"""System and Pilot pages, document register."""
from site_common import R, G, at, write_page


def build_architecture():
    parts = []
    at("architecture.html", "main", "System - pipeline and claim types")
    parts.append("""
<h1>The system</h1>
<p class="doc-dateline">How a verdict is produced, and why each part exists - 2026-07-15</p>

<p>The stable thing here is not a model. It is a contract: what counts as evidence, what each criterion demands,
what a verdict must contain, and who may change what. Models are replaceable parts inside that contract. Every
decision the system makes must be reconstructible from one auditable unit:</p>

<pre>Criterion C applies.
Attempt span A exhibits behavior B.
Evidence E supports, contradicts, or is insufficient for B.
B does or does not satisfy C.
The project's decision policy assigns consequence S.</pre>

<h2>The pipeline, in order</h2>
<ol>
<li><b>Intake and integrity.</b> Check provenance, completeness of the record, and eligibility before anything
is judged. A gap in the record is routed to record repair, never held against the worker.</li>
<li><b>Compile the contract.</b> Project instructions become versioned criteria, proof standards, worked
examples, and evidence rules - with the project owner signing off on real graded cases, because instructions
alone compile badly.</li>
<li><b>Decompose and type.</b> The writeup is split into claims, each typed: grounding, warrant, calibration,
completeness, or opinion. Type determines machinery. Checks the system cannot certify - those requiring
re-derivation beyond its measured competence - are marked as such rather than guessed at %s.</li>
<li><b>Verify in lanes.</b> Deterministic checks run on everything; cheap screeners triage; frontier models
judge with the same evidence the worker had; contested items surface instead of being forced.</li>
<li><b>Adjudicate criteria.</b> Positive evidence, defects, omissions, and open questions are recorded
separately, then rolled up by the project's explicit, versioned formula.</li>
<li><b>Route.</b> Clear cases decide; borderline cases get deeper verification; only decision-changing
ambiguity reaches a human, framed as one bounded question.</li>
<li><b>Feedback.</b> Task-referenced only, quoting claim, evidence, clause, and fix - and it must pass the same
grounding gate it enforces before delivery.</li>
<li><b>Monitor.</b> Blind gold items, drift sensors, divergence tracking between live scores and held-out gold,
and appeals that write back into the contract.</li>
</ol>

""" % R("F26-01"))
    at("architecture.html", "ontology", "System - claim types")
    parts.append("""
<h2 id="ontology">Different claims need different proof</h2>
<p>The table below is the type system that keeps opinions from being truth-scored and absence claims from
receiving false certainty. The references point to the evidence behind each treatment.</p>
<table>
<thead><tr><th>Claim type</th><th>The question</th><th>Treatment, and why</th></tr></thead>
<tbody>
<tr><td>Grounding</td><td>Does the cited evidence say this?</td><td>Span-level entailment check against the
record. Checkers confirm support far more reliably than they catch its absence, so the fail class is measured
directly, never assumed %s %s.</td></tr>
<tr><td>Warrant</td><td>Does the evidence justify this strength of conclusion?</td><td>Reasoning check confined
to the record, with context kept around the claim - over-splitting measurably hurt strong verifiers %s.</td></tr>
<tr><td>Completeness / absence</td><td>Is anything required missing?</td><td>Compiled into explicit checklists.
Concurrence with "no errors" is labeled not-contradicted, never verified, until planted-defect recall is
measured - detecting what is absent is the structurally weakest lane %s.</td></tr>
<tr><td>Opinion</td><td>Is the stance consistent with the evidence cited for it?</td><td>Never truth-scored.
Checked only for contradiction with, and proportion to, its own cited support %s.</td></tr>
<tr><td>Undecidable</td><td>Do the inputs decide this at all?</td><td>Routed to the owner as an instructions
problem, without penalty to the worker - forced choices on ambiguous items provably corrupt evaluation %s %s.</td></tr>
</tbody>
</table>

<h2>Long records are a named failure mode, not a hope</h2>
<p>A model reading a long evidence record misses things in three different ways, and only one of them is easy:
the passage can be lost in sheer length; the model can read the right passage and fail to connect it to a claim
phrased in functionally equivalent but completely different words; and the evidence can be no passage at all -
a property of the whole trajectory, assembled from state scattered across the record, invisible to any local
reading %s %s. Chunking the record fixes only the first. A checklist of chunks examined over the other two is
false confidence: a complete-looking audit of a search that could not have seen the evidence.</p>
<p>So the design does not rely on reading strategy. In order: the record itself is restructured - transcripts
are logs this platform emits, so tool calls, file changes, errors, and state transitions are parsed into a
typed index, each extraction a short, individually measurable task, and most functional claims become index
queries rather than semantic search %s; the evidence contract can require workers to attach pointers to
load-bearing claims, turning open search into bounded checking of cited spots %s; what remains is scanned with
the claim in hand and running state, and its discovery rate is measured by planting evidence - including
semantically distant and cross-record distributed plants, never just verbatim needles %s; and claims that
survive all of that as irreducibly global go to a lane of their own: assisted, human-routed, or honestly
abstained, sized by measurement each model generation. Coverage statements on verdicts name the detector and
its measured recall, or they do not ship. The worker-protecting half stands throughout: a missed support reads
"unsupported," which requests evidence and never auto-fails - only found contradiction fails anyone. The
residual risk concentrates in false passes over buried counter-evidence, which is exactly what the standing
audit of confident passes samples, at a rate priced by the distributed-plant number %s.</p>

<h2>A worked case, briefly</h2>
<p>A task asks whether the evidence establishes Initiative X as the primary cause of an improvement. The worker
answers, correctly, that the supplied studies do not establish primacy. A reviewer fails the item: "did not
choose yes or no." The project instructions explicitly permit an inconclusive answer. The system's output:
the attempt is accepted, with the grounding of its conclusion affirmed; the review is returned for rework,
with the unstated binary-answer requirement identified; and the recurring pattern is flagged to the project
owner as an instructions problem. The complete machine-readable trace of this case ships in the package -
<a href="documents/view/foundation-examples-evaluation-output-example-json.html">open it</a> to see exactly
what the system records at each step.</p>

<h2>Authority is earned in levels</h2>
<table>
<thead><tr><th>Level</th><th>What it means</th><th>What it may do</th></tr></thead>
<tbody>
<tr><td>A - Structured</td><td>Valid contracts, criterion findings, evidence links.</td><td>Decision support only.</td></tr>
<tr><td>B - Calibrated</td><td>Measured confidence, risk-coverage curves, locked tests.</td><td>Clear-case automation may begin.</td></tr>
<tr><td>C - Governed</td><td>Shadow deployment, drift monitoring, replay, appeals.</td><td>Production decisions in approved lanes.</td></tr>
</tbody>
</table>
<p>Nothing accepts or rejects autonomously below level B, and decisions of significant detriment stay with a
human everywhere - our commitment, and for EU workers the law's %s %s.</p>
""" % (R("GF-07"), R("GF-01"), R("GF-03"), R("CM-06"), R("GF-05"),
       R("AJ-02"), R("F26-08"),
       R("AJ-12"), R("GF-04"), R("F26-02"), R("GF-09"), R("CM-06"), R("CM-02"),
       R("CG-07"), R("CG-11")))
    write_page("architecture.html", "System", "The AutoQA pipeline, claim ontology, worked case, and authority levels.", "architecture", "".join(parts))


def build_pilot():
    parts = []
    at("pilot.html", "main", "Pilot - gates and objectives")
    parts.append("""
<h1>The pilot</h1>
<p class="doc-dateline">A measurement plan that can stop, narrow, or graduate - 2026-07-15</p>

<p>The pilot answers five questions leadership can act on: whether criterion-level checking agrees with
adjudicated truth more often than our current review layer does; how much of the volume it can decide within
the project's error limits; whether escalated humans actually add information; whether grounded feedback
changes worker behavior; and what an accepted, expert-valid datum costs end to end. Four outcomes are
acceptable by design - stop, narrow, assist-only, or selective graduation - and a credible stop is a success
of the process, not a failure of it.</p>

<h2>The gates, in order</h2>
<ol>
<li><b>Measure the current human system.</b> Dual-review a common item set; measure reviewer agreement and code
every disagreement as instructions, expertise, attention, or legitimate difference. This baseline has never been
measured for our population and everything downstream calibrates against it.</li>
<li><b>Compile one project contract.</b> Criteria, proof standards, worked examples, evidence rules - signed off
by the owner on real graded cases.</li>
<li><b>Build the gold sets.</b> Adjudicated development, calibration, and test data; rare failures oversampled;
disagreement preserved rather than voted away; planted defects and gaming attacks included.</li>
<li><b>Run the bakeoff on the deployment tier.</b> Compare configurations on the models we would actually run -
current frontier, cross-family. No published number covers these models on this task; this gate produces the
numbers the literature cannot %s.</li>
<li><b>Shadow production.</b> Score live work without touching dispositions; measure drift, position bias,
evidence-swap robustness %s, and confident-pass blind spots via seeded audits %s.</li>
<li><b>Test the human loop honestly.</b> Randomize evidence-only against verdict-visible interfaces %s. The
human lane's justified roles are meaning, contestability, and independent audit; if escalated humans also
out-judge the system on routine items, that is a bonus the data will show - we do not assume it.</li>
<li><b>Graduate by lane, or do not.</b> Authority only where precommitted error ceilings hold on untouched
test data %s - and nowhere that law reserves the decision to a person %s.</li>
</ol>

<h2 id="risks">What we expect to go wrong, and the sensor for each</h2>
<table>
<thead><tr><th>Risk</th><th>Control</th><th>Sensor</th><th>Evidence</th></tr></thead>
<tbody>
<tr><td>Consistent but wrong judge</td><td>Adjudicated gold; corrected statistics only</td><td>Validity by
criterion and agreement stratum</td><td>%s %s</td></tr>
<tr><td>Humans rubber-stamping the machine</td><td>Blind, evidence-only review</td><td>Overturn quality and
anchoring deltas</td><td>%s %s</td></tr>
<tr><td>Rubric drift</td><td>Versioned contract loop; owner sign-off on real cases</td><td>Disagreement clusters
and appeal themes</td><td>%s %s</td></tr>
<tr><td>Workers gaming the judge</td><td>Stakes-sterile prompts; seeded gold; evidence swaps; economics at the
account level</td><td>Scores rising on live work while flat on held-out gold</td><td>%s %s %s</td></tr>
<tr><td>Correlated blind spots across models</td><td>Cross-family checks; permanent expert audit</td><td>Error
overlap between judge and generators</td><td>%s %s</td></tr>
<tr><td>Wrong feedback teaching wrong lessons</td><td>Feedback passes its own grounding gate</td><td>False
accusation rate; repeat-error trends</td><td>%s %s</td></tr>
<tr><td>Judging beyond its competence</td><td>Route by checkability; abstain honestly</td><td>Performance by
difficulty slice</td><td>%s %s</td></tr>
<tr><td>Silent evidence misses in long records</td><td>Typed-event indexing; citation contracts; detector-named
coverage - chunk checklists alone are inadmissible</td><td>Discovery recall on planted evidence including
semantically distant and cross-record distributed plants</td><td>%s %s</td></tr>
<tr><td>Harming workers unlawfully or unfairly</td><td>Human decisions on detriment; explanation and appeal;
group-level error monitoring</td><td>Appeal outcomes; adverse-action audit</td><td>%s %s %s</td></tr>
</tbody>
</table>

<h2>What the pilot needs from the organization</h2>
<p>Not engineering, at the start. It needs decision rights (the standard, the project, the boundaries), expert
hours for adjudication, and patience for a baseline measurement before any automation verdict. The requirements are
argued one by one in <a href="decisions.html">the decision register</a>; the scorecard, launch gates, and full
protocol are in the <a href="documents/view/foundation-benchmark-protocol-md.html">benchmark protocol</a>.</p>
""" % (R("AJ-03"), R("GF-10"), R("CM-02"), R("CM-03"), R("HS-07"), R("CG-07"),
       R("AJ-03"), R("AJ-02"),
       R("CT-02"), R("CM-03"),
       R("RR-05"), R("CT-04"),
       R("CT-09"), R("F26-03"), R("AQ-02"),
       R("CT-05"), R("AJ-08"),
       R("CM-08"), R("CM-07"),
       R("AJ-11"), R("CT-08"),
       R("AJ-12"), R("GF-09"),
       R("CG-07"), R("CG-11"), R("DA-02")))
    write_page("pilot.html", "Pilot", "The measurement pilot: gates, risks, sensors, and what it needs from the organization.", "pilot", "".join(parts))