# The AutoQA Kernel **Version 0.3.4 - 2026-07-15 - status: third revision, after three independent adversarial reviews of v0.1 (two Claude-family critics, one GPT-5.6-class critic at maximum effort) and a GPT-5.6-class confirmation pass on v0.2 whose verdict was "still broken - in the FACT layer, the derivation statuses, and the choice discipline." v0.3 implements that verdict's exact repairs. The changelog records every break and fix. The kernel is versioned; it does not change silently.** ## What this document learned to be Three adversarial reviews converged on one lesson, and this version finally obeys it: **the facts in this domain are limitative, and the architecture is chosen.** Mathematics tells you what cannot be presumed - not what to build. Every attempt (v0.1, v0.2) to make the design fall out of the facts as theorems was found, correctly, to be smuggling. So v0.3 is smaller where it claims necessity and more explicit where it chooses: a thin layer of genuinely mathematical facts; presumptions the domain warrants, stated as presumptions with measurement obligations; commitments owned as commitments, each with a named owner and a version; and consequences labeled by what they actually are. This is not a retreat from rigor. For a system whose product is honest verdicts, the foundation's rigor *is* its refusal to claim more than it can show. ## Scope and the migration principle The kernel governs **evaluative claims about open-ended human work for which no sound, complete certificate system exists** - "this critique is well-grounded," "this severity matches the evidence," "nothing important is missing" - judged against natural-language instructions and a bounded evidence record. Where a criterion admits a total, sound decision procedure, it is not the kernel's problem: it migrates to the deterministic lane and ordinary software-correctness discipline. As capability and formalization advance, checks may graduate out (and mis-formalized checks may migrate back). The kernel's claims concern the residue; the residue's boundary is re-surveyed every generation (I1). ## Tags - **[TELOS]** - the stipulated purpose. - **[DEF]** - thin lexical definitions; vocabulary only. - **[FACT]** - mathematical/logical constraints, stated minimally. All are *limitative*: they say what may not be presumed or claimed, never what must be built. - **[COND]** - warranted presumptions of this domain: defaults the program adopts pending measurement, each tied to the interface that measures it. Not facts; not pretended to be. - **[CHOSEN]** - normative commitments, owned and versioned. Motivations are given as motivations; where a motivation contains a causal claim, it is a belief held, not a theorem proved. - **[LAW]** - the thin legal-floor rule; current statutes and doctrines live on the versioned legal interface (I7), because law is external and changes. Parts II and VI are meta-analysis and carry no tags by design. Commentary is marked and non-load-bearing. **The discipline.** A design element is legitimate only as: (a) **[DERIVED]** - entailed by named elements; (b) **[UNPACKED]** - a consequence of a CHOSEN commitment under named pressure; (c) **[DESIGN RESPONSE]** - one admissible architecture satisfying kernel constraints, adopted and replaceable; (d) an **operationalization** filling a declared interface slot with a measured-error obligation; (e) a **governed choice** at a declared Part V choice-point - *with a named owner, a version, and an effective date*. Anything else is an explicit kernel amendment, or it does not ship. --- ## Part I - The kernel **K0 [TELOS].** The enterprise exists to increase the validity of training data about genuine human judgment: to make the recorded signal about what humans actually judged, and why, more truthful, more traceable, and more usable - not to make workers agree, not to make reviews uniform, and not to replace the judgment the data exists to capture. *Commentary - the motivating problem, named.* This enterprise is being considered because human reviews of human-labeled data are not reaching consensus. K0 takes a position on that problem rather than dodging it: non-consensus is a symptom with four distinct causes - ambiguous instructions, reviewer error, missing expertise, and legitimate difference of judgment - and a system that targets consensus itself treats all four identically, by erasure. That cure kills the patient twice: it caps the system's validity at the reviewers' own unmeasured reliability, and it manufactures agreement exactly where the recorded signal should show a defensible plurality. What the organization needs from its non-consensus problem is explanation, pricing, and reduction at the source: instruction ambiguity routed to the owner and fixed, error caught claim by claim, expertise gaps routed to competence, and genuine plurality recorded as such. Consensus in application then rises as a byproduct of removing its illegitimate causes - it is the one thing the system must never pursue directly. (This is commentary; the operative content lives in K0, D1, C1, and K14's underdetermine disposition.) ### Definitions **K1 [DEF].** "Project" names a triple (instructions, evidence policy, owner) - the owner being the party holding amendment authority over the first two. (The program takes on work only after it is in this form: a scope condition.) **K2 [DEF].** "Quality" names whatever construct a project-version's contract fixes as the target of evaluation. Which construct - see choice-point CP1. **K3 [DEF].** "Verdict" names a claim about quality issued for a project-version. What verdicts must carry is protocol (K14). **K4 [DEF].** "Evaluator" names anything that issues verdicts - human, model, or hybrid. Kernel requirements attach to verdicts, never to substrates. ### Facts (limitative) **F1 [FACT] - Certificates, and their absence.** A sound, checkable certificate lets a verifier certify work independently of its own generative competence. Absent such a certificate, no certificate-based entailment exists: a reliability advantage of evaluator over producer is then not a logical consequence of anything - it is an empirical property, if it is anything. (No ceiling is asserted: decomposition, tooling, repetition, and discriminative reading can outperform single-attempt generation. The corresponding protocol rule - unmeasured advantage never enters routing or reporting - lives in K14 and I5, where norms belong.) **F2 [FACT] - The witness asymmetry, stated narrowly.** For an explicitly existential claim with a valid witness relation, one verified witness suffices. A universal/absence claim ("no defects," "nothing missing") is warranted only to the extent of a sound completeness argument - and absent one (the kernel's domain, by scope), **a negative search result warrants only a claim about its disclosed procedure and scope.** **F3 [FACT] - Small-signal arithmetic.** (i) Among accusations, the false share is a function of prevalence, sensitivity, and specificity - as illustration only: at 3% prevalence, 95% sensitivity, 99% specificity, roughly a quarter of fail-verdicts are false. (ii) Absent formal assurance, error rates are known through adjudicated observation, whose precision depends on sample size, dependence structure, and the estimation target - and the adjudication is itself fallible, so reference error is part of the accounting (CP3). (iii) Calibration and coverage guarantees are conditional on assumptions linking calibration data to deployment (exchangeability-class); nothing in the mathematics discharges those assumptions. (Whether they hold in a given deployment - including deployments that change their own population - is measured transport, I4/I6.) **F4 [FACT] - Agreement does not self-certify.** Marginal accuracies plus agreement do not identify ensemble correctness without assumptions or bounds on the joint error distribution; in the limit of perfectly shared errors, additional agreeing evaluators add no evidence. Whether given evaluators' errors are dependent is an empirical property of the ensemble at hand. (The rule that it is measured or structurally justified, never assumed away, is P3's presumption discipline and K14's protocol - not mathematics.) **F5 [FACT] - No capability supplies missing premises.** Where the instructions-plus-record underdetermine a verdict, the missing information is not in the inputs, and no evaluator capability manufactures it; a better evaluator converges on better *detection* of underdetermination. (Whether and how often material underdetermination occurs in a given project is not asserted here - it is presumed by P1 and measured at I6.) ### Presumptions of the domain Each is a default the program adopts, with the interface that must keep it honest. None is capability-invariant truth; all are re-examined per project and generation. **P1 [COND] - Underdetermination occurs materially.** Natural-language instructions over open-ended evaluative work are presumed to leave a material share of admissible cases underdetermined. Measured at I6 (the variance-attribution baseline exists to measure exactly this); a project where it measures near zero has little kernel-governed residue. **P2 [COND] - The population is adaptive.** The evaluated population is paid, informed, persistent, and tool-equipped; consequential legible criteria are presumed to create non-negligible incentive and information for boundary-seeking, and incentives on measured dimensions are presumed to divert effort from unmeasured ones (the multitask mechanism). Magnitudes and actual behavioral response are measured at I6, never assumed. **P3 [COND] - Dependence is the default presumption among substrate-sharing evaluators.** Where evaluators (machine or human) materially share training, tooling, or process, error dependence is presumed until measured otherwise (F4 sets the stakes of the presumption). The ecology census - who shares what substrate, including whether producers and evaluators are resource-symmetric - is itself an interface measurement (I9), re-taken each generation. No trend about the future supply of independence is asserted. **P4 [COND] - Frontier mass is presumed nonzero until measured.** Some share of incoming work is presumed to sit where the evaluator can demonstrate no reliability advantage (F1) - from shared substrate (P3), producer assistance, or task difficulty. That share ("frontier mass") is a measured deployment quantity (I1/I6), per project and generation; assisted and escalation lanes persist **while measured frontier mass exceeds declared thresholds - in either direction.** The v0.1-v0.2 claim that this band permanently "does not empty" is retracted as unproven. (The standing obligation to measure frontier mass, and the routing capability that acts on it, are K14-protocol and D2-architecture respectively - a COND carries presumptions, not obligations.) **P5 [COND] - Reading long records is unreliable evidence discovery, in three distinct ways.** Within this domain, an evaluator misses in-record evidence through (i) attention dilution - the passage is lost in length; (ii) recognition failure - the evaluator reads the relevant passage and does not connect it to a claim phrased in functionally equivalent but semantically distant terms; and (iii) compositional distribution - the evidence is not a passage at all but a property of the trajectory, assembled from state across distant parts of the record, so no local reading can see it. All three failures are silent. Chunking addresses only (i); similarity-based retrieval addresses none of them and is structurally worst at (ii). A per-chunk coverage ledger over failures (ii) and (iii) is false confidence: a complete-looking record of an examination that could not have seen the evidence. Presumed binding until measured (I10) with plants that specifically include semantically distant and cross-chunk distributed evidence - never lexical needles alone - per record-length and claim-type bucket, re-measured each generation. ### Commitments Owner of K-commitments: program governance (the kernel's own amendment authority), version-stamped with the kernel. **K13 [CHOSEN] - Owner authority and the citable bar.** Prospective interpretation may be delegated; *settling* a contested or novel meaning is reserved to the project owner and takes effect as a versioned amendment; the bar workers are judged against never changes silently, and no later bar is applied retroactively to earlier work. Motivation: some authority structure must be chosen for evaluation to be reproducible; this one keeps every verdict traceable to a citable version. **K14 [CHOSEN] - The verdict protocol.** An admissible verdict cites the instruction clauses it applies and the evidence it rests on; carries calibrated confidence; is issued under a declared evidence-integrity regime (provenance and completeness checked before grounding; record gaps disclosed and routed to record repair, not to worker detriment); and **no synthetic verdict is issued below the project's declared admissibility confidence - the evaluator abstains or escalates instead.** The verdict set includes an explicit *underdetermine* disposition. One further clause, added at v0.3.3: a verdict's grounds include **coverage accounting** - which parts of the record were examined against which claims, by what procedure - and any claim of record-level support or non-contradiction extends no further than the coverage actually achieved. This is F2's disclosed-scope rule applied inside the record, where P5 says a single pass cannot be presumed to have looked everywhere. Reflexivity: verdicts, feedback, and adjudications are themselves evaluative work products and owe this protocol. **K15 [CHOSEN] - Contestability, everywhere.** Any verdict that binds a person must be reconstructible from its grounds by that person and contestable through a channel that can change the outcome - for all workers, everywhere, not merely where law compels it. Motivation, held as belief: unaccountable verdicts corrupt the K0 record silently; and the scope beyond legal compulsion is a worker-dignity commitment this program elects by name. **K16 [CHOSEN] - Measurement integrity.** The system never knowingly reports a biased number as unbiased, and disposition pressure acts downstream of the recorded measurement or not at all. Numbers estimated under assumptions are reported as such. **K17 [CHOSEN] - Specification-risk allocation.** The cost of ambiguity the worker did not create sits with the specification's owner. Workers may be contractually obligated to flag ambiguity; they are never penalized for its existence. This protection is categorical: it is not tradeable against any error price (CP4). Motivation, held as belief: assigning ambiguity cost to the party with amendment power generates correction; assigning it to workers generates fear and hiding. **K18 [CHOSEN] - Separation of measurement, attribution, and sanction - constitutive.** "This work has a defect," "this person is responsible," and "this consequence is warranted" are, in this program, three determinations with three evidence standards by construction. No automation of the first constitutes the second or third; the second and third have their own proceedings and cannot be collapsed by any owner's error-price declaration (CP4 is subordinate to this). **K19 [CHOSEN] - Symmetric threat model.** The program treats every actor with power over the loop - workers, reviewers, adjudicators, project owners, operators, buyers - as within the threat model, by policy extending to them the same presumption of incentive exposure that P2 warrants for the workforce. Integrity controls (audits, logs, gold custody, disclosure) are owed upward and sideways, not only downward; the concrete control matrix per actor is a design obligation (D5) with acceptance criteria at I6. **K20 [CHOSEN] - Construct-validity duty (detection and escalation).** *Commentary (the motivating possibility, not part of the commitment):* instructions can mis-capture the judgment the data exists to serve. The commitment: where evidence of that accumulates (clustered legitimate disagreement, instruction-gap patterns, divergence between what instructions reward and the project's stated purpose), the program reports it to the project owner and, where contracted, the buyer - through the named escalation channel in the decision register. This duty is detection and escalation, not defense: the kernel cannot force a bad project to stop (CP5 governs what happens next, above this document). **K21 [LAW] - The legal floor, thin.** Jurisdictional law binding on a project's workforce constrains the program as a floor that no internal choice may undercut. Current statutes, doctrines, scope determinations, and counsel opinions live on the versioned legal interface (I7) and are censused per project, two-sided (EU and US at minimum) - they are load-bearing there, and perishable there, by design. **K22 [CHOSEN] - The strictest-regime rider, made unambiguous.** This program adopts globally, by choice: decisions of significant detriment to a worker are taken by a human with real authority and competence - everywhere, not only where a directive compels it. (This resolves what v0.2 left ambiguous: the human-decision floor is global by election; I7 tracks where it is also legally mandatory.) **K23 [CHOSEN] - Fairness commitment.** For any binding use, group-specific error burdens (above all: false-accusation rates) are measured and governed. Which classifications, which disparity measures, and what bounds are acceptable is a governed choice at CP6 with legal floors from I7 (adverse-impact doctrine where applicable); that the measurement and governance exist at all is committed here and is not optional per project. **K24 [CHOSEN] - Exculpatory reopening.** Correcting the record in a worker's favor is always permitted; applying a later, stricter bar to earlier work never is (K13). Reopening a past leniency under the *original* bar is permitted only through the K18 proceedings, never by re-scoring alone. --- ## Part II - Dependency and rationale map *Meta-analysis; untagged by design (the tagging rule governs kernel statements, not this audit of them). This is a map of currently stated rationales - removing an element removes its stated ground, which is not a proof that no other ground could be constructed.* | Element | What currently rests on it | |---|---| | K0 | K20's duty; D6's diversity bound; CP5's stakes; the point of the enterprise | | K1-K4 | Vocabulary for the project-scoped elements (K0 stands without them); K2 feeds CP1, CP8, and K20; K3 feeds K14; K4 feeds D7 | | F1 | D2's classification; the measurement obligation in I5; P4's definition of frontier mass | | F2 | D3's scope-bounded negative verdicts | | F3 | U2's validation gate arithmetic; CP3's reference-error accounting; I2's budgets | | F4 | U4's dependence measurement; skepticism of ensemble agreement | | F5 | D1's underdetermine routing (with K14's chosen disposition) | | P1 | The expectation that the underdetermine class matters; measured at I6 | | P2 | D5/D6 gaming and feedback bounds; measured at I6 | | P3 | U4's engineered-independence requirement; measured at I9 | | P4 | Persistence conditions for assisted/escalation lanes; measured at I1/I6 | | P5 | D9's coverage discipline; I10's measurement; the single-pass certification bound | | K13 | Versioned amendment; citable bars; D8's preservation core | | K14 | Verdict admissibility; abstention; underdetermine disposition; evidence integrity; D7's substrate neutrality | | K15 | Appeals; reconstructible grounds; part of U2's floor | | K16 | U5's core; stamped estimates-under-assumptions | | K17 | D1's non-penalization; a categorical bound on CP4 | | K18 | Sanction gating; a categorical bound on CP4 | | K19 | D5's symmetric control obligation | | K20 | Detection-and-escalation of construct failure | | K21 | Jurisdictional floors via I7 | | K22 | The global human-decision rule in U2 | | K23 | I8/CP6 fairness measurement and governance | | K24 | Worker-favorable reopening; the sanction-only route for the reverse | --- ## Part III - Consequences, honestly labeled **D1 [DERIVED] - Underdetermine handling - from K14, K16, F5, K17, K13, K18.** K14 (chosen) puts the underdetermine disposition in the verdict set; F5 says capability cannot fill missing premises; K16 bars reporting determinacy the inputs do not license as though they did. Routing splits by cause: semantic ambiguity -> the owner as a K13 amendment question; record gaps -> the K14 integrity process (record repair, never worker detriment); any question of worker responsibility for the gap -> a K18 attribution proceeding, separately. K17: no penalty for ambiguity the worker did not create. **D2 [UNPACKED core + DESIGN RESPONSE] - Checkability classification and abstention.** Unpacked core, from K14 under F1: the admissibility rule (chosen) makes abstention mandatory below declared confidence, and F1 bars borrowing presumed reliability on certificate-less checks - so *something* at intake must tell these cases apart before a verdict is attempted. The intake classifier itself is the adopted design response implementing that need (P4 is the presumption that makes running it worthwhile, not a premise that entails it), and its classification (I1) carries at least three states - certificate-backed, partial-assurance, none - because binary "checkable/not" misdescribes tool-assisted and statistical middle grounds. **D3 [DERIVED core + DESIGN RESPONSE] - The absence discipline.** Derived (F2, K16, K14): *a negative verdict may claim no more than the completeness guarantee of its disclosed procedure and scope, and the scope disclosure is part of the verdict's grounds.* Design response (adopted, replaceable): compiling completeness criteria into explicit checklists where the owner can enumerate expectations; and using planted-defect recall to *inform* confidence in not-contradicted verdicts - "inform" strictly, until a transport model relating planted to live defects has been validated for the class (I4). **D4 [DESIGN RESPONSE] - Claim-grained verification.** Adopted (owner: program governance; replaceable): decomposition of writeups into typed claims verified at claim grain, with item dispositions assembled transparently. Constraints it must satisfy come from K14 (clauses and evidence cited; grounds reconstructible, K15). Genuinely holistic judgments - where the ground is a gestalt, not a clause-and-span - are not force-decomposed: they route to the opinion/underdetermine machinery rather than having grounds manufactured for them. Granularity optima: I3. **U2 [split honestly] - Consequences.** - **[DERIVED] The floor:** from K22 (global, by choice) and K21/I7 (legally, where in scope): decisions of significant detriment are taken by a human; no operating point licenses autonomous detriment. From K18: no measurement result constitutes attribution or sanction. From K17: ambiguity-based penalties are barred categorically. - **[DESIGN RESPONSE] The validation gate:** before even human-decided consequences lean on system verdicts, lane error rates are bounded on untouched adjudicated data at precommitted ceilings (F3 supplies the arithmetic that makes anything less self-deception; the gate design itself - untouched split, precommitment, ceilings - is this program's adopted assurance regime, versioned at CP4). - **[Governed choice, CP4] Residual error prices:** the owner declares relative prices for residual tradeoffs - strictly after and subordinate to K17, K18, K21/K22, and K23, which are not priceable. **U3 [Governed choice, CP3, with a derived constraint] - Trust termination.** The chosen reference architecture: chains terminate in owner sign-off for meaning (K13), adjudication panels under a declared regime, and formal certificates where checks have migrated. The derived constraint (F3(ii), K16): terminating in an anchor never asserts the anchor's truth - the anchor's own error is part of the accounting, and where it cannot be quantified without assumptions, it is reported as *unknown or partially identified under named assumptions*, never silently zero. Authority-finality (who may settle), epistemic accuracy (what supports the anchor), and non-identifiability (what cannot be known from inside) are kept distinct in every report. **U4 [DESIGN RESPONSE] - The audit channel.** Adopted: blind seeded items (indistinguishability treated as a measured, decaying property, not an achievement - I6), randomized audits with rates seeded from the acceptance-sampling tradition (I2), divergence tracking against held-out gold, dependence measurement across evaluators (F4, P3). Its continuation is conditional in form - reviewed against measured dependence, gaming pressure, and frontier mass (P4) - and this program expects, as a P2/P3 matter, that the review will keep concluding "continue"; the honest statement is the conditional plus the expectation, not "permanent." **U5 [UNPACKED core + DESIGN RESPONSE] - The dial.** Core, from K16: disposition pressure acts downstream of the recorded measurement. Adopted implementation: stakes-sterile evaluator inputs; commercial adjustments expressed as thresholds over unchanged measurements; batches stamped with profile and residual-error *estimates under named assumptions*; bar changes prospective and announced (K13). Transparent recalibration and versioned equating are admissible under the core when they are measurement-motivated and disclosed; what is inadmissible is perception change *driven by disposition pressure* - the difference is the documented motivation and the K16 audit trail. **D5 [DESIGN RESPONSE] - The defense suite, symmetric.** Worker-facing: provenance and economics at the account level; perturbation probes (a support-removing evidence swap that leaves a verdict standing shows the verdict did not depend on that support - grounds for re-examination, since redundant independent support may exist); cross-family routing (palliative under P3). K19-facing: a control matrix covering every actor class by name - workers (provenance, economics); reviewers and adjudicators (rotation, capture and collusion checks, blind-assignment integrity); project owners (amendment and override audit logs); operators (access separation, gold custody and leakage controls); buyers (pressure disclosure, dial-change co-signatures); and the appeal channel itself (manipulation monitoring, outcome-distribution audits) - each control tied to an I6 acceptance criterion. (v0.2's suite watched mostly downward; review was right that K19 demanded more.) **D6 [DESIGN RESPONSE] - Feedback policy.** Adopted: task-referenced feedback only; no person- or rank-referencing; no stylistic pressure beyond what the construct (CP1) makes criterial; grounded to K14 before delivery; effects measured at I6, with population-level diversity monitoring feeding the K20 escalation channel (the named process, not just a sensor). **D7 [DERIVED, narrow] - Substrate neutrality of the protocol.** From K4 + K14: all verdicts owe the same admissibility protocol regardless of issuer. Which reliability and bias studies fit which evaluator class, and where shared statistical models are justified, is I5 - not derivable, and different failure mechanisms may warrant different designs. **D8 [DERIVED core + DESIGN RESPONSE + K24] - Versioning.** Derived (K13, K15, K16): the applicable bar, its effective dates, and the grounds of every binding verdict are preserved well enough for the bound person to contest them. Design response: full component pinning and computational replay (adopted for operational value; not pretended to be entailed). K24 governs reopening. **D9 [UNPACKED core + DESIGN RESPONSE] - Record-coverage discipline, without the false confidence.** Unpacked core, from K14's coverage clause under F2 and P5: no reading strategy - single-pass or chunked - certifies a record-level claim beyond what its measured discovery recall supports, and coverage statements are meaningful only relative to a detector with a measured recall for the evidence class in question. A ledger of chunks examined is not coverage; "checked by detector D, whose planted-evidence recall for this claim type at this record length is R" is. Adopted design response, in order of preference: (1) change the substrate - records in this domain are semi-structured logs the platform itself emits, so deterministic parsing plus per-event typed extraction (each a short-context task with measurable per-event accuracy) turns most functional claims into queries over an index rather than semantic search over prose; capture-time structuring is a lever the operator owns; (2) change the contract - evidence policy may require workers to attach pointers to load-bearing claims, converting open search into bounded cited-locus checking, leaving record-wide search only for contradiction hunting and cherry-picking checks; (3) claim-conditioned scanning with running state for what remains, with discovery recall measured on plants that include semantically distant and cross-chunk distributed evidence (P5(ii) and (iii)) - lexical-needle scores are inadmissible as coverage evidence; (4) claims that survive all three as irreducibly global-semantic form their own lane: judge-assisted, human-routed, or abstained, sized by I10 per generation, both directions open. The worker-protecting asymmetry stands and matters more here than anywhere: a missed support yields "unsupported," which requests evidence and never auto-fails - only found contradiction fails anyone (F2's reliable direction) - so the silent-miss harm concentrates in false passes over buried counter-evidence, which the audit channel (U4) samples at an intensity priced by the distributed-plant recall number, not the flattering one. --- ## Part IV - Interfaces Measured, perishable quantities enter only here. Literature informs priors and experiment design; it never fills a slot (K16). Every I-value is re-measured on the deployment tier each generation; none is ever promoted into Parts I-III. - **I1. Checkability and lane maps** - certificate / partial-assurance / none, per criterion family, per generation; frontier-mass estimates (P4) and lane persistence against declared thresholds, both directions. - **I2. Budgets and rates** - operating points from measured curves at CP4's declared prices; audit and escalation rates seeded from the acceptance-sampling tradition; gold budgets from F3(ii) arithmetic at declared confidence and dependence assumptions. - **I3. Granularity and anchoring parameters** - decomposition grain, exemplar counts, context bounds. - **I4. Transport validity** - planted-to-live defect transport models; seeded-item indistinguishability decay. - **I5. Evaluator measurement design** - reliability/bias/calibration study designs per evaluator class; the F1 measurement obligation (no presumed advantage) lives here. - **I6. Behavioral response** - underdetermination prevalence (P1), gaming and feedback response (P2), anchoring effects, diversity drift, K19 control acceptance criteria. - **I7. The legal interface** - statutes, doctrines, scope censuses (two-sided at minimum), counsel opinions; versioned; load-bearing and perishable by design. - **I8. Fairness measurements** - group-specific error burdens for binding uses (K23), with metric and bound selection governed at CP6. - **I9. The ecology census** - substrate sharing among evaluators, producers, experts; resource symmetry between producers and evaluators; measured, not assumed (P3). - **I10. In-record evidence-discovery reliability** - per detector and per claim type: typed-event extraction accuracy; discovery recall for planted support and counter-evidence including semantically distant and cross-chunk distributed plants (lexical needles alone are inadmissible); the record size and claim classes each lane may certify; the size of the irreducibly global-semantic residue lane; re-measured each generation (P5, D9). --- ## Part V - Choice-points Each has a named owner, a version obligation, and an effective date when exercised. This is discipline category (e); v0.2 declared the category and then failed to apply it - review was right. - **CP1. The construct** (owner: program governance, with buyer visibility). Selected from admissible constructs - those whose verdicts can carry reconstructible grounds (K14/K15) and that are fixed per project-version (K13). This program selects instruction-satisfaction-plus-evidence-grounding as its default; fidelity-to-elicited-owner-judgment and hybrids are admissible alternatives a project may choose with eyes open. No uniqueness is claimed; the selection is recorded, versioned, and revisable prospectively. - **CP2. The entailment standard** (owner: project owner at compilation, program-governance sign-off). Chosen point on the strictness continuum; false-flag price measured (I2/I6); disclosed to workers. - **CP3. The reference-standard regime** (owner: program governance). Adjudicator selection, blinding, disagreement handling, gold-error accounting per U3, contamination controls. - **CP4. Residual error prices and the assurance regime** (owner: project owner; subordinate to K17, K18, K21/K22, K23). Gate design, ceilings, and prices for what remains after the floors. - **CP5. Project take/keep/fire on construct-validity evidence** (owner: enterprise governance, named as the executive owner of this program; input: K20 escalations). The kernel obligates the evidence stream; this choice-point owns what is done with it. - **CP6. Fairness metrics and bounds** (owner: enterprise governance with counsel; floors from I7). Under K23's committed obligation that the measurement and governance exist. - **CP7. Interim authority between amendments** (owner: project owner). Whether provisional rulings bind before formal amendment; K16 no-silent-motion and D8 versioning apply to interim states. - **CP8. Aggregation** (owner: project owner at compilation). Where the project contract itself designates a clause as necessary, item failure on that clause follows from the contract's own terms - that much is the contract speaking, not this kernel. The governed choices are which clauses to designate as necessary, and the weighting of everything else - explicit, versioned, error-tolerant under F3's claim-level error reality. - **CP9. Acceptable residual at sale** (owners: enterprise governance and buyer, jointly). K16 bars misreporting and U5's adopted stamp discloses the estimate; this choice-point owns the number someone accepts. --- ## Part VI - Changelog *Meta-analysis; untagged.* **v0.1 -> v0.2** (after the first GPT-5.6-class attack): scope + migration principle added; COND tier introduced; construct circularity removed; dial demoted from theorem to unpacking; the platform-work contradiction fixed; evidence integrity, specification-risk allocation, measurement/attribution/sanction separation, symmetric threat model, construct-validity duty, and trust termination added; discipline category (e) created; minimality rhetoric replaced by a dependency table. **v0.2 -> v0.3** (after two Claude-family reviews of v0.1 and the GPT-5.6-class confirmation pass on v0.2, verdict "still broken"): the FACT layer shrunk to five limitative facts, each stated at the width its grounds support (the "cannot be more reliable" ceiling, the universal witness claim, the "only through sampling" clause, and the "jointly necessary" dichotomy all corrected); the shared-substrate premise, the independence-scarcity trend, and the permanent frontier band demoted from walls to measured presumptions (P3, P4, I9) - the permanence claim retracted and replaced by a standing measurement obligation; the human lane's value split into durable grounds (authority, contestability, law) and a measured ground (independence, I9); the underdetermine disposition, global human-decision floor (K22), fairness (K23), and reopening rules (K24: worker-favorable freely; the reverse only through K18 proceedings) made explicit CHOSEN commitments instead of derivation by-products; every Part III item re-statused per the confirmation pass's exact repairs (D3 split, U1->D4 as design response with a holistic-claim residual, U2 tripartite with categorical floors above prices, U3 as governed choice with the derived anchors-are-not-true constraint, U4 conditional-plus-expectation instead of "permanent," U5 admitting transparent recalibration, D7 narrowed, D8 split with K24); every choice-point given a named owner; the dependency table retitled as a rationale map and completed for K1-K4; Part II/VI exempted from the tagging rule explicitly, closing the self-referential violation. **Independence from model experiments, stated as a checkable property:** strike every LLM experimental result from the record - any model generation - and Parts I-III do not change. The facts are mathematics and logic; the presumptions are warranted by the domain and carry measurement obligations; the commitments are owned choices; the discipline bars derivations from citing benchmarks. The old-model literature shaped the path of discovery - it suggested which constraints to formalize - but it carries none of the justification. The one deliberate retention: adversarial results of any age remain valid attacker floors, since capability asymmetry only strengthens them. **v0.3.3 -> v0.3.4:** P5 rewritten to name the three distinct discovery failures (dilution, recognition, composition) and to state that chunking addresses only the first and that chunk ledgers over the other two are false confidence; D9 rewritten around detector-relative coverage with the substrate-first design order (structured event indexing, citation contracts, state-carrying scans, an honest residue lane); I10 tightened to require distributed and semantically distant plants and to bar lexical-needle scores as coverage evidence. Prompted by the operator's challenge that a model cannot reliably match semantically distant but functionally accurate claims against a 500k-token transcript, and that chunking invites false confidence - both points conceded and encoded. **v0.3.2 -> v0.3.3:** one presumption, one protocol clause, one consequence, one interface - all in response to the silent long-context retrieval question: P5 (single-pass reading of long records is unreliable retrieval, presumed until measured), the K14 coverage-accounting clause (record-level claims extend no further than coverage achieved), D9 (record-coverage discipline: separate auditable discovery step beyond measured reliable length; planted-evidence recall; the false-pass concentration argument), and I10 (the measurement slot). The dependency map gains the corresponding rows. **v0.3.1 -> v0.3.2:** commentary and meta-analysis only; no tagged element changed. The motivating non-consensus problem is named inside K0's commentary and answered by existing kernel content (four causes; erasure versus explanation; consensus in application as a byproduct, never a target), and the model-experiment-independence property above is recorded. **On K25:** per that commitment, this version was delta-checked against the confirmation pass's prescriptions (verdict: 21 implemented / 8 partial / 0 unimplemented, 2 new majors - all folded into v0.3.1); the next full hostile pass is owed at the next version bump or model generation, whichever first. v0.3.1 does not claim to have survived a review it has not had.