# Ticket #000058 — `cache_key_9` verifier-policy dimension: mandatory-vs-legible decision + doc reconciliation

**Status:** open · awaiting go/no-go
**Opened:** 2026-05-20
**Scope:** Decide whether the 9-dim `cache_key` (with explicit
`verifier_policy_hash`) becomes the default write form, and reconcile
the "8-dim" language in CLAUDE.md / concepts docs with the
`keys.py` reality (8-dim legacy + optional 9th).
**Audience:** fox + a Dav1d de-novo review of the cache-identity
invariant + maintainers of `arborist/qa/keys.py`.
**Hard constraint:** do NOT silently stale every prior providence
record without a measured, fox-gated reason. The audit chain and the
schema column stay unchanged either way.

---

## 1. Origin

Dav1dPrometheus, *Protocol-Layer AGI, Recursive Falsification, and the
Final Bet — Master Whitepaper Edition* (2026-05-20, Asia/Kuala_Lumpur;
non-public working report, held outside the repo per fox 2026-05-20 —
private-forecast / public-spine split). Its **§2 Erratum 1** and
**§11 Priority 1** call for "mandatory `cache_key_9`":

> No high-warrant cache lookup may omit `verifier_policy_hash`. A claim
> verified under old verifier rules should not silently serve under new
> verifier rules.

This ticket is the isolated decision fox split out from the
admission-discipline cluster (#000059) because flipping it mandatory
would invalidate every cached record — a clean, separable call.

## 2. The requirement is already half-dumb (five-step #1)

**Make the requirement less dumb first.** Checked against the artifact
(`arborist/qa/keys.py:259-307`), the report's stated *correctness*
motivation is **already satisfied** in arborist:

- The verifier-relevant fields (`_VERIFIER_POLICY_FIELDS`, `keys.py:195`)
  are a **subset of the policy dict**. They therefore already fold into
  `governance_policy_hash` (`keys.py:182`), which IS one of the 8
  legacy dimensions.
- The docstring is explicit (`keys.py:269-275`): *"bumping a verifier
  rule bumps BOTH dimensions … Bumping a non-verifier field (e.g.
  temperature) bumps ONLY governance_policy_hash."*

So a verifier-rule change **already** changes the cache_key today, via
`governance_policy_hash`. A claim verified under old verifier rules
**cannot** silently serve under new rules. The report's Erratum 1
premise does not hold for arborist.

What the explicit 9th dimension actually buys is **audit legibility**:
answering *"did the verifier rules change, specifically?"* with a
single hash diff instead of scanning the whole policy. That is real,
but it is not the correctness fix the report claims.

## 3. The decision

Given §2, "mandatory" is the wrong frame. The genuine choices:

- **Option A — leave as-is (legacy 8-dim default, 9th optional).**
  Zero cache churn. Legibility available to callers that opt in.
- **Option B — make 9-dim the default *write* form** (call-sites pass
  `verifier_policy_hash_value`). One-time stale of all prior records on
  next lookup. Buys: every new record is verifier-legible by
  construction. Cost: full re-warm of the providence cache.
- **Option C — Option B but bench-gated + flag-staged** (the
  #000008 / #000011 / #000049 / #000056 rollout discipline): land the
  default-write behind a flag, default-OFF, measure re-warm cost on a
  real shard, fox-flip later.

**Recommendation: Option A + doc reconciliation now**, unless fox wants
the explicit verifier-legibility as a standing audit affordance — in
which case **Option C**, never a hard mandatory flip. Correctness does
not justify the cache invalidation; only legibility does, and legibility
does not require staling history.

## 4. Doc reconciliation (do regardless of A/B/C)

The artifact divergence the report correctly flagged:

- `CLAUDE.md` schema-invariants: *"v9.8 8-dim cache_key"* — states 8,
  silent on the optional 9th.
- `docs/_source/concepts.rst` (concepts page): lists the 8 dimensions,
  *"changing any … invalidates prior records."*
- `arborist/qa/keys.py`: 8-dim legacy **+ optional 9th**
  `verifier_policy_hash`, with the both-dimensions overlap documented.

Reconcile to one truth: **8 canonical dimensions; an optional explicit
9th (`verifier_policy_hash`) for verifier-rule legibility, whose content
is already covered by `governance_policy_hash`.** Wrap any numeric claim
in AUTOCOUNT per the doc-drift discipline if a count is asserted.

## 5. Scope boundaries

- No new schema column. No audit-chain change.
- No hard mandatory flip without a measured re-warm cost + explicit go.
- This ticket does NOT touch the graveyard / self-providence work
  (#000059) or the H-ABCDEFG harness (#000060), though all three trace
  to the same report's "admissible state transition" thesis.

## 6. Done when

Docs reconciled; fox has chosen A / B / C; if B/C, the default-write
behaviour lands flag-staged with a measured re-warm cost recorded here.
