diff --git a/docs/TICKETS.md b/docs/TICKETS.md index 4456235..9ad1e4d 100644 --- a/docs/TICKETS.md +++ b/docs/TICKETS.md @@ -113,7 +113,7 @@ Newest first. Update on every open/close. |----------|------------------------------------------------|-----------------------|------------|-----------| | #000072 | Collapse legacy `query()` into the unified `run_query` orchestrator | **open · Phase 1 foundation shipped 2026-05-31 (10 commits) · Phase 2 BLOCKED on 5 missing rerank stages** — multi_route smoke probe regressed on 2/5 questions (Mercury Seven → Sam T. Beddingfield; dinosaurs → Paul Austin Kelly), so Phase 1 is structurally complete but not production-quality. Phase 1 shipped: `source_roles.py` extraction (9ba6317), canonical `stem_for_match` in `_text_norm.py` (a83e47b), `retrieval_routes.py` with `filter_by_title_relevance` (056d785), Corpus protocol gains `core_keyword_match` + `doc_body` (e322bbd), byte-identity test fixture as Phase 2 safety gate (1822741), `run_query` gains `policy=` kwarg threading 12 verifier kwargs (72d1117), role-classified + role-weighted budget (03f248c), multi-route retrieval body+title+phrase+core_keyword merge (5fdd573), filter wired into multi_route path (6c2ec1b), wikitext-strip when `policy.base_version` set (b8bd9d6), `providence_query.py` cache-wrapper skeleton with cache persist deferred (20faae0). Every commit ships with `policy=None` preserving pre-step byte-identity behavior — existing `arborist corpus-query` and `arborist cloud query` callers are unaffected; the slim-FTS5 cloud path already wins on the dinosaur Q5 fixture (picks "Dinosaur" not legacy's "Edwina"). Phase 2 blocked because Phase 1's `multi_route` pipeline lacks the 5 downstream rerank stages legacy uses to suppress noisy phrase-route hits: body-density check (`_body_density_passes`), body-coverage sqrt rerank (`_rerank_by_body_coverage`), source-role rerank (`_rerank_by_source_role` with RANK_WEIGHTS), title-purity rerank ((1+overlap)*(1+purity)), ordered-token-match rerank (longest-common-subsequence). **Path A** = port the 5 stages → re-bench → resume Phase 2 cache persist + legacy-query() collapse to 50-line adapter. **Path B chosen 2026-05-31** = stop here, defer Phase 2, leave multi_route off by default (which IS the default — `policy=None` preserves body-only retrieval). Until Path A: Phase 1 foundation stays in tree as future-ready infrastructure; user surface unchanged (legacy `query()` still produces same answers, INCLUDING the wrong "Edwina" pick on dinosaur Q5). Full spec + commit log + bench data + the missing-rerank-stages inventory in `docs/tickets/ticket-000072-collapse-legacy-query-into-run-query.md`. | 2026-05-31 | — | | #000071 | World-bridge grammar for AnchorN / v7-W inter-chain treaties | **open · doc-first Phase 1.** Spec the bridge-grammar layer so two chains with different histories / rules / grammars / manifests / translators / canonicalization_versions exchange commitments **without either chain overwriting the other's local law**. Operates between ChainRoots whose world grammars may be AnchorN-derived (not Joseph6-coupled). Axis split: **#000070 = intra-world state instantiation** (one chain's grammar determines its state-space), **#000071 = inter-world treaty grammar** (decides agreement/translation/embassy/quarantine/no-bridge). **Composite ChainRoot identity** (replaces `chain_id = governance_policy_hash`): SHA256(canonical({chain_id_version, history_root, governance_policy_hash, canonicalization_version, schema_version, chunking_version, world_manifest_hash, world_dimension_grammar_hash, axiom_pack_hash, optional_verifier_policy_hash})) — language-only QA chains: three v7-W fields are null sentinels (chain_id collapses to existing identity); v7-W chains: all mandatory. **Five typed bridge outcomes:** Agreement (grammars match on invariant set; no_translator sentinel), Translation (hash-pinned adapter proves mapping; translator_id binds into bridge_seed), Embassy (foreign object hosted with limited rights via rights_mask + embassy_contract_hash + expiry_or_decay + no_warrant_promotion sentinel), Quarantine (bridge attempted, invariant validation FAILED, record rejection with quarantine_until + revisit_policy_hash so future attempts see what broke), No-bridge (genuinely incompatible, explicit declaration with incompatibility_root + explanation_hash). **Privacy class vocabulary** (4 classes, Phase 1 paper-must-define): public_bridge / redacted_bridge / zk_bridge / private_bridge — Phase 2 bridge_seed canonicalization encodes the chosen class as a hash-bound field. **Hard constraints (all phases):** A1–A3 axioms, local chain sovereignty (chain law local, bridge law treaty-only, no bridge overwrites native chain law — guard against forced-unity failure), translator identities hash-pinned (same discipline as #000056 opus-mt), no new audit_mode token (bridges produce commitments not warrants; embassies stay POINTER-LINKED, never EVIDENCE-WARRANTED), no SQL at Phase 1, topic-named under `arborist/world/bridge/`. **Phase 1 ships:** substrate-paper extension at `docs/_source/merkle-agi-v7w-spatial-temporal.rst` §"World-bridge grammar" (5 outcomes + composite ChainRoot + privacy vocabulary + sovereignty rule + #000070 cross-ref + retro-validation appendix) + optional namespace stub `arborist/world/bridge/__init__.py` (STATUS=namespace_reserved). **Phase 1 does NOT ship:** kernels, bridge_seed@v1 canonicalization (Phase 2), SQL schema, cache_key dimension change, audit_mode token, verifier change, KATs (Phase 2), bench. **Status discipline:** Phase 1 doc-only DOES NOT flip #000013 to `kernel_in_progress` — correct transition is `namespace_reserved → bridge_grammar_specified`; `kernel_in_progress` reserved for actual kernel landings (Phase 2+). **Retro-validation appendix** names three structurally-aligned arborist primitives: #000066 graft / cold-pack overlay = Agreement archetype, #000056 Operation Sandwich = Translation archetype, #000059 bounded-ingestion graveyard = Embassy archetype (proposed/structurally-aligned, NOT "already shipped" — verify repo before paper lands). Quarantine + No-bridge are genuinely new patterns. **Phase 2** (deferred): bridge_seed@v1 canonicalizer + KATs + tests + typed event-body parsers per outcome + bridge_canonicalization_version cache_key field only IF bench reveals it must. **Phase 3** (deferred): bridge atlas, event_type='bridge' audit-chain writer with kind-specific bodies, mesh integration. **Phase 4** (deferred): cross-domain composition (language ↔ spatial via #000015), gated on #000070 Phase 1+2 stable. **Open questions** (most resolved by AnchorN reframe): paper-amendment wording, Quarantine revisit_policy_hash shape, privacy enforcement boundary. Originally Joseph6-sibling framing 2026-05-31 (commit `fadc50a`); rewritten 2026-06-01 to grammar-agnostic AnchorN per dav1d's REJECT-AS-WRITTEN + GO-with-rewrite verdict (full 1026-line review archived at `docs/dav1d-reviews/000071-world-bridge-grammar--2026-06-01.txt`). Full directive spec in `docs/tickets/ticket-000071-world-bridge-grammar.md`. (2026-05-31; sibling to #000070, opened same day after Joseph @TrudoJo posted his bridge-framework extension to the 6-dim spatial-ontology — "chain A has its own world rules, chain B has its own world rules, a bridge exists only where a deterministic agreement layer can be proven"). Three bridge kinds: **Agreement** (rules match, direct passage), **Translation** (rules differ but a hash-pinned adapter exists), **Embassy** (foreign-object representation with limited rights). Bridge identity: `bridge_seed = hash(src_chain_id ‖ src_node ‖ src_rule_v ‖ tgt_chain_id ‖ tgt_rule_v ‖ translator_id ‖ invariant_set)`. Joseph's sovereignty rule (hard): chain law remains local, bridge law governs translation only, **no bridge may overwrite native chain law** — guard against forced-unity failure mode. **Primary contribution: retroactive-validation appendix** naming three already-shipped arborist primitives as Joseph-bridge-shape patterns one-for-one — **#000066 graft-receipt mode = Agreement bridge**, **#000056 Operation Sandwich = Translation bridge** (opus-mt hash IS the translator_id), **#000059 bounded-ingestion graveyard = Embassy bridge** (POINTER-LINKED only, never promotes, banner-labelled). The framework is not a new requirement; it's a unifying spec that names what arborist already does in 3+ places, plus surfaces a fourth pattern (bridge atlas for multi-instance federation with potentially-different `governance_policy_hash` peers) as genuinely new work for `arborist/mesh/`. **Phase 1 is doc-only** — paper extension §7 in `docs/_source/merkle-agi-v7w-spatial-temporal.rst` + `arborist/world/bridge/__init__.py` namespace stub mirroring `arborist/world/__init__.py` discipline + Joseph-memory extension. No kernel code, no SQL change, no `cache_key` extension, no new `audit_mode` token, no bench (doc-only review surface). Phase 2 = `pi_star/bridge-seed@v1` canonicalization deliberately deferred to avoid premature locking before three implementation tickets opine. Phase 3 = per-bridge-type kernels + bridge atlas + `event_type='bridge'` writer + mesh integration. Phase 4 = cross-domain bridges (language ↔ spatial via #000015 composition theorem). **Ten open questions for dav1d** in §8: doc-only vs registry-slot-at-Phase-1 (Q1), chain_id = governance_policy_hash vs manifest hash (Q2), three-bridge taxonomy completeness (Q3), translator integrity hashing depth (Q4), bridge witness via `event_type='bridge'` (Q5), `audit_mode` discipline for translated objects (Q6), bridge privacy class default (Q7), endianness reconfirmation (Q8), Phase 2 KAT count + adversarial vectors (Q9), paper-amendment wording (Q10). Hard constraints: A1–A3, no continuous tensors, no `audit_mode` token, no SQL change at Phase 1, topic-named under `arborist/world/bridge/`. Full spec in `docs/tickets/ticket-000071-world-bridge-grammar.md`. | 2026-05-31 | — | -| #000070 | AnchorN + π*_w_object: deterministic world-object canonicalization (was: Spatial-anchor π*_w_object / Joseph 6-dim kernel) | **open · dav1d GO with rewrite (2026-06-01) · spec revision pending before any kernel ships.** Dav1d verdict: GO for generic **AnchorN** substrate primitive (not fixed Anchor6), GO for **Joseph6 as first registered grammar** (not THE ontology), GO for deterministic object-state canonicalization, GO for axiom/physics-loaded **WorldDimensionGrammar** path; NO-GO for hard-coding H₁..H₆ as final ontology, NO-GO for runtime LLM-decided dimensionality (axioms MAY propose, only deterministic validators may accept; grammars frozen via grammar_hash before proof-path use), NO-GO for framing this as "semantic verifier warrant", NO-GO for relation/event/place/agent_trace in this ticket (scope-creep), NO-GO for SQL persistence at Phase 1. Critical technical corrections: **H₁ must use uint256 not uint64** (octree position entropy at depth>8), **do NOT overclaim SO(3) on rotation** (name `map_rotation_euler_ypr()`), canonical record carries grammar_hash + axiom_pack_hash + manifest_hash + seed_hash, missing `privacy.class` = HARD reject, spatial-anchor-object@v1 folds into `canonicalization_version` only. Corrected package layout: `arborist/substrate/spatial_anchor.py` (AnchorN, split_anchor_n), `arborist/world/grammar.py` NEW (WorldDimensionGrammar + validate_grammar), `arborist/world/pi_star/object.py` (derive_world_object_record + 5 mappers), `arborist/pi_star/spatial_anchor_object.py` NEW (registry adapter), KATs at `bench/fixtures/spatial-anchor-object/known-answer-tests.jsonl`, 3 test modules. Phase 1 deliverable: AnchorN split + Joseph6 grammar + π*_w_object canonicalizer + KATs + tests + paper amendment; NO SQL, NO new audit_mode, NO verifier_policy_hash change. Implementation NOT started — `arborist/world/__init__.py` STATUS still "namespace_reserved", no spatial_anchor.py exists; only the pre-review empirical bench `bench/spatial_anchor_validation.py` is on disk (commit `55b651f`/`2eea5b5`: avalanche 767.85 bits vs PRF null 768 z=-0.49, octree chi² \|z\|<1 at L=2..4, collision birthday-bound 0.989/1.038, cross-region Pearson r∈[-0.018,+0.012], domain separation Arm A independent / Arm B exact-collision confirming dedicated `spatial_anchor_seed`). Dav1d's 26-section review preserves the empirical evidence (HMAC-SHA-512 properties unchanged by AnchorN generalization). Five of original ten open questions resolved by measurement (Q1/Q2/Q3/Q8/Q9); review answers Q4/Q5/Q6/Q7, Q10 (paper-amendment wording) still open. Full review archived at `docs/dav1d-reviews/000070-spatial-anchor-pi-w-object--2026-06-01.txt`; corrected spec in ticket §0; design log of original Anchor6 proposal preserved in §§1-8. Originally surfaced 2026-05-31 when fox brought in Joseph @TrudoJo's procedural-spatial framework — "hashes do not encode the world, hashes determine the world" — and asked whether it fits arborist's substrate model. Yes, AS AnchorN with Joseph6 as default grammar. — pure-stdlib empirical-validation script (`bench/spatial_anchor_validation.py`, `make bench-spatial-anchor`, ~2 s, RNG-seed-pinned) measures: §1 avalanche mean 767.85 bits vs PRF null 768 (z = -0.49) · §2 octree chi² uniformity \|z\| < 1 at L=2,3,4 · §3 collision birthday-bound ratio 0.989 / 1.038 at L=4,6 · §4 cross-region Pearson r in [-0.018, +0.012] across all 15 pairs of H₁..H₆ (none flag at 4σ) · §5 domain separation Arm A 767.91 bits independent / Arm B **0.00 bits exact collision** confirming the dedicated-`spatial_anchor_seed` discipline. Five of ten open questions (Q1 seed source · Q2 segmentation · Q3 octree mapper · Q8 endianness · Q9 KAT adversarial vectors) now resolve by measurement; Q4/Q5/Q6/Q7/Q10 remain non-empirical design decisions for dav1d. Full empirical detail in ticket §7a. Originally surfaced 2026-05-31 when fox brought in Joseph @TrudoJo's procedural-spatial framework — "hashes do not encode the world, hashes determine the world" — and asked whether it fits arborist's substrate model. It does, cleanly. Implements the first verifier kernel under the #000013 v7-W reserved namespace (`arborist/world/__init__.py` `STATUS = "namespace_reserved"` → `kernel_in_progress` on land): a single committed 32-byte SHA-256 hash deterministically expands into six named 32-byte regions `H₁..H₆` via the HMAC-SHA-512 KDF already shipped in `arborist/substrate/anchor_prg.py` (#000035), and each region drives one quantized object dimension under a fixed canonical mapper — `H₁→octree position`, `H₂→scale level`, `H₃→quantized SO(3) rotation`, `H₄→material palette`, `H₅→raw links (reserved for π*_w_relation sibling ticket)`, `H₆→behavior code`. Domain separation from #000035 by dedicated `spatial_anchor_seed` (manifest-published) — keeps #000035's KAT freeze + dav1d 2026-05-11 final review intact. Hard constraints: stays inside A1–A3, no continuous tensors in proof path, no new `audit_mode` token (substrate commitments are not warrants — the four-rung ladder is unchanged), no SQL schema change at Phase 1, `canonicalization_version` absorbs the new `spatial-anchor-object@v1` registry slot. Phase 1 deliverable ~150 LoC + 10 KATs + tests in one PR: `arborist/substrate/spatial_anchor.py` (segmentation), `arborist/world/pi_star/object.py` (six mappers), registry entry, KAT vectors at `bench/fixtures/spatial-anchor/known-answer-tests.jsonl` matching #000035 KAT discipline, `tests/test_spatial_anchor.py` + `tests/test_world_pi_star_object.py`, substrate-paper amendment citing Joseph (@TrudoJo) in `docs/_source/merkle-agi-v7w-spatial-temporal.rst`. Position mapper at Phase 1 = octree (substrate paper §2.1 + §A worked example); H3/S2/Hilbert/Morton siblings deferred — Morton's value is purely as the relation-kernel `pair(A,B)` cheap bit-interleave and surfaces in the sibling ticket. **Ten open questions for dav1d** in §8: seed-source choice, segmentation method, position mapper, scope split (object alone vs object+relation per CLAUDE.md memory `feedback_ticket_proliferation`), privacy-class fail-closed default, `audit_mode` discipline confirmation, manifest-validator timing, endianness reconfirmation, KAT count + adversarial vectors, paper-amendment wording. Five-step §7 deletions captured: dropped the prior `/tmp/arborist-spatial-ontology-plan.md`'s geographic-search backend (encoding-route confusion), `Document.extra` lat/lon hooks (different ticket if at all), `audit_mode=HYBRID` for spatial hits (convention-illegal), geohash (subsumed by Morton), quadtree as separate (octree at z-level-0), Hilbert at Phase 1 (deferred), tier-1/2/3 hash-suite framing (conflated hard vs soft hashes), and `arborist/spatial/` namespace (violates topic-naming rule). Full spec in `docs/tickets/ticket-000070-spatial-anchor-pi-w-object.md`. | 2026-05-31 | — | +| #000070 | AnchorN + π*_w_object: deterministic world-object canonicalization | **open · Phase 1 deliverable scoped.** Implement the first executable v7-W world-object canonicalization kernel: kernel takes `(hard_hash_32, spatial_anchor_seed, WorldDimensionGrammar, world_manifest)` → `(canonical_world_object_bytes, world_object_hash, object_record with grammar_hash + axiom_pack_hash + manifest_hash + seed_hash + per-dimension values)`. A single committed hash deterministically expands into N named regions via HMAC-SHA-512 KDF (reuses `arborist/substrate/anchor_prg.py:_expand` from #000035); **N is grammar-decided, not hard-coded**. Joseph6 (Joseph @TrudoJo's six-dimension framework) ships as the FIRST registered example grammar — not THE ontology. **AnchorN primitive** at `arborist/substrate/spatial_anchor.py`: `split_anchor_n(hard_hash, seed, grammar_hash, n)` — grammar_hash binds into the expansion so the same hard_hash under two different grammars yields disjoint regions (without that binding, swapping grammars at proof-path time would silently reuse anchor bytes for new semantics). **WorldDimensionGrammar** at `arborist/world/grammar.py`: name + version + n + region_mappers + region_names + axiom_pack_ref → canonical_grammar_bytes() → grammar_hash(); validate_grammar() raises GrammarInvalid on n/mapper-count/axiom-pack/reserved-name mismatch. **Five quantization mappers** at `arborist/world/pi_star/object.py`: `map_octree_position()` → **(level uint8, cell uint256)** (uint256, NOT uint64 — preserves entropy at depth>8 where uint64 truncates and silently biases cell selection), `map_scale_level()` → uint16, `map_rotation_euler_ypr()` → (yaw, pitch, roll) uint16 triple (**NOT "SO(3)"** — quantized Euler is not SO(3) coverage; adjacent rotation operations are not metrically adjacent in this quantization, do not overclaim), `map_symbol_table_index()` → uint64 (modulo over fixed palette), `map_passthrough_hex()` → hex_str (full 64-char). **Canonicalizer** `derive_world_object_record()` → WorldObjectRecord with all four identity hashes (required for replayability across grammar versions; consumer with the four hashes can re-derive byte-identically by loading named grammar+pack+manifest+seed). **Registry adapter** at `arborist/pi_star/spatial_anchor_object.py`: PI_STAR_NAME="spatial-anchor-object", PI_STAR_VERSION="v1", `canonicalize(raw: bytes) -> bytes`. **Joseph6 grammar instance** at `arborist/world/grammars/joseph6.py`: n=6, regions=(position, scale, rotation, material, links, behavior), mappers=(octree, scale_level, euler_ypr, symbol_index, passthrough_hex, symbol_index), axiom_pack_ref="axiom-pack-joseph6@v1". Joseph6 is the worked example — proves AnchorN can host a non-trivial grammar end-to-end, gives substrate-paper readers something concrete to follow, lets the bench (§7) measure a real grammar's avalanche/uniformity/domain-separation. **Hard constraints (all phases):** A1–A3 axioms, quantized integer state only (no continuous tensors in proof path), SHA-256 commit + HMAC-SHA-512 expansion (soft locality indices Morton/H3/S2/Hilbert/geohash stay OUTSIDE proof path), domain separation from #000035 via dedicated `spatial_anchor_seed` (no PHI_PRG_VERSION bump), no new audit_mode token (π*_w_object emits commitments not warrants; four-rung ladder unchanged), no SQL at Phase 1 (registry entry folds into `canonicalization_version` only — Phase 3 may add `world_state_cells` table), privacy fail-closed (missing `privacy.class` = HARD reject, no PUBLIC fallback), grammars MUST be FROZEN before proof-path use (axioms MAY propose / LLM may candidate, only deterministic validators may accept), topic-named (`arborist/world/`, `arborist/pi_star/`, not `arborist/v7w/` or `arborist/spatial/`). **Phase 1 ships:** 3 new modules (substrate/spatial_anchor.py, world/grammar.py, world/pi_star/object.py) + registry adapter + Joseph6 grammar + KATs at `bench/fixtures/spatial-anchor-object/known-answer-tests.jsonl` (zero-hash, max-hash, low-entropy, 3 mid-entropy with expected Joseph6 outputs) + 3 test modules + substrate-paper amendment citing Joseph (@TrudoJo) + STATUS bump `namespace_reserved → world_object_kernel_in_progress`. **Phase 1 does NOT ship:** relation/event/place/agent_trace kernels (siblings), SQL persistence (Phase 3), new audit_mode (ever), verifier_policy_hash change, continuous tensors in proof path, runtime LLM-decided dimensionality, open-ended bench (KATs replace). **Pre-review empirical bench already on disk** (`bench/spatial_anchor_validation.py`, commit `55b651f`, 561 lines, `make bench-spatial-anchor` ~2s, RNG-pinned `0xa8c90e551fd34427`): §1 avalanche 767.85/768 bits z=-0.49, §2 octree chi² \|z\|<1 at L=2/3/4, §3 birthday-bound 0.989/1.038 at L=4/6, §4 cross-region Pearson r∈[-0.018,+0.012] all 15 pairs, §5 domain separation Arm A 767.91 bits independent / Arm B **0.00 bits exact collision** confirming dedicated `spatial_anchor_seed` discipline. Bench answers 5 of original 10 open questions (Q1 seed source · Q2 segmentation · Q3 octree mapper · Q8 endianness · Q9 KAT vectors); dav1d's review answered Q4/Q5/Q6/Q7. **Open questions remaining:** Q10 substrate-paper amendment wording (technical content in ticket; paper's voice + diagram style stay for fox to set), grammar registry persistence shape (Python constants / manifest YAML / SQLite blobs — Phase 1 starts Pythonic; Phase 2 may need otherwise as more grammars land), axiom pack registry vs declared inline (may warrant sibling ticket if axiom packs grow). **Phase 2** (deferred — siblings): second grammar registration (Cartesian5 candidate) proves registry mechanism works, π*_w_relation kernel (different grammar, no single anchor), π*_w_event/place/agent_trace each own ticket. **Phase 3** (deferred): SQL `world_state_cells` table + v9.8 cache_key dimension if bench reveals must + cold-pack export sibling of #000061. Originally Anchor6 framing 2026-05-31; rewritten 2026-06-01 to grammar-agnostic AnchorN with Joseph6 as worked example per dav1d's GO-with-rewrite verdict (full 1904-line review archived at `docs/dav1d-reviews/000070-spatial-anchor-pi-w-object--2026-06-01.txt`). Full directive spec in `docs/tickets/ticket-000070-spatial-anchor-pi-w-object.md`. — pure-stdlib empirical-validation script (`bench/spatial_anchor_validation.py`, `make bench-spatial-anchor`, ~2 s, RNG-seed-pinned) measures: §1 avalanche mean 767.85 bits vs PRF null 768 (z = -0.49) · §2 octree chi² uniformity \|z\| < 1 at L=2,3,4 · §3 collision birthday-bound ratio 0.989 / 1.038 at L=4,6 · §4 cross-region Pearson r in [-0.018, +0.012] across all 15 pairs of H₁..H₆ (none flag at 4σ) · §5 domain separation Arm A 767.91 bits independent / Arm B **0.00 bits exact collision** confirming the dedicated-`spatial_anchor_seed` discipline. Five of ten open questions (Q1 seed source · Q2 segmentation · Q3 octree mapper · Q8 endianness · Q9 KAT adversarial vectors) now resolve by measurement; Q4/Q5/Q6/Q7/Q10 remain non-empirical design decisions for dav1d. Full empirical detail in ticket §7a. Originally surfaced 2026-05-31 when fox brought in Joseph @TrudoJo's procedural-spatial framework — "hashes do not encode the world, hashes determine the world" — and asked whether it fits arborist's substrate model. It does, cleanly. Implements the first verifier kernel under the #000013 v7-W reserved namespace (`arborist/world/__init__.py` `STATUS = "namespace_reserved"` → `kernel_in_progress` on land): a single committed 32-byte SHA-256 hash deterministically expands into six named 32-byte regions `H₁..H₆` via the HMAC-SHA-512 KDF already shipped in `arborist/substrate/anchor_prg.py` (#000035), and each region drives one quantized object dimension under a fixed canonical mapper — `H₁→octree position`, `H₂→scale level`, `H₃→quantized SO(3) rotation`, `H₄→material palette`, `H₅→raw links (reserved for π*_w_relation sibling ticket)`, `H₆→behavior code`. Domain separation from #000035 by dedicated `spatial_anchor_seed` (manifest-published) — keeps #000035's KAT freeze + dav1d 2026-05-11 final review intact. Hard constraints: stays inside A1–A3, no continuous tensors in proof path, no new `audit_mode` token (substrate commitments are not warrants — the four-rung ladder is unchanged), no SQL schema change at Phase 1, `canonicalization_version` absorbs the new `spatial-anchor-object@v1` registry slot. Phase 1 deliverable ~150 LoC + 10 KATs + tests in one PR: `arborist/substrate/spatial_anchor.py` (segmentation), `arborist/world/pi_star/object.py` (six mappers), registry entry, KAT vectors at `bench/fixtures/spatial-anchor/known-answer-tests.jsonl` matching #000035 KAT discipline, `tests/test_spatial_anchor.py` + `tests/test_world_pi_star_object.py`, substrate-paper amendment citing Joseph (@TrudoJo) in `docs/_source/merkle-agi-v7w-spatial-temporal.rst`. Position mapper at Phase 1 = octree (substrate paper §2.1 + §A worked example); H3/S2/Hilbert/Morton siblings deferred — Morton's value is purely as the relation-kernel `pair(A,B)` cheap bit-interleave and surfaces in the sibling ticket. **Ten open questions for dav1d** in §8: seed-source choice, segmentation method, position mapper, scope split (object alone vs object+relation per CLAUDE.md memory `feedback_ticket_proliferation`), privacy-class fail-closed default, `audit_mode` discipline confirmation, manifest-validator timing, endianness reconfirmation, KAT count + adversarial vectors, paper-amendment wording. Five-step §7 deletions captured: dropped the prior `/tmp/arborist-spatial-ontology-plan.md`'s geographic-search backend (encoding-route confusion), `Document.extra` lat/lon hooks (different ticket if at all), `audit_mode=HYBRID` for spatial hits (convention-illegal), geohash (subsumed by Morton), quadtree as separate (octree at z-level-0), Hilbert at Phase 1 (deferred), tier-1/2/3 hash-suite framing (conflated hard vs soft hashes), and `arborist/spatial/` namespace (violates topic-naming rule). Full spec in `docs/tickets/ticket-000070-spatial-anchor-pi-w-object.md`. | 2026-05-31 | — | | #000069 | Arborist VIZ / Merkle Command Center (Pyramid + six.js + SSE browser dashboard) | **open · awaiting go/no-go · doc-only scaffold** (2026-05-27; filed from `/home/fox/Downloads/TICKET_0000VIZ_*`, stack corrected same day per fox). Configurable browser dashboard for inspecting arborist's content-addressed state: Merkle root explorer, proof verifier, claim warrant + graveyard, audit timeline, run-DAG replay, cache-key explainer, root diff, 3D Merkle lattice, optional circuit/activation traces. Read-only consumer; arborist proper stays source-of-truth, dashboard projects state. **Stack pinned to unturf-native** (fox 2026-05-27, supersedes proposal §3): **Pyramid + Jinja2 + SQLAlchemy** (matches `remarkbox` / `make_post_sell` / `unhomeschool.com` idiom), **SSE** (`text/event-stream` via Pyramid streaming response) for live audit/claim/falsifier patches, **vanilla JS + six.js** (fox's patched three.js fork at `git.unturf.com/gumyum/six.js` — three.js r175 + CWE-407 patches incl. ObjectBVH O(N)→O(log N); bundles vendored from `~/git/cupPCB/cdn/six/`; third-instance MOAD-0001 dogfood alongside `java-topology` + gumyum-engine) for 3D widgets and large-graph rendering, SQLite for dashboard metadata (no PostgreSQL/ClickHouse/Redis/NATS by default — promote on measured need), no React / no Next.js / no Node build step. Server-rendered SVG (or Graphviz `.dot` per existing `docs/diagrams/*.dot` pattern) replaces React Flow for run-DAG widgets. Browser-side proof verification dropped from v1 (server-side Pyramid view returns PASS/FAIL + receipt; reinstate phase-N only if third-party-verification use case surfaces). **Three filing-note gates before phase 0** (in ticket body): **F-1** sibling-repo home — implementation lives in a new `~/git/arborist-viz` (Pyramid Python, matches existing unturf apps), not in-tree; arborist's contribution is the read-API spec + view package + arborist library import via `arborist.embed`. **F-2** scope split — proposal carries 8 phases (§17 phases 0–8); recommended cut keeps phases 0–3 (schema + shell + proof/root widgets + claim/audit/run widgets) inside #000069, and spawns sibling tickets for SSE streaming (4), 3D six.js (5), massive-graph (6, only if measured need surfaces), circuit-tracing (7, gated on #000062), embeddable widgets (8) — Dav1d-audience rule. **F-3** upstream prereqs — phase 7 (circuit/activation) consumes **#000062 Mechanistic Witness**'s `MechanisticWitnessRoot`; phase 3's claim-graveyard widget projects **#000059**'s bounded-ingestion graveyard. Hard constraints: arborist soft-vs-hard discipline applies verbatim (attribution weights renderable but never `audit_mode`, never causal without intervention/ablation evidence); private-leaf default-deny (commitments + hashes + redacted maps only without explicit auth); every widget exposes its data query + source roots. Reserved scope: NOT a replacement for `arborist controller-events` / `arborist analyze` / `arborist inspect` CLI — those stay canonical inspector surfaces; VIZ is the projection layer. | 2026-05-27 | — | | #000068 | Verifier-blind missed-answer falsification guard | **in progress · Phase 1+2+3 landed 2026-05-27 · Phase 4 default flip NO-GO** (Phase 2 bench 2026-05-27 76q × n=3 claim_lattice Hermes-3-8B: 2/228 sidecar fires, both STRONG confidence, both the Ballestrini regression fixture, 100% precision, 0/226 false positives across non-Ballestrini runs. Phase 3 demote flag opt-in via `--demote-on-missed-answer` on `query`/`ask` — wires `EVIDENCE-WARRANTED → EVIDENCE-MISSED-PARTIAL` for strong/medium confidence on lattice modes; lower rungs + non-lattice modes get `· missed-answer` tail tag. `answerability_demote_enabled` added to `_VERIFIER_POLICY_FIELDS` so flipping the flag partitions cache via verifier_policy_hash. Default OFF per Dav1d Phase 4 NO-GO — 100% precision at n=2 fires is too few samples to claim precision floor empirically; default flip blocks on wider bench + human spot-check. 47 tests (36 Phase 1 + 11 Phase 3) all passing. End-to-end verified live: 4/4 Hermes runs on Ballestrini with --demote-on-missed-answer rendered EVIDENCE-MISSED-PARTIAL.) Original opening 2026-05-27 (Dav1d de-novo review GO for Phase 1 with seven hardenings folded into spec — subject-token cue-stripping, answer-type alignment, confidence_class, candidate cap=10, precise offset_start/end/basis, cache-hit recompute-on-read, Phase 1 out of verifier_policy_hash). Original opening 2026-05-27; sibling to the user-payload-layout work shipped 2026-05-26, split out per the Dav1d-audience rule — `feedback_ticket_proliferation`). Surfaced by the Ballestrini case: evidence E2 literally contained the song names, Hermes-3-8B under `user_payload_layout=tail` said *"specific songs by her are not mentioned in the provided evidence blocks"*, verifier marked the run `EVIDENCE-WARRANTED` 2/2 because nothing positive was unsupported. **Verifier-blind false-negative class** — existing layered verifier (quote/span/entity/paraphrase + Rule 8 + Rule 9 + claim ceiling) guards unsupported *presence*, has no hook for unsupported *absence*. Layout fixes attention placement on the specific instance (n=3 bench 2026-05-27 confirms bookend/per_chunk recover Ballestrini); layout alone can't close the class — adversarial phrasing or bigger prompt resurfaces it under any layout. Proposed deterministic sidecar in `arborist/qa/inspect.py:diagnose_missed_answer`: three-clause conjunction — **(A)** answer matches denial pattern ("not mentioned", "not provided", "the evidence does not say", …, closed list versioned via `denial_patterns_version`); **(B)** question is extraction shape (reuse `arborist.qa.quantifier` classifier — `ALL`/`COMPREHENSIVE`/`OPEN_REQUEST` intensities, OR surface cues "songs by"/"works by"/"who wrote"/"list"/"name all"); **(C)** evidence contains candidate spans near subject tokens (reuse `entity_proximity_n`/`entity_proximity_window` from verify.py — quoted strings, title-case spans, comma-separated title lists within W chars of stemmed subject content tokens). All three must fire. Output: `result["answerability"]` with `missed_answer_candidate_spans` list (evidence_id + offset + text). **Hash discipline:** sidecar fields (`denial_patterns_version`, `extraction_cues_version`, `answerability_threshold`) fold into `governance_policy_hash` only; an optional `answerability_demote_enabled` flag (default OFF) wires `EVIDENCE-WARRANTED → EVIDENCE-MISSED-PARTIAL` in `_render_audit_label`, and IF on folds into BOTH `governance_policy_hash` AND `verifier_policy_hash` (changes rendered audit_mode, so verifier hash must move — the deliberate opt-in moves the verifier hash, sidecar-only stays out). No LLM-as-judge. Never writes `providence_cache`/`audit_events`. Never promotes claims. Pattern verbatim from `arborist.qa.inspect.diagnose_*` (deflection, coherence, title-relevance). Phases: 1 sidecar read-only, 2 bench + threshold tuning, 3 demote opt-in, 4 default decision (bench-gated). 5F-Falsification fixture: Ballestrini case already in `bench/qa_questions.txt` under "entity list". Full spec in `docs/tickets/ticket-000068-verifier-blind-missed-answer-guard.md`. | 2026-05-27 | D2 | | #000067 | M-aware cold-pack hydration (route incoming docs by content hash into M target shards) | **open · scaffold · prereq for #46 genesis test** (2026-05-26; surfaced while preparing the 3090 SPV-wallet validation). Today's `hydrate_from_metadata_pack` takes a single `conn` and writes every incoming row into one shard. With the corpus now in M=4 hash-routed topology (#000065), a fresh peer needs to land each document on `shard_for_document(document_root, M)` — same routing function as the producer. Without this, a fresh peer's `~/.arborist/shards/` is just one big single-shard DB and the M=4 ATTACH-and-route assumption #000065 was sized for doesn't hold consumer-side. Two coherent shapes: **(α) two-step kludge** — hydrate into single shard, then `arborist corpus reshard --to M` on the consumer. Works today (proven by the 2026-05-26 reshard executor) but doubles the wall time and treats packed shards as if they came from an arbitrary topology. **(β) direct M-aware hydrate** — extend `hydrate_from_metadata_pack` to accept `targets: list[sqlite3.Connection]` + `M: int` and route per-row at restore time (reusing `arborist.document.shard_for_document` + the table-routing rules in `arborist/migrate.py`). Manifest carries `corpus_shard_count` so the unpacker knows M from the pack itself. β is the right answer — α exists only as a fallback if 20-min-window pressure forces it. Sequence: (1) add `corpus_shard_count` to pack manifest (read from source meta during `dump_shard_metadata`); (2) `restore_shard_metadata_routed(targets, M, table_dir)` in `cold_pack_metadata.py` mirroring `_route_per_doc_table` from migrate.py; (3) `hydrate_from_metadata_pack` gains a `targets`/`shards_dir` param; (4) `arborist cold unpack --shards-dir DIR` initialises M target shards from the manifest's `corpus_shard_count` and routes; (5) regression test: pack 2 shards → hydrate into fresh 4 shards → assert every doc on its hash-routed target. Refactor opportunity: the routing rules (ROUTED_BY_DOCUMENT_ROOT, CONSOLIDATED_TABLES) currently live in migrate.py; this ticket can either duplicate them in cold_pack_metadata.py (fast) or factor into a shared `arborist/multi_shard.py` module (cleaner). The shared-module path is more honest given graft mode (#000066) wants the same primitives. Out of scope: graft / overlay mode (that's #000066 — overlays onto populated, this is hydrate-into-empty). | 2026-05-26 | — | diff --git a/docs/tickets/ticket-000070-spatial-anchor-pi-w-object.md b/docs/tickets/ticket-000070-spatial-anchor-pi-w-object.md index 3378d76..15c9aab 100644 --- a/docs/tickets/ticket-000070-spatial-anchor-pi-w-object.md +++ b/docs/tickets/ticket-000070-spatial-anchor-pi-w-object.md @@ -1,978 +1,498 @@ # Ticket #000070 — AnchorN + π*_w_object: deterministic world-object canonicalization -**Status:** open · **dav1d GO with rewrite (2026-06-01)** · spec -revision pending before any kernel ships. Pre-review empirical bench -(`bench/spatial_anchor_validation.py`, commit `55b651f`) already on -disk; no implementation kernel started (only the namespace stub at -`arborist/world/__init__.py` exists, `STATUS = "namespace_reserved"`). -**Original title kept in the design log:** "Spatial-anchor π*_w_object -(Joseph 6-dim determination kernel)". §0 below carries the corrected -spec; §§1-8 preserve the ORIGINAL Anchor6 proposal as the historical -record of what was reviewed. +**Status:** open · Phase 1 deliverable scoped · dav1d GO-with-rewrite +landed 2026-06-01 (full review at +`docs/dav1d-reviews/000070-spatial-anchor-pi-w-object--2026-06-01.txt`). **Opened:** 2026-05-31 -**Scope:** Pin the operational spec for **π*_w_object** — the first -verifier kernel of v7-W. Implements **Joseph (@TrudoJo)**'s 6-dimension -procedural-anchor framework: a single committed 32-byte SHA-256 hash -deterministically expands into six named regions `H₁..H₆` via the -HMAC-SHA-512 KDF already shipped in `arborist/substrate/anchor_prg.py` -(#000035), and each region drives one quantized object dimension under -a fixed canonical mapper. This ticket lands segmentation + position -mapper + registry slot + KATs. Relation / event / place / agent_trace -kernels land as siblings under #000013. -**Audience:** dav1d (primary review), v7-W substrate-paper maintainers, -Joseph (@TrudoJo, original framework author), #000013 follow-up, -#000035 follow-up. -**Hard constraint:** -- Stays inside A1–A3 (canonical encoding, public quantization, - collision-resistant hash). No new axiom. -- π*_w on **quantized integer state** only; continuous floats do not - enter the proof path (v7-W manifest hard rule, paper §1.2). -- Hard-hash family stays SHA-256 commit + HMAC-SHA-512 expansion. +## Goal + +Implement the first executable v7-W world-object canonicalization +kernel. The kernel takes: + +``` +hard_hash_32 one committed 32-byte SHA-256 +spatial_anchor_seed v7-W manifest-published, dedicated +WorldDimensionGrammar frozen grammar declaring N + N mappers +world_manifest privacy class, axiom pack, version pins +``` + +and produces: + +``` +canonical_world_object_bytes deterministic byte string +world_object_hash SHA-256(canonical bytes) +object_record grammar_hash + axiom_pack_hash + + manifest_hash + seed_hash + per-dim values +``` + +A single committed hash deterministically expands into N named regions +via the HMAC-SHA-512 KDF already shipped in +`arborist/substrate/anchor_prg.py` (#000035). Each region drives one +quantized dimension under a registered mapper. **N is grammar-decided, +not hard-coded.** + +## Axis split (cross-ref #000071) + +``` +#000070 intra-world state instantiation + AnchorN + WorldDimensionGrammar + AxiomPack + Manifest → + canonical world-state records + +#000071 inter-world treaty grammar + two chains decide whether commitments cross the gap → + agreement | translation | embassy | quarantine | no_bridge +``` + +Joseph6 (six-dimension Joseph @TrudoJo framework) is the **first +registered default grammar**, not THE substrate ontology. See §5. + +## Hard constraints + +- **A1–A3 axioms.** Canonical encoding · public quantization for + proof-path state · collision-resistant hash. No new axiom. +- **Quantized integer state only.** Continuous floats do not enter + the proof path (v7-W manifest hard rule, paper §1.2). Mappers + emit integers; any continuous-domain math (e.g. Euler rotation) + quantizes deterministically before commitment. +- **Hard-hash family stays SHA-256 commit + HMAC-SHA-512 expansion.** Soft locality indices (Morton / H3 / S2 / Hilbert / geohash) live **outside** the proof path per CLAUDE.md soft-hash rule. - **Domain separation from #000035.** A NEW seed `spatial_anchor_seed` is published in the v7-W manifest beside `anchor_prg_seed`; #000035 §2.4 "single-purpose — never reuse `anchor_prg_seed`" is honored without a `PHI_PRG_VERSION` bump. -- **No new `audit_mode` token.** CLAUDE.md: `audit_mode` is decided - by the verifier, never asserted. π*_w_object emits commitments, +- **No new `audit_mode` token.** π*_w_object emits commitments, not warrants. The four-rung ladder (POINTER-LINKED → ANCHOR-WARRANTED → EVIDENCE-WARRANTED → ENTAILMENT-VERIFIED) is - not extended by Phase 1. -- **Schema column-unchanged.** A new `pi_star/spatial-anchor@v1` + not extended. +- **No SQL at Phase 1.** A new `pi_star/spatial-anchor-object@v1` registry entry folds into `canonicalization_version` (one of the - v9.8 8-dim cache_key dimensions). No new SQL table required for - Phase 1; persistence to a `world_state_cells` table is deferred. -- Topic-named, not version-prefixed (CLAUDE.md naming rule). Lands - under `arborist/world/pi_star/`, not `arborist/v7w/` or - `arborist/spatial/`. + v9.8 8-dim cache_key dimensions). Persistence to a + `world_state_cells` table is deferred to Phase 3. +- **Privacy fail-closed.** Missing `privacy.class` in the manifest + is a HARD reject — no PUBLIC fallback. +- **Grammars must be FROZEN before proof-path use.** Axioms MAY + *select* a grammar (LLM may *propose* candidates), only + deterministic validators may *accept* them. Accepted grammars + are canonicalized, hashed, KAT-tested, versioned. `grammar_hash` + binds into every downstream commitment. +- **Topic-named, not version-prefixed** (CLAUDE.md naming rule). + Lands under `arborist/world/` and `arborist/pi_star/`, not + `arborist/v7w/` or `arborist/spatial/`. --- -## 0. Dav1d review verdict (2026-06-01) — GO with rewrite +## 1. AnchorN — the substrate primitive -Full review at `docs/dav1d-reviews/000070-spatial-anchor-pi-w-object--2026-06-01.txt` -(1904 lines). Headlines below; §§1-8 stay unchanged as the design log -of the original Anchor6 proposal that was reviewed. - -### 0.1 Verdict matrix - -| | | | -|---|---|---| -| ✅ GO | generic **AnchorN** substrate primitive | not fixed Anchor6 | -| ✅ GO | **Joseph6** as the first registered default grammar | not THE ontology | -| ✅ GO | deterministic object-state canonicalization | the actual Phase 1 win | -| ✅ GO | axiom/physics-loaded `WorldDimensionGrammar` | the scalable path | -| ❌ NO-GO | hard-coding H₁..H₆ as final ontology | freezes the substrate | -| ❌ NO-GO | runtime LLM-decided dimensionality | breaks reproducibility | -| ❌ NO-GO | framing this as a "semantic verifier warrant" | commitments ≠ warrants | -| ❌ NO-GO | relation/event/place/agent_trace inside this ticket | scope-creep | -| ❌ NO-GO | SQL persistence in Phase 1 | namespace-reserved kernel only | - -### 0.2 Architectural reframe - -Replace the fixed Anchor6 primitive with **generic AnchorN** driven -by a frozen `WorldDimensionGrammar`. The grammar is a deterministic -manifest declaring N and the N region→mapper bindings. Joseph6 -becomes a *named* grammar instance (`name="joseph6", version="v1"`), -not THE substrate. - -**Critical correction on the "axioms decide N" intuition:** - - - Axioms MAY *select* the grammar (LLM may *propose* candidates). - - Only *deterministic validators* may accept them. - - Accepted grammars are canonicalized, hashed, KAT-tested, versioned. - - **Grammars must be FROZEN before proof-path use** — `grammar_hash` - folds into the manifest. Runtime LLM dimensionality is the - failure mode dav1d explicitly NO-GOs. - -### 0.3 Technical corrections (load-bearing) - - - **§16 — H₁ MUST use uint256, not uint64.** The original - `map_octree_position()` truncation loses entropy at depth >8 - octants. uint256 preserves the full 32-byte region. Same lesson - propagates to the other quantized dimensions. - - **§17 — Do NOT overclaim SO(3) on rotation.** The original spec - called H₃ a "quantized SO(3)" mapper; dav1d notes this is a - quantized Euler ypr triple — name it `map_rotation_euler_ypr()` - so consumers don't assume continuous SO(3) coverage. - - **§18 — Canonical object output shape:** the record carries - `grammar_hash`, `axiom_pack_hash`, `manifest_hash`, `seed_hash` - alongside the per-dimension quantized values. All four hashes - are required for replayability across grammar versions. - - **§19 — Privacy fail-closed:** missing `privacy.class` in - manifest = HARD reject (don't fall back to PUBLIC). - - **§20 — Hash/cache discipline:** spatial-anchor-object@v1 folds - into `canonicalization_version` only; no new `audit_mode` token, - no `verifier_policy_hash` bump. - -### 0.4 Corrected package layout (was §13 of the review) - -``` -arborist/substrate/spatial_anchor.py - AnchorN - split_anchor_n() - SPATIAL_ANCHOR_VERSION - PLACEHOLDER_SPATIAL_SEED - -arborist/world/grammar.py (NEW) - WorldDimensionGrammar - canonical_grammar_bytes() - grammar_hash() - validate_grammar() - -arborist/world/pi_star/object.py - derive_world_object_record() - map_octree_position() # uint256 — see §16 - map_scale_level() - map_rotation_euler_ypr() # not "SO(3)" — see §17 - map_symbol_table_index() - map_passthrough_hex() - -arborist/pi_star/spatial_anchor_object.py (NEW) - registered π* adapter - name = "spatial-anchor-object" - version = "v1" - canonicalize(raw: bytes) -> bytes - -bench/fixtures/spatial-anchor-object/known-answer-tests.jsonl -tests/test_spatial_anchor.py -tests/test_world_dimension_grammar.py -tests/test_pi_star_spatial_anchor_object.py -``` - -The split moves **registry-facing canonicalization** to -`arborist/pi_star/` and keeps **v7-W domain logic** under -`arborist/world/`. AnchorN itself stays substrate-level alongside -`anchor_prg.py` since it's the generic key-derivation primitive. - -### 0.5 Phase 1 deliverable (corrected) - -``` -1. generic split_anchor_n() — substrate, hash-pinned -2. Joseph6 grammar instance — frozen, KAT-tested -3. π*_w_object canonicalizer — registry slot -4. KATs at bench/fixtures/spatial-anchor-object/known-answer-tests.jsonl -5. Tests (3 modules above) -6. Substrate-paper amendment citing Joseph (@TrudoJo) -7. NO SQL -8. NO new audit_mode -9. NO verifier_policy_hash change -``` - -### 0.6 Relationship to #000071 (cross-ref) - -Dav1d §22 confirms #000071 (world-bridge grammar) is the right -sibling: bridges connect different `WorldDimensionGrammar` instances -across chains. AnchorN + grammar identity is what the bridge layer -identifies; without grammar-as-first-class-object, bridges have -nothing to anchor. - -### 0.7 Five dav1d open-questions answered by measurement, five still open - -§7a of this ticket already cited the pre-review empirical bench -(`bench/spatial_anchor_validation.py`) resolving five of the ten -original open questions (Q1 seed source / Q2 segmentation / Q3 -octree mapper / Q8 endianness / Q9 KAT adversarial vectors). The -review preserves those resolutions and reframes Q4/Q5/Q6/Q7/Q10: - - - **Q4 scope split** — answered: object alone, NO relation/event/ - place/agent_trace in this ticket. AnchorN handles N=6+ kernels - in future tickets. - - **Q5 privacy fail-closed default** — answered: HARD reject on - missing `privacy.class`. - - **Q6 `audit_mode` discipline** — answered: spatial commits are - not warrants, no new token. - - **Q7 manifest-validator timing** — defer to grammar validation - step in `arborist/world/grammar.py:validate_grammar()`. - - **Q10 paper-amendment wording** — still open; substrate paper - text needs revision to introduce AnchorN + grammar layer - instead of fixed Anchor6. - -### 0.8 What changes for the implementer - -The original §3 "Recommendation" + §4 "Implementation sketch" name -specific functions (`segment_anchor()`, fixed-6-region split, etc.). -Those stay in the design log as reference; **what actually ships -follows §0.4 above** — `split_anchor_n()` with grammar-driven N, -`WorldDimensionGrammar` class, registry-addressable π* adapter. - -The original §7a empirical bench remains valid as evidence — it -validated the HMAC-SHA-512 expansion's avalanche / uniformity / -domain-separation properties, which are unchanged by the AnchorN -generalization (N just changes the loop count; the per-region -properties measured stay identical). - ---- - -## 1. Problem statement *(original design log — what was reviewed)* - -### 1.1 What #000013 left undefined - -#000013 closed 2026-05-09 doc-only — substrate paper at -`docs/_source/merkle-agi-v7w-spatial-temporal.rst` (658 lines) plus -the frontier catalog at `docs/v7w-frontier-catalog.md` plus the -namespace stub at `arborist/world/__init__.py` (`STATUS = -"namespace_reserved"`). The substrate paper §1.1 names five -world-state object kinds: - -``` -- objects: { id, class, bbox, pose, confidence } -- relations: { subject_id, predicate, object_id, time_window } -- events: { type, t_start, t_end, participants, place } -- places: { id, frame_of_reference, geometry, parent_place } -- agents: { id, position_trace, pose_trace, attention_trace } -``` - -§2.1 specifies the **discretization grammar** (octree / S2 / quadtree -with hierarchical levels declared by the deployment manifest). §2.3 -specifies the **frame discipline** (frame_id = SHA-256 of canonical -frame definition; transforms committed). The paper §A worked example -walks a 10×10×3 m room with an octree manifest. What the paper does -**not** specify operationally is the function - -``` -H : 32-byte SHA-256 commitment → object record -``` - -— how a *single anchor hash* determines an object. The paper treats -π*_w as an encoder of observations produced by an exogenous -world-model engine (SLAM, Gaussian splatting, predictive video). That -is the *encoding* model: object → bytes → hash. - -### 1.2 Joseph's framework — determination model - -2026-05-31 fox brought in Joseph (@TrudoJo)'s framework. Verbatim -core distinction: - -> **Hashes do not encode the world. Hashes determine the world.** -> The hash is not a message. It is a fixed generative coordinate. -> Object identity = determined by its own hash. Object expression = -> determined by the hash plus its surrounding hashes. - -Operational spec: a single anchor hash splits into six stable regions -and each region drives one object dimension via a fixed deterministic -mapper. - -``` -H = 9f3a...c71b -H₁ → position -H₂ → scale -H₃ → rotation -H₄ → material -H₅ → relation / links -H₆ → behavior / motion - -object.position = map(H₁) -object.scale = map(H₂) -object.rotation = map(H₃) -object.material = map(H₄) -object.links = map(H₅) -object.motion = map(H₆) - -same hash + same rule-field = same object every time -``` - -Joseph's "necessary rule" (verbatim): the system must fix **hash -algorithm, hash length, byte order, segmentation method, pairing -method, ordering rule, mapping functions, world version, collision -policy**. Otherwise the same hashes generate different worlds under -different interpreters. - -### 1.3 Why this fits arborist's substrate model - -Cross-checked against ground truth on 2026-05-31: - -| Joseph spec requirement | Arborist primitive that fulfills it | -|---|---| -| `hash → rule-field → object` (determination) | `arborist/substrate/anchor_prg.py` `_expand()` — counter-mode HMAC-SHA-512 KDF, 193 LoC, KAT-frozen #000035 | -| Fixed hash algo + length | SHA-256 (`arborist/merkle.py:24-40`, `LEAF_PREFIX=0x00`, `NODE_PREFIX=0x03`, 32-byte output) | -| Fixed byte order | Little-endian throughout (v7 §A1; `PHI_PRG_VERSION = "phi-prg-v1-hmac-sha512-le"`) | -| World version (different interpreters ≠ different worlds) | v9.8 8-dim `cache_key` — `governance_policy_hash` + `canonicalization_version` + `schema_version` + `chunking_version`; bump any dim → prior worlds invalidated on lookup | -| Mapping functions | `arborist/pi_star/registry.py` — `register(pi_star: PiStar)` API; one slot per canonical projection (existing slots: `arithmetic@v1`, `logic-kernel@v1`, `algebra-symbolic@v1`, `claim-lattice@v1`, …) | -| Object identity (H alone) | π*_w_object — this ticket | -| Object expression (H in field) | π*_w_relation — sibling ticket | -| Hash + grammar (joint canonicalization) | governance_policy_hash absorbs grammar changes; bumping registry version stales worlds | - -Joseph's framework supplies the **operational layer** the substrate -paper deferred. Without it, `world/` stays a namespace stub. With it, -`world/pi_star/object.py` becomes the first verifier kernel and the -v7-W substrate moves from `namespace_reserved` to -`kernel_in_progress`. - -### 1.4 Encoding vs determination — both compose - -Important: arborist's existing merkle commits are *encoding* (object -→ canonical bytes → SHA-256 root). Merkle proofs verify "this object -hashed to this root." Joseph's framework is *determination* (hash → -grammar → object). A determination "proof" verifies "given this seed, -grammar, and hash, the object **must** be this." - -These compose. Encoding gives commitment (un-forgeable post-hoc). -Determination gives reproducibility (every interpreter agrees on the -object). For π*_w_object both hold: the SHA-256 hard hash is the -commitment surface (encoding), and the HMAC-SHA-512 expansion plus -six mappers is the determination grammar. This is the same shape as -verifiable random functions in cryptography; it is the same shape as -v7 §9.10 φ_PRG already shipped. - -## 2. Design choices - -### 2.1 Seed source — dedicated `spatial_anchor_seed` vs domain-tag bump - -**A. Dedicated `spatial_anchor_seed` in the v7-W manifest (recommended).** - -Publish a second 32-byte seed beside `anchor_prg_seed`. `_expand()` -from `arborist/substrate/anchor_prg.py` is reused as-is with the new -seed. No `PHI_PRG_VERSION` bump. - -- **Strength:** respects #000035 §2.4 single-purpose rule exactly. No - PRF-security regression. dav1d's 2026-05-11 #000035 final review - stays valid. -- **Cost:** manifest gains one field. Rotation policy stays at the - v7-W manifest layer. - -**B. Domain-tag input under bumped `PHI_PRG_VERSION`.** - -Bump to `phi-prg-v2-hmac-sha512-le-dst` and add a 4-byte -little-endian domain tag (e.g. `0x77_77_5f_53` = ASCII `"w_S"`) into -the KDF input: `HMAC(seed, hard_hash || domain_tag || counter)`. -Reuses `anchor_prg_seed`. - -- **Strength:** cleaner cryptographic story — true domain separation - by tag rather than by seed independence. -- **Cost:** spec churn. #000035 just KAT-froze (10 KATs at - `bench/fixtures/phi-prg/known-answer-tests.jsonl`). Bumping forces - regeneration for every v7 anchor-map consumer and invalidates - dav1d's 2026-05-11 review. - -**Recommendation: A.** Smaller blast radius; orthogonal to #000035's -frozen surface. - -### 2.2 Region segmentation — fixed offsets vs per-region nested HMAC - -**A. Fixed-offset slicing (recommended).** - -Compute `_expand(spatial_anchor_seed, hard_hash_32, 192)` → 192 bytes -→ six 32-byte regions at byte offsets `[0,32), [32,64), …, -[160,192)`. Three HMAC-SHA-512 blocks (64 B each) cover the 192-byte -output exactly. - -- **Strength:** trivial; KAT-able; deterministic; reuses #000035's - counter-mode discipline byte-for-byte. -- **PRF independence argument:** counter-mode HMAC-SHA-512 blocks are - computationally independent under the standard SHA-512 + HMAC - assumption — the same argument #000035 §2.1 used to bound the - channel. Slicing the concatenation does not weaken independence. - -**B. Per-region nested HMAC.** - -For each region, `H_i = HMAC-SHA-512(spatial_anchor_seed, hard_hash_32 -|| i_le_u32)[:32]` with `i ∈ {1..6}`. - -- **Strength:** textbook tree-PRF; per-region independence by - construction. -- **Cost:** 6× HMAC calls vs 3× in A. Negligible at v7-W cadence but - pointlessly more code. - -**Recommendation: A.** - -### 2.3 Spatial coordinate output per dimension - -Each region's mapper consumes 32 bytes and emits a canonical integer -cell. Per-dimension choice: - -| `H_i` | Dimension | Mapper output | Rationale | -|------|----------|---------------|-----------| -| `H₁` | position | **octree cell at manifest-declared level `L`** — read `H₁[0:8]` as little-endian uint64, modulo `8**L`, descend bit-by-bit to canonical `cell_id` | Substrate paper §2.1 explicitly recommends octree for object-fixed local frames; §A worked example uses octree with `level_max=18` | -| `H₂` | scale | **level integer** in `[level_min, level_max]` — read `H₂[0]` as uint8, modulo `(level_max - level_min + 1)`, offset by `level_min` | Manifest-declared range; uniform modulo across declared levels | -| `H₃` | rotation | **quantized SO(3) cell** — read `H₃[0:12]` as three LE uint32, normalize to integer-quaternion grid of step `Δ_rot ≥ 1 mrad` | Paper §A ε budget `Δ_rot ≈ 1 mrad` | -| `H₄` | material | **palette index** — read `H₄[0:4]` as LE uint32, modulo manifest-declared palette size | Deployment-specific | -| `H₅` | links / relation seed | **opaque 32 bytes carried through** as raw input to the relation kernel (sibling ticket) | Phase boundary — relation kernel canonicalizes the `pair(A,B) → relation-seed` operator | -| `H₆` | behavior / motion | **behavior code** — read `H₆[0:4]` as LE uint32, modulo manifest-declared behavior-table size | Deployment-specific | - -`H₅` deliberately stays raw — Joseph's `pair(A, B) → relation-seed` -operator consumes raw bytes from both anchors. Canonicalizing `H₅` -here would foreclose the relation kernel's design space. - -**Why octree and not Morton / H3 / S2 / Hilbert at Phase 1.** The -substrate paper §2.1 names octree for object-fixed frames as the -primary recommendation; the §A worked example uses octree. Picking -one mapper at Phase 1 keeps KAT scope tractable. Geographic / -planetary deployments register `spatial-anchor-s2@v1` later; -image-plane / 2D-floor deployments register -`spatial-anchor-quadtree@v1`; pairwise-locality deployments register -`spatial-anchor-hilbert@v1`. All siblings, all under #000013. -Morton's value is purely as a cheap bit-interleave for the relation -kernel's `pair(A,B)` operator and surfaces there, not here. - -### 2.4 Scope: does this ticket also land π*_w_relation? - -Joseph's framework treats object and relation as a tightly coupled -pair: identity from a single hash, expression from pairs. CLAUDE.md -memory: "don't proliferate tickets — prefer extending existing." - -**A. Single ticket lands object + relation.** -- Smaller cross-reference graph; one dav1d-review pass covers the - full identity+expression substrate. -- Larger review surface (~300 LoC + 20 KATs vs ~150 + 10). - -**B. Sibling ticket for relation (recommended pending fox call).** -- Object kernel ships and can be benched independently before - relation canonicalization is pinned. -- Relation introduces the `pair(A,B)` canonicalization choice - (symmetric `min || max` vs ordered) — that's a distinct - architectural decision dav1d will want to review on its own - surface. -- #000049 and #000048 split similarly when NLI introduced a fresh - audit_mode question; this is the same shape. - -**fox call requested. Open question #4 below.** - -### 2.5 Privacy class — fail-closed manifest declaration - -v7-W paper §6 requires the deployment manifest to declare its -privacy class: - -```json -{"privacy": {"class": "public | aggregated_only | ZK_with_selective_disclosure"}} -``` - -The §A worked example defaults to `"public"`. - -**A. Phase 1 requires explicit declaration (recommended).** Manifest -loader raises if `privacy.class` is missing. - -- **Strength:** fail-closed (CLAUDE.md guardrail). Anyone shipping a - non-public deployment cannot accidentally omit the class. -- **Cost:** worked example manifests must be edited to declare - `"public"` explicitly — trivial. - -**B. Default to `"public"` if absent.** - -- **Strength:** matches the paper §A example shape. -- **Risk:** a downstream operator forgets to declare; deployment - ships exposing positions. Surveillance risk per paper §6. - -**Recommendation: A.** Fail-closed beats convenience. - -### 2.6 `audit_mode` discipline — commitments are not warrants - -CLAUDE.md: "`audit_mode` is decided by the verifier, never -asserted." A spatial-anchor-derived object is **not** evidence for a -spatial claim. It is a commitment that "given THIS seed + grammar + -hash, THIS is the object." The verifier discipline (quote / span / -entity / paraphrase) is unchanged by Phase 1. - -If a downstream consumer wants to use spatial commitments as -warrants for spatial claims, that requires a new verifier method -(`spatial_commitment`) — separate ticket, separate -`verifier_policy_hash` impact, **not in scope here**. The four-rung -ladder (POINTER-LINKED → ANCHOR-WARRANTED → EVIDENCE-WARRANTED → -ENTAILMENT-VERIFIED reserved) is not extended by Phase 1. - -This is the single most important conceptual discipline of this -ticket. The prior `/tmp/arborist-spatial-ontology-plan.md` proposed -"hits carry `audit_mode=HYBRID`" — convention-illegal, rejected. - -### 2.7 Manifest schema — declared or coded? - -`world/manifest.py` is not in Phase 1 scope. Phase 1 accepts a -Python `dict` matching the paper §A shape and reads its `grid`, -`frames`, `materials`, `behaviors`, `privacy` fields. A JSON-Schema -validator + canonical-bytes serializer lands as a separate ticket -under #000013. - -**Open question #8 below** — is "manifest-as-dict, no validator" an -acceptable Phase 1 contract, or does the validator have to land -together? - -### 2.8 Endianness - -Little-endian throughout, matching v7 §A1 / #000035. The Phase 1 -mapper reads bytes as LE uint8 / uint32 / uint64 for `H₁`, `H₂`, -`H₃`, `H₄`, `H₆`. Big-endian readers would be a #000035-style -silent-divergence defect. - -## 3. Recommendation - -**Phase 1 deliverable** — ship the segmentation + position kernel -under one PR: - -1. **`arborist/substrate/spatial_anchor.py`** — module wrapping - `_expand` from `anchor_prg.py`. Constants: - - `SPATIAL_ANCHOR_VERSION = "spatial-anchor-v1-hmac-sha512-le"` - - `PLACEHOLDER_SPATIAL_SEED: bytes` — 32 bytes, SHA-256 of fixed - string for test reproducibility, NOT a security claim, matching - `anchor_prg.PLACEHOLDER_SEED` discipline - - `class Anchor6(NamedTuple)` — six 32-byte regions - - `def split_anchor(hard_hash_32, *, seed) -> Anchor6` -2. **`arborist/world/pi_star/object.py`** — six `_map_*` functions - per §2.3 table. Public callable - `pi_star_w_object(hard_hash_32, manifest, *, seed) -> ObjectRecord`. -3. **`arborist/world/pi_star/__init__.py`** — package marker. -4. **`arborist/pi_star/registry.py` registration** — - `spatial-anchor-object@v1` registered via `register(pi_star)`. - The version string folds into `canonicalization_version` - (CLAUDE.md schema invariant). -5. **KAT vectors** at - `bench/fixtures/spatial-anchor/known-answer-tests.jsonl` — 10 - vectors, matching the #000035 §3.4 KAT discipline. Each vector - pins `(seed_hex, hard_hash_hex, manifest_canonical_bytes_hex, - octree_cell_id, scale_level, rotation_cell_tuple, - material_index, links_blob_hex, behavior_code)`. -6. **Tests**: - - `tests/test_spatial_anchor.py` — `split_anchor` shape, - deterministic, domain separation from `anchor_prg` - (`split_anchor(H, seed=S1) ≠ phi_prg(H, …, seed=S1)` outputs), - bool-reject + size-reject mirroring `phi_prg`, KAT replay. - - `tests/test_world_pi_star_object.py` — per-mapper KAT replay, - manifest validation (missing privacy class → raise; missing - grid → raise; out-of-range level → raise), determinism under - dict ordering. -7. **AUTOCOUNT discipline** — wrap any numeric claim added to docs - (test count, KAT count) per `docs/tickets/ticket-000044-*`. - -**Phase 2 (separate ticket per §2.4 recommendation B)** — -π*_w_relation consuming `H₅` from two anchors. Canonicalization -decision: lexicographic `min(A,B) || max(A,B)` for symmetric -predicates; ordered for directed. Pinned by -`relation_canonicalization_version`. - -**Phase 3 (separate ticket)** — `world/frontier/{pose_integration, -observation_update, object_logits, relation_logits}.py` per paper -Part 4. - -**Phase 4 (separate ticket)** — `world/manifest.py` JSON-Schema -validator + canonical-bytes serializer. - -**Phase 5 (separate ticket)** — SQL persistence layer: -`world_state_cells` table or `edges` extension; folds into -`schema_version` bump (stales prior records — must be batched with -other v9.x → v9.y migrations). - -## 4. Implementation sketch +`AnchorN` is the generic key-derivation primitive. Given a hard hash +and a frozen grammar declaring N regions, it expands the hash into N +named 32-byte regions via HMAC-SHA-512 counter mode. ```python -# arborist/substrate/spatial_anchor.py -"""π*_w_object six-region anchor segmentation (Joseph @TrudoJo framework). - -Splits a committed 32-byte SHA-256 hash into six named 32-byte regions -using HMAC-SHA-512 counter-mode KDF (reuses ``anchor_prg._expand`` from -#000035). Domain separation from #000035 is by **seed**: a dedicated -``spatial_anchor_seed`` is published in the v7-W manifest beside -``anchor_prg_seed``; never reuse one for the other. -""" - -from __future__ import annotations - -import hashlib -from typing import NamedTuple - -from arborist.substrate.anchor_prg import _expand - -SPATIAL_ANCHOR_VERSION = "spatial-anchor-v1-hmac-sha512-le" - -# Test placeholder; v7-W deployment manifest publishes the real seed. -PLACEHOLDER_SPATIAL_SEED: bytes = hashlib.sha256( - b"arborist v7-w spatial_anchor placeholder seed -- ticket #000070" -).digest() - -# 6 regions × 32 bytes; HMAC-SHA-512 produces 64-byte blocks → 3 blocks. -_REGION_BYTES = 32 -_TOTAL_BYTES = 6 * _REGION_BYTES # 192 +@dataclass(frozen=True) +class AnchorN: + hard_hash: bytes # 32 bytes (SHA-256 of source) + seed: bytes # spatial_anchor_seed from manifest + grammar_hash: bytes # binds region identities to a grammar + regions: tuple[bytes, ...] # N × 32 bytes -class Anchor6(NamedTuple): - h1_position: bytes # 32 B → octree cell id - h2_scale: bytes # 32 B → manifest grid level - h3_rotation: bytes # 32 B → quantized SO(3) cell - h4_material: bytes # 32 B → palette index - h5_links: bytes # 32 B → raw, consumed by π*_w_relation - h6_behavior: bytes # 32 B → manifest behavior code - - -def split_anchor( - hard_hash_32: bytes, - *, - seed: bytes = PLACEHOLDER_SPATIAL_SEED, -) -> Anchor6: - """Determine the six-region anchor for a committed object hash. - - Same hash + same seed = same anchor every time, by HMAC-SHA-512 - PRF property under the standard SHA-512 + HMAC assumption. - """ - if not isinstance(hard_hash_32, (bytes, bytearray)) or len(hard_hash_32) != 32: - raise ValueError( - "hard_hash_32 must be exactly 32 bytes (SHA-256 output)" - ) - if not isinstance(seed, (bytes, bytearray)) or len(seed) != 32: - raise ValueError("seed must be exactly 32 bytes") - raw = _expand(bytes(seed), bytes(hard_hash_32), _TOTAL_BYTES) - return Anchor6( - h1_position=raw[0:32], - h2_scale=raw[32:64], - h3_rotation=raw[64:96], - h4_material=raw[96:128], - h5_links=raw[128:160], - h6_behavior=raw[160:192], - ) - - -__all__ = ["Anchor6", "split_anchor", "SPATIAL_ANCHOR_VERSION", - "PLACEHOLDER_SPATIAL_SEED"] -``` - -```python -# arborist/world/pi_star/object.py -"""π*_w_object — Joseph 6-dim object kernel (#000070). - -Composes ``split_anchor`` (#000070 §3) with six per-dimension mappers -to emit a canonical integer ObjectRecord. Output is content-addressable -under (seed, hard_hash_32, manifest_canonical_bytes). -""" - -from __future__ import annotations - -from typing import TypedDict - -from arborist.substrate.spatial_anchor import Anchor6, split_anchor - -PI_STAR_OBJECT_VERSION = "spatial-anchor-object-v1" - - -class ObjectRecord(TypedDict): - octree_cell_id: int - scale_level: int - rotation_cell: tuple[int, int, int] - material_index: int - links_blob_hex: str # raw H5, hex-encoded for canonical JSON - behavior_code: int - - -def pi_star_w_object( - hard_hash_32: bytes, - manifest: dict, - *, +def split_anchor_n( + hard_hash: bytes, seed: bytes, -) -> ObjectRecord: - _require_manifest(manifest) - a = split_anchor(hard_hash_32, seed=seed) - grid = manifest["grid"] - return ObjectRecord( - octree_cell_id=_map_position(a.h1_position, grid), - scale_level=_map_scale(a.h2_scale, grid), - rotation_cell=_map_rotation( - a.h3_rotation, - int(manifest.get("rotation_delta_mrad_inv", 1000)), - ), - material_index=_map_material(a.h4_material, len(manifest["materials"])), - links_blob_hex=a.h5_links.hex(), - behavior_code=_map_behavior(a.h6_behavior, len(manifest["behaviors"])), - ) + grammar_hash: bytes, + n: int, +) -> AnchorN: + """Generic N-region split. Counter-mode HMAC-SHA-512 over the + triple (hard_hash || seed || grammar_hash || counter_be8) yields + 64-byte blocks; first 32 bytes of each block is the region. - -def _require_manifest(manifest: dict) -> None: - # Fail-closed (Phase 1 §2.5 recommendation A): explicit privacy class - if "privacy" not in manifest or "class" not in manifest["privacy"]: - raise ValueError( - "manifest must declare privacy.class explicitly (v7-W paper §6); " - "see worked example at " - "docs/_source/merkle-agi-v7w-spatial-temporal.rst §A" - ) - # Grid declaration required (paper §2.1) - if "grid" not in manifest or "type" not in manifest["grid"]: - raise ValueError("manifest must declare grid.type (paper §2.1)") - # Materials + behaviors required for H4 + H6 mappers - if not manifest.get("materials"): - raise ValueError("manifest must declare a non-empty materials list") - if not manifest.get("behaviors"): - raise ValueError("manifest must declare a non-empty behaviors list") - - -def _map_position(h1: bytes, grid: dict) -> int: - """octree cell id at manifest level `L`. - - Reads h1[0:8] as LE uint64, modulo 8**L → canonical descent - address. Higher levels = finer cells; L declared by manifest. + Same construction as arborist.substrate.anchor_prg._expand; + the difference is grammar_hash binds into the expansion so the + same hard_hash under two different grammars yields disjoint + regions. Without that binding, swapping grammars at proof-path + time would silently reuse anchor bytes for new semantics. """ - level = int(grid.get("level_max", 18)) - cells = 1 << (3 * level) # 8 ** level - raw = int.from_bytes(h1[:8], "little") - return raw % cells - - -def _map_scale(h2: bytes, grid: dict) -> int: - lo = int(grid.get("level_min", 0)) - hi = int(grid.get("level_max", 18)) - span = hi - lo + 1 - return lo + (h2[0] % span) - - -def _map_rotation(h3: bytes, delta_inv: int) -> tuple[int, int, int]: - """Three integer Euler-equivalent indices at 1/delta_inv mrad step. - - Reads three LE uint32 from h3[0:12], modulo (2π / step). - """ - step_count = int(6_283 * delta_inv // 1000) # 2π * 10^3 ≈ 6283 mrad - axes = [] - for i in range(3): - u = int.from_bytes(h3[4 * i : 4 * (i + 1)], "little") - axes.append(u % step_count) - return tuple(axes) # type: ignore[return-value] - - -def _map_material(h4: bytes, palette_size: int) -> int: - u = int.from_bytes(h4[:4], "little") - return u % palette_size - - -def _map_behavior(h6: bytes, table_size: int) -> int: - u = int.from_bytes(h6[:4], "little") - return u % table_size - - -__all__ = ["ObjectRecord", "pi_star_w_object", "PI_STAR_OBJECT_VERSION"] ``` +Lives at `arborist/substrate/spatial_anchor.py`. Substrate-level (not +under `arborist/world/`) because AnchorN is the generic primitive any +future world kernel may consume — v7-W is one consumer, but other +consumers may want N-region splits without the v7-W semantics. + +--- + +## 2. WorldDimensionGrammar — frozen, hash-pinned, registry-addressable + +A grammar declares N and the N region-to-mapper bindings. It is a +canonical-bytes-serializable record; its SHA-256 is `grammar_hash`. + ```python -# arborist/world/pi_star/__init__.py -"""``arborist.world.pi_star`` — v7-W π*_w canonical projections (#000070+). +@dataclass(frozen=True) +class WorldDimensionGrammar: + name: str # e.g. "joseph6" + version: str # e.g. "v1" + n: int # number of regions + region_mappers: tuple[str, ...] # registered mapper names + region_names: tuple[str, ...] # human-readable per-region label + axiom_pack_ref: str # "axiom-pack@v1" registry slot -Per ``arborist/world/__init__.py`` reserved-namespace roadmap: - pi_star/object.py — π*_w_object (#000070, this package's first kernel) - pi_star/relation.py — π*_w_relation (sibling ticket TBD) - pi_star/event.py — π*_w_event (sibling ticket TBD) - pi_star/place.py — π*_w_place (sibling ticket TBD) - pi_star/agent_trace.py — π*_w_agent_trace (sibling ticket TBD) -""" +def canonical_grammar_bytes(g: WorldDimensionGrammar) -> bytes: + """Stable serialization. Field order pinned, integers little-endian.""" + + +def grammar_hash(g: WorldDimensionGrammar) -> bytes: + return sha256(canonical_grammar_bytes(g)) + + +def validate_grammar(g: WorldDimensionGrammar) -> None: + """Raise GrammarInvalid if: + - n != len(region_mappers) != len(region_names) + - any mapper name isn't in the registry + - axiom_pack_ref isn't in the registry + - reserved-name collision (e.g. names starting with '_') + """ ``` -(Mapper internals are illustrative; KAT vectors in -`bench/fixtures/spatial-anchor/known-answer-tests.jsonl` will pin the -exact byte-level behavior under review.) +Lives at `arborist/world/grammar.py` (new file). -## 5. Scope boundaries (what this ticket does NOT do) +--- -- **No π*_w_relation kernel.** `H₅` is reserved raw; the `pair(A,B)` - operator is a separate ticket's decision. -- **No event / place / agent_trace kernels.** Separate tickets per - paper Part 4. -- **No ε-frontier kernels.** `world/frontier/*.py` is Phase 3. -- **No `world/manifest.py` validator.** Phase 1 accepts a dict with - manual `_require_manifest()`. -- **No `world/frame.py`.** Frame discipline (paper §2.3) is honored - via manifest declaration but not validated by an in-code kernel. -- **No `Document.extra` lat/lon hooks.** The prior - `/tmp/arborist-spatial-ontology-plan.md` proposed a - geographic-search feature on `Document.extra`; that is a - soft-channel consumer of π*_w outputs, not a substrate concern, - and lives in a different ticket if at all. -- **No new `audit_mode` token.** Substrate commitments are not - warrants. -- **No SQL schema change.** Phase 1 emits canonical bytes consumed - by callers; persistence to a `world_state_cells` table is Phase 5. -- **No CLI surface.** Phase 1 ships as a library kernel. CLI - (`arborist substrate world-object …`) is a follow-up. -- **No SLAM stack.** Paper §6 out-of-scope unchanged. -- **No ZK / privacy implementation.** Defers to #000016. -- **No mass-storage tier integration.** Cold-pack (#000061) - unchanged. -- **No bench harness wiring.** Phase 1 is KAT-tested; bench-qa - integration follows when relation + event land. +## 3. Quantization mappers -## 6. Cross-references +Five registered mappers ship in Phase 1 (Joseph6's full set). Each +takes a 32-byte region and returns a quantized integer record. -| Ref | Title | Relationship | -|---|---|---| -| #000013 | Spatial-temporal substrate (Merkle-AGI v7-W) | Parent. Closed doc-only 2026-05-09; this ticket implements the first verifier kernel under that namespace. Reopens #000013 status from `namespace_reserved` to `kernel_in_progress` upon land. | -| #000035 | PRG choice for φ_PRG (HMAC-SHA-512 KDF) | Primitive reused. Domain separation by dedicated seed; #000035 KAT freeze stays intact. | -| #000018 | Soft-hash covert channel | Hard-hash discipline inherited. Spatial-anchor outputs are integer cells (hard channel); locality indices (Morton / H3) would be soft and never enter proof path. | -| #000015 | π* cross-domain composition | Future: composing v9.8 language claims with v7-W spatial claims requires the composition theorem from #000015. Out of scope for #000070 but the registration pattern keeps the door open. | -| #000016 | ZK / privacy | Required before any non-public spatial-anchor deployment. Phase 1 fails closed on missing privacy class. | -| #000049 | Attribution-aware grounding check | Architectural sibling — split from #000048 because NLI raised a fresh `audit_mode` question that needed its own dav1d-review surface. Same shape as the §2.4 split-or-extend decision here. | -| v7-W paper | `docs/_source/merkle-agi-v7w-spatial-temporal.rst` (658 lines) | Specification this kernel implements. §A worked example informs default manifest shape. | -| v7 paper | `docs/_source/merkle-agi-dag-v7.rst` §9.10 / §9.10.1 | φ_PRG amendment context. Domain-separation argument inherits from §9.10. | -| Joseph framework (6-dim) | Memory: `joseph_trudojo_6dim_spatial_ontology.md` | Author attribution. The six-dimension `H₁..H₆` split is Joseph (@TrudoJo)'s. Substrate paper amendment under this ticket cites him. | -| #000071 | World-bridge grammar (Joseph 3-bridge inter-chain framework) | **Adjacent axis**, opened 2026-05-31 alongside this ticket. Joseph's bridge framework (Agreement / Translation / Embassy bridges + bridge-seed formula) lives on a different axis: #000070 governs *intra-chain identity* (one hash → one object inside one world); #000071 governs *inter-chain treaties* (a bridge between two worlds with potentially different rule grammars). Adjacent, not overlapping — dav1d's #000070 review proceeds independently. | -| Prior plan | `/tmp/arborist-spatial-ontology-plan.md` (2026-05-31, not in repo) | The plan this ticket replaces. Five-step §2 deletions captured in §7 below. | +| mapper | input | output | notes | +|---|---|---|---| +| `map_octree_position()` | 32 bytes | `(level: uint8, cell: uint256)` | **uint256, not uint64** — preserves entropy at any octree depth | +| `map_scale_level()` | 32 bytes | `uint16` | quantized log-scale, fixed scale-ladder per grammar | +| `map_rotation_euler_ypr()` | 32 bytes | `(yaw: uint16, pitch: uint16, roll: uint16)` | **NOT "SO(3)"** — quantized Euler triple, no continuous SO(3) coverage claim | +| `map_symbol_table_index()` | 32 bytes | `uint64` | modulo over a fixed-size symbol palette | +| `map_passthrough_hex()` | 32 bytes | `hex_str` | 64-char hex; preserves the full region byte string for downstream interpretation | -## 7. Five-step alignment +All mappers are **deterministic** and **registered by name@version**. +Adding a mapper = bump +`canonicalization_version: spatial-anchor-object@v1 → v2`. -1. **Requirements less dumb.** Joseph (@TrudoJo) authored the - framework; fox brought it in 2026-05-31 and decided which kernel - lands first. Names, not departments. -2. **Delete the part or the process.** ~40 % of the prior - `/tmp/arborist-spatial-ontology-plan.md` deleted before drafting: - - Geographic-search backend (encoding route — substrate confusion) - - `Document.extra` lat/lon hooks (different ticket if at all) - - `audit_mode = HYBRID` for spatial hits (convention-illegal) - - Geohash (subsumed by raw Morton) - - Quadtree as separate (octree at level-z=0) - - Hilbert at Phase 1 (deferred; not used by H₁ mapper) - - Five-tier "hash suite" framing (conflated hard vs soft hashes) - - `arborist/spatial/` namespace (violates topic-naming rule; - `world/pi_star/object.py` is the right home) -3. **Simplify.** One registry slot (`spatial-anchor-object@v1`); one - new seed; no new SQL; reuses #000035's `_expand`. ~150 LoC - excluding KATs + tests. -4. **Cycle time.** KATs ship with the projection — replay is the - test, no separate harness. Phase 1 is a single PR. -5. **Automate.** `arborist/pi_star/registry.py` already automates - `name@version` lookup; this ticket adds a row, not a mechanism. +Lives at `arborist/world/pi_star/object.py`. -## 7a. Pre-review empirical evidence (shipped in `55b651f`) +### 3.1 Critical correction (dav1d §16) -To shrink dav1d's review surface, ticket #000070 ships a pure-stdlib -empirical-validation bench **before** any kernel code lands. It runs -against `arborist.substrate.anchor_prg._expand` directly (no new module -required) and prototypes `split_anchor` + `map_position_octree` inline. +The original Anchor6 spec called `map_octree_position()` to return +`uint64`. **That loses entropy at octree depth > 8.** Use `uint256`: +preserves the full 32-byte region. The bench (§7) measured chi² +uniformity at L=2,3,4 only; production deployments will go deeper, +and uint64 truncation would silently bias cell selection at the bits +that get dropped. -**Reproducing the bench (one command):** +### 3.2 Critical correction (dav1d §17) + +The original Anchor6 spec described H₃ as "quantized SO(3) rotation." +**Do not overclaim.** The mapper is a quantized Euler ypr triple. +Quantized Euler is not SO(3) coverage — adjacent rotation operations +are not metrically adjacent in this quantization. Name the mapper +`map_rotation_euler_ypr()` so consumers don't import SO(3) semantics. + +--- + +## 4. π*_w_object — the canonicalizer + +```python +def derive_world_object_record( + hard_hash: bytes, + seed: bytes, + grammar: WorldDimensionGrammar, + manifest: WorldManifest, +) -> WorldObjectRecord: + """End-to-end: + 1. validate_grammar(grammar) — fail-closed + 2. validate_manifest(manifest) — privacy.class HARD-required + 3. anchor = split_anchor_n(...) — N regions + 4. per region: invoke registered mapper + 5. assemble record with all four hashes + 6. SHA-256(canonical(record)) = world_object_hash + """ +``` + +Output record carries the FOUR identity hashes plus per-dimension +values: + +```python +@dataclass(frozen=True) +class WorldObjectRecord: + grammar_hash: bytes # which grammar produced this + axiom_pack_hash: bytes # which axiom pack the grammar pins + manifest_hash: bytes # which deployment manifest + seed_hash: bytes # which spatial_anchor_seed + dimensions: tuple[Any, ...] # length N; one per region_mapper + world_object_hash: bytes # SHA-256 of the canonical bytes +``` + +All four hashes are **required for replayability across grammar +versions**. A consumer presented with a `world_object_hash` and the +four identity hashes can re-derive the record byte-for-byte by +loading the named grammar + axiom pack + manifest + seed. + +Lives at `arborist/world/pi_star/object.py`. + +A separate registry-facing adapter at +`arborist/pi_star/spatial_anchor_object.py` exposes the canonicalizer +as a registered π*: + +```python +PI_STAR_NAME = "spatial-anchor-object" +PI_STAR_VERSION = "v1" + + +def canonicalize(raw: bytes) -> bytes: + """Registry contract. Parses raw bytes into the (hard_hash, + seed_ref, grammar_ref, manifest_ref) tuple, dispatches to + derive_world_object_record, returns the canonical bytes.""" +``` + +--- + +## 5. Joseph6 — the first registered grammar (example) + +Joseph @TrudoJo's six-dimension framework lands as the first +canonical grammar. It is **an example of what a WorldDimensionGrammar +looks like**, not THE substrate. + +```python +JOSEPH6 = WorldDimensionGrammar( + name="joseph6", + version="v1", + n=6, + region_names=( + "position", # H₁ + "scale", # H₂ + "rotation", # H₃ + "material", # H₄ + "links", # H₅ — reserved for π*_w_relation sibling + "behavior", # H₆ + ), + region_mappers=( + "map_octree_position", + "map_scale_level", + "map_rotation_euler_ypr", + "map_symbol_table_index", # material palette + "map_passthrough_hex", # raw links reserved + "map_symbol_table_index", # behavior code + ), + axiom_pack_ref="axiom-pack-joseph6@v1", +) +``` + +Joseph6's `grammar_hash` is computed at module-load time; KATs (§7) +pin it byte-for-byte. Future grammars (Joseph12, Cartesian5, +spatial+temporal-7, etc.) register through the same mechanism — +none is privileged over Joseph6 except by being chosen at +deployment-manifest level. + +**Why ship Joseph6 in Phase 1:** + +- Proves AnchorN can host a non-trivial grammar end-to-end. +- Gives the substrate-paper a concrete worked example readers can + follow without inventing one. +- Lets the bench (§7) measure a real grammar's avalanche / uniformity + / domain-separation properties rather than a synthetic. + +--- + +## 6. Phase 1 deliverables + +**What ships:** + +1. **Substrate primitive:** + - `arborist/substrate/spatial_anchor.py` — `AnchorN`, + `split_anchor_n()`, `SPATIAL_ANCHOR_VERSION`, + `PLACEHOLDER_SPATIAL_SEED` +2. **Grammar layer:** + - `arborist/world/grammar.py` — `WorldDimensionGrammar`, + `canonical_grammar_bytes()`, `grammar_hash()`, + `validate_grammar()` +3. **Mappers + record:** + - `arborist/world/pi_star/object.py` — 5 mappers + `WorldObjectRecord` + + `derive_world_object_record()` +4. **Registry adapter:** + - `arborist/pi_star/spatial_anchor_object.py` — registered π* +5. **Joseph6 grammar:** + - `arborist/world/grammars/joseph6.py` (or registry-registered + constant) — the `JOSEPH6` grammar definition + axiom-pack-joseph6@v1 +6. **KATs:** + - `bench/fixtures/spatial-anchor-object/known-answer-tests.jsonl` + — at minimum: zero-hash, max-hash, low-entropy hash, three + mid-entropy hashes; expected outputs for Joseph6 grammar +7. **Tests:** + - `tests/test_spatial_anchor.py` — AnchorN unit + integration + - `tests/test_world_dimension_grammar.py` — grammar validation + - `tests/test_pi_star_spatial_anchor_object.py` — canonicalizer + round-trip + KAT replay +8. **Paper amendment:** + - `docs/_source/merkle-agi-v7w-spatial-temporal.rst` — new section + citing Joseph (@TrudoJo) as the framework author; AnchorN + + grammar layer as the architecture +9. **Status:** + - `arborist/world/__init__.py` STATUS bumps from + `namespace_reserved` → `world_object_kernel_in_progress` + +**What does NOT ship in Phase 1:** + +- ❌ Relation / event / place / agent_trace kernels (siblings) +- ❌ SQL `world_state_cells` table (Phase 3) +- ❌ New `audit_mode` token (ever — hard) +- ❌ `verifier_policy_hash` change (commitments ≠ warrants) +- ❌ Continuous tensors anywhere in proof path +- ❌ Runtime LLM-decided dimensionality (axioms select, validators + accept, grammars freeze) +- ❌ Bench at Phase 1 over and above the pre-review empirical bench + (§7) — KATs replace open-ended bench + +--- + +## 7. Pre-review empirical evidence (already shipped) + +`bench/spatial_anchor_validation.py` (commit `55b651f`, 561 lines) +validated the HMAC-SHA-512 expansion properties before this ticket's +implementation phase. **Survives the AnchorN reframe** — N just +changes the loop count; the per-region properties measured are +unchanged. + +Reproduce: ``` make bench-spatial-anchor [SPATIAL_N=10000] ``` -- **Wall time:** ~2 s on a workstation (10000 samples through 5 benches). -- **Determinism:** RNG seed pinned at `0xa8c90e551fd34427` — same input - produces byte-identical numbers; if `bench/spatial_anchor_validation_results.md` - changes hash after a re-run, something is wrong with the construction. -- **Dependencies:** Python stdlib only. No numpy, no scipy. The chi² - p-value is reported as a Normal(df, 2·df) z-score under the - approximation that's tight to ±0.05 for df ≥ 30. - -**Files committed in `55b651f`:** - -- `bench/spatial_anchor_validation.py` — 423 lines, the bench script. -- `bench/spatial_anchor_validation_results.md` — the report from the - first canonical run (2026-05-31T14:05:04Z), committed alongside the - script so dav1d can diff against any later re-run. -- `Makefile` target `bench-spatial-anchor` (+ PHONY entry). - -**What the bench measures and why each one matters for review:** - -| § | Bench | Purpose | What it answers | +| § | Bench | Result | What it proves | |---|---|---|---| -| 1 | Avalanche (single-bit hash flip → Hamming distance over 192-byte output) | Confirms the PRF-output independence property the §2.2 fixed-offset slicing relies on | Q2 | -| 2 | Octree cell-distribution chi² at L=2,3,4 | Confirms the position mapper's modulo-`8^L` operator is uniform — not biased toward low-numbered cells under the LE uint64 conversion | Q3 | -| 3 | Collision rate at L=4,6,8,10 vs birthday-bound `N(N-1)/(2·8^L)` | Confirms collisions follow PRF expectation, not structural skew; surfaces the adversarial-vector class for KATs | Q3, Q9 | -| 4 | Pairwise Pearson correlation on byte 0 across all 15 pairs of H₁..H₆ | The directly-measured argument that fixed-offset slicing inherits counter-mode block independence — IF any pair fired above 4σ, §2.2 option B (per-region nested HMAC) would become the recommendation | Q2 | -| 5 | Two-arm Hamming distance — Arm A distinct seeds vs Arm B shared seed | Empirically demonstrates the collision class the dedicated-`spatial_anchor_seed` discipline protects against | Q1 | +| 1 | Avalanche (single-bit hash flip → Hamming distance over output) | mean 767.85 / 768 bits (z = -0.49) | counter-mode HMAC-SHA-512 is PRF-good; fixed-offset slicing inherits the property | +| 2 | Octree chi² uniformity (L=2,3,4) | \|z\| < 1 every level | `map_octree_position()` modulo `8^L` is uniform; no LE-conversion bias | +| 3 | Birthday-bound collision ratio (L=4,6) | 0.989 / 1.038 | structural skew absent; collisions follow PRF expectation | +| 4 | Cross-region Pearson r (15 pairs of H₁..H₆) | r ∈ [-0.018, +0.012], max \|r\|/stderr = 1.80 | counter-mode block independence holds empirically | +| 5 | Domain separation (Arm A distinct seeds vs Arm B shared seed) | Arm A 767.91 bits independent · Arm B **0.00 bits exact collision** | dedicated `spatial_anchor_seed` discipline is load-bearing; sharing seeds yields byte-identical anchor maps | -**Headline results from `55b651f`** (N=10000, RNG seed -`0xa8c90e551fd34427`, wall 2.02 s): +Result file `bench/spatial_anchor_validation_results.md` pinned to +the RNG seed `0xa8c90e551fd34427` — re-runs hash-stable. -| § | Bench | Headline | Verdict | Answers | -|---|---|---|---|---| -| 1 | Avalanche | mean 767.85 bits flipped (PRF null = 768) · z = -0.49 · range [700, 844] | PASS | Q2 | -| 2 | Cell-distribution | \|z\| < 1.0 at L=2 (z=0.87) / L=3 (z=0.05) / L=4 (z=-0.33) | PASS | Q3 | -| 3 | Collisions | L=4 ratio 0.989 (12 071 / 12 205.81) · L=6 ratio 1.038 (198 / 190.72) · L=8 + L=10 zero, both below 1 expected | PASS | Q3, Q9 | -| 4 | Cross-region independence | all 15 pairs \|r\| < 2σ · range [-0.018, +0.012] · max \|r\|/stderr = 1.80 | PASS | Q2 | -| 5 | Domain separation | Arm A mean 767.91 bits independent (range [688, 850]) · Arm B mean **0.00 bits exact, range [0, 0]** — collision class confirmed | PASS | Q1 | - -**What each headline buys dav1d:** - -- **Q1 (§2.1 — seed source).** Arm B's exact-zero Hamming distance is - the *measurable* footgun the dedicated-`spatial_anchor_seed` - discipline protects against. Sharing one seed across two PRG - domains makes `split_anchor` byte-identical to the v7 anchor map. - This is the empirical case for §2.1 option A; option B (domain-tag - bump) would also close the gap but at the cost of a `PHI_PRG_VERSION` - bump that invalidates #000035's KAT freeze. -- **Q2 (§2.2 — segmentation method).** Cross-region Pearson r values - fall in [-0.018, +0.012] across all 15 pairs, every one sub-2σ. - Counter-mode HMAC-SHA-512 block independence holds empirically; - fixed-offset slicing inherits the PRF property cleanly. §2.2 option - B (per-region nested HMAC) would add 3× the HMAC calls for zero - measurable gain. -- **Q3 (§2.3 — octree position mapper).** Chi² uniformity holds at - every tested level (|z| < 1 at L=2,3,4). Birthday-bound holds at - every populated level (obs/exp 0.989 / 1.038 at L=4,6). Mapper is - sound; no measurable bias from the LE uint64 modulo `8^L` operator. -- **Q8 (§2.8 — endianness).** Inherited from #000035 by byte-identical - reuse of `_expand`. The bench would catch a silent endianness flip - in `anchor_prg.py` because cross-region correlation would fire, but - the test is implicit, not separate. -- **Q9 (§3 / open-Q row 9 — adversarial KAT vectors).** §3 of the - bench surfaces the structural importance of including `0x00 * 32`, - `0xFF * 32`, and at least one low-entropy hash engineered to map to - cell 0 at the deployment's chosen L. Future regressions to the - mapper would skip past random KATs but trip on these. - -**What the bench does NOT cover** (stays with dav1d's design review): - -- **Q4** scope split (object alone vs object+relation) — non-empirical; - it's a ticket-proliferation discipline call. -- **Q5** privacy-class default — policy decision, not measurable. -- **Q6** `audit_mode` discipline confirmation — paper-side architectural - decision (commitments ≠ warrants). -- **Q7** manifest-validator timing — sequencing decision. -- **Q10** substrate-paper amendment wording — editorial. - -5 of 10 open questions resolve with measurements. The other 5 are -exactly the kind dav1d's review *should* spend time on. - -## 8. Open questions for dav1d - -1. **§2.1 — dedicated seed vs domain-tag bump.** Recommendation A - (dedicated seed) preserves your 2026-05-11 #000035 final review. - Acceptable, or do you prefer the cleaner domain-tag separation - under a `PHI_PRG_VERSION` bump? -2. **§2.2 — fixed-offset slicing vs per-region nested HMAC.** - Recommendation A relies on counter-mode block independence — - the same PRF argument #000035 §4 used. Confirm the slicing - inherits the independence cleanly, or do we need a separate - per-region HMAC for paper-citation purposes? -3. **§2.3 — H₁ mapper choice.** Octree at Phase 1 matches paper - §2.1 + §A. Should we ship a second position mapper - (`spatial-anchor-h3@v1` or `spatial-anchor-morton@v1`) at Phase - 1 to avoid registry churn later, or is one mapper per ticket the - right discipline? -4. **§2.4 — scope.** Object alone (sibling ticket for relation), or - object + relation in one drop? CLAUDE.md memory says don't - proliferate; #000049/#000048 says split when the audience - differs. Your call. -5. **§2.5 — privacy class default.** Recommendation A (fail-closed - on missing class) is the safest. Is requiring explicit - declaration acceptable, or does the worked-example's silent - `"public"` default need to ship as-is? -6. **§2.6 — `audit_mode` discipline.** Confirm that a spatial - commitment is structurally different from a verifier warrant and - that the ladder is not extended by Phase 1. -7. **§2.7 — manifest validator timing.** Phase 1 accepts a dict with - inline `_require_manifest()`. Acceptable to land - `world/manifest.py` as a follow-up ticket, or must the validator - land alongside the position kernel? -8. **§2.8 — endianness.** Confirm LE throughout matches your - 2026-05-11 #000035 review (the `-le` suffix discipline). -9. **KAT count.** #000035 shipped 10 vectors. Phase 1 plan also - says 10. Larger? Specifically: should the KAT set include - adversarial cases (zero hash, all-ones hash, low-entropy hash, - `phi_prg` output reused as `split_anchor` input) to harden - against future-developer foot-guns? -10. **Substrate paper amendment wording.** Phase 1 land includes - a paragraph in `docs/_source/merkle-agi-v7w-spatial-temporal.rst` - introducing the six-dimension framework. Preferred wording for - @TrudoJo attribution? Default draft: "The six-dimension anchor - split formalized in this section follows the procedural-spatial - framework presented by Joseph (@TrudoJo) on 2026-05-31." +The bench answers 5 of the original 10 design questions (Q1 seed +source, Q2 segmentation method, Q3 octree mapper, Q8 endianness, +Q9 KAT adversarial vectors). The remaining 5 are design decisions +the dav1d review already resolved or paper-editorial calls (see §10). --- -**Land sequence on go:** +## 8. Phase 2 (deferred — siblings under #000013) -1. ✓ Land this ticket file + `Next ID` bump + index row + pre-review - bench + Makefile target — **landed in `55b651f`** (2026-05-31). -2. dav1d review pass — 5 of 10 open questions answered by bench in - `55b651f` (Q1, Q2, Q3, Q8, Q9); 5 remain (Q4, Q5, Q6, Q7, Q10). -3. fox go. -4. Implementation PR per §3 (`arborist/substrate/spatial_anchor.py` + - `arborist/world/pi_star/object.py` + KATs + tests). -5. Substrate-paper amendment in the same PR. -6. Memory update: flip `joseph_trudojo_6dim_spatial_ontology.md` - from "reference (cite when used)" to "reference (used in #000070, - landed ``)". -7. Reopen #000013 status `namespace_reserved` → `kernel_in_progress`. +When Phase 2 opens: + +- **Second grammar registration** — proves the registry mechanism + works for grammars other than Joseph6. Candidate: Cartesian5 + (position-only, 5-region for 3D + 2D-affine variants). +- **π*_w_relation** — relation kernel sibling. Different grammar + (relations don't have a single anchor), different π* registry slot. +- **π*_w_event / π*_w_place / π*_w_agent_trace** — three more + sibling kernels. Each is its own ticket. + +The substrate primitive `AnchorN` is unchanged across siblings — +only the grammar + mappers vary. + +--- + +## 9. Phase 3 (deferred — persistence) + +- SQL `world_state_cells` table (or whatever shape mesh-replay needs) +- v9.8 `cache_key` may gain a new dimension if Phase 3 reveals it + must (defer to bench evidence) +- Cold-pack export for v7-W records (sibling of #000061 cold-pack) +- `audit_events` writer for π*_w_* commitments (no new event_type + needed; existing `pi_star_emit` handles this) + +--- + +## 10. Open questions + +Only the items the dav1d review left genuinely open. The empirical +bench (§7) closed Q1/Q2/Q3/Q8/Q9; dav1d's review §0.7 answered +Q4/Q5/Q6/Q7. + +1. **Q10 — substrate-paper amendment wording.** The paper at + `docs/_source/merkle-agi-v7w-spatial-temporal.rst` needs a new + section introducing AnchorN + grammar layer (not fixed Anchor6). + The technical content is in this ticket; the paper's voice, + diagram style, and reading order stay for fox to set. + +2. **Grammar registry persistence shape.** Are grammars Python + constants in `arborist/world/grammars/*.py`, manifest-declared + YAML, or hash-pinned blobs in a SQLite table? Phase 1 starts + Pythonic; Phase 2 may need otherwise as more grammars land. + +3. **Axiom pack registry vs declared inline.** `axiom_pack_ref` + is a registry slot; the axiom pack itself (the physics / math + constraints the grammar pins) needs its own canonicalization + and KAT discipline. May warrant a sibling ticket if axiom packs + grow beyond simple shape. + +--- + +## 11. Cross-references + +- **#000013** — v7-W substrate reservation. This ticket's Phase 1 + flips `arborist/world/__init__.py` STATUS from + `namespace_reserved` → `world_object_kernel_in_progress`. +- **#000035** — HMAC-SHA-512 KDF (`anchor_prg.py`). AnchorN reuses + `_expand` byte-for-byte. Domain separation via dedicated + `spatial_anchor_seed` keeps #000035's KAT freeze intact. +- **#000071** — World-bridge grammar. Bridge ChainRoots may carry + `world_dimension_grammar_hash` from this ticket's grammar layer. +- **#000015** — π* cross-domain composition. Eventually composes + spatial π* with linguistic π* via the composition theorem. +- **#000061** — cold-pack object store. Future v7-W record persistence + may piggyback on the cold-pack distribution tier. + +--- + +## 12. Five-step alignment + +1. **Make requirements less dumb.** Joseph's framework named the + six-dimension axis; dav1d's review named "freeze grammars before + proof-path use." Both are load-bearing requirements with people + attached. +2. **Delete the part / process.** AnchorN replaces Anchor6 — same + primitive, generalized. Joseph6 stays as the worked example. + Five mappers, not "however many feels right." `map_rotation_so3` + is deleted; renamed `map_rotation_euler_ypr` so consumers don't + import the SO(3) overclaim. +3. **Simplify and optimize.** uint256 for H₁ position (no truncation + ambiguity); grammar identity binds into AnchorN expansion (no + silent reuse across grammars); manifest-published `spatial_anchor_seed` + (no need to bump `PHI_PRG_VERSION`). +4. **Accelerate cycle time.** KATs replace open-ended bench at + Phase 1. Joseph6's grammar_hash is a fixed byte string; deviations + show up as KAT failures, not bench drift. +5. **Automate.** Last. The π* registry mechanism + KAT discipline + automates what the paper specifies; no automation before the + grammar registry mechanism freezes. + +--- + +## 13. Review history + +- **2026-05-31** — original ticket filed (fixed Anchor6 framing, + H₁..H₆ ontology, six-dimension Joseph kernel). Full original + proposal preserved in git history at commit `55b651f` / `e2c8e2c` + (pre-rewrite tip). +- **2026-05-31** — pre-review empirical bench shipped in `55b651f` + validating HMAC-SHA-512 expansion properties (§7); survives the + rewrite unchanged. +- **2026-06-01** — dav1d de-novo review: GO-with-rewrite. Generic + AnchorN replaces fixed Anchor6; Joseph6 is the first registered + grammar, not THE substrate. uint256 H₁ correction; no SO(3) + overclaim; canonical record carries four identity hashes; + privacy fail-closed; no SQL / new audit_mode / verifier_policy_hash + change at Phase 1. Full review (1904 lines) archived at + `docs/dav1d-reviews/000070-spatial-anchor-pi-w-object--2026-06-01.txt`. + This ticket text is the rewrite dav1d's review requires.