# Ticket #000062 — Mechanistic Witness: governed diagnostic sidecar

**Status:** open · awaiting go/no-go · scaffold-only
**Opened:** 2026-05-26
**Scope:** Specification of a mechanistic-interpretability sidecar
  (CNA / SAE / Neuronpedia-compatible) that produces a content-addressed
  `MechanisticWitnessRoot` over (model, prompts, capture policy, neurons/
  features, intervention deltas), used as a **diagnostic input** to
  SelfModel + benchmark-fixture generation. **Never** a proof of semantic
  truth; **never** a production-steering signal without explicit
  governance promotion through ForkScore.
**Audience:** dav1d (architectural inflection — first time arborist has
  framed interpretability tooling as part of the substrate at all; needs
  the four guardrails below to be load-bearing before any code lands).
**Hard constraint:** soft signals never enter the hard proof path.
  `audit_mode` does not move based on mechanistic-witness output;
  `governance_policy_hash` only moves if/when a promotion is explicitly
  ACCEPT'd via ForkScore with M+C+X axes passing (cf. #000060 §7).

## Problem

The recursive truth-maintenance framing (Dav1d review, 2026-05-26) puts
arborist's verifier + falsifier layers at the "what" of truth: was a
claim grounded, did its evidence support it, did a falsifier defeat it.
None of that surfaces the *internal* "why" of a model's behavior — the
neurons / SAE features / activation patterns that fire when the model
produces a refusal, a hallucination, or a low-confidence answer.

Two reasons this matters for arborist:

1. **SelfModel calibration improves** when the system has internal
   evidence of its own failure modes (e.g. "this question class
   activates the refusal cluster — expect higher refusal rate"). The
   5R workspace (#000017 SelfModel) currently relies on behavioral
   evidence only; a mechanistic channel adds an orthogonal signal.

2. **Benchmark fixtures become falsifiers.** Contrastive-neuron-
   attribution work (Pan et al., 2025; the CNA paper Dav1d cited) shows
   that ablating 0.1% of MLP neurons reduces refusal rate by >50%
   across Llama / Qwen up to 72B. That kind of finding is itself a
   *falsifier* for safety claims — "this model is safe because it
   refuses X" is undermined by "ablating these N neurons breaks the
   refusal." Treating that finding as a benchmark fixture lets the
   substrate use it.

But — and this is the load-bearing caveat — mechanistic interpretability
is **dual-use** by construction. The same technique that identifies a
refusal circuit can be used to break it. arborist must absorb the
diagnostic value without giving up the governance discipline that keeps
soft signals out of the hard proof path.

## Design — four guardrails

Dav1d's review (§4.7) frames the integration rule. Restated for this
ticket:

1. **Diagnostic only by default.** Mechanistic-witness output feeds
   SelfModel + benchmark fixtures + safety audits. It does NOT promote
   audit_mode, write to providence_cache, or move governance_policy_hash.

2. **Sandbox intervention only.** Activation patching / neuron clamping
   runs in a sandbox process, against a sandbox model load, against a
   sandbox eval set. Production inference paths see no intervention.

3. **No production steering without governance.** If a mechanistic
   finding suggests "amplify these neurons to reduce hallucination,"
   that's a *proposal*, not an action. The proposal goes through
   ForkScore acceptance (M+C+X axes per #000060 §7) with the result
   logged as a separate `MechanisticWitnessRoot` and explicit policy
   change.

4. **Feature labels never become semantic proof.** A neuron labeled
   "refusal_cluster" in Neuronpedia is a hypothesis about its function,
   not a guarantee. `MechanisticWitnessRoot` records the LABEL provider
   + version + evidence; the substrate treats labels as fallible
   metadata, not as ground truth.

## Artifact — `MechanisticWitnessRoot`

Following the v9.8 content-addressing discipline, a witness is a Merkle
root over the following preimages (TLV-encoded, hash-chained):

```
MechanisticWitnessRoot = hash_leaf(
    model_config_root                # model name + version + weights hash
  | activation_capture_policy_root   # which layers, which sites, what dtype
  | contrastive_prompt_set_root      # the prompt pair the witness used
  | feature_or_neuron_set_root       # the discovered features/neurons
  | intervention_result_root         # ablation/amplification + delta
  | behavioral_delta_root            # measured output change
  | safety_policy_root               # what governance bucket this lives under
)
```

Two writers running the same prompt set against the same model produce
identical `MechanisticWitnessRoot`. Witnesses can be replayed
(reproducibility), audited (governance), and gossiped (mesh) without
trusting the producer — the same content-addressing discipline that
already covers documents, chunks, and providence cache.

## Restrictions in scope of this ticket

This ticket is a **scaffold only**, like #000057. No code lands until:

- An actual mechanistic finding is sitting in a fixture that arborist
  could use as a SelfModel input or benchmark fixture. (Without a real
  use case, this is speculative tooling.)
- The four guardrails above are formally restated in CLAUDE.md (as
  rules, not just doc).
- An #000060 H-ABCDEFG-M+C+X harness exists to gate any promotion.

Open before any of those land: this is a *placeholder* in the design
log so the architectural framing is captured. Don't proliferate
sub-tickets, don't write a `arborist/witness/` directory.

## Explicitly NOT in scope

- Replacing the verifier or falsifier layers. Mechanistic Witness is
  **additive diagnostic**, never substitutive.
- Direct integration with `providence_cache` or `audit_events` for
  output rows. Witness data lives in its own table (when implemented)
  with explicit hard-vs-soft separation per CLAUDE.md.
- Adversarial robustness claims. The substrate does NOT make claims
  like "this model is safe because the refusal cluster fires" — that
  would itself be a mechanistic-as-proof regression.
- LLM-as-judge over witness output. Witness analysis is deterministic
  + transparent — labels can come from external tools (Neuronpedia
  cross-references, SAE labels with provenance), but interpretation
  stays in code-level rules, not in a model loop.

## Status

Scaffold. Not started. No code expected until the prerequisites land.
Captured 2026-05-26 from Dav1d's de-novo review (§4.7, §9.1.F) so the
framing is in the design log before the first real use case forces an
implementation decision.

If the use case never materializes, this ticket stays scaffold
indefinitely — and that's the correct state. Mechanistic interpretability
is one of the most-promised + least-delivered areas in ML; arborist's
substrate is at risk of absorbing speculative tooling unless we keep
the bar at "real falsifier in hand + four guardrails locked in CLAUDE.md."
