🔧 Auto-commit from sysupdate on 2026-04-05 21:31

PENDING.md

@@ -110,4 +110,100 @@
 **Rationale:** Emerged from Chamber Phase 1 session on Essay I. The Alexander voice identified that L2 constitutional governance is either automation of the grammar of recognition (in tension with the essay's central claim and constituting a drift risk) or constitutional stabilization (the architectural realization of the essay's argument). Both steward and jurist assessed this as Tier 1 governance risk: the current architecture leans toward stabilization but the lean is implicit. An implicit commitment under pressure from an unresolved tension is the structural condition for drift. Naming it before the next hardened invariant work prevents the automation reading from corrupting the architecture incrementally.
 **Relationship to existing design notes:** Operates within the space opened by DN-GOV-05 (bounded self-repair) and DN-GOV-07 (threshold already crossed). Directly connected to I3 (phronesis ceiling) and ICP-9/I15 (accusative default). Candidate for Domain C invariant precursor.
 **File created:** `DN-GOV-08-constitutional-stabilization-not-automation.md`
-**Awaiting:** Steward authorization. This is a DESIGN NOTE that requires steward review before advancing toward invariant status.
+**Awaiting:** Steward authorization. This is a DESIGN NOTE that requires steward review before advancing toward invariant status.
+
+## PENDING-15 — Reviewer-Agent for ICP-19 External Review (Luke)
+**Date:** 2026-04-01
+**Tag:** [PROPOSAL]
+**Summary:** Design and build an agent to help Luke (confirmed founding reviewer, 2026-04-01) navigate the L2 constitutional corpus. Luke is technical but was not present for the corpus's development and needs orientation across 18 invariants, 9+ design notes, the contamination problem, and the governance architecture.
+**Rationale:** The reviewer-agent's posture directly affects the integrity of ICP-19. An agent that explains the corpus risks becoming an advocate for it, undermining the independence that external review exists to provide. The agent must be navigator, not advocate — helping Luke understand what documents say and how they relate, without defending them. If the reviewer identifies a tension or weakness, the agent should help articulate it, not resolve it.
+**Options:**
+1. **Reader's guide + Claude Project** — Write an orientation document (reading order, genealogy, key terms). Upload corpus to a Claude.ai project with a system prompt that positions the agent as navigator, not advocate. Simplest. Luke just needs a Claude account.
+2. **Claude Code config** — A dedicated `CLAUDE.md` + seed scoped to the reviewer role. Luke clones a repo with the constitutional corpus. More structured, version-controlled.
+3. **Purpose-built agent (Agent SDK)** — Web-hosted, review protocol baked in, tracks findings and HOLD thresholds. Most capable, most work.
+**Recommendation:** Option 1. A reader's guide is inert and can't bias; a Claude project gives Luke a conversation partner. The system prompt is the critical piece — it must be reviewed by all three parties (steward, jurist, Luke himself) before deployment. Option 2 is a reasonable upgrade if Luke prefers working in terminal.
+**Constitutional concern:** The reviewer-agent's framing of documents could influence the review outcome. The system prompt constitutes a governance artifact — it shapes what the reviewer sees and how. This is exactly the kind of intervention ICP-19 exists to keep honest. The system prompt should be transparent to the reviewer (Luke can read it) and should explicitly disclaim advocacy.
+**Files affected:** New artifacts: reader's guide document, Claude project system prompt. No changes to existing constitutional documents.
+**Awaiting:** Steward authorization + jurist review of system prompt posture. Ideally Luke reviews and approves the agent's framing before using it.
+
+## PENDING-16 — Observation-Recall Coupling: Attention-Driven Ingestion Pipeline
+**Date:** 2026-04-03
+**Tag:** [PROPOSAL]
+**Summary:** Restructure the BMF ingestion pipeline to couple observation to recall. Before classification, a fast similarity probe queries the vector store to provide the classifier with epistemic context — "what do I already know that's like this?" — enabling three-disposition routing (novel / reinforcing / noise) instead of the current binary (classified / degraded-but-stored). This addresses the root cause of storage bloat: the observe path is blind to existing knowledge.
+
+**Rationale:** The current pipeline classifies every observation in isolation, appends everything to the logchain, and dispatches to all 11 modules regardless of novelty or redundancy. Result: 18,651 vector chunks and 1.3 GB SurrealDB for modest ingestion volumes. The system stores everything because it has no basis for judgment — existing knowledge is available at recall time but invisible at observation time. Coupling observation to recall gives the classifier epistemic standing to make quality judgments, producing logarithmic rather than linear storage growth.
+
+**Architecture:**
+```
+observe → fast similarity probe (~20-50ms) → contextual classification → disposition
+```
+
+Three dispositions:
+- **Novel:** Full pipeline — logchain append, dispatch, embed, extract. Genuinely new information.
+- **Reinforcing:** Lightweight logchain entry linking to the entry it reinforces (with similarity score + reinforced entry ID for provenance). Module stores absorb consolidation (confidence boost, timestamp update, detail merge). Logchain remains append-only.
+- **Noise:** Audit log only. Raw envelope + similarity context + disposition reason + similarity score preserved. No logchain, no embedding, no dispatch. Re-ingestable within retention window.
+
+**Existing machinery activated (not new complexity):**
+- Vector store HNSW index — already operational, unused during observation
+- `CausalEdgeCandidate` type — already in classification-types.ts, provides linking semantics
+- `compressToAtomicFacts` — exists in classification.ts but not wired into ingestion path
+- `computeSalience` — currently decorative, becomes load-bearing
+- Graduation system — models developmental stages, provides infant→calibration→active arc
+
+**Five governance decisions required:**
+
+1. **Novelty floor invariant (Cluster A candidate).** The system shall not permit its observation disposition to exclude more than [X]% of events from novel classification over any [Y]-day window. Prevents attention narrowing / epistemic closure. Threshold values require empirical grounding during infant stage — the invariant's shape is proposed now, parameters set from data. Jurist recommends Cluster A priority.
+
+2. **Similarity threshold for reinforcement.** Reinforcement requires cosine similarity exceeding [threshold]. Too high: system never consolidates. Too low: over-consolidation / attention drift. Must be calibrated from infant-stage similarity score distributions, not engineering intuition. Temporal decay on probe context prevents ancient clusters from capturing attention space.
+
+3. **Noise audit retention and remediation.** Audit log retention aligned to chain pruner (90 days). Re-ingestion authorized by steward. Monthly noise disposition report *pushed* to steward (not pulled) — connector distribution, similarity score distribution, top noise patterns. Closes the observability gap: steward can't authorize review of filtering they don't know about.
+
+4. **Graduation staging thresholds.** Infant (log similarity scores, no enforcement) → Calibration (enforced, permissive threshold from distribution data) → Active (tightened threshold). Transition triggers need explicit criteria, not descriptive stages.
+
+5. **Ingest latency budget.** The similarity probe adds an embedding call (~50-200ms Ollama) + HNSW lookup (<5ms) to every observation. Current classification path is ~500ms. Net ingest latency may decrease for mature systems (most events are reinforcing/noise, skip full dispatch). Engineering constraint — Seb should validate against #10 sequential dispatch bottleneck.
+
+**Attention drift detection:** Anomaly module (already subscribes to all events) tracks novel/reinforcing/noise ratio over sliding window. Novelty drop below floor triggers alert to steward. Cross-node attention coupling via circles (sharing attention state rather than noise rules) amplifies this — governance implications flagged for later circle-governance work.
+
+**AF-7 intersection:** Noise gate behavior exports as auditable artifact — "what have you been filtering and why." External reviewer can audit disposition patterns. Audit log is the evidence base.
+
+**Options:**
+1. **Full implementation** — similarity probe, three-disposition routing, graduation stages, audit log, anomaly-module drift detection, pushed monthly report.
+2. **Probe-only first** — add similarity probe to classification, log scores, but don't enforce dispositions. Builds empirical foundation for governance parameters. Smallest diff, highest learning.
+3. **Classification-only** — add memorability judgment to LLM prompt without similarity probe. Cheaper, but the classifier lacks context (the jurist's original concern).
+
+**Recommendation:** Option 2. The probe-only approach is the infant stage itself — it builds the data needed to set governance parameters while adding minimal risk. The logchain continues to receive all events. The only new behavior is: every classified event gets annotated with a similarity score against existing knowledge. This data drives decisions 1-4 above with evidence rather than intuition.
+
+**Files affected:** `src/core/keystone/orchestrator.ts` (probe before classify), `src/core/keystone/classification.ts` (extended schema), `src/core/keystone/classification-types.ts` (disposition type), `src/modules/anomaly/` (drift detection), new: audit log writer. Factory connector metrics for per-connector novelty ratio.
+
+**Constitutional touchpoints:** Logchain append path (append-only contract preserved — reinforcement links, doesn't mutate). Noise disposition is a stronger commitment than degraded classification — candidate for invariant governance.
+
+**Awaiting:** Steward authorization. Jurist review of novelty floor invariant shape and Cluster A placement. Seb's assessment of latency budget and #10 interaction.
+
+## PENDING-17 — Epistemic Integrity: The System Shall Know What It Knows
+**Date:** 2026-04-03
+**Tag:** [PROPOSAL]
+**Summary:** The L1 pipeline computes classification confidence and then discards it. No module checks it (`base.ts:83`). Degraded events (confidence 0) are processed, stored, and returned at recall identically to understood events. The bloom filter locks in degraded guesses as permanent records. The recall path returns a mix of knowledge and guesses with no distinguishing signal. This is the contamination problem applied to infrastructure — the system's output looks more confident than its input warrants.
+
+**Rationale:** L0 (contamination problem / Freeman question) requires an epistemically honest substrate. If L1 launders uncertainty into authority, L0 inquiry inherits false confidence. The epistemic integrity amendment is the L0 readiness condition.
+
+**Constitutional position (jurist-assessed 2026-04-03):** "The system does not grant epistemic authority to its own outputs without external grounding." Classified as constitutional position for L2 preamble — the normative claim from which the enforceable invariants derive.
+
+**Three invariants proposed (Cluster A):**
+
+1. **I-CF: Processing Confidence Floor** — No module shall process an event whose classification confidence has not been earned against a declared floor. Sub-floor events HELD for remediation (DeferrableError at `base.ts:83`), not discarded.
+
+2. **I-CC: Classification Confidence Ceiling** — No classification confidence shall exceed the validated accuracy of the source that produced it. Enforcement by construction in `classification.ts`. Open schema question: enforcement vocabulary may need CAP/BOUND verb for value-bounding invariants.
+
+3. **I-NF: Novelty Floor** — Already in REVIEWED-18. Confirmed for Cluster A by jurist.
+
+**Implementation scope:** ~270 lines across 8 files. No new infrastructure. Threading existing confidence signal through existing pipeline. Key changes: confidence floor at `base.ts:83` (~10 lines), confidence ceiling in `classification.ts` (~20 lines), dual bloom filter in `quality-gate.ts` (~40 lines), source confidence provenance on stored records (~80 lines across modules), confidence-weighted recall ranking (~50 lines), epistemic state in health (~40 lines).
+
+**Retroactive implication:** "Earned" reaches backward. When classification competence improves, logchain replay re-evaluates past events. Competence-change triggers (graduation transitions, rule accuracy changes) should fire selective replay.
+
+**Kill chain documented:** Five links from confidence-computed-then-ignored through bloom-filter-locks-in-guesses through entity-graph-launders-uncertainty through recall-returns-guesses-as-knowledge through four-models-none-knows-others-failed.
+
+**Files affected:** `src/modules/base.ts`, `src/core/keystone/classification.ts`, `src/core/perception/quality-gate.ts`, `src/modules/vector/storage.ts`, `src/modules/entity/storage.ts`, `src/modules/temporal/storage.ts`, `src/core/keystone/query-router.ts`, `src/server/routes/health.ts`, `src/server/routes/recall.ts`
+
+**Full amendment:** `CapableMind-AI/docs/thinking/David/amendments/amendment-epistemic-integrity.md`
+
+**Awaiting:** Steward authorization. Seb's engineering review (6 questions in amendment). Invariant hardening for Cluster A.