Version 0.2 · 2026-07-15 · status: revised after a three-critic adversarial pass (two independent Claude critics, one GPT-5.6-class critic at maximum reasoning effort); the changelog at the end records what the attack broke in v0.1 and how each break was repaired. Pending: residual findings from the second and third critic reports are reconciled on arrival.
This document is the philosophical kernel of the AutoQA program: the minimal set of commitments upon which everything else — the eleven principles, the eight-stage architecture, the decision policy, the governance rules — is built. It exists because the program will outlive every model generation it runs on, and must therefore rest only on what does not move within its declared domain.
Part of Kernel
- Format
- MD
- Lines
- 182
- Size
- 33.3 KB
- SHA-256 (v2)
182a06316241ff006ccbbffe00376e0f24fc63c8a1eeee8e1b54b7df1ffdceb6
Scope, and the migration principle
The kernel governs a specific epistemic territory: evaluative claims about open-ended human work for which no sound, complete certificate system exists — claims like "this critique is well-grounded," "this severity rating matches the evidence," "nothing important is missing from this writeup," judged against natural-language instructions and a bounded evidence record.
That scoping is load-bearing, and it resolves what would otherwise be overclaims. Where a criterion admits a total, sound decision procedure — a regex, a compiling program, a checkable proof, a complete formal specification — it is not the kernel's problem: it migrates to the deterministic lane, where ordinary software-correctness discipline governs. The migration principle: as capability and formalization advance, individual checks may graduate out of the kernel's domain into the certifiable lane; the kernel's claims are claims about the residue, and the residue's boundary is re-surveyed at every model generation. This is how the kernel absorbs model progress without amendment: progress moves the boundary; it does not touch the sentences.
Every statement in Parts I–II carries exactly one tag. Sentences marked Commentary carry no tag and do no inferential work; if a later derivation is found leaning on commentary, that is a defect (this rule was enforced against v0.1 by adversarial review, and violations were repaired).
- [TELOS] — the stipulated purpose. One statement.
- [DEF] — a thin lexical definition. Definitions here fix vocabulary only; v0.1's definitions smuggled substance and were split.
- [FACT] — a mathematical or logical constraint, true unconditionally.
- [COND] — a standing condition of this domain: capability-invariant, but contingent on the domain the kernel is scoped to (open-world evaluative work; a paid, adaptive, tool-equipped workforce; a shared model-provider ecology). If the domain changes, CONDs are re-examined; no model improvement alone changes them.
- [CHOSEN] — a normative commitment. Not derivable, and not pretended to be; defended, versioned, ownable.
- [LAW] — an external legal given, binding where its scope conditions hold, tracked on a versioned legal interface because law changes.
The kernel discipline. A design element is legitimate only if it is: (a) derived — entailed by named kernel elements; (b) an unpacking — a consequence drawn from a CHOSEN commitment under the pressure of named FACT/COND elements; (c) a design response — one admissible way (not the only way) of satisfying kernel constraints, adopted explicitly and replaceable by any other admissible way; (d) an operationalization filling a declared interface slot, carrying a measured-error obligation; or (e) a governed choice at a declared choice-point (Part V), made by its named owner and versioned. Anything else is either a kernel amendment — explicit and versioned — or it does not ship. v0.1 lacked category (e) and thereby made its own holes unfillable; that was a real defect, found by review, fixed here.
Part I — The kernel
The purpose
K0 [TELOS]. The enterprise exists to increase the validity of training data about genuine human judgment: to make the recorded signal about what humans actually judged, and why, more truthful, more traceable, and more usable — not to make workers agree, not to make reviews uniform, and not to replace the judgment the data exists to capture.
Commentary. Two failure patterns are named early because they recur: a QA layer that homogenizes worker output consumes the signal being purchased, and a QA layer that launders one arbitrary reading of an ambiguous instruction into "consistency" records a fiction. Both are argued, where used, from K0 plus named elements — not from this commentary.
Definitions (thin)
K1 [DEF] — Project. "Project" names a triple ⟨instructions, evidence policy, owner⟩: a written statement of intent; a rule fixing what counts as admissible evidence; and the party holding amendment authority over both. (That such an owner exists with such authority is not asserted by this definition; it is constituted by K13 below. Projects with plural or contested governance exist in the world; this program only takes on work after it has been brought into this form — a scope condition, not a metaphysical claim.)
K2 [DEF] — Quality. "Quality" names whatever construct a project's contract fixes as the target of evaluation. Which construct that should be is not a definition; it is decided at C1 in Part III — v0.1 defined the answer into K2 and then "derived" it, a circularity the adversarial pass correctly killed.
K3 [DEF] — Verdict. "Verdict" names a claim about quality issued for a project. What a verdict must carry to be admissible (grounds, confidence) is a protocol commitment (K14), not vocabulary.
K4 [DEF] — Evaluator. "Evaluator" names anything that issues verdicts — human, model, or hybrid. The kernel's requirements attach to verdicts, never to substrates.
Constraints that are mathematics
K5 [FACT] — The certificate asymmetry. For claims with a sound, checkable certificate, verification can be far easier than production, and a weak verifier can soundly certify strong work. For claims without such a certificate, a verdict reached by re-derivation inherits the verifier's own error on the underlying task — it cannot be more reliable than the verifier is competent, and its stated confidence is not self-validating. (Both halves matter. v0.1 asserted only the second and was rightly refuted with proof-carrying code; the kernel's domain is defined by the absence of the first half's precondition, per the scope declaration.)
K6 [FACT] — The witness asymmetry, scoped. Within the kernel's domain — open-world claims with no complete formal specification — confirming that support exists requires one witness, while certifying absence ("no defects," "nothing missing") is sound only relative to a disclosed enumeration or search scope. Where a complete specification or sound proof system exists, absence certification is possible and the claim has migrated out of the domain. Within the domain, an absence verdict stronger than its disclosed scope is unsound by construction.
K7 [FACT] — Small-signal arithmetic. (i) Among accusations, the false share is fixed by prevalence, sensitivity, and specificity together — at 3% prevalence, 95% sensitivity, and 99% specificity, roughly a quarter of fail-verdicts are false accusations; precision targets at low prevalence impose specificity requirements that grow extreme. (ii) Absent a sound formal assurance (unavailable in-domain, by scope), error rates are known only through sampled, adjudicated data, and bounding rare error rates requires sample sizes that scale inversely with the rate, at the chosen confidence, under the actual dependence structure. (iii) Every calibration or coverage guarantee is conditional on the deployment population resembling the calibration population.
K8 [FACT] — Dependence bounds ensemble evidence. The evidential value of agreement among evaluators is bounded by their error dependence: k evaluators with correlated errors provide less than k independent opinions, and agreement among highly dependent evaluators can be arbitrarily weak evidence. Accuracy and independence are jointly necessary; neither substitutes for the other. Whether given evaluators are dependent is an empirical question that must be measured or structurally justified — never assumed away.
Standing conditions of this domain
K9 [COND] — Underdetermination is standing. The instructions this program compiles are natural-language expressions of evaluative intent over open-ended work. Within that domain, some admissible cases are underdetermined by the instructions-plus-record: the information needed for a determinate verdict is not in the inputs. No evaluator capability manufactures missing information; a perfect evaluator converges on perfect detection of underdetermination. (A project whose criteria are fully decidable has, by the migration principle, no kernel-governed residue — and no need for this system.)
K10 [COND] — The adaptive-population condition. The evaluated population is paid, informed, persistent, and equipped with the same class of tools as the evaluator. Under those conditions, consequential legible criteria are optimization targets; specific feedback publishes a gradient toward the evaluator's decision boundary; and incentives concentrated on measured dimensions divert effort from unmeasured ones (the multitask result — under the standard conditions of constrained effort and imperfect proxies, both of which are constitutive of this domain). This is tagged COND, not FACT: a population without knowledge, persistence, or stakes would not exhibit it. This workforce has all three by construction.
K11 [COND] — The shared-substrate condition. Frontier evaluators are trained by a small number of providers on overlapping data with overlapping methods, the workforce's assistants come from the same pool, and human experts increasingly work through the same tools. Under K8, this ecology makes error dependence the default presumption; independence is the scarce resource, must be deliberately engineered (heterogeneous methods, tool-based recomputation, genuinely separate processes), and its supply degrades over time rather than improving.
K12 [COND] — The producer–evaluator frontier band. Because producers and evaluators draw on the same substrate (K11) and in-domain claims lack certificates (scope), there is a standing band of submitted work near the evaluator's own frontier where, by K5's second half, its verdicts are educated guesses. The band moves with capability; within the domain it does not empty, and adaptive producers (K10) can deliberately locate work inside it. (A bounded project whose entire content becomes certifiable exits the domain — the band is not claimed to survive migration.)
Authority and legitimacy
K13 [CHOSEN] — Owner authority. This program takes on only projects governed thus: prospective interpretation of the instructions may be delegated (including to evaluators), but settling a contested or novel meaning is reserved to the owner and takes effect as a versioned amendment; and the bar workers are judged against never changes silently or retroactively. Motivation: some authority structure must be chosen for evaluation to be reproducible at all; this one keeps every verdict traceable to a citable version of the standard. It is a governance choice — v0.1 presented it as an institutional fact about meaning in general, which it is not.
K14 [CHOSEN] — The verdict protocol. An admissible verdict cites the instruction clauses it applies and the evidence it rests on, carries calibrated confidence, and is issued under a declared evidence-integrity regime: provenance and completeness of the record are checked before grounding, and gaps in the record are disclosed rather than papered over. Reflexivity is part of the protocol: verdicts, feedback, and adjudications are themselves evaluative work products and owe everything this protocol demands. Motivation: contestability (K15) is empty if there is nothing reconstructible to contest; and a grounded verdict against a corrupted or partial record is grounded fiction — admissibility without integrity does not serve K0.
K15 [CHOSEN] — Contestability. Any verdict that binds a person must be reconstructible from its grounds by that person and contestable through a channel with the power to change the outcome. Adopted for all workers everywhere — not merely where law compels it — because unaccountable verdicts corrupt the K0 record silently and because K18's separation (below) is unenforceable without a contest channel. Where platform-work law applies, most of K15 is also legally mandated; the commitment does not depend on that.
K16 [CHOSEN] — Measurement integrity. The system never knowingly reports a biased number as unbiased, and never lets what is done about a measurement alter what is measured. Leniency, throughput pressure, and commercial dials act downstream of measurement or not at all. Motivation: under K10, any channel by which disposition pressure can bend measurement will be found and used; a bendable instrument fails K0 for every consumer of its numbers at once. (This is a commitment, not a theorem; its unpacking under pressure is U5.)
K17 [CHOSEN] — Specification-risk allocation. The risk of ambiguous or defective instructions sits with the specification's owner, not with the worker who performed under them. A worker may be obligated to flag ambiguity where the contract says so; a worker is never penalized for the existence of an ambiguity they did not create. Motivation: K9 makes ambiguity standing; some party must bear its cost; assigning it to the party with amendment power (K13) is the only assignment that generates correction rather than fear. v0.1 used this premise silently; the adversarial pass forced it into the open — it is a choice, and it is now owned as one.
K18 [CHOSEN] — Separation of measurement, attribution, and sanction. "This work has a defect," "this person is responsible for it," and "this consequence is warranted" are three determinations with three evidence standards, and no automation of the first ever constitutes the second or third. Motivation: the kernel's measurement machinery addresses defects; culpability involves duty, capability, and circumstance that the evidence record may not contain (K9); collapsing the three is how measurement systems become injustice systems.
K19 [CHOSEN] — Symmetric threat model. K10 applies to every actor with power over the loop — workers, reviewers, adjudicators, project owners, platform operators, and buyers all face incentives that can corrupt the record, and the integrity architecture (audits, seeded gold, logs, disclosure) watches upward and sideways, not only downward. Motivation: a QA layer pointed only at the least powerful actor is itself a Goodhart artifact; the documented history of deployed review systems includes owner-side pressure on the numbers. (The specific safeguards are design responses; the symmetry is the commitment.)
K20 [CHOSEN] — Construct-validity duty. Because K0 is about genuine human judgment and K2's construct is fixed per-project, the two can diverge: instructions can mis-specify the judgment the data exists to capture. The system owes upward reporting of construct-invalidity evidence — clustered legitimate disagreement, systematic instruction-gap patterns, divergence between what the instructions reward and what the project's stated purpose names — to the owner and, where contracted, the buyer. The kernel cannot make a project legitimate (H4), but it is forbidden to be silently complicit in construct failure: enforcement fidelity never excuses suppressing evidence that the construct itself is broken. This element exists because the adversarial pass showed that without it, perfect kernel compliance could defeat the telos.
Legal givens
K21 [LAW]. On a versioned legal interface (I7), currently: EU Platform Work Directive — decisions of significant detriment must be taken by a human for workers in scope, with explanation, competent human contact, substantiated review within a deadline, and allowlist-bounded monitoring; SCHUFA doctrine — a determining automated score is itself an automated decision, and rubber-stamp review counts as none. US side — automated employment decision tools face bias-audit and notice obligations in enacted jurisdictions (NYC Local Law 144), and selection procedures with adverse impact carry validation duties under the Uniform Guidelines. [CHOSEN] rider, tagged separately: this program designs to the strictest applicable regime across its workforce rather than per-jurisdiction minimums — a choice motivated by K15's universality, not entailed by it.
Part II — Dependency table
Replacing v0.1's rhetorical minimality test: which downstream element becomes unjustifiable if a kernel element is removed.
| Removed | What loses its ground |
|---|---|
| K0 | K20 entirely; the anti-homogenization half of D6; the point of the enterprise |
| K5 | Routing by checkability (D2); the frontier band (K12); honest abstention |
| K6 | Absence-capping and checklist-compilation (D3) |
| K7 | Consequence gating and gold-budget economics (U2, U3); advisory-first |
| K8 | The audit channel's independence requirement (U4); limits on ensemble evidence |
| K9 | The underdetermine verdict class (D1); the instruction-gap channel |
| K10 | Stakes-sterile prompting, unpredictable audits, feedback bounds (U5, D5, D6) |
| K11 | The engineered-independence requirement; skepticism of cross-model agreement |
| K12 | The permanent escalation band; the claim that some lanes stay assisted |
| K13 | Versioned amendment; reproducible verdicts; T-era "rubric-as-law" debates become unanchored |
| K14 | Admissibility of any verdict; evidence-integrity gating; reflexive self-measurement (D7) |
| K15 | Appeals; blind-contestable adjudication; half of K21-alignment |
| K16 | The dial's one-way glass (U5); stamped batches |
| K17 | Non-penalization under ambiguity (D1's second half) |
| K18 | The human-decision floor's rationale beyond law; sanction gating (U2) |
| K19 | Upward/sideways integrity controls; seeded-gold protection from owner-side leakage |
| K20 | The system's defense against telos-defeating projects |
| K21 | Jurisdictional floors; the strictest-regime design target (with its CHOSEN rider) |
Part III — Consequences
Statuses are honest per the discipline: [DERIVED] (entailed by named elements), [UNPACKED] (consequences of a CHOSEN commitment under named pressure), [DESIGN RESPONSE] (one admissible architecture among others, adopted at a declared choice-point). v0.1 claimed DERIVED for nearly everything; the adversarial pass demonstrated that several of those were circular, gapped, or smuggled. The statuses below are the corrected ones.
C1 [governed choice, constrained] — The construct. Kernel constraints narrow what "quality" may denote: the referent must be inspectable (else K14/K15 verdicts are impossible), owner-amendable (else K13 authority and K9 resolution have no object), and fixed per-project (else no versioned bar, K16). Within the surviving space — instruction-satisfaction-with-grounding; fidelity-to-elicited-owner-judgment; hybrid forms — this program chooses instruction-satisfaction plus evidence-grounding, because it is the only surviving option whose referent is fully written down in advance, which is what makes verdicts contestable by workers who never met the owner (K15) and lets evaluation exceed the reliability of any reviewer population. Predicted-reviewer-consensus is excluded by the constraints (not amendable, not stably inspectable, and — where K9 bites — it manufactures determinacy the inputs lack, against K16). This is a constrained choice, honestly labeled; v0.1's "only definition consistent with the kernel" was circular and is retracted.
D1 [DERIVED] — Underdetermine, non-penalization, owner routing — from K9, K16, K13, K17. K9: some items are underdetermined. K16: the system may not report determinacy it does not have — so the verdict set must contain an underdetermine class. K17: the worker is not penalized for it. K13: settling it is an amendment, so the item routes to the owner. Each step now has its premise; v0.1 derived all three from K5 alone, which was refuted.
D2 [DERIVED] — Routing by checkability, and honest abstention — from K5, K12, K14, K16. Claims split into certificate/read-checkable and re-derivation classes (K5, scope). On re-derivation-class claims at the frontier band (K12), the evaluator's confidence is not self-validating (K5), and K16 forbids reporting it as though it were; K14 requires calibrated confidence. Jointly: the pipeline must classify checks by checkability, and must be able to output "beyond what I can certify" rather than a synthetic verdict. Which checks land in which class, per project and generation, is interface I1.
D3 [DERIVED] — The absence discipline — from K6, K16, K14. In-domain absence claims are sound only relative to disclosed scope (K6); K16 forbids overreporting; K14 requires the scope disclosure. Hence: completeness criteria compile to explicit checklists; absence concurrence is "not-contradicted (within the checked scope)," never "verified"; and — correcting v0.1's incoherence, caught by review — measured recall on planted defects calibrates the confidence of not-contradicted verdicts and never converts them to verified, because a population recall estimate cannot certify a particular open universal.
U1 [UNPACKED] — Claim-grained verification — from K14 under K5/K6. K14 requires verdicts to cite clauses and spans; checkability classification (D2) and scope disclosure (D3) operate at the grain of individual claims. Unpacking: the pipeline decomposes writeups into typed claims and verifies at that grain, with item dispositions assembled transparently from claim findings. Honest labeling: other grounds-preserving architectures exist (structured proof-trees over whole items, for one); claim-granularity is this program's adopted way to satisfy K14 at scale, not the only way — and optimal granularity is measured (I3), not derived.
U2 [UNPACKED] — Consequence gating — from K18, K15, K21 under K7. Within K21 scope, decisions of significant detriment are taken by a human: no operating point licenses autonomous detriment there — v0.1's contrary implication was a genuine contradiction and is retracted. Outside that scope, K18 still separates defect-measurement from sanction, and K15 requires contestable grounds; K7 then prices what measurement must exist before even human-decided consequences lean on system verdicts: error rates bounded on untouched adjudicated data at precommitted ceilings, with prevalence-realistic arithmetic, funded at the K7(ii) sample sizes for as long as the domain remains non-certifiable and the population adaptive — which is the domain's standing condition, not "forever" by fiat. Relative error prices (false accusation vs missed defect) are the owner's declared input (I2), constrained by K15/K21's procedural asymmetry: accusations carry contest duties that acquittals do not.
U3 [UNPACKED] — The reference standard and trust termination — from K14, K13, K8 under K7(ii). Verification chains must terminate (the adversarial pass showed v0.1 had an infinite regress). They terminate in declared anchors: owner sign-off for meaning (K13); adjudication panels operated under a declared reference-standard regime — selection, blinding where anchoring threatens independence (K8), disagreement handling, and quantified residual uncertainty of the gold itself (K7(ii) applies to the reference too, per K14 reflexivity); and formal certificates where a check has migrated out of the domain. Terminating in an anchor does not make the anchor true; it makes the residual uncertainty explicit and priced. The regime's parameters are interface I4.
U4 [UNPACKED] — The audit channel — from K13, K8, K11, K19 under K12. The calibration referent must trace to the owner-anchored standard (K13 via U3); dependence-bounded evidence (K8) under the shared-substrate ecology (K11) means the system's own confident agreement cannot audit itself; K19 extends the audit's gaze to every actor. Hence a standing channel of engineered-independence checks — blind seeded items indistinguishable in distribution (an empirical property to be tested, not assumed — v0.1 overclaimed it), randomized deep audits at rates set by the sampling-plan tradition (I2), divergence tracking between live scores and held-out gold. Permanent within the domain, because the conditions that require it (K11, K12, K10) are the domain's standing conditions. Unpredictability does not make audits unpriceable — review corrected v0.1 here — it degrades the attacker's per-item information and raises the variance of evasion, which with K19's symmetric application is the available lever.
U5 [UNPACKED] — The dial's one-way glass — from K16 under K10. K16 is the commitment; U5 is its implementation under pressure: perception-fixed, stakes-sterile evaluation; every commercial adjustment expressed as explicit thresholds over unchanged measurements; every batch stamped with profile and corrected residual-error estimate; bar changes prospective and announced (K13). Not a theorem — v0.1's "theorem" framing was circular, as review showed — but the unpacking is tight: alternatives that adjust perception under pressure violate K16 directly, and alternatives that adjust it "transparently" still break comparability of the K0 record across the adjustment.
D5 [DESIGN RESPONSE] — The defense suite — satisfying K10/K11/K19 constraints. Stakes-sterile prompts, evidence-perturbation probes (with the corrected rationale: a verdict that survives evidence-swap has failed to demonstrate dependence on the record — grounds for re-examination, not automatic falsity), cross-family routing (palliative under K11, not cure), worker-level economics and provenance, owner-side audit logging (K19). Adopted as this program's response; admissible alternatives exist; the constraints they must satisfy do not move.
D6 [DESIGN RESPONSE] — Feedback bounds — satisfying K10/K14/K17/K20 under K0. Task-referenced, never person-referenced (K17's spirit; rank-reference invites the K10 multitask distortion). Grounded to the verdict protocol before delivery (K14 reflexivity). No stylistic guidance where style is not criterial — with the boundary given by C1's construct, correcting v0.1's conflation of stylistic with judgment diversity: guidance toward criterial clarity serves K0; pressure toward the evaluator's non-criterial preferences homogenizes the signal (K0) and publishes gradient (K10). Population-level diversity monitoring stands as the K20-adjacent sensor.
D7 [DERIVED] — Reflexive enrollment — from K4, K14. Evaluators are defined by verdicts (K4); verdicts owe the protocol (K14); therefore the machine evaluator's reliability, bias, and calibration are measured under the same protocol obligations as human raters'. Whether the same statistical model fits both is an interface question (I5) — v0.1 overreached to "same measurement model," review caught it, and the entailed core is the protocol symmetry, not the model identity.
D8 [UNPACKED] — Version discipline — from K13, K16 under K9. Reproducible verdicts against a citable bar (K13, K16) with standing amendment pressure (K9) require: pinned versions of instructions, configs, evaluator components, and policies; replayability sufficient to reconstruct any binding verdict's grounds (K15 sets the sufficiency bar — what the bound person could contest); and per-amendment retroactivity handling within K16's constraint (retroactive re-scoring may only ever be exculpatory or dataset-side; the bar a person was judged against does not move backward).
Part IV — Interfaces
Declared slots where perishable, measured facts enter. The kernel defines the slot and the obligation; measurement fills it; published literature informs experiment design and priors but never fills a slot (K16: a borrowed number reported as if it measured this system is a number known to be biased-as-stated).
- I1. Checkability and lane maps. Which checks are certificate/read-checkable vs re-derivation-class, and which criterion families sit in which lane, per project and per evaluator generation — re-surveyed every generation under the migration principle, in both directions.
- I2. Error prices, thresholds, budgets. Owner-declared relative error costs; operating points from measured curves; audit and escalation rates seeded from the acceptance-sampling tradition; gold budgets from K7(ii) arithmetic at declared confidence.
- I3. Granularity and anchoring parameters. Decomposition grain, exemplar counts, context-preservation bounds — measured optima, not doctrine.
- I4. The reference-standard regime. Adjudicator selection, blinding, disagreement handling, gold residual-uncertainty quantification, contamination controls.
- I5. Measurement-model fit. Which reliability/bias models fit human raters, machine evaluators, and hybrids; where shared models are justified and where they are not.
- I6. Behavioral-response parameters. Anchoring effects in adjudication interfaces, feedback-response and gaming rates, population drift under deployment — the K10 dynamics, quantified locally.
- I7. The legal interface. Current statutes, doctrines, scope determinations, counsel opinions — versioned, jurisdiction-mapped, censused per project (two-sided: EU and US at minimum).
- I8. Fairness metrics and disparity bounds. Which protected classifications, which disparity measures, what acceptable bounds, decided by whom — a governed choice-point with legal floors (K21: adverse-impact doctrine) and an owner beyond this document; the kernel's contribution is that error burdens are measured per group wherever K18-sanctions or K21-scope attach, because an unmeasured disparity in false-accusation rates is a K15 violation someone specific is absorbing.
The interface rule: capability is rented, walls are owned. Every I-value is re-measured on the deployment tier at each generation; no I-value is ever promoted into Parts I–III.
Part V — Declared choice-points and holes
Category (e) of the discipline: choices the kernel deliberately leaves to named owners, with obligations attached — and questions on which it is honestly silent.
H1. Aggregation formulas. No principled unique map exists from claim verdicts to item dispositions. Obligation: explicit, versioned, owner-signed, error-tolerant under K7's claim-level error reality. Owner: project owner at compilation.
H2. The entailment standard. Between strict entailment and loose support there is no theoretically privileged point. Obligation: choose, measure the false-flag price (I2/I6), disclose, own. What is forbidden is presenting any point as derived.
H3. Interim authority between amendments. K13 reserves settlement to the owner; it does not say whether provisional owner rulings may bind before formal amendment, or how long interim states may persist. Genuine governance choice; obligation: whatever is chosen, K16's no-silent-motion and D8's versioning apply to interim states too.
H4. Project legitimacy. The kernel cannot make a project worth doing, and K20 does not pretend otherwise — it obligates evidence-reporting, not moral laundering. Whether to take, keep, or fire a project whose construct-validity signals are bad is a decision above this document.
H5. The acceptable-residual question. K16 forces every batch to carry its stamped error estimate; nothing in the kernel says what residual error is acceptable to sell at what price. Commercial-ethical judgment, made with open eyes — which is all a measurement layer can force.
Changelog v0.1 → v0.2 (the adversarial pass, and what it broke)
Three independent critics reviewed v0.1 (two Claude-family, one GPT-5.6-class at maximum effort). The GPT-5.6 report found no derivation fully entailed as written and multiple overclaimed axioms; its findings drove this revision. Principal repairs: (1) scope declaration + migration principle added — K5/K6/K7-class claims were false as universals (formal certificates, total specifications, proof-checking are real) and are now true by scope; (2) the COND tag introduced — behavioral and ecological regularities were masquerading as permanent FACTs; (3) K2/T1 circularity removed — the construct is now a constrained governed choice (C1), not a fake theorem; (4) T7's "theorem" demoted to the U5 unpacking it always was; (5) the T6/K15 contradiction fixed — inside platform-work scope, no operating point licenses autonomous detriment, full stop (U2); (6) missing kernel elements added: evidence integrity (in K14), specification-risk allocation (K17), measurement/attribution/sanction separation (K18), symmetric threat model (K19), construct-validity duty (K20), trust termination and gold-uncertainty (U3), fairness interface (I8); (7) the discipline gained category (e), repairing the holes-are-unfillable defect; (8) the minimality rhetoric replaced with a dependency table; (9) "the one probe K9 cannot price," "an anchored human is a copy," "same measurement model," and the recall-converts-to-verified incoherence retracted or corrected; (10) untagged working prose demoted to commentary or given premises. Residual findings from the two Claude critics are reconciled on arrival; this version number does not change silently (K16 applies to the kernel itself).