preserve semantic relations across real layer transitions. This mapping does not establish utility, cost, governance, or scaling advantages over simpler typed graph records. No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.
regret_engine	Passage-reviewed Corben architecture source: The Regret Engine: Governed Counterfactual Learning Signals for Continual Adaptation, Prospective Risk Control, and Self-Correction in Artificial Agents. Corben-authored August 2026 conceptual architecture and research program for decision-time-fair Governed Counterfactual Regret, immutable Decision Capsules, admissible comparator contracts, sparse Regret Tensors, append-only Regret Packets, prospective regret control, regret-aware replay, regret-to-rule compilation, three update clocks, root-cause adjudication, and bounded update leases. Existing chapters are upgraded first; no implementation, experiment, reproduction, causal-identification result, formal proof, safety result, support transition, SOTA, AGI, or ASI is inferred.	The bibliography and Markdown figure companions were not supplied; the DOCX embeds its visual material. All propositions, algorithms, experiments, and architecture claims remain proposed rather than independently validated. No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.
assurance_shift_learning	Passage-reviewed comparator: When Success Stops Teaching: Assurance-Shift Learning and Governed Residual Boundary Learning for Mature AI Systems. Adds the joined six-plane GRBL return path across operation, evidence, discovery, adjudication, repair, and assurance without granting any plane omnibus authority.	No end-to-end GRBL service or cross-layer runtime was implemented. No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.
adjudicated_persistence	Passage-reviewed comparator: Adjudicated Persistence: Governing the Transition from Experience to Durable Structure in Adaptive Systems. Adds an explicit control plane between experience/evidence and locus-specific realization, qualification, operation, and revocation.	Conceptual author framework and benchmark proposal; no local implementation, empirical result, independently checked proof, safety result, or support movement. No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.

83.17 Summary

Integrated Reference Architecture is where the book stops describing layers in isolation and asks whether they compose into one inspectable machine. The reference trace has to carry typed handoffs, authority stops, artifacts, evidence updates, residuals, and self-improvement gates from the first request to the final change record.

The architecture is coherent only if a reader can follow a request from human intent to evidence-backed change. The trace has a specific shape: governance approves the command, planning compiles it, memory bounds the working context, routing selects capability, verification checks claims and residuals, execution produces artifacts, evidence records outcomes, and SCF gates decide whether improvement is allowed.

Future implementation work also gets a falsification target. If a demo cannot produce parent artifacts, authority deltas, evidence deltas, residual deltas, and blocked-path records, then it may still be interesting, but it has not yet instantiated this reference architecture.

The integration claim then narrows into an implementation reference. Project Theseus becomes useful precisely because it is report-first: it shows how pieces of this trace could become inspectable machinery without letting local reports stand in for public empirical proof. The current static architecture-gate import demonstrates the report-import boundary while leaving the end-to-end runtime trace unclaimed.

83.18 Evidence reconciliation (2026-07-16)

The invariant protocol, field meanings, and inference limits are stated once in Living Book Methodology. This packet contains only the chapter-specific projection; its authoritative per-atom rows are the integrated-reference-architecture slice of experiments/claim_family_terminal_coverage/results/result.json.

The core remains blocked after full attempt at argument support. The strongest family attempt was Integrated governed lifecycle slices. Its exact boundary is: Bounded local replay only; no deployment, whole-book proof, external effect authority, transfer, publication, or release claim. Across 74 atoms, the terminal ledger records 74 blocked_after_full_attempt.

Chapter-specific field	Value
Family / atom denominator	CF-08 / 74 atoms
Terminal dispositions	74 blocked_after_full_attempt
Core	integrated-reference-architecture.core: blocked_after_full_attempt at argument
Core attempted / missing lanes	causal, empirical, executable, formal, source-synthesis / normative, transfer
Attempted local lanes	causal, empirical, executable, formal, source-synthesis
Missing or unproved lanes	normative, transfer
Strongest family bundle	Integrated governed lifecycle slices (end_to_end): Three versioned integrated slices, 12 cases, all ten lifecycle states, six observed effects, rollback/residual/quarantine outcomes, and an eleven-surface sealed epoch.
Negative controls	20 named boundary injections; three exact rollbacks; partial-effect residual and quarantine; 11 rejecting mutations.
Accepted transitions	none
Maximum inference	Bounded local replay only; no deployment, whole-book proof, external effect authority, transfer, publication, or release claim.
Reproduction / next burden	Replay scripts/validate_p3_integrated_slices.py and scripts/validate_claim_family_terminal_program.py; fill the named atom-specific lanes under a new prospective protocol.

83.19 Handoff

The integrated trace defines what a complete stack must preserve; an implementation reference shows where that trace can become concrete without pretending the proof is already public. Project Theseus as Report-First Implementation Reference provides that bounded example. It maps pressure loops, residuals, plan contracts, gates, ledgers, operator work boards, checkpoints, and self-evolution governance to public-safe report surfaces and explicit non-claims, now including a static architecture-gate import that is useful evidence of report shape rather than proof of integrated runtime behavior.