diff --git a/PENDING.md b/PENDING.md index 32b218d..c56ba6d 100644 --- a/PENDING.md +++ b/PENDING.md @@ -696,3 +696,17 @@ Measured against the register itself before acting. Four corrections; the item's **Recommendation:** (c). The same shape as the Fool trials and the 2025 archive read: pre-register what counts as a clustered miss *before* reading, or the executor grades its own errors after seeing them. Note the standing hazard — this is the executor measuring whether the executor is checked, which is the contaminated form; the grading criteria must be fixed in advance and the raw classifications left checkable. **Files affected:** none yet; a measurement, not a change. Output would be a dated record beside the doctrine package. **Awaiting:** Steward direction on (a)/(b)/(c), and on whether the executor is the right party to run a measurement of its own oversight at all — the jurist is no more independent here, so this may be steward-only work. + +## PENDING-90 — First L2 transfer: checker position in the calibration loop +**Date:** 2026-08-02 +**Tag:** [ESCALATE] +**Summary:** A candidate amendment carrying the differently-biased-checkers doctrine (Constraint 6) into the CapableMind spec corpus is drafted and awaiting steward authorization; it proposes an autonomy-ceiling rule, which is L2-constitutional. +**Rationale:** Five months of microcosm work has produced material for L2 and transferred none of it — `risk-manager-spec.md`, `personality-traits-spec.md` and `mindset-runtime-spec.md` were last touched 2026-03-08. This is the first transfer. It lands where CapableMind actually evaluates its own self-adjustment: the trust calibration loop. Censused finding — across `risk-manager-spec.md` v0.2 and `adaptation-chain-spec.md` v1.3, no field records who checked a decision or how that checker is positioned relative to the decider (grep terms: reviewer, reviewed_by, checked_by, approver, approved_by, independen*, second_opinion, adversarial; one unrelated hit). The base entry records `initiator` and `authorization` — who made the change and whether an operator granted it — but when `authorization.required` is false, which is the entire self-adjustment case, no checker is in the record at all. +**Why ESCALATE and not PROPOSAL:** Change 4 proposes that threshold *loosening* driven by a same-formation calibration be recorded but not applied — the system may observe that it judged itself well calibrated, but may not widen its own autonomy on that basis. That is an autonomy ceiling, i.e. constitutional, and per this file's own rule L2 constitutional changes escalate unconditionally. Checked first for an existing authorization covering the L2 transfer; there is none, so the boundary is real rather than manufactured. +**What was done:** the candidate amendment only, at `CapableMind-AI/docs/thinking/David/amendments/amendment-checker-position-calibration-loop.md`. Nothing under `docs/specs/` was touched. Per that repo's amendment-first discipline, amendments are candidates and the synthesis PR is the gated act. +**Verification:** all 21 quotations mechanically contained against source (Constraint 6, both specs, ADR-014), 9/9 positive controls absent, instrument verified. Three controls — `readonly accuracy_source`, `readonly calibration_source`, `CheckerPosition` — confirm the proposed fields are genuinely new rather than re-proposals. The census *negative* is grep-established, not containment-established; the instrument cannot verify an absence. +**Options:** (a) authorize as drafted, executor opens the synthesis PR once the owed Introspection API types are written; (b) authorize the direction but require the jurist design-gate it first, as with the doctrine itself; (c) hold — the doctrine is provisional and it may be premature to encode a provisional doctrine into a build-ready spec; (d) reject the autonomy-ceiling clause specifically and take the recording fields alone, which are non-constitutional. +**Recommendation:** (b). The doctrine reached Constraint 6 through a jurist design-gate, and this is its first load-bearing application; the same gate should govern the transfer. Note the standing limit the amendment itself carries: the doctrine may never be cited as assurance that anything was caught, so the fields make self-checks *legible* and nothing more. If the steward prefers speed over symmetry, (d) is the safe subset — the recording fields stand on their own and (a)-minus-Change-4 loses little. +**Open question the reviewer should press first:** who declares the position? If the calibrating party declares its own, that declaration is itself a self-report. The honest answer may be that position is derivable from `initiator` and the facet ID rather than declared — which would make it mechanical. Not settled in the draft. +**Files affected:** one new candidate file in `thinking/`; on authorization, `adaptation-chain-spec.md` §4.11/§4.12 and `risk-manager-spec.md` §6/§6.1/§9. +**Awaiting:** Steward authorization, and direction on (a)/(b)/(c)/(d). diff --git a/claude/memory/session-ledger-2026-08-02.md b/claude/memory/session-ledger-2026-08-02.md index 74149a9..e366c4d 100644 --- a/claude/memory/session-ledger-2026-08-02.md +++ b/claude/memory/session-ledger-2026-08-02.md @@ -5,7 +5,7 @@ metadata: node_type: memory type: feedback originSessionId: 9256a5b3-c56b-4564-8ff2-8dc9d93ef97a - modified: 2026-08-02T10:25:57.625Z + modified: 2026-08-02T10:46:40.041Z --- # Session Ledger — 2026-08-02 @@ -29,6 +29,10 @@ metadata: - **16:20 — a containment control that leaks by construction, twice in five minutes.** Both controls I built for the Q3 negation were substrings of the sentence doing the negating. The instrument refused certification both times and was right to. **Substring containment cannot verify a negation** — the affirmative always appears inside its own denial. Documented in the script; polarity must be established by reading and reported as uncovered. - **17:05 — nearly called Seb's PENDING-10 citation a miscitation.** The substrate showed the steward himself framed the replay-contract audit question as PENDING-10's, twice, in June cover notes. Seb was echoing faithfully. The real defect was ours: the extension never got written back into the item. +*— context clear; same day, same ledger —* + +- **The pulling thread's own checkable claim was half false, and the false half was a bounded search.** The wrap asserted *"there is no `amendments/` directory in `thinking/David/`"* as the second leg of the L2-transfer evidence. There is: `docs/thinking/David/amendments/`, **14 files**, last touched **2026-06-13** (the L1 `/health` auth-tiering amendment answering Seb). The first leg holds — the three orchestration specs are last-touched **2026-03-08** — but they live at `docs/specs/orchestration/`, not under `thinking/David/` as the wrap implied. **Sixth instance of the day's pattern**, and the first one caught inside the wake that inherited it. The honest claim narrows: L1 material has transferred through this machinery within the last eight weeks; the chamber/doctrine material has not. + ## What held *Instruments that fired prospectively — banked-lesson → what it caught → what it would have cost.* @@ -37,6 +41,7 @@ metadata: - **The wake's substrate-check rule** (*a disposition clause is not a status*) caught at 10:44 that REVIEWED-85 was already placed — three minutes after a wrap that called it the blocker. Cost avoided: reporting an authorized item as blocked, for the second day running. - **Pre-registering the divergence criterion before opening any archive file** caught that *reference* was the wrong term — the v1 protocols mandate invented bibliography, so counting citations would have compared two fiction generators and inflated the result enormously. Cost avoided: a doctrine looking strong for a bogus reason. - **Reading the protocols before the data**, at the steward's insistence. Every substantive correction to the archive reading came from the instruments and the record, not from re-reading the outputs. +- **The wake's substrate-check rule fired a second time, on the thread itself.** Post-clear, checking the pulling thread's two checkable legs before restoring them found `amendments/` alive with 14 files. Cost avoided: opening the L2 transfer by *creating* a directory that exists, ignoring eight weeks of precedent and its naming convention — and telling the steward his repo lacks a phase it has been using. **This is a partial answer to the session's own literal question:** the census instrument that failed five times yesterday fired today when it was written into a *procedure* (the wake's §3 substrate-check step) rather than banked as a *lesson*. Provisional; one datum. ## Open horizons @@ -52,6 +57,7 @@ metadata: ## Authorization moves - **REVIEWED-85 placed by the steward** (`aa6e51a`, 10:41) — design gate passed with conditions. Its prescribed work (§1.6 edit; four proposals as the first FIX-lane batch; then the check-in) is now executor-authorized and outstanding. +- **PENDING-90 filed [ESCALATE]** — the first L2 transfer, as a candidate amendment only. Tagged ESCALATE rather than PROPOSAL because Change 4 proposes an autonomy ceiling (the system may not widen its own autonomy on a same-formation self-assessment), which is constitutional. Checked for a pre-existing authorization covering the L2 transfer before treating the boundary as real — there is none, so this is not a manufactured boundary. Nothing under `docs/specs/` touched. ## Sub-agent dialogues