From 8f32e53a56a6a50b21d732c4f2e83a9f2f57c723 Mon Sep 17 00:00:00 2001 From: Logic Date: Mon, 7 Sep 2026 18:42:32 +0300 Subject: [PATCH] =?UTF-8?q?OIC/ZTL=20maturation=20rebase=20=E2=80=94=20doc?= =?UTF-8?q?umentation=20and=20contract=20only?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit DOCUMENTATION + CONTRACT UPDATED RUNTIME ADAPTER STILL BLOCKED Front door (dated supersession, historical text retained unchanged): - README.md, STATUS.md: PR #40 merged 2026-09-06; bounded candidate admission and provisional interpretation are present on main; semantic implementation has not started; ZTL runtime attachment remains BLOCKED. New architecture documents: - docs/architecture/OIC-ZTL-MATURATION-DELTA-001.md - docs/architecture/OIC-ZTL-LAYER-OWNERSHIP-001.md - adapters/ztl/CURRENT-STATE-001.md - docs/darpa/OIC-ZTL-DARPA-CROSSWALK-001.md Currentness ownership stated as an ownership rule, not a logic claim: ZTL may reason over supplied epoch, expiry, revocation and currentness facts; ZTL does not create institutional currentness, validity, expiry authority or revocation authority. No ADR text was rewritten to accommodate it. Not done, deliberately: - No semantic runtime implementation is introduced. No adapter, no envelope constructor, no receipt producer, no canonical-formula path: the lawful input does not exist, and its absence is a result to preserve. - No schema promotion. src/oic/** and schemas/draft/** are untouched. - docs/contracts/kernel-profiles/ztl-v0.1.json is untouched; its historical tag names remain historical evidence. - docs/capabilities/CAPABILITY_MATRIX.json is untouched. It cannot represent the ZTL boundary without breaking its own gate: adding a single restrictive ceiling key makes scripts/verify_code_start_gate.py fail with "evidence ceiling expanded". Returned as a frozen-evidence limitation, not forced. - KILL-Z8 and KILL-Z9 remain OPEN / UNGUARDED. No test is fabricated against a component that does not exist. No Tier-1 reproduction claim is made; tier_1_reproduction remains NOT ESTABLISHED. No independent review is claimed. No DARPA hypothesis is moved from UNTESTED. Claim wording remains subject to curator review before merge. Co-Authored-By: Claude Opus 5 --- README.md | 44 ++++++++ STATUS.md | 22 +++- adapters/ztl/CURRENT-STATE-001.md | 100 ++++++++++++++++++ .../OIC-ZTL-LAYER-OWNERSHIP-001.md | 74 +++++++++++++ .../OIC-ZTL-MATURATION-DELTA-001.md | 91 ++++++++++++++++ docs/darpa/OIC-ZTL-DARPA-CROSSWALK-001.md | 95 +++++++++++++++++ 6 files changed, 425 insertions(+), 1 deletion(-) create mode 100644 adapters/ztl/CURRENT-STATE-001.md create mode 100644 docs/architecture/OIC-ZTL-LAYER-OWNERSHIP-001.md create mode 100644 docs/architecture/OIC-ZTL-MATURATION-DELTA-001.md create mode 100644 docs/darpa/OIC-ZTL-DARPA-CROSSWALK-001.md diff --git a/README.md b/README.md index 744f24c..a150788 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,49 @@ # Open Institutional Compiler +> ## Current state — 2026-09-07 +> +> **PR #40 was merged into `main` on 2026-09-06** (merge commit +> `c4a325c551ce8904dfcc5b9fe81b05109726a334`, tree +> `b8e31ec4786a2fd1aca976a6ff047deeee63ef15`). Statements elsewhere in this file and in +> `STATUS.md` that describe a merge as still pending predate that merge. **They are retained +> unchanged as historical text and are superseded by this block, not deleted.** +> +> This state has **two matured sides and one missing centre**, and both halves are true at once. +> +> **Side one — the OIC admission plane is materially implemented.** Present on `main` today: +> +> - **bounded candidate admission** — a frozen admission runtime with fifteen terminal states +> and recomputable receipts; +> - **provisional interpretation** — model-proposed semantic structure, explicitly marked +> provisional and untrusted. +> +> **Side two — ZTL reasoning and warrant semantics have materially matured**, well beyond the +> July dossier in `adapters/ztl/`. See [`adapters/ztl/CURRENT-STATE-001.md`](adapters/ztl/CURRENT-STATE-001.md). +> This is a statement about the dependency's own maturity, not a claim that OIC uses it. +> +> **The missing centre.** Between those two sides, three institutional transitions do not +> exist: +> +> institutional semantic admission +> → stable admitted proposition +> → evidence-bearing formalization +> +> What remains blocked, and is *not* made less blocked by either side maturing: +> +> - **semantic implementation has not started.** The semantic code-start gate is +> `READY FOR SEPARATE EXACT-HEAD REVIEW / NOT OPEN` — see +> [`docs/gates/OIC-SEMANTIC-CODE-START-GATE-CLOSURE-v0.1.md`](docs/gates/OIC-SEMANTIC-CODE-START-GATE-CLOSURE-v0.1.md). +> - **ZTL runtime attachment is blocked.** No institutional act converts a reviewed +> interpretation proposal into admitted canonical meaning, and no canonical formal object +> exists for a logic kernel to receive. The pipeline ends at a provisional proposal. +> +> The boundary itself is described in +> [`docs/architecture/OIC-ZTL-MATURATION-DELTA-001.md`](docs/architecture/OIC-ZTL-MATURATION-DELTA-001.md) +> and [`docs/architecture/OIC-ZTL-LAYER-OWNERSHIP-001.md`](docs/architecture/OIC-ZTL-LAYER-OWNERSHIP-001.md). +> +> Nothing in this block establishes semantic correctness, runtime authorization, +> institutional validity, or independent reproduction. + - **Status:** BOUNDED_REFERENCE_IMPLEMENTATION — scoped independent Gate F repository validation passed; merge pending Gate G and owner authorization - **Bootstrap date:** 2026-07-29 - **Governing design:** TDD-OIC-001 v1.1 diff --git a/STATUS.md b/STATUS.md index 7fe1e4a..8e994f7 100644 --- a/STATUS.md +++ b/STATUS.md @@ -1,6 +1,26 @@ # Project Status -## Current status +## Current state — 2026-09-07 + +**PR #40 was merged into `main` on 2026-09-06**, merge commit +`c4a325c551ce8904dfcc5b9fe81b05109726a334`, tree +`b8e31ec4786a2fd1aca976a6ff047deeee63ef15`. + +The section below says a merge remains pending. That sentence predates the merge. It is +**retained unchanged as historical text** and superseded by this block; the validation figures +it reports (promotion base `9ad37fc8`, candidate `c0108a7a`, tree `1d12b17a`, 1714 passing) +belong to that historical Gate-F candidate and are not a statement about the current head. + +On `main` today: bounded candidate admission and provisional interpretation are present. +Semantic implementation has not started, and the broader production semantic gate remains +**BLOCKED**. **ZTL runtime attachment remains BLOCKED** — the institutional semantic act that +would produce an admitted canonical proposition does not exist, so there is no lawful input +for a logic kernel. + +No semantic correctness, runtime authorization, institutional validity, or independent +reproduction is established by this block. + +## Current status (historical — superseded 2026-09-07) **BOUNDED_REFERENCE_IMPLEMENTATION — SCOPED INDEPENDENT GATE F REPOSITORY VALIDATION PASSED** diff --git a/adapters/ztl/CURRENT-STATE-001.md b/adapters/ztl/CURRENT-STATE-001.md new file mode 100644 index 0000000..e4c2050 --- /dev/null +++ b/adapters/ztl/CURRENT-STATE-001.md @@ -0,0 +1,100 @@ +# ZTL current state — 001 + +**Date:** 2026-09-07. This file records what ZTL is **now**, beside the v0.1/v0.2 dossier and +conformance material in this directory, which describe a July state and are retained unchanged. + +**Reading discipline.** A module's existence and theorem count is **not** a reading of its +statements. Below, *read* means the source was opened in the pass that produced this file; +*counted* means only the census figure is asserted. Nothing here upgrades a claim on the +strength of a file name. + +## Pin + +| | | +|---|---| +| repository | `https://github.com/inventor1975/ZTL` | +| branch | `master` | +| HEAD | `8ab40b23546eb9fd5a4fd8cc22e94282ce2a7a44` | +| tree | `0efbd9cb6852a214bc653477454639a5f378a1ce` | + +The **frozen kernel profile pins a different, older commit** — `56e1ff05`, July — and that is +correct and deliberate: this file is not a re-pin. See +`docs/architecture/OIC-ZTL-MATURATION-DELTA-001.md` §5. + +## Census — measured 2026-09-07 + +ZTL's own inventory tooling reports, verbatim: + + ALL CLEAN: 1112 theorems across 66 modules, every one on the empty axiom list. + +**Anticipating the arithmetic.** A plain count over the sources disagrees — 67 `.lean` files and +1118 `theorem`/`lemma` line-starts. Both differences are explained and neither is an exclusion: + +- **67 vs 66 modules:** one file contains zero theorem or lemma declarations; it is an + evaluation script, contributing a file and no theorem. +- **1118 vs 1112 declarations:** the six extras are English prose **inside block comments** + that happen to begin with the word *theorem* or *lemma*. The inventory tool skips block + comments deliberately; its own source records that exact bug being caught earlier, with one + of these six lines as the example. + +Separately and unrelatedly, classical proofs of the `F:∀` rule **are** held outside the +theorem corpus, in a probes directory that is not part of the module set. That is a real +exclusion — but those files were never inside the counted scope, so they explain none of the +six. The two facts are both true and neither explains the other. + +**The figure to use is 1112 / 66.** + +## Modules the current interface work depends on + +| module | theorems | this pass | +|---|---|---| +| `ZCutElim` | 103 | counted | +| `ZProv` | 35 | counted | +| `ZNaN` | 25 | counted | +| `Linear` | 22 | counted | +| `RelianceBridge` | 19 | counted | +| `LabelExactDefinite` | 19 | counted | +| `LabelExact` | 17 | counted | +| `ZHeredTaut` | 17 | counted | +| `ContextClosure` | 12 | counted | +| `ZReceiptHard` | 12 | counted | +| `ZReconverge` | 11 | **read** | +| `ZWidthHard` | 10 | counted | +| `NoGift` | 10 | counted | +| `Receipt` | 4 | counted | + +Every module in the census is on the empty axiom list; that part is measured for all of them. + +## The one result read in full, because this repository's architecture depends on it + +`ZReconverge` — 11 theorems, empty axiom list: + + eligible m (Γ₁ ++ Γ₂) = true ↔ eligible m Γ₁ = true ∧ eligible m Γ₂ = true + +An **equivalence**, holding **without** non-emptiness hypotheses, *whatever the two branches +share and however many times they share it*. The question is settled by a theorem over every +marking and every pair of bundles — not by a failed search. + +Where sharing does bite: **below eligibility, in the verdict.** One unresolved ground read once +yields `Z`; read twice it yields `F`. In that witness eligibility is `false` in **both** cases, +and more generally an unresolved ground makes every branch reading it ineligible **before** any +recombination. The one way such a ground enters an eligible branch is the over-grant `¬¬p`, and +there recombination is neutral. + +Supporting measurement, 2026-09-07: 135 225 enumerated cells — verdict ≠ meet with both bundles +non-empty **0**, on the empty-bundle edge **12**, eligibility ≠ conjunction **0**, cells where +both branches are eligible **14 387** (the denominator; the check is not vacuous). A second +sweep of 3000 random pairs: 27 000 cells, edge 45, eligibility mismatches **0**. + +**Consequences for this repository.** Do not write *"shared ancestor = unsafe"* or *"shared +ancestor = loss of standing"*; both are refuted. Keep **eligibility**, **verdict**, **ground +identity**, **use multiplicity** and **path multiplicity** as separate questions — ground +identity in particular is *not* settled by this module. And note that the meet identity on the +verdict does carry non-emptiness hypotheses: an empty bundle is not the identity element of +that operation. No dependency-graph representation is proposed here. + +## What this file does not do + +It does not re-pin the kernel profile, does not update the dossier, does not claim +conformance against the current head, and does not establish Tier-1 reproduction — which +remains **NOT ESTABLISHED**. diff --git a/docs/architecture/OIC-ZTL-LAYER-OWNERSHIP-001.md b/docs/architecture/OIC-ZTL-LAYER-OWNERSHIP-001.md new file mode 100644 index 0000000..5d340ed --- /dev/null +++ b/docs/architecture/OIC-ZTL-LAYER-OWNERSHIP-001.md @@ -0,0 +1,74 @@ +# OIC↔ZTL Layer Ownership 001 + +**Date:** 2026-09-07 · **Base:** `main` at `c4a325c5`, tree `b8e31ec4` · **Status:** architecture +description, not a decision record. It describes ownership as it stands; it creates no +authority and admits nothing. + +This document answers one question for each semantic act in the pipeline: **which layer owns +it, and what artifact in this repository shows that.** Two rows have no owner. Naming them is +the point of the document. + +## 1. Ownership of each semantic act + +| Question | Owning layer | Where it lives here | +|---|---|---| +| What source bytes existed? | OIC | `source_id` / `source_version` / `source_digest` on every admission receipt; `schemas/draft/source-document.schema.json`, `source-node`, `source-anchor` | +| What candidate spans were proposed? | OIC extraction | `src/oic/candidate_extraction.py`; `schemas/draft/candidate-normative-unit.schema.json` | +| Are **candidate** proposals divergent? | OIC review docket | `src/oic/review_docket.py` — `AgreementState` ∈ {`NO_CANDIDATES`, `IDENTICAL`, `DIVERGENT`} | +| Is institutional authority evidence sufficient? | OIC admission | `src/oic/admission.py`; `design/admission-boundary-001/ADMISSION-CONTRACT-v0.1.md` | +| **What meaning was institutionally admitted?** | — **no owner** | assigned in prose to a *"Future Institutional IR construction stage"*; no code, no receipt, no state | +| **What formal proposition represents that admitted meaning?** | — **no owner** | ADR-002 names Institutional IR as the canonical admitted representation; `schemas/draft/institutional-ir.schema.json` types `nodes` as `{"type":"object"}` and carries no formula | +| What grounds are verified / unverified? | supplied evidence state | `docs/contracts/kernel-profiles/ztl-v0.1.json` → `unverified_ground_semantics`; ADR-013 W-5, W-12 | +| What follows without granting truth on credit? | ZTL | ADR-009; profile `entrypoint: ztljudge.judge` | +| Is the conclusion earned, refuted, on-credit, or open? | ZTL | profile `disposition_values`; ADR-013 §3.1 | +| Is the result institutionally authorized for this purpose and epoch? | OIC | ADR-013 §2.2 `decision_basis`; `docs/contracts/WARRANT-CONTRACT-v0.1.md` | +| May software execute an action? | downstream authority / runtime — **not ZTL** | ADR-013 §2.2 `execution_disposition`; ADR-009 forbids ZTL deciding ALLOW/BLOCK/ESCALATE | +| Is execution integrity established? | VEIP | ADR-010; `docs/contracts/VEIP-CODE-START-BOUNDARY-v0.1.json` (non-executable); ADR-013 §4 | +| Does historical consequence retain current standing? | OAM / Authority-VM boundary | **not found in this repository.** Reported as *not found*, which is not *absent* | + +## 2. A scope distinction that is easy to miss + +`review_docket.py` looks like the organ that reviews interpretations. It is not. It consumes +`CandidateExtractionResult` — candidate **spans** — and never sees an +`InterpretationProposalResult`. Its own docstring states it *"never votes, selects an +authoritative interpretation, records admission, or advances candidate state."* + +The word *proposal* denotes two different objects in this tree: a proposed span and a proposed +interpretation. The docket is upstream of interpretation, not downstream of it. **Divergence +among interpretation proposals has no owner**, which is a third consequence of the two unowned +rows above: nobody is appointed to accept an interpretation, and nobody is appointed to notice +that two interpretations disagree. + +## 3. Currentness ownership — the rule + +> **ZTL may reason over supplied epoch, expiry, revocation and currentness facts. ZTL does not +> create institutional currentness, validity, expiry authority or revocation authority.** + +This is an **ownership rule**, not a claim about the logic. It asserts no theorem, and no ZTL +result is offered in support of it. It follows the boundary already drawn in ADR-009 — +which prohibits ZTL from determining authority — and makes explicit what that boundary implies +for currentness specifically, where the implication had not been written down. + +Consistent with it, and already stated in ADR-013 §3.3: + +- expiry is **scoped, never global**: `valid_until` is per artifact and `revocation_references` + are per ground; unrestricted expiry would make every warranty invariant trivially true; +- `hereditary` is absorbing **only** under monotone refinement. It waives re-checking on + nothing else — not expiry, revocation, correction, source invalidation, schema change, + formula change, semantic-version change, or institutional admissibility. + +**No ADR text was rewritten to add this rule.** It is stated here because it is an ownership +statement, and this is the ownership document. If normative consistency later requires it to +appear in an ADR, that is a separate change with its own justification. + +## 4. Complexity as a ceiling, not a citation + +Minimality of a repair or recheck set is **not claimed** in this repository, deliberately and +in three places: `docs/contracts/WARRANT-CONTRACT-v0.1.md` (*"Minimality is not claimed, +deliberately"*, measured in 38 of 180 census cases), the kernel profile (*"NOT claimed. This is +a deliberate over-approximation"*), and `docs/contracts/ZTL-OCE-MAPPING-v0.1.json` (*"Neither +array claims minimality"*). + +`SUFFICIENT` and `MINIMAL_IF_ESTABLISHED` must remain distinct wherever a repair certificate is +eventually emitted. **NP-completeness is not claimed anywhere**: hardness is not membership, +and no claim here rests on one standing for the other. diff --git a/docs/architecture/OIC-ZTL-MATURATION-DELTA-001.md b/docs/architecture/OIC-ZTL-MATURATION-DELTA-001.md new file mode 100644 index 0000000..9a39f5d --- /dev/null +++ b/docs/architecture/OIC-ZTL-MATURATION-DELTA-001.md @@ -0,0 +1,91 @@ +# OIC↔ZTL Maturation Delta 001 + +**Date:** 2026-09-07 · **OIC base:** `main` at `c4a325c5`, tree `b8e31ec4` · **ZTL base:** +`master` at `8ab40b23`, tree `0efbd9cb`. + +This document reconciles what this repository says about ZTL, what it implements, and what ZTL +currently is. It broadens no claim. Where a statement here is measured, the measurement is +named; where something was not read, that is said rather than glossed. + +## 1. The short answer + +The contract between OIC and ZTL is **largely written and entirely unstarted**. The +documentation describing it is stale in specific places. And the three institutional +transitions that would let anything cross between them **do not exist**: + + InterpretationProposal + → institutional semantic act (no owner, no code, no receipt) + → stable admitted proposition (no identity object) + → evidence-bearing formalization (no provenance discipline) + → ZTL + +This is why `ZTL RUNTIME ATTACHMENT = BLOCKED`. It is not a defect in ZTL and not a gap in the +warrant contract; it is a missing institutional middle. + +## 2. Statements in this repository that had become stale + +| Where | What it said | What is the case | +|---|---|---| +| `README.md`, `STATUS.md` | *"merge pending Gate G and owner authorization"* | PR #40 merged 2026-09-06. **Superseded by dated blocks in both files; historical text retained** | +| `STATUS.md` | validation figures for promotion base `9ad37fc8`, candidate `c0108a7a`, tree `1d12b17a`, 1714 passing | that is the historical Gate-F candidate, not the current head. Now labelled as such. Measured at the current head 2026-09-07: **1719 passed, 1 declared skip** | +| `adapters/ztl/` | dossier, conformance and census at **v0.1 / v0.2**, `OPEN-ITEMS-2026-07-29.md` | ZTL has moved substantially since. See `adapters/ztl/CURRENT-STATE-001.md` | +| `docs/capabilities/CAPABILITY_MATRIX.json` | **no ZTL entry at all** | corrected minimally in this change | +| `docs/contracts/kernel-profiles/ztl-v0.1.json` | names tags `veraxis-ztl-input-v0.1` and `veraxis-ztl-input-v0.2-signed` | neither exists in the ZTL repository. **Deliberately not modified** — see §5 | + +**Not stale, and worth stating:** `STATUS.md`'s *"Broader production semantic gate: BLOCKED"*, +`CAPABILITY_MATRIX.json`'s `production_semantic_gate: "BLOCKED"`, and +`docs/gates/OIC-SEMANTIC-CODE-START-GATE-CLOSURE-v0.1.md`'s *"SEMANTIC IMPLEMENTATION HAS NOT +STARTED"* were all accurate. Three independent artifacts already stated the conclusion. + +## 3. OIC-side maturity — what is actually implemented + +| Capability | Implemented | Note | +|---|---|---| +| source binding | yes | digest-checked against a registered source; three distinct mismatch states | +| candidate grounding | yes | a literal supporting quote is required, or the slot is `null` | +| deterministic candidate identity | yes | `cnu-<24 hex>`; canonical JSON, no clock, no randomness | +| divergence preservation | yes, **for candidate spans** | see `OIC-ZTL-LAYER-OWNERSHIP-001.md` §2 | +| admission boundary | yes | 15 frozen terminal states in frozen precedence order | +| authority evidence | yes | ordered, per-item digests, integrity-checked; **supplied, never issued** | +| expiry / supersession / revocation | yes, **of the candidate's admission** | not of a meaning; the distinction is load-bearing | +| conflicting authority | yes | `CONFLICTING_AUTHORITY`; distinct from a contradictory formula, which ZTL simply refutes | +| admission receipt | yes | 18 fields, recomputable, `admrec-sha256:` identity | +| provisional interpretation | yes — **and the pipeline ends here** | `proposal_state: PROVISIONAL`, `epistemic_state: uncertain`; its own frozen prompt calls the output provisional and untrusted | +| Institutional IR closure | no | already declared `UNESTABLISHED` in the capability matrix | +| Open Control Envelope | not executable | `schemas/draft/control-envelope.schema.json` | + +## 4. ZTL-side maturity, against what `adapters/ztl/` currently pins + +Measured 2026-09-07 by ZTL's own inventory tooling: **1112 theorems across 66 modules, every +one on the empty axiom list.** + +Present in current ZTL and absent from the adapter's July picture: `RelianceBridge`, +`ZReconverge`, `ZReceiptHard`, `ZWidthHard`, `LabelExact`, `LabelExactDefinite`, `ZNumPrice` +and others. Per-module detail, and the reading discipline separating what was read from what +was only counted, is in `adapters/ztl/CURRENT-STATE-001.md`. + +Two ZTL results bear directly on this repository's architecture: + +- **Reconvergence.** Eligibility of a fan-in equals eligibility of both branches — an + equivalence, holding without non-emptiness hypotheses, *whatever grounds they share and + however often*. The older shorthand *"a shared ancestor destroys eligibility"* is **refuted** + and must not be carried forward. Shared ancestry never changes eligibility; verdict movement + from a repeatedly-read unresolved ground occurs only where eligibility is already false. + A caution for any future dependency-graph representation: the meet identity on the *verdict* + does carry non-emptiness hypotheses, so **an empty bundle is not the identity element** and + cannot be folded in as neutral. +- **Disposition count.** ADR-013 §3.1 already corrects the v0.1 dossier's three dispositions to + four, adding `ON CREDIT`. That correction stands. + +## 5. What was deliberately not changed + +- **`docs/contracts/kernel-profiles/ztl-v0.1.json` is untouched.** Its tag names are historical + evidence of what was admitted in July. A recovered public tag created in September does not + retroactively replace them. A superseding profile — re-binding the current admitted ZTL + surface to a published durable reference and a re-verified interface — is separate future + work, and which ZTL surface it should pin must follow from a conformance and reproduction + gate rather than from recency. +- **No runtime code, no schema promotion, no adapter.** There is no lawful input to write code + against. The absence of the chain in §1 is a result to preserve, not a gap to fill with + scaffolding. +- **`tier_1_reproduction` remains NOT ESTABLISHED** and is not moved by anything here. diff --git a/docs/darpa/OIC-ZTL-DARPA-CROSSWALK-001.md b/docs/darpa/OIC-ZTL-DARPA-CROSSWALK-001.md new file mode 100644 index 0000000..2a3fbc6 --- /dev/null +++ b/docs/darpa/OIC-ZTL-DARPA-CROSSWALK-001.md @@ -0,0 +1,95 @@ +# OIC↔ZTL DARPA Crosswalk 001 + +**Date:** 2026-09-07 · **OIC base:** `c4a325c5` · **ZTL base:** `8ab40b23`. + +**No DARPA hypothesis is moved from UNTESTED by this document.** Component maturity is not +evidence about a seam. Nothing here is an independent review. + +## 1. Three levels of falsifiability, kept separate + +| Level | What a falsifier attacks | Available today | +|---|---|---| +| **COMPONENT** | one side's machinery in isolation — the admission runtime, or the logic kernel | **yes, both sides** | +| **SEAM** | a transition between two institutional objects | **no** — the transitions are not performed | +| **END-TO-END** | source bytes → executed authority, as one chain | **no** — requires every seam | + +**Component falsifiability ≠ seam falsifiability ≠ end-to-end falsifiability.** None may be +promoted to another. This distinction is the document's organising rule, not a caveat attached +to it. + +## 2. The six dependency families + +| Family | OIC owner | ZTL role | Evidence grade | Falsifier available | Open gap | +|---|---|---|---|---|---| +| **evidence** | admission plane — receipts binding source digests, ordered authority evidence, ruleset digest, evaluator identity | none; ADR-009 forbids ZTL authenticating a source | **MEASURED** | **component:** mutate one evidence byte or reorder the array; the digest must change and the state must fail closed | none at component level | +| **semantics** | **unowned** | would consume a canonical formal object; none exists | **OPEN** | **none constructible** — a non-faithful formalization cannot be exhibited where no formalization is performed | the three transitions | +| **admission** | admission runtime — 15 frozen terminal states, frozen reason codes | none; ADR-009 forbids ZTL creating admission | **MEASURED**, for *candidate* admission | **component:** supply stale, out-of-scope, superseded or conflicting evidence; require the declared state in frozen precedence | admission **of meaning** is a different act and does not exist | +| **currentness** | institutional state — expiry, supersession, revocation | may reason over supplied epoch facts; may not create currentness | **ARGUED** — the rule is stated, not measured | **component:** revoke a ground after a favourable result; standing must fall | no path could carry currentness across the missing seam | +| **memory** | VEIP / OAM boundary | none | **PROPOSED** — the VEIP boundary is declared non-executable | **not constructible** while non-executable | no OAM or Authority-VM artifact in this repository (*not found*, which is not *absent*) | +| **authority** | control plane — execution disposition, decision basis, declared minimum grade, unverified-ground policy | ends at disposition, grade, formula and dependency information, verified and unverified grounds, epoch information, recomputation evidence; decides no ALLOW/BLOCK/ESCALATE | **PROPOSED**, with MEASURED sub-results | **component:** drive a fixture whose raw verdict and disposition disagree; the decision must follow the disposition | nothing consumes it at runtime | + +## 3. A seventh failure surface: dependency reference continuity + +Distinct from the semantic blocker and not to be listed beside it: + + dependency object survival + ≠ dependency-reference continuity + ≠ declared-profile reproducibility + +| | Question | Observed 2026-09-07 | +|---|---|---| +| object survival | does the pinned object still exist anywhere? | **yes** throughout | +| reference continuity | does a published reference reach it, so an ordinary clone obtains it? | **no**, until a dated recovery tag was created; **yes** after | +| declared-profile reproducibility | do the references the frozen profile *declares* resolve? | **no**, still — the declared tag names remain absent | + +A dependency can be perfectly preserved, byte-identical and signed, and still be unreachable by +the route its own contract names — while every party's local checkout looks green and only a +fresh reproducer sees nothing. **The defect is invisible from the owner's side by +construction.** It was detected only because a measurement was re-taken from a fresh clone +rather than from a working copy. + +**Falsifier:** clone the published dependency repository from scratch and resolve every +reference the consuming contract declares. Any that fails to resolve is a continuity break, +whether or not the object survives by explicit hash. + +**This changes no claim.** Reachability restored is **not** reproduction, and +`tier_1_reproduction` remains **NOT ESTABLISHED**. + +## 4. Which ZTL capabilities are usable as T&E instruments now + +**Usable, at component level:** the axiom census (re-runnable, and able to fail); the +reconvergence measurement, which states its denominator; the frozen interface fixtures, +including retained not-reachable defensive rows; and the disposition/grade vocabulary as a +classification instrument over supplied results. + +**Not instruments — research questions:** anything requiring an admitted proposition or a +canonical formula; seam-level or end-to-end falsification of dependency continuity; minimality +of a repair set; ground identity under equal content; and the large-scale dependency-graph +representation, which is **not** designed here. + +## 5. Two negative controls that remain genuinely open + +| | Requirement | Status | +|---|---|---| +| **KILL-Z8** | a future component must not emit `MINIMAL` unless minimality is separately established | **OPEN / UNGUARDED** — minimality is refused by declaration in three places, but nothing prevents emission | +| **KILL-Z9** | equal-content grounds must not be deduplicated without an established identity rule | **OPEN / UNGUARDED** — no artifact here settles ground identity under equal content | + +They are not testable yet: there is no component to refuse. They become executable negative +controls when a relevant component exists. **No test is fabricated against a component that +does not exist.** + +## 6. The strongest result, stated as a result + +> Some failure surfaces cannot yet be falsified, because the institutional object or transition +> whose failure would be tested does not yet exist. + +That is a finding about the architecture, not an embarrassment and not an incomplete audit. The +value of the boundary described in `docs/architecture/OIC-ZTL-MATURATION-DELTA-001.md` is +precisely that it says **which** surfaces already have a witness and which cannot have one yet. + +## 7. What must not be written from this document + +- that any seam-level or end-to-end defect is measurable today; +- that component maturity constitutes seam or end-to-end evidence; +- that this constitutes independent review; +- that Tier-1 reproduction is established.