From 9e4645f60e1b161ba0a974512f102c2d47dc8ed7 Mon Sep 17 00:00:00 2001 From: "russell@unturf.com" Date: Mon, 1 Jun 2026 07:17:31 -0400 Subject: [PATCH] #000071: rewrite ticket as directive forward-spec (no more rejection archaeology) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Per fox 2026-06-01: replace the descriptive review-archaeology structure with what we SHOULD grow. Ticket goes from 805 lines (original §§1-8 design log + my dav1d-review §0 retrofit) to 389 lines of clean directive spec. What changed in shape: Before: §0 "Dav1d review verdict" decision-table + §§1-8 archaeology of the original Joseph6 spec being rejected. After: §1-12 forward spec. Goal at the top, hard constraints, composite ChainRoot identity, five bridge outcomes with typed witness shapes, privacy class vocabulary, Phase 1 deliverables, Phase 2/3/4 roadmap, retro-validation appendix, cross-references, three remaining open questions, five-step alignment, one-line review history at the bottom pointing at the archive file. What changed in content: nothing material. The corrected spec from the prior §0 retrofit IS the body now. The original Joseph6 design log is no longer inlined — git history preserves it at commit fadc50a; readers who want the rejection-by-rejection detail go to docs/dav1d-reviews/000071-world-bridge-grammar--2026-06-01.txt. TICKETS.md index row also rewritten in directive voice. Shorter, less "what was wrong" + more "what to build." Net effect: an implementer picking this up reads a forward-looking ticket they can act on, not an archaeology of which framing was rejected. The dav1d review history is one line at the bottom, not the structural frame. doc_counts tests still pass. --- docs/TICKETS.md | 2 +- .../ticket-000071-world-bridge-grammar.md | 1091 +++++------------ 2 files changed, 340 insertions(+), 753 deletions(-) diff --git a/docs/TICKETS.md b/docs/TICKETS.md index 8f28de0..4456235 100644 --- a/docs/TICKETS.md +++ b/docs/TICKETS.md @@ -112,7 +112,7 @@ Newest first. Update on every open/close. | ID | Title | Status | Opened | Directive | |----------|------------------------------------------------|-----------------------|------------|-----------| | #000072 | Collapse legacy `query()` into the unified `run_query` orchestrator | **open · Phase 1 foundation shipped 2026-05-31 (10 commits) · Phase 2 BLOCKED on 5 missing rerank stages** — multi_route smoke probe regressed on 2/5 questions (Mercury Seven → Sam T. Beddingfield; dinosaurs → Paul Austin Kelly), so Phase 1 is structurally complete but not production-quality. Phase 1 shipped: `source_roles.py` extraction (9ba6317), canonical `stem_for_match` in `_text_norm.py` (a83e47b), `retrieval_routes.py` with `filter_by_title_relevance` (056d785), Corpus protocol gains `core_keyword_match` + `doc_body` (e322bbd), byte-identity test fixture as Phase 2 safety gate (1822741), `run_query` gains `policy=` kwarg threading 12 verifier kwargs (72d1117), role-classified + role-weighted budget (03f248c), multi-route retrieval body+title+phrase+core_keyword merge (5fdd573), filter wired into multi_route path (6c2ec1b), wikitext-strip when `policy.base_version` set (b8bd9d6), `providence_query.py` cache-wrapper skeleton with cache persist deferred (20faae0). Every commit ships with `policy=None` preserving pre-step byte-identity behavior — existing `arborist corpus-query` and `arborist cloud query` callers are unaffected; the slim-FTS5 cloud path already wins on the dinosaur Q5 fixture (picks "Dinosaur" not legacy's "Edwina"). Phase 2 blocked because Phase 1's `multi_route` pipeline lacks the 5 downstream rerank stages legacy uses to suppress noisy phrase-route hits: body-density check (`_body_density_passes`), body-coverage sqrt rerank (`_rerank_by_body_coverage`), source-role rerank (`_rerank_by_source_role` with RANK_WEIGHTS), title-purity rerank ((1+overlap)*(1+purity)), ordered-token-match rerank (longest-common-subsequence). **Path A** = port the 5 stages → re-bench → resume Phase 2 cache persist + legacy-query() collapse to 50-line adapter. **Path B chosen 2026-05-31** = stop here, defer Phase 2, leave multi_route off by default (which IS the default — `policy=None` preserves body-only retrieval). Until Path A: Phase 1 foundation stays in tree as future-ready infrastructure; user surface unchanged (legacy `query()` still produces same answers, INCLUDING the wrong "Edwina" pick on dinosaur Q5). Full spec + commit log + bench data + the missing-rerank-stages inventory in `docs/tickets/ticket-000072-collapse-legacy-query-into-run-query.md`. | 2026-05-31 | — | -| #000071 | World-bridge grammar for AnchorN / v7-W inter-chain treaties (was: Joseph 3-bridge framework) | **open · dav1d REJECT-AS-WRITTEN + GO-with-rewrite (2026-06-01) · doc-first Phase 1.** Bridge concept is valid and necessary; the Joseph6-coupled framing is now wrong because #000070 was rewritten as generic AnchorN/WorldDimensionGrammar. Bridge grammar operates between **ChainRoots whose world grammars may be AnchorN-derived** — does NOT assume six fields, bridges grammar-rooted worlds, not Joseph6 worlds. Axis split corrected: **#000070 = intra-world state instantiation** (one chain's grammar determines its state-space), **#000071 = inter-world treaty grammar** (two chains exchange commitments without overwriting local law). Decision table (12 rows): bridge concept GO, Phase 1 doc-only GO, bridge_seed@v1 deferred GO, no audit_mode/SQL/atlas-now GO. REWRITES: #000070-as-Joseph6-sibling → AnchorN/WorldDimensionGrammar; `chain_id=governance_policy_hash` → composite ChainRoot (history_root + governance_policy_hash + canonicalization_version + schema_version + chunking_version + world_manifest_hash + world_dimension_grammar_hash + axiom_pack_hash + optional verifier_policy_hash — language-only chains use null sentinels for the three v7-W fields, v7-W chains require all); doc-only Phase 1 flipping #000013 to `kernel_in_progress` REJECTED (correct: `bridge_grammar_specified`); single `event_type='bridge'` body → typed schemas per kind; privacy as Phase 3+ footnote → Phase 1 vocabulary (4 classes: public_bridge / redacted_bridge / zk_bridge / private_bridge); #000059 "already-shipped" overclaim → proposed/structurally-aligned unless repo confirms. **Five bridge outcomes** (was three): Agreement (grammars match on invariant set), Translation (hash-pinned adapter proves mapping), Embassy (foreign object hosted, limited rights), **Quarantine NEW** (bridge attempted, invariant validation failed — record rejection so future attempts see what broke), **No-bridge NEW** (genuinely incompatible — explicit declaration). Phase 1 doc-only: substrate-paper extension §"World-bridge grammar" (5 outcomes + composite ChainRoot + privacy vocabulary + sovereignty rule + #000070 cross-ref + retro-validation appendix with corrected shipped/proposed framing) + optional namespace stub `arborist/world/bridge/__init__.py` with `STATUS = "namespace_reserved"` + NO kernels / NO bridge_seed canonicalization / NO SQL / NO cache-key dimension / NO new audit_mode / NO verifier change / NO KATs. Sovereignty rule survives unchanged (chain law local, bridge law treaty-only, no bridge overwrites native chain law — guard against forced-unity failure); hash-pinned translators survive unchanged. Full review (1026 lines) archived at `docs/dav1d-reviews/000071-world-bridge-grammar--2026-06-01.txt`; corrected spec in ticket §0; design log of original Joseph6-sibling proposal preserved in §§1-8. Originally surfaced 2026-05-31 after Joseph @TrudoJo posted the bridge-framework extension to his 6-dim spatial-ontology — that framework's CONCEPT (three bridge kinds, sovereignty rule, no-empire principle) is preserved; only the Joseph6 anchoring is replaced by grammar-agnostic AnchorN. Hard constraints: A1–A3, no continuous tensors in proof path, no `audit_mode` token, no SQL at Phase 1, topic-named under `arborist/world/bridge/`. (2026-05-31; sibling to #000070, opened same day after Joseph @TrudoJo posted his bridge-framework extension to the 6-dim spatial-ontology — "chain A has its own world rules, chain B has its own world rules, a bridge exists only where a deterministic agreement layer can be proven"). Three bridge kinds: **Agreement** (rules match, direct passage), **Translation** (rules differ but a hash-pinned adapter exists), **Embassy** (foreign-object representation with limited rights). Bridge identity: `bridge_seed = hash(src_chain_id ‖ src_node ‖ src_rule_v ‖ tgt_chain_id ‖ tgt_rule_v ‖ translator_id ‖ invariant_set)`. Joseph's sovereignty rule (hard): chain law remains local, bridge law governs translation only, **no bridge may overwrite native chain law** — guard against forced-unity failure mode. **Primary contribution: retroactive-validation appendix** naming three already-shipped arborist primitives as Joseph-bridge-shape patterns one-for-one — **#000066 graft-receipt mode = Agreement bridge**, **#000056 Operation Sandwich = Translation bridge** (opus-mt hash IS the translator_id), **#000059 bounded-ingestion graveyard = Embassy bridge** (POINTER-LINKED only, never promotes, banner-labelled). The framework is not a new requirement; it's a unifying spec that names what arborist already does in 3+ places, plus surfaces a fourth pattern (bridge atlas for multi-instance federation with potentially-different `governance_policy_hash` peers) as genuinely new work for `arborist/mesh/`. **Phase 1 is doc-only** — paper extension §7 in `docs/_source/merkle-agi-v7w-spatial-temporal.rst` + `arborist/world/bridge/__init__.py` namespace stub mirroring `arborist/world/__init__.py` discipline + Joseph-memory extension. No kernel code, no SQL change, no `cache_key` extension, no new `audit_mode` token, no bench (doc-only review surface). Phase 2 = `pi_star/bridge-seed@v1` canonicalization deliberately deferred to avoid premature locking before three implementation tickets opine. Phase 3 = per-bridge-type kernels + bridge atlas + `event_type='bridge'` writer + mesh integration. Phase 4 = cross-domain bridges (language ↔ spatial via #000015 composition theorem). **Ten open questions for dav1d** in §8: doc-only vs registry-slot-at-Phase-1 (Q1), chain_id = governance_policy_hash vs manifest hash (Q2), three-bridge taxonomy completeness (Q3), translator integrity hashing depth (Q4), bridge witness via `event_type='bridge'` (Q5), `audit_mode` discipline for translated objects (Q6), bridge privacy class default (Q7), endianness reconfirmation (Q8), Phase 2 KAT count + adversarial vectors (Q9), paper-amendment wording (Q10). Hard constraints: A1–A3, no continuous tensors, no `audit_mode` token, no SQL change at Phase 1, topic-named under `arborist/world/bridge/`. Full spec in `docs/tickets/ticket-000071-world-bridge-grammar.md`. | 2026-05-31 | — | +| #000071 | World-bridge grammar for AnchorN / v7-W inter-chain treaties | **open · doc-first Phase 1.** Spec the bridge-grammar layer so two chains with different histories / rules / grammars / manifests / translators / canonicalization_versions exchange commitments **without either chain overwriting the other's local law**. Operates between ChainRoots whose world grammars may be AnchorN-derived (not Joseph6-coupled). Axis split: **#000070 = intra-world state instantiation** (one chain's grammar determines its state-space), **#000071 = inter-world treaty grammar** (decides agreement/translation/embassy/quarantine/no-bridge). **Composite ChainRoot identity** (replaces `chain_id = governance_policy_hash`): SHA256(canonical({chain_id_version, history_root, governance_policy_hash, canonicalization_version, schema_version, chunking_version, world_manifest_hash, world_dimension_grammar_hash, axiom_pack_hash, optional_verifier_policy_hash})) — language-only QA chains: three v7-W fields are null sentinels (chain_id collapses to existing identity); v7-W chains: all mandatory. **Five typed bridge outcomes:** Agreement (grammars match on invariant set; no_translator sentinel), Translation (hash-pinned adapter proves mapping; translator_id binds into bridge_seed), Embassy (foreign object hosted with limited rights via rights_mask + embassy_contract_hash + expiry_or_decay + no_warrant_promotion sentinel), Quarantine (bridge attempted, invariant validation FAILED, record rejection with quarantine_until + revisit_policy_hash so future attempts see what broke), No-bridge (genuinely incompatible, explicit declaration with incompatibility_root + explanation_hash). **Privacy class vocabulary** (4 classes, Phase 1 paper-must-define): public_bridge / redacted_bridge / zk_bridge / private_bridge — Phase 2 bridge_seed canonicalization encodes the chosen class as a hash-bound field. **Hard constraints (all phases):** A1–A3 axioms, local chain sovereignty (chain law local, bridge law treaty-only, no bridge overwrites native chain law — guard against forced-unity failure), translator identities hash-pinned (same discipline as #000056 opus-mt), no new audit_mode token (bridges produce commitments not warrants; embassies stay POINTER-LINKED, never EVIDENCE-WARRANTED), no SQL at Phase 1, topic-named under `arborist/world/bridge/`. **Phase 1 ships:** substrate-paper extension at `docs/_source/merkle-agi-v7w-spatial-temporal.rst` §"World-bridge grammar" (5 outcomes + composite ChainRoot + privacy vocabulary + sovereignty rule + #000070 cross-ref + retro-validation appendix) + optional namespace stub `arborist/world/bridge/__init__.py` (STATUS=namespace_reserved). **Phase 1 does NOT ship:** kernels, bridge_seed@v1 canonicalization (Phase 2), SQL schema, cache_key dimension change, audit_mode token, verifier change, KATs (Phase 2), bench. **Status discipline:** Phase 1 doc-only DOES NOT flip #000013 to `kernel_in_progress` — correct transition is `namespace_reserved → bridge_grammar_specified`; `kernel_in_progress` reserved for actual kernel landings (Phase 2+). **Retro-validation appendix** names three structurally-aligned arborist primitives: #000066 graft / cold-pack overlay = Agreement archetype, #000056 Operation Sandwich = Translation archetype, #000059 bounded-ingestion graveyard = Embassy archetype (proposed/structurally-aligned, NOT "already shipped" — verify repo before paper lands). Quarantine + No-bridge are genuinely new patterns. **Phase 2** (deferred): bridge_seed@v1 canonicalizer + KATs + tests + typed event-body parsers per outcome + bridge_canonicalization_version cache_key field only IF bench reveals it must. **Phase 3** (deferred): bridge atlas, event_type='bridge' audit-chain writer with kind-specific bodies, mesh integration. **Phase 4** (deferred): cross-domain composition (language ↔ spatial via #000015), gated on #000070 Phase 1+2 stable. **Open questions** (most resolved by AnchorN reframe): paper-amendment wording, Quarantine revisit_policy_hash shape, privacy enforcement boundary. Originally Joseph6-sibling framing 2026-05-31 (commit `fadc50a`); rewritten 2026-06-01 to grammar-agnostic AnchorN per dav1d's REJECT-AS-WRITTEN + GO-with-rewrite verdict (full 1026-line review archived at `docs/dav1d-reviews/000071-world-bridge-grammar--2026-06-01.txt`). Full directive spec in `docs/tickets/ticket-000071-world-bridge-grammar.md`. (2026-05-31; sibling to #000070, opened same day after Joseph @TrudoJo posted his bridge-framework extension to the 6-dim spatial-ontology — "chain A has its own world rules, chain B has its own world rules, a bridge exists only where a deterministic agreement layer can be proven"). Three bridge kinds: **Agreement** (rules match, direct passage), **Translation** (rules differ but a hash-pinned adapter exists), **Embassy** (foreign-object representation with limited rights). Bridge identity: `bridge_seed = hash(src_chain_id ‖ src_node ‖ src_rule_v ‖ tgt_chain_id ‖ tgt_rule_v ‖ translator_id ‖ invariant_set)`. Joseph's sovereignty rule (hard): chain law remains local, bridge law governs translation only, **no bridge may overwrite native chain law** — guard against forced-unity failure mode. **Primary contribution: retroactive-validation appendix** naming three already-shipped arborist primitives as Joseph-bridge-shape patterns one-for-one — **#000066 graft-receipt mode = Agreement bridge**, **#000056 Operation Sandwich = Translation bridge** (opus-mt hash IS the translator_id), **#000059 bounded-ingestion graveyard = Embassy bridge** (POINTER-LINKED only, never promotes, banner-labelled). The framework is not a new requirement; it's a unifying spec that names what arborist already does in 3+ places, plus surfaces a fourth pattern (bridge atlas for multi-instance federation with potentially-different `governance_policy_hash` peers) as genuinely new work for `arborist/mesh/`. **Phase 1 is doc-only** — paper extension §7 in `docs/_source/merkle-agi-v7w-spatial-temporal.rst` + `arborist/world/bridge/__init__.py` namespace stub mirroring `arborist/world/__init__.py` discipline + Joseph-memory extension. No kernel code, no SQL change, no `cache_key` extension, no new `audit_mode` token, no bench (doc-only review surface). Phase 2 = `pi_star/bridge-seed@v1` canonicalization deliberately deferred to avoid premature locking before three implementation tickets opine. Phase 3 = per-bridge-type kernels + bridge atlas + `event_type='bridge'` writer + mesh integration. Phase 4 = cross-domain bridges (language ↔ spatial via #000015 composition theorem). **Ten open questions for dav1d** in §8: doc-only vs registry-slot-at-Phase-1 (Q1), chain_id = governance_policy_hash vs manifest hash (Q2), three-bridge taxonomy completeness (Q3), translator integrity hashing depth (Q4), bridge witness via `event_type='bridge'` (Q5), `audit_mode` discipline for translated objects (Q6), bridge privacy class default (Q7), endianness reconfirmation (Q8), Phase 2 KAT count + adversarial vectors (Q9), paper-amendment wording (Q10). Hard constraints: A1–A3, no continuous tensors, no `audit_mode` token, no SQL change at Phase 1, topic-named under `arborist/world/bridge/`. Full spec in `docs/tickets/ticket-000071-world-bridge-grammar.md`. | 2026-05-31 | — | | #000070 | AnchorN + π*_w_object: deterministic world-object canonicalization (was: Spatial-anchor π*_w_object / Joseph 6-dim kernel) | **open · dav1d GO with rewrite (2026-06-01) · spec revision pending before any kernel ships.** Dav1d verdict: GO for generic **AnchorN** substrate primitive (not fixed Anchor6), GO for **Joseph6 as first registered grammar** (not THE ontology), GO for deterministic object-state canonicalization, GO for axiom/physics-loaded **WorldDimensionGrammar** path; NO-GO for hard-coding H₁..H₆ as final ontology, NO-GO for runtime LLM-decided dimensionality (axioms MAY propose, only deterministic validators may accept; grammars frozen via grammar_hash before proof-path use), NO-GO for framing this as "semantic verifier warrant", NO-GO for relation/event/place/agent_trace in this ticket (scope-creep), NO-GO for SQL persistence at Phase 1. Critical technical corrections: **H₁ must use uint256 not uint64** (octree position entropy at depth>8), **do NOT overclaim SO(3) on rotation** (name `map_rotation_euler_ypr()`), canonical record carries grammar_hash + axiom_pack_hash + manifest_hash + seed_hash, missing `privacy.class` = HARD reject, spatial-anchor-object@v1 folds into `canonicalization_version` only. Corrected package layout: `arborist/substrate/spatial_anchor.py` (AnchorN, split_anchor_n), `arborist/world/grammar.py` NEW (WorldDimensionGrammar + validate_grammar), `arborist/world/pi_star/object.py` (derive_world_object_record + 5 mappers), `arborist/pi_star/spatial_anchor_object.py` NEW (registry adapter), KATs at `bench/fixtures/spatial-anchor-object/known-answer-tests.jsonl`, 3 test modules. Phase 1 deliverable: AnchorN split + Joseph6 grammar + π*_w_object canonicalizer + KATs + tests + paper amendment; NO SQL, NO new audit_mode, NO verifier_policy_hash change. Implementation NOT started — `arborist/world/__init__.py` STATUS still "namespace_reserved", no spatial_anchor.py exists; only the pre-review empirical bench `bench/spatial_anchor_validation.py` is on disk (commit `55b651f`/`2eea5b5`: avalanche 767.85 bits vs PRF null 768 z=-0.49, octree chi² \|z\|<1 at L=2..4, collision birthday-bound 0.989/1.038, cross-region Pearson r∈[-0.018,+0.012], domain separation Arm A independent / Arm B exact-collision confirming dedicated `spatial_anchor_seed`). Dav1d's 26-section review preserves the empirical evidence (HMAC-SHA-512 properties unchanged by AnchorN generalization). Five of original ten open questions resolved by measurement (Q1/Q2/Q3/Q8/Q9); review answers Q4/Q5/Q6/Q7, Q10 (paper-amendment wording) still open. Full review archived at `docs/dav1d-reviews/000070-spatial-anchor-pi-w-object--2026-06-01.txt`; corrected spec in ticket §0; design log of original Anchor6 proposal preserved in §§1-8. Originally surfaced 2026-05-31 when fox brought in Joseph @TrudoJo's procedural-spatial framework — "hashes do not encode the world, hashes determine the world" — and asked whether it fits arborist's substrate model. Yes, AS AnchorN with Joseph6 as default grammar. — pure-stdlib empirical-validation script (`bench/spatial_anchor_validation.py`, `make bench-spatial-anchor`, ~2 s, RNG-seed-pinned) measures: §1 avalanche mean 767.85 bits vs PRF null 768 (z = -0.49) · §2 octree chi² uniformity \|z\| < 1 at L=2,3,4 · §3 collision birthday-bound ratio 0.989 / 1.038 at L=4,6 · §4 cross-region Pearson r in [-0.018, +0.012] across all 15 pairs of H₁..H₆ (none flag at 4σ) · §5 domain separation Arm A 767.91 bits independent / Arm B **0.00 bits exact collision** confirming the dedicated-`spatial_anchor_seed` discipline. Five of ten open questions (Q1 seed source · Q2 segmentation · Q3 octree mapper · Q8 endianness · Q9 KAT adversarial vectors) now resolve by measurement; Q4/Q5/Q6/Q7/Q10 remain non-empirical design decisions for dav1d. Full empirical detail in ticket §7a. Originally surfaced 2026-05-31 when fox brought in Joseph @TrudoJo's procedural-spatial framework — "hashes do not encode the world, hashes determine the world" — and asked whether it fits arborist's substrate model. It does, cleanly. Implements the first verifier kernel under the #000013 v7-W reserved namespace (`arborist/world/__init__.py` `STATUS = "namespace_reserved"` → `kernel_in_progress` on land): a single committed 32-byte SHA-256 hash deterministically expands into six named 32-byte regions `H₁..H₆` via the HMAC-SHA-512 KDF already shipped in `arborist/substrate/anchor_prg.py` (#000035), and each region drives one quantized object dimension under a fixed canonical mapper — `H₁→octree position`, `H₂→scale level`, `H₃→quantized SO(3) rotation`, `H₄→material palette`, `H₅→raw links (reserved for π*_w_relation sibling ticket)`, `H₆→behavior code`. Domain separation from #000035 by dedicated `spatial_anchor_seed` (manifest-published) — keeps #000035's KAT freeze + dav1d 2026-05-11 final review intact. Hard constraints: stays inside A1–A3, no continuous tensors in proof path, no new `audit_mode` token (substrate commitments are not warrants — the four-rung ladder is unchanged), no SQL schema change at Phase 1, `canonicalization_version` absorbs the new `spatial-anchor-object@v1` registry slot. Phase 1 deliverable ~150 LoC + 10 KATs + tests in one PR: `arborist/substrate/spatial_anchor.py` (segmentation), `arborist/world/pi_star/object.py` (six mappers), registry entry, KAT vectors at `bench/fixtures/spatial-anchor/known-answer-tests.jsonl` matching #000035 KAT discipline, `tests/test_spatial_anchor.py` + `tests/test_world_pi_star_object.py`, substrate-paper amendment citing Joseph (@TrudoJo) in `docs/_source/merkle-agi-v7w-spatial-temporal.rst`. Position mapper at Phase 1 = octree (substrate paper §2.1 + §A worked example); H3/S2/Hilbert/Morton siblings deferred — Morton's value is purely as the relation-kernel `pair(A,B)` cheap bit-interleave and surfaces in the sibling ticket. **Ten open questions for dav1d** in §8: seed-source choice, segmentation method, position mapper, scope split (object alone vs object+relation per CLAUDE.md memory `feedback_ticket_proliferation`), privacy-class fail-closed default, `audit_mode` discipline confirmation, manifest-validator timing, endianness reconfirmation, KAT count + adversarial vectors, paper-amendment wording. Five-step §7 deletions captured: dropped the prior `/tmp/arborist-spatial-ontology-plan.md`'s geographic-search backend (encoding-route confusion), `Document.extra` lat/lon hooks (different ticket if at all), `audit_mode=HYBRID` for spatial hits (convention-illegal), geohash (subsumed by Morton), quadtree as separate (octree at z-level-0), Hilbert at Phase 1 (deferred), tier-1/2/3 hash-suite framing (conflated hard vs soft hashes), and `arborist/spatial/` namespace (violates topic-naming rule). Full spec in `docs/tickets/ticket-000070-spatial-anchor-pi-w-object.md`. | 2026-05-31 | — | | #000069 | Arborist VIZ / Merkle Command Center (Pyramid + six.js + SSE browser dashboard) | **open · awaiting go/no-go · doc-only scaffold** (2026-05-27; filed from `/home/fox/Downloads/TICKET_0000VIZ_*`, stack corrected same day per fox). Configurable browser dashboard for inspecting arborist's content-addressed state: Merkle root explorer, proof verifier, claim warrant + graveyard, audit timeline, run-DAG replay, cache-key explainer, root diff, 3D Merkle lattice, optional circuit/activation traces. Read-only consumer; arborist proper stays source-of-truth, dashboard projects state. **Stack pinned to unturf-native** (fox 2026-05-27, supersedes proposal §3): **Pyramid + Jinja2 + SQLAlchemy** (matches `remarkbox` / `make_post_sell` / `unhomeschool.com` idiom), **SSE** (`text/event-stream` via Pyramid streaming response) for live audit/claim/falsifier patches, **vanilla JS + six.js** (fox's patched three.js fork at `git.unturf.com/gumyum/six.js` — three.js r175 + CWE-407 patches incl. ObjectBVH O(N)→O(log N); bundles vendored from `~/git/cupPCB/cdn/six/`; third-instance MOAD-0001 dogfood alongside `java-topology` + gumyum-engine) for 3D widgets and large-graph rendering, SQLite for dashboard metadata (no PostgreSQL/ClickHouse/Redis/NATS by default — promote on measured need), no React / no Next.js / no Node build step. Server-rendered SVG (or Graphviz `.dot` per existing `docs/diagrams/*.dot` pattern) replaces React Flow for run-DAG widgets. Browser-side proof verification dropped from v1 (server-side Pyramid view returns PASS/FAIL + receipt; reinstate phase-N only if third-party-verification use case surfaces). **Three filing-note gates before phase 0** (in ticket body): **F-1** sibling-repo home — implementation lives in a new `~/git/arborist-viz` (Pyramid Python, matches existing unturf apps), not in-tree; arborist's contribution is the read-API spec + view package + arborist library import via `arborist.embed`. **F-2** scope split — proposal carries 8 phases (§17 phases 0–8); recommended cut keeps phases 0–3 (schema + shell + proof/root widgets + claim/audit/run widgets) inside #000069, and spawns sibling tickets for SSE streaming (4), 3D six.js (5), massive-graph (6, only if measured need surfaces), circuit-tracing (7, gated on #000062), embeddable widgets (8) — Dav1d-audience rule. **F-3** upstream prereqs — phase 7 (circuit/activation) consumes **#000062 Mechanistic Witness**'s `MechanisticWitnessRoot`; phase 3's claim-graveyard widget projects **#000059**'s bounded-ingestion graveyard. Hard constraints: arborist soft-vs-hard discipline applies verbatim (attribution weights renderable but never `audit_mode`, never causal without intervention/ablation evidence); private-leaf default-deny (commitments + hashes + redacted maps only without explicit auth); every widget exposes its data query + source roots. Reserved scope: NOT a replacement for `arborist controller-events` / `arborist analyze` / `arborist inspect` CLI — those stay canonical inspector surfaces; VIZ is the projection layer. | 2026-05-27 | — | | #000068 | Verifier-blind missed-answer falsification guard | **in progress · Phase 1+2+3 landed 2026-05-27 · Phase 4 default flip NO-GO** (Phase 2 bench 2026-05-27 76q × n=3 claim_lattice Hermes-3-8B: 2/228 sidecar fires, both STRONG confidence, both the Ballestrini regression fixture, 100% precision, 0/226 false positives across non-Ballestrini runs. Phase 3 demote flag opt-in via `--demote-on-missed-answer` on `query`/`ask` — wires `EVIDENCE-WARRANTED → EVIDENCE-MISSED-PARTIAL` for strong/medium confidence on lattice modes; lower rungs + non-lattice modes get `· missed-answer` tail tag. `answerability_demote_enabled` added to `_VERIFIER_POLICY_FIELDS` so flipping the flag partitions cache via verifier_policy_hash. Default OFF per Dav1d Phase 4 NO-GO — 100% precision at n=2 fires is too few samples to claim precision floor empirically; default flip blocks on wider bench + human spot-check. 47 tests (36 Phase 1 + 11 Phase 3) all passing. End-to-end verified live: 4/4 Hermes runs on Ballestrini with --demote-on-missed-answer rendered EVIDENCE-MISSED-PARTIAL.) Original opening 2026-05-27 (Dav1d de-novo review GO for Phase 1 with seven hardenings folded into spec — subject-token cue-stripping, answer-type alignment, confidence_class, candidate cap=10, precise offset_start/end/basis, cache-hit recompute-on-read, Phase 1 out of verifier_policy_hash). Original opening 2026-05-27; sibling to the user-payload-layout work shipped 2026-05-26, split out per the Dav1d-audience rule — `feedback_ticket_proliferation`). Surfaced by the Ballestrini case: evidence E2 literally contained the song names, Hermes-3-8B under `user_payload_layout=tail` said *"specific songs by her are not mentioned in the provided evidence blocks"*, verifier marked the run `EVIDENCE-WARRANTED` 2/2 because nothing positive was unsupported. **Verifier-blind false-negative class** — existing layered verifier (quote/span/entity/paraphrase + Rule 8 + Rule 9 + claim ceiling) guards unsupported *presence*, has no hook for unsupported *absence*. Layout fixes attention placement on the specific instance (n=3 bench 2026-05-27 confirms bookend/per_chunk recover Ballestrini); layout alone can't close the class — adversarial phrasing or bigger prompt resurfaces it under any layout. Proposed deterministic sidecar in `arborist/qa/inspect.py:diagnose_missed_answer`: three-clause conjunction — **(A)** answer matches denial pattern ("not mentioned", "not provided", "the evidence does not say", …, closed list versioned via `denial_patterns_version`); **(B)** question is extraction shape (reuse `arborist.qa.quantifier` classifier — `ALL`/`COMPREHENSIVE`/`OPEN_REQUEST` intensities, OR surface cues "songs by"/"works by"/"who wrote"/"list"/"name all"); **(C)** evidence contains candidate spans near subject tokens (reuse `entity_proximity_n`/`entity_proximity_window` from verify.py — quoted strings, title-case spans, comma-separated title lists within W chars of stemmed subject content tokens). All three must fire. Output: `result["answerability"]` with `missed_answer_candidate_spans` list (evidence_id + offset + text). **Hash discipline:** sidecar fields (`denial_patterns_version`, `extraction_cues_version`, `answerability_threshold`) fold into `governance_policy_hash` only; an optional `answerability_demote_enabled` flag (default OFF) wires `EVIDENCE-WARRANTED → EVIDENCE-MISSED-PARTIAL` in `_render_audit_label`, and IF on folds into BOTH `governance_policy_hash` AND `verifier_policy_hash` (changes rendered audit_mode, so verifier hash must move — the deliberate opt-in moves the verifier hash, sidecar-only stays out). No LLM-as-judge. Never writes `providence_cache`/`audit_events`. Never promotes claims. Pattern verbatim from `arborist.qa.inspect.diagnose_*` (deflection, coherence, title-relevance). Phases: 1 sidecar read-only, 2 bench + threshold tuning, 3 demote opt-in, 4 default decision (bench-gated). 5F-Falsification fixture: Ballestrini case already in `bench/qa_questions.txt` under "entity list". Full spec in `docs/tickets/ticket-000068-verifier-blind-missed-answer-guard.md`. | 2026-05-27 | D2 | diff --git a/docs/tickets/ticket-000071-world-bridge-grammar.md b/docs/tickets/ticket-000071-world-bridge-grammar.md index f8ec829..93aacf1 100644 --- a/docs/tickets/ticket-000071-world-bridge-grammar.md +++ b/docs/tickets/ticket-000071-world-bridge-grammar.md @@ -1,143 +1,73 @@ # Ticket #000071 — World-bridge grammar for AnchorN / v7-W inter-chain treaties -**Status:** open · **dav1d REJECT-AS-WRITTEN + GO-with-rewrite (2026-06-01)** · -doc-first Phase 1. Original Joseph6-coupled spec rejected; corrected -AnchorN/WorldDimensionGrammar reframe in §0 below. §§1-8 preserve the -original proposal as the design log of what was reviewed. -**Original title kept in design log:** "World-bridge grammar (Joseph -3-bridge inter-chain framework)". +**Status:** open · doc-first Phase 1 · dav1d GO-with-rewrite landed +2026-06-01 (full review at `docs/dav1d-reviews/000071-world-bridge-grammar--2026-06-01.txt`). **Opened:** 2026-05-31 -**Scope:** Spec the bridge-grammar layer for v7-W. **Joseph (@TrudoJo)**'s -second framework (2026-05-31): every chain has its own world-rules -(`chain = cryptographic history + rule grammar + world mapper`); bridges -between chains exist only where a deterministic agreement layer can be -proven. Three bridge kinds — **Agreement** (direct passage when rules -match), **Translation** (mediated passage through a hash-pinned -adapter), **Embassy** (foreign-object representation with limited -rights). Bridge identity is a deterministic seed: -`bridge_seed = hash(src_chain_id ‖ src_node ‖ src_rule_v ‖ tgt_chain_id ‖ tgt_rule_v ‖ translator_id ‖ invariant_set)`. -Phase 1 is **doc-only** — a substrate-paper extension at -`docs/_source/merkle-agi-v7w-spatial-temporal.rst` plus a retroactive- -validation appendix naming three already-shipped arborist primitives -(#000066, #000056, #000059) as Joseph-bridge-shape patterns. Sibling -implementation tickets per bridge type land later. -**Audience:** dav1d (primary review), v7-W substrate-paper maintainers, -mesh-protocol maintainers (`arborist/mesh/`), Joseph (@TrudoJo, original -framework author), #000013 follow-up, #000070 adjacent axis, -#000056 / #000066 / #000059 retro-validation, #000015 generalization -target. -**Hard constraint:** -- Stays inside A1–A3 (canonical encoding, public quantization, - collision-resistant hash). No new axiom. -- **Joseph's bridge sovereignty rule (hard).** Chain law remains local; - bridge law governs translation only; **no bridge may overwrite native - chain law**. The bridge is a treaty, not an empire. This is the - guard against the "forced unity" failure mode Joseph flags in §5 of - the framework. -- **Translator identities hash-pinned.** Translation bridges depend on - a fixed translator; the translator's identity hash binds into the - `bridge_seed`. Matches #000056 opus-mt hash-pinning discipline; no - exception for "model-of-the-week" adapters. -- **No new `audit_mode` token.** Bridges produce commitments - (`bridge_seed`, bridge geometry), not warrants. CLAUDE.md verifier- - stays-binary discipline applies unchanged; foreign-object embassy - representations stay POINTER-LINKED at best, never promote to - EVIDENCE-WARRANTED. Joseph's "embassy bridge" semantics MATCH - arborist's graveyard-and-witness pattern (#000059) one-for-one. -- **No new SQL table at Phase 1.** Phase 1 is paper + retro-validation - + namespace stub only. Bridge persistence schema (Phase 3+) is a - separate ticket; folding it into v9.8 `cache_key` via a new - `bridge_canonicalization_version` dimension is deferred for explicit - fox + dav1d sign-off. -- **Topic-named, not version-prefixed.** Lands under - `arborist/world/bridge/` (sibling to `arborist/world/pi_star/` from - #000070), not `arborist/v7w_bridge/` or `arborist/bridge/`. +## Goal ---- +Specify how two chains with different histories, rules, grammars, +manifests, translators, or canonicalization_versions exchange +commitments **without either chain overwriting the other's local law**. -## 0. Dav1d review verdict (2026-06-01) — REJECT-AS-WRITTEN, GO-WITH-REWRITE +Concretely: define the substrate-paper section + bridge identity +shape + bridge-outcome taxonomy + privacy classes that future kernels +will canonicalize and the audit chain will witness. -Full review at `docs/dav1d-reviews/000071-world-bridge-grammar--2026-06-01.txt` -(1026 lines). The bridge concept is valid and necessary; the -Joseph6-coupled framing is now wrong (#000070 has been rewritten as -generic AnchorN/WorldDimensionGrammar — see ticket #000070 §0). - -### 0.1 Direct verdict - -```text -Original #000071 as written: - REJECT AS WRITTEN. - -Corrected #000071: - REWRITE AND PROCEED as doc-first / spec-first Phase 1. - -Reason: - Bridge idea is valid. - "Fixed Joseph6 / six-dimensional axis" dependency is now wrong. - Must be rewritten around AnchorN + WorldDimensionGrammar. -``` - -### 0.2 Corrected #000070 ↔ #000071 axis split +## Axis split (cross-ref #000070) ``` -#000070 (intra-world state instantiation): - one chain/world grammar determines its own state-space - AnchorN + WorldDimensionGrammar + AxiomPack + Manifest → - canonical world-state records +#000070 intra-world state instantiation + one chain's grammar determines its own state-space + AnchorN + WorldDimensionGrammar + AxiomPack + Manifest + → canonical world-state records -#000071 (inter-world treaty grammar): - two chains with different histories, rules, grammars, manifests, - translators, or canonicalization_versions exchange commitments - without either chain overwriting the other's local law - decide: agreement | translation | embassy | quarantine | no_bridge +#000071 inter-world treaty grammar + two chains decide whether commitments cross the gap + → agreement | translation | embassy | quarantine | no_bridge ``` Bridge grammar operates between **ChainRoots whose world grammars -may be AnchorN-derived**. It does NOT assume six fields, does NOT -assume position/scale/rotation/material/relation/behavior. It bridges -**grammar-rooted worlds**, not Joseph6 worlds. +may be AnchorN-derived**. It does NOT assume six fields. It bridges +grammar-rooted worlds, not Joseph6 worlds. -### 0.3 Decision table +## Hard constraints (all phases) -| component | original ticket | verdict | correction | -|---|---|---|---| -| bridge concept (Agreement/Translation/Embassy) | valid | ✅ GO | add **Quarantine** + **No-bridge** as first-class outcomes | -| Phase 1 doc-only | mostly correct | ✅ GO | namespace stub optional | -| `bridge_seed@v1` deferred to Phase 2 | correct | ✅ GO | keep deferred | -| no new `audit_mode` | correct | ✅ GO | keep hard | -| no SQL Phase 1 | correct | ✅ GO | keep hard | -| bridge atlas Phase 3 | correct | ✅ GO | keep deferred | -| **#000070 as Joseph6 sibling** | **wrong** | ❌ REWRITE | replace with AnchorN/WorldDimensionGrammar | -| **`chain_id = governance_policy_hash`** | **insufficient** | ❌ REWRITE | composite ChainRoot (history_root + governance_policy_hash + canonicalization_version + schema_version + chunking_version + world_manifest_hash + world_dimension_grammar_hash + axiom_pack_hash + optional verifier_policy_hash) | -| **doc-only flips #000013 → `kernel_in_progress`** | **wrong** | ❌ REJECT | use `bridge_grammar_specified`; kernel_in_progress is for actual kernel landings | -| **"already shipped" claim on #000059** | **overclaim** | ❌ REWRITE | mark proposed/structurally aligned unless repo confirms shipped | -| **single `event_type='bridge'` body** | **too flat** | ❌ REWRITE | typed bridge event schemas per kind (agreement / translation / embassy) | -| **privacy as Phase 3+ footnote** | **too weak** | ❌ REWRITE | promote to Phase 1: vocabulary defined now, code later | +- **A1–A3 axioms.** Canonical encoding · public quantization for + proof-path state · collision-resistant hash. No new axiom. +- **Local chain sovereignty.** Chain law remains local; bridge law + governs passage only. **No bridge may overwrite native chain law.** + Guard against the forced-unity failure mode Joseph flags in his + framework §5. +- **Translator identities hash-pinned.** A Translation bridge depends + on a fixed translator; the translator's identity hash binds into + `bridge_seed`. Same discipline as #000056 opus-mt hash-pinning; + no exception for "model-of-the-week" adapters. +- **No new `audit_mode` token.** Bridges produce commitments + (`bridge_seed`, bridge geometry), not warrants. Foreign-object + embassy representations stay POINTER-LINKED at best, never promote + to EVIDENCE-WARRANTED. Embassy semantics align with the bounded- + ingestion graveyard pattern (#000059, structurally aligned). +- **No new SQL at Phase 1.** Persistence is a Phase 3 ticket. Phase 1 + is paper + namespace stub. +- **Topic-named, not version-prefixed.** Lands under + `arborist/world/bridge/` (sibling to `arborist/world/pi_star/` from + #000070). -### 0.4 Five bridge outcomes (was three) +--- -The original ticket recognized Agreement / Translation / Embassy. -Dav1d adds two more as FIRST-CLASS outcomes: +## 1. Composite ChainRoot identity -| kind | when it applies | witness shape | -|---|---|---| -| **Agreement** | grammars match on the shared invariant set | src_chain_id · tgt_chain_id · shared_invariant_root · object_or_pack_root · no_translator sentinel | -| **Translation** | grammars differ but a hash-pinned adapter proves the mapping | src_chain_id · tgt_chain_id · translator_id · translator_manifest_hash · input_root · output_root · translation_policy_hash | -| **Embassy** | foreign object hosted with limited rights | foreign_chain_id · host_chain_id · foreign_object_commitment · rights_mask · embassy_contract_hash · expiry_or_decay · no_warrant_promotion flag | -| **Quarantine** (new) | bridge attempted but invariant validation FAILED — record the rejection so future attempts can see what broke | src_chain_id · tgt_chain_id · attempted_bridge_kind · invariant_violation_root · quarantine_until · revisit_policy_hash | -| **No-bridge** (new) | grammars genuinely incompatible — explicit declaration that no bridge will exist | src_chain_id · tgt_chain_id · incompatibility_root · explanation_hash | - -Phase 1 defines one abstract `bridge` event family; Phase 3 implements -typed bridge event bodies per kind. - -### 0.5 Composite ChainRoot identity (replaces `chain_id = governance_policy_hash`) +A bridge connects two ChainRoots. ChainRoot is **NOT** +`governance_policy_hash` alone — that's QA-policy identity only. +A chain is `cryptographic history + rule grammar + world mapper`, so +identity composes all three. ``` chain_id = SHA256(canonical({ - chain_id_version, - history_root, # provenance / audit chain root - governance_policy_hash, # arborist QA-policy identity (v9.8) + chain_id_version, # "chain-v1" + history_root, # provenance/audit chain root + governance_policy_hash, # arborist v9.8 QA policy canonicalization_version, schema_version, chunking_version, @@ -148,655 +78,312 @@ chain_id = SHA256(canonical({ })) ``` -For **language-only QA chains** (today's arborist), the three v7-W -fields are null sentinels — `chain_id` collapses to existing identity. -For **v7-W chains** with a `WorldDimensionGrammar`, all three are -mandatory. This keeps backward compat AND extends cleanly to the -spatial/temporal axis. +**Language-only QA chains** (today's arborist): the three v7-W +fields are null sentinels — `chain_id` collapses to existing QA +identity. **v7-W chains** with a `WorldDimensionGrammar`: all three +mandatory. -### 0.6 Privacy as first-class (Phase 1 vocabulary) - -Promoted from "Phase 3+ later" to Phase 1 paper-must-define. Minimum -classes: - -| class | semantic | -|---|---| -| `public_bridge` | bridge existence + endpoints visible | -| `redacted_bridge` | bridge existence visible; endpoint identities hidden or committed | -| `zk_bridge` | proof of valid bridge without revealing full chain identifiers / invariant set | -| `private_bridge` | only peers with group keys can inspect bridge metadata | - -No code now; vocabulary must exist before `bridge_seed@v1` -canonicalization is frozen (else the field shape rotates everything). - -### 0.7 #000013 status discipline (correction) - -The original ticket said Phase 1 (doc-only) would flip #000013 from -`namespace_reserved` to `kernel_in_progress`. Dav1d rejects: doc-only -extensions are not kernel progress. Correct transitions: - -``` -After #000071 Phase 1 (doc-only): - #000013 status: bridge_grammar_specified (or v7-W-paper-extended) - -After #000070 AnchorN implementation: - #000013 status: world_object_kernel_in_progress - -After #000071 bridge_seed / atlas implementation: - #000013 status: bridge_kernel_in_progress -``` - -### 0.8 #000059 overclaim correction - -The original ticket claimed three "already-shipped" arborist -primitives as retroactive validators of the Joseph-bridge pattern. -Dav1d corrects per repo evidence: - -| bridge kind | original mapping | corrected mapping | -|---|---|---| -| Agreement | "#000066 graft-receipt mode = shipped" | #000066 graft/cold-pack overlay — shipped OR scaffolded (check repo for current status) | -| Translation | "#000056 Operation Sandwich = shipped" | #000056 — shipped if landed; otherwise specified-and-testable | -| Embassy | "#000059 bounded-ingestion graveyard = shipped" | #000059 — proposed / structurally aligned, NOT "already shipped" unless repo evidence confirms | - -Don't call all three "already-shipped" unless code evidence supports -that exact status. The structural alignment claim still holds; only -the shipped-vs-proposed framing was wrong. - -### 0.9 Corrected Phase 1 deliverables - -``` -1. Substrate-paper extension (the bulk of Phase 1) - docs/_source/merkle-agi-v7w-spatial-temporal.rst - new section: "World-bridge grammar" - - Five bridge outcomes (Agreement / Translation / Embassy / - Quarantine / No-bridge) with typed witness shapes - - Composite ChainRoot identity (replaces the - governance_policy_hash-only chain_id) - - Privacy class vocabulary (4 classes) - - Sovereignty rule (chain law local, bridge law treaty-only) - - Cross-ref to #000070 AnchorN axis - - Retroactive-validation appendix (with corrected #000059 - "structurally aligned, not shipped" framing) - -2. Optional namespace stub - arborist/world/bridge/__init__.py - STATUS = "namespace_reserved" - -3. NO kernels -4. NO bridge_seed canonicalization (deferred to Phase 2) -5. NO SQL -6. NO cache-key dimension -7. NO new audit_mode -8. NO verifier change -9. NO KATs yet -10. #000013 status field bumps to "bridge_grammar_specified", - NOT "kernel_in_progress" -``` - -### 0.10 What changes for the implementer - -The original §§3-4 ("Recommendation" + "Implementation sketch") frame -this as Joseph6-sibling work. Those stay in the design log as -reference; **what actually ships follows §0 above** — AnchorN-grammar -agnostic bridges, five outcomes (not three), composite ChainRoot, -privacy classes defined upfront. - -The original sovereignty rule, hash-pinned translators, and -no-new-audit_mode discipline all SURVIVE the rewrite — they're the -parts the review explicitly preserves. +This keeps backward compat AND extends cleanly to the spatial/ +temporal axis. Phase 1 defines this in the paper; Phase 2 freezes +`canonical_chain_id@v1`. --- -## 1. Problem statement *(original design log — what was reviewed)* - -### 1.1 What #000013 left undefined (axis 2) - -The v7-W substrate paper at -`docs/_source/merkle-agi-v7w-spatial-temporal.rst` §1.1 lists five -world-state object kinds: objects, relations, events, places, -agents. It does **not** name a `bridge` or `chain` kind. The paper -implicitly assumes a *single* world — one manifest, one grid, one -frame anchor — and defers federation to "out of scope" §6 -discussion of surveillance/privacy. - -This is fine for the v7-W *single-world commitment* layer. It -leaves *inter-world translation* unspecced. With multiple arborist -peers running with potentially different `governance_policy_hash` / -`canonicalization_version` values (the multi-instance federation -case the mesh layer in `arborist/mesh/` is positioned for), the -question "what bytes can peer A and peer B agree on, and under -what translator?" has no formal answer today. - -### 1.2 Joseph's framework (verbatim core) - -2026-05-31 fox brought in Joseph (@TrudoJo)'s second framework. -Verbatim cores: - -> **Chain A has its own nodes. Chain A has its own world rules.** -> Chain B has its own nodes. Chain B has its own world rules. -> A bridge exists only where a deterministic agreement layer can be -> proven. - -> A chain is not just a list of hashes. It becomes: -> `Chain = cryptographic history + rule grammar + world mapper` - -> **Three bridge kinds:** -> - **Agreement** — rules match directly: `A.object.position == B.object.position`. Strongest bridge. -> - **Translation** — rules do not match, but a deterministic adapter exists. The adapter itself must be hashed and versioned, otherwise the translation drifts. -> - **Embassy** — rules cannot fully translate, but one chain can host a representation of the other. The object appears as a foreign object with limited rights. - -> **Bridge seed:** -> `bridge_seed = hash(src_chain_id ‖ src_node ‖ src_rule_version ‖ tgt_chain_id ‖ tgt_rule_version ‖ translator_id ‖ invariant_set)` - -> **The real rule:** chain law remains local; bridge law governs -> translation; no bridge may overwrite native chain law. The bridge -> is a treaty, not an empire. - -> **Where rules agree, merge. Where rules translate, bridge. Where -> rules conflict, quarantine. Contradiction → no bridge.** - -### 1.3 Why this fits arborist — retroactive validation - -The most important finding of this ticket: **Joseph's bridge -framework names what arborist already does in three places.** -Cross-checked against ground truth on 2026-05-31: - -| Joseph concept | Already-shipped arborist primitive | Shape match | -|---|---|---| -| **Chain = cryptographic history + rule grammar + world mapper** | v9.8 8-dim `cache_key` — `source_root + question_hash + model_profile_hash + conversation_hash + governance_policy_hash + schema_version + canonicalization_version + chunking_version`. Each instance with distinct hashes IS a distinct "chain" by Joseph's definition. | exact | -| **Shared invariants** (Merkle root, state commitment, rule-version hash) | `document_root`, `source_root`, chunk `leaf_hash`, `cache_key`, `audit_event_hash`, `governance_policy_hash`, `canonicalization_version` | exact (these are the "common handles" Joseph names) | -| **Agreement bridge** — rules match, direct passage | **#000066 cold-pack overlay / graft mode** (Wikipedia 2010 / current / arxiv-cs corpora packs). `INSERT OR IGNORE` on content-addressed PKs collapses dupes; **graft receipt** = the bridge witness (`event_type='graft'` event carrying `pack_hash`, `snapshot_root`, `corpus_name`, `event_count`, `first_event_hash`, `last_event_hash`, `manifest_root`). Pack chain stays a "witnessed subgraph"; host chain takes the receipt. Joseph's framework gives a name to what we already shipped. | exact | -| **Translation bridge** — deterministic hash-pinned adapter | **#000056 Operation Sandwich** — cross-language MT on the edges. Adapter (opus-mt es/fr/ru↔en) is hash-pinned in `RetrievalPlan.mt_*`; MT never re-enters the verifier; English answer verified English-vs-English; Spanish display banner-labeled with zero grounding. The bridge IS the sandwich. | exact | -| **Embassy bridge** — foreign-object with limited rights | **#000059 bounded-ingestion graveyard** (proposed) + **falsified-but-witnessed claims**. A peer's claim is pinned as evidence (commitment), never promoted to warrant (no `EVIDENCE-WARRANTED`, no `STRICT`). Witness marker remains. Joseph's "appears as a foreign object with limited rights" maps one-for-one to graveyard semantics. | exact | -| **Bridge seed formula** `hash(src_chain_id ‖ src_node ‖ src_rule_v ‖ tgt_chain_id ‖ tgt_rule_v ‖ translator_id ‖ invariant_set)` | Structurally identical to the v9.8 8-dim `cache_key` composition. Same Merkle-style content addressing; bridge-specific roles instead of QA-specific ones. | structural | -| **Chain sovereignty** ("no bridge may overwrite native chain law") | Verifier-stays-binary + "MT on the edges only" + soft-vs-hard-hash discipline. Same rule, restated as a federation principle. | exact | - -**Implication.** Joseph's bridge framework is not a *new requirement* -on arborist. It is a *unifying spec* that retroactively names three -already-shipped patterns (graft / sandwich / graveyard) as one -architectural family, and surfaces a fourth pattern (bridge atlas -for multi-instance federation) as genuinely new work for the mesh -layer. - -This is unusual ticket shape: most of Phase 1's value is **paper -work** (giving names to existing primitives + folding them into one -framework), not new code. - -## 2. Design choices - -### 2.1 Phase 1 deliverable shape — paper vs paper + code - -**A. Doc-only Phase 1 (recommended).** - -Phase 1 ships: -- An extension to `docs/_source/merkle-agi-v7w-spatial-temporal.rst` - introducing the bridge layer (§2 axis 2, sibling to the 6-dim - object axis from #000070). -- A retroactive-validation appendix (referenced as §10 in this - ticket's bench section) cross-referencing #000066, #000056, - #000059 as Agreement / Translation / Embassy bridges respectively. -- A namespace stub at `arborist/world/bridge/__init__.py` mirroring - `arborist/world/__init__.py`'s `STATUS = "namespace_reserved"` - discipline. - -No kernel code. No new SQL. No registry slots. No bench. Per-bridge- -type implementation kernels (`arborist/world/bridge/agreement.py`, -`bridge/translation.py`, `bridge/embassy.py`) are sibling tickets -when fox prioritizes them. - -- **Strength:** paper-first matches #000013's discipline; cheap to - land; retroactive-validation discipline gives dav1d a focused - doc-review surface. -- **Cost:** no executable validation at Phase 1. The retroactive- - validation claim is checked by code-reading, not bench. - -**B. Paper + π*_w_bridge registry slot at Phase 1.** - -Add to Phase 1: a registered `pi_star/bridge-seed@v1` projection that -computes `bridge_seed` deterministically from -`(src_chain_id, src_node, src_rule_v, tgt_chain_id, tgt_rule_v, -translator_id, invariant_set)`. Per-bridge-type mappers stay deferred. - -- **Strength:** locks the bridge-seed canonicalization at Phase 1, so - downstream implementations cannot drift. -- **Cost:** Phase 1 grows from paper-only to paper + 100 LoC + KATs - + tests. Picks a canonicalization (ordering, separator bytes, - invariant-set serialization) before three implementation tickets - have any opinion on the right shape. Premature locking. - -**Recommendation: A.** Doc-only Phase 1. The bridge seed is too -sensitive a canonicalization to lock before per-bridge-type kernels -have informed the shape. - -### 2.2 Bridge-seed canonicalization (DEFERRED to Phase 2) - -When Phase 2 lands `pi_star/bridge-seed@v1`, the canonical bytes for -`bridge_seed` must pin: - -- **Chain identifiers** — what counts as a `chain_id`? Joseph's - framework leaves this open. Two candidates: - - **(a) `governance_policy_hash`** — every cache-key partition is a - chain. Matches Joseph's definition (`chain = cryptographic - history + rule grammar + world mapper`) one-for-one. - - **(b) v7-W manifest hash** — every committed substrate manifest is - a chain. Closer to Joseph's "rule grammar" framing; ignores - QA-policy churn. - - Recommendation (Phase 2): `(a)` — `governance_policy_hash` - already changes whenever any policy field changes, including the - verifier-rule subset, MT engine identity, π* registry version. - It's the union surface. (b) would miss QA-side rule drift. -- **Node identifiers** — what counts as `src_node` / `tgt_node`? - Recommendation (Phase 2): a content-addressed handle valid in BOTH - chains' invariant sets. Default: a `document_root` if both chains - agree on that schema; otherwise the bridge's invariant set must - declare a translator that maps node identities (`src_node → - tgt_node`). -- **Rule version** — `governance_policy_hash` at bridge-establishment - time. Locking this means re-establishment is required if either - chain bumps policy. That's the right semantics (a treaty signed - under one law is not auto-binding under a new law). -- **Translator id** — for Agreement bridges: the empty 32-byte hash - (no translator). For Translation bridges: SHA-256 of the - translator's canonical bytes (e.g. opus-mt model hash). For Embassy - bridges: SHA-256 of the embassy contract bytes (Phase 3 spec). -- **Invariant set** — a canonical sorted list of `(invariant_kind, - invariant_hash)` tuples committed at bridge-establishment time. - Recommendation (Phase 2): one of `merkle_root`, `state_commitment`, - `rule_version_hash`, `address`, `signature_proof`, - `timestamp_window`. Closed list versioned by - `invariant_kind_set_version`. -- **Encoding** — little-endian, matching v7 §A1 / #000035 / #000070. - -Phase 2 will face the same KAT-discipline question #000070 faced; -Phase 2 will also need a domain-separation seed of its own -(`bridge_anchor_seed`), distinct from `spatial_anchor_seed` (#000070) -and `anchor_prg_seed` (#000035). - -### 2.3 Bridge kind taxonomy — formalization - -Phase 1 paper extension formalizes the three bridge kinds as follows. -Each kind names a **decision rule** the bridge runtime evaluates at -the moment two chains attempt to exchange. - -**Agreement bridge (`bridge_kind = 'agreement'`).** -- Decision rule: `src_rule_v == tgt_rule_v` AND `invariant_set` - contents are byte-identical when serialized canonically. -- Result: direct passage. Source object enters target chain native. -- **`bridge_seed`'s `translator_id` field** = the empty 32-byte hash - (no translator needed). -- **Arborist retro-validation:** #000066 graft-receipt mode. Same - `governance_policy_hash` peers exchange packs; `INSERT OR IGNORE` - on content-addressed PKs is the agreement; the graft receipt is the - bridge witness. - -**Translation bridge (`bridge_kind = 'translation'`).** -- Decision rule: `src_rule_v ≠ tgt_rule_v` BUT a registered - `translator_id` exists in the bridge atlas mapping - `(src_rule_v, tgt_rule_v) → translator`. -- Result: mediated passage. Source object passes through translator; - output enters target chain as a *translated native object*. -- **Translator integrity:** the translator's identity hash binds into - `bridge_seed`; a translator change at runtime invalidates the - bridge (same shape as #000035 KAT discipline + #000056 opus-mt - hash-pinning). -- **Arborist retro-validation:** #000056 Operation Sandwich. Spanish - query → opus-mt → English query → English-vs-English verifier → - English answer → opus-mt → Spanish display. The opus-mt model hash - IS the `translator_id`. - -**Embassy bridge (`bridge_kind = 'embassy'`).** -- Decision rule: `src_rule_v ≠ tgt_rule_v` AND no translator exists - (or the translator is explicitly declared as `embassy`). -- Result: foreign-object passage with limited rights. Source object - appears in target chain as a witnessed proxy: commitment only, no - warrant promotion, no native-rule extension. -- **Limited rights** (Phase 1 paper formalizes; Phase 3 ticket - implements): - - May be cited as evidence (POINTER-LINKED at best). - - May NOT promote to `EVIDENCE-WARRANTED` / `STRICT`. - - May NOT extend the target chain's rule grammar. - - MUST display the embassy banner (matches #000056 display-only - Spanish banner discipline). -- **Arborist retro-validation:** #000059 bounded-ingestion graveyard - (proposed). A peer's claim enters as a fingerprint witness, never - promotes. - -**Quarantine vs no bridge.** Joseph's §6 also names two non-bridge -outcomes: **quarantine** (rules conflict; bridge inhibited but -boundary objects allowed) and **no bridge** (rules contradict; -exchange impossible). Phase 1 paper formalizes these as the -`bridge_kind` enum values `'quarantine'` and `'no_bridge'`: - -- `quarantine`: a bridge object exists but its allowed-object set - is empty; the object IS the boundary marker. -- `no_bridge`: no bridge object; attempted exchange raises at the - atlas layer. - -### 2.4 Bridge atlas — multi-instance protocol (DEFERRED to Phase 3) - -The bridge atlas is the runtime registry that holds bridge objects -between known chains. It is genuinely new work — arborist's -`arborist/mesh/` layer today does group keys + epochs + roster but -assumes peers share `governance_policy_hash`. The atlas lets peers -with different `governance_policy_hash` values selectively exchange -under explicit bridges. - -Phase 3 ticket will specify: -- Atlas schema (`bridge_atlas` table or sibling-DB pattern). -- Bridge discovery (who advertises bridges, how peers learn). -- Bridge establishment protocol (consent, signature, witness). -- Bridge revocation + decay (Joseph names "decay" as a bridge - geometry property). -- Cross-chain quorum semantics (does an Agreement bridge between - 3-of-5 peers count? — likely #000037 controller territory). - -NOT in Phase 1 scope. Listed here so dav1d sees the full picture. - -### 2.5 Audit-chain composition — graft receipt as bridge witness - -#000066 already specifies the **graft receipt** as the witness -pattern: one `event_type='graft'` event in the host chain carries -the absorbed pack chain's bookend hashes, and the pack file itself -becomes the durable witness for the absorbed events. - -Phase 1 paper extension formalizes this as the **canonical bridge -witness pattern**: every bridge object (Agreement, Translation, or -Embassy) writes one audit event of `event_type='bridge'` carrying -`(bridge_kind, bridge_seed, src_chain_id, tgt_chain_id, translator_id, -invariant_root)`. The body matches Joseph's bridge-seed inputs -one-for-one. Source-chain commitments stay in their own audit -chains; the bridge event is a witness pointer. - -**`append_audit` extension (Phase 3 ticket).** The -`arborist.store.append_audit` helper would gain a `bridge` event -type; Phase 1 spec only. - -### 2.6 audit_mode discipline — bridges produce commitments, not warrants - -CLAUDE.md: "`audit_mode` is decided by the verifier, never -asserted." A bridge produces a `bridge_seed`, a witness event, and -(for Translation/Embassy) a translated/proxied representation. None -of these are warrants for any claim. The verifier discipline (quote -/ span / entity / paraphrase) is unchanged by Phase 1. - -Translated objects ride the bridge into the target chain's -warrant-eligibility pool only if both: -- (a) The target chain's verifier accepts the source-language - evidence in its own language under the existing rules - (English-vs-English for #000056). -- (b) The translator hash is the one bound into the bridge_seed. - -Embassy objects never enter the warrant-eligibility pool. They are -pure witnesses (CLAUDE.md: "soft never enters proof path" -generalization). - -This is the most important conceptual discipline of this ticket. -The bridge layer must not become a sneak path for promoting -foreign-rule warrants past the local verifier. - -### 2.7 Privacy / surveillance - -v7-W paper §6 surveillance discussion applies doubly to bridges: -a bridge object exposes the existence of a relationship between two -chains. Phase 1 paper extension flags this; Phase 3+ implementation -tickets will need to declare bridge-privacy class (public vs -ZK-with-selective-disclosure) parallel to v7-W manifest privacy -class. - -### 2.8 Endianness - -Little-endian throughout, matching v7 §A1 / #000035 / #000070 / -phase-2 bridge-seed canonicalization. No exceptions. - -## 3. Recommendation - -**Phase 1 deliverable** — paper-only, no code: - -1. **`docs/_source/merkle-agi-v7w-spatial-temporal.rst`** — new section - "§7 — World-bridge grammar (axis 2)" with: - - Joseph's framework verbatim core (§1.2 of this ticket). - - Three-bridge-kind taxonomy formalization (§2.3). - - `bridge_seed` formula and the canonicalization deferred to Phase 2 - (§2.2). - - Sovereignty rule (chain law local, bridge law translation-only). - - **Retroactive-validation appendix** explicitly naming #000066 / - #000056 / #000059 as Agreement / Translation / Embassy bridges - respectively. This is the most load-bearing paragraph of Phase 1 - — the framework's primary contribution is naming, not - prescribing new behavior. - - Bridge witness pattern (§2.5) and the deferred `bridge` audit - event type. -2. **`arborist/world/bridge/__init__.py`** — namespace stub mirroring - `arborist/world/__init__.py` discipline. `BRIDGE_VERSION = - "v0-draft"`, `STATUS = "namespace_reserved"`. No exports. -3. **Joseph memory** (`joseph_trudojo_6dim_spatial_ontology.md`) - extension — fold the bridge framework into the existing reference - memory so future attribution stays unified. -4. **No bench, no KATs, no SQL changes, no `cache_key` extension, no - new `audit_mode` token, no `governance_policy_hash` field, no - verifier change.** - -**Phase 2** (separate ticket, post-Phase-1 paper review): -`pi_star/bridge-seed@v1` registered with the full -canonicalization per §2.2 decisions. KATs at -`bench/fixtures/bridge-seed/known-answer-tests.jsonl` matching -#000070's discipline. - -**Phase 3** (separate ticket): -- `arborist/world/bridge/{agreement,translation,embassy}.py` kernels. -- `bridge_atlas` schema. -- `arborist.store.append_audit` extended for `event_type='bridge'`. -- Multi-instance bridge discovery + establishment protocol - (`arborist/mesh/` integration). -- Bridge revocation + decay semantics. - -**Phase 4** (separate ticket, depends on #000015): -- Cross-domain bridges — bridging arborist v9.8 language claims into - v7-W spatial commitments via the #000015 π* composition theorem. - This is where the agi-axis composition lives. - -## 4. Implementation sketch (Phase 1 only) - -```python -# arborist/world/bridge/__init__.py -"""``arborist.world.bridge`` — v7-W bridge-grammar substrate (#000071). - -Reserved namespace. The bridge-grammar paper extension at -``docs/_source/merkle-agi-v7w-spatial-temporal.rst`` §7 specifies the -contract; this package will host the implementation when fox -prioritizes per-bridge-type kernel work. - -Status: namespace stub only. No kernels, no schema, no API surface -yet. Importing this package succeeds (the module loads and reports -its draft version) but nothing else is exported. - -Future shape (per Phase 3 ticket roadmap): - -:: - - arborist/world/bridge/ - ├── __init__.py # this stub - ├── agreement.py # `bridge_kind='agreement'` kernel - ├── translation.py # `bridge_kind='translation'` kernel - ├── embassy.py # `bridge_kind='embassy'` kernel - ├── seed.py # bridge_seed canonicalization (Phase 2) - ├── atlas.py # bridge atlas (multi-instance) - ├── audit.py # `event_type='bridge'` writer - └── adapters/ # translator adapters live here - -The substrate paper's hard constraint applies: chain law remains -local; bridge law governs translation; no bridge may overwrite -native chain law. - -Retroactive-validation appendix (paper §7.4): the following arborist -primitives are *already* bridge-shape patterns and remain so when -this namespace ships: - -- #000066 cold-pack graft mode → Agreement bridge -- #000056 Operation Sandwich → Translation bridge -- #000059 bounded-ingestion graveyard (proposed) → Embassy bridge -""" - -from __future__ import annotations - - -__all__ = ["BRIDGE_VERSION", "STATUS"] - - -BRIDGE_VERSION = "v0-draft" -"""Draft bridge-grammar version. Bumps on every spec change before v1 -freeze. Once a kernel ships, BRIDGE_VERSION pins the manifest version -the kernel emits.""" - - -STATUS = "namespace_reserved" -"""Reservation status. Becomes ``kernel_in_progress`` when the first -bridge kernel lands; ``v1`` once all three bridge kinds have passing -tests + bench fixtures + multi-instance atlas.""" +## 2. Five bridge outcomes (each typed) + +A bridge attempt resolves to exactly one of five outcomes. Each +outcome carries a typed witness event body so the audit chain can +replay what was decided. + +### 2.1 Agreement + +Grammars match on the shared invariant set; commitments pass +directly without translation. + +``` +witness body { + kind = "agreement" + src_chain_id + tgt_chain_id + shared_invariant_root + object_or_pack_root + no_translator # sentinel: no adapter used +} ``` -Paper section template — to be drafted in -`docs/_source/merkle-agi-v7w-spatial-temporal.rst` §7: +### 2.2 Translation -- §7.1 Problem statement (§1.1 of this ticket) -- §7.2 Joseph framework (§1.2 verbatim) -- §7.3 Three-kind taxonomy (§2.3 formalization) -- §7.4 **Retroactive-validation appendix** (§1.3 table, expanded) -- §7.5 Bridge-seed canonicalization (§2.2 deferred to Phase 2) -- §7.6 Sovereignty rule -- §7.7 Bridge witness pattern + `event_type='bridge'` -- §7.8 Privacy carries through from §6 -- §7.9 Out-of-scope: SLAM, ZK, per-bridge-type kernels, atlas +Grammars differ but a hash-pinned adapter proves the mapping. -## 5. Scope boundaries (what this ticket does NOT do) +``` +witness body { + kind = "translation" + src_chain_id + tgt_chain_id + translator_id # adapter identity + translator_manifest_hash # adapter version + config + input_root # what the adapter consumed + output_root # what the adapter produced + translation_policy_hash # acceptance rules used +} +``` -- **No per-bridge-type kernel code.** `agreement.py`, - `translation.py`, `embassy.py` are Phase 3 tickets. -- **No `bridge_seed` canonicalization.** Phase 2 ticket; this ticket - deliberately defers to avoid premature locking. -- **No `pi_star/bridge-seed@v1` registry slot.** Phase 2. -- **No bridge atlas schema.** Phase 3. -- **No `event_type='bridge'` writer.** Phase 3. -- **No `bridge_canonicalization_version` cache-key dimension.** Phase - 3 (and only with explicit fox + dav1d sign-off — adding a 10th - cache-key dimension is consequential). -- **No mesh-layer changes.** `arborist/mesh/` group-key state machine - stays unchanged; Phase 3 will extend. -- **No KATs, no bench.** Doc-only Phase 1. -- **No `Document.extra` extensions.** Bridges do not live on - documents. -- **No new `audit_mode` token.** Bridges produce commitments, not - warrants. -- **No retroactive code change to #000066 / #000056 / #000059.** The - retroactive-validation appendix is *naming*, not *refactoring*. - Each existing primitive stays where it is, doing what it does. - Only the paper picks up the bridge-shape vocabulary. -- **No #000015 generalization at Phase 1.** Cross-domain bridges - (language ↔ spatial) are Phase 4. +Note: `translator_id` binds into `bridge_seed`. Adapter swaps = +new bridge identity = cache miss = proof-path re-verification. -## 6. Cross-references +### 2.3 Embassy -| Ref | Title | Relationship | -|---|---|---| -| #000070 | Spatial-anchor π*_w_object (Joseph 6-dim) | **Adjacent axis**, opened same day. #000070 is intra-chain object identity (one hash → one object inside one world); #000071 is inter-chain treaties (a bridge between two worlds). Different axes; #000070 dav1d review proceeds independently. | -| #000013 | Spatial-temporal substrate (v7-W) | Parent. The bridge layer extends the v7-W paper with axis 2. Reopens #000013 status from `namespace_reserved` to `kernel_in_progress` once this Phase 1 paper extension lands. | -| #000066 | Cold-pack overlay / graft mode | **Retroactive validation — Agreement bridge.** Already shipped (scaffold). Phase 1 names graft-receipt as the canonical Agreement bridge witness pattern; no code change to #000066 itself. | -| #000056 | Operation Sandwich (cross-language MT) | **Retroactive validation — Translation bridge.** Already shipped. opus-mt model hash IS the `translator_id`; Phase 1 names sandwich as the canonical Translation bridge. | -| #000059 | Bounded-ingestion graveyard (proposed) | **Retroactive validation — Embassy bridge.** Joseph's "foreign object with limited rights" maps one-for-one to graveyard semantics. Phase 1 names this. | -| #000001 §7 | Cross-language transforms | Companion to #000056; same retro-validation as Translation bridge. The "fail-closed reject DAG" for `CROSS_LANGUAGE_UNSUPPORTED` is the `no_bridge` outcome from Joseph's §6. | -| #000015 | π* cross-domain composition | Future. Cross-domain bridges (language ↔ spatial) are Phase 4; #000015 supplies the composition theorem. | -| #000018 | Soft-hash covert channel | Hard-hash discipline inherits. Bridge seeds are hard-channel commitments. | -| #000035 | PRG choice (φ_PRG HMAC-SHA-512) | Phase 2 `pi_star/bridge-seed@v1` will need its own seed (`bridge_anchor_seed`) distinct from `spatial_anchor_seed` (#000070) and `anchor_prg_seed` (#000035). Same domain-separation discipline. | -| #000037 | Controller / consensus | Phase 3 bridge atlas may need multi-peer consensus on bridge establishment; #000037 territory. | -| #000049 | Attribution-aware grounding check | Sibling-split pattern reference. The bridge framework is exactly the kind of architectural-inflection split where a separate dav1d-review surface is correct (CLAUDE.md memory `feedback_ticket_proliferation`). | -| v7-W paper | `docs/_source/merkle-agi-v7w-spatial-temporal.rst` | Specification this ticket extends with §7. | -| Joseph framework (6-dim) | Memory: `joseph_trudojo_6dim_spatial_ontology.md` | Same memory file extended to cover both frameworks. Sibling axes; one author. | +Foreign object hosted in the target chain with limited rights — +the foreign chain's `audit_mode` does NOT promote in the host. -## 7. Five-step alignment +``` +witness body { + kind = "embassy" + foreign_chain_id + host_chain_id + foreign_object_commitment + rights_mask # bitfield: what the host may do + embassy_contract_hash # treaty terms + expiry_or_decay # when this embassy ends + no_warrant_promotion = true # hard sentinel +} +``` -1. **Requirements less dumb.** Joseph (@TrudoJo) authored both - frameworks (6-dim 2026-05-31 + bridges 6 hours later same day); - fox brought both in. Names, not departments. -2. **Delete the part or the process.** Phase 1 is paper-only — no - code lands. The strongest deletion is the *non-decision* to - defer bridge-seed canonicalization to Phase 2 instead of locking - it now. Premature canonicalization would foreclose - per-bridge-type kernel decisions. ~50% of "we could write Phase - 1 with seed canonicalization included" deleted. -3. **Simplify.** One paper section extension; one namespace stub; - one memory update. No new code surface. Phase 1's primary - contribution is *naming what we already do*. -4. **Cycle time.** Doc-only Phase 1 lands in one PR (~400 lines of - prose); no test harness needed. -5. **Automate.** No automation surface — there is no per-bridge-type - automation to add until Phase 3 kernels exist. +### 2.4 Quarantine -## 8. Open questions for dav1d +Bridge attempted, invariant validation **FAILED**. Record the +rejection so future attempts see what broke and don't replay the +same failure silently. -1. **§2.1 — doc-only Phase 1 vs paper + π*_w_bridge registry slot.** - Recommendation A (doc-only) defers bridge-seed canonicalization to - Phase 2 to avoid premature locking. Acceptable, or should Phase 1 - ship the `pi_star/bridge-seed@v1` slot to lock canonical bytes now - while three implementation tickets are still ahead? -2. **§2.2 — `chain_id = governance_policy_hash` vs v7-W manifest - hash.** Recommendation `(a)` covers QA-policy churn. Acceptable, - or does the chain identifier need narrower semantics (one chain - per substrate-manifest version, ignoring QA changes)? -3. **§2.3 — three-bridge taxonomy completeness.** Joseph's - framework names Agreement / Translation / Embassy plus the - Quarantine and No-bridge non-bridge outcomes. Does the taxonomy - cover all cases dav1d has seen, or is there a fifth case (e.g. - *partial-translation bridge*, where the translator handles some - fields but not others)? -4. **§2.3 — Translation bridge's translator integrity.** Phase 1 - spec says translator identity hash binds into `bridge_seed`. - Should the spec also require the translator's *implementation* - (not just identity) to be content-addressed (cf. #000049 - model-in-proof-path cage), or is identity-hashing sufficient? -5. **§2.5 — bridge witness via `event_type='bridge'`.** Phase 3 - would extend `arborist.store.append_audit` with this. Confirm - the audit-chain composition rule from #000066 (graft receipt - as bookend witness) generalizes cleanly to all three bridge - kinds, or are Translation / Embassy witnesses structurally - different? -6. **§2.6 — `audit_mode` discipline for translated objects.** - Confirm that a translated object riding a Translation bridge - can be promoted to the target chain's warrant-eligibility pool - only if (a) target-chain verifier accepts source-language - evidence in its own language *under the existing rules*, and - (b) the translator hash matches the bridge_seed-bound one. No - new audit_mode token; the existing four-rung ladder governs. -7. **§2.7 — bridge privacy class.** Should the bridge-establishment - event itself be public-by-default, or should ZK-with-selective- - disclosure be the default for bridges between non-public chains? - #000016 follow-up. -8. **§2.8 — endianness.** Inherited from #000035 / #000070; - confirm reuse. -9. **Phase 2 KAT count.** Phase 2 `pi_star/bridge-seed@v1` will need - KATs. Recommendation: 10 matching #000035 / #000070 discipline. - Larger? Adversarial vectors should include identical - `(src_chain_id, tgt_chain_id)` with different `src_rule_v` - (i.e. same chain, different rule version — same-chain rule-bump - case) so the canonicalization can't quietly collapse them. -10. **Paper amendment wording — bridge framework.** Default draft: - "The bridge-grammar layer formalized in this section follows - the inter-chain treaty framework presented by Joseph (@TrudoJo) - on 2026-05-31, sibling to the procedural-spatial framework - that drives axis 1 (#000070)." +``` +witness body { + kind = "quarantine" + src_chain_id + tgt_chain_id + attempted_bridge_kind # what kind was tried + invariant_violation_root # which invariants failed + quarantine_until # earliest revisit time + revisit_policy_hash # rules for unblocking +} +``` + +### 2.5 No-bridge + +Grammars genuinely incompatible. Explicit declaration that no +bridge will exist between these two chains — distinct from +Quarantine (which is "not now, maybe later") and from "we haven't +tried" (which has no witness at all). + +``` +witness body { + kind = "no_bridge" + src_chain_id + tgt_chain_id + incompatibility_root # what blocks bridging + explanation_hash # rationale committed +} +``` --- -**Land sequence on go:** +## 3. Privacy class vocabulary -1. Land this ticket file + `Next ID` bump + index row + #000070 §6 - cross-reference + Joseph memory extension (one commit). -2. dav1d Phase 1 review (paper extension + retro-validation appendix). -3. fox go. -4. Implementation PR: substrate paper §7 extension + - `arborist/world/bridge/__init__.py` namespace stub. ~400 lines of - prose + ~30 lines of stub. -5. Memory update: flip `joseph_trudojo_6dim_spatial_ontology.md`'s - bridge-framework section from "cite when used" to "used in - #000071, landed ``". -6. Open Phase 2 ticket for `pi_star/bridge-seed@v1` canonicalization - when fox prioritizes. +Bridges leak information about which chains know each other. +Privacy is a **first-class** Phase 1 vocabulary choice, not a +Phase 3+ footnote. Phase 2 bridge_seed canonicalization must +encode the chosen class as a hash-bound field. + +``` +public_bridge bridge existence + endpoints visible +redacted_bridge bridge existence visible; endpoints hidden/committed +zk_bridge proof of valid bridge without revealing chain IDs + or invariant set +private_bridge only peers with group keys can inspect bridge + metadata +``` + +Phase 1 ships no enforcement code; vocabulary must exist before +bridge_seed canonicalization is frozen (else the field shape +rotates everything that already used the broader scheme). + +--- + +## 4. Phase 1 deliverables (doc-first) + +**What ships:** + +1. **Substrate-paper extension** — bulk of Phase 1: + - File: `docs/_source/merkle-agi-v7w-spatial-temporal.rst` + - New section: "World-bridge grammar" + - Contents: + - Axis split with #000070 + - Five bridge outcomes with typed witness shapes + - Composite ChainRoot identity (§1 above) + - Privacy class vocabulary (§3 above) + - Sovereignty rule + hash-pinned translator discipline + - Retro-validation appendix (§5 below) +2. **Optional namespace stub:** + - File: `arborist/world/bridge/__init__.py` + - `STATUS = "namespace_reserved"` (mirrors `arborist/world/__init__.py` + pattern) + +**What does NOT ship in Phase 1:** + +- ❌ No kernels +- ❌ No `bridge_seed@v1` canonicalization (Phase 2) +- ❌ No SQL schema +- ❌ No `cache_key` dimension change +- ❌ No new `audit_mode` token (ever — hard constraint) +- ❌ No verifier change +- ❌ No KATs (Phase 2) +- ❌ No bench + +**Status discipline:** Phase 1 doc-only DOES NOT flip #000013 to +`kernel_in_progress`. Correct transition: `namespace_reserved → +bridge_grammar_specified`. `kernel_in_progress` is reserved for +actual kernel landings (Phase 2+). + +--- + +## 5. Retro-validation appendix (paper §) + +Three already-existing arborist primitives align with the bridge +taxonomy. The appendix documents this alignment — useful for +implementers as "this isn't a new pattern, it's a named one we've +been using." + +| bridge kind | arborist primitive | status (verify against repo before paper lands) | +|---|---|---| +| Agreement | #000066 graft / cold-pack overlay | shipped OR scaffolded — check repo | +| Translation | #000056 Operation Sandwich (opus-mt edges) | shipped if landed; specified-and-testable otherwise | +| Embassy | #000059 bounded-ingestion graveyard | **proposed / structurally aligned** — do NOT claim "shipped" unless repo confirms | + +Quarantine + No-bridge have no existing arborist primitive — they +are genuinely new patterns this ticket introduces. + +--- + +## 6. Phase 2 (kernel, deferred — separate ticket) + +When Phase 2 opens: + +``` +bridge_seed = SHA256(canonical({ + bridge_seed_version, # "bridge-seed-v1" + src_chain_id, # composite ChainRoot + tgt_chain_id, # composite ChainRoot + bridge_kind, # agreement|translation|embassy + # |quarantine|no_bridge + privacy_class, # public|redacted|zk|private + invariant_set_root, # for agreement / translation + translator_id, # NULL unless translation + translator_manifest_hash, # NULL unless translation + embassy_contract_hash, # NULL unless embassy + rights_mask, # NULL unless embassy +})) +``` + +Phase 2 ships: +- `arborist/world/bridge/seed.py` — `bridge_seed()` canonicalizer +- KATs at `bench/fixtures/world-bridge/known-answer-tests.jsonl` +- Tests at `tests/test_world_bridge_seed.py` +- One typed event-body parser per outcome (`agreement_body`, + `translation_body`, etc.) + +`bridge_canonicalization_version` becomes a new field in v9.8 +`cache_key` ONLY IF Phase 2 reveals it must. Defer that decision +to bench evidence. + +--- + +## 7. Phase 3 (atlas + audit chain integration, deferred) + +- `arborist/world/bridge/atlas.py` — multi-instance bridge directory +- `event_type='bridge'` audit-chain writer with kind-specific bodies +- Mesh integration (`arborist/mesh/`) so peers can negotiate bridges + in the federation overlay +- First SQL persistence (if at all — may stay event-stream-only) + +--- + +## 8. Phase 4 (cross-domain composition, deferred) + +Language ↔ spatial bridges via the #000015 composition theorem. +Out of scope until the spatial-only AnchorN substrate (Phase 1+2 +of #000070) ships and stabilizes. + +--- + +## 9. Cross-references + +- **#000070** — AnchorN + WorldDimensionGrammar. This ticket bridges + ChainRoots whose grammars come from #000070. +- **#000013** — v7-W substrate reservation. Phase 1 of this ticket + bumps #000013 status to `bridge_grammar_specified` (NOT + `kernel_in_progress`). +- **#000056** — Operation Sandwich. Retro-validation appendix names + the opus-mt translator pattern as the Translation bridge archetype. +- **#000066** — graft / cold-pack overlay. Agreement bridge archetype. +- **#000059** — bounded-ingestion graveyard. Embassy bridge + archetype (structurally aligned; verify repo status before paper + lands). +- **#000015** — π* cross-domain composition. Phase 4 dependency. + +--- + +## 10. Open questions + +Only the items dav1d's review left genuinely open. Most of the +original 10 questions were answered by the AnchorN reframe. + +1. **Q10 substrate-paper amendment wording.** The paper at + `docs/_source/merkle-agi-v7w-spatial-temporal.rst` needs a new + section. Draft language for §0.4-§0.5 (bridge outcomes + ChainRoot) + is ready in this ticket; the paper's voice + diagram style stay + for fox to set. +2. **Quarantine `revisit_policy_hash` shape.** What does the policy + encode? Time-based (revisit after N seconds), event-based + (revisit when invariant_violation_root changes), or both? Phase 2 + decision when bridge_seed canonicalization opens. +3. **Privacy class enforcement boundary.** Phase 1 defines the + vocabulary; Phase 2 freezes the field in bridge_seed; where does + ENFORCEMENT live? In the canonicalizer (reject if the caller's + class doesn't match the bridge's declaration), or in a separate + privacy-policy verifier? Phase 2 decides. + +--- + +## 11. Five-step alignment + +1. **Make requirements less dumb.** Joseph's framework, dav1d's + review — both named, both load-bearing. The "AnchorN-aware bridge" + reframe is exactly the requirement Joseph + dav1d together insist + on. +2. **Delete the part / process.** Three bridge kinds → five — but + the two new ones (Quarantine, No-bridge) are not addition, they + are extraction of states the original three implicitly forced + into either Agreement-with-empty-invariants or silent-failure. + The taxonomy is now exhaustive. +3. **Simplify and optimize.** Phase 1 is paper only. Zero new + schema. Composite ChainRoot reuses every hash field we already + compute. +4. **Accelerate cycle time.** Doc-first. Implementation tickets + land when fox + the implementer agree the paper-extension reads + clean. +5. **Automate.** Last. The canonicalizer + KAT discipline (Phase 2) + automates what the paper specifies; no automation before the + spec freezes. + +--- + +## 12. Review history + +- **2026-05-31** — original ticket filed (Joseph6-sibling framing, + three bridge kinds, governance_policy_hash as chain_id). Full + original spec preserved in git history at commit `fadc50a`. +- **2026-06-01** — dav1d de-novo review: REJECT-AS-WRITTEN + + GO-with-rewrite. Five-outcome taxonomy, composite ChainRoot, + Phase 1 privacy vocabulary, #000059 "shipped" overclaim corrected. + Full review (1026 lines) archived at + `docs/dav1d-reviews/000071-world-bridge-grammar--2026-06-01.txt`. + This ticket text is the rewrite dav1d's review requires.