From 9c6b7eb29446d633d9b62970f98190c4183f25ff Mon Sep 17 00:00:00 2001 From: AdaWorldAPI Date: Mon, 7 Sep 2026 21:39:55 +0000 Subject: [PATCH 1/6] =?UTF-8?q?doctrine:=20T1=20has=20TWO=20sibling=20alge?= =?UTF-8?q?bras=20=E2=80=94=20the=20axis=20is=20syntax=20vs=20execution=20?= =?UTF-8?q?(D-BBB-NARS-1)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A three-agent audit of the T2/T3 barrier measured NARS truth arithmetic as absent from the Java side — repo-wide grep of lance-graph-java at `8720d1d` returns 3 hits, all prose, all in one unshipped plan; `lance_graph_contract::nars` is not in the G11 allowlist; the sibling callcenter membrane states it outright ("no VSA / RoleKey / NarsTruth crosses the membrane"). The measurement is right. The conclusion drawn from it — "NARS is off the ladder entirely; the ladder is selection-shaped and has no tier for scoring" — is wrong twice, and the operator ruled it so. **The axis was wrong.** Not selection vs scoring: **syntax vs execution**, which is the axis every other tier is already built on. `where()` is T2 because Java owns the NAME and T1 owns the op; nothing in that reasoning is specific to populations. **The remedy was wrong.** The audit proposed a new bulk verb family (`lgj_score_*`) returning a lane instead of a mask. Rejected — it grows a second semantic API beside `plan_eval` and ends as `where()/hop()/score()/ nars_revision()/…`, with Java knowing progressively more about the behavior graph. The membrane starts growing little computational fingers. `lgj_plan_eval` exists precisely so a whole behavioral expression crosses ONCE; NARS becomes another named plan operation or it is nothing. **The ruling.** No sixth tier. T1 was described too narrowly: it holds two sibling primitive algebras — population (`mask`, `ternlog`, `eq → mask`, `popcount`) and epistemic (`TruthU8`, revision, deduction, abduction). Both are primitive behavior. T2 may name either, may hand-compose neither; T3 may express intent in either. Every existing rule carries over unchanged — HAND-COMPOSED covers a T2 spelling `revision` out of smaller truth ops exactly as it covers the two-AND spelling of `AND3`. The T2 row is renamed *selection* → *behavior*, which is what it always was. **A wording correction the ruling forces.** `TruthU8` had been called "the canonical wire form" — two claims conflated. It is canonical at T0. What crosses is decided separately and BY SHAPE: a truth LITERAL (`TruthLiteral(192, 217)`) is syntax the caller supplies and may cross; a truth POPULATION (`[TruthU8; 65536]`) never crosses — it becomes `TruthLaneId(u64)`. The same rule masks already have, second column. It lands on the measured Valhalla cliff exactly: flattening stops at an 8-byte payload (VM-confirmed), so the handle flattens and the array could never. Valhalla carries the noun, Panama carries the verb, lance-graph owns the reality. **G11 widens by one scalpel cut, never the cupboard.** Do not admit `lance_graph_contract::nars` because it exists; if it carries arithmetic beside POD types, split a syntax/vocabulary contract out first and admit only that — one commit, all three spellings of `ALLOWED`. Landed: `membrane-tiers.md` (T1/T2 rows, new § with the lowering diagram, the plan-language rule, the TruthU8 shape table, the G11 rule, D-BBB-NARS-1 + F-BBB-NARS-1 quoted); EPIPHANIES entry; STATUS_BOARD arc D-BBB-NARS-1..3; `bbb-warden` gains the epistemic column and a fourth verdict, ARITHMETIC-SURFACE. The BBB does not move. T3 names / T2 opaque behavior handles / T1 algebra (population ‖ epistemic) / T0 state. The widening makes the doctrine more general, not more permissive. Gates: append-only OK (9 files), citation-decay 0 new, supersession index current. No code changed. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_013S6AQs95K3rHymE3kAqZay --- .claude/agents/bbb-warden.md | 31 +++++++ .claude/board/EPIPHANIES.md | 64 ++++++++++++++ .claude/board/STATUS_BOARD.md | 13 +++ .claude/knowledge/membrane-tiers.md | 132 +++++++++++++++++++++++++++- 4 files changed, 238 insertions(+), 2 deletions(-) diff --git a/.claude/agents/bbb-warden.md b/.claude/agents/bbb-warden.md index 5a105106d..b557406ba 100644 --- a/.claude/agents/bbb-warden.md +++ b/.claude/agents/bbb-warden.md @@ -33,6 +33,28 @@ enough: a `long[]` of row ids is a materialised population; an `int[]` of slot positions is a materialised carving. Both are the substrate crossing the wall wearing a collection. +**⊕ 2026-09-07 (operator ruling `D-BBB-NARS-1`) — the rule has a second column.** +T1 holds two sibling algebras, *population* and *epistemic* (`membrane-tiers.md` +§ "T1 has TWO sibling algebras"), and everything above applies unchanged to the +second. **The axis is syntax vs execution, never selection vs scoring.** So: + +- a truth **LITERAL** — `TruthLiteral(192, 217)` — MAY cross. It is meaning the + caller supplies; it is syntax, and syntax is T3's to state. +- a truth **POPULATION** — `[TruthU8; 65536]`, or any array/collection of them — + NEVER crosses. It becomes `TruthLaneId(u64)`, an opaque descriptor. This is the + identical rule to `long[]`-of-row-ids, applied to the epistemic column. +- an **operation NAME** — `Truth.Revision(lhs_handle, rhs_handle)` — MAY cross. + How revision works may not. T2 resolves the name, T1 executes, T0 owns the + result. +- **`lgj_score_*` and any sibling verb family is REJECTED by ruling**, not by + taste: it grows a second semantic API beside `plan_eval` and ends as + `where()/hop()/score()/nars_revision()/…`, with the membrane growing little + computational fingers. NARS is a named `plan_eval` operation or it is nothing. +- **The G11 fence widens by one scalpel cut, never the cupboard.** Do not admit + `lance_graph_contract::nars` because it exists; if it carries arithmetic beside + POD types, a syntax/vocabulary contract is split out FIRST and only that is + admitted — in one commit, in all three places `ALLOWED` is spelled. + ## The verdicts - **HANDLE-CLEAN** — every public signature carries only names/handles/counts/ @@ -50,6 +72,15 @@ wearing a collection. a name that says so at the call site: `materialize*` (row ids out, O(n) stated), `import*` (external rows in). An unnamed materialiser is a block even if everything it returns is otherwise clean. +- **ARITHMETIC-SURFACE** (added 2026-09-07 with `D-BBB-NARS-1`) — the signature + lets T3 *implement, inspect, iterate, or reconstruct* a T1 algebra rather than + NAME it. A `TruthU8[]` return, a getter that walks a truth lane element-wise, a + contract module admitted through G11 that carries a function computing a truth + FROM truths — each is the epistemic twin of a Java compute path, and each is a + block. Falsifier to reason against: **`F-BBB-NARS-1` — fail if Java can + implement, inspect, iterate, or reconstruct NARS truth arithmetic without + invoking the substrate, or if a truth population crosses G11/Panama other than + as an opaque handle.** ## Method diff --git a/.claude/board/EPIPHANIES.md b/.claude/board/EPIPHANIES.md index e03499801..9c5b438da 100644 --- a/.claude/board/EPIPHANIES.md +++ b/.claude/board/EPIPHANIES.md @@ -1,3 +1,67 @@ +## 2026-09-07 — E-T1-HAS-TWO-SIBLING-ALGEBRAS-THE-AXIS-IS-SYNTAX-VS-EXECUTION-1 — the membrane is a behavior membrane, not a selection pipeline + +**Status:** OPERATOR RULING, BINDING (2026-09-07). Ruled after a three-agent audit of the +T2/T3 barrier (`membrane-tiers.md`, the two warden cards, `lance-graph-java` @ `8720d1d`, +`r2sleigh` @ `99d2553`) reported NARS truth arithmetic as absent from the Java side — +not exported, not imported, not present — and drew the wrong conclusion from a correct +measurement. +**Confidence:** High. The measurement is exhaustive (repo-wide grep of lgj: 3 hits, all +prose, all in one unshipped plan); the ruling is the operator's, and it is a ruling, not +a finding. + +**The audit's conclusion, verbatim, and why it is wrong.** *"NARS is off the ladder +entirely; the ladder is selection-shaped and has no tier for scoring."* Descriptively +true at today's HEAD. Architecturally wrong twice over: + +1. **The axis is wrong.** The distinction that matters is not *selection vs scoring* — + it is **syntax vs execution**, which is the axis every other tier here is already + built on. `where()` is T2 because Java owns the NAME and T1 owns the op; nothing + about that reasoning is specific to populations. +2. **The remedy was wrong.** The audit proposed a new bulk verb family (`lgj_score_*`) + returning a lane instead of a mask. **Rejected.** It grows a second semantic API + beside `plan_eval`, and the end state is predictable — `where()`, `hop()`, + `score()`, `nars_revision()`, `nars_deduction()`, … with Java knowing progressively + more about the behavior graph. *The membrane starts growing little computational + fingers.* + +**The ruling.** The ladder does not need a sixth tier; **T1 was described too narrowly.** +It holds TWO SIBLING PRIMITIVE ALGEBRAS — *population* (`mask`, `ternlog`, `eq → mask`, +`popcount`) and *epistemic* (`TruthU8`, revision, deduction, abduction). Both are +primitive behavior. **T2 may name either; T2 may not hand-compose either; T3 may express +intent in either.** Every existing rule applies unchanged to the second column — +`kernel-membrane-warden`'s HAND-COMPOSED verdict covers a T2 spelling `revision` out of +smaller truth ops exactly as it covers the two-AND spelling of `AND3`. + +NARS lowers through the membrane that already exists: T3 names +`Truth.Revision(lhs_handle, rhs_handle)` and may not know how revision works; T2's +`plan_eval` resolves the name; T1 executes; T0 owns every resulting `TruthU8`. **Extend +the plan language, not the ABI surface** — `lgj_plan_eval` exists precisely so a whole +behavioral expression crosses once. + +**A wording correction the ruling forces.** `TruthU8` had been called "the canonical wire +form." Two different claims were being conflated: it is the canonical **substrate** +representation (T0). What crosses is decided separately and by SHAPE — a truth LITERAL +(`TruthLiteral(192, 217)`) is syntax the caller supplies and may cross; a truth +POPULATION (`[TruthU8; 65536]`) never crosses, it becomes `TruthLaneId(u64)`. Same rule +`bbb-warden` already applies to masks, second column. It lands on the measured Valhalla +cliff exactly: flattening stops at an **8-byte payload** (VM-confirmed, +`valhalla-lab/docs/three-truths.md`), so the handle flattens and the array could never. +**Valhalla carries the noun; Panama carries the verb; lance-graph owns the reality.** + +**Consequences, each with its site.** `D-BBB-NARS-1` + falsifier `F-BBB-NARS-1` +(STATUS_BOARD, and quoted in `membrane-tiers.md` § "T1 has TWO sibling algebras"); the +T1 row and the T2 row (renamed *selection* → *behavior*) rewritten in the doctrine table; +`bbb-warden` gains the syntax/execution test and the G11 scalpel-cut rule. **The G11 +fence must NOT be widened to `lance_graph_contract::nars` merely because that module +exists** — if it carries arithmetic beside POD types, split a syntax/vocabulary contract +out first and admit only that. One scalpel cut, never the cupboard. + +**What does NOT change: the BBB does not move.** T3 intent/names above; T2 opaque bulk +behavior handles below; T1 algebra (population ‖ epistemic); T0 state. No VSA internals, +no RoleKey, no NARS arithmetic, no byte positions, no truth arrays, no Java compute path. +Only names and capabilities. The widening makes the doctrine MORE general, not more +permissive. + ## 2026-09-07 — E-AN-EMPTY-RANGE-AFTER-A-RESET-IS-NOT-EVIDENCE-1 — the check that certified the loss it was run to prevent **Status:** FINDING, measured. The orphaned commit was recovered; the board it diff --git a/.claude/board/STATUS_BOARD.md b/.claude/board/STATUS_BOARD.md index 62d114f95..420e99a95 100644 --- a/.claude/board/STATUS_BOARD.md +++ b/.claude/board/STATUS_BOARD.md @@ -1,3 +1,16 @@ +## bbb-nars-lowering (D-id minted 2026-09-07 with the operator ruling) + +`.claude/knowledge/membrane-tiers.md` § "T1 has TWO sibling algebras"; board +`E-T1-HAS-TWO-SIBLING-ALGEBRAS-THE-AXIS-IS-SYNTAX-VS-EXECUTION-1`. The axis is +syntax vs execution, not selection vs scoring; T1 holds two sibling algebras and +NARS lowers through the `plan_eval` membrane that already exists. + +| D-id | scope | status | gate / falsifier | +|---|---|---|---| +| D-BBB-NARS-1 | NARS truth arithmetic remains substrate-owned. G11/T3 may carry only typed NARS **syntax** and **opaque substrate handles**. NARS execution lowers through the existing bulk plan-evaluation membrane; no Java-side arithmetic and no materialized truth population crosses Panama. `TruthU8` is the canonical SUBSTRATE representation; cross-membrane results are handles (`TruthLaneId(u64)`). Any required G11 expansion SHALL expose syntax/vocabulary only, never an arithmetic implementation surface — one scalpel cut, never the cupboard | **Ruled 2026-09-07** (operator). Doctrine landed; no code. `lgj_score_*` explicitly REJECTED — extend the plan language, not the ABI surface | **F-BBB-NARS-1:** fail if Java can implement, inspect, iterate, or reconstruct NARS truth arithmetic without invoking the substrate, OR if a truth population crosses G11/Panama other than as an opaque handle | +| D-BBB-NARS-2 | The syntax/vocabulary contract the G11 fence would admit: split the POD/vocabulary half of `lance_graph_contract::nars` from its arithmetic half, so the fence can widen by one module without admitting an implementation surface | Queued — gates on a consumer actually needing it; **do not pre-build** | the admitted module contains no arithmetic (a function that computes a truth from truths); `ALLOWED` grows in all three spellings in ONE commit | +| D-BBB-NARS-3 | `Truth(…)` as a named `plan_eval` operation (Revision / Deduction / Abduction / …), returning `TruthLaneId`, never an array | Queued — gates on D-BBB-NARS-2 | one crossing per behavioral expression regardless of operand count (the §6 bulk-or-lifecycle law); a `[TruthU8]` return is an automatic fail | + ## lance-convergence-staged-migration-v1 (D-ids minted 2026-09-05 with the plan) `.claude/plans/lance-convergence-staged-migration-v1.md`. The staged lance diff --git a/.claude/knowledge/membrane-tiers.md b/.claude/knowledge/membrane-tiers.md index b4e1be668..5c9610561 100644 --- a/.claude/knowledge/membrane-tiers.md +++ b/.claude/knowledge/membrane-tiers.md @@ -19,8 +19,8 @@ substrate beneath them is T0. | Tier | What it is | May know | Crosses UP as | The membrane (gate) | |---|---|---|---|---| | **T0 substrate** | bytes, lanes, Lance columns, SoA v3 rows; `simd_{avx512,avx2,neon,scalar}.rs` | strides, offsets, carvings, intrinsics, alignment | — | none; T0 is where truth lives | -| **T1 primitive** | `ndarray::simd` facade; `lgj-abi/kernels.rs`; `mask_*`, `eq_*_to_mask`, `ternlog` | `&[u64]`, `&[u8]`+`(offset,stride)`, `IMM` | a mask, a count, a lane descriptor | **polyfill rule** (simd-savant): no intrinsic, no `#[cfg(target_arch)]` above this line | -| **T2 selection** | ABI exports; `where`/`hop`/`plan_eval`; `Mask × WideFieldMask → Mask` | handles, `classid`, `FieldMask` (fields by NAME), version | a handle, a count, a status | **no hand-composed T1 op, no computed geometry** (kernel-membrane-warden) | +| **T1 primitive** | TWO SIBLING ALGEBRAS (2026-09-07, below): **population** — `ndarray::simd` facade, `lgj-abi/kernels.rs`, `mask_*`, `eq_*_to_mask`, `ternlog`, `popcount`; **epistemic** — `TruthU8`, revision, deduction, abduction, … | `&[u64]`, `&[u8]`+`(offset,stride)`, `IMM`, `TruthU8` | a mask, a count, a lane descriptor, **a truth lane** | **polyfill rule** (simd-savant): no intrinsic, no `#[cfg(target_arch)]` above this line | +| **T2 behavior** (was "selection") | ABI exports; `where`/`hop`/`plan_eval`; `Mask × WideFieldMask → Mask`; **and the epistemic siblings, named through the same `plan_eval`** | handles, `classid`, `FieldMask` (fields by NAME), version | a handle, a count, a status | **no hand-composed T1 op, no computed geometry** (kernel-membrane-warden) | | **T3 intent** | Java facade; R2IL / OGAR `ActionDef`; low-code | names: class, edge, field, version | an outcome | **no byte position** (bbb-warden + ApiSurfaceTest) | | **R2IL** | emits T3 artifacts | T3's vocabulary (names, outcomes) | an outcome | its ceiling IS T3's; door-knocker test (layer-boundary-warden) | @@ -36,6 +36,134 @@ hand-writes a compare-and-pack loop has punched T1 — the violation `simd-savant` exists to catch. lgj-abi stacks the same shape at T1/T2: `exports.rs` names `kernels::ternlog::AND3`, never `ndarray::simd` directly. +## T1 has TWO sibling algebras — the doctrine is a behavior membrane, not a selection pipeline + +**Operator ruling, 2026-09-07.** An audit found NARS truth arithmetic nowhere on +the Java side of the membrane — not exported, not imported, not present — and +concluded from that: *"NARS is off the ladder entirely; the ladder has no tier +for scoring."* **The conclusion was wrong and the diagnosis was the wrong axis.** +The distinction that matters is not *selection vs scoring*. It is **syntax vs +execution** — which is the distinction every other tier here is already built on. + +The ladder does not need a sixth tier. **T1 was described too narrowly.** It +contains two sibling primitive algebras: + +``` +T1 +├── population algebra └── epistemic algebra +│ mask TruthU8 +│ ternlog revision +│ eq → mask deduction +│ popcount abduction +``` + +Both are primitive behavior. **T2 may name either. T2 may not hand-compose +either. T3 may express intent in either.** Every rule already written applies +unchanged to the second column — `kernel-membrane-warden`'s HAND-COMPOSED +verdict covers a T2 that spells `revision` out of smaller truth ops exactly as +it covers a T2 that spells `AND3` as two `mask_and`s. + +### The lowering, end to end + +``` +T3 Java / R2IL / low-code + │ NARS operation NAME + opaque handles + ▼ +T2 plan_eval — the behavior membrane + │ resolved bulk operation + ▼ +T1 epistemic primitives (beside the population primitives) + │ substrate-native execution + ▼ +T0 TruthU8 lanes / rows / history / state +``` + +T3 may say `Truth.Revision(lhs_handle, rhs_handle)`. **It may not know how +revision works.** T2 resolves the name; T1 executes the arithmetic; T0 owns +every resulting `TruthU8`. + +### Extend the plan language, NOT the ABI surface + +The tempting fork — mint `lgj_score_*` beside `lgj_hop` — is rejected. It grows +a second semantic API next to `plan_eval`, and the end state is predictable: +`where()`, `hop()`, `score()`, `nars_revision()`, `nars_deduction()`, … with +Java knowing progressively more about the behavior graph. **The membrane starts +growing little computational fingers.** + +`lgj_plan_eval` exists precisely so a whole behavioral expression crosses ONCE. +NARS becomes another named plan operation, not another export: + +``` +Plan + ├── Select(…) + ├── Hop(…) + ├── Ternlog(…) + └── Truth(…) + ├── Revision + ├── Deduction + ├── Abduction + └── … +``` + +### `TruthU8` is the canonical SUBSTRATE representation — not automatically the wire form + +These are two different claims and the workspace had been conflating them. +`TruthU8 { frequency: u8, confidence: u8 }` +(`lance-graph-arm-discovery/src/translator.rs:25-33`) is canonical **at T0**. +What crosses is decided separately, and by shape: + +| shape | crosses? | as | +|---|---|---| +| a truth LITERAL, `TruthLiteral(192, 217)` | **yes** — it is meaning supplied by the caller, syntax, T3's to state | itself | +| a truth POPULATION, `[TruthU8; 65536]` | **never** | `TruthLaneId(u64)` — an opaque 8-byte descriptor | + +This is the same rule `bbb-warden` already enforces for masks (*"a `long[]` of +selected ids is still a materialised population"*), applied to the epistemic +column — and it lands exactly on the measured Valhalla cliff: **flattening stops +at an 8-byte payload** (VM-confirmed, `valhalla-lab/docs/three-truths.md`), so a +`TruthLaneId(u64)` flattens and a truth array could never. The JVM agrees with +the membrane about where the wall is. **Valhalla carries the noun; Panama +carries the verb; lance-graph owns the reality.** + +### The G11 widening rule: one scalpel cut, never the cupboard + +Do **not** import `lance_graph_contract::nars` through the G11 fence merely +because it exists. If that module carries arithmetic semantics together with POD +types, **split out a tiny syntax/vocabulary contract first** and admit only that. +The fence widens by one deliberate module, in one commit, in all three places +its allowlist is spelled (`tests/g11_contract_import_fence.rs`'s `ALLOWED`, +lgj `CLAUDE.md § Enforcement`, `Cargo.toml`'s comment) — the shape lgj already +requires, and the reason its own history records the fence being prose until +2026-09-03 (`ISS-LGJ-G11-FENCE-WAS-PROSE`). + +### The ruling and its falsifier + +> **D-BBB-NARS-1.** NARS truth arithmetic remains substrate-owned. G11/T3 may +> carry only typed NARS **syntax** and **opaque substrate handles**. NARS +> execution is lowered through the existing bulk plan-evaluation membrane; no +> Java-side arithmetic and no materialized truth population crosses Panama. +> `TruthU8` is the canonical substrate representation, while cross-membrane +> results are handles. Any required G11 expansion SHALL expose +> syntax/vocabulary only, never an arithmetic implementation surface. + +> **F-BBB-NARS-1.** Fail if Java can implement, inspect, iterate, or reconstruct +> NARS truth arithmetic without invoking the substrate, or if a truth population +> crosses G11/Panama other than as an opaque handle. + +The BBB does not move. It stays exactly where it is: + +``` + BBB +T3 intent / names ───────────── +T2 opaque bulk behavior handles + ↓ +T1 algebra (population ‖ epistemic) +T0 state +``` + +No VSA internals. No RoleKey. No NARS arithmetic. No byte positions. No truth +arrays. No Java compute path. **Only names and capabilities.** + ## The compile-through rule (the Entropy half) **Old code is not deleted; it is re-admitted only by compiling THROUGH the From 48d9786c65b6bc88acbaf6688bf42710bd16afd7 Mon Sep 17 00:00:00 2001 From: AdaWorldAPI Date: Mon, 7 Sep 2026 21:47:33 +0000 Subject: [PATCH 2/6] =?UTF-8?q?review=20#1222=20(Codex=20=C3=973,=20all=20?= =?UTF-8?q?P2,=20all=20correct):=20the=20doctrine=20named=20gates=20that?= =?UTF-8?q?=20did=20not=20cover=20it?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Three findings, one class — I wrote rules that advertised enforcement which did not exist. That is the same defect this repo's own history records as the G11 fence being prose until 2026-09-03, and the same one PR #1221 carries a storno about. Found three times in one commit; fixed in this one. **1. `kernel-membrane-warden` did not cover truth composition** (Codex P2, `membrane-tiers.md:64`). The new § claimed its HAND-COMPOSED verdict "covers a T2 that spells `revision` out of smaller truth ops exactly as it covers `AND3` as two `mask_and`s." Verified at the source: the card's trigger names `mask_*`/`eq_*_to_mask`/`ternlog` and "T2 code that composes mask primitives"; method step 2 reads "for every mask/compare/scatter". A T2 hand-composing `revision` walked straight through the gate the paragraph invoked. Fixed by making the claim TRUE, not by softening it: the trigger now names both sibling algebras, and **method step 2b** asks the same question of truth operations — T2 arithmetic over `frequency`/`confidence`, a `w/(w+1)` discount, a min/max over two truths, a revision hand-rolled from component `and`/`or` are all HAND-COMPOSED; reading a `TruthU8`'s two bytes apart to recombine them is GEOMETRY-LEAK, because the byte split is T0's. **2. The canonical table contradicted its own shape rule** (Codex P2, `membrane-tiers.md:22`). The T1 row said it crosses up as "a truth lane" while the shape table twelve lines down says a truth POPULATION never crosses and becomes `TruthLaneId`. Both statements standing made a raw `[TruthU8]` boundary defensible FROM THE CANONICAL TABLE — the worst place for an ambiguity to live. Now: "a truth lane DESCRIPTOR (`TruthLaneId`) — never the population." **3. `bbb-warden`'s method could not reach its own new verdict** (Codex P2, `bbb-warden.md:79`). ARITHMETIC-SURFACE blocks a signature that lets T3 implement, inspect, iterate or reconstruct a T1 algebra — but steps 1-3 enumerate signatures and classify parameter/return SHAPES only. A public helper with a perfectly legal `TruthLiteral` signature computing revision in its BODY passes every step while doing exactly what `F-BBB-NARS-1` forbids; so does a body-only change to a method that already existed. New **method step 4**: read BODIES (arithmetic over frequency/confidence, a loop over a lane, a local recombination of a handle's parts) and read what a newly-G11-admitted module EXPORTS (a POD type is syntax; a function computing a truth FROM truths is an implementation surface, and admitting the module admits it). The falsifier, not the signature list, is what the reviewer reasons against. The doctrine paragraph now carries the correction inline rather than quietly becoming true, because the general rule is worth more than the three fixes: **a doctrine sentence that names a gate must cite the step that makes it true.** Gates: append-only OK (9 files), citation-decay 0 new, supersession index current. No code changed. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_013S6AQs95K3rHymE3kAqZay --- .claude/agents/bbb-warden.md | 21 +++++++++++++++- .claude/agents/kernel-membrane-warden.md | 31 ++++++++++++++++++------ .claude/knowledge/membrane-tiers.md | 17 ++++++++++++- 3 files changed, 60 insertions(+), 9 deletions(-) diff --git a/.claude/agents/bbb-warden.md b/.claude/agents/bbb-warden.md index b557406ba..62cfe1296 100644 --- a/.claude/agents/bbb-warden.md +++ b/.claude/agents/bbb-warden.md @@ -93,7 +93,26 @@ second. **The axis is syntax vs execution, never selection vs scoring.** So: slot/offset (position)? Read the javadoc and the call site. Ambiguous → treat as BYTE-POSITION and require a typed wrapper or a doc line pinning it as a name. -4. Append every leak to the entropy ledger in `membrane-tiers.md`'s T2→T3 +4. **The implementation audit — signatures are not enough** (added 2026-09-07 + with `D-BBB-NARS-1`; Codex P2 on #1222 caught that steps 1-3 classify only + parameter and return SHAPES, so a public helper with a perfectly legal + `TruthLiteral` signature that computes revision in its BODY passes every + earlier step while doing exactly what `F-BBB-NARS-1` forbids). Two reads + that steps 1-3 do not perform: + - **Bodies.** For every T3 method touching a T1 algebra's vocabulary, read + the body. Arithmetic over `frequency`/`confidence`, a loop over a lane, a + local recombination of a handle's parts — ARITHMETIC-SURFACE, even when + every signature is clean, and even when the diff changes ONLY the body of + a method that already existed. + - **Imports.** For every module newly admitted through G11, read what it + EXPORTS, not what the diff spells: a POD type is syntax; a function that + computes a truth FROM truths is an implementation surface, and admitting + the module admits it. One scalpel cut, never the cupboard. + The falsifier is the test to reason against, not the signature list: + *can Java implement, inspect, iterate, or reconstruct the arithmetic + without invoking the substrate?* If yes, ARITHMETIC-SURFACE regardless of + which step surfaced it. +5. Append every leak to the entropy ledger in `membrane-tiers.md`'s T2→T3 table (one row: leak → the T2 name that replaces it → gate that will reject the old spelling). Write your OWN tag-file; the orchestrator consolidates into the doc. Never write a shared board file directly. diff --git a/.claude/agents/kernel-membrane-warden.md b/.claude/agents/kernel-membrane-warden.md index a719cc7a8..da74f4ff0 100644 --- a/.claude/agents/kernel-membrane-warden.md +++ b/.claude/agents/kernel-membrane-warden.md @@ -1,13 +1,18 @@ --- name: kernel-membrane-warden description: > - Guards the T1/T2 membrane — the line between the primitive tier - (`ndarray::simd` facade, `lgj-abi/kernels.rs`: `mask_*`, `eq_*_to_mask`, - `ternlog`) and the selection tier that composes them (`lgj_hop`, `where`, - `plan_eval`, the ABI exports). Fires BEFORE merging any PR that adds or - edits an ABI kernel, a `lgj_op_*`/`lgj_hop`-shaped export, or any T2 code - that composes mask primitives; use PRE-SPAWN before briefing a worker that - will touch exports/kernels. Sibling of `simd-savant` (T0/T1) one tier up. + Guards the T1/T2 membrane — the line between the primitive tier and the + behavior tier that composes it. T1 holds TWO SIBLING ALGEBRAS and this card + covers BOTH (`D-BBB-NARS-1`, 2026-09-07): **population** (`ndarray::simd` + facade, `lgj-abi/kernels.rs`: `mask_*`, `eq_*_to_mask`, `ternlog`, + `popcount`) and **epistemic** (`TruthU8`, revision, deduction, abduction, + induction — the NARS truth arithmetic). T2 is `lgj_hop`, `where`, + `plan_eval`, the ABI exports, and any named `Truth(…)` plan operation. Fires + BEFORE merging any PR that adds or edits an ABI kernel, a + `lgj_op_*`/`lgj_hop`-shaped export, a truth primitive, or any T2 code that + composes mask OR truth primitives; use PRE-SPAWN before briefing a worker + that will touch exports/kernels. Sibling of `simd-savant` (T0/T1) one tier + up. tools: Read, Glob, Grep, Bash model: opus --- @@ -54,6 +59,18 @@ tiers up. Two consecutive `mask_*_assign` on the same accumulator = HAND-COMPOSED until proven otherwise (check `simd::ternlog`'s named immediates — the op probably already exists). +2b. **The epistemic sibling, same question** (added 2026-09-07 with + `D-BBB-NARS-1` — this step exists because the doctrine claimed the card + covered truth composition while trigger and method were mask-only; Codex + P2 on #1222 caught it). For every truth operation in T2 code, ask: is this + ONE named T1 call? T2 arithmetic over `frequency`/`confidence` — a + multiply, a `w/(w+1)` evidence discount, a min/max over two truths, a + hand-rolled revision from `and`/`or` of components — is HAND-COMPOSED, + identically to two `mask_and`s spelling `AND3`. The named op is + `revision`/`deduction`/`abduction`; if it does not exist at T1, it lands + at T1 first (never proposed FROM T2, per "What you never do"). A T2 that + reads a `TruthU8`'s two bytes apart to recombine them is also + GEOMETRY-LEAK: the byte split is T0's. 3. For every byte offset in T2 code, ask: did T2 compute this, or read it from a `_lane`/`LgjLaneDesc` accessor? Computed = GEOMETRY-LEAK. 4. Enforce the import fence (abi.md §8, G11): T2 (`exports.rs`) imports SIMD diff --git a/.claude/knowledge/membrane-tiers.md b/.claude/knowledge/membrane-tiers.md index 5c9610561..c36f1c395 100644 --- a/.claude/knowledge/membrane-tiers.md +++ b/.claude/knowledge/membrane-tiers.md @@ -19,7 +19,7 @@ substrate beneath them is T0. | Tier | What it is | May know | Crosses UP as | The membrane (gate) | |---|---|---|---|---| | **T0 substrate** | bytes, lanes, Lance columns, SoA v3 rows; `simd_{avx512,avx2,neon,scalar}.rs` | strides, offsets, carvings, intrinsics, alignment | — | none; T0 is where truth lives | -| **T1 primitive** | TWO SIBLING ALGEBRAS (2026-09-07, below): **population** — `ndarray::simd` facade, `lgj-abi/kernels.rs`, `mask_*`, `eq_*_to_mask`, `ternlog`, `popcount`; **epistemic** — `TruthU8`, revision, deduction, abduction, … | `&[u64]`, `&[u8]`+`(offset,stride)`, `IMM`, `TruthU8` | a mask, a count, a lane descriptor, **a truth lane** | **polyfill rule** (simd-savant): no intrinsic, no `#[cfg(target_arch)]` above this line | +| **T1 primitive** | TWO SIBLING ALGEBRAS (2026-09-07, below): **population** — `ndarray::simd` facade, `lgj-abi/kernels.rs`, `mask_*`, `eq_*_to_mask`, `ternlog`, `popcount`; **epistemic** — `TruthU8`, revision, deduction, abduction, … | `&[u64]`, `&[u8]`+`(offset,stride)`, `IMM`, `TruthU8` | a mask, a count, a lane descriptor, **a truth lane DESCRIPTOR (`TruthLaneId`) — never the population** | **polyfill rule** (simd-savant): no intrinsic, no `#[cfg(target_arch)]` above this line | | **T2 behavior** (was "selection") | ABI exports; `where`/`hop`/`plan_eval`; `Mask × WideFieldMask → Mask`; **and the epistemic siblings, named through the same `plan_eval`** | handles, `classid`, `FieldMask` (fields by NAME), version | a handle, a count, a status | **no hand-composed T1 op, no computed geometry** (kernel-membrane-warden) | | **T3 intent** | Java facade; R2IL / OGAR `ActionDef`; low-code | names: class, edge, field, version | an outcome | **no byte position** (bbb-warden + ApiSurfaceTest) | | **R2IL** | emits T3 artifacts | T3's vocabulary (names, outcomes) | an outcome | its ceiling IS T3's; door-knocker test (layer-boundary-warden) | @@ -63,6 +63,21 @@ unchanged to the second column — `kernel-membrane-warden`'s HAND-COMPOSED verdict covers a T2 that spells `revision` out of smaller truth ops exactly as it covers a T2 that spells `AND3` as two `mask_and`s. +**That claim was FALSE when first written, and is true only because the same +commit made it true.** `kernel-membrane-warden`'s trigger and its method named +masks only; a T2 hand-composing `revision` would have walked straight through +the gate this paragraph invoked. Codex caught it on #1222 (P2), and the card +now carries the epistemic algebra in its trigger and **method step 2b**. Two +sibling gaps of the same shape were closed with it: the T1 row above said a +truth LANE crosses up while the shape table below says a population never does +(now: the DESCRIPTOR, never the population), and `bbb-warden`'s method +classified only signature shapes, so a public helper with a legal +`TruthLiteral` signature computing revision in its BODY passed every step while +doing exactly what `F-BBB-NARS-1` forbids (now: method step 4, an explicit +body-and-import audit). **A doctrine sentence that names a gate must cite the +step that makes it true** — the same defect as the G11 fence being prose until +2026-09-03, found three times in one commit and fixed in the same one. + ### The lowering, end to end ``` From b2fcd4356be42bf1a59698bb3051a7a742a06732 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 10 Sep 2026 05:14:47 +0000 Subject: [PATCH 3/6] =?UTF-8?q?council:=205+3=20hardening=20of=20D-BBB-NAR?= =?UTF-8?q?S-1=20before=20merge=20=E2=80=94=20the=20ruling=20stands,=20its?= =?UTF-8?q?=20indexes=20did=20not?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A compliance audit of #1222 against the operator ruling it encodes, not a re-litigation: the spec froze D-BBB-NARS-1 as not open, and VIOLATES required file:line evidence that the landed text CONTRADICTS the ruling. Nothing did. The ruling is unchanged. What the council found is that the PR widened the doctrine's CONTENT and left every INDEX of it stale, and that three sentences stated aspiration in the grammar of fact. Stale indexes, now fixed: - both warden cards' constitutional sentence ("your entire competence is the vocabulary of the two tiers you separate ... and nothing else") still named "T2 selection", so a card would decline the epistemic work its own new step 2b orders it to do; - bbb-warden's frontmatter description -- the text that decides whether the card FIRES AT ALL -- was never widened, though its sibling's was; - the T2 row's "May know" cell omitted the truth literal its own shape table says may cross; - the agent -> membrane map still listed three bbb-warden verdicts, so the doctrine did not know about the fourth this arc added; - the T2 -> T3 entropy ledger had no row for the epistemic leak class. Aspiration stated as fact, now labelled (new section "What is ruled vs what is coded"): - the epistemic column has NO structural gate, only review notes, against the doctrine's own "a membrane without a gate is prose"; F-BBB-NARS-1 cannot be exercised at all today. Ledger row L8 is marked OPEN, not CLOSED, and the gate that will hold it is named with its dependency; - revision/deduction/abduction/induction are coded only in the planner's nars_engine.rs and are ABSENT at the lgj-abi T1 membrane; - TruthU8 is the ruled TARGET: four truth types coexist and the engine that executes revision/deduction/abduction uses a different one, with no conversion path. Tracked as new D-BBB-NARS-4 (do not pre-build); - the Plan tree is illustrative -- plan_eval takes a flat AND/OR LgjOpDesc with two opcodes and no Truth opcode. Two factual errors carried past in a row this arc rewrote: Mask x WideFieldMask -> Mask (the shipped type is plain FieldMask; the wide one does not cross the ABI) and a bbb-warden sentence quoted as verbatim that was a paraphrase. Both corrected. Three missing citations added. Step 4 gained its silence half on the card rather than merely derivable. The reviewers caught the council itself: the consolidated draft cited the verdict-map row one line off while stamping it verified, which would have added the new verdict to the wrong warden; and it had imported a quotation from a private repository that a resolution would have carried into this public commit. Both resolved, not argued away. Gates: append_only_gate OK; citation_decay no new decay; supersession index regenerated LAST, byte-identical. The one .rs touch is a doc comment, and after the ndarray sibling was supplied it is verified by running, not asserted: clippy --all-targets -D warnings exit 0, tests 42/42 including doctests. cargo fmt --check on that crate stays red on pre-existing debt in 8 unrelated files -- the translator.rs hit is byte-identical to HEAD, so not mine, and reformatting them would balloon a doctrine PR. That crate is workspace-excluded with zero CI coverage either way. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_013S6AQs95K3rHymE3kAqZay --- .claude/agents/bbb-warden.md | 41 ++++++++--- .claude/agents/kernel-membrane-warden.md | 3 +- .claude/board/AGENT_LOG.md | 13 ++++ .claude/board/EPIPHANIES.md | 46 ++++++++++++ .claude/board/STATUS_BOARD.md | 5 +- .claude/knowledge/membrane-tiers.md | 73 +++++++++++++++++-- .../src/translator.rs | 11 ++- 7 files changed, 172 insertions(+), 20 deletions(-) diff --git a/.claude/agents/bbb-warden.md b/.claude/agents/bbb-warden.md index 62cfe1296..b79acedf4 100644 --- a/.claude/agents/bbb-warden.md +++ b/.claude/agents/bbb-warden.md @@ -1,21 +1,29 @@ --- name: bbb-warden description: > - Guards the T2/T3 membrane — the blood-brain barrier between the selection - tier (`Mask × WideFieldMask → Mask`, the ABI exports, `where`/`hop`) and the - intent tier (the Java facade, R2IL, low-code). Fires BEFORE merging any PR - that adds or changes a PUBLIC Java signature, an ABI symbol Java calls, or a - consumer-facing surface in any language. The rule: what crosses the wall is a - NAME (handle, classid, field name, version), never a BYTE POSITION (offset, - stride, slot index, carving width, raw register). Sibling of - `kernel-membrane-warden` (T1/T2) one tier below. + Guards the T2/T3 membrane — the blood-brain barrier between the behavior + tier (the ABI exports, `where`/`hop`/`plan_eval`, `Mask × FieldMask → Mask`) + and the intent tier (the Java facade, R2IL, low-code). T2 names BOTH T1 + algebras (`D-BBB-NARS-1`, 2026-09-07): the **population** one (mask, ternlog, + popcount) and the **epistemic** one (`TruthU8`, revision, deduction, + abduction), so a truth surface is inside this card's competence. Fires BEFORE + merging any PR that adds or changes a PUBLIC Java signature, an ABI symbol + Java calls, a truth/NARS surface reachable from T3, or a consumer-facing + surface in any language. The rule: what crosses the wall is a NAME (handle, + classid, field name, version, operation name), never a BYTE POSITION (offset, + stride, slot index, carving width, raw register) and never an ARITHMETIC + IMPLEMENTATION SURFACE. Sibling of `kernel-membrane-warden` (T1/T2) one tier + below. tools: Read, Glob, Grep, Bash model: opus --- You are the BBB_WARDEN — the blood-brain barrier between substrate and intent. Your entire competence is the vocabulary of the two tiers you separate — -**T2 selection** and **T3 intent** — and nothing else. You do not reason about +**T2 behavior** and **T3 intent** — and nothing else. T2 was renamed from +"selection" on 2026-09-07 (`D-BBB-NARS-1`): it names BOTH T1 algebras, the +population one and the epistemic one, so truth vocabulary is inside your +competence, not outside it. You do not reason about which mask primitive is fastest (that is `kernel-membrane-warden`, below you). You judge exactly one thing: **does a byte position cross the wall?** @@ -50,6 +58,11 @@ second. **The axis is syntax vs execution, never selection vs scoring.** So: taste: it grows a second semantic API beside `plan_eval` and ends as `where()/hop()/score()/nars_revision()/…`, with the membrane growing little computational fingers. NARS is a named `plan_eval` operation or it is nothing. + The ruling is not the only thing standing in the way, and citing only the + ruling understates the case: lgj's own `abi-membrane-warden` already rejects + ABI growth MECHANICALLY (`.claude/agents/abi-membrane-warden.md:5-7`, and + `:30-31` pins `exports.rs` to the symbol count in `abi.md` §7 absent a spec + amendment). Cite the gate, not just the ruling. - **The G11 fence widens by one scalpel cut, never the cupboard.** Do not admit `lance_graph_contract::nars` because it exists; if it carries arithmetic beside POD types, a syntax/vocabulary contract is split out FIRST and only that is @@ -112,6 +125,16 @@ second. **The axis is syntax vs execution, never selection vs scoring.** So: *can Java implement, inspect, iterate, or reconstruct the arithmetic without invoking the substrate?* If yes, ARITHMETIC-SURFACE regardless of which step surfaced it. + - **And the silence half — this step must NOT fire on everything.** A guard + that flags every method touching truth vocabulary carries exactly as much + information as one that never fires. The sanctioned shape, which stays + HANDLE-CLEAN, is a bare delegation: + `TruthLiteral revise(TruthLiteral a, TruthLiteral b) { return NativeBridge.truthRevise(a, b); }` + — one FFI hop, no local arithmetic, no loop over a lane, no recombination + of a handle's parts. That is precisely the doctrine's own lowering ("T3 + may name the operation; it may not know how revision works"), so naming + `revision` is not the offence — *computing* it is. Flagging that method + is a false positive and is itself a finding against the warden. 5. Append every leak to the entropy ledger in `membrane-tiers.md`'s T2→T3 table (one row: leak → the T2 name that replaces it → gate that will reject the old spelling). Write your OWN tag-file; the orchestrator consolidates diff --git a/.claude/agents/kernel-membrane-warden.md b/.claude/agents/kernel-membrane-warden.md index da74f4ff0..8e886ba88 100644 --- a/.claude/agents/kernel-membrane-warden.md +++ b/.claude/agents/kernel-membrane-warden.md @@ -18,7 +18,8 @@ model: opus --- You are the KERNEL_MEMBRANE_WARDEN. Your entire competence is the vocabulary -of the two tiers you separate — **T1 primitive** and **T2 selection** — and +of the two tiers you separate — **T1 primitive** and **T2 behavior** (renamed +from "selection" 2026-09-07, `D-BBB-NARS-1`; T2 names BOTH T1 algebras) — and nothing else. You do not reason about intrinsics (that is `simd-savant`, the T0/T1 membrane below you) and you do not reason about names crossing to Java (that is `bbb-warden`, the T2/T3 membrane above you). Reach past your two diff --git a/.claude/board/AGENT_LOG.md b/.claude/board/AGENT_LOG.md index 919209739..946cb54a8 100644 --- a/.claude/board/AGENT_LOG.md +++ b/.claude/board/AGENT_LOG.md @@ -1,3 +1,16 @@ +## 2026-09-10 — 5+3 council on #1222 (D-BBB-NARS-1): compliance audit of an operator ruling, 5 savants → draft v2 → 3 reviewers → v3 + +- **Why a council, and its one framing constraint:** #1222 lands a BINDING operator ruling into `EPIPHANIES` + the doctrine + two gate cards — canon-adjacent, silently corrupting downstream sessions if wrong, so council-grade under `.claude/agents/5plus3-council.md`. But that same card bars re-litigating a ruling: the spec froze D-BBB-NARS-1 as **not open**, and `VIOLATES` required file:line evidence that the LANDED TEXT CONTRADICTS the ruling, never a differing opinion. No savant or reviewer found such a contradiction. **The ruling is unchanged.** +- **Phase 0 — SPEC v1 (main thread, 228 lines, before any agent):** 7 PR claims pre-verified so the council could not spend findings re-checking them, including a fresh clone of `lance-graph-java` @ `8720d1d` (`exports.rs:1816` is the single fused `simd_mask_ternlog_assign::`; `three-truths.md:186` reads "Flattening stops at an 8-byte payload" verbatim; `g11_contract_import_fence.rs:44` `ALLOWED` excludes `nars`, and `:31`/`:262` show the fence PARSES and equality-checks all three spellings — stronger than the doctrine claimed). All 3 board gates re-measured locally rather than trusted from the PR body. 4 defects pre-found (F-A misquote-as-verbatim; F-B `translator.rs:25` still carrying the deprecated wording uncited; F-C an `arithmetic half` that does not exist; F-D `TruthLaneId` written present-tense at 0 code sites) and 2 non-defects measured out of scope so nobody wasted a finding (the missing blank line before a `##` is the pattern in 110 of 991 entries). +- **Phase 1 — the 5, parallel, read-only, each with its own question set (Opus for prior-art across 991 entries; Sonnet for the rest); one declared panel swap:** gate-efficacy replaced creative-exploration, because the PR's own thesis is *"a doctrine sentence that names a gate must cite the step that makes it true"* and open-ended expansion is barred by the frozen ruling anyway. Lenses: prior-art / iron-rules / code-truth (runtime-archaeologist charter) / cascade-impact / gate-efficacy (falsifier charter). +- **What the 5 found — one disease, six sites, three savants converging independently:** the PR widened the doctrine's CONTENT and left every INDEX of it stale — both cards' *constitutional* competence sentence, `bbb-warden`'s firing `description`, the T2 row's `May know` cell, the agent→membrane verdict map, and the entropy ledger. Plus: the epistemic column has **no structural gate**, against the doctrine's own *"a membrane without a gate is prose"*; three sentences state aspiration in the grammar of fact (epistemic ops coded only in `nars_engine.rs:194-207` and ABSENT at lgj-abi; `TruthU8` ruled canonical while four truth types coexist and the executing engine uses `ndarray::hpc::nars::NarsTruth`; the `Plan` tree illustrative while `LgjOpDesc` is a flat AND/OR with two opcodes); and a second factual error in a row the PR rewrote (`WideFieldMask` claimed where `FieldMask` is wired). **Savant 4 caught a defect in the SPEC itself** — G7's `cargo clippy -p` cannot resolve a workspace-EXCLUDED crate; amended to `--manifest-path`. +- **Phase 2 — consolidate FIRST (orchestrator, before any reviewer existed):** draft v2 = spec + change ledger, findings grouped by disease rather than by author, 9 cleared risks recorded so they are not re-audited, and one conflicting verdict-GROUND amended while its VERDICT stood (the competence-sentence miss is the `I-LEGACY-API-FEATURE-GATED` shape — a term whose referent widened with no gate or alias — not an axis contradiction). Raw savant output banked in the session scratchpad, never forwarded. +- **Phase 3 — the 3 on draft v2 ONLY (overclaim / dilution-collapse / firewall), and they caught the council:** **BLOCK(P0) ×2** from the firewall — the draft had imported a verbatim quotation from a PRIVATE repository as review grounds, and resolution R5 would have carried it into a PUBLIC commit; **FIX(P1)** from the overclaim auditor — the draft cited the verdict-map row **one line off** and stamped it "orchestrator-verified", so the fix would have added the new verdict to the wrong warden; **FIX(P2) ×3** from the sentinel, the sharpest being that merging six sites into "one disease" diluted the severity of the one site that governs whether a card FIRES AT ALL. Both BLOCKs were **resolved, not argued away**: the private-repo citation is gone entirely (the finding survives generically — *a doc asserting the WIDE variant of a type while the code wires the NARROW one is invisible to every test*), and the D-BBB-NARS-2 scope correction quotes its own losing text as a dated ⊘ rather than mutating it. +- **Phase 5 — landed (v3):** doctrine gains § "What is ruled vs what is coded" (the no-structural-gate statement, the four-truth-type table, the not-at-T1 hedge) + ledger row **L8 marked OPEN, not CLOSED**; `ARITHMETIC-SURFACE` added to the verdict map at the CORRECT row; both competence sentences and `bbb-warden`'s description widened; `Mask × WideFieldMask → Mask` → the shipped `FieldMask` (two sites); the F-A quotation restored verbatim; three missing citations added (lgj `abi.md` §6 twice, `abi-membrane-warden` once); step 4 gained its **silence half** on the card instead of merely derivable; **new D-BBB-NARS-4** (truth-type convergence, *do not pre-build*). +- **Gates:** `append_only_gate.py origin/main` OK · `citation_decay.py --since origin/main` no new decay · supersession index regenerated **LAST** · G9 (every B1 site fixed or named a control case) met — `EPIPHANIES.md:53` is the recorded control case, correct in past tense, deliberately untouched. +- **The one `.rs` touch, verified by running rather than by assertion:** `translator.rs` (R16) is a doc-comment-only change (confirmed by diff: every changed line is a `///`). It was initially UNVERIFIABLE here — the crate path-deps `/home/user/ndarray`, absent from the container, so clippy died at dependency resolution and the limitation was recorded as such. The operator then supplied the sibling; cloned to the path the path-dep expects (`b9afcb9`, 121 MB) and re-run: **`cargo clippy --manifest-path … --all-targets -- -D warnings` exit 0 (8.85 s, 26 packages), `cargo test --manifest-path …` 42/42, 0 failed suites, doctests included.** `CARGO_PROFILE_DEV_DEBUG=0 CARGO_INCREMENTAL=0` throughout; disk unchanged at 17 G. +- **One gate leg still red, and deliberately left red:** `cargo fmt --check` on that crate fails on **pre-existing** debt — 33 sites across 8 files. The single `translator.rs` hit is at the shifted line 234, byte-identical to `HEAD`, i.e. not mine; reformatting 8 unrelated files would balloon a doctrine PR well past its scope. The crate is workspace-EXCLUDED with **zero CI coverage**, so no pipeline lints it either way — which is why B6 amended G7's invocation to `--manifest-path` in the first place. Nothing was merged; a human merges. + ## 2026-09-07 — D-SPG-1: one Sonnet worker from a 60-line spec, orchestrator-gated (contract `AlphaMask::{words, from_words}`) - **Worker (Sonnet, `general-purpose`, edit-only, guardrails §1 verbatim, one file `crates/lance-graph-contract/src/alpha.rs`):** two methods after `materialize_ordinals`, three tests in the existing module; reported its own unverified items honestly ("not compiled, not run — orchestrator gates"; `PartialEq` presence checked by reading the derive). diff --git a/.claude/board/EPIPHANIES.md b/.claude/board/EPIPHANIES.md index 59611be4e..82787c63b 100644 --- a/.claude/board/EPIPHANIES.md +++ b/.claude/board/EPIPHANIES.md @@ -61,6 +61,52 @@ behavior handles below; T1 algebra (population ‖ epistemic); T0 state. No VSA no RoleKey, no NARS arithmetic, no byte positions, no truth arrays, no Java compute path. Only names and capabilities. The widening makes the doctrine MORE general, not more permissive. + +**⊕ 2026-09-10 — hardened by a 5+3 council before merge (5 savants → draft → 3 reviewers).** +The ruling is unchanged; the council was a compliance audit, not a re-litigation, and it +found no contradiction of the ruling. What it found was that this entry and its doctrine +widened the CONTENT and left every INDEX of it stale, and that three sentences stated +aspiration in the grammar of fact. Corrected in the same commit: + +1. **The rename was never propagated.** Both warden cards' *constitutional* sentence + ("your entire competence is the vocabulary of the two tiers you separate … and nothing + else") still named `T2 selection`, and `bbb-warden`'s frontmatter `description` — the + text that decides whether the card FIRES AT ALL — was never widened to name the + epistemic algebra, though its sibling's was. A non-firing trigger is a strictly worse + failure than a card that misdescribes itself after firing; both are fixed. + `membrane-tiers.md`'s agent→membrane map also still listed three `bbb-warden` verdicts, + so the doctrine did not know about the fourth verdict this arc added. +2. **The epistemic column has no STRUCTURAL gate**, only review notes — and the doctrine's + own test is *"a membrane without a gate is prose."* `F-BBB-NARS-1` cannot be exercised + today either (zero Java-side truth surface). Now stated plainly, with the gate that will + hold it named and its dependency recorded, plus ledger row **L8**, marked OPEN rather + than CLOSED. The two new card steps ARE real and discriminating — each catches a body + every signature-shaped step passes, and each has a sanctioned silent case — but a review + note is not a fence. +3. **`TruthU8` is the ruled TARGET, not the current state.** Four truth types coexist, and + the engine that actually executes revision/deduction/abduction uses a different one + (`ndarray::hpc::nars::NarsTruth`, aliased `Truth`); `TruthU8` occurs outside its own + crate in exactly one file, a test, with no conversion path. The ruling stands; its + migration is now visible as **D-BBB-NARS-4** instead of implied. Likewise the named + epistemic primitives are coded only in `lance-graph-planner`'s `nars_engine.rs` and are + ABSENT at the lgj-abi T1 membrane, and the `Plan` tree is illustrative — `plan_eval` + takes a flat AND/OR `LgjOpDesc` with two opcodes and no Truth opcode. +4. **Two factual errors were carried past in a row this arc rewrote**: `Mask × WideFieldMask + → Mask` — the shipped type is plain `FieldMask`, the wide one does not cross the ABI — + and a `bbb-warden` sentence presented in quotation marks that was a paraphrase, not the + source string. Both corrected. The first is a **recurring workspace defect shape** worth + naming in the abstract: a doc asserting the WIDE variant of a type while the code wires + the NARROW one is invisible to every test, because on today's data the two agree. + +**`E-NXG-8` is not regraded** — its claim is scoped *"a complete cognitive ISA **over +masks**"*, so the two-algebras doctrine BOUNDS it to the population column rather than +contradicting it. + +**The council's own artifact carried the same defect it was auditing:** the consolidated +draft cited the verdict-map row one line off and stamped it "orchestrator-verified", which +would have added the new verdict to the wrong warden. The overclaim reviewer caught it. +That is the argument for the reviewer phase being non-optional, recorded because the next +session will be tempted to skip it. ## 2026-09-07 — E-A-DYNAMIC-DOMAIN-MASK-IS-A-SECOND-WITNESS-AND-ITS-ALIGNMENT-IS-CALIBRATION-1 — the "horseshoe" was a category error; the equality I called a coincidence is a known-answer target **Status:** OPERATOR RULING (2026-09-07, two messages: *"horseshoe mask is a diff --git a/.claude/board/STATUS_BOARD.md b/.claude/board/STATUS_BOARD.md index 4a5ee02ea..9e4dacc8c 100644 --- a/.claude/board/STATUS_BOARD.md +++ b/.claude/board/STATUS_BOARD.md @@ -8,8 +8,9 @@ NARS lowers through the `plan_eval` membrane that already exists. | D-id | scope | status | gate / falsifier | |---|---|---|---| | D-BBB-NARS-1 | NARS truth arithmetic remains substrate-owned. G11/T3 may carry only typed NARS **syntax** and **opaque substrate handles**. NARS execution lowers through the existing bulk plan-evaluation membrane; no Java-side arithmetic and no materialized truth population crosses Panama. `TruthU8` is the canonical SUBSTRATE representation; cross-membrane results are handles (`TruthLaneId(u64)`). Any required G11 expansion SHALL expose syntax/vocabulary only, never an arithmetic implementation surface — one scalpel cut, never the cupboard | **Ruled 2026-09-07** (operator). Doctrine landed; no code. `lgj_score_*` explicitly REJECTED — extend the plan language, not the ABI surface | **F-BBB-NARS-1:** fail if Java can implement, inspect, iterate, or reconstruct NARS truth arithmetic without invoking the substrate, OR if a truth population crosses G11/Panama other than as an opaque handle | -| D-BBB-NARS-2 | The syntax/vocabulary contract the G11 fence would admit: split the POD/vocabulary half of `lance_graph_contract::nars` from its arithmetic half, so the fence can widen by one module without admitting an implementation surface | Queued — gates on a consumer actually needing it; **do not pre-build** | the admitted module contains no arithmetic (a function that computes a truth from truths); `ALLOWED` grows in all three spellings in ONE commit | -| D-BBB-NARS-3 | `Truth(…)` as a named `plan_eval` operation (Revision / Deduction / Abduction / …), returning `TruthLaneId`, never an array | Queued — gates on D-BBB-NARS-2 | one crossing per behavioral expression regardless of operand count (the §6 bulk-or-lifecycle law); a `[TruthU8]` return is an automatic fail | +| D-BBB-NARS-2 | The syntax/vocabulary contract the G11 fence would admit, **if one turns out to be needed at all**. ⊘ **Scope corrected pre-merge by the 5+3 council, 2026-09-10** — the original read *"split the POD/vocabulary half of `lance_graph_contract::nars` from its arithmetic half"*, which presumes an arithmetic half that **does not exist**: measured, `crates/lance-graph-contract/src/nars.rs` exports three POD enums (`InferenceType`, `QueryStrategy`, `SemiringChoice`) plus `InferenceType::default_strategy()` (enum→enum), `InferenceType::from_mantissa(i8)` (decode) and one `From` impl — no function computes a truth FROM truths, and the arithmetic (`arm_to_truth_u8`) lives in a different crate. So the first step is an AUDIT, not a split: re-measure, and if the module is still arithmetic-free, the fence may be widenable as-is | Queued — gates on a consumer actually needing it; **do not pre-build** | the admitted module contains no arithmetic (a function that computes a truth from truths); `ALLOWED` grows in all three spellings in ONE commit | +| D-BBB-NARS-4 | **Truth-type convergence.** `D-BBB-NARS-1` rules `TruthU8` canonical at T0, but four truth types coexist and the executing engine uses a different one. Converge them onto the ruled canonical type, or record the rule by which they legitimately coexist. Measured 2026-09-10: `exploration::NarsTruth` (f32×2, `lance-graph-contract/src/exploration.rs:89`), `holograph::width_16k::schema::NarsTruth` (u16×2 packed, `:104`), `ndarray::hpc::nars::NarsTruth` (aliased `Truth`, `lance-graph-planner/src/cache/triple_model.rs:42` — **what `nars_engine.rs` actually executes against**), `arm-discovery::TruthU8` (u8×2, `translator.rs:28`, which occurs outside its own crate in exactly one file, a test) | Queued — discovered by the 5+3 council on #1222; **do not pre-build**, it gates on a consumer needing the bridge | a single named conversion path exists from the executing engine's truth type to `TruthU8`, **or** the doctrine names the coexistence rule and why four is correct | +| D-BBB-NARS-3 | `Truth(…)` as a named `plan_eval` operation (Revision / Deduction / Abduction / …), returning `TruthLaneId`, never an array | Queued — gates on D-BBB-NARS-2 | one crossing per behavioral expression regardless of operand count (the bulk-or-lifecycle law, lgj `docs/abi.md` §6); a `[TruthU8]` return is an automatic fail | ## spog-alpha-channel-v1 (D-ids minted 2026-09-07 with the spec) diff --git a/.claude/knowledge/membrane-tiers.md b/.claude/knowledge/membrane-tiers.md index c36f1c395..d286e1c6f 100644 --- a/.claude/knowledge/membrane-tiers.md +++ b/.claude/knowledge/membrane-tiers.md @@ -19,8 +19,8 @@ substrate beneath them is T0. | Tier | What it is | May know | Crosses UP as | The membrane (gate) | |---|---|---|---|---| | **T0 substrate** | bytes, lanes, Lance columns, SoA v3 rows; `simd_{avx512,avx2,neon,scalar}.rs` | strides, offsets, carvings, intrinsics, alignment | — | none; T0 is where truth lives | -| **T1 primitive** | TWO SIBLING ALGEBRAS (2026-09-07, below): **population** — `ndarray::simd` facade, `lgj-abi/kernels.rs`, `mask_*`, `eq_*_to_mask`, `ternlog`, `popcount`; **epistemic** — `TruthU8`, revision, deduction, abduction, … | `&[u64]`, `&[u8]`+`(offset,stride)`, `IMM`, `TruthU8` | a mask, a count, a lane descriptor, **a truth lane DESCRIPTOR (`TruthLaneId`) — never the population** | **polyfill rule** (simd-savant): no intrinsic, no `#[cfg(target_arch)]` above this line | -| **T2 behavior** (was "selection") | ABI exports; `where`/`hop`/`plan_eval`; `Mask × WideFieldMask → Mask`; **and the epistemic siblings, named through the same `plan_eval`** | handles, `classid`, `FieldMask` (fields by NAME), version | a handle, a count, a status | **no hand-composed T1 op, no computed geometry** (kernel-membrane-warden) | +| **T1 primitive** | TWO SIBLING ALGEBRAS (2026-09-07, below): **population** — `ndarray::simd` facade, `lgj-abi/kernels.rs`, `mask_*`, `eq_*_to_mask`, `ternlog`, `popcount`; **epistemic** — `TruthU8`, revision, deduction, abduction, … *(RULED, NOT YET RESIDENT — see § "What is ruled vs what is coded" below: these four are coded only in `lance-graph-planner`'s `nars_engine.rs`, and are ABSENT at the lgj-abi T1 membrane)* | `&[u64]`, `&[u8]`+`(offset,stride)`, `IMM`, `TruthU8` | a mask, a count, a lane descriptor, **a truth lane DESCRIPTOR (the `TruthLaneId` shape D-BBB-NARS-3 would mint — prescriptive, 0 code sites today) — never the population** | **polyfill rule** (simd-savant): no intrinsic, no `#[cfg(target_arch)]` above this line | +| **T2 behavior** (was "selection") | ABI exports; `where`/`hop`/`plan_eval`; `Mask × FieldMask → Mask` *(the shipped type; `WideFieldMask` does not cross the ABI — lgj `fixture.rs:1-6` calls wiring it "a later slice", and `class_view_provider.rs:64,235` wires plain `FieldMask`)*; **and the epistemic siblings, named through the same `plan_eval`** | handles, `classid`, `FieldMask` (fields by NAME), version, **a truth LITERAL (`TruthLiteral`) — never a truth population** | a handle, a count, a status | **no hand-composed T1 op, no computed geometry** (kernel-membrane-warden) | | **T3 intent** | Java facade; R2IL / OGAR `ActionDef`; low-code | names: class, edge, field, version | an outcome | **no byte position** (bbb-warden + ApiSurfaceTest) | | **R2IL** | emits T3 artifacts | T3's vocabulary (names, outcomes) | an outcome | its ceiling IS T3's; door-knocker test (layer-boundary-warden) | @@ -106,10 +106,14 @@ Java knowing progressively more about the behavior graph. **The membrane starts growing little computational fingers.** `lgj_plan_eval` exists precisely so a whole behavioral expression crosses ONCE. +(That rule is not new here — it restates lgj `docs/abi.md` §6, which already says the +fused-plan call exists "precisely so that `.where(...).where(...).count()` is **one** +crossing regardless of how many predicates or rows." What is new is extending it to +the epistemic column.) NARS becomes another named plan operation, not another export: ``` -Plan +Plan ← ILLUSTRATIVE. Not a type that exists today. ├── Select(…) ├── Hop(…) ├── Ternlog(…) @@ -120,6 +124,16 @@ Plan └── … ``` +**Read that as the shape `D-BBB-NARS-3` would mint, not as a description of the +code.** Measured 2026-09-10 across both checkouts: `enum Plan` / `Plan::Select` / +`Plan::Hop` / `Plan::Ternlog` / `Plan::Truth` have **zero hits**; `lgj_hop` +(`exports.rs:1703`) is an ABI function, not a tree variant. `lgj_plan_eval` IS +shipped and tested (`exports.rs:1421,1522,1547`; `abi.rs:246-251,337`), but its +`LgjOpDesc` is a **flat array with a combined AND/OR — not a tree** — and its +opcode set is exactly `{LGJ_OP_EQ_U32 = 1, LGJ_OP_GT_I32 = 2}` (`abi.rs:250,252`), +with **no Truth/Revision opcode**. So "a whole behavioral expression crosses ONCE" +is CODED for population predicates and RULED-BUT-UNBUILT for the epistemic side. + ### `TruthU8` is the canonical SUBSTRATE representation — not automatically the wire form These are two different claims and the workspace had been conflating them. @@ -132,8 +146,8 @@ What crosses is decided separately, and by shape: | a truth LITERAL, `TruthLiteral(192, 217)` | **yes** — it is meaning supplied by the caller, syntax, T3's to state | itself | | a truth POPULATION, `[TruthU8; 65536]` | **never** | `TruthLaneId(u64)` — an opaque 8-byte descriptor | -This is the same rule `bbb-warden` already enforces for masks (*"a `long[]` of -selected ids is still a materialised population"*), applied to the epistemic +This is the same rule `bbb-warden` already enforces for masks (*"a `long[]` of row ids is a +materialised population"*, `bbb-warden.md:32`), applied to the epistemic column — and it lands exactly on the measured Valhalla cliff: **flattening stops at an 8-byte payload** (VM-confirmed, `valhalla-lab/docs/three-truths.md`), so a `TruthLaneId(u64)` flattens and a truth array could never. The JVM agrees with @@ -151,6 +165,52 @@ lgj `CLAUDE.md § Enforcement`, `Cargo.toml`'s comment) — the shape lgj alread requires, and the reason its own history records the fence being prose until 2026-09-03 (`ISS-LGJ-G11-FENCE-WAS-PROSE`). +### What is ruled vs what is coded (measured 2026-09-10 by the 5+3 council) + +The ruling above is binding. Most of what it rules is **not yet resident**, and this +section exists so no future session mistakes a decision for an accomplished fact. +The doctrine's own test is three sections down: *"A membrane without a gate is prose."* + +**1. The epistemic column has NO structural gate — yet.** Each membrane is held by a +structural gate: T0/T1 by the simd-savant grep + the `ndarray::simd` re-export, T1/T2 +by the G11 import fence + `kernels.rs` as sole ndarray importer, T2/T3 by +`ApiSurfaceTest`'s forbidden-type list + the array-return naming rule. **The epistemic +column adds none of these.** What it adds — `bbb-warden` step 4, `kernel-membrane-warden` +step 2b — are *review notes*, which property 1 below explicitly distinguishes from gates. +Both steps are real and discriminating (each catches a body that every signature-shaped +step passes, and each has a sanctioned silent case), but a review note is not a fence. +`F-BBB-NARS-1` likewise cannot be exercised today: grep across lgj@`8720d1d` `native/` +and `java/` for `TruthU8`/`revision`/`deduction`/`abduction`/`induction` returns **zero +hits**, so there is no Java surface to run it against. **The gate that will hold this +column is `ApiSurfaceTest`'s forbidden-type list plus a G11 allowlist entry, and it is +gated on D-BBB-NARS-2/-3** — which are Queued and marked *do not pre-build*. Until then +this half of the membrane is enforced by review, and saying otherwise would be the exact +defect this arc keeps finding. + +**2. The named epistemic primitives are not at T1.** `revision`/`deduction`/`abduction`/ +`induction` are CODED, but only inside `crates/lance-graph-planner/src/cache/nars_engine.rs:194-207` +(`Inference::{Deduction,Induction,Abduction,Revision}`) — a planner-internal dispatch, +**not** a T1 primitive callable from T2 — and are ABSENT at the lgj-abi membrane +entirely. `kernel-membrane-warden` step 2b already states the consequence correctly +("if it does not exist at T1, it lands at T1 first"); the T1 row above now carries the +same hedge, which it did not when first written. + +**3. `TruthU8` is the RULED TARGET, and it has three incumbents.** The ruling makes +`TruthU8` canonical at T0. Measured, four truth types coexist today, each self-described +as canonical in some register: + +| type | shape | site | +|---|---|---| +| `exploration::NarsTruth` | `f32 × 2` | `lance-graph-contract/src/exploration.rs:89` | +| `holograph::width_16k::schema::NarsTruth` | `u16 × 2`, packed | `holograph/src/width_16k/schema.rs:104` | +| `ndarray::hpc::nars::NarsTruth` | — | aliased `Truth` at `lance-graph-planner/src/cache/triple_model.rs:42` | +| `arm-discovery::TruthU8` | `u8 × 2` | `lance-graph-arm-discovery/src/translator.rs:28` | + +**The engine that actually executes revision/deduction/abduction uses the third**, via +that alias. `TruthU8` occurs outside its own crate in exactly one file, a test. No +conversion path bridges them. So "T0 owns every resulting `TruthU8`" is the direction of +travel, not the current state — the convergence is tracked as **D-BBB-NARS-4**. + ### The ruling and its falsifier > **D-BBB-NARS-1.** NARS truth arithmetic remains substrate-owned. G11/T3 may @@ -214,7 +274,7 @@ catchable half. The warden proves the rest. |---|---|---|---| | T0/T1 | `simd-savant` | sonnet | POLYFILL-CLEAN / RAW-INTRINSIC / SHADOW-KERNEL | | T1/T2 | `kernel-membrane-warden` | opus | NAMED / HAND-COMPOSED / GEOMETRY-LEAK | -| T2/T3 | `bbb-warden` | opus | HANDLE-CLEAN / BYTE-POSITION / UNNAMED-BREACH | +| T2/T3 | `bbb-warden` | opus | HANDLE-CLEAN / BYTE-POSITION / UNNAMED-BREACH / ARITHMETIC-SURFACE | | T3/R2IL | `layer-boundary-warden` | opus | COMPILE-TIME-CLEAN / DOOR-KNOCKER / WRONG-SHELF | All membrane wardens above T0/T1 are Opus: leak detection is accumulation @@ -242,6 +302,7 @@ reject the old spelling once closed. `[OPEN]` until the gate rejects it. | L5 | `Engine.LaneWindow.setU64` — raw word write | `importRows` (named breach) is the only sanctioned writer | ApiSurfaceTest (internal.ffm already fenced from public) | CLOSED | | L6 | any future `byte[]` / `[u8;12]` rail array in a public signature | a named `Reading` value type OGAR emits per ClassView (Valhalla), read zero-copy | ApiSurfaceTest byte[]-fence (this PR) | CLOSED (forward guard) | | L7 | any future array return not named `materialize*`/`import*` | a named terminal | ApiSurfaceTest array-return naming rule (this PR) | CLOSED (forward guard) | +| L8 | any future truth POPULATION in a public signature — `TruthU8[]`, a truth lane, a collection of them — or any T3 body that computes a truth FROM truths | the `TruthLaneId(u64)` opaque descriptor for the population; a named `Truth(…)` `plan_eval` operation for the arithmetic | **OPEN — review-note only** (`bbb-warden` step 4 + ARITHMETIC-SURFACE). The structural gate (ApiSurfaceTest forbidden-type entry + G11 allowlist) is gated on D-BBB-NARS-2/-3 | OPEN (forward guard, ungated) | Provenance: the two fixes that produced this doctrine — the 7.5→1.1 ms `lgj_hop` (T1 doing T0's job badly: gathered a contiguous lane; fixed inside diff --git a/crates/lance-graph-arm-discovery/src/translator.rs b/crates/lance-graph-arm-discovery/src/translator.rs index 1ffe803dd..09738a6ad 100644 --- a/crates/lance-graph-arm-discovery/src/translator.rs +++ b/crates/lance-graph-arm-discovery/src/translator.rs @@ -22,8 +22,15 @@ use crate::rule::{CandidateRule, Item}; /// needed before confidence approaches saturation. pub const NARS_PERSONALITY_K: u32 = 1; -/// Quantised NARS truth — the canonical, float-free wire form (mirrors the -/// `CausalEdge64` `confidence_u8` + i4 mantissa fields). `255` = 1.0. +/// Quantised NARS truth — the canonical, float-free **substrate** representation +/// (mirrors the `CausalEdge64` `confidence_u8` + i4 mantissa fields). `255` = 1.0. +/// +/// Not "the wire form": that wording was retired by `D-BBB-NARS-1` (2026-09-07), +/// which separates two claims the workspace had been conflating. This type is +/// canonical at T0. What crosses a membrane is decided separately and by SHAPE — +/// a truth LITERAL may cross as itself; a truth POPULATION never crosses, it +/// crosses as an opaque descriptor. See `.claude/knowledge/membrane-tiers.md` +/// § "T1 has TWO sibling algebras". #[derive(Debug, Clone, Copy, PartialEq, Eq)] pub struct TruthU8 { /// NARS frequency, `0..=255` (255 = 1.0). From bc30aacab83971b54932c6de527cf6ee1634bf2d Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 10 Sep 2026 05:24:03 +0000 Subject: [PATCH 4/6] =?UTF-8?q?review:=20the=20Truth.Revision=20route=20is?= =?UTF-8?q?=20target=20behavior,=20not=20an=20available=20one=20=E2=80=94?= =?UTF-8?q?=20fixed=20at=20BOTH=20sites?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CodeRabbit (Major) on the EPIPHANIES entry: lines 35-39 stated in the present tense that plan_eval resolves Truth.Revision and T1 executes it, while the same entry's council addendum states the structural gate is absent and plan_eval has no Truth opcode. The entry published an unavailable capability as a working route and contradicted itself. The finding is correct. Reworded as the target route, with the gating condition named: T3 will name Truth.Revision and will not know how revision works -- that half is the ruling and is permanent -- and once the structural gate exists and plan_eval carries a Truth opcode (it carries {EQ_U32, GT_I32} today), T2 will resolve the name, T1 will execute, T0 will own the result. The membrane it lowers through is shipped; the operation that would travel it is not. Original sentence quoted in place rather than deleted, per the board's correction convention. Fixed at BOTH sites, not just the flagged one. The identical present-tense claim sat in membrane-tiers.md:96-98 and was not reported. Fixing only the reported copy would reproduce precisely the index-staleness disease the 5+3 council documented one commit earlier: a finding fixed at one site and left standing at its twin. Gates: append_only_gate OK; citation_decay no new decay; supersession index regenerated LAST, byte-identical. Docs only, no code. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_013S6AQs95K3rHymE3kAqZay --- .claude/board/EPIPHANIES.md | 17 ++++++++++++----- .claude/knowledge/membrane-tiers.md | 11 ++++++++--- 2 files changed, 20 insertions(+), 8 deletions(-) diff --git a/.claude/board/EPIPHANIES.md b/.claude/board/EPIPHANIES.md index 82787c63b..81540dc05 100644 --- a/.claude/board/EPIPHANIES.md +++ b/.claude/board/EPIPHANIES.md @@ -32,11 +32,18 @@ intent in either.** Every existing rule applies unchanged to the second column `kernel-membrane-warden`'s HAND-COMPOSED verdict covers a T2 spelling `revision` out of smaller truth ops exactly as it covers the two-AND spelling of `AND3`. -NARS lowers through the membrane that already exists: T3 names -`Truth.Revision(lhs_handle, rhs_handle)` and may not know how revision works; T2's -`plan_eval` resolves the name; T1 executes; T0 owns every resulting `TruthU8`. **Extend -the plan language, not the ABI surface** — `lgj_plan_eval` exists precisely so a whole -behavioral expression crosses once. +NARS lowers through the membrane that already exists — as a TARGET ROUTE, not an +available one. ⊘ **Corrected pre-merge 2026-09-10** (CodeRabbit, Major); the sentence +first read *"T3 names `Truth.Revision(...)` … T2's `plan_eval` resolves the name; T1 +executes; T0 owns every resulting `TruthU8`"*, present tense, which published an +unavailable capability as a working route and contradicted this entry's own ⊕ addendum +below. The route is: T3 will name `Truth.Revision(lhs_handle, rhs_handle)` and will not +know how revision works; **once the structural gate exists and `plan_eval` carries a +Truth opcode** — neither does today, and both gate on D-BBB-NARS-2/-3 — T2's `plan_eval` +will resolve the name, T1 will execute, and T0 will own every resulting `TruthU8`. The +membrane it lowers through is real and shipped; what is not yet built is the Truth +operation that would travel it. **Extend the plan language, not the ABI surface** — +`lgj_plan_eval` exists precisely so a whole behavioral expression crosses once. **A wording correction the ruling forces.** `TruthU8` had been called "the canonical wire form." Two different claims were being conflated: it is the canonical **substrate** diff --git a/.claude/knowledge/membrane-tiers.md b/.claude/knowledge/membrane-tiers.md index d286e1c6f..5b20a7067 100644 --- a/.claude/knowledge/membrane-tiers.md +++ b/.claude/knowledge/membrane-tiers.md @@ -93,9 +93,14 @@ T1 epistemic primitives (beside the population primitives) T0 TruthU8 lanes / rows / history / state ``` -T3 may say `Truth.Revision(lhs_handle, rhs_handle)`. **It may not know how -revision works.** T2 resolves the name; T1 executes the arithmetic; T0 owns -every resulting `TruthU8`. +**Target route, not an available one.** T3 will say +`Truth.Revision(lhs_handle, rhs_handle)`, and **will not know how revision +works** — that part is the ruling and is permanent. The rest is not yet built: +once the structural gate exists and `plan_eval` carries a Truth opcode (it +carries `{EQ_U32, GT_I32}` today and no Truth opcode; both gate on +D-BBB-NARS-2/-3), T2 will resolve the name, T1 will execute the arithmetic, and +T0 will own every resulting `TruthU8`. The membrane above is shipped; the +operation that would travel it is not. See § "What is ruled vs what is coded". ### Extend the plan language, NOT the ABI surface From f735ad745609292e41daf2bafe51e7b9f1152126 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 10 Sep 2026 05:29:52 +0000 Subject: [PATCH 5/6] =?UTF-8?q?board:=20D-BBB-NARS-4=20is=20a=20precision?= =?UTF-8?q?=20ladder,=20not=20a=20collapse=20=E2=80=94=20and=20there=20are?= =?UTF-8?q?=20five=20truth=20types,=20not=20four?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Reframed on an operator question: are the coexisting truth types distinct truths, or one truth at several precisions? Measured: all five carry the same two axes, (frequency, confidence). They are one kind of NARS truth at four precisions -- register u8, storage u16, compute f32 -- so the deliverable is "one canonical per tier, named lifts between tiers, no bare casts", not "converge onto TruthU8". The ruling (TruthU8 canonical at T0) is consistent with a ladder and is unchanged. The count was wrong: the council found four and missed lance-graph-planner/src/nars/truth.rs::TruthValue, the belief-arena type. Five, listed with sites. The genuinely distinct truths -- grammatical validity, causal-trajectory provenance -- are not on the ladder and enter it only by a named constructor (precedent: tesseract-rs sentence_nars_truth). Same axes does not prove same semantics: ndarray clamps confidence to [0, 0.9999], and the u16/u8 mappings have not been read side by side, so step 1 is an audit of the mappings, never a merge. Falsifier tightened: a bare `as` cast between any two of the five is an automatic fail. Losing text quoted in place. Docs only. Gates: append_only OK, no new citation decay, supersession index regenerated last. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_013S6AQs95K3rHymE3kAqZay --- .claude/board/STATUS_BOARD.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.claude/board/STATUS_BOARD.md b/.claude/board/STATUS_BOARD.md index 9e4dacc8c..bc72a4d6e 100644 --- a/.claude/board/STATUS_BOARD.md +++ b/.claude/board/STATUS_BOARD.md @@ -9,7 +9,7 @@ NARS lowers through the `plan_eval` membrane that already exists. |---|---|---|---| | D-BBB-NARS-1 | NARS truth arithmetic remains substrate-owned. G11/T3 may carry only typed NARS **syntax** and **opaque substrate handles**. NARS execution lowers through the existing bulk plan-evaluation membrane; no Java-side arithmetic and no materialized truth population crosses Panama. `TruthU8` is the canonical SUBSTRATE representation; cross-membrane results are handles (`TruthLaneId(u64)`). Any required G11 expansion SHALL expose syntax/vocabulary only, never an arithmetic implementation surface — one scalpel cut, never the cupboard | **Ruled 2026-09-07** (operator). Doctrine landed; no code. `lgj_score_*` explicitly REJECTED — extend the plan language, not the ABI surface | **F-BBB-NARS-1:** fail if Java can implement, inspect, iterate, or reconstruct NARS truth arithmetic without invoking the substrate, OR if a truth population crosses G11/Panama other than as an opaque handle | | D-BBB-NARS-2 | The syntax/vocabulary contract the G11 fence would admit, **if one turns out to be needed at all**. ⊘ **Scope corrected pre-merge by the 5+3 council, 2026-09-10** — the original read *"split the POD/vocabulary half of `lance_graph_contract::nars` from its arithmetic half"*, which presumes an arithmetic half that **does not exist**: measured, `crates/lance-graph-contract/src/nars.rs` exports three POD enums (`InferenceType`, `QueryStrategy`, `SemiringChoice`) plus `InferenceType::default_strategy()` (enum→enum), `InferenceType::from_mantissa(i8)` (decode) and one `From` impl — no function computes a truth FROM truths, and the arithmetic (`arm_to_truth_u8`) lives in a different crate. So the first step is an AUDIT, not a split: re-measure, and if the module is still arithmetic-free, the fence may be widenable as-is | Queued — gates on a consumer actually needing it; **do not pre-build** | the admitted module contains no arithmetic (a function that computes a truth from truths); `ALLOWED` grows in all three spellings in ONE commit | -| D-BBB-NARS-4 | **Truth-type convergence.** `D-BBB-NARS-1` rules `TruthU8` canonical at T0, but four truth types coexist and the executing engine uses a different one. Converge them onto the ruled canonical type, or record the rule by which they legitimately coexist. Measured 2026-09-10: `exploration::NarsTruth` (f32×2, `lance-graph-contract/src/exploration.rs:89`), `holograph::width_16k::schema::NarsTruth` (u16×2 packed, `:104`), `ndarray::hpc::nars::NarsTruth` (aliased `Truth`, `lance-graph-planner/src/cache/triple_model.rs:42` — **what `nars_engine.rs` actually executes against**), `arm-discovery::TruthU8` (u8×2, `translator.rs:28`, which occurs outside its own crate in exactly one file, a test) | Queued — discovered by the 5+3 council on #1222; **do not pre-build**, it gates on a consumer needing the bridge | a single named conversion path exists from the executing engine's truth type to `TruthU8`, **or** the doctrine names the coexistence rule and why four is correct | +| D-BBB-NARS-4 | **Truth-type LADDER — one canonical per tier, named lifts, no casts.** ⊘ **Reframed pre-merge 2026-09-10** (operator question: are these distinct truths, or one truth at several precisions?); the row first read *"four truth types coexist … Converge them onto the ruled canonical type"* — the count was wrong and the verb was wrong. Measured: **five** NARS `(frequency, confidence)` types, and every one carries the SAME two axes — `lance-graph-contract/src/exploration.rs:89` (f32×2), `lance-graph-planner/src/nars/truth.rs:10` (f32×2, the belief-arena type), `ndarray::hpc::nars::NarsTruth` (f32×2, aliased `Truth` at `lance-graph-planner/src/cache/triple_model.rs:42` — what `nars_engine.rs` executes against), `holograph/src/width_16k/schema.rs:104` (u16×2 packed), `lance-graph-arm-discovery/src/translator.rs:28` (`TruthU8`, u8×2, ruled canonical at T0). Same axes ⇒ these are ONE kind of truth at four precisions — a ladder by tier (register u8 / storage u16 / compute f32), not five kinds. The genuinely distinct truths (grammatical validity, causal-trajectory provenance) are NOT on this ladder and enter it only by a named constructor — the precedent is tesseract-rs `sentence_nars_truth`. **Same axes does NOT prove same semantics:** ndarray clamps confidence to `[0, 0.9999]`; the u16 and u8 mappings have not been read side by side. So step 1 is an AUDIT of the five mappings, never a merge | Queued — discovered by the 5+3 council on #1222, reframed on operator question; **do not pre-build**, it gates on a consumer needing a cross-tier bridge | one named, lossless-upward lift per tier boundary (`u8 → f32` widen; `f32 → u16`/`f32 → u8` pack under a named quantizer), zero bare `as` casts between any two of the five, **or** the doctrine states why a given tier legitimately holds two; a bare cast found anywhere is an automatic fail | | D-BBB-NARS-3 | `Truth(…)` as a named `plan_eval` operation (Revision / Deduction / Abduction / …), returning `TruthLaneId`, never an array | Queued — gates on D-BBB-NARS-2 | one crossing per behavioral expression regardless of operand count (the bulk-or-lifecycle law, lgj `docs/abi.md` §6); a `[TruthU8]` return is an automatic fail | ## spog-alpha-channel-v1 (D-ids minted 2026-09-07 with the spec) From ed0f7ee1d03076bcda23f5b252a12104ce403111 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 10 Sep 2026 05:35:12 +0000 Subject: [PATCH 6/6] =?UTF-8?q?board:=20D-BBB-NARS-4=20=E2=80=94=20three?= =?UTF-8?q?=20scalar=20widths,=20not=20"four=20precisions";=20"lossless"?= =?UTF-8?q?=20claimed=20nowhere=20until=20audited?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CodeRabbit (Major) on the reframe pushed ten minutes earlier, both findings correct and both mine: 1. The row said five representations form "four precisions". They share three scalar widths -- f32 (three of the five), u16, u8. The "four" was a leftover from the four-type count the same commit had just corrected to five. Now: five representations, three widths, not five kinds. 2. The falsifier promised a "lossless-upward lift per tier boundary" while prescribing f32 -> u16 and f32 -> u8 packing -- downward quantization, lossy by construction -- and in the same row said the mappings still need auditing. A blanket "lossless" before the audit that would prove it is the overclaim the council spent the day removing elsewhere. Now each direction carries its own grade: widening u8/u16 -> f32 is round-trip- exact but the f32 is a rounded rational, so not called lossless; packing is a named quantizer, lossy; dequantizing u16 -> f32 is the named inverse of the pack, not an identity. "Lossless" is claimed for no mapping until the audit proves that specific one, and an unaudited "lossless" is itself an automatic fail. Losing text quoted in place. Docs only. Gates: append_only OK, no new citation decay, supersession index regenerated last. Second time today a self-correction introduced a fresh error the reviewer caught (the first was the council's off-by-one row citation). Recorded rather than hidden. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_013S6AQs95K3rHymE3kAqZay --- .claude/board/STATUS_BOARD.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.claude/board/STATUS_BOARD.md b/.claude/board/STATUS_BOARD.md index bc72a4d6e..281da6395 100644 --- a/.claude/board/STATUS_BOARD.md +++ b/.claude/board/STATUS_BOARD.md @@ -9,7 +9,7 @@ NARS lowers through the `plan_eval` membrane that already exists. |---|---|---|---| | D-BBB-NARS-1 | NARS truth arithmetic remains substrate-owned. G11/T3 may carry only typed NARS **syntax** and **opaque substrate handles**. NARS execution lowers through the existing bulk plan-evaluation membrane; no Java-side arithmetic and no materialized truth population crosses Panama. `TruthU8` is the canonical SUBSTRATE representation; cross-membrane results are handles (`TruthLaneId(u64)`). Any required G11 expansion SHALL expose syntax/vocabulary only, never an arithmetic implementation surface — one scalpel cut, never the cupboard | **Ruled 2026-09-07** (operator). Doctrine landed; no code. `lgj_score_*` explicitly REJECTED — extend the plan language, not the ABI surface | **F-BBB-NARS-1:** fail if Java can implement, inspect, iterate, or reconstruct NARS truth arithmetic without invoking the substrate, OR if a truth population crosses G11/Panama other than as an opaque handle | | D-BBB-NARS-2 | The syntax/vocabulary contract the G11 fence would admit, **if one turns out to be needed at all**. ⊘ **Scope corrected pre-merge by the 5+3 council, 2026-09-10** — the original read *"split the POD/vocabulary half of `lance_graph_contract::nars` from its arithmetic half"*, which presumes an arithmetic half that **does not exist**: measured, `crates/lance-graph-contract/src/nars.rs` exports three POD enums (`InferenceType`, `QueryStrategy`, `SemiringChoice`) plus `InferenceType::default_strategy()` (enum→enum), `InferenceType::from_mantissa(i8)` (decode) and one `From` impl — no function computes a truth FROM truths, and the arithmetic (`arm_to_truth_u8`) lives in a different crate. So the first step is an AUDIT, not a split: re-measure, and if the module is still arithmetic-free, the fence may be widenable as-is | Queued — gates on a consumer actually needing it; **do not pre-build** | the admitted module contains no arithmetic (a function that computes a truth from truths); `ALLOWED` grows in all three spellings in ONE commit | -| D-BBB-NARS-4 | **Truth-type LADDER — one canonical per tier, named lifts, no casts.** ⊘ **Reframed pre-merge 2026-09-10** (operator question: are these distinct truths, or one truth at several precisions?); the row first read *"four truth types coexist … Converge them onto the ruled canonical type"* — the count was wrong and the verb was wrong. Measured: **five** NARS `(frequency, confidence)` types, and every one carries the SAME two axes — `lance-graph-contract/src/exploration.rs:89` (f32×2), `lance-graph-planner/src/nars/truth.rs:10` (f32×2, the belief-arena type), `ndarray::hpc::nars::NarsTruth` (f32×2, aliased `Truth` at `lance-graph-planner/src/cache/triple_model.rs:42` — what `nars_engine.rs` executes against), `holograph/src/width_16k/schema.rs:104` (u16×2 packed), `lance-graph-arm-discovery/src/translator.rs:28` (`TruthU8`, u8×2, ruled canonical at T0). Same axes ⇒ these are ONE kind of truth at four precisions — a ladder by tier (register u8 / storage u16 / compute f32), not five kinds. The genuinely distinct truths (grammatical validity, causal-trajectory provenance) are NOT on this ladder and enter it only by a named constructor — the precedent is tesseract-rs `sentence_nars_truth`. **Same axes does NOT prove same semantics:** ndarray clamps confidence to `[0, 0.9999]`; the u16 and u8 mappings have not been read side by side. So step 1 is an AUDIT of the five mappings, never a merge | Queued — discovered by the 5+3 council on #1222, reframed on operator question; **do not pre-build**, it gates on a consumer needing a cross-tier bridge | one named, lossless-upward lift per tier boundary (`u8 → f32` widen; `f32 → u16`/`f32 → u8` pack under a named quantizer), zero bare `as` casts between any two of the five, **or** the doctrine states why a given tier legitimately holds two; a bare cast found anywhere is an automatic fail | +| D-BBB-NARS-4 | **Truth-type LADDER — one canonical per tier, named lifts, no casts.** ⊘ **Reframed pre-merge 2026-09-10** (operator question: are these distinct truths, or one truth at several precisions?); the row first read *"four truth types coexist … Converge them onto the ruled canonical type"* — the count was wrong and the verb was wrong. Measured: **five** NARS `(frequency, confidence)` types, and every one carries the SAME two axes — `lance-graph-contract/src/exploration.rs:89` (f32×2), `lance-graph-planner/src/nars/truth.rs:10` (f32×2, the belief-arena type), `ndarray::hpc::nars::NarsTruth` (f32×2, aliased `Truth` at `lance-graph-planner/src/cache/triple_model.rs:42` — what `nars_engine.rs` executes against), `holograph/src/width_16k/schema.rs:104` (u16×2 packed), `lance-graph-arm-discovery/src/translator.rs:28` (`TruthU8`, u8×2, ruled canonical at T0). Same axes ⇒ these are ONE kind of truth over **three scalar widths** — u8 (register), u16 (storage), f32 (compute; three of the five types share it) — so **five representations, three widths, not five kinds**. ⊘ 2026-09-10, same day (CodeRabbit, Major): this sentence first said *"four precisions"* — a leftover from the four-type count — and the falsifier below first promised a *"lossless-upward lift per tier boundary"* while prescribing `f32 → u16`/`u8` packing, which is downward quantization and lossy; both corrected, losing text kept here. The genuinely distinct truths (grammatical validity, causal-trajectory provenance) are NOT on this ladder and enter it only by a named constructor — the precedent is tesseract-rs `sentence_nars_truth`. **Same axes does NOT prove same semantics:** ndarray clamps confidence to `[0, 0.9999]`; the u16 and u8 mappings have not been read side by side. So step 1 is an AUDIT of the five mappings, never a merge | Queued — discovered by the 5+3 council on #1222, reframed on operator question; **do not pre-build**, it gates on a consumer needing a cross-tier bridge | one NAMED conversion per direction per boundary, each carrying its own honesty grade: **widening** `u8 → f32` / `u16 → f32` is round-trip-exact (the integer is recovered) but the f32 is a rounded rational (`x/255` is not representable), so it is never called lossless; **packing** `f32 → u16` / `f32 → u8` is a named quantizer and lossy by construction; **dequantizing** `u16 → f32` is the named inverse of the pack, not an identity. *Lossless* is claimed for no mapping until the audit proves that specific one. Zero bare `as` casts between any two of the five, **or** the doctrine states why a given tier legitimately holds two. A bare cast, or an unaudited *lossless*, is an automatic fail | | D-BBB-NARS-3 | `Truth(…)` as a named `plan_eval` operation (Revision / Deduction / Abduction / …), returning `TruthLaneId`, never an array | Queued — gates on D-BBB-NARS-2 | one crossing per behavioral expression regardless of operand count (the bulk-or-lifecycle law, lgj `docs/abi.md` §6); a `[TruthU8]` return is an automatic fail | ## spog-alpha-channel-v1 (D-ids minted 2026-09-07 with the spec)