Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 13 additions & 11 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@

A framework for deciding **where determinations are supplied, how they are assured, and who answers for them** — at the level of individual decisions rather than whole jobs.

It applies to any arrangement that determines choices against ground: programs, models, humans, organisations, markets, immune systems, and compositions of them.
It is written to apply across arrangements that determine choices against ground — programs, models, humans, organisations, markets, immune systems, and compositions of them.

\---

Expand Down Expand Up @@ -102,25 +102,27 @@ See [`core/01-the-principle.md`](core/01-the-principle.md) and [`core/02-complet

\---

## The central result: check the work or check the worker
## The central claim: check the work or check the worker

The framework's most important result concerns the **acceptance predicate**: the criterion by which an outcome would be judged acceptable.
The framework's central claim concerns the **acceptance predicate**: the criterion by which an outcome would be judged acceptable.

The irreducible judgment floor is not a property of how "difficult" a task is.

It is a property of whether adequacy can be checked.

> **The floor is non-zero exactly when, and because, you cannot check the work.**

Where the acceptance predicate **closes for the arrangement** — relevant ground is observable and adequacy can be evaluated within the declared resource, latency, confidence, and assurance bounds — no particular determiner is required for trust. Different paths may produce acceptable outputs because the result itself can be checked.
*(Claim `DDD-floor-02`, **projected** — argued, with a declared falsifier that has not been met.)*

Where the acceptance predicate **closes for the arrangement** — relevant ground is observable and adequacy can be evaluated within the declared resource, latency, and confidence bounds — no particular determiner is required for trust. Different paths may produce acceptable outputs because the result itself can be checked.

Where the predicate does **not** close, that route to assurance disappears.

Verification moves from the output toward the supplier:

> **You cannot check the work, so you check the worker.**

This explains why organisations use licences, qualifications, grades, track records, certification, institutional standing, and selection.
This is the framework's reading of why organisations use licences, qualifications, grades, track records, certification, institutional standing, and selection — carried as a projected hypothesis (`DDD-hyp-05`), not a finding.

They are not merely descriptions of capability.

Expand Down Expand Up @@ -317,7 +319,7 @@ An open predicate within capacity remains judgment.

Overflow on an open predicate produces escape.

This also yields a mechanical account of one class of hallucination: output decoupled from correct ground because that ground is absent, false, or present but unresolved.
Read as exposition, this suggests a mechanical reading of one class of hallucination: output decoupled from correct ground because that ground is absent, false, or present but unresolved. No claim carries that reading; the mechanism claim itself (`DDD-floor-01`) is `reported` on toy actors only.

See [`core/11-the-floor-mechanism.md`](core/11-the-floor-mechanism.md).

Expand Down Expand Up @@ -351,11 +353,11 @@ See [`core/07-determination-and-intelligence.md`](core/07-determination-and-inte

\---

## A worked instance outside software
## A suggestive parallel outside software

The actor-general vocabulary is tested against the vertebrate immune system.
The actor-general vocabulary is read against the vertebrate immune system.

The mapping is not intended as metaphor:
The reading is a **suggestive parallel with known disanalogies** — that demotion is on record, and no claim carries the instance at any status. The mapping offered:

|Store|Immune-system instance|
|-|-|
Expand All @@ -364,11 +366,11 @@ The mapping is not intended as metaphor:
|**Judgment**|adaptive per-encounter response|
|**Escaped**|a pathogen no response catches|

The case also supplies an ensemble actor: diversity across a population carries coverage no single member can.
The case also suggests an ensemble actor: diversity across a population carries coverage no single member can.

> **Redundancy buys reliability. Diversity buys coverage.**

The immune system matters because no engineer specified it. If the framework's categories only worked for deliberately engineered systems, the actor-general claim would fail here.
The parallel matters because no engineer specified the immune system: a vocabulary that could only describe deliberately engineered systems would not be actor-general. The instance is offered as a reading to be broken, not a test that was passed.

See [`core/12-the-licensing-instance.md`](core/12-the-licensing-instance.md).

Expand Down
14 changes: 13 additions & 1 deletion core/05-accountability.md
Original file line number Diff line number Diff line change
Expand Up @@ -52,17 +52,29 @@ spectrum runs the other way.

> **Accountability completeness is a property of an arrangement, not a capacity of an actor. An
> execution is accountability-complete when it is linked to a persistent responsible principal, an
> attributable record, a defined stake, and an enforceable consequence path.**
> attributable record, a defined stake, an enforceable consequence path, and an authority with
> jurisdiction to enforce it.**
>
> It is independent of pinning resolution, in the sense that it is not recoverable from it — and it
> is the scarcer of the two properties.

That is the completeness condition — five elements: attribution, persistent principal, authority
linkage, stake, sanction path *(claim `DDD-frame-08`, **projected**)*. It is not the definition.
The definition is the settled term embedded below, and the two are different objects.

<!-- ddd:embed id=term:accountability -->
> **Accountability** is a property of the arrangement, not of the executor: attribution of
> the determination, a persistent answerable party, and a borne consequence. An arrangement
> missing any of the three has not allocated the decision's consequence.
<!-- /ddd:embed -->

The definition and the completeness condition differ, and the difference has a test: an arrangement
can instantiate the relation and still be incomplete. Attribution exists, a persistent principal
exists, a consequence is borne — and no authority has jurisdiction to enforce it. Everyone knows who
is responsible; nobody can sanction them. The completeness condition refines the definition's borne
consequence into stake plus sanction path and adds authority linkage; the refinement and the
addition are carried at the claim's grade (**projected**), not the term's (**settled**).

A model does not simply *lack* sanctionability. Persistence depends on identity rules and continuity
of obligation; stake depends on property, role, bond, reputation, or delegated interest;
sanctionability depends on an authority with enforceable jurisdiction — all properties of a
Expand Down
41 changes: 38 additions & 3 deletions core/claims/DDD-frame-08.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -2,13 +2,48 @@ format: 1
id: DDD-frame-08
kind: normative
statement: |
Accountability is a relation (attribution, persistent principal, authority linkage, stake, sanction path), not an intrinsic capacity; an arrangement naming an executor but no principal is incomplete.
Accountability is a relation, not an intrinsic capacity of an executor. Completeness is a design-time condition on an arrangement, distinct from the relation's definition: a complete arrangement links attribution, a persistent principal, authority linkage, stake, and a sanction path. An arrangement can instantiate the relation and still be incomplete; an arrangement naming an executor but no principal is incomplete.
status: projected
region: consequential deployments
test: >-
stakeholder and case studies — completeness of the relation predicting trust and remediation
outcomes better than executor identity
owner: paper-4
changed: v4.5
changed: v5.14 (2026-09-03, pre-transfer session, GATE 1 ruling C — statement re-scoped as the completeness condition; status, region, test unchanged; version per the session's close proposal)
notes: |
Conceptual core verified against canon: core/05 (v4.5, P1) states "Accountability completeness is a property of an arrangement, not a capacity of an actor... linked to a persistent responsible principal, an attributable record, a defined stake, and an enforceable consequence path", and core/01/core/05 §1 "a judgment allocation naming no accountable party is... Escaped with an executor attached". Kept projected: the normative prediction (relation-completeness predicting trust/remediation) is unexercised, needing the stated case studies.
Re-scoped, 2026-09-03 (pre-transfer session, GATE 1 ruling C, Emil). The prior statement read:
"Accountability is a relation (attribution, persistent principal, authority linkage, stake,
sanction path), not an intrinsic capacity; an arrangement naming an executor but no principal is
incomplete." Read against term:accountability (settled, three elements), that left two counts of
the relation's elements with nothing saying which governs. The ruling: the term defines what
accountability is — attribution of the determination, a persistent answerable party, a borne
consequence; this claim asserts what a complete instance requires at design time — the borne
consequence refined into stake plus the sanction path, and authority linkage added as a
completeness condition. The two objects differ, and there is a test: an arrangement can
instantiate the relation and still be incomplete — attribution exists, a persistent principal
exists, a consequence is borne, and no authority has jurisdiction to enforce it; everyone knows
who is responsible, nobody can sanction them. The term deliberately does not carry authority
linkage: a settled definition carries only what the corpus argues at settled grade, and authority
linkage's carriage is this projected claim and DDD-hyp-04's unrun prediction. core/05 §2 states
the distinction beside the term's embed.

Conceptual core verified against canon, citation corrected in the same ruling: the prior notes
cited core/05 §2's completeness sentence alone, which carried four elements (persistent
responsible principal, attributable record, defined stake, enforceable consequence path) — a
four-element source cited as verification for five. The verification is the pair: that sentence
(now carrying all five, attributed to this claim), plus core/05 §2's sanctionability line —
"sanctionability depends on an authority with enforceable jurisdiction — all properties of a
relationship among executor, principal, record, and sanctioning authority" — which is where the
prose argues the fifth element. Also core/01/core/05 §1: "a judgment allocation naming no
accountable party is... Escaped with an executor attached".

Lineage (Paper A's related-work survey, 2026-08-30): four of the five elements are already
Bovens's — the actor–forum relation, with the actor obliged to inform, the forum able to
interrogate, and the forum able to pass judgement and impose sanctions (European Law Journal
13(4), 2007). The delta is authority linkage, which Bovens does not carry as a distinct element,
and a change of tense: Bovens's relation is assessed retrospectively over conduct, this claim's
completeness is constituted at design time. Half the delta is a tense change and is claimed as no
more than that.

Kept projected: the normative prediction (relation-completeness predicting trust/remediation) is
unexercised, needing the stated case studies.
10 changes: 8 additions & 2 deletions core/claims/DDD-measure-11.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ statement: >
function and the deployment distribution and says nothing about the cost of computing a
correct answer. Two tasks with identical verdict entropy can differ unboundedly in
generation cost, so the measure must not be read as pricing generation.
status: reported
status: projected
region: closing predicates only (where H(verdict) exists)
credits: >
Cook-Levin (1971), via DDD-frame-06: satisfiability is linear to check yet NP-hard to
Expand All @@ -21,9 +21,15 @@ falsifier: >
A task family in which verdict entropy bounds generation cost, so that the measure does
price the search.
owner: paper-1
changed: v4.5
changed: v5.14 (2026-09-07, pre-transfer session, GATE 4 ruling — demoted reported -> projected; statement, region, evidence and falsifier unchanged; version per the session's close proposal)
notes: >
Extracted in the core/09 conversion; added to canon at v4.5 (generation-cost
correction). The measure-framed companion of DDD-frame-06 (the closure/generation-cost
separation, established) — the two variables this release separates must not be re-fused
through the measure.

Demoted reported -> projected, 2026-09-07 (pre-transfer session, GATE 4 ruling, Emil):
the only evidence entry is a derivation, and spec/claim-format.md §5 defines reported as
carrying at least one evidence entry whose asset reproduces. The derivation stays
recorded; the status now matches what the evidence carries — and matches how the primer's
§6 already read this claim. Restatus to reported when a reproducing asset exercises it.
10 changes: 8 additions & 2 deletions core/claims/DDD-measure-13.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ statement: >
decomposition harvests more of the verdict, runtime demand falls toward the residual the
encoding has not captured, never below what the open part of the predicate leaves
undetermined.
status: reported
status: projected
region: closing predicates only, conditional on DDD-measure-01
credits: The theorem is Shannon's (chain rule, 1948); only the identification is ours.
evidence:
Expand All @@ -15,8 +15,14 @@ evidence:
note: §5, third bullet — the asymptote of the maturation/funnel projection (core/08) in measure terms
falsifier: none — arithmetic given the chain rule; fires with DDD-measure-01
owner: paper-1
changed: v4.5
changed: v5.14 (2026-09-07, pre-transfer session, GATE 4 ruling — demoted reported -> projected; statement, region, evidence and falsifier unchanged; version per the session's close proposal)
notes: >
Extracted in the core/09 conversion (§5). Connects the measure to the maturation/funnel
projection in core/08-projections.md; the seed landed neither the asymptote formula nor
that link.

Demoted reported -> projected, 2026-09-07 (pre-transfer session, GATE 4 ruling, Emil):
the only evidence entry is a derivation, and spec/claim-format.md §5 defines reported as
carrying at least one evidence entry whose asset reproduces. The derivation stays
recorded; the status now matches what the evidence carries — and matches how the primer's
§6 already read this claim. Restatus to reported when a reproducing asset exercises it.
70 changes: 70 additions & 0 deletions releases/v5.14.0.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,70 @@
format: 1
version: v5.14.0
# No `commit`: cut wherever this file lands on the default branch, the normal case
# (spec/release-format.md §2 rule 3).
date: 2026-09-07
basis:
# The claim re-scoped as the completeness condition (GATE 1 ruling C): the settled term
# defines the relation; the claim asserts what a complete instance requires at design time.
- DDD-frame-08
# Examined under the same ruling and deliberately untouched: its prediction already
# quantifies over completeness of the five-element arrangement.
- DDD-hyp-04
# The two demotions: derivation-only evidence under a status §5 defines as requiring a
# reproducing asset (GATE 4 ruling).
- DDD-measure-11
- DDD-measure-13
title: 'Publication readiness — the arity ruled, the front page carries no more than a status does'
summary: |
**The last canon work before the repositories become public**, chosen by one test: does this get
more expensive, or become unfixable, once someone outside can read it or fork it? Interactive
throughout; every change below is a gate ruling (pre-transfer session, Emil; the session record
is the projection repository's `meta/sessions/2026-09-02-pre-transfer/`).

This is a minor and not a patch: a projected claim's statement moves by supersession and two
statuses move. It is not a major because every format-1 claim remains valid unchanged, no id
moves, and no settled node moves.

### The accountability arity, ruled (disposition C)

`DDD-frame-08` (projected) counted five elements where `term:accountability` (settled) counts
three, and nothing said which governs. Ruled: **they are different objects, and the difference
has a test.** The term defines what accountability is — attribution, a persistent answerable
party, a borne consequence. The claim asserts what a *complete* instance requires at design
time — the borne consequence refined into stake plus sanction path, and authority linkage added
as a completeness condition. An arrangement can instantiate the relation and still be
incomplete: everyone knows who is responsible; nobody can sanction them. The claim's statement
now says so; the term is untouched; `core/05` §2 states the distinction beside the embed, with
its completeness sentence carrying all five elements at the claim's grade, attributed. The
lineage lands in the claim's notes at its true size: four of the five elements are Bovens's;
the delta is authority linkage plus the change from retrospective assessment to design-time
constitution — half of it a tense change, claimed as no more.

### Two statuses stop overstating their evidence

`DDD-measure-11` and `DDD-measure-13` demote `reported` → `projected`: their only evidence is a
derivation, and `spec/claim-format.md` §5 defines `reported` as carrying at least one evidence
entry whose asset reproduces. The derivations stay recorded; the downstream primer already read
both conservatively as projected, and canon now agrees with its own projection. Neither is
pinned downstream; nothing fires on their account.

### The front page carries no more than a status does

Repaired in place, converging on the register the README already used where it was right: the
central claim is named a claim with `DDD-floor-02`'s status beside it; the licences sentence
carries `DDD-hyp-05` as a projected hypothesis, not a finding; the hallucination passage is
marked exposition; the immune-system section takes the recorded v3-era demotion — a suggestive
parallel with known disanalogies, offered as a reading to be broken, not a test that was
passed; the applicability sentence states intent rather than asserting universality; and the
closure sentence returns to the settled term's three bounds — the fourth was the front page's
own addition, which three sources contradicted.

### What fires, stated before it happens

When the downstream pin next advances past this release, **exactly one W6 fires**:
`DDD-frame-08`, `sha256:cf73b307…` → `sha256:ef5d5faf…` (statement re-scoped, status held).
The demotions fire nothing — `DDD-measure-11` and `DDD-measure-13` are not pinned, and status
is instrumented by W5 only for pinned ids. Zero W5, zero W7 change. The downstream pin advance
*to* v5.13.0 was executed and verified in the same session (downstream `DDD-dec-35`): the
ground migration's own two-W6 prediction held in every limb, by id and by hash, across a tag
and a merge.
3 changes: 2 additions & 1 deletion spec/claim-format.md
Original file line number Diff line number Diff line change
@@ -1,7 +1,8 @@
# Claim format specification

**Format version: 1.** This file is the versioned schema artifact for claim nodes — shape and
validation rules only. It contains no process (see `meta/conversion-protocol.md`, versioned with
validation rules only. It contains no process (see the projection repository's
`meta/conversion-protocol.md`, versioned with
the way of working) and no content (see `core/claims/`, versioned per claim via `changed`). The
three change independently:

Expand Down
Loading