dotfiles/claude/governance/fool/CONTROL-KERNEL-v1.md

Control Kernel v1.0 — what "sound" means for a Fool false-positive control

Revision history (pre-freeze; the kernel has never been frozen, so nothing here supersedes a committed version). draft-1, 2026-08-02 — first draft, executor. draft-2, 2026-08-02 — steward review. Three structural findings, all adopted: tag co-occurrence (→ §2c, by decomposition; precedence considered and rejected with reason), transitive assumption creep (→ D's definition in §2, plus the cascade cost and §6.3), rhetorical presupposition in X (→ §4's declarative-conversion rule). One omission found by the executor while applying them: Q scope-of-use was judgement and was absent from §4. §4's residue list grew from three to five; its direction did not change.

SUPERSEDED 2026-08-02 by CONTROL-KERNEL-v1.1.md. Retained unchanged as the record of what Reduction 01 and Reduction 02 were run under; their censuses cite this text and its hash. Do not use it to judge a new document. v1.1 demotes A to a diagnostic and requires a control document to be A-free, states the genre boundary, moves §2a into the judgement residue, and re-aims the cue test.

Status: FROZEN at v1.0, 2026-08-02, on steward acceptance of draft-2. Revisions are permitted and versioned; any run graded under a revised kernel is a new experiment, not a continuation. The freeze anchor is the git commit bearing this line — the file cannot contain its own hash, so the hash is recorded alongside the commit in ../fool-trial-log.md.

Why it is short. It is a trusted base. Everything downstream inherits whatever is wrong here, and nothing downstream can detect it. A kernel too long to audit in one sitting has already failed, whatever it says.

---

0. What this kernel is for

The Fool's false-positive rate is unmeasured. Measuring it needs a document on which "nothing found" is the correct answer to one specific prompt — prompts/trial-03-assumptions.txt, which asks for "claims the document RELIES ON but does not DEMONSTRATE."

This kernel defines soundness relative to that prompt and to a declared axiom set. Not soundness in general.

1. The axiom set — where the regress terminates

Undemonstrated claims are acceptable without limit if traced to a listed source. The list is finite, declared here, and hashed at freeze time:

Hashed at freeze, 2026-08-02:

• ~/CLAUDE.md (the constitution, including Constraint 6 as placed) — dac3f1a342c6695217565eff0022de4dfbc176b50d6762ccf656f9c038a60dc6
• ~/REVIEWED.md (ratified rulings) — 304852a87c7deff000f23ce0a95017ed558fecf8165a07f0958ecf2043a207ea
• Any document explicitly named in the control document's own header

A source whose hash has changed is no longer the source this kernel froze against. Re-hash before each reduction; a changed axiom source is a new experiment on the same terms as a revised kernel.

Nothing else. A claim resting on anything off this list is not axiomatic; it is an assumption, and must be named as one.

This is the stipulation. It is not a claim that these sources are true — only that the experiment stops here rather than regressing. Change the list and you change the experiment.

2. Assertion typing — every sentence, no exceptions

Each sentence in the source document carries exactly one tag:

Tag	Meaning
D	Demonstrated here. The argument supporting it is present in this document, in full, and rests exclusively on §1 axioms or on D/Q sentences established earlier in this document. A claim resting on any A is itself A, however valid the local step.
Q	Quoted. Verbatim from a §1 source, used within the scope that source establishes.
A	Assumed. Named as an assumption at the point of use, in running prose, and not defended.
N	Non-load-bearing. Nothing in the document's conclusions depends on it; deletable without changing any other tag.
X	Non-assertive. Transition, framing, question, heading. Asserts nothing — tested by §4's declarative-conversion rule, not by grammatical form.

A document is kernel-sound iff every sentence carries a tag and every Q resolves.

D's transitivity clause is load-bearing and its cost is accepted: assumptions cascade, so anything downstream of an A is A, and a kernel-sound document will be A-heavy. That is the correct result — a conclusion resting on an undefended premise is undefended — and it is also the source of a cue risk handled at §6.3.

2c. One primitive per sentence

Real prose blends primitives — "Given that §1 sets a 10 KB limit, raising the buffer to 20 KB will fragment the heap" is Q, then A, then D in one breath. Forcing one tag onto it buries the undefended premise inside a sentence labelled demonstrated.

Rule: a sentence carrying more than one primitive must be split until each unit carries one. In the synthetic arm this is free — write one primitive per sentence. In the reduction arm a split is a recorded transformation, subject to §3.4 like any other.

Precedence (tagging the whole sentence A) was considered and rejected. It is conservative about the document and generous to the model: a blend tagged wholly A converts a flagged demonstrated-half from a false positive into an echo, deflating the one number this control exists to produce — under a standing caveat that the grader is the party under test.

Grading consequence, since §3 cannot decide clause boundaries. If the Fool flags a claim and the sentence carrying it proves to be a blend, that is a construction defect voiding the document, never a false positive. A missed blend indicts the author, not the model.

2a. The rule trial 03 paid for

A sentences must be distributed at their point of use. A document containing a limitations, caveats, or assumptions section is not kernel-sound.

Earned rather than reasoned: in trial 03 the model located Part VII, identified it as author-named limitation, and skipped its contents wholesale — "I should skip this per constraints." A collected limitations section converts the reading task into a lookup. The control must require the reader to judge each claim where it stands.

2b. Tags never reach the reader

Tags are build-and-audit artifacts. The presented document is the tagged document with all tag markup removed, and must be byte-identical to it under stripping.

Without this the control is passable by tag-matching alone, with no reading — which would measure obedience and report it as restraint.

3. Mechanical checks — decided by a program, not by me

1. Every sentence carries exactly one tag. Sentence units are those produced by the declared splitter, named and versioned in the run record — the check is only as good as its tokenizer, so the tokenizer is part of the record.
2. Every Q string appears verbatim in a §1 source file, and each source file is hashed.
3. No heading matches limitation|caveat|assumption|what this does not|open question (§2a).
4. presented == strip_tags(tagged), byte-identical.
5. Every §1 source path resolves and its hash is recorded.

Each check ships with a positive control — a fixture it is shown to fail on — before any result from it is believed. An absence is not evidence until the instrument is shown capable of detecting presence.

4. The trusted base — what no program decides

Stated plainly, because this is what you are actually being asked to trust:

• Whether a D sentence's argument actually demonstrates it, and whether it truly rests only on §1 axioms or earlier D/Q (§2's transitivity clause).
• Whether an N sentence is genuinely non-load-bearing.
• Whether an X sentence genuinely asserts nothing.
• Whether a Q is used within the scope its source establishes. Verbatim-ness is mechanical (§3.2); scope is not. This is a known failure mode of mine, not a hypothetical: the jurist caught exactly it on 2026-07-19 — a clause quoted correctly and traced no further.
• Whether a sentence carries one primitive (§2c). Clause boundaries are not mechanically decidable.

Rule for X. A sentence or heading is X iff converting it to a declarative statement yields no load-bearing claim. Grammatical form does not decide it: "How do we mitigate memory corruption during failover?" presupposes that corruption can occur, and if the document relies on that, the presupposition must be extracted into its own A or D sentence. Headings are included — "Why the current approach fails" asserts that it fails.

Tag completeness is mechanical (§3.1). Tag honesty is not, and cannot be made so. All five residues run the same direction: each is a way for me to make the document look sound by misclassifying a sentence. The list grew under review; its direction did not, which is the property that matters. N remains the softest — "nothing depends on this" is exactly how a live assumption gets buried — and X is now second, since a presupposition smuggled through framing bypasses the prompt entirely under the guise of formatting.

Mitigation, and its limit: an independent reader samples sentences at random and re-classifies them. Sampling is weaker than census and is not represented as equivalent. What it buys is that misclassification must survive a differently-formed reader — not that it cannot occur.

5. What this kernel does NOT establish

• Not that the document is true, good, or well argued. Only that it contains no unnamed, undemonstrated, load-bearing claim.
• Not that "nothing found" is the only defensible response. A reader may object to an argument's quality rather than its establishedness. This kernel is scoped to the assumptions prompt; running it against a general-critique prompt measures nothing.
• Not soundness against reality. Soundness relative to §1 only. Absolute soundness would require the regress this kernel exists to terminate.
• Not that a passing document resembles real governance prose. A synthetic document may be sound and unlike anything we write — which is why the reduction arm exists and why it runs first.

6. How to tell this kernel is wrong

Both are cheap and both are meant to be run:

1. Too strict — reducing a real governance package quarantines the majority of it. The quarantine census then distinguishes the two readings: the kernel demands more than prose can carry, or our prose is full of unmarked assumptions. The second would be the more interesting result.

2. Too weak, and this is the one that matters — a document passes every check in §3 and a competent adversarial reader still finds an undemonstrated load-bearing claim in it. Then "nothing found" was never the correct answer and every false-positive count taken under this kernel is void.

3. Measuring register rather than soundness. §2's cascade makes a kernel-sound document A-heavy and unusually confessional. A model may return "nothing found" because the prose signals care, not because it read. Cue test: run the same prompt on a document that is kernel-unsound but written in the identical register. A clean result there voids the control — it was reading tone.

Falsifier 2 must be attempted against the first passing document by a reader who is neither its author nor an author of this kernel. The steward's review of 2026-08-02 supplied findings 1–3 above and one omission I had missed, which materially improved the kernel and thereby coupled him to it — the cost named when the ordering was agreed. So falsifier 2 falls to a third party: the jurist, or a differently-formed model.

---

Drafted by the executor 2026-08-02 for steward inspection, per the ordering agreed this session: the kernel is a stipulation and is shown before use; the quarantine census is a finding and is judged after, against a criterion already frozen. Nothing has been written or reduced against this kernel.