https://osf.io/6mybg/files/osfstorage/68d7dce87b362f1ca4b8f825
https://chatgpt.com/share/68d681b4-abf4-8010-98e5-e482dca626e5
https://chatgpt.com/share/68d681f7-8a0c-8010-a275-f8f64ed4a670

Industrializing Insight: A Reproducible Method to Empower （灌頂加持）LLMs via
the $E = G + M + D$ Decomposition

Outline

0) Executive Summary (1 page)

The problem: “Publishing rituals doesn’t reproduce breakthroughs.”
The proposal: Decompose empowering priors into General Skeletons (G), Morphology Mappings (M), and Domain Residuals (D)—a method that turns isolated genius into an industrial pipeline.
The claim: Using certification gates (CWA, PRI, PBHL), we can prove or falsify whether $E = G + M + D$ yields scalable domain “empowerment”.
The result: A realistic path to 600–1200 domains without inventing a brand-new full theory for each.

1) The Blind Spot in Knowledge Integration

1.1 Why “share protocols” never reproduced the essence

Distinguish Ritual (process discipline) from Essence (empowering priors).
Why open protocols improved auditability but not capability leaps.

1.2 From monolithic theories to skeletonized integration

The cost of waiting for a grand theory per domain.
The opportunity: factorizing insight into reusable bones + light mappings + tiny residuals.

2) Hypothesis and Formal Model

2.1 Definition of $E = G + M + D$

G (General Skeletons): reusable invariants (conservation/flow, phase/criticality, belt governance, surplus, peaks & traps, phase-lock, slot economics, substitution topology, commuting instruments, certified aggregation, multi-objective trade-offs, deepening algorithms).
M (Morphology Mapping): domain-to-skeleton alignment (units/dimensions, instrument→operator mapping, control variables, state space, cadence, aggregation plans, belt ledger, failure signatures, ethics/guardrails, intervention modes).
D (Domain Residuals): 3–5 counter-intuition rules, a 100–300-term lexicon, concise edge-case tables.

2.2 Capability gain and gates

$Δ C = f (G, M) - λ ∥ D ∥$ with CWA ≥ 0.98, PRI ≤ 0.20, PBHL $r$ ≤ 0.08 as pass conditions.
Why these gates prevent “average-kills-truth” and enforce safe aggregation.

2.3 When the model breaks

The $K$ discriminator (non-observability, non-commuting instruments, semantic drift, adversarial pressure).
If $K$ is high, you need a new $G$ or heavy data/experimentation.

3) The 12 Canonical Skeletons $G$ (with minimal operators)

3.1 Conservation & Flow (mass/energy/capital/attention/token flow; stock-flow operators)
3.2 Surplus Dynamics (generation, absorption, leakage; structural/role/type transformations)
3.3 Phase & Criticality (thresholds, bifurcations, regime shifts; early-warning signals)
3.4 Peaks & Traps (extrema, local minima, lock-ins; escape operators)
3.5 Observer-Runtime Invariants (internal collapse; cross-observer agreement; slot conservation; belt closure)
3.6 Certified Aggregation (CWA/PRI) (commutation test, phase risk, fallback estimators)
3.7 Slot Economics (integer capacity for attention/memory/tools; allocation/eviction logs)
3.8 Belt Governance (PBHL) (Gap, Flux, Twist, Residual; residual band policies)
3.9 Phase-Lock & Symbol Kernels (minimal opcode vocabularies; narrative entropy reduction)
3.10 Multi-Objective Trade-offs (MEEL) (explicit objectives, weights, Pareto tracking)
3.11 Deepening Algorithm (SIDA) (safe internal deepening, evidence compaction)
3.12 Substitution/Topology (substitution belts; topology of replacement and interference)

For each skeleton: purpose, operators, expected signals, common misuses, interface stubs.

4) The 10 Morphology Mapping Templates $M$

4.1 Units & Dimensions Map (what is conserved, what flows)
4.2 Instrument→Operator Map (what we can measure & commute, with cadence $τ$ )
4.3 Control Variable Taxonomy (policy/knob surfaces and feasible sets)
4.4 State Space & Constraints (bounds, invariants, degeneracy)
4.5 Intervention Modes (soft prompts, policy levers, structural edits)
4.6 Aggregation Plan (mean/sum vs. order-sensitive fallback; cohorting rules)
4.7 Belt Ledger Mapping (how Gap/Flux/Twist/Residual are computed)
4.8 Failure Signature Library (common traps, oscillations, collapses)
4.9 Ethics & Safety Constraints (non-goals, blocked instruments)
4.10 Evidence Contract (what traces are written; JSON schemas; hashes)

Each template ships with checklists and example fill-ins.

5) Domain Residuals $D$ : The Controlled Essence

5.1 Design constraint: $∥ D ∥ \leq 5$ rules + 100–300 term lexicon
5.2 Residual rule types (counter-intuition, exception routing, taboo transforms)
5.3 Packaging as EM-Pack plugins (opaque priors served via attestation; no plaintext leakage)
5.4 Versioning & AB testing (rollouts keyed to certification metrics)

6) Observer-Aligned Runtime: How Empowerment Executes

6.1 Tick & Trace: internal collapse and irreversibility
6.2 Cross-observer agreement & replicated logs
6.3 Slot accounting and capacity contention
6.4 Belt closure reporting (Gap/Flux/Twist/Residual; policy bands)
6.5 The READY-CHECK → MEASURE → AGGREGATE (CWA) → GOVERN (PBHL) loop

7) Certification: CWA / PRI / PBHL

7.1 CWA battery: commutation tests, cohorting, mean/sum permission
7.2 PRI estimation and policy thresholds
7.3 PBHL residual bands: Green ≤0.08; Amber ≤0.15; Red >0.15 (actions per band)
7.4 Why these gates correlate with reproducibility and safety

8) The Production Pipeline (Factory Model)

8.1 Stage A — Skeleton Selection (G): choose and stack from the 12
8.2 Stage B — Morphology Mapping (M): complete the 10 templates
8.3 Stage C — Residual Mining (D): SIDA deepening + MEEL multi-objective scoring to extract the minimal 3–5 rules
8.4 Stage D — Certification: run CWA/PRI/PBHL; only emit EM-Pack if all pass
8.5 Stage E — Packaging & Attestation: plugin manifest, hash, usage meter, audit endpoints

9) Interfaces and Data Contracts (copy-paste ready)

9.1 EM-Pack manifest (JSON)

{
  "name": "empack.domain.v1",
  "g_refs": ["G03.phase", "G08.pbhl", "G06.cwa"],
  "m_fills": { "units": "...", "instruments": "...", "controls": "...", "ledger": "..." },
  "d_rules": [
    {"id":"D1","if":"pattern/condition","then":"override/route"},
    {"id":"D2","if":"...","then":"..."}
  ],
  "lexicon": ["term1","term2","..."],
  "attestation": { "hash":"...", "server":"...", "policy":"PRI<=0.20 & CWA>=0.98" }
}

9.2 Trace schema (irreversible records: $τ, π, y$ , hash chain)
9.3 Belt report schema (Gap/Flux/Twist/Residual with band flags)
9.4 CWA result schema (tests, cohorts, grant/deny)

10) Evaluation Program and Falsification Plan

10.1 P1 Family Coverage Test: 30 blind domains → cluster into families → aim ≥60% pass with $∥ D ∥ \leq 5$
10.2 P2 Small-Residual Law: show upper bounds on $∥ D ∥$ for observable, low-adversary domains
10.3 P3 Failure Catalog: high $K$ cases (non-observability, non-commutation, drift, adversary) → propose new $G$ candidates
10.4 Metrics dashboard: sample efficiency, reproducibility, band time, error cost

11) Case Patterns (worked mini-maps)

11.1 TCM → $G$ : phase-lock, belt governance, substitution topology; $M$ : instruments (pulse, tongue, pattern sets); $D$ : syndrome exceptions & lexicon
11.2 Surplus Dynamics → $G$ : conservation/flow, surplus, PBHL; $M$ : capital/attention stocks, roles; $D$ : leak/role-flip exceptions
11.3 Peaks & Traps → $G$ : phase/criticality, peaks/traps, certified aggregation; $M$ : expectation loops; $D$ : lock-in breakers
11.4 ObserverOps (meta) → $G$ : runtime invariants, slot economics, CWA, PBHL; $M$ : cadence, audit; $D$ : none/minimal

Each shows the filled $M$ templates and 3–5 example $D$ rules.

12) Scaling Strategy: From 4 to 600–1200 Domains

12.1 Build the 12×10 G/M base matrix (workbench)
12.2 Curate 100 “families” and their canonical $M$ defaults
12.3 Run a D-harvest sprint per family (target ≤5 rules/domain)
12.4 Release cadence: monthly waves of EM-Packs with public dashboards
12.5 Continuous improvement: when $∥ D ∥$ regularly >10, promote a new $G$ skeleton

13) Governance, Safety, and Ethics

13.1 Non-commuting instruments and order effects
13.2 Guarding against “average kills truth” (CWA)
13.3 Belt-band actions under Red (halt, request human-in-the-loop, instrument swap)
13.4 Privacy of residual priors (opaque serving; no raw leakage)
13.5 Domain boundaries and misuse prevention

14) Business & Ecosystem Model

14.1 Capability-as-Attestation (CaaA): pay per certified output
14.2 Attractor Marketplace: third-party EM-Packs, but must pass certification
14.3 Open vs. closed: open $G / M$ and evaluation kits; licensed $D$
14.4 Incentive design: challenges that reward residual quality, not prompt tricks

15) Limitations and Failure Modes

15.1 High- $K$ domains and the cost of new skeletons
15.2 When $D$ refuses to stay small (true novelty vs. missing $G$ )
15.3 Adversarial drift and instrument poisoning
15.4 Organizational pitfalls (slot contention; audit debt)

16) Roadmap

16.1 Phase 0: Publish G/M kits + certification CLI
16.2 Phase 1: 10 families, 50 domains; publish live dashboards
16.3 Phase 2: 100 families, 600–1200 domains (rolling)
16.4 Phase 3: New $G$ skeleton program (fellows, prizes, AB test farms)

17) Appendices

A. Strong-Attractor kernel prompt (READY-CHECK, invariants, outputs)
B. CWA battery specs (tests, cohorting, pass/fail)
C. PBHL formulas & bands (Gap/Flux/Twist/Residual)
D. MEEL objective templates (cost, risk, fidelity, latency, ethics)
E. SIDA loop (deepening steps, stop conditions)
F. Sample filled $M$ templates for two domains
G. Glossary (skeletons, instruments, bands)

Optional: Sample “Strong-Attractor” Header (to include in EM-Packs)

SYSTEM // Strong-Attractor Kernel
- Enforce invariants: {internal-collapse, cross-observer-agreement, slot-conservation, belt-closure}
- Runtime loop: READY-CHECK → MEASURE → CWA(≥0.98)/PRI(≤0.20) → PBHL(band actions)
- Outputs: {TRACE, AGREEMENT, SLOTS, CWA, BELT} as JSON per turn
- If CWA denied or PBHL=Red: downgrade to order-sensitive estimator, request human-in-the-loop

Closing remark

This article blueprint turns the “empowerment ritual” into falsifiable engineering. If repeated P1/P2 results hold with small $D$ , we’ve exposed a long-standing civilizational blind spot and unlocked a practical route to industrial-scale knowledge integration. If they don’t, the failure surfaces exactly which new skeletons $G$ the world must invent next.

Executive Summary

Problem. AI teams routinely publish “rituals” (workflows, prompts, governance checklists) hoping to reproduce breakthrough capabilities in new domains. In practice, the rituals improve discipline and auditability but do not deliver the essential prior that makes an LLM actually competent in the target field. This paper proposes a reproducible way to industrialize insight so that capability gains become measurable, portable, and safe.

Proposal. We posit a decomposition of empowering priors:

E = G + M + D,

where $G$ is a compact library of General Skeletons (physics-like invariants and runtime guarantees), $M$ is a Morphology Mapping that aligns a concrete domain to one or more skeletons (units, instruments, controls, aggregation plan, belt ledger), and $D$ is a small set of domain residuals (3–5 counter-intuition rules plus a concise lexicon and edge-case notes). Under this factorization, most domains do not require inventing a full new theory; they require reusing $G$ , completing $M$ , and harvesting minimal $D$ .

Falsifiability and safety. The method stands or falls on certification gates tied to runtime signals:

CWA (commutation-safe aggregation) ≥ 0.98 to permit mean/sum;
PRI (phase-risk) ≤ 0.20 to limit order/phase sensitivity;
PBHL residual $r$ ≤ 0.08 (Green band) to maintain governed closure.
If a candidate EM-Pack fails these gates, it is not an empowerment—outputs must revert to order-sensitive estimators and/or human-in-the-loop governance.

What changes in practice. Instead of waiting for a monolithic “new theory per domain,” teams operate a factory pipeline: (A) choose and stack skeletons $G$ ; (B) fill 10 standardized mapping templates $M$ (units, instruments, controls, state space, intervention modes, aggregation plan, belt ledger, failure signatures, ethics, evidence contract); (C) mine ≤5 residual rules $D$ using SIDA deepening and MEEL multi-objective scoring; (D) certify (CWA/PRI/PBHL); (E) ship an attested EM-Pack as a plug-in. All executions run under Observer-aligned invariants (internal collapse, cross-observer agreement, slot conservation, belt closure) with immutable traces.

Scope and scale. With 12 canonical skeletons and 10 mapping templates, we anticipate covering ~100 domain families. If each family yields 5–10 adjacent domains by adjusting only $D$ , the realistic first wave is 600–1200 domains. This is not “one-click” magic; it is repeatable engineering with quantitative gates and audit logs.

Limits and triggers for new theory. The approach fails (and should honestly declare failure) when a domain exhibits high non-observability, non-commuting instruments, semantic drift, and adversarial pressure simultaneously. We summarize this with a difficulty discriminator $K$ . If $K$ exceeds policy thresholds, teams must invent new skeletons $G$ or invest in expensive experimentation (“data chemistry”). Failures are valuable: they pinpoint where new $G$ is needed.

Business and ecosystem. We recommend opening the $G/M$ kits and certification tooling, while distributing $D$ as opaque, attested EM-Packs (no plaintext leakage). This enables a Capability-as-Attestation model (pay per certified output) and a marketplace where third parties can publish EM-Packs—provided they pass the same gates.

Relation to the companion text. Chapter 3 of this paper introduces the 12 canonical skeletons with application-first guidance (interfaces, operators, signals, mistakes to avoid). A separate mini textbook will teach the theory of these skeletons from first principles. This division lets practitioners build now, while learners study the foundations at depth.

Claim in one line. If repeated evaluations show that small $D$ atop reusable $G$ and standardized $M$ reliably passes CWA/PRI/PBHL and raises capability, then we have exposed—and begun to fix—a long-standing blind spot in how civilization integrates knowledge: we can mass-produce empowerment, safely.

1) The Blind Spot in Knowledge Integration

1.1 Why “share protocols” never reproduced the essence

Ritual vs. Essence.

Ritual (R) is how you move: workflow order, checklists, review steps, prompt formats, governance forms, logging.
Essence (E) is what makes it work: the compact, domain-shaping priors that tell the system what to conserve, what to measure, how to combine measurements, and which exceptions overrule the default.

What open protocols reliably improve.

Auditability & reproducibility. Shared steps standardize traces, make failures debuggable, and reduce variance due to operator habits.
Coordination & safety. Teams align on cadence, interfaces, and guardrails; compliance becomes inspectable.

Why they rarely deliver capability leaps.

Hidden priors are not encoded. Protocol texts describe procedures but omit the projection dictionary (the small set of counter-intuitive rules and mappings that truly disambiguate the domain). Without that dictionary, identical steps compress different worlds into the same buckets.
Non-commuting instruments. When measurements interact (order/phase matters), naïve mean/sum collapses signals. Protocols seldom include commutation tests or fallback estimators, so essence is literally averaged away.
No unit/dimension alignment. Most playbooks skip “what is conserved” and “valid units.” The model then aggregates in ill-posed spaces, creating precise nonsense.
Slot contention. Procedures assume infinite attention/memory/tooling. In practice, limited “slots” force silent evictions; the first lost fact is often the essential one.
Template overfit. Generic sections (e.g., “Risks,” “KPIs”) invite plausible filler that looks disciplined but encodes zero domain leverage.
Drift without phase-lock. Rituals don’t compress the narrative to a minimal opcode; language meanders, and small phrasing shifts change decisions.
Evaluation asymmetry. Protocol success is judged by “did we follow the steps?” not by attested capability under disciplined aggregation and governance.

Net effect. Open rituals raise discipline (good) but, absent explicit priors and certified aggregation, they do not cross the capability threshold $E_c$ . Teams mistake clarity of process for power of understanding.

1.2 From monolithic theories to skeletonized integration

The cost of waiting for a grand theory per domain.

Latency. Full theories are rare, slow, and path-dependent; by the time consensus forms, the domain has shifted.
Fragility. Monoliths couple ontology, measurement, and governance; one refutation can stall the whole stack.
Exclusion. Only a handful of experts can extend the edifice; everyone else waits.

The opportunity: factorize insight.
We propose building empowering priors as

E = G + M + D

where:

$G$ — General Skeletons. A compact library of reusable invariants and operators (conservation/flow, phase/criticality, certified aggregation, belt governance, slot economics, etc.). We will introduce how to apply them (interfaces, signals, failure modes) here; a separate mini-textbook will teach their theory.
$M$ — Morphology Mapping. Ten standardized templates that align a concrete domain to selected skeletons: units & dimensions, instrument→operator mapping (with cadence), control variables, state constraints, intervention modes, aggregation plan, belt ledger, failure signatures, ethics, and evidence contract.
$D$ — Domain Residuals. The 3–5 counter-intuition rules plus a compact lexicon and edge-case table that capture what’s truly special in the domain.

Why skeletonization scales while preserving essence.

Reuse over reinvention. Most domains reuse the same handful of structural laws ( $G$ ); we only tailor the fit ( $M$ ) and add a tiny residual ( $D$ ).
Bounded difficulty. If $\|D\|$ stays small and aggregation is certified (no “average kills truth”), capability leaps become repeatable rather than miraculous.
Parallelizable production. Different teams can fill $M$ for different domains in parallel, mine $D$ with guided deepening, then pass common certification gates.
Transparent failure. When the approach breaks (non-observability, non-commuting instruments, semantic drift, adversarial pressure), the failure localizes to “we lack the right skeleton $G$ here,” focusing research on inventing new bones rather than arguing over rituals.

What this changes day-to-day.

You stop asking, “Where’s the theory for this domain?” and start asking, “Which skeletons apply, how do we map them, and what are the 3–5 residual rules we must learn?”
Progress is measured not by page counts of guidelines but by attested capability: certified aggregation (passes), governed residuals (in band), reproducible outputs (traces agree across observers).

Bottom line. The blind spot wasn’t a lack of process; it was a lack of explicit, portable priors and disciplined aggregation. Skeletonized integration surfaces and packages both—turning isolated brilliance into an industrial method without diluting the essence.

2) Hypothesis and Formal Model

2.1 Definition of $E = G + M + D$

Statement. Any actionable domain prior $E$ that empowers an LLM can be factorized into: a small set of General Skeletons $G$ , a Morphology Mapping $M$ that aligns the domain to those skeletons, and a compact Domain Residual $D$ holding only the irreducible counter-intuition and nomenclature.

$G$ — General Skeletons (reusable invariants & operators)

What it is. A compact library of reusable “bones” you stack as needed. Each skeleton ships with minimal operators, signals to watch, and misuse warnings. This paper focuses on how to apply them (interfaces, checks), deferring theory proofs to a companion text.

Typical members (examples):

Conservation / Flow (stock–flow operators; continuity checks).
Phase / Criticality (thresholds; bifurcation checks; early-warning indicators).
Belt Governance (PBHL) (Gap/Flux/Twist/Residual; band policies).
Surplus Dynamics (generation/absorption/leakage; role & type transforms).
Peaks & Traps (extrema; lock-ins; escape operators).
Phase-Lock (minimal opcode vocabularies; narrative entropy reduction).
Slot Economics (integer capacities for attention/memory/tools; allocation/evictions).
Substitution Topology (interference, replacement belts, compatibility).
Commuting Instruments (order-safety tests; cohorting).
Certified Aggregation (CWA/PRI) (grant/deny mean/sum).
Multi-Objective Trade-offs (MEEL) (explicit objectives; Pareto tracking).
Deepening Algorithms (SIDA) (safe internal deepening; stop rules).

Interface idea. Each $G_i$ exposes: required_units, measure(), aggregate(), govern(), signals, and deny_on.

$M$ — Morphology Mapping (domain → skeleton alignment)

What it is. A set of 10 fill-once templates that align a concrete domain to chosen skeletons. Done well, it tells the runtime what counts as units, what is measurable, and how to combine measurements safely.

Templates (the “M-10”):

Units & Dimensions (what is conserved vs. flows).
Instrument → Operator Map (which sensor feeds which $G$ operator; cadence $\tau$ ).
Control Variables (policy knobs; feasible sets).
State Space & Constraints (bounds; invariants; degeneracies).
Intervention Modes (soft prompts; structural edits; policy levers).
Aggregation Plan (when mean/sum is allowed; fallback estimators; cohort rules).
Belt Ledger (how to compute Gap/Flux/Twist; reporting cadence).
Failure Signatures (oscillations; lock-ins; collapses).
Ethics / Guardrails (non-goals; blocked instruments).
Evidence Contract (trace schema; hashes; JSON outputs).

Outcome. $M$ removes ambiguity so that two observers, running the same EM-Pack, commute to the same decision under the same data.

$D$ — Domain Residuals (controlled essence)

What it is. The small, irreducible “secret sauce”: 3–5 counter-intuition rules, a 100–300 term lexicon, and compact edge-case tables.

Design constraint. Keep $\|D\|$ small. If many exceptions are needed, you likely chose the wrong skeletons $G$ or left $M$ under-specified.

Packaging. Ship $D$ as an opaque, attested plugin (no plaintext leakage), exposing only interfaces and performance attestations.

2.2 Capability gain and gates

Capability model

\Delta C = f(G,M) - \lambda \|D\|, \quad \lambda>0.

$f(G,M)$ captures reusable structure and correct alignment;
$\|D\|$ penalizes brittle, ad-hoc exceptions.

How to measure $\Delta C$ in practice. Use a dashboard of sample efficiency, reproducibility (cross-observer agreement), error cost, and band time in PBHL. Gains that don’t pass the gates (below) do not count.

Gate 1 — Certified aggregation (CWA)

Problem. Arithmetic means/sums only preserve truth if the contributing instruments commute (order/phase doesn’t matter). Otherwise, “average kills truth.”

Test. For the target aggregator $A$ and batch $X$ , compute:

\text{CWA} = 1 - \mathbb{E}_{\pi}\left[\frac{\|A(X)-A(\pi(X))\|}{\sigma_{\text{base}}+\varepsilon}\right].

Policy. Grant mean/sum only if CWA ≥ 0.98. Else, deny and switch to order-sensitive estimators (e.g., sequence models, causal stacks) or re-cohort until commutation holds.

Gate 2 — Phase risk (PRI)

Idea. Even with partial commutation, outputs may still be sensitive to ordering. PRI estimates residual phase sensitivity of the decision.

\text{PRI} = \min\!\left(1,\ \frac{\mathrm{Var}_{\pi}[y(\pi(X))]}{\mathrm{Var}_{\text{boot}}[y(X)] + \varepsilon}\right).

Policy. Require PRI ≤ 0.20. If higher, downgrade aggregation or request human-in-the-loop.

Gate 3 — Belt closure (PBHL residual)

Idea. Governance must “close the loop”: planned Gap should be explained by realized Flux plus geometric Twist (structural/coupling effects).

r = \frac{\|\,\text{Gap} - \text{Flux} - \alpha\,\text{Twist}\,\|}{\|\text{Gap}\|+\varepsilon}.

Policy. Keep $r \le 0.08$ (Green band). Amber (≤0.15) requires mitigation; Red (>0.15) halts/rolls back.

Why these gates prevent “average-kills-truth”

CWA forbids mean/sum unless the algebra is safe → you don’t erase signal by illegal averaging.
PRI catches residual order sensitivity at the decision level → you don’t ship unstable judgments.
PBHL $r$ forces accountable dynamics → you don’t accumulate silent governance debt.

Together, they separate discipline from essence: you only claim empowerment when structure, alignment, and residuals produce stable, auditable gains.

2.3 When the model breaks

The $K$ discriminator

Define normalized (0–1) scores:

$\rho$ : Non-observability — key quantities cannot be measured or inferred with acceptable noise.
$\kappa$ : Non-commuting instruments — large commutators; CWA persistently low despite cohorting.
$\sigma$ : Semantic drift — rapid distribution shift; lexicon instability; ontology churn.
$\gamma$ : Adversarial pressure — strategic manipulation, gaming, poisoning, or high-stakes incentives.

Aggregate difficulty:

K = \rho \cdot \kappa \cdot \sigma \cdot \gamma.

Break policy

If $K \ge K_\star$ (e.g., 0.40), declare model break.
Action A: Propose/design a new skeleton $G'$ (extend the library).
Action B: Run data chemistry (experiments, instrumentation upgrades, new labels) to reduce $\rho$ or $\kappa$ .
Action C: Increase governance: narrow scope, raise thresholds (CWA/PRI), require human-in-the-loop, or sandbox deployment.

Diagnostic signals of break

$\|D\|$ inflates beyond policy (e.g., $k>10$ rules) just to pass gates → wrong $G$ or missing measurement.
CWA refuses to rise with reasonable cohorting → instruments inherently non-commuting for the decision.
PBHL $r$ sits in Amber/Red across cycles → unclosed governance, mis-modeled Twist, or unmeasured Flux.
PRI oscillates with small phrasing changes → phase-lock missing; narrative opcodes too large.

Practical takeaway

If gates pass with small $D$ : you’ve achieved portable empowerment—structure over ceremony.
If gates fail or $K$ is high: stop “adding rules”; either invent a new bone or upgrade the lab.

Chapter 3 — The 12 Canonical Skeletons $G$ (Application-First)

How to read each skeleton

Purpose – When to apply; what it guarantees.
Minimal operators – The smallest set of computations you actually need.
Expected signals – What to monitor to know it’s working.
Common misuses – Typical ways people break it.
Interface stub – Copy-paste configuration + function signatures.

3.1 Conservation & Flow

Purpose. Enforce unit-correct stock–flow accounting so nothing appears/disappears “by prose.” Use for anything that accumulates (inventory, cash, energy, attention, tokens, tasks).

Minimal operators.

State (stocks) $s_t \in \mathbb{R}^n$
Flows $f_t^{\text{in}}, f_t^{\text{out}} \in \mathbb{R}^n$
Sources/sinks $q_t \in \mathbb{R}^n$ (exogenous)
Update: $s_{t+1} = s_t + f_t^{\text{in}} - f_t^{\text{out}} + q_t$
Conservation error: $\varepsilon_{\text{cons}} = \|s_{t+1}^{\text{meas}} - s_{t+1}^{\text{model}}\|$

Expected signals.

$\varepsilon_{\text{cons}}$ stays near 0 (Green band).
Flow balance ratios per unit (e.g., outflow/inflow) stable within policy.
CWA passes on cohort-aggregated flows (commute under sum).

Common misuses.

Mixing rates and levels; averaging levels from different unit bases.
Double-counting internal transfers as both inflow and source.
Allowing negative stocks where physically impossible.

Interface stub.

{
  "g": "conservation_flow.v1",
  "units": ["items","kWh","USD","attention_min"],
  "state_vars": ["stock_A","stock_B"],
  "flows_in": ["prod_A","import_B"],
  "flows_out": ["ship_A","consume_B"],
  "sources_sinks": ["scrap_A","loss_B"],
  "policy": { "min_stock": 0, "tolerance_cons_error": 1e-6 }
}

def measure_flows(data)->Flows: ...
def step(state: Stocks, flows: Flows, q: Sources)->Stocks: ...
def audit(state_prev, state_next, measured_next)->dict:  # returns ε_cons, flags
    ...

3.2 Surplus Dynamics

Purpose. Track surplus (of matter, money, attention, optionality) as a driver of capacity and resilience. Use to separate generation, absorption, leakage, and structural transforms (role/type flips).

Minimal operators.

Surplus stock $S_t$ and components $\{S_t^{(k)}\}$ (material, financial, cognitive, institutional…).
Generation $g_t$ , absorption $a_t$ , leakage $\ell_t$ .
Transform tensors $T_t$ for role/type changes (e.g., opex→capex; viewer→buyer).
Update: $S_{t+1} = S_t + g_t - a_t - \ell_t + T_t$

Expected signals.

Generation ratio $g_t/S_t$ , leakage rate $\ell_t/S_t$ .
Capacity runway (periods of positive $S_t$ under baseline burn).
Stress index spikes when $\ell_t$ persists above policy bands.

Common misuses.

Treating “profit” as the only surplus; ignoring attention/option surplus.
Measuring leakage only on financial ledgers (missing time, cognition, reputation).
Confusing transforms with generation (relabeling ≠ new surplus).

Interface stub.

{
  "g": "surplus_dynamics.v1",
  "surplus_components": ["financial","attention","optionality"],
  "observe": { "g":"gen_signal", "a":"absorb_signal", "ell":"leak_signal" },
  "transforms": ["role_flip","type_shift"],
  "policy": { "band_leak_rate": { "green":"<=0.03", "amber":"<=0.08" } }
}

def estimate_generation(x)->float: ...
def estimate_leakage(x)->float: ...
def apply_transforms(S, events)->float: ...

3.3 Phase & Criticality

Purpose. Detect thresholds, bifurcations, regime shifts; act before a system flips irreversibly. Use in markets, safety ops, reliability, epidemiology, growth loops.

Minimal operators.

Order parameter $m$ (the behavior that changes regime).
Control parameter $\mu$ (load, R0, leverage, temperature-like).
Early-warning signals (EWS):
- Critical slowing down: rise in lag-1 autocorrelation $\rho_1$
- Variance $\mathrm{Var}(m)$ increase
- Skewness changes / flickering between states
Threshold test: crossing $\mu_\star$ or composite EWS index.

Expected signals.

EWS index trending up; PRI increases if narratives are phase-sensitive.
Hysteresis observed on stress-relaxation cycles.

Common misuses.

Calling noise “phase change” without a defined order parameter.
Acting on variance spikes caused by measurement drift (not dynamics).
Ignoring cohorting when instruments don’t commute.

Interface stub.

{
  "g": "phase_criticality.v1",
  "order_param": "m", "control_param": "mu",
  "ews": ["lag1_autocorr","variance","skewness","dfa_exponent"],
  "thresholds": { "mu_star": 1.0, "ews_star": 0.8 },
  "actions": { "precritical":"throttle", "supercritical":"halt+reconfigure" }
}

def ews_index(series)->float: ...
def regime(m, mu, ews)->str:  # {"subcritical","near-critical","supercritical"}
    ...

3.4 Peaks & Traps

Purpose. Identify local optima (peaks) and lock-ins (traps); plan escape operators (kick, re-seed, topology change) when gradient methods stall.

Minimal operators.

Potential/fitness surface $U(x)$ or reward proxy.
Trap depth $\Delta U$ , barrier width $w$ .
Expected escape time $T_{\text{esc}}$ (proxy via stochastic search / Kramers-like).
Escape operators:
- Kick (temporary resource spike / temperature)
- Re-seed (start from a different basin)
- Topology edit (add/remove constraints or couplings)

Expected signals.

Plateauing improvements with rising local curvature.
Gains resume after controlled kicks or topology edits.

Common misuses.

Declaring a trap without estimating barrier (depth/width).
Infinite kicking (overheating) instead of changing topology.
Averaging non-commuting objectives into one scalar (destroying shape).

Interface stub.

{
  "g": "peaks_traps.v1",
  "objective": "U(x)",
  "diagnostics": ["local_curvature","ΔU","w","T_escape_est"],
  "escape_plan": ["kick:temp=0.2,dur=10","reseeds=3","topology_edit:relax_constraint=C2"]
}

def detect_trap(trace)->dict:  # returns {"ΔU":..., "w":..., "T_escape":..., "is_trap":bool}
    ...
def escape(state, plan)->state: ...

3.5 Observer-Runtime Invariants

Purpose. Make the system auditable and reproducible across observers: no retro-edits, shared records, finite capacity accounting, and closed governance loops.

Minimal operators.

Internal collapse (write-once): record $(\tau,\pi,y)$ → immutable trace.
Cross-observer agreement: replicate/compare traces → agreement score.
Slot conservation: integer capacities for attention/memory/tools; log allocation/eviction.
Belt closure: compute Gap/Flux/Twist/Residual; act by band.

Expected signals.

Trace coverage ≥ policy (e.g., ≥99% of decisions logged).
Agreement score ≥ threshold across replicas/cohorts.
Slot utilization within limits; no silent evictions.
Residual $r$ in Green band.

Common misuses.

Retro-editing traces (“fixing history”).
Tool sprawl without slot accounting (ghost side-effects).
Belt reports that list numbers but trigger no actions.

Interface stub.

{
  "g": "observer_runtime_invariants.v1",
  "trace_schema": ["tau","policy_id","inputs_hash","decision","evidence_hash"],
  "agreement": { "replicas": 2, "min_score": 0.98 },
  "slots": { "attention": 8, "memory": 4, "tools": 3 },
  "belt_policy": { "green":"r<=0.08","amber":"r<=0.15","red":">0.15" }
}

def write_trace(tau, policy_id, inputs, decision, evidence)->Hash: ...
def check_agreement(replica_logs)->float: ...
def allocate_slot(kind)->bool: ...
def belt_report(metrics)->dict:  # returns r, band, required_action
    ...

3.6 Certified Aggregation (CWA/PRI)

Purpose. Decide when averaging/summing is lawful. Prevent “average-kills-truth” by granting mean/sum only if instruments commute and phase/order sensitivity is acceptably low.

Minimal operators.

Cohorting. Partition inputs so that instruments inside a cohort are expected to commute (same unit, protocol, cadence).
CWA (commutation) test: estimate how invariant an aggregator $A$ (mean/sum) is to permutations $\pi$ of the cohort.
$\text{CWA}=1-\mathbb{E}_{\pi}\!\left[\frac{\|A(X)-A(\pi(X))\|}{\sigma_{\text{base}}+\varepsilon}\right]$
Grant mean/sum iff CWA ≥ 0.98.
PRI (phase risk) on the decision $y$ :
$\text{PRI}=\min\!\left(1,\frac{\mathrm{Var}_{\pi}[\,y(\pi(X))\,]}{\mathrm{Var}_{\text{boot}}[\,y(X)\,]+\varepsilon}\right)$
Permit deployment iff PRI ≤ 0.20.
Fallback estimators. If denied: use order-sensitive methods (sequence/causal aggregators, weighted voting, trimmed/quantile ops) or re-cohort.

Expected signals.

Grant rate (fraction of cohorts with CWA pass).
PRI median and tail (95th percentile) on shipped decisions.
Fallback share and error delta vs. granted mean/sum.
Cohort size distribution (avoid tiny underpowered cohorts).

Common misuses.

Running mean/sum without commutation tests.
Cohorting on outcomes (leaks label information) instead of instruments/units.
Using too few permutations (CWA unstable); ignoring drift across time windows.
Mixing levels and rates in the same aggregator.

Interface stub.

{
  "g": "certified_aggregation.v1",
  "aggregators": ["mean","sum","trimmed_mean:p=0.1","quantile:q=0.5"],
  "cohort_keys": ["unit","instrument","cadence","protocol"],
  "thresholds": { "cwa": 0.98, "pri": 0.20, "min_cohort": 30, "permutations": 200 },
  "fallback": { "order_sensitive": "sequence_lstm", "recohort": true }
}

def cohort(records, keys)->list[list]: ...
def test_cwa(cohort, A, P=200)->float: ...
def estimate_pri(cohort, decision_fn, P=200)->float: ...
def aggregate_or_fallback(cohort)->Decision:
    cwa = test_cwa(cohort, A="mean")
    pri = estimate_pri(cohort, decision_fn)
    if cwa>=0.98 and pri<=0.20: return mean(cohort)
    return sequence_estimator(cohort)  # or re-cohort

3.7 Slot Economics

Purpose. Make attention/memory/tool capacity explicit and integer. Prevent silent overcommit (hallucinations, tool thrash, lost context) by allocating/evicting with logs.

Minimal operators.

Slot classes: attention, memory, tools, i/o.
Capacities: integers per class (e.g., attention=8).
Policies: reservation (high-priority tasks), eviction (LRU, LFU, cost-aware), preemption rules.
Accounting: every allocation/eviction writes an immutable slot event; decisions must cite the slot footprint.

Expected signals.

Utilization per class, thrash rate (evictions/turn), SLA misses (latency spikes), overflow denials (properly denied instead of silent failure).
Decision quality vs. footprint: diminishing returns after certain slot counts.

Common misuses.

Allowing “elastic” slots that expand silently.
Hidden recursion/tool fan-out without slot checks.
Evicting evidence needed for later audit.
Not pricing latency and risk into slot priority.

Interface stub.

{
  "g": "slot_economics.v1",
  "capacities": { "attention": 8, "memory": 4, "tools": 3, "io": 2 },
  "reservation": [{ "policy":"critical_decision", "attention": 4 }],
  "eviction": { "attention": "LRU", "memory": "cost_aware", "tools": "LFU" },
  "pricing": { "latency_ms_per_slot": 15, "risk_weight": 2.0 }
}

def request_slot(kind, n=1, priority=0)->bool: ...
def release_slot(kind, n=1)->None: ...
def evict(kind)->SlotId: ...
def slot_audit()->dict:  # utilization, thrash, denials
    ...

3.8 Belt Governance (PBHL)

Purpose. Close the loop between plan and reality. Compute geometric Gap/Flux/Twist; act by Residual band so governance is not a dashboard but an actuator.

Minimal operators.

Gap: planned change or target delta for a metric vector $g$ .
Flux: realized change $f$ from measurements over the same window/cohort.
Twist: coupling/geometry term $t$ (constraint interactions, substitutions).
Residual (normalized):
$r = \frac{\|\,g - f - \alpha t\,\|}{\|g\|+\varepsilon}$
Bands & actions: Green (≤0.08) → proceed; Amber (≤0.15) → mitigate; Red (>0.15) → halt/rollback/escalate.

Expected signals.

Time-in-band (share of ticks in Green).
Twist ratio $\|t\|/\|g\|$ (structure biting?).
Action adherence (% of prescribed actions actually executed).
Residual trend after interventions (should decline).

Common misuses.

Unit mismatch between Gap and Flux; computing per different cadences.
Setting $\alpha=0$ (pretending structure doesn’t exist).
Producing belt reports without executing band actions.
Gaming by redefining Gap every tick to zero.

Interface stub.

{
  "g": "pbhl_belt_governance.v1",
  "alpha": 0.6,
  "bands": { "green": 0.08, "amber": 0.15 },
  "actions": {
    "green": ["continue"],
    "amber": ["reduce_scope:20%","increase_measurement_cadence:2x","assign_owner"],
    "red": ["halt","rollback","escalate_to_human"]
  },
  "ledger": ["Gap","Flux","Twist","Residual","Band","Action","Owner","Timestamp"]
}

def compute_belt(gap, flux, twist, alpha=0.6)->dict:  # returns r, band
    ...
def govern(band)->list[str]:  # returns required actions
    ...
def record_belt_entry(entry)->Hash: ...

3.9 Phase-Lock & Symbol Kernels

Purpose. Reduce narrative entropy and phase drift by constraining language to a minimal opcode vocabulary with explicit grammar. This locks the model’s “semantic phase” so the same prompts yield stable decisions.

Minimal operators.

Opcode set $\Omega$ (e.g., 120–300 canonical tokens/phrases).
Grammar/automaton $\mathcal{G}$ (allowed sequences; sections/slots).
Canonicalization rules (normalize synonyms, units, tense; forbid hedges).
Entropy gauges: opcode perplexity $PPL_\Omega$ , KL to canonical bigram model, PRI change after lock.

Expected signals.

Drop in narrative entropy (lower $PPL_\Omega$ ).
Higher cross-observer agreement on section outputs.
PRI reduction (decisions less order-sensitive).
Rejection rate (off-vocab/illegal grammar blocked early).

Common misuses.

Over-pruning (so small $\Omega$ that nuance is lost).
Letting style kits creep in (multiple dialects ⇒ phase jitter).
Post-lock paraphrasers that re-expand synonyms (undoing the lock).
Forgetting unit canonicalization (e.g., kWh vs. Wh vs. “electricity”).

Interface stub.

{
  "g": "phase_lock_symbols.v1",
  "opcodes": ["DEFINE","ASSUME","EVIDENCE","RISK","DECISION","PBHL:Gap","PBHL:Flux","..."],
  "grammar": [
    "DOC := HEADER SECTION+ FOOTER",
    "SECTION := (DEFINE|EVIDENCE|ANALYSIS|DECISION)",
    "DECISION := 'DECISION' ':' CLAIM JUSTIFICATION PBHL_BELT"
  ],
  "canonicalization": {
    "units": { "usd":"USD", "kwh":"kWh" },
    "forbid": ["maybe","might","sort of","kinda"],
    "synonyms": { "risk":"RISK", "hazard":"RISK" }
  },
  "thresholds": { "max_ppl_op": 2.0, "max_kl": 0.15 }
}

def tokenize_to_opcodes(text, opcodes)->list[str]: ...
def check_grammar(op_tokens, grammar)->bool: ...
def canonicalize(text, rules)->str: ...
def lock_and_validate(text)->dict:  # returns {"ok":bool, "ppl":..., "kl":..., "errors":[...]}
    ...

3.10 Multi-Objective Trade-offs (MEEL)

Purpose. Make trade-offs explicit, auditable, and stable when multiple objectives conflict (accuracy vs. latency vs. cost vs. risk/ethics). Produce a Pareto-sound decision with clear sensitivity to weights.

Minimal operators.

Objective vector $\mathbf{J}(x)=\big(J_1(x),\dots,J_m(x)\big)$ with units and directions (min/max).
Constraints $g_k(x)\le 0$ , hard guards (safety/ethics), and band costs from PBHL.
Dominance test and Pareto set $\mathcal{P}$ .
Scalarizations (only for selection, not hiding trade-offs): weighted sum, $\epsilon$ -constraint, Tchebycheff.
Knee-point/hypervolume heuristics for “best compromise”.
Uncertainty layer (CIs on $J_i$ ); CWA/PRI enforced when aggregating across cohorts.

Expected signals.

Hypervolume ↑ across iterations; constraint violation ↓ to zero.
Weight sensitivity: selected decision stable within policy ranges.
Fairness/ethics parity (e.g., max group gap ≤ threshold).
PBHL residual improves post-deployment.

Common misuses.

Hiding objectives via a single weighted sum with post-hoc weight edits.
Mixing units/directions; aggregating non-commuting evidence (no CWA).
Ignoring uncertainty (selecting on noisy front tips).
Treating hard ethics as soft penalties.

Interface stub.

{
  "g": "meel_tradeoffs.v1",
  "objectives": [
    {"name":"error_rate","direction":"min","unit":"%"},
    {"name":"latency","direction":"min","unit":"ms"},
    {"name":"cost","direction":"min","unit":"USD"},
    {"name":"risk","direction":"min","unit":"score"}
  ],
  "constraints": [
    {"name":"fairness_gap","bound": 0.03, "type":"hard"},
    {"name":"pbhl_band","bound":"green_only","type":"hard"}
  ],
  "selection": { "method":"epsilon_constraint", "epsilon":{"risk":0.1,"fairness_gap":0.03} },
  "uncertainty": {"bootstrap": 200, "ci": 0.9}
}

def evaluate_objectives(x)->dict: ...                     # returns J_i with CIs
def pareto_sort(candidates)->list: ...                    # returns Pareto set
def knee_point(pareto)->dict: ...                         # compromise locator
def select(pareto, method, params)->dict: ...             # final decision
def sensitivity(pareto, weights_grid)->dict: ...          # stability report

3.11 Deepening Algorithm (SIDA)

Purpose. Perform safe internal deepening—only dig deeper when evidence gain justifies capacity/risk. Produce a compact, auditable evidence core instead of sprawling rabbit holes.

Minimal operators.

Deepening graph $\mathcal{T}$ : nodes = hypotheses/evidence; edges = drill paths.
Info-gain metric $\Delta I$ per step (e.g., reduction in decision entropy / error bars).
Stop rules (any triggers halt):
- $\Delta I < \theta_I$ for $h$ consecutive steps;
- PBHL residual worsens beyond band;
- Slot budgets hit;
- CWA/PRI fail on new aggregated evidence.
Compaction: deduplicate and compress evidence to a minimal set that supports the decision (with provenance).
Contradiction detector: flags mutually exclusive claims & routes to MEEL/PBHL governance.

Expected signals.

Info-gain per step declines (diminishing returns curve).
Compaction ratio (raw:evidence_core) high (e.g., ≥ 5:1).
Provenance coverage: % of final claims backed by hashes/logs.
Contradiction rate low and resolved before decision freeze.

Common misuses.

Deepening without a hypothesis (aimless exploration).
Compaction after publishing the decision (audit gap).
Ignoring slot budgets; unbounded tool recursion.
Treating new contradictory evidence as append-only (no resolve).

Interface stub.

{
  "g": "sida_deepening.v1",
  "budgets": { "attention": 4, "tools": 2, "depth": 3 },
  "stops": { "min_info_gain": 0.02, "max_contradictions": 0, "pbhl_band":"green_only" },
  "compaction": { "target_ratio": 5.0 },
  "outputs": ["evidence_core","provenance_log","contradiction_report"]
}

def propose_paths(state)->list: ...                       # where to dig
def deepen_once(path)->dict: ...                          # fetch/analyze
def info_gain(prev, curr)->float: ...
def should_stop(metrics, budgets)->bool: ...
def compact_evidence(items)->list: ...                    # minimal support set
def deepening_report(core, provenance, contradictions)->dict: ...

3.12 Substitution / Topology

Purpose. Model replacement and interference among capabilities/technologies/policies. Plan migration paths (hybrids, phased rollouts) that respect constraints and avoid hidden cannibalization.

Minimal operators.

Capability graph $G=(V,E)$ , nodes = functions/resources; edges = couplings.
Substitution matrix $S_{ij}$ (share of $j$ that capability $i$ can replace).
Compatibility matrix $C_{ij}\in[0,1]$ (how well $i$ coexists with $j$ ).
Interference term $\Theta_{ij}$ (negative synergies / bottlenecks).
Belt levels (legacy→hybrid→new) with actions per level.
Path planner: compute rollout that maximizes PBHL improvement and minimizes risk/cost subject to slot/cadence constraints.

Expected signals.

Substitution pressure (planned Gap vs. realizable Flux given $\Theta$ ).
Cannibalization index (losses in adjacent nodes).
Time-to-parity (when new reaches legacy performance under constraints).
Residual $r$ declines as belts advance; Twist spikes during hybrid phases but returns to baseline.

Common misuses.

Assuming 1:1 substitution (ignoring partial $S_{ij}$ ).
Ignoring bottlenecks (infrastructure, compliance, workforce).
Double-counting benefits across coupled nodes.
Forcing immediate cut-over instead of hybridizing where $C_{ij}$ low but nonzero.
Aggregating across non-commuting metrics without CWA.

Interface stub.

{
  "g": "substitution_topology.v1",
  "nodes": ["legacy_app","hybrid_stack","new_service","infra","ops"],
  "S": { "new_service->legacy_app": 0.7, "hybrid_stack->legacy_app": 0.3 },
  "C": { "new_service,infra": 0.6, "hybrid_stack,ops": 0.8 },
  "Theta": { "new_service,infra": 0.3, "new_service,ops": 0.2 },
  "belts": ["legacy","hybrid","new"],
  "actions": {
    "legacy": ["throttle_old:10%"],
    "hybrid": ["dual_run:8w","buffer_capacity:+20%"],
    "new": ["decommission_old","redistribute_slots"]
  },
  "objective": { "pbhl_residual":"min", "cost":"min", "risk":"min" },
  "constraints": { "slots.attention<=10": true, "cwa>=0.98": true }
}

def simulate_substitution(graph, S, C, Theta, belts)->dict: ...
def compute_path(graph, objective, constraints)->list: ... # sequence of belt actions
def detect_interference(trace)->list: ...                   # hotspots to mitigate
def recommend_migration(plan, hotspots)->Report: ...

Chapter 4 — The 10 Morphology Mapping Templates $M$

How to use this chapter: each template includes Purpose → Checklist → Example Fill-in → Interface stub. Examples use a neutral domain: “City Bike-Share Operations” (inventory/usage safety-critical, easy to imagine). Where useful, I add a compact second example.

4.1 Units & Dimensions Map (what is conserved, what flows)

Purpose. Make units/levels/rates explicit so conservation checks and lawful aggregation are possible.

Checklist.

List stocks (levels): bikes, docks, battery-kWh, cash.
List flows (rates): trips/h, rebalancing moves/h, charge kW, $ /day.
Define unit transforms (min↔h, kW·h=kWh).
Mark non-negative and bounded variables.
Identify sources/sinks (new bikes, scrap, subsidies).

Example fill-in (Bike-Share).

Stocks: bikes_on_street [units], bikes_in_depot [units], dock_slots [units], battery_energy [kWh], cash_balance [USD].
Flows: rides_start [1/h], rides_end [1/h], rebalance_pick [1/h], rebalance_drop [1/h], charge_power [kW], opex [USD/day].
Transforms: kW * h → kWh; 1/h * h → 1.
Bounds: bikes_on_street ≥ 0, battery_energy ∈ [0, cap].

Interface stub.

{
  "M1_units_dimensions": {
    "stocks": [
      {"name":"bikes_on_street","unit":"unit","min":0},
      {"name":"battery_energy","unit":"kWh","min":0,"max":"cap_kWh"}
    ],
    "flows": [
      {"name":"rides_start","unit":"1/h"},
      {"name":"charge_power","unit":"kW"}
    ],
    "transforms": [
      {"from":["kW","h"],"to":"kWh"}
    ],
    "sources_sinks": ["new_bikes:unit","scrap:unit","subsidy:USD/day"]
  }
}

4.2 Instrument → Operator Map (what we can measure & commute, with cadence $\tau$ )

Purpose. Tie sensors/logs to skeleton operators (from Chapter 3) and specify cadence $\tau$ so commutation/cohorting is feasible.

Checklist.

For each measurement, define instrument id, unit, cadence $\tau$ , lag, error model.
Map to skeleton operators: Conservation step, PBHL Gap/Flux/Twist, Phase EWS, etc.
Choose cohort keys (unit, instrument family, protocol, timezone).
Predeclare non-commuting pairs (order-sensitive).

Example fill-in (Bike-Share).

Instruments:
- iot.dock_occupancy: unit=unit, $\tau$ =1 min, lag=10 s → Conservation/Flow + PBHL Flux
- app.trip_events: unit=events, $\tau$ =event, lag<1 s → Conservation/Flow
- bms.power_meter: unit=kW, $\tau$ =1 min → Conservation (energy), PBHL Flux
- ops.rebalance_log: unit=units moved, $\tau$ =event → Twist (coupling street↔depot)
Cohort keys: unit, instrument_family, cadence_bucket, protocol.

Interface stub.

{
  "M2_instrument_operator": {
    "instruments": [
      {"id":"iot.dock_occupancy","unit":"unit","tau_sec":60,"lag_sec":10,
       "maps_to":["G1.conservation","G8.pbhl.flux"]},
      {"id":"ops.rebalance_log","unit":"unit","tau_sec":"event",
       "maps_to":["G8.pbhl.twist"]}
    ],
    "cohort_keys":["unit","instrument_family","cadence_bucket","protocol"],
    "non_commuting":[["app.trip_events","ops.rebalance_log"]]
  }
}

4.3 Control Variable Taxonomy (policy/knob surfaces and feasible sets)

Purpose. Enumerate the knobs you can actually turn, with domains, bounds, and coupling constraints—so MEEL trade-offs and PBHL actions have real levers.

Checklist.

List policy knobs (continuous / discrete).
Define feasible sets and couplings (e.g., staffing ≤ shifts × seats).
Tag cost/latency/risk for each knob movement.
Specify cadence (how often allowed to change).
Mark ownership (who approves).

Example fill-in (Bike-Share).

Knobs:
- rebalance_rate [units/h] ∈ [0, 120], cost=$40/h/van, cadence=15 min, owner=Ops.
- price_per_min [USD/min] ∈ [0.05, 0.60], risk=churn, cadence=10 min, owner=Revenue.
- charge_setpoint [kW] ∈ [0, 50], constraint: depot feeder ≤ 300 kW, owner=Facilities.
Couplings: sum(charge_setpoint) ≤ feeder_cap; rebalance_rate ≤ vans×capacity_per_van.

Interface stub.

{
  "M3_controls": {
    "knobs": [
      {"name":"rebalance_rate","type":"continuous","unit":"unit/h",
       "min":0,"max":120,"cost_per_unit":0.333,"cadence_min":15,"owner":"Ops"},
      {"name":"price_per_min","type":"continuous","unit":"USD/min",
       "min":0.05,"max":0.60,"risk":"churn","cadence_min":10,"owner":"Rev"}
    ],
    "constraints": [
      "sum(charge_setpoint)<=feeder_cap_kW",
      "rebalance_rate<=vans*capacity_per_van"
    ]
  }
}

4.4 State Space & Constraints (bounds, invariants, degeneracy)

Purpose. Define the state vector, its legal region, and invariants to avoid illegal plans and to support Phase/Criticality checks.

Checklist.

Declare state vector $x$ (levels + latent).
Define bounds and invariants (e.g., bikes_on_street + bikes_in_depot = total_bikes − scrap).
Identify degenerate subspaces (e.g., zero-dock areas).
Provide projection/feature maps used by skeletons (order parameter $m$ , control $\mu$ ).
Supply reset/initialization rules.

Example fill-in (Bike-Share).

State:
$x = [bikes\_on\_street_i, bikes\_in\_depot, dock\_slots_i, battery\_energy, cash]$ across zones $i$ .
Invariants:
$\sum_i bikes\_on\_street_i + bikes\_in\_depot = total\_bikes - scrap$ .
Degeneracy: zones with dock_slots_i = 0 (no placement allowed).
Phase features:
$m =$ “empty-dock fraction variance across zones”;
$\mu =$ demand load (trips/h) vs. capacity.

Interface stub.

{
  "M4_state_space": {
    "state_vector": ["bikes_on_street[*]","bikes_in_depot","dock_slots[*]","battery_energy","cash"],
    "invariants": [
      "sum(bikes_on_street)+bikes_in_depot = total_bikes - scrap"
    ],
    "bounds": [
      {"var":"battery_energy","min":0,"max":"cap_kWh"}
    ],
    "degenerate_sets": ["dock_slots[*]==0"],
    "features": {
      "order_param":"var(empty_dock_fraction_by_zone)",
      "control_param":"demand_load_per_capacity"
    },
    "reset_rules": ["if blackout: set charge_setpoint=0; preserve trace"]
  }
}

4.5 Intervention Modes (soft prompts, policy levers, structural edits)

Purpose. Enumerate how the system may act—ranging from reversible, low-risk “nudges” to high-impact structural changes—so decisions produced by MEEL/PBHL translate into legal, timely, and safe interventions.

Checklist.

Classify interventions by mode and reversibility:
Soft (messages, UI changes, ranking weights), Policy (prices, quotas, service levels), Structural (topology/capacity/roles).
Define latency, rollout scope, blast radius, owner, approval gates.
Attach pre-conditions (CWA/PRI pass, PBHL band) and post-conditions (belt re-measurement, rollback criteria).
Specify risk score and fallback per action.
Log before/after diffs to trace.

Example fill-in (Bike-Share).

Soft:
- in-app_demand_nudge(zone=z), latency=seconds, scope=cohort(z), owner=Growth, pre: CWA≥0.98 & PRI≤0.2, post: measure Flux(ride starts in z) @ 10-min.
Policy:
- price_per_min += 0.05 USD/min in zones Z*, latency=10 min, scope=multi-zone, owner=Revenue, risk=med, rollback: PBHL r>0.15.
Structural:
- add_temp_docks(z)=+30 slots, latency=2 days, owner=Ops, risk=high, approval: Ops Dir + City permit, rollback: remove after demand season.

Interface stub.

{
  "M5_interventions": {
    "catalog": [
      {"id":"nudge.demand","mode":"soft","latency_sec":5,"reversible":true,
       "owner":"Growth","pre":{"cwa":0.98,"pri":0.20,"band":"green_or_amber"},
       "post":{"measure":"rides_start","window_min":10,"rollback_on":"pbhl.red"}},
      {"id":"policy.price.bump","mode":"policy","latency_min":10,"reversible":true,
       "owner":"Revenue","risk":"medium","pre":{"band":"green_only"},
       "post":{"rollback_on":"band.red || churn_delta>2%"}},
      {"id":"struct.temp_docks","mode":"structural","latency_hours":48,"reversible":true,
       "owner":"Ops","risk":"high","approvals":["OpsDirector","City"],
       "pre":{"band":"amber_or_red","twist_ratio_min":0.2},"post":{"review_days":30}}
    ],
    "fallbacks": {
      "on_pri_high":"downgrade_to_soft_nudge",
      "on_cwa_fail":"recohort_then_retry"
    }
  }
}

def can_execute(action_id, context)->bool: ...      # checks pre-conditions
def execute(action_id, params)->ActionReceipt: ...
def rollback(action_receipt)->None: ...
def post_measure(action_receipt)->dict: ...         # PBHL delta, KPIs

4.6 Aggregation Plan (mean/sum vs. order-sensitive fallback; cohorting rules)

Purpose. Declare when arithmetic aggregators are lawful and what to do when they are not. This template operationalizes CWA/PRI policies from G-3.6.

Checklist.

Define primary aggregators (mean, sum, trimmed mean, quantiles) and order-sensitive fallbacks (sequence/causal estimators).
Choose cohort keys (unit, instrument, cadence, protocol, timezone, population slice).
Set grant thresholds: CWA, PRI, min cohort size, max drift window.
Specify permutation budget (e.g., 200) and drift windows (e.g., rolling 1h/24h).
Write deny routes (re-cohort, fallback, human-in-the-loop).
Record aggregation trace (hash of members, grant/deny flags).

Example fill-in (Bike-Share).

Aggregators: sum(rides_start) per zone/h; mean(wait_time); trimmed_mean(p=0.1) for outlier-prone metrics.
Fallbacks: sequence_estimator for wait_time when order effects present.
Cohorts: by zone, instrument_family, cadence_bucket, time_of_day.
Thresholds: CWA≥0.98, PRI≤0.20, min_cohort=30 observations/hour, permutations=200.
Drift: detect if base distribution shift > KS=0.1 over 24h → auto re-cohort.

Interface stub.

{
  "M6_aggregation_plan": {
    "aggregators": [
      {"name":"sum","fields":["rides_start"],"cadence":"1h"},
      {"name":"mean","fields":["wait_time"],"cadence":"15min"},
      {"name":"trimmed_mean","fields":["charge_time"],"params":{"p":0.1}}
    ],
    "fallbacks": [
      {"name":"sequence_estimator","for":["wait_time"],"model":"causal_rnn"}
    ],
    "cohort_keys":["zone","instrument_family","cadence_bucket","tod4"],
    "thresholds":{"cwa":0.98,"pri":0.20,"min_cohort":30,"permutations":200},
    "drift":{"window_hours":[1,24],"ks_threshold":0.1},
    "deny_routes":["recohort","fallback","human_review"]
  }
}

def make_cohorts(X, keys)->list[list]: ...
def grant_mean_sum(cohort)->bool: ...   # runs CWA/PRI, size checks
def aggregate(cohort, spec)->dict: ...
def fallback_estimate(cohort, spec)->dict: ...
def log_agg_trace(cohort, spec, granted)->Hash: ...

4.7 Belt Ledger Mapping (how Gap/Flux/Twist/Residual are computed)

Purpose. Define exactly how to compute PBHL terms for this domain and where they are stored, so governance is actuated (not just visualized).

Checklist.

Define Gap vector $g$ (targets over window), units & cadence.
Define Flux $f$ (realized change from instruments) and cohort alignment (same units, window).
Define Twist $t$ (couplings: substitution, constraints, geometry).
Choose $\alpha$ (coupling weight) and Residual $r=\|g-f-\alpha t\|/\|g\|$ .
Set bands and actions (Green/Amber/Red).
Specify ledger schema (fields, hash chain) and report cadence.
Map owners per metric and SLA to act (e.g., Amber → 2h mitigation).

Example fill-in (Bike-Share).

Gap $g$ : target “reduce empty-dock rate variance by 20% in 24h”; units=percentage points.
Flux $f$ : realized variance reduction from iot.dock_occupancy cohorts @ 24h window.
Twist $t$ : coupling from ops.rebalance_log (street↔depot interaction) + charge_setpoint limits (feeder bottleneck).
$\alpha=0.6$ .
Bands: Green ≤0.08, Amber ≤0.15, Red >0.15.
Actions: Amber → increase rebalancing +10% & raise measurement cadence 2×; Red → halt price changes + escalate.

Interface stub.

{
  "M7_belt_ledger": {
    "gap": {
      "name":"var_empty_dock_reduction",
      "unit":"pct_point","window":"24h","target_delta":-20
    },
    "flux": {
      "source":"iot.dock_occupancy","cohort":"zone","window":"24h",
      "compute":"var_reduction"
    },
    "twist": {
      "sources":["ops.rebalance_log","bms.power_meter","controls.charge_setpoint"],
      "model":"coupling_linear","params":{"weights":{"rebalance":0.7,"feeder":0.3}}
    },
    "alpha": 0.6,
    "bands": {"green":0.08,"amber":0.15},
    "actions": {
      "green":["continue"],
      "amber":["rebalance_rate:+10%","measure_cadence:x2","assign_owner:Ops"],
      "red":["halt:price_changes","rollback:last_policy","escalate:director"]
    },
    "ledger_schema": [
      "ts","gap","flux","twist","alpha","residual_r","band","actions","owner","hash_prev","hash_curr"
    ],
    "report_cadence":"1h"
  }
}

def compute_gap(targets, window)->np.ndarray: ...
def compute_flux(measurements, cohort, window)->np.ndarray: ...
def compute_twist(couplings, params)->np.ndarray: ...
def residual(g,f,t,alpha=0.6)->float: ...
def band_actions(r, bands)->list[str]: ...
def write_ledger(entry)->Hash: ...

4.8 Failure Signature Library (common traps, oscillations, collapses)

Purpose. Pre-register recognizable failure patterns so the runtime can auto-diagnose and route to PBHL/MEEL actions before damage accumulates.

Checklist.

Catalog failure classes with signal predicates and confirmatory tests.
Provide first-aid actions (recohort, throttle, rollback, human-in-the-loop).
Map each failure to root cause candidates (measurement, commutation, control, topology).
Tie to stop conditions (SIDA, PBHL Red, ethics guards).
Include recovery metrics and exit criteria.

Canonical classes & signals (generic).

O1: Limit-cycle oscillation. Periodic sign flips in control error; spectral peak near control cadence; autocorrelation $\rho_k$ at $k=\tau$ > 0.6.
Actions: halve gain, increase measurement cadence, add delay compensation, freeze non-essential knobs.
O2: Drift/creep. Monotone bias in residuals; KS shift > 0.1 over 24h; covariate shift alarms.
Actions: re-cohort, recalibrate units, retrain fallback estimator, tighten PRI gate.
O3: Lock-in trap. Plateau with rising local curvature; no improvement despite kicks; escape time $T_{\text{esc}}$ increases.
Actions: invoke Substitution/Topology planner; schedule hybrid belt; allocate buffer capacity.
O4: Non-commuting aggregation. CWA < 0.98 or PRI > 0.20 persists despite cohorting.
Actions: disable mean/sum, force order-sensitive estimator, redesign instruments.
O5: Instrument poisoning / adversary. Sudden entropy drop with performance collapse; feature importance flips; anomaly ratio spikes.
Actions: quarantine cohorts, roll back to last attested model, enable human review, rotate keys/sensors.
O6: Ethics/guard breach. Blocked instrument used; non-goal optimized; fairness gap > bound.
Actions: immediate halt, ethics review, evidence export.

Example fill-in (Bike-Share).

O1 (Oscillation): price_per_min adjustments cause 2-step oscillations in demand; spectral peak at 2×10-min cadence; $\rho_{2}$ =0.72.
O2 (Drift): night-shift iot.dock_occupancy calibration off by −3 units; KS=0.14 vs. day cohort.
O3 (Trap): rebalancing trucks saturated by feeder cap; $T_{\text{esc}}$ →∞ unless topology edit (temp docks / feeder upgrade).

Interface stub.

{
  "M8_failure_signatures": {
    "classes": [
      {
        "id":"O1_limit_cycle",
        "predicate":"acf_k>=0.6 && spectral_peak_near(control_cadence)",
        "confirm":"simulate_step_response<gain,delay>",
        "first_aid":["halve_gain","increase_measure_cadence:2x","freeze:non_essential_knobs"],
        "exit_criteria":["acf_k<0.3","belt_residual<=0.08 for 24h"]
      },
      {
        "id":"O4_non_commuting",
        "predicate":"cwa<0.98 || pri>0.20",
        "first_aid":["disable_mean_sum","fallback:sequence","recohort"],
        "root_causes":["unit_mismatch","mixed_protocols","cadence_aliasing"]
      }
    ]
  }
}

def detect_failures(metrics)->list[str]: ...   # returns failure class ids
def first_aid(actions)->None: ...
def confirm_test(class_id, context)->bool: ...
def exit_ready(class_id, history)->bool: ...

Common misuses.

“One-off excuses” instead of registering signatures → repeated surprises.
No confirmatory tests → false positives.
First-aid without exit criteria → permanent throttle.
Ignoring non-commutation and blaming “data quality.”

4.9 Ethics & Safety Constraints (non-goals, blocked instruments)

Purpose. Encode what the system must not pursue, which instruments are disallowed, and the bounds (fairness, harm, privacy) that gate decisions—so safety is executable, not ceremonial.

Checklist.

List non-goals (explicitly off-limits optimizations).
Define blocked instruments/inputs and redacted fields.
Specify hard constraints (must hold) and soft bounds (penalize).
Provide appeal/escalation paths and human approval layers.
Add red-team tests and shadow audits (periodic).
Record violations with immutable traces.

Example fill-in (Bike-Share).

Non-goals: maximize revenue at the cost of stranding riders in low-income zones; exploiting personal mobility traces for advertising.
Blocked instruments: raw GPS at sub-minute resolution; PII; ad-IDs.
Hard constraints: fairness_gap ≤ 3%; PBHL band must be Green to raise prices in low-income zones; max surcharge ≤ $0.15/min.
Soft penalties: high churn in elderly cohort; complaint rate.
Escalation: any proposal breaching hard constraints requires Ethics Officer approval and citizen board review.

Interface stub.

{
  "M9_ethics_safety": {
    "non_goals": [
      "maximize_revenue_by_stranding_low_income",
      "use_personal_traces_for_ads"
    ],
    "blocked_instruments": ["raw_gps_subminute","PII","ad_id"],
    "hard_constraints": [
      {"name":"fairness_gap","op":"<=","value":0.03},
      {"name":"pbhl_band_low_income","op":"==","value":"green"}
    ],
    "soft_bounds": [
      {"name":"elderly_churn","target":"min","weight":2.0},
      {"name":"complaint_rate","target":"min","weight":1.5}
    ],
    "approvals": [
      {"if":"violates(hard_constraints)","then":"require:EthicsOfficer+CitizenBoard"}
    ],
    "redteam_tests": ["membership_inference","linkage_attack","feedback_loop_bias"],
    "logging": { "violation_trace":"hash_chain", "retention_days": 365 }
  }
}

def enforce_hard(decision, metrics)->bool: ...          # deny if any hard fail
def apply_soft(decision, metrics)->float: ...           # risk score/penalty
def is_blocked_instrument(stream)->bool: ...
def require_approval(decision)->list[str]: ...
def run_redteam_suite()->dict: ...

Common misuses.

Writing “principles” with no machine-checkable tests.
Treating fairness as a soft objective when policy demands hard bounds.
Allowing blocked data to sneak in through derived features.
Missing appeal and public transparency paths.

4.10 Evidence Contract (what traces are written; JSON schemas; hashes)

Purpose. Define the immutable evidence your system writes at every tick: inputs, decisions, aggregation justifications, belt states, and approvals—so any observer can replay and audit.

Checklist.

Specify trace records and hash chain (prev_hash → curr_hash).
Include inputs hashes, model/version ids, cohort lists, CWA/PRI results, aggregation grant/deny, belt ledger snapshot, interventions (with approvals).
Provide schemas (JSON) and retention policy.
Support cross-observer agreement checks.
Add export bundles for dispute resolution (signatures, Merkle proofs).

Example schemas.

Decision trace (per tick):

{
  "ts": "2025-09-26T10:30:00Z",
  "policy_id": "bike_share_v3.2",
  "inputs_hash": "sha256:abc123...",
  "cohort_ids": ["zone=A,instr=dock,cad=1m"],
  "aggregation": {
    "granted": true,
    "cwa": 0.992,
    "pri": 0.11,
    "members_hash": "sha256:deadbeef..."
  },
  "decision": {
    "action": "rebalance_rate:+10%",
    "justification": "O1_limit_cycle mitigated; PBHL amber->green"
  },
  "belt_snapshot": {
    "gap": {"name":"var_empty_dock_reduction","target_delta":-20},
    "flux": {"value":-12.3},
    "twist": {"rebalance":0.7,"feeder":0.3},
    "alpha": 0.6,
    "residual_r": 0.07,
    "band": "green"
  },
  "approvals": ["OpsLead:eSig:..."],
  "prev_hash": "sha256:001122...",
  "hash": "sha256:334455..."
}

Evidence bundle (export for audit/dispute):

{
  "bundle_id": "audit_2025w39_zoneA",
  "range": ["2025-09-25T00:00:00Z","2025-09-26T00:00:00Z"],
  "trace_hashes": ["sha256:...","sha256:..."],
  "merkle_root": "sha256:feedcafe...",
  "artifacts": [
    {"type":"cohort_manifest","hash":"sha256:..."},
    {"type":"cwa_tests","hash":"sha256:..."},
    {"type":"pri_tests","hash":"sha256:..."},
    {"type":"belt_ledger","hash":"sha256:..."}
  ],
  "signatures": ["auditor:pk_sig:...", "operator:pk_sig:..."]
}

Interface stub.

{
  "M10_evidence_contract": {
    "trace_schema_ref": "schema://decision_trace_v1",
    "hashing": {"algo":"sha256","chain":"prev_hash->hash"},
    "agreement": {"replicas":2,"min_score":0.98},
    "bundles": {"merkle": true, "export_formats": ["jsonl","parquet"] },
    "retention": {"days": 365, "cold_storage_days": 90}
  }
}

def write_trace(record)->str: ...                     # returns hash
def verify_chain(hashes)->bool: ...
def cross_observer_agreement(logA, logB)->float: ...
def build_bundle(range)->dict: ...
def sign_bundle(bundle, key)->str: ...

Common misuses.

Storing raw payloads without hash references → tamper risk.
Missing members_hash for cohorts → can’t prove who was averaged.
No prev_hash → chain breaks; replay impossible.
Retention too short for regulatory windows.

Chapter 4 wrap-up

What you now have: Ten concrete templates to construct $M$ —units, instruments, controls, state, interventions, aggregation plan, belt ledger, failure signatures, ethics, and evidence.
How it fits the whole method: With $G$ chosen (Chapter 3) and $M$ filled (this chapter), you can mine a small $D$ and run certification (CWA/PRI/PBHL). If gates pass, package an EM-Pack and deploy under Observer-aligned invariants.

Chapter 5 — Domain Residuals $D$ : The Controlled Essence

Residuals are the small, irreducible pieces that actually make your deployment smart for this domain—without bloating into a new monolith. Keep them few, explicit, and governed.

5.1 Design constraint: $\|D\|\le 5$ rules + 100–300 term lexicon

Purpose. Bound complexity so capability comes from structure (G) and alignment (M), not from dumping a new theory into $D$ .

Checklist (ship-readiness).

Rules $R$ : $k\le 5$ , mutually exclusive where possible; explicit precedence and fall-through.
Lexicon $\mathcal{L}$ : 100–300 canonical terms; each has unit, aliases, forbidden variants; conflicts resolved.
Edge tables $\mathcal{E}$ : tiny tables (≤ 20 rows each) for known hard cases; every row cites evidence.
Tests: each rule has unit tests and counter-tests (prove non-trigger on near-misses).
Budget report: compute $\|D\|$ ; if over policy, open a “new G or fix M” ticket.

Example (Bike-Share, compact).

$k=4$ rules; $|\mathcal{L}|=180$ ; $|\mathcal{E}|=2$ small tables.
Budget: $\|D\|= 1.0\cdot4 + 0.2\log(181) + 0.2\log(3) \approx 4.6$ (under policy 5.0).

Interface stub (budget + tests).

{
  "D_budget": {
    "k_rules": 4, "lexicon_size": 180, "edge_tables": 2,
    "weights": {"wr":1.0,"wl":0.2,"we":0.2},
    "norm": 4.62, "policy_max": 5.0, "status": "OK"
  },
  "D_tests": {
    "unit": ["r1_pass","r1_counter","r2_pass","r2_counter", "..."],
    "integration": ["cwa_ok","pri_ok","pbhl_green_24h"]
  }
}

5.2 Residual rule types (counter-intuition, exception routing, taboo transforms)

Design $R$ from three orthogonal types. Keep them crisp and machine-checkable.

A) Counter-intuition rules (override naive heuristics)

Form. “IF pattern $P(x)$ THEN adjust decision $y$ by $\delta$ / switch operator $O$ / re-weight objective $J_i$ .”
Use when. Aggregated signal says A, but domain regularity says A is misleading in this sub-manifold.
Example (Bike-Share).
r1. “Night-shift occupancy under construction yields false ‘low demand’.”
IF zone.has_construction && time∈[22:00,04:00] && sensor_family='dock'
THEN deny mean/sum, force sequence_estimator and raise measurement cadence 2×.

B) Exception routing rules (send cases to a different pipeline)

Form. “IF $P(x)$ THEN route → $\pi'$ ” (fallback model, human review, or alternate belt).
Use when. Safety, ethics, non-commutation, or rare topology demands different handling.
Example.
r2. “Low-income zone price guard.”
IF zone.income_quintile<=1 && action=price_increase THEN route→ethics_review and freeze price until PBHL stays Green 24h.

C) Taboo transforms (forbid harmful/invalid operations)

Form. “NEVER apply transform $T$ under condition $C$ .”
Use when. Operation breaks units/commutation, or violates policy/ethics.
Examples.
r3. “No unit conflation.”
FORBID averaging wait_time[min] with trip_distance[km] in any scalar KPI.
r4. “Protected-class price discrimination.”
FORBID any action where price_delta depends on protected attributes or proxies.

Rule DSL (suggested minimal grammar).

RULE      := IF <predicate> THEN <effect> [ELSE <fallback>]
predicate := atom { (AND|OR) atom }*
atom      := feature OP value | in(feature, set) | exists(feature)
effect    := route(<pipeline>) | deny(<operator>) | set(<param>=<value>)
          | weight(<objective>=w) | forbid(<transform>)
fallback  := route(human_review) | sequence_estimator

Stub (ruleset manifest).

{
  "D_rules": [
    {
      "id":"r1_night_construction_noncommute",
      "type":"counter_intuition",
      "if":"zone.has_construction && tod in [22,4] && sensor='dock'",
      "then":["deny('mean')","set('measure_cadence', '2x')","route('sequence_estimator')"]
    },
    {
      "id":"r2_low_income_price_guard",
      "type":"exception_routing",
      "if":"zone.income_quintile<=1 && action=='price_increase'",
      "then":["route('ethics_review')","freeze('price')"]
    },
    {
      "id":"r3_unit_conflation_taboo",
      "type":"taboo_transform",
      "if":"kpi.mixes_units(['min','km'])",
      "then":["forbid('unit_mix')"]
    },
    {
      "id":"r4_protected_pricing_taboo",
      "type":"taboo_transform",
      "if":"depends_on(protected_attr_or_proxy)",
      "then":["forbid('price_delta')"]
    }
  ],
  "precedence": ["r3","r4","r2","r1"], "fallthrough": "none"
}

Common misuses.

Writing “rules” that restate M mappings (units, instruments) instead of true residuals.
Overlapping predicates with no precedence → non-determinism.
Making taboos “soft penalties” (they must be hard).

5.3 Packaging as EM-Pack plugins (opaque priors via attestation; no plaintext leakage)

Goal. Ship $D$ so operators can use it and auditors can verify it—without exposing the plaintext rules.

Packaging model.

Runtime contract. Plugin implements evaluate(context) -> {effects, scores, audit}. Context contains hashed cohorts, units, belts, without PII.
Attestation. Publisher signs {manifest, code_hash, tests_hash} → attestation.sig.
Server mode. Rules executed remotely (or in enclave); edge returns effects + metrics + attest_id.
No plaintext. Local logs store rule_id, effect, attest_id, not rule bodies.

Manifest (EM-Pack D).

{
  "name": "empack.bikeshare.D.v1.3.0",
  "api": "D_plugin_v1",
  "code_hash": "sha256:ab12...",
  "tests_hash": "sha256:cd34...",
  "attestation": {
    "issuer":"OrgX",
    "sig":"base64:...",
    "policy":{"cwa":0.98,"pri":0.20,"pbhl_r":0.08}
  },
  "interfaces": {
    "evaluate":"ctx -> {effects, scores, audit}",
    "self_test":"-> report"
  },
  "privacy": {"no_plaintext_rules": true, "no_pii": true}
}

Evaluate contract (response).

{
  "effects": ["deny('mean')","route('sequence_estimator')"],
  "scores": {"cwa": 0.991, "pri": 0.18, "pbhl_r_pred": 0.07},
  "audit": {
    "rule_ids":["r1_night_construction_noncommute"],
    "attest_id":"att-2025-09-26-xyz",
    "inputs_fingerprint":"sha256:feed..."
  }
}

Loader (pseudo-code).

def load_D_plugin(manifest)->Plugin:
    assert verify_sig(manifest["attestation"])
    assert api_compatible(manifest["api"])
    return RemotePlugin(endpoint=resolve(manifest))

def apply_D(plugin, ctx):
    out = plugin.evaluate(ctx_minimal(ctx))
    write_trace({"D_attest": out["audit"]["attest_id"],
                 "rule_ids": out["audit"]["rule_ids"],
                 "effects": out["effects"]})
    return out

Security notes.

Rotate keys quarterly; pin code_hash; block execution if attestation stale.
Provide a redacted decompile to regulators under NDA if required.

5.4 Versioning & AB testing (rollouts keyed to certification metrics)

Purpose. Change $D$ safely: prove improvement under gates before full rollout; auto-rollback when bands or ethics fail.

Versioning.

SemVer: major (rule grammar/IO contract changes), minor (new rule or widened predicate), patch (typo/alias updates).
Deprecation. Keep two versions hot for shadow eval; remove the older only after stability ≥ N windows.
Changelogs cite which metrics improved and which tests added.

AB design (practical).

Stratified cohorts (e.g., zones, times, instruments) to avoid Simpson’s paradox.
Primary endpoints: CWA grant rate ↑ or equal; PRI ↓; PBHL residual $r$ ↓; fairness hard bounds never violated.
Sequential testing (e.g., mSPRT) with alpha spending; stop early for superiority or harm.
Guardrails: on any arm, if pbhl_band=Red or fairness_gap>bound → immediate halt + rollback.
Size guidance: for a baseline PBHL $r=0.10$ , detect $-0.02$ improvement with 90% power ⇒ need ~O(10^4) decisions per stratum (tune to domain variance).

AB policy stub.

{
  "D_ab_policy": {
    "arms": ["v1.3.0","v1.4.0"],
    "allocation": {"stratified":"zone,tod4,instrument"},
    "endpoints": ["cwa_grant_rate","pri","pbhl_r","fairness_gap"],
    "stopping": {"method":"mSPRT","alpha":0.05,"beta":0.1},
    "guardrails": ["pbhl_band!='red'","fairness_gap<=0.03"],
    "rollback": {"trigger":"any_guardrail_fail","action":"switch_all_to:control"},
    "reporting": {"cadence":"1h","export_bundle":true}
  }
}

Rollout ladder.

Shadow (read-only scoring, no effects).
Canary (5% traffic in low-risk strata).
Scaled (25–50% with live PBHL watch).
Full (≥90%) after stability ≥ N windows; keep shadow of previous for 1–2 cycles.

What failure teaches.

If successive versions of $D$ bloat (k>5) or still cannot pass CWA/PRI/PBHL, stop: you likely need a new skeleton $G$ or to fix $M$ (units, instruments, constraints).

One-page “D” Checklist (copy/paste)

Budget: $k\le 5$ , 100–300 terms, $\|D\|$ computed & logged.
Types: at least one each of counter-intuition, exception routing, taboo (if applicable).
Precedence: explicit ordering; no overlapping predicates without tie-break.
Tests: unit, counter-tests, integration; shadow eval passes.
Privacy: rules shipped as opaque; only rule_id + attest_id logged.
Gates: CWA/PRI/PBHL/ethics all pass on canary; guardrails active.
AB: stratified, sequential, rollback scripted; changelog ties to metrics.
Exit: if budget or gates fail repeatedly, raise “New $G$ / Fix $M$ ” ticket.

Closing note

$D$ is where your domain genius lives—but strictly small, testable, opaque, and governed. Keep essence controlled, let structure $G$ and morphology $M$ do the heavy lifting, and your empowerments will scale without turning back into monoliths.

6) Observer-Aligned Runtime: How Empowerment Executes

This chapter turns your $G$ + $M$ + $D$ into live, auditable behavior. We keep theory minimal and focus on what to run, what to log, and what to do when signals go bad.

6.1 Tick & Trace: internal collapse and irreversibility

Purpose. Every decision becomes an append-only fact. No retro-editing; all re-computations produce new records, never overwriting old ones.

What to implement.

Tick. A monotone counter $\tau$ (or ISO time bucket) that advances only forward.
Internal collapse (write-once). At the end of each tick, serialize inputs/outputs and write
$T_\tau = \mathrm{hash}(\tau, p, \text{inputs\_hash}, y_\tau, T_{\tau-1}).$
Minimal fields. ts, policy_id, inputs_hash, cohort_ids, cwa, pri, agg_granted, decision, belt_snapshot, approvals, prev_hash, hash.

Checklist.

Clock monotonicity tests.
No “repair” endpoints; fixes must appear as new ticks.
Integrity job that replays the hash chain daily.
Cold storage policy & encryption-at-rest.

Interface stub.

{
  "trace_runtime": {
    "hash_algo": "sha256",
    "required_fields": ["ts","policy_id","inputs_hash","cohort_ids",
                        "cwa","pri","agg_granted","decision",
                        "belt_snapshot","approvals","prev_hash","hash"],
    "replay_job_cron": "0 3 * * *"
  }
}

def write_trace(rec)->str: ...
def verify_chain(hashes)->bool: ...
def repair_by_append(correction)->str: ...  # never mutate past

Common misuses.

“Hot editing” a past record.
Logging raw payloads without a stable inputs_hash.
Gaps in ticks (unlogged decisions).

6.2 Cross-observer agreement & replicated logs

Purpose. Independent observers produce the same decisions under the same data and policy. We quantify that with an agreement score.

What to implement.

Replication. At least two replicas (e.g., east, west) run the same EM-Pack and write separate hash chains.
Agreement function. Compare aligned windows on {decision, cwa, pri, belt.band}:
$A = \frac{1}{N}\sum_{i=1}^N \mathbf{1}\left[(y_i^{(a)}, b_i^{(a)}) = (y_i^{(b)}, b_i^{(b)})\right].$
Drift alarms. Alert when $A<0.98$ or when divergence clusters by cohort.

Checklist.

Replica time sync within $\le$ 1s.
Deterministic seeds & pinned model versions.
Roll-forward only on disagreement; preserve both views.
Export bundles for third-party replay.

Interface stub.

{
  "agreement_runtime": {
    "replicas": 2,
    "min_score": 0.98,
    "compare_fields": ["decision","belt.band","agg_granted"],
    "alert": {"threshold": 0.98, "window":"1h"}
  }
}

def align_logs(logA, logB)->list[tuple]: ...
def agreement_score(pairs)->float: ...
def alert_if_low(score, window)->None: ...

Common misuses.

“Agreement” on text-only justifications, not decisions.
Replica differences due to unpinned dependencies.
Skipping agreement when falling back to human-in-the-loop.

6.3 Slot accounting and capacity contention

Purpose. Attention, memory, tools, and I/O are finite integer resources. Make contention explicit to avoid hidden failures.

What to implement.

Slot classes & caps. attention, memory, tools, io with integer capacities.
Reservations. Critical flows get guaranteed slots.
Evictions. LRU/LFU/cost-aware, always logged.
Deny path. If no slots available, deny and record a safe degradation (don’t “squeeze”).

Signals.

Utilization per class; thrash rate (evictions/turn); denials; latency per slot.
Quality vs. footprint curves (diminishing returns).

Checklist.

Preflight capacity plan.
Slot footprint on each decision trace.
Alerts on thrash rate > policy.

Interface stub.

{
  "slot_runtime": {
    "capacities": {"attention": 8, "memory": 4, "tools": 3, "io": 2},
    "reservation": [{"policy":"critical","attention":4}],
    "eviction": {"attention":"LRU","memory":"cost_aware","tools":"LFU"},
    "deny_on_exhaustion": true,
    "metrics": ["utilization","thrash_rate","denials","latency_per_slot"]
  }
}

def request_slot(kind, n=1, priority=0)->bool: ...
def release_slot(kind, n=1)->None: ...
def evict(kind)->SlotId: ...
def slot_metrics()->dict: ...

Common misuses.

“Elastic” slots that silently expand.
Evicting evidence needed for audit.
Tool recursion that bypasses slot checks.

6.4 Belt closure reporting (Gap/Flux/Twist/Residual; policy bands)

Purpose. Governance must act, not decorate. We compute the belt tuple and trigger Green/Amber/Red actions.

What to implement.

Gap $g$ . Planned delta over a window/cohort (units aligned).
Flux $f$ . Realized change from instrument cohorts.
Twist $t$ . Coupling/geometry term (constraints, substitutions).
Residual $r$ .
$r=\frac{\|g-f-\alpha t\|}{\|g\|+\varepsilon}$
Bands with actions:
- Green $(r \le 0.08)$ : proceed.
- Amber $(0.08<r \le 0.15)$ : mitigate (scope↓, cadence×2, owner assigned).
- Red $(r>0.15)$ : halt/rollback/escalate.

Checklist.

Same window/cohort for Gap and Flux.
Non-zero $\alpha$ where structure matters.
Action adherence tracked (did we actually do the thing?).
Owner field mandatory.

Interface stub.

{
  "belt_runtime": {
    "alpha": 0.6,
    "bands": {"green":0.08,"amber":0.15},
    "actions": {
      "green":["continue"],
      "amber":["reduce_scope:20%","increase_measurement_cadence:2x","assign_owner"],
      "red":["halt","rollback","escalate"]
    },
    "ledger_fields": ["Gap","Flux","Twist","Residual","Band","Action","Owner","ts","hash"]
  }
}

def compute_belt(gap, flux, twist, alpha)->dict: ...
def enforce_band(band)->list[str]: ...
def record_belt(entry)->str: ...

Common misuses.

Mismatched units/cadences → fake residuals.
Reporting bands without executing actions.
Setting $\alpha=0$ “to make residuals look good.”

6.5 The READY-CHECK → MEASURE → AGGREGATE (CWA) → GOVERN (PBHL) loop

Purpose. A minimal finite-state loop that ties readiness, measurement, certified aggregation, and governance together.

States & transitions.

READY-CHECK. Verify prerequisites: slots, policy version, ethics guards, sensor health.
- Fail → DEGRADED (fallback model) or HALT (human).
- Pass → MEASURE.
MEASURE. Acquire instrument cohorts; compute features/order/control parameters.
- Write inputs_hash, cohort manifests.
AGGREGATE (CWA/PRI).
- Run cohorting; test CWA & PRI.
- If CWA≥0.98 & PRI≤0.20 & size≥min: grant mean/sum; else fallback to order-sensitive estimators or re-cohort.
GOVERN (PBHL).
- Compute Gap/Flux/Twist/Residual; trigger band actions.
- Execute interventions under 4.5 rules; write belt entry.
- Loop to next tick.

Loop pseudocode.

def tick(context):
    # READY-CHECK
    assert time_sync_ok()
    if not slots_ok() or not ethics_ok(context) or not sensors_ok():
        route_to_degraded_or_halt()
        return write_trace(decision="degraded_or_halt")

    # MEASURE
    X, cohorts = measure(context)
    inputs_hash = hash_inputs(X, cohorts)

    # AGGREGATE
    granted = grant_mean_sum(cohorts)  # runs CWA/PRI
    if granted:
        decision = aggregate(cohorts, spec=M6)
    else:
        decision = fallback_estimate(cohorts, spec=M6)

    # GOVERN
    gap, flux, twist = compute_gap(...), compute_flux(...), compute_twist(...)
    belt = compute_belt(gap, flux, twist, alpha=cfg.alpha)
    actions = enforce_band(belt["band"])
    execute(actions, decision)

    # TRACE
    rec = pack_record(inputs_hash, decision, cohorts, cwa=granted.cwa,
                      pri=granted.pri, belt=belt, actions=actions, prev_hash=get_prev())
    return write_trace(rec)

Runtime SLOs (suggested).

READY-CHECK < 50 ms; MEASURE window fixed; AGGREGATE budgeted permutations (e.g., 200) < 300 ms; GOVERN latency < domain SLA.
Agreement ≥ 0.98; CWA grant rate tracked; PBHL Green time ≥ 80% steady-state.
Ethics hard constraints: 0 violations.

Common misuses.

Skipping READY-CHECK during high load.
Collapsing AGGREGATE into a black-box model (no CWA/PRI visibility).
GOVERN as a dashboard with no actuators.
Writing traces after actions (replay mismatch).

Example: Bike-Share one-tick snapshot (condensed)

READY-CHECK: slots OK; ethics OK; sensors OK.
MEASURE: cohorts by zone/instrument/cadence; inputs_hash=sha256:….
AGGREGATE: CWA=0.993, PRI=0.12 ⇒ grant sum(rides_start) & mean(wait_time).
GOVERN: target reduce empty-dock variance −20 pp/24h; Flux −12.3; Twist 3.1; $\alpha$ =0.6 ⇒ $r=0.07$ (Green) → continue; minor nudge in two zones.
TRACE: write hash chained record with actions.

Chapter 6 Checklist (copy/paste)

Tick & Trace: monotone ticks; append-only hash chain; daily replay job.
Agreement: ≥2 replicas; compare {decision, band, agg_granted}; alert <0.98.
Slots: integer caps, reservations, evictions logged; deny on exhaustion.
Belt: Gap/Flux/Twist consistent window/units; actions executed & logged.
Loop: READY-CHECK → MEASURE → AGGREGATE (CWA/PRI) → GOVERN (PBHL); fallbacks & escalations wired.
SLOs: latency budgets, grant rates, band time; 0 hard-ethics violations.

This runtime makes empowerment observable and enforceable—so your EM-Packs don’t just work, they work under audit.

7) Certification: CWA / PRI / PBHL

Certification turns “seems to work” into provable permission to deploy. It is a battery of repeatable tests and banded actions that any observer can replay.

7.1 CWA battery: commutation tests, cohorting, mean/sum permission

Purpose. Decide when arithmetic aggregators (mean/sum) preserve signal. If instruments don’t commute, averaging can destroy truth.

Battery components (run all):

Cohort formation. Partition records on keys that plausibly induce commutation:
unit, instrument_family, cadence_bucket, protocol, timezone, (optionally) population_slice.
- Enforce min cohort size (e.g., 30 obs per window).
- Reject cohorts mixing levels and rates or incompatible units.
Permutation-invariance test (CWA). For aggregator $A$ and cohort $X$ : sample $P$ permutations (e.g., 200):
$\text{CWA}(X,A)=1-\frac{1}{P}\sum_p\frac{\|A(X)-A(\pi_p(X))\|}{\sigma_{\text{base}}+\varepsilon}$
- $\sigma_{\text{base}}$ is a cohort-specific scale (e.g., median absolute deviation).
- Grant mean/sum if CWA ≥ 0.98.
Drift-aware windows. Run CWA in rolling short/long windows (e.g., 1 h and 24 h); deny grant if short-window pass but long-window fails and KS shift > threshold.
Order-probe stress. Introduce structured permutations (sorted-by-time, reversed, block swaps) to catch aliasing/seasonality artifacts.
Grant/deny with fallback.
- Grant: use declared $A$ (mean/sum/trimmed) and write a grant record with members_hash.
- Deny: route to order-sensitive estimators (sequence/causal), or re-cohort, or human-in-the-loop.

Interface stub.

{
  "cert_cwa": {
    "cohort_keys": ["unit","instrument_family","cadence_bucket","protocol","tz"],
    "min_size": 30,
    "permutations": 200,
    "threshold": 0.98,
    "windows": ["1h","24h"],
    "drift_ks": 0.10,
    "stress_perms": ["time_sorted","time_reversed","block_swap"]
  }
}

def make_cohorts(records, keys)->list[list]: ...
def cwa_score(cohort, A, P=200)->float: ...
def grant_mean_sum(cohort)->bool: ...
def write_cwa_grant(cohort, A, score, members_hash)->Hash: ...

Common misuses.

Skipping cohorting (“pooled mean for all”).
Too few permutations (unstable CWA).
Using outcome labels as cohort keys (leakage).
Granting when units differ or when mixing levels/rates.

7.2 PRI estimation and policy thresholds

Purpose. Quantify residual order/phase sensitivity of the decision after CWA. Even commuting inputs can hide a phase-sensitive decision boundary.

Procedure.

Define decision functional $y(\cdot)$ (post-aggregation pipeline).
Permutation variance. Compute $\mathrm{Var}_{\pi}[y(\pi(X))]$ with the same cohort and permutations used in CWA.
Baseline variance. Estimate $\mathrm{Var}_{\text{boot}}[y(X)]$ via bootstrap (order preserved), or from a calibrated noise model.
PRI.
$\text{PRI}=\min\!\left(1,\ \frac{\mathrm{Var}_{\pi}[\,y(\pi(X))\,]}{\mathrm{Var}_{\text{boot}}[\,y(X)\,]+\varepsilon}\right)$
Policy. PRI ≤ 0.20 to deploy; else downgrade to order-sensitive estimator or increase measurement cadence and re-cohort.

Diagnostics to log.

PRI median & 95th percentile across cohorts.
Cohorts with chronic PRI>0.20 (focus for instrument redesign).
Delta-PRI after Phase-Lock (expect reduction).

Interface stub.

{
  "cert_pri": {
    "perm_budget": 200,
    "bootstrap": 200,
    "threshold": 0.20,
    "report": ["median","p95","cohort_breakdown"]
  }
}

def pri_score(cohort, decision_fn, P=200, B=200)->float: ...
def pri_report(scores)->dict: ...
def pri_gate(cohort)->bool: ...

Common misuses.

Estimating PRI on proxy metrics, not the final decision.
Ignoring variance baseline (everything looks “sensitive”).
Passing CWA and assuming PRI must be small (not always).

7.3 PBHL residual bands: Green ≤ 0.08; Amber ≤ 0.15; Red > 0.15 (actions per band)

Purpose. Enforce governed closure: plans must be reconciled with reality via Gap/Flux/Twist; residual $r$ drives actions.

Computation.

Gap $g$ : planned delta over a defined window/cohort.
Flux $f$ : realized delta from certified cohorts (same units/window).
Twist $t$ : coupling/geometry (constraints, substitutions).
Residual:
$r=\frac{\|g-f-\alpha t\|}{\|g\|+\varepsilon}$

Bands & required actions.

Green (≤ 0.08) → proceed; keep cadence; note owner.
Amber (≤ 0.15) → mitigate: narrow scope (e.g., −20%), increase measurement cadence (×2), add owner & deadline, optionally re-run MEEL with updated constraints.
Red (> 0.15) → halt/rollback/escalate: disable risky interventions, roll back last policy change, notify human authority, open incident with evidence bundle.

Ledger requirements.

Same window & cohort for Gap and Flux.
$\alpha$ documented and non-zero when structure matters.
Action adherence logged; no “band without actuation.”

Interface stub.

{
  "cert_pbhl": {
    "alpha": 0.6,
    "bands": {"green":0.08,"amber":0.15},
    "actions": {
      "green":["continue"],
      "amber":["reduce_scope:20%","measure_cadence:x2","assign_owner"],
      "red":["halt","rollback","escalate"]
    },
    "audit_fields": ["gap","flux","twist","alpha","r","band","actions","owner","hash"]
  }
}

def pbhl_residual(g, f, t, alpha)->float: ...
def band_of(r, bands)->str: ...
def enforce_actions(band)->list[str]: ...

Common misuses.

Misaligned units/cadence → meaningless $r$ .
Setting $\alpha=0$ to hide structure.
Issuing belt reports with no actions.

7.4 Why these gates correlate with reproducibility and safety

Reproducibility.

CWA demands invariance to permutation within cohorts. That removes incidental ordering as a hidden confounder; observers re-running the same cohort retrieve the same aggregates.
PRI checks the decision surface, not just inputs: low PRI means a decision won’t flip under benign re-orderings—critical for cross-observer agreement.
PBHL ties decisions to closed-loop evidence: without Gap/Flux/Twist reconciliation, apparent gains drift unobserved; with it, the same plan produces the same measured closure across observers.

Safety.

CWA/PRI prevent “average-kills-truth”: you don’t authorize mean/sum when instruments interact, avoiding silent loss of minorities or edge cases.
PBHL bands force timely correction: Amber narrows risk; Red stops harm.
Auditability (grant/deny logs, cohort hashes, belt ledger) makes post-hoc review possible, deterring reckless tuning.

Empirical signature to expect when the system is healthy.

High CWA grant rate in mature cohorts; low PRI p95; PBHL Green time ≥ 80% with Amber spikes resolved within SLA.
Cross-observer agreement ≥ 0.98 on {decision, band, agg_granted}; investigation tickets focus on a small set of chronic non-commuting cohorts (instrument redesign targets).

Certification runbook (copy/paste)

Assemble cohorts per M-4.2 keys; validate units per M-4.1.
Run CWA permutations (≥ 200) in 1 h & 24 h windows; stress perms; grant/deny.
Compute PRI on the decision; downgrade if > 0.20.
Build belt tuple (Gap/Flux/Twist) on granted cohorts; compute $r$ ; act by band.
Write grant/deny and belt records with hashes; export evidence bundle.
Gate outcome: Only if CWA & PRI pass and PBHL is Green/Amber-with-mitigation, publish the EM-Pack certification attestation. Otherwise block and open tickets: fix M (units/instruments), propose new G, or redesign D (keep $\|D\|\le 5$ ).

With this battery, “works” becomes provably works, and “safe” becomes operationally safe—in a way any observer can replay.

Chapter 8 — The Production Pipeline (Factory Model)

8.1 Stage A — Skeleton Selection (G): choose and stack from the 12

Purpose. Pick the fewest skeletons that explain the domain’s dynamics and constraints, then define how they compose.

Inputs

Domain brief (one page)
Early telemetry samples (units, instruments, typical decisions)
Family guess (which cluster from your 12×10 G/M map)

Outputs

G_stack (2–5 skeletons), composition order, and conflict policy
“Why not” notes (skeletons explicitly not used)
Initial risk register (where $K$ might be high)

Method (fast, repeatable)

Family match. Use a 12-skeleton screening matrix:

Signal	C&F	Surplus	Phase	Peaks	Obs-Inv	CWA/PRI	Slots	PBHL	P-Lock	Subst/Topo
Conserved stock/flow present?	●	○
Planning–reality gaps matter?		○						●
Threshold/flip risk?			●
Lock-in/plateau?				●
Auditability a must?					●	●	●	●	●
Limited capacity/tools?							●
Replacement/migration planned?										●

Pick 2–5 bones. Start with the highest-signal bones; avoid blanket inclusion.
Define composition.
- Serial: output of $G_i$ feeds $G_{i+1}$ (e.g., C&F → PBHL).
- Parallel: $G_i$ and $G_j$ compute in parallel, reconciled by MEEL.
- Guarded: a skeleton only activates when a predicate holds (e.g., Phase only near $\mu_\star$ ).
Conflict policy. Resolve disagreements via MEEL (Section 3.10) and hard constraints (ethics).

Acceptance criteria

2–5 skeletons chosen with justification.
Composition diagram and predicates documented.
Initial $K$ estimate (which factor is likely to break the model).

Interface stub

{
  "stageA_G_selection": {
    "domain":"bike_share_ops.v1",
    "G_stack":["conservation_flow","pbhl_belt","certified_aggregation","slot_economics","phase_lock"],
    "compose": {
      "serial":["conservation_flow->pbhl_belt"],
      "parallel":["certified_aggregation","slot_economics"],
      "guarded":[{"skeleton":"phase_criticality","when":"ews_index>=0.7"}]
    },
    "not_used":["substitution_topology"],
    "risk":{"K_guess":{"rho":0.2,"kappa":0.1,"sigma":0.3,"gamma":0.1}}
  }
}

Common misuses.

“Kitchen-sink” G_stack (everything included).
No composition policy → contradictory actions.
Ignoring obvious Phase or Substitution signals to shorten Stage A.

8.2 Stage B — Morphology Mapping (M): complete the 10 templates

Purpose. Translate the domain into machine-checkable forms so the chosen skeletons can run safely.

Inputs

G_stack and composition policy (Stage A)
Raw data dictionaries, policy knob lists, ethics constraints
Two weeks of representative logs (if available)

Outputs

Completed M-1 … M-10 templates (Chapter 4)
Quality vector $Q=(u,c,g,a,b,e)$ and lint report
B-exit packet for Stage C (SIDA/MEEL)

Method (quality-first)

Fill M-1 … M-4 (Units, Instruments, Controls, State).
Wire M-5 … M-7 (Interventions, Aggregation Plan, Belt). Make sure cohort keys match units & instruments, and belt windows equal the plan windows.
Install M-8 … M-10 (Failures, Ethics, Evidence).
Lint with automated checks:
- Unit consistency (no mixed level/rate in the same aggregator).
- Cohort coverage and min sizes.
- Belt coherence (Gap/Flux cadences match; $\alpha$ nonzero if couplings declared).
- Ethics hard constraints are machine-checkable.
- Evidence schema contains members_hash, prev_hash, signatures.

Acceptance criteria (“B-gate”)

Quality vector meets policy:
$u\ge0.95, c\ge0.85, g\ge0.9, a\ge0.75, b\ge0.9, e\ge0.95$ .
No lint blockers (only warnings allowed).
A one-page M-map exported (for auditors and Stage C).

Example (condensed B-exit packet)

{
  "stageB_M_complete": {
    "M_quality":{"u":0.98,"c":0.90,"g":0.95,"a":0.82,"b":0.97,"e":0.99,"status":"PASS"},
    "cohort_keys":["zone","instrument_family","cadence_bucket","tz"],
    "belt":{"gap":"var_empty_dock_reduction@24h","alpha":0.6,"bands":{"green":0.08,"amber":0.15}},
    "ethics":{"hard":["fairness_gap<=0.03","no_raw_gps_subminute"],"non_goals":["strand_low_income"]},
    "evidence_schema":"schema://decision_trace_v1"
  }
}

Common misuses.

Treating M as prose instead of contracts (no JSON/DSL).
Misaligned cadences across Gap and Flux (PBHL becomes noise).
Cohorts keyed by outcomes (label leakage, breaks CWA).

Handover to Stage C

Provide the M-map, cohort manifests, and the initial hypothesis list (what kinds of residuals might be needed).
Slot budgets for SIDA runs (C-Stage tooling will request them).

Next response: Stage C — Residual Mining (D), Stage D — Certification, and Stage E — Packaging & Attestation, including checklists, staffing plan, timing, and example artifacts.

Continuing Chapter 8 with Stages C → E (application-first). This completes the Production Pipeline.

8.3 Stage C — Residual Mining (D): SIDA deepening + MEEL multi-objective scoring

Purpose. Extract the minimal controlled essence—≤ 5 rules + 100–300 term lexicon—that lifts capability beyond $G+M$ while staying safe and auditable.

Inputs

B-exit packet (M-templates complete, quality vector passed)
Candidate hypotheses for residuals (from domain lead & ops post-mortems)
Slot budgets for exploration (attention/memory/tools)

Outputs

D_rules (3–5) with predicates, effects, precedence
D_lexicon (100–300 terms with units, aliases, forbidden variants)
D_edge_tables (compact) with provenance
Budget report $\|D\|$ and test suite (unit, counter-tests, integration)
Shadow eval & MEEL scorecard vs. control

Method (SIDA × MEEL loop)

Plan deepening (SIDA budgets).
Set budgets and stops (info-gain floor, PBHL band policy, slot caps).
Propose drill paths.
Generate candidate predicates from failure signatures, ethics flags, high-PRI cohorts, and operator narratives.
Deepen & measure.
For each path: gather evidence → compute info-gain $\Delta I$ (entropy/CI reduction) → log provenance.
Compact & synthesize rules.
Convert high-value patterns to rule triples: (predicate → effect → fallback); remove overlap; assign precedence.
Score trade-offs (MEEL).
Evaluate candidate rulesets on accuracy, latency, cost, risk/ethics, CWA grant rate, PRI, and PBHL $r$ .
Select minimal set.
Prefer the knee of the Pareto front with k ≤ 5; demote extras to edge tables.
Shadow eval & counter-tests.
Run in read-only mode; prove rules don’t trigger on near-misses; compute deltas vs. control.

Acceptance criteria (“C-gate”)

$k \le 5$ rules; lexicon 100–300 terms; $\|D\|$ ≤ policy
All rules have unit tests + counter-tests
Shadow eval shows no hard-ethics violations; PBHL not worse; PRI p95 not worse

Interface & artifacts

C-stage config (SIDA × MEEL).

{
  "stageC_config": {
    "sida": { "budgets": {"attention":4,"tools":2,"depth":3},
              "stops": {"min_info_gain":0.02,"pbhl_band":"green_only"} },
    "meel": { "objectives":["error","latency","cost","risk","cwa_grant","pri","pbhl_r"],
              "constraints":[{"name":"fairness_gap","type":"hard","bound":0.03}] }
  }
}

Rule manifest (example).

{
  "D_rules": [
    {"id":"r1_night_construction_noncommute",
     "if":"zone.has_construction && tod in [22,4] && sensor='dock'",
     "then":["deny('mean')","set('measure_cadence','2x')","route('sequence_estimator')"]},
    {"id":"r2_low_income_price_guard",
     "if":"zone.income_quintile<=1 && action=='price_increase'",
     "then":["route('ethics_review')","freeze('price')"]}
  ],
  "precedence":["r3_unit_conflation_taboo","r4_protected_pricing_taboo",
     "r2_low_income_price_guard","r1_night_construction_noncommute"]
}

SIDA loop (pseudo).

for path in propose_paths(M, failures, high_PRI):
    ev = deepen_once(path)                # fetch/analyze evidence
    if info_gain(prev, ev) < 0.02 or pbhl_band(ev) != "green": break
core = compact_evidence(all_ev)           # minimal support set
rules = synthesize_rules(core)            # predicates/effects/fallbacks
front = meel_score(rules, objectives)     # Pareto set
D = select_minimal(front, k_max=5)

Common misuses.

Encoding M facts as D rules (inflates $D$ ).
Adding rules to “fix” CWA/PRI instead of re-cohorting or repairing instruments.
No counter-tests → rules trigger on benign cases.

8.4 Stage D — Certification: run CWA / PRI / PBHL; emit only if all pass

Purpose. Convert “promising” into permitted via batteries & bands (Chapter 7). If any gate fails, block and open work items (fix $M$ , revise $D$ , or propose new $G$ ).

Inputs

G_stack, completed M, candidate D (shadow-proven)
Canary cohorts & deployment plan

Outputs

CWA report (grant/deny per cohort, windows, stress perms)
PRI report (median/p95; chronic offenders)
Belt report (Gap/Flux/Twist, residual $r$ , bands & actions)
Ethics attestation (hard constraints satisfied)
Certification decision (PASS/BLOCK) + evidence bundle

Procedure (gated)

Assemble cohorts (from M-4.2 keys). Validate units (M-4.1).
Run CWA permutations (≥200) on 1h & 24h windows + stress perms.
- Grant mean/sum only if CWA ≥ 0.98 and cohort size ≥ min.
Compute PRI on the decision; require PRI ≤ 0.20.
Build PBHL belt, same windows; compute $r$ and act by band.
Ethics & safety: prove all hard constraints hold; blocked instruments not used.
Cross-observer replay: agreement ≥ 0.98 on {decision, band, agg_granted}.
Decision: PASS if all above hold; else BLOCK with root cause ticket.

Acceptance criteria (“D-gate”)

CWA pass rate ≥ policy; all shipped decisions have PRI ≤ 0.20
PBHL Green time ≥ 80% canary window; Amber actions executed; no Red
0 hard-ethics violations; cross-observer agreement ≥ 0.98

Artifacts

CWA report (snippet).

{
  "cwa_report": {
    "cohort":"zone=A,instr=dock,cad=1m",
    "A":"mean(wait_time)",
    "permutations":200,
    "cwa":0.992, "granted":true,
    "members_hash":"sha256:deadbeef"
  }
}

PRI report (summary).

{"pri_report":{"median":0.11,"p95":0.18,"chronic_offenders":[]}}

Belt report (per tick).

{"belt":{"gap":{"delta_pp":-20},"flux":{"value":-12.3},
         "twist":{"rebalance":0.7,"feeder":0.3},
         "alpha":0.6,"r":0.07,"band":"green","actions":["continue"]}}

Certification attestation (decision).

{
  "cert_decision": {
    "status":"PASS",
    "policy":{"cwa":0.98,"pri":0.20,"pbhl_green_time":0.80},
    "evidence_bundle":"sha256:bundle_root",
    "signatures":["cert_owner:eSig:...","safety:eSig:..."]
  }
}

Fail-fast playbook.

CWA fail → re-cohort; repair unit/cadence mismatch; if persistent → redesign instruments.
PRI high → apply Phase-Lock; increase measurement cadence; fallback to sequence estimators.
PBHL Amber/Red → execute band actions; if Red persists → revert last policy; open incident.
Ethics breach → immediate halt; escalate.

Common misuses.

Declaring pass on averaged metrics while individual cohorts fail.
Ignoring stress permutations (time-sorted/reversed).
Treating Amber as “informational” (must act).

8.5 Stage E — Packaging & Attestation: plugin manifest, hash, usage meter, audit endpoints

Purpose. Ship the empowerment as a portable, opaque EM-Pack with cryptographic attestation, usage metering, and audit APIs.

Inputs

Certification PASS decision + evidence bundle
Security keys, release channel (shadow/canary/full)

Outputs

Plugin artifact (container/enclave/remote endpoint)
Manifest (API, hashes, policy thresholds, version)
Attestation (issuer/signature)
Usage meter and audit endpoints

Packaging modes

Remote service (default): evaluate rules on a server; edge receives effects + attest_id.
TEE/enclave (sensitive domains): run locally inside a trusted enclave; export only attested results.
WASM module (offline, low-risk): sandboxed local.

Manifest (minimal).

{
  "manifest": {
    "name":"empack.bikeshare.v1.4.0",
    "api":"empack_eval_v1",
    "endpoints": {"evaluate": "https://api.example.com/eval", "self_test": "/self_test"},
    "hashes": {"code":"sha256:ab12...", "tests":"sha256:cd34..."},
    "policy":{"cwa":0.98,"pri":0.20,"pbhl_r":0.08},
    "version":"1.4.0",
    "privacy":{"no_plaintext_rules":true,"no_pii":true}
  }
}

Attestation

{
  "attestation": {
    "issuer":"OrgX",
    "issued_at":"2025-09-26T10:00:00Z",
    "manifest_hash":"sha256:f00d...",
    "evidence_bundle":"sha256:bundle_root",
    "signature":"base64:MEUCIQ...=="
  }
}

Usage meter (billing + safety)

Count certified decisions (i.e., after CWA/PRI gates) and band time (Green/Amber/Red)
Expose per-cohort, per-zone, per-policy usage for billing and SLOs

{
  "usage_meter": {
    "period":"2025-09-26",
    "counts":{"decisions":123456,"certified":118900,"fallbacks":4556},
    "bands":{"green":0.84,"amber":0.15,"red":0.01},
    "errors":{"ethics_blocks":0,"agreement_drops":2}
  }
}

Audit endpoints

GET /audit/bundle?range=... → returns Merkle bundle (traces, CWA/PRI tests, belt ledger)
GET /audit/attestation/:id → attestation record
POST /audit/replay → deterministic replay job (returns agreement score & diffs)

{
  "audit_api": {
    "endpoints": [
      {"path":"/audit/bundle","method":"GET","auth":"auditor_token"},
      {"path":"/audit/attestation/{id}","method":"GET"},
      {"path":"/audit/replay","method":"POST","body":{"range":["2025-09-25","2025-09-26"]}}
    ],
    "sla":{"p99_latency_ms":500,"availability":"99.9%"}
  }
}

Release flow (CLI sketch)

empack build --G G_stack.json --M M_map.json --D D_rules.json
empack certify --bundle evidence.bundle --policy policy.json   # produces PASS/BLOCK
empack sign --manifest manifest.json --bundle evidence.bundle --out attestation.json
empack publish --manifest manifest.json --attestation attestation.json --channel canary
empack meter --export usage_2025w39.json

Rollback & key rotation

Rollback: keep last PASS version hot; publish --channel rollback --to v1.3.0
Keys: rotate quarterly; pin manifest_hash; fail-closed on signature mismatch

Acceptance criteria (“E-gate”)

Manifest & attestation signatures verify; hashes match bundle
Audit endpoints respond under SLA; replay yields agreement ≥ 0.98
Usage meter live; billing tied to certified outputs (not total calls)

Common misuses.

Shipping without usage metering (no accountability).
Logging plaintext rules (breaks privacy/competition).
No replay API (can’t audit or defend decisions).

Chapter 8 wrap-up (factory at a glance)

A (G) pick 2–5 bones; define composition & guard predicates.
B (M) fill 10 contracts to machine-checkable form; pass quality vector.
C (D) mine ≤5 rules via SIDA×MEEL; shadow-prove; keep $\|D\|$ small.
D (Cert) CWA/PRI/PBHL batteries; ethics hard; agreement ≥ 0.98.
E (Ship) package as attested plugin with usage meter & audit APIs.

This pipeline converts domain insight into a repeatable, governable product—so empowerment is not just achieved, but operated under audit.

9) Interfaces & Data Contracts (copy-paste ready)

9.1 EM-Pack Manifest (JSON + JSON Schema)

Example (minimal but complete)

{
  "name": "empack.bikeshare",
  "version": "1.4.0",
  "api": "empack_eval_v1",
  "g_refs": ["G01.conservation", "G06.certified_aggregation", "G08.pbhl_belt", "G09.phase_lock"],
  "m_fills": {
    "units_dimensions_ref": "sha256:3b1e...",
    "instrument_operator_ref": "sha256:91aa...",
    "controls_ref": "sha256:20fe...",
    "state_space_ref": "sha256:7c9d...",
    "interventions_ref": "sha256:11af...",
    "aggregation_plan_ref": "sha256:6d44...",
    "belt_ledger_ref": "sha256:d0ad...",
    "failure_signatures_ref": "sha256:5e77...",
    "ethics_safety_ref": "sha256:a9f2...",
    "evidence_contract_ref": "sha256:f912..."
  },
  "d_rules": {
    "attest_id": "att-2025-09-26-xyz",
    "opaque": true,
    "rule_ids": ["r1_night_construction_noncommute", "r2_low_income_price_guard"]
  },
  "lexicon": {
    "size": 180,
    "hash": "sha256:0f0f...",
    "canonical_units": ["unit", "kWh", "USD", "min"]
  },
  "policy": {
    "cwa_min": 0.98,
    "pri_max": 0.20,
    "pbhl_r_max": 0.08,
    "bands": { "green": 0.08, "amber": 0.15 }
  },
  "endpoints": {
    "evaluate": "https://api.example.com/eval",
    "self_test": "https://api.example.com/self_test",
    "audit_bundle": "https://api.example.com/audit/bundle"
  },
  "attestation": {
    "issuer": "OrgX",
    "issued_at": "2025-09-26T10:00:00Z",
    "manifest_hash": "sha256:f00d...",
    "code_hash": "sha256:ab12...",
    "tests_hash": "sha256:cd34...",
    "evidence_bundle": "sha256:feedcafe...",
    "signature": "base64:MEUCIQ...=="
  },
  "privacy": { "no_plaintext_rules": true, "no_pii": true }
}

JSON Schema (Draft-07)

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "$id": "schema://empack_manifest_v1",
  "title": "EM-Pack Manifest",
  "type": "object",
  "required": ["name", "version", "api", "g_refs", "m_fills", "d_rules", "policy", 
    "endpoints", "attestation", "privacy"],
  "properties": {
    "name": {
      "type": "string",
      "pattern": "^[a-z0-9]+([._-][a-z0-9]+)*$"
    },
    "version": {
      "type": "string",
      "pattern": "^\\d+\\.\\d+\\.\\d+$"
    },
    "api": { "type": "string", "enum": ["empack_eval_v1"] },
    "g_refs": {
      "type": "array",
      "minItems": 1,
      "items": { "type": "string", "pattern": "^G(0[1-9]|1[0-2])\\.[a-z0-9_]+$" },
      "uniqueItems": true
    },
    "m_fills": {
      "type": "object",
      "required": [
        "units_dimensions_ref","instrument_operator_ref","controls_ref","state_space_ref",
        "interventions_ref","aggregation_plan_ref","belt_ledger_ref","failure_signatures_ref",
        "ethics_safety_ref","evidence_contract_ref"
      ],
      "additionalProperties": false,
      "properties": {
        "units_dimensions_ref": { "type": "string", "pattern": "^sha256:[a-f0-9]{6,}$" },
        "instrument_operator_ref": { "type": "string", "pattern": "^sha256:[a-f0-9]{6,}$" },
        "controls_ref": { "type": "string", "pattern": "^sha256:[a-f0-9]{6,}$" },
        "state_space_ref": { "type": "string", "pattern": "^sha256:[a-f0-9]{6,}$" },
        "interventions_ref": { "type": "string", "pattern": "^sha256:[a-f0-9]{6,}$" },
        "aggregation_plan_ref": { "type": "string", "pattern": "^sha256:[a-f0-9]{6,}$" },
        "belt_ledger_ref": { "type": "string", "pattern": "^sha256:[a-f0-9]{6,}$" },
        "failure_signatures_ref": { "type": "string", "pattern": "^sha256:[a-f0-9]{6,}$" },
        "ethics_safety_ref": { "type": "string", "pattern": "^sha256:[a-f0-9]{6,}$" },
        "evidence_contract_ref": { "type": "string", "pattern": "^sha256:[a-f0-9]{6,}$" }
      }
    },
    "d_rules": {
      "type": "object",
      "required": ["attest_id", "opaque", "rule_ids"],
      "properties": {
        "attest_id": { "type": "string" },
        "opaque": { "type": "boolean", "const": true },
        "rule_ids": { "type": "array", "items": { "type": "string" }, "minItems": 1, "uniqueItems": true }
      },
      "additionalProperties": false
    },
    "lexicon": {
      "type": "object",
      "required": ["size", "hash"],
      "properties": {
        "size": { "type": "integer", "minimum": 1, "maximum": 1000 },
        "hash": { "type": "string", "pattern": "^sha256:[a-f0-9]{6,}$" },
        "canonical_units": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }
      },
      "additionalProperties": false
    },
    "policy": {
      "type": "object",
      "required": ["cwa_min", "pri_max", "pbhl_r_max", "bands"],
      "properties": {
        "cwa_min": { "type": "number", "minimum": 0, "maximum": 1, "const": 0.98 },
        "pri_max": { "type": "number", "minimum": 0, "maximum": 1, "const": 0.20 },
        "pbhl_r_max": { "type": "number", "minimum": 0, "maximum": 1, "const": 0.08 },
        "bands": {
          "type": "object",
          "required": ["green", "amber"],
          "properties": {
            "green": { "type": "number", "minimum": 0, "maximum": 1, "const": 0.08 },
            "amber": { "type": "number", "minimum": 0, "maximum": 1, "const": 0.15 }
          },
          "additionalProperties": false
        }
      },
      "additionalProperties": false
    },
    "endpoints": {
      "type": "object",
      "required": ["evaluate", "self_test"],
      "properties": {
        "evaluate": { "type": "string", "format": "uri" },
        "self_test": { "type": "string", "format": "uri" },
        "audit_bundle": { "type": "string", "format": "uri" }
      },
      "additionalProperties": false
    },
    "attestation": {
      "type": "object",
      "required": ["issuer", "issued_at", "manifest_hash", "code_hash", "tests_hash", 
        "evidence_bundle", "signature"],
      "properties": {
        "issuer": { "type": "string" },
        "issued_at": { "type": "string", "format": "date-time" },
        "manifest_hash": { "type": "string", "pattern": "^sha256:[a-f0-9]{6,}$" },
        "code_hash": { "type": "string", "pattern": "^sha256:[a-f0-9]{6,}$" },
        "tests_hash": { "type": "string", "pattern": "^sha256:[a-f0-9]{6,}$" },
        "evidence_bundle": { "type": "string", "pattern": "^sha256:[a-f0-9]{6,}$" },
        "signature": { "type": "string" }
      },
      "additionalProperties": false
    },
    "privacy": {
      "type": "object",
      "required": ["no_plaintext_rules", "no_pii"],
      "properties": {
        "no_plaintext_rules": { "type": "boolean", "const": true },
        "no_pii": { "type": "boolean", "const": true }
      },
      "additionalProperties": false
    }
  },
  "additionalProperties": false
}

9.2 Trace Schema (irreversible records: τ, π, y … with hash chain)

Minimal Trace (for ultra-lean deployments)

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "$id": "schema://decision_trace_min_v1",
  "title": "Decision Trace (Minimal)",
  "type": "object",
  "required": ["tau", "pi", "y", "prev_hash", "hash", "ts"],
  "properties": {
    "tau": { "type": "integer", "minimum": 0, "description": "Tick index (τ)" },
    "pi":  { "type": "string",  "description": "Policy id (π), e.g., policy/version" },
    "y":   { "type": "string",  "description": "Decision compact opcode or JSON-serialized object" },
    "ts":  { "type": "string",  "format": "date-time" },
    "prev_hash": { "type": "string", "pattern": "^sha256:[a-f0-9]{6,}$" },
    "hash":      { "type": "string", "pattern": "^sha256:[a-f0-9]{6,}$" }
  },
  "additionalProperties": false
}

Full Decision Trace (recommended for certification/audit)

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "$id": "schema://decision_trace_v1",
  "title": "Decision Trace (Full)",
  "type": "object",
  "required": [
    "ts","tau","policy_id","inputs_hash","cohort_ids","aggregation",
    "decision","belt_snapshot","approvals","prev_hash","hash"
  ],
  "properties": {
    "ts": { "type": "string", "format": "date-time" },
    "tau": { "type": "integer", "minimum": 0 },
    "policy_id": { "type": "string" },
    "inputs_hash": { "type": "string", "pattern": "^sha256:[a-f0-9]{6,}$" },
    "cohort_ids": { "type": "array", "items": { "type": "string" }, "minItems": 1, "uniqueItems": true },
    "aggregation": {
      "type": "object",
      "required": ["granted", "cwa", "pri", "members_hash"],
      "properties": {
        "granted": { "type": "boolean" },
        "cwa": { "type": "number", "minimum": 0, "maximum": 1 },
        "pri": { "type": "number", "minimum": 0, "maximum": 1 },
        "members_hash": { "type": "string", "pattern": "^sha256:[a-f0-9]{6,}$" },
        "window": { "type": "string", "enum": ["1h", "24h", "other"] },
        "permutations": { "type": "integer", "minimum": 1 }
      },
      "additionalProperties": false
    },
    "decision": {
      "type": "object",
      "required": ["action"],
      "properties": {
        "action": { "type": "string" },
        "parameters": { "type": "object", "additionalProperties": true },
        "justification": { "type": "string" },
        "D_effects": {
          "type": "object",
          "properties": {
            "attest_id": { "type": "string" },
            "rule_ids": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }
          },
          "additionalProperties": false
        }
      },
      "additionalProperties": false
    },
    "belt_snapshot": {
      "$ref": "schema://pbhl_belt_v1"
    },
    "approvals": { "type": "array", "items": { "type": "string" }, "uniqueItems": true },
    "prev_hash": { "type": "string", "pattern": "^sha256:[a-f0-9]{6,}$" },
    "hash": { "type": "string", "pattern": "^sha256:[a-f0-9]{6,}$" }
  },
  "additionalProperties": false,
  "definitions": {
    "pbhl_belt_v1_inline": {
      "type": "object"
    }
  }
}

Note: The $ref above expects the Belt schema (9.3) to be registered at schema://pbhl_belt_v1. If not using a registry, inline that object.

Example record (full):

{
  "ts": "2025-09-26T10:30:00Z",
  "tau": 123456,
  "policy_id": "bike_share_v3.2",
  "inputs_hash": "sha256:abc123...",
  "cohort_ids": ["zone=A|instr=dock|cad=1m"],
  "aggregation": { "granted": true, "cwa": 0.992, "pri": 0.11, 
    "members_hash": "sha256:deadbeef", "window": "1h", "permutations": 200 },
  "decision": {
    "action": "rebalance_rate_adjust",
    "parameters": { "delta_pct": 10, "zones": ["A", "C"] },
    "justification": "O1 oscillation mitigated; PBHL Amber→Green",
    "D_effects": { "attest_id": "att-2025-09-26-xyz", "rule_ids": ["r1_night_construction_noncommute"] }
  },
  "belt_snapshot": {
    "gap": { "name": "var_empty_dock_reduction", "unit": "pct_point", "window": "24h", "target_delta": -20 },
    "flux": { "value": -12.3, "unit": "pct_point" },
    "twist": { "rebalance": 0.7, "feeder": 0.3 },
    "alpha": 0.6,
    "residual_r": 0.07,
    "band": "green",
    "actions": ["continue"],
    "owner": "OpsLead"
  },
  "approvals": ["OpsLead:eSig:..."],
  "prev_hash": "sha256:001122...",
  "hash": "sha256:334455..."
}

9.3 PBHL Belt Report Schema (Gap / Flux / Twist / Residual with band flags)

JSON Schema

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "$id": "schema://pbhl_belt_v1",
  "title": "PBHL Belt Report",
  "type": "object",
  "required": ["gap", "flux", "twist", "alpha", "residual_r", "band"],
  "properties": {
    "gap": {
      "type": "object",
      "required": ["name", "unit", "window"],
      "properties": {
        "name": { "type": "string" },
        "unit": { "type": "string" },
        "window": { "type": "string" },
        "target_delta": { "type": "number" }
      },
      "additionalProperties": false
    },
    "flux": {
      "type": "object",
      "required": ["value", "unit"],
      "properties": {
        "value": { "type": "number" },
        "unit": { "type": "string" }
      },
      "additionalProperties": false
    },
    "twist": {
      "type": "object",
      "description": "Coupling/geometry components by source",
      "additionalProperties": { "type": "number" }
    },
    "alpha": { "type": "number", "minimum": 0, "maximum": 1 },
    "residual_r": { "type": "number", "minimum": 0, "maximum": 1 },
    "band": { "type": "string", "enum": ["green", "amber", "red"] },
    "actions": { "type": "array", "items": { "type": "string" }, "uniqueItems": true },
    "owner": { "type": "string" },
    "ts": { "type": "string", "format": "date-time" },
    "hash": { "type": "string", "pattern": "^sha256:[a-f0-9]{6,}$" }
  },
  "additionalProperties": false
}

Example

{
  "gap": { "name": "var_empty_dock_reduction", "unit": "pct_point", "window": "24h", "target_delta": -20 },
  "flux": { "value": -12.3, "unit": "pct_point" },
  "twist": { "rebalance": 0.7, "feeder": 0.3 },
  "alpha": 0.6,
  "residual_r": 0.07,
  "band": "green",
  "actions": ["continue"],
  "owner": "OpsLead",
  "ts": "2025-09-26T10:30:00Z",
  "hash": "sha256:baddad..."
}

9.4 CWA Result Schema (tests, cohorts, grant/deny)

Per-Cohort CWA Test Result

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "$id": "schema://cwa_result_v1",
  "title": "CWA Result (Per Cohort)",
  "type": "object",
  "required": ["cohort_id", "aggregator", "permutations", "cwa", "granted", "members_hash"],
  "properties": {
    "cohort_id": { "type": "string" },
    "aggregator": { "type": "string", "enum": ["mean","sum","trimmed_mean","quantile"] },
    "params": { "type": "object", "additionalProperties": true },
    "window": { "type": "string", "enum": ["1h","24h","other"] },
    "permutations": { "type": "integer", "minimum": 50 },
    "stress_perms": {
      "type": "array",
      "items": { "type": "string", "enum": ["time_sorted","time_reversed","block_swap"] },
      "uniqueItems": true
    },
    "cwa": { "type": "number", "minimum": 0, "maximum": 1 },
    "pri": { "type": "number", "minimum": 0, "maximum": 1 },
    "granted": { "type": "boolean" },
    "reason": { "type": "string" },
    "members_hash": { "type": "string", "pattern": "^sha256:[a-f0-9]{6,}$" },
    "ks_shift": { "type": "number", "minimum": 0, "maximum": 1 }
  },
  "additionalProperties": false
}

Batch Report (many cohorts)

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "$id": "schema://cwa_batch_report_v1",
  "title": "CWA Batch Report",
  "type": "object",
  "required": ["policy", "results", "summary"],
  "properties": {
    "policy": {
      "type": "object",
      "required": ["cwa_min", "pri_max", "min_cohort_size", "permutations"],
      "properties": {
        "cwa_min": { "type": "number", "const": 0.98 },
        "pri_max": { "type": "number", "const": 0.20 },
        "min_cohort_size": { "type": "integer", "minimum": 1 },
        "permutations": { "type": "integer", "minimum": 50 }
      },
      "additionalProperties": false
    },
    "results": {
      "type": "array",
      "items": { "$ref": "schema://cwa_result_v1" }
    },
    "summary": {
      "type": "object",
      "required": ["grant_rate", "n_cohorts", "p95_pri"],
      "properties": {
        "grant_rate": { "type": "number", "minimum": 0, "maximum": 1 },
        "n_cohorts": { "type": "integer", "minimum": 0 },
        "p95_pri": { "type": "number", "minimum": 0, "maximum": 1 }
      },
      "additionalProperties": false
    }
  },
  "additionalProperties": false
}

Example (single result)

{
  "cohort_id": "zone=A|instr=dock|cad=1m",
  "aggregator": "mean",
  "params": { "field": "wait_time" },
  "window": "1h",
  "permutations": 200,
  "stress_perms": ["time_sorted","block_swap"],
  "cwa": 0.993,
  "pri": 0.12,
  "granted": true,
  "reason": "CWA>=0.98 & PRI<=0.20",
  "members_hash": "sha256:deadbeef",
  "ks_shift": 0.04
}

Implementation notes (practical)

Registry: host these schemas under a stable URL or embed them in your repo at schema/.
Validation: enforce at ingress and before writing any trace.
Interlinking: Manifest → M-refs (hashes) → runtime uses those; Traces reference Belt schema; CWA batch reports feed Certification (Ch.7).
Privacy: never log plaintext D rules; only rule_ids + attest_id.
Audit: expose /audit/bundle to return Merkle-bundled traces + CWA/PRI tests + belt ledger.

9.5 Cohort Manifest Schema (who was averaged, why it’s lawful)

JSON Schema (Draft-07)

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "$id": "schema://cohort_manifest_v1",
  "title": "Cohort Manifest",
  "type": "object",
  "required": [
    "cohort_id", "keys", "values", "members_hash", "size",
    "unit", "instrument_family", "cadence_bucket", "protocol", "tz",
    "window", "policy", "health"
  ],
  "properties": {
    "cohort_id": { "type": "string", "description": "Deterministic slug of key=value pairs" },
    "keys": {
      "type": "array",
      "items": { "type": "string", 
        "enum": ["unit","instrument_family","cadence_bucket","protocol","tz","population_slice",
          "zone","tod4"] },
      "minItems": 1,
      "uniqueItems": true
    },
    "values": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "unit": { "type": "string" },
        "instrument_family": { "type": "string" },
        "cadence_bucket": { "type": "string" },
        "protocol": { "type": "string" },
        "tz": { "type": "string" },
        "population_slice": { "type": "string" },
        "zone": { "type": "string" },
        "tod4": { "type": "string", "enum": ["night","morning","afternoon","evening"] }
      }
    },
    "members_hash": {
      "type": "string",
      "pattern": "^sha256:[a-f0-9]{6,}$",
      "description": "Merkle or flat hash over member record IDs"
    },
    "size": { "type": "integer", "minimum": 1 },
    "unit": { "type": "string" },
    "level_or_rate": { "type": "string", "enum": ["level","rate"] },
    "instrument_family": { "type": "string" },
    "cadence_bucket": { "type": "string" },
    "protocol": { "type": "string" },
    "tz": { "type": "string" },
    "window": {
      "type": "object",
      "required": ["start", "end"],
      "properties": {
        "start": { "type": "string", "format": "date-time" },
        "end": { "type": "string", "format": "date-time" }
      },
      "additionalProperties": false
    },
    "source_refs": {
      "type": "array",
      "items": { "type": "string" },
      "description": "Instrument IDs or dataset tags included"
    },
    "non_commuting_pairs": {
      "type": "array",
      "items": {
        "type": "array",
        "items": { "type": "string" },
        "minItems": 2,
        "maxItems": 2
      }
    },
    "drift": {
      "type": "object",
      "properties": {
        "baseline_hash": { "type": "string", "pattern": "^sha256:[a-f0-9]{6,}$" },
        "ks_shift": { "type": "number", "minimum": 0, "maximum": 1 }
      },
      "additionalProperties": false
    },
    "policy": {
      "type": "object",
      "required": ["cwa_min","pri_max","min_cohort_size","permutations"],
      "properties": {
        "cwa_min": { "type": "number", "const": 0.98 },
        "pri_max": { "type": "number", "const": 0.20 },
        "min_cohort_size": { "type": "integer", "minimum": 1 },
        "permutations": { "type": "integer", "minimum": 50 }
      },
      "additionalProperties": false
    },
    "health": {
      "type": "object",
      "required": ["status"],
      "properties": {
        "status": { "type": "string", "enum": ["ok","warn","fail"] },
        "notes": { "type": "string" }
      },
      "additionalProperties": false
    },
    "created_at": { "type": "string", "format": "date-time" }
  },
  "additionalProperties": false
}

Example

{
  "cohort_id": "zone=A|unit=min|instr=dock|cad=1m|tz=UTC",
  "keys": ["zone","unit","instrument_family","cadence_bucket","protocol","tz"],
  "values": {
    "zone": "A",
    "unit": "min",
    "instrument_family": "dock",
    "cadence_bucket": "1m",
    "protocol": "v2",
    "tz": "UTC"
  },
  "members_hash": "sha256:deadbeefcafee1a5",
  "size": 342,
  "unit": "min",
  "level_or_rate": "level",
  "instrument_family": "dock",
  "cadence_bucket": "1m",
  "protocol": "v2",
  "tz": "UTC",
  "window": { "start": "2025-09-26T09:00:00Z", "end": "2025-09-26T10:00:00Z" },
  "source_refs": ["iot.dock_occupancy"],
  "non_commuting_pairs": [["app.trip_events","ops.rebalance_log"]],
  "drift": { "baseline_hash": "sha256:beadfeed1234", "ks_shift": 0.04 },
  "policy": { "cwa_min": 0.98, "pri_max": 0.20, "min_cohort_size": 30, "permutations": 200 },
  "health": { "status": "ok", "notes": "Meets size and drift thresholds" },
  "created_at": "2025-09-26T10:05:00Z"
}

9.6 Tiny Rule DSL (JSON) for D Predicates/Effects

A minimal, machine-checkable AST matching Chapter 5’s rule types. Two layers:

Rule: id, type, predicate, effects[], optional fallback.
Predicate AST: boolean ops (and, or, not) + atoms (cmp, in, between, exists, depends_on).
Effects (enumerated): route, deny, set, weight, forbid, freeze, escalate.

JSON Schema (ruleset + rule + predicate AST)

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "$id": "schema://ruleset_v1",
  "title": "D Ruleset (Tiny Rule DSL)",
  "type": "object",
  "required": ["rules", "precedence"],
  "properties": {
    "rules": {
      "type": "array",
      "minItems": 1,
      "items": { "$ref": "schema://rule_dsl_v1" }
    },
    "precedence": {
      "type": "array",
      "items": { "type": "string" },
      "uniqueItems": true,
      "description": "Ordered list of rule IDs; earlier = higher priority"
    }
  },
  "additionalProperties": false
}

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "$id": "schema://rule_dsl_v1",
  "title": "Rule (Tiny Rule DSL)",
  "type": "object",
  "required": ["id","type","predicate","effects"],
  "properties": {
    "id": { "type": "string" },
    "type": { "type": "string", "enum": ["counter_intuition","exception_routing","taboo_transform"] },
    "predicate": { "$ref": "schema://predicate_ast_v1" },
    "effects": {
      "type": "array",
      "minItems": 1,
      "items": { "$ref": "schema://effect_v1" },
      "uniqueItems": false
    },
    "fallback": { "$ref": "schema://effect_v1" },
    "notes": { "type": "string" }
  },
  "additionalProperties": false
}

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "$id": "schema://predicate_ast_v1",
  "title": "Predicate AST",
  "type": "object",
  "oneOf": [
    { "required": ["and"] },
    { "required": ["or"] },
    { "required": ["not"] },
    { "required": ["atom"] }
  ],
  "properties": {
    "and": {
      "type": "array",
      "minItems": 2,
      "items": { "$ref": "schema://predicate_ast_v1" }
    },
    "or": {
      "type": "array",
      "minItems": 2,
      "items": { "$ref": "schema://predicate_ast_v1" }
    },
    "not": { "$ref": "schema://predicate_ast_v1" },
    "atom": {
      "type": "object",
      "required": ["op","field"],
      "properties": {
        "op": {
          "type": "string",
          "enum": ["eq","ne","lt","le","gt","ge","in","between","regex","exists","depends_on"]
        },
        "field": { "type": "string" },
        "value": {},
        "values": { "type": "array", "items": {} }
      },
      "additionalProperties": false
    }
  },
  "additionalProperties": false
}

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "$id": "schema://effect_v1",
  "title": "Effect",
  "type": "object",
  "required": ["op"],
  "properties": {
    "op": {
      "type": "string",
      "enum": ["route","deny","set","weight","forbid","freeze","escalate"]
    },
    "target": { "type": "string" },
    "params": { "type": "object", "additionalProperties": true }
  },
  "additionalProperties": false
}

Examples (three classic rules, JSON-AST)

r1 — Counter-intuition (deny mean at night construction; route to sequence; speed up measurement)

{
  "id": "r1_night_construction_noncommute",
  "type": "counter_intuition",
  "predicate": {
    "and": [
      { "atom": { "op": "eq", "field": "zone.has_construction", "value": true } },
      { "atom": { "op": "in", "field": "time.tod_hour", "values": [22,23,0,1,2,3,4] } },
      { "atom": { "op": "eq", "field": "sensor.family", "value": "dock" } }
    ]
  },
  "effects": [
    { "op": "deny", "target": "aggregator.mean" },
    { "op": "set", "target": "measurement.cadence", "params": { "multiplier": 2.0 } },
    { "op": "route", "target": "pipeline.sequence_estimator" }
  ]
}

r2 — Exception routing (ethics guard on low-income zone price increases)

{
  "id": "r2_low_income_price_guard",
  "type": "exception_routing",
  "predicate": {
    "and": [
      { "atom": { "op": "le", "field": "zone.income_quintile", "value": 1 } },
      { "atom": { "op": "eq", "field": "decision.action", "value": "price_increase" } }
    ]
  },
  "effects": [
    { "op": "route", "target": "pipeline.ethics_review" },
    { "op": "freeze", "target": "controls.price" }
  ],
  "fallback": { "op": "escalate", "target": "human.owner", "params": { "reason": "ethics_guard" } }
}

r3 — Taboo transform (unit conflation ban)

{
  "id": "r3_unit_conflation_taboo",
  "type": "taboo_transform",
  "predicate": {
    "atom": { "op": "regex", "field": "kpi.formula", 
      "value": "(wait_time.*\\+.*trip_distance)|(min.*\\+.*km)" }
  },
  "effects": [
    { "op": "forbid", "target": "kpi.compute" }
  ],
  "notes": "Forbid mixing minutes and kilometers in a single scalar KPI."
}

r4 — Taboo transform (protected pricing)

{
  "id": "r4_protected_pricing_taboo",
  "type": "taboo_transform",
  "predicate": {
    "atom": { "op": "depends_on", "field": "decision.price_delta", "value": "protected_attr_or_proxy" }
  },
  "effects": [
    { "op": "forbid", "target": "controls.price_delta" }
  ]
}

Ruleset wrapper with precedence

{
  "rules": [
    { "id": "r3_unit_conflation_taboo", "type": "taboo_transform",
      "predicate": { "atom": { "op": "regex", "field": "kpi.formula", 
        "value": "(wait_time.*\\+.*trip_distance)|(min.*\\+.*km)" } },
      "effects": [ { "op": "forbid", "target": "kpi.compute" } ]
    },
    { "id": "r4_protected_pricing_taboo", "type": "taboo_transform",
      "predicate": { "atom": { "op": "depends_on", "field": "decision.price_delta", 
        "value": "protected_attr_or_proxy" } },
      "effects": [ { "op": "forbid", "target": "controls.price_delta" } ]
    },
    { "id": "r2_low_income_price_guard", "type": "exception_routing",
      "predicate": { "and": [
        { "atom": { "op": "le", "field": "zone.income_quintile", "value": 1 } },
        { "atom": { "op": "eq", "field": "decision.action", "value": "price_increase" } }
      ]},
      "effects": [
        { "op": "route", "target": "pipeline.ethics_review" },
        { "op": "freeze", "target": "controls.price" }
      ],
      "fallback": { "op": "escalate", "target": "human.owner", "params": { "reason": "ethics_guard" } }
    },
    { "id": "r1_night_construction_noncommute", "type": "counter_intuition",
      "predicate": { "and": [
        { "atom": { "op": "eq", "field": "zone.has_construction", "value": true } },
        { "atom": { "op": "in", "field": "time.tod_hour", "values": [22,23,0,1,2,3,4] } },
        { "atom": { "op": "eq", "field": "sensor.family", "value": "dock" } }
      ]},
      "effects": [
        { "op": "deny", "target": "aggregator.mean" },
        { "op": "set", "target": "measurement.cadence", "params": { "multiplier": 2.0 } },
        { "op": "route", "target": "pipeline.sequence_estimator" }
      ]
    }
  ],
  "precedence": [
    "r3_unit_conflation_taboo",
    "r4_protected_pricing_taboo",
    "r2_low_income_price_guard",
    "r1_night_construction_noncommute"
  ]
}

Interop notes

Log only {attest_id, rule_ids} in traces (no plaintext logic).
Predicates reference the same field names used in M-templates and runtime features.
Effects must honor gates: denying mean/sum or routing must occur before aggregation is granted (CWA/PRI).

That completes 9.5 Cohort Manifest and the Tiny Rule DSL JSON.

10) Evaluation Program & Falsification Plan

10.1 P1 — Family Coverage Test (30 blind domains)

Goal. Demonstrate portability: ≥ 60% of blind domains pass certification and keep ∥D∥ ≤ 5.

Design (controlled, reproducible)

Sampling. 30 blind domains curated by an external selector. Mix by type (ops, clinical, finance, infra, CX), regions, and data richness.
Blinding. Team sees only minimal briefs until Stage B; no prior bespoke theory allowed.
Process. Run the standard pipeline A→E (Ch.8) with the fixed gates.

Pass definition (per domain)

Gates: CWA ≥ 0.98, PRI ≤ 0.20, PBHL r ≤ 0.08 (Amber allowed only with mitigations executed).
Residual budget: $\|D\| \le 5$ rules and lexicon 100–300; edge tables small.
Ethics: 0 hard-constraint violations.
Agreement: ≥ 0.98 across replicas on {decision, band, agg_granted}.

Statistical plan

Estimator: $\hat p=\frac{\text{passes}}{30}$ .
Success criterion: 95% CI lower bound of $\hat p$ ≥ 0.60 (Wilson or Clopper-Pearson).
Power note: With n=30, each domain moves the point estimate by ~3.3%; use this to plan contingency add-ons (up to n=40) if the lower CI straddles 0.60.

Artifacts & schema

P1 domain record (JSON)

{
  "program": "P1_family_coverage",
  "domain_id": "retail_demand_planning.eu.v1",
  "family_guess": "inventory_flow",
  "stages": {"A":"done","B":"done","C":"done","D":"pass","E":"shipped"},
  "D_budget": {"k_rules":4,"lexicon_size":176,"edge_tables":2,"norm":4.6},
  "gates": {"cwa":0.991,"pri":0.14,"pbhl_r":0.07,"ethics_hard_violations":0},
  "agreement": 0.989,
  "result": "pass",
  "evidence_bundle": "sha256:...",
  "notes": "Amber spikes resolved in 24h"
}

P1 summary (JSON)

{
  "program": "P1_family_coverage",
  "n": 30,
  "passes": 20,
  "p_hat": 0.667,
  "ci95": [0.49, 0.81],
  "criterion": {"lower_bound_min": 0.60},
  "met": true,
  "median_D_rules": 4,
  "median_lexicon": 182,
  "fail_reasons": {"cwa_fail":5,"pri_high":2,"pbhl_red":3}
}

Falsification for P1

Fail if CI lower bound < 0.60 or median ∥D∥ > 5.
Action: open G/RFC tickets for repeated fail motifs; expand data chemistry if failures concentrate in observability (ρ) or commutation (κ).

10.2 P2 — Small-Residual Law (upper bounds on ∥D∥ in low-K domains)

Claim. For low-K domains (good observability, commuting instruments, stable semantics, low adversary), we can bound ∥D∥ tightly.

Cohort definition (low-K)

Compute $K=\rho\cdot\kappa\cdot\sigma\cdot\gamma$ .
Low-K set: $K \le 0.10$ with each factor ≤ 0.4; instrumentation vetted; adversary score low.

Metric & hypotheses

Binary indicator $Z=\mathbb{1}[\|D\|\le 5]$ .
H0: $p=\Pr(Z=1) < 0.80$ .
H1: $p \ge 0.80$ (non-inferiority margin δ = 0.0 vs. 0.80 floor).

Statistical plan

Sample size guidance: aim n≥40 low-K domains; with $\hat p\approx 0.9$ , the 95% lower bound typically exceeds 0.8.
Decision rule: compute 95% CI for $p$ (Wilson). Pass if lower bound ≥ 0.80.
Explainers: regress $\|D\|$ on (ρ, κ, σ, γ) to check monotonicity; report partial correlations.

Artifacts & schema

Low-K scorecard (per domain)

{
  "program": "P2_small_residual",
  "domain_id": "clinical_triage.lowacuity.v2",
  "rho": 0.12, "kappa": 0.20, "sigma": 0.18, "gamma": 0.05,
  "K": 0.0022,
  "D_budget": {"k_rules": 3, "lexicon_size": 140, "edge_tables": 1, "norm": 3.9},
  "D_small": true,
  "gates": {"cwa": 0.995, "pri": 0.09, "pbhl_r": 0.06},
  "result": "included"
}

P2 summary (JSON)

{
  "program": "P2_small_residual",
  "n_lowK": 44,
  "count_smallD": 39,
  "p_hat": 0.886,
  "ci95": [0.76, 0.95],
  "criterion": {"lower_bound_min": 0.80},
  "met": true,
  "trend": {"corr_D_vs_rho": 0.41, "corr_D_vs_kappa": 0.47}
}

Falsification for P2

Fail if 95% CI lower bound for $\Pr(\|D\|\le 5)$ < 0.80 in a vetted low-K cohort.
Action: inspect M quality; if clean, open new-G exploration (missing invariants).

10.3 P3 — Failure Catalog (high-K) → propose new G candidates

Goal. Convert systematic high-K failures into a catalog that motivates new skeletons G′ or lab upgrades.

Inclusion (high-K)

High-K: $K \ge 0.40$ or chronic gate failures (CWA low despite cohorting; PBHL Red; PRI p95 high).

Required evidence (per failure)

Break ticket: domain, K components, failing gates, failure signatures (M-8), D inflation symptoms, audit bundle hashes.
Root cause type: non-observability (ρ), non-commutation (κ), semantic drift (σ), adversary (γ).
Attempted mitigations: re-cohorting, phase-lock, instrument redesign, data chemistry.

Break ticket (JSON)

{
  "program": "P3_failure_catalog",
  "ticket_id": "break.finance.highfreq.v1",
  "domain_id": "market_making.hft.us",
  "rho": 0.35, "kappa": 0.75, "sigma": 0.40, "gamma": 0.30,
  "K": 0.0315,
  "gates": {"cwa": 0.91, "pri_p95": 0.34, "pbhl_r": 0.18},
  "D_budget": {"k_rules": 11, "lexicon_size": 420, "edge_tables": 7, "norm": 9.2},
  "signatures": ["O4_non_commuting","O5_adversary"],
  "mitigations_tried": ["recohort","phase_lock","fallback_sequence","ethics_sandbox"],
  "bundle_hash": "sha256:...",
  "status": "needs_new_G"
}

New-G RFC (proposal template)

{
  "rfc": "G13_temporal_anti_commutator.v0",
  "purpose": "Model non-commuting tick-level instruments; lawful path-integral aggregation",
  "operators": ["ordered_integral","commutator_penalty","phase_windowing"],
  "signals": ["CWA_lift_on_windowing","PRI_drop","PBHL_green_time_rise"],
  "misuses": ["averaging_across_phase_breaks","mixing levels/rates"],
  "interfaces": {"required_units": ["tick","lot"], "aggregate": "order-aware"},
  "acceptance": {"delta_cwa_grant": ">=+0.15", "pri_p95": "<=0.20", "D_budget_delta": "<= -2 rules"}
}

Post-G validation

Run A/B on the same high-K domains with G′. Success if:
- CWA grant rate ↑, PRI p95 ↓ to ≤ 0.20, PBHL Green time ≥ 80%, and ∥D∥ shrinks (e.g., −2 rules vs. baseline).

Falsification for P3

Fail if recurrent high-K motifs persist and proposed G′ fails to reduce D and pass gates across cases.
Action: re-score feasibility; declare domain out-of-scope until instrumentation or governance changes.

10.4 Metrics Dashboard (sample efficiency, reproducibility, band time, error cost)

Purpose. Continuous view of empowerment quality and safety across programs.

Canonical metrics

Sample efficiency: gain per labeled/observed unit (e.g., Δerror / observations); or Δcapability per wall-clock.
Reproducibility: cross-observer agreement (≥ 0.98); variance of decisions under benign reorderings.
Band time: PBHL Green/Amber/Red shares; action adherence % in Amber/Red.
Error cost: cost-weighted error index (domain-specific units, e.g., USD, harm score).
Grant rate: share of cohorts where mean/sum was legally granted (CWA pass).
Residual budget: median ∥D∥ and tail (p90) over active domains.

Dashboard schema (JSON)

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "$id": "schema://empowerment_dashboard_v1",
  "title": "Empowerment Metrics Dashboard",
  "type": "object",
  "required": ["period","program","by_domain","rollup"],
  "properties": {
    "period": {"type":"string","description":"ISO week or month, e.g., 2025-W39"},
    "program": {"type":"string","enum":["P1_family_coverage","P2_small_residual",
      "P3_failure_catalog","ALL"]},
    "by_domain": {
      "type": "array",
      "items": {
        "type":"object",
        "required":["domain_id","grant_rate","agreement","pbhl_bands","error_cost",
          "sample_efficiency","D_budget"],
        "properties":{
          "domain_id":{"type":"string"},
          "grant_rate":{"type":"number","minimum":0,"maximum":1},
          "agreement":{"type":"number","minimum":0,"maximum":1},
          "pbhl_bands":{"type":"object","required":["green","amber","red"],
            "properties":{"green":{"type":"number"},"amber":{"type":"number"},"red":{"type":"number"}}},
          "action_adherence":{"type":"number","minimum":0,"maximum":1},
          "error_cost":{"type":"number"},
          "sample_efficiency":{"type":"number","description":"gain per 1k obs or per day"},
          "D_budget":{"type":"object","required":["k_rules","lexicon_size","norm"],
            "properties":{"k_rules":{"type":"integer"},"lexicon_size":{"type":"integer"},
              "norm":{"type":"number"}}}
        }
      }
    },
    "rollup": {
      "type":"object",
      "required":["n_domains","grant_rate_med","agreement_med","pbhl_green_med",
        "error_cost_sum","D_rules_med","alerts"],
      "properties":{
        "n_domains":{"type":"integer"},
        "grant_rate_med":{"type":"number"},
        "agreement_med":{"type":"number"},
        "pbhl_green_med":{"type":"number"},
        "error_cost_sum":{"type":"number"},
        "D_rules_med":{"type":"number"},
        "alerts":{"type":"array","items":{"type":"string"}}
      }
    }
  },
  "additionalProperties": false
}

Example (rollup)

{
  "period": "2025-W39",
  "program": "ALL",
  "by_domain": [
    {
      "domain_id": "bike_share_ops.v1",
      "grant_rate": 0.82,
      "agreement": 0.989,
      "pbhl_bands": {"green": 0.86, "amber": 0.13, "red": 0.01},
      "action_adherence": 0.94,
      "error_cost": 1200.5,
      "sample_efficiency": 0.34,
      "D_budget": {"k_rules": 4, "lexicon_size": 180, "norm": 4.6}
    }
  ],
  "rollup": {
    "n_domains": 18,
    "grant_rate_med": 0.79,
    "agreement_med": 0.985,
    "pbhl_green_med": 0.84,
    "error_cost_sum": 184220.0,
    "D_rules_med": 4,
    "alerts": ["3 domains with PRI_p95>0.20", "1 domain PBHL red>2%"]
  }
}

CLI hooks (fits Ch.9 tooling)

empack eval p1 --domains domains_p1.jsonl --out p1_summary.json
empack eval p2 --lowK lowK_manifest.jsonl --out p2_summary.json
empack eval p3 --tickets break_tickets.jsonl --propose-g newG_rfc.json
empack dashboard --period 2025-W39 --out dashboard.json

Falsification & Decision Tree (one page, copy/paste)

Decision rules (hard):

P1 fails (CI lower bound < 0.60 or median ∥D∥ > 5) → open root-cause review:
- If failures cluster in ρ/κ → instrument redesign or new-G exploration.
- If failures cluster in σ/γ → tighten phase-lock & ethics; consider scope narrowing.
P2 fails (low-K lower bound < 0.80) → the small-residual law is not supported for “easy” domains → prioritize new-G discovery; publish negative result.
P3 fails (no new-G reduces D and passes gates across repeated high-K motifs) → declare scope boundary; update roadmap and public limits.

Publication plan:

Release P1/P2 summaries with anonymized artifacts (schema-conformant bundles).
Publish the Failure Catalog with redacted tickets and accepted G RFCs.

Minimal checklists

P1 Checklist

30 blind domains curated externally
A→E pipeline run; evidence bundles signed
Pass rate CI ≥ 0.60; median ∥D∥ ≤ 5

P2 Checklist

Low-K cohort vetted (K ≤ 0.10)
n ≥ 40
Lower CI for $\Pr(\|D\|\le 5)$ ≥ 0.80

P3 Checklist

Break tickets complete with K components, gates, signatures
New-G RFCs propose operators/signals/acceptance
Post-G A/B shows gate passes and ∥D∥ shrinkage

This completes Chapter 10 with copy-paste-ready designs, schemas, and falsifiers.

11.1 TCM (Traditional Chinese Medicine) — Diagnostic & Formula Selection

G (skeletons used).
phase_lock_symbols, pbhl_belt_governance, substitution_topology, certified_aggregation, observer_runtime_invariants.

Intent. Phase-lock clinical language; safely aggregate multi-instrument observations (pulse, tongue, symptom clusters); govern plan→outcome via PBHL; model substitutions among formulas/ingredients.

M — Morphology Mapping (compact fills)

M1 Units & Dimensions

{
  "M1_units_dimensions": {
    "stocks": [
      {"name":"symptom_burden","unit":"score","min":0,"max":100},
      {"name":"constitution_level","unit":"score","min":0,"max":100}
    ],
    "flows": [
      {"name":"change_in_symptom_burden","unit":"score/week"},
      {"name":"dose","unit":"g/day"}
    ],
    "transforms": [{"from":["score/week","week"],"to":"score"}],
    "sources_sinks": ["new_stressor:score","adherence_gap:score"]
  }
}

M2 Instrument → Operator Map

{
  "M2_instrument_operator": {
    "instruments": [
      {"id":"exam.pulse","unit":"opcode","tau_sec":"exam","lag_sec":0,
        "maps_to":["G09.phase_lock","G06.cwa"]},
      {"id":"exam.tongue","unit":"opcode","tau_sec":"exam","lag_sec":0,
        "maps_to":["G09.phase_lock","G06.cwa"]},
      {"id":"survey.pattern_set","unit":"binary_vec","tau_sec":"visit","lag_sec":0,
        "maps_to":["G06.cwa","G08.pbhl.flux"]},
      {"id":"lab.hr_variability","unit":"ms","tau_sec":"visit","lag_sec":30,
        "maps_to":["G03.phase"]}
    ],
    "cohort_keys":["practitioner_protocol","visit_window","pattern_dictionary","region"],
    "non_commuting":[["exam.pulse","intervention.herb_intake_just_prior"]]
  }
}

M3 Controls (policy/knobs)

{
  "M3_controls": {
    "knobs": [
      {"name":"formula_selection","type":"discrete","domain":"{FormulaA,...}",
        "cadence_visit":1,"owner":"Clinician"},
      {"name":"dose","type":"continuous","unit":"g/day","min":0,"max":60,"owner":"Clinician"},
      {"name":"adjuncts","type":"set","domain":"{acupoint_block, diet_rule,...}","owner":"Clinician"}
    ],
    "constraints":[
      "dose<=60","avoid_pairs(incompatibles)","pregnancy_blocklist==enforced"
    ]
  }
}

M4 State Space & Constraints

{
  "M4_state_space": {
    "state_vector":["symptom_burden","constitution_level","pattern_probs[*]","adherence"],
    "invariants":["0<=pattern_probs[i]<=1","sum(pattern_probs)=1"],
    "features":{"order_param":"pattern_entropy","control_param":"dose"},
    "degenerate_sets":["adherence==0"]
  }
}

M5 Intervention Modes

{
  "M5_interventions": {
    "catalog": [
      {"id":"formula.switch","mode":"policy","latency":"same_visit","reversible":true,
       "pre":{"band":"green_or_amber","cwa":0.98,"pri":0.20}},
      {"id":"dose.titrate","mode":"policy","latency":"days","reversible":true},
      {"id":"adjunct.acupoint_block","mode":"soft","latency":"minutes"}
    ],
    "fallbacks":{"on_pri_high":"defer_formula_change","on_cwa_fail":"recohort_by_protocol"}
  }
}

M6 Aggregation Plan

{
  "M6_aggregation_plan": {
    "aggregators":[
      {"name":"mean","fields":["pattern_probs[*]"],"cadence":"per_visit"},
      {"name":"trimmed_mean","fields":["symptom_burden"],"params":{"p":0.1}}
    ],
    "fallbacks":[{"name":"sequence_estimator","for":["pattern_probs[*]","symptom_burden"]}],
    "cohort_keys":["practitioner_protocol","pattern_dictionary","visit_window"],
    "thresholds":{"cwa":0.98,"pri":0.20,"min_cohort":25,"permutations":200}
  }
}

M7 PBHL Belt Ledger

{
  "M7_belt_ledger": {
    "gap":{"name":"symptom_burden_delta","unit":"score","window":"4w","target_delta":-12},
    "flux":{"source":"survey.pattern_set","cohort":"protocol","window":"4w","compute":"score_delta"},
    "twist":{"sources":["dose","adjuncts","adherence"],"model":"linear",
      "params":{"weights":{"dose":0.5,"adherence":0.4,"adjuncts":0.1}}},
    "alpha":0.6,"bands":{"green":0.08,"amber":0.15},
    "actions":{"red":["halt_formula_change","human_case_review"]}
  }
}

M8 Failure Signatures

{
  "M8_failure_signatures": {
    "classes":[
      {"id":"O4_non_commuting","predicate":"cwa<0.98",
        "first_aid":["recohort_by_protocol","sequence_estimator"]},
      {"id":"O2_drift","predicate":"ks_shift>0.1",
         "first_aid":["phase_lock_refresh","dictionary_recalibration"]}
    ]
  }
}

M9 Ethics & Safety

{
  "M9_ethics_safety": {
    "non_goals":["optimize_short_term_relief_at_risk_of_rebound","any_pregnancy_contraindication_breach"],
    "blocked_instruments":["unconsented_PII"],
    "hard_constraints":[{"name":"pregnancy_blocklist","op":"==","value":"enforced"}]
  }
}

M10 Evidence Contract

{
  "M10_evidence_contract": {
    "trace_schema_ref":"schema://decision_trace_v1",
    "hashing":{"algo":"sha256","chain":"prev_hash->hash"},
    "agreement":{"replicas":2,"min_score":0.98}
  }
}

D — Domain Residuals (3–5 rules, Tiny Rule-DSL)

{
  "rules":[
    {
      "id":"r1_pulse_heat_with_floating_override",
      "type":"counter_intuition",
      "predicate":{"and":[
        {"atom":{"op":"eq","field":"pulse.sign","value":"floating"}},
        {"atom":{"op":"eq","field":"tongue.coat","value":"yellow"}},
        {"atom":{"op":"gt","field":"symptom_burden","value":40}}
      ]},
      "effects":[
        {"op":"deny","target":"aggregator.mean"},
        {"op":"route","target":"pipeline.sequence_estimator"},
        {"op":"set","target":"adjuncts.add","params":{"id":"cooling_rule","on":true}}
      ]
    },
    {
      "id":"r2_pregnancy_blocklist_taboo",
      "type":"taboo_transform",
      "predicate":{"atom":{"op":"eq","field":"patient.pregnant","value":true}},
      "effects":[{"op":"forbid","target":"controls.formula_selection"}]
    },
    {
      "id":"r3_adherence_exception_routing",
      "type":"exception_routing",
      "predicate":{"atom":{"op":"lt","field":"adherence","value":0.6}},
      "effects":[{"op":"route","target":"pipeline.adherence_counseling"}],
      "fallback":{"op":"freeze","target":"controls.dose"}
    },
    {
      "id":"r4_dictionary_drift_phase_lock",
      "type":"counter_intuition",
      "predicate":{"atom":{"op":"gt","field":"phase_lock.kl_to_canonical","value":0.2}},
      "effects":[{"op":"set","target":"phase_lock.refresh","params":{"dictionary":"v_next"}}]
    }
  ],
  "precedence":["r2_pregnancy_blocklist_taboo","r4_dictionary_drift_phase_lock",
    "r1_pulse_heat_with_floating_override","r3_adherence_exception_routing"]
}

11.2 Surplus Dynamics — Org/Business Operating Model

G.
conservation_flow, surplus_dynamics, pbhl_belt_governance, certified_aggregation, meel_tradeoffs.

Intent. Track financial/attention/option surplus; govern leakage; certify when averaging KPIs is lawful; choose levers via MEEL.

M — Morphology Mapping

M1 Units & Dimensions

{
  "M1_units_dimensions": {
    "stocks":[
      {"name":"surplus_financial","unit":"USD"},
      {"name":"surplus_attention","unit":"min"},
      {"name":"surplus_option","unit":"count"}
    ],
    "flows":[
      {"name":"gen_financial","unit":"USD/day"},
      {"name":"leak_attention","unit":"min/day"}
    ],
    "transforms":[{"from":["USD/day","day"],"to":"USD"}]
  }
}

M2 Instrument → Operator Map

{
  "M2_instrument_operator": {
    "instruments":[
      {"id":"ledger.cashflow","unit":"USD/day","tau_sec":86400,
        "maps_to":["G01.conservation","G08.pbhl.flux"]},
      {"id":"product.analytics.attention","unit":"min","tau_sec":3600,"maps_to":["G02.surplus"]},
      {"id":"ops.ticket_counts","unit":"count","tau_sec":3600,"maps_to":["G02.surplus","G08.pbhl.twist"]}
    ],
    "cohort_keys":["business_unit","region","cadence_bucket"],
    "non_commuting":[["ops.ticket_counts","marketing.campaign_blast"]]
  }
}

M3 Controls

{
  "M3_controls": {
    "knobs":[
      {"name":"marketing_spend","type":"continuous","unit":"USD/day","min":0,"max":1e6,"owner":"CMO"},
      {"name":"headcount_allocation","type":"vector","unit":"FTE","owner":"COO"},
      {"name":"feature_release_rate","type":"continuous","unit":"rel/week","owner":"CPO"}
    ],
    "constraints":["sum(headcount_allocation)<=FTE_total"]
  }
}

M4 State Space & Constraints

{
  "M4_state_space": {
    "state_vector":["surplus_financial","surplus_attention","surplus_option","backlog","ticket_age"],
    "invariants":["surplus_financial>=0"],
    "features":{"order_param":"surplus_ratio=surplus_financial/opex","control_param":"marketing_spend"}
  }
}

M5 Interventions

{
  "M5_interventions": {
    "catalog":[
      {"id":"shift_headcount_to_product","mode":"structural","latency_days":14,"owner":"COO"},
      {"id":"pause_low_roi_campaigns","mode":"policy","latency_days":1,"owner":"CMO"},
      {"id":"focus_feature_knee","mode":"policy","latency_days":7,"owner":"CPO"}
    ]
  }
}

M6 Aggregation Plan

{
  "M6_aggregation_plan": {
    "aggregators":[
      {"name":"sum","fields":["gen_financial"],"cadence":"weekly"},
      {"name":"mean","fields":["surplus_ratio"],"cadence":"weekly"}
    ],
    "fallbacks":[{"name":"sequence_estimator","for":["surplus_ratio"]}],
    "cohort_keys":["business_unit","region","cadence_bucket"],
    "thresholds":{"cwa":0.98,"pri":0.20,"min_cohort":30,"permutations":200}
  }
}

M7 PBHL Belt

{
  "M7_belt_ledger": {
    "gap":{"name":"increase_surplus_ratio","unit":"ratio","window":"8w","target_delta":0.10},
    "flux":{"source":"ledger.cashflow","cohort":"business_unit","window":"8w","compute":"ratio_delta"},
    "twist":{"sources":["headcount_allocation","ticket_age"],"model":"linear",
      "params":{"weights":{"headcount_allocation":0.6,"ticket_age":0.4}}},
    "alpha":0.6,"bands":{"green":0.08,"amber":0.15}
  }
}

M8 Failure Signatures

{"M8_failure_signatures":{"classes":[
  {"id":"O2_drift","predicate":"ks_shift>0.1","first_aid":["recohort","recalibrate_units"]},
  {"id":"O4_non_commuting","predicate":"cwa<0.98","first_aid":["disable_mean_sum","sequence_estimator"]}
]}}

M9 Ethics & Safety

{
  "M9_ethics_safety": {
    "non_goals":["boost_profit_via_unfair_layoffs","privacy_violations"],
    "hard_constraints":[{"name":"privacy","op":"==","value":"enforced"}]
  }
}

M10 Evidence Contract

{"M10_evidence_contract":{"trace_schema_ref":"schema://decision_trace_v1","hashing":{"algo":"sha256"}}}

D — Residual Rules (3–5)

{
  "rules":[
    {
      "id":"r1_attention_leak_override",
      "type":"counter_intuition",
      "predicate":{"and":[
        {"atom":{"op":"gt","field":"leak_attention","value":20000}},
        {"atom":{"op":"gt","field":"marketing_spend","value":100000}}
      ]},
      "effects":[
        {"op":"deny","target":"aggregator.mean"},
        {"op":"route","target":"pipeline.sequence_estimator"},
        {"op":"set","target":"controls.pause_low_roi_campaigns","params":{"on":true}}
      ]
    },
    {
      "id":"r2_role_flip_capex",
      "type":"counter_intuition",
      "predicate":{"atom":{"op":"gt","field":"ticket_age","value":14}},
      "effects":[{"op":"set","target":"controls.headcount_allocation.product","params":{"delta_fte":5}}]
    },
    {
      "id":"r3_substitution_collision_taboo",
      "type":"taboo_transform",
      "predicate":{"atom":{"op":"gt","field":"ops.utilization","value":0.9}},
      "effects":[{"op":"forbid","target":"feature_release_rate_increase"}]
    },
    {
      "id":"r4_amber_scope_narrow",
      "type":"exception_routing",
      "predicate":{"atom":{"op":"eq","field":"pbhl.band","value":"amber"}},
      "effects":[{"op":"set","target":"scope.reduction_pct","params":{"value":20}}]
    }
  ],
  "precedence":["r3_substitution_collision_taboo","r1_attention_leak_override",
    "r4_amber_scope_narrow","r2_role_flip_capex"]
}

11.3 Peaks & Traps — Product/Model Optimization

G.
phase_criticality, peaks_traps, certified_aggregation, pbhl_belt_governance, meel_tradeoffs.

Intent. Detect plateaus/lock-ins; pick escape operators (kick/re-seed/topology edit); certify when to average experiment results; govern risk/cost via PBHL.

M — Morphology Mapping

M1 Units & Dimensions

{
  "M1_units_dimensions": {
    "stocks":[{"name":"fitness","unit":"score"}],
    "flows":[{"name":"delta_fitness","unit":"score/iter"}],
    "transforms":[{"from":["score/iter","iter"],"to":"score"}]
  }
}

M2 Instrument → Operator Map

{
  "M2_instrument_operator": {
    "instruments":[
      {"id":"exp.metrics","unit":"score","tau_sec":"iter","maps_to":["G06.cwa","G04.peaks_traps"]},
      {"id":"cost.trace","unit":"USD","tau_sec":"iter","maps_to":["G10.meel"]},
      {"id":"latency.trace","unit":"ms","tau_sec":"iter","maps_to":["G10.meel"]}
    ],
    "cohort_keys":["experiment_id","dataset","seed_bucket"],
    "non_commuting":[["exp.metrics","reset_operator"]]
  }
}

M3 Controls

{
  "M3_controls": {
    "knobs":[
      {"name":"kick_temp","type":"continuous","unit":"unitless","min":0,"max":1},
      {"name":"reseeds","type":"integer","min":0,"max":20},
      {"name":"topology_edit","type":"enum","domain":"{relax_reg,add_feature_block,change_optimizer}"}
    ]
  }
}

M4 State Space & Constraints

{
  "M4_state_space": {
    "state_vector":["fitness","curvature","cost","latency"],
    "features":{"order_param":"fitness","control_param":"kick_temp"},
    "degenerate_sets":["fitness_nan"]
  }
}

M5 Interventions

{
  "M5_interventions": {
    "catalog":[
      {"id":"kick","mode":"soft","latency_iter":1},
      {"id":"reseeds","mode":"policy","latency_iter":5},
      {"id":"topology_edit","mode":"structural","latency_iter":20}
    ],
    "fallbacks":{"on_pri_high":"sequence_eval"}
  }
}

M6 Aggregation Plan

{
  "M6_aggregation_plan": {
    "aggregators":[{"name":"mean","fields":["fitness"],"cadence":"per_phase"}],
    "fallbacks":[{"name":"quantile","for":["fitness"],"params":{"q":0.5}}],
    "cohort_keys":["dataset","seed_bucket","phase"],
    "thresholds":{"cwa":0.98,"pri":0.20,"permutations":200,"min_cohort":20}
  }
}

M7 PBHL Belt

{
  "M7_belt_ledger": {
    "gap":{"name":"fitness_gain","unit":"score","window":"1w","target_delta":+0.02},
    "flux":{"source":"exp.metrics","cohort":"dataset","window":"1w","compute":"score_delta"},
    "twist":{"sources":["cost","latency"],"model":"linear","params":{"weights":{"cost":0.5,"latency":0.5}}},
    "alpha":0.6,"bands":{"green":0.08,"amber":0.15}
  }
}

M8 Failure Signatures

{
  "M8_failure_signatures": {
    "classes":[
      {"id":"O3_trap","predicate":"curvature_up && delta_fitness~0",
        "first_aid":["kick","reseeds","topology_edit"]},
      {"id":"O4_non_commuting","predicate":"cwa<0.98","first_aid":["quantile","sequence_eval"]}
    ]
  }
}

M9 Ethics & Safety

{"M9_ethics_safety":{"non_goals":["optimize_accuracy_by_disparate_impact"],
  "hard_constraints":[{"name":"fairness_gap","op":"<=","value":0.03}]}}

M10 Evidence Contract

{"M10_evidence_contract":{"trace_schema_ref":"schema://decision_trace_v1","hashing":{"algo":"sha256"}}}

D — Lock-in Breakers (3–5 rules)

{
  "rules":[
    {
      "id":"r1_plateau_then_kick",
      "type":"counter_intuition",
      "predicate":{"and":[
        {"atom":{"op":"lt","field":"delta_fitness_window","value":0.002}},
        {"atom":{"op":"gt","field":"curvature","value":0.8}}
      ]},
      "effects":[{"op":"set","target":"controls.kick_temp","params":{"value":0.3}}]
    },
    {
      "id":"r2_kick_budget_guard",
      "type":"taboo_transform",
      "predicate":{"atom":{"op":"gt","field":"cost_per_gain_est","value":5000}},
      "effects":[{"op":"forbid","target":"kick"}]
    },
    {
      "id":"r3_reseed_if_variance_high",
      "type":"counter_intuition",
      "predicate":{"atom":{"op":"gt","field":"fitness_variance","value":0.01}},
      "effects":[{"op":"set","target":"controls.reseeds","params":{"value":10}}]
    },
    {
      "id":"r4_topology_edit_on_repeat_trap",
      "type":"exception_routing",
      "predicate":{"atom":{"op":"ge","field":"trap_repeats","value":3}},
      "effects":[{"op":"route","target":"pipeline.topology_edit"}]
    }
  ],
  "precedence":["r2_kick_budget_guard","r4_topology_edit_on_repeat_trap","r1_plateau_then_kick",
    "r3_reseed_if_variance_high"]
}

11.4 ObserverOps (Meta Runtime Pack)

G.
observer_runtime_invariants, slot_economics, certified_aggregation, pbhl_belt_governance, phase_lock_symbols.

Intent. Provide the execution substrate for all EM-Packs: immutable traces, cross-observer agreement, slots, certified aggregation, governed closure. D: none/minimal.

M — Morphology Mapping

M1–M4 (compact)

{
  "M1_units_dimensions":{"stocks":[{"name":"attention_slots","unit":"count"}], 
    "flows":[{"name":"allocations","unit":"count/tick"}]},
  "M2_instrument_operator":{"instruments":[
    {"id":"runtime.trace_writer","unit":"hash","tau_sec":"tick","maps_to":["G05.observer_invariants"]},
    {"id":"runtime.slot_meter","unit":"count","tau_sec":"tick","maps_to":["G07.slots"]},
    {"id":"runtime.cwa_tester","unit":"score","tau_sec":"tick","maps_to":["G06.cwa"]}
  ],"cohort_keys":["policy_id","tick_window"]},
  "M3_controls":{"knobs":[
    {"name":"slot_caps","type":"vector","unit":"count","owner":"Ops"},
    {"name":"permutation_budget","type":"integer","unit":"count","owner":"Ops"}
  ]},
  "M4_state_space":{"state_vector":["slots.attention","slots.memory","slots.tools","agreement"],
    "invariants":["slots.*>=0"]}
}

M5–M7 (governance loop)

{
  "M5_interventions":{"catalog":[
    {"id":"increase_permutation_budget","mode":"policy","latency_ticks":1},
    {"id":"throttle_tool_fanout","mode":"policy","latency_ticks":1},
    {"id":"escalate_human_review","mode":"policy","latency_ticks":1}
  ]},
  "M6_aggregation_plan":{"aggregators":[{"name":"mean","fields":["agreement"],"cadence":"1h"}],
    "cohort_keys":["policy_id","tick_window"],"thresholds":{"cwa":0.98,"pri":0.20,
      "permutations":200,"min_cohort":60}},
  "M7_belt_ledger":{
    "gap":{"name":"keep_agreement","unit":"ratio","window":"1h","target_delta":0.0},
    "flux":{"source":"runtime.agreement","cohort":"policy_id","window":"1h","compute":"ratio"},
    "twist":{"sources":["slot_utilization","tool_fanout"],"model":"linear",
      "params":{"weights":{"slot_utilization":0.7,"tool_fanout":0.3}}},
    "alpha":0.6,"bands":{"green":0.08,"amber":0.15}
  }
}

M8–M10 (failures, ethics, evidence)

{
  "M8_failure_signatures":{"classes":[
    {"id":"O1_limit_cycle_ops","predicate":"acf_k>=0.6",
      "first_aid":["halve_gain","increase_measure_cadence:2x"]},
    {"id":"O4_non_commuting","predicate":"cwa<0.98",
      "first_aid":["disable_mean_sum","sequence_estimator"]}
  ]},
  "M9_ethics_safety":{"non_goals":["retro_edit_traces"],
    "hard_constraints":[{"name":"trace_write_once","op":"==","value":"enforced"}]},
  "M10_evidence_contract":{"trace_schema_ref":"schema://decision_trace_v1",
    "agreement":{"replicas":2,"min_score":0.98}}
}

D — Residuals

{
  "rules": [],
  "precedence": []
}

Case Appendix: Quick “How to Run” (all cases)

# Build & lint each case pack
empack build --manifest manifest.json --schemas ./schema
empack certify --bundle evidence.bundle --policy gates.json
empack publish --manifest manifest.json --attestation attestation.json

# Live metrics (Chapter 10 dashboard)
empack dashboard --period 2025-W39 --out dashboard.json

That completes Chapter 11 with four worked mini-maps (TCM, Surplus Dynamics, Peaks & Traps, ObserverOps meta), each with filled M templates and D examples (except ObserverOps, which is intentionally minimal on D).

12.1 Build the 12×10 G/M Base Matrix (Workbench)

Purpose. Make selection/assembly fast and auditable: rows = 12 skeletons G, columns = 10 morphology templates M. Each cell carries defaults, warnings, tests.

Matrix schema (JSON)

{
  "$id": "schema://gm_matrix_v1",
  "g_skeletons": [
    "conservation_flow","surplus_dynamics","phase_criticality","peaks_traps",
    "observer_runtime_invariants","certified_aggregation","slot_economics",
    "pbhl_belt_governance","phase_lock_symbols","meel_tradeoffs",
    "sida_deepening","substitution_topology"
  ],
  "m_templates": [
    "units","instrument_map","controls","state_space","interventions",
    "aggregation_plan","belt_ledger","failure_signatures","ethics_safety","evidence_contract"
  ],
  "cells": [
    {
      "g": "certified_aggregation",
      "m": "aggregation_plan",
      "defaults": { "cwa": 0.98, "pri": 0.20, "permutations": 200, "min_cohort": 30 },
      "warnings": ["do_not_mix_levels_and_rates","no_outcome_key_in_cohorts"],
      "tests": ["cwa_stress_perms","pri_bootstrap"]
    }
  ],
  "lint": {
    "required_pairs": [
      ["pbhl_belt_governance","belt_ledger"],
      ["observer_runtime_invariants","evidence_contract"]
    ],
    "forbidden_pairs": [
      ["conservation_flow","aggregation_plan:mean_without_cwa"]
    ]
  }
}

Workbench CLI

gm init --out gm_matrix.json
gm lint --matrix gm_matrix.json --family family_profile.json
gm pick --family family_profile.json --out starter_pack/

12.2 Curate 100 “Families” and Canonical M-Defaults

Purpose. Group domains that share structural invariants and instruments, so most work is mapping M and harvesting a tiny D.

Family profile schema (JSON)

{
  "$id": "schema://family_profile_v1",
  "family_id": "inventory_flow",
  "description": "Stock–flow ops with safety & service constraints",
  "g_stack": ["conservation_flow","certified_aggregation","pbhl_belt_governance","phase_lock_symbols"],
  "m_defaults": {
    "units": { "stocks":["units"], "flows":["units/h"], "transforms":[{"from":["1/h","h"],"to":"1"}] },
    "instrument_map": { "cohort_keys":["unit","instrument_family","cadence_bucket","protocol","tz"] },
    "aggregation_plan": { "cwa":0.98,"pri":0.20,"permutations":200,"min_cohort":30 },
    "belt_ledger": { "alpha":0.6,"bands":{"green":0.08,"amber":0.15} },
    "evidence_contract": { "trace_schema_ref":"schema://decision_trace_v1",
      "agreement":{"replicas":2,"min_score":0.98} }
  },
  "inclusion": {
    "signals":["conserved_levels","commutable_instruments"],
    "ethics_hard":["privacy_enforced"]
  },
  "exemplars": ["bike_share_ops","warehouse_replenishment","hospital_bed_alloc"]
}

Curation checklist (copy/paste)

Clear order parameter & unit model (M1/M4 ready).
Instruments with stable cadence; non-commuting pairs listed (M2).
Canonical cohort keys defined (M2/M6).
PBHL alpha/bands set; action table present (M7).
Ethics hard constraints machine-checkable (M9).
Evidence schema pins members_hash and prev_hash (M10).

12.3 D-Harvest Sprint per Family (target ≤ 5 rules/domain)

Purpose. Convert family defaults into concrete domain empowerments by mining ≤ 5 residual rules + 100–300 lexicon using SIDA × MEEL.

Sprint plan (10 working days)

Day	Track	Output
1–2	B-fill	M1–M4 completed; lint pass (u≥0.95, c≥0.85, g≥0.9, a≥0.75, b≥0.9, e≥0.95)
3–5	SIDA	Candidate predicates from high-PRI cohorts, failure signatures
6–7	MEEL	Pareto choose minimal ruleset (k≤5); compile lexicon (100–300)
8	Shadow	Run shadow eval; counter-tests; compute ∥D∥
9	Cert	CWA/PRI/PBHL batteries on canary cohort
10	Ship	Manifest + attestation; add to wave

D-harvest backlog (JSON)

{
  "$id": "schema://d_harvest_backlog_v1",
  "family_id": "inventory_flow",
  "domains": [
    {
      "domain_id": "warehouse_replenishment.na",
      "candidates": ["night_shift_sensor_bias","truck_dock_collision"],
      "rules_k": 4,
      "lexicon_size": 168,
      "edge_tables": 2,
      "∥D∥": 4.7,
      "shadow_pass": true,
      "notes": "PRI p95 improved 0.07→0.16 after phase-lock"
    }
  ]
}

Exit criteria (per domain).

Gates pass: CWA/PRI/PBHL & ethics.
Budget: $\|D\| \le 5$ ; if > 5, open “Fix M / New G” ticket.
Artifacts: ruleset JSON (Ch.9.6), lexicon, evidence bundle.

12.4 Release Cadence — Monthly Waves with Public Dashboards

Purpose. Ship at a predictable tempo; make safety & capability visible.

Wave manifest (JSON)

{
  "$id": "schema://wave_manifest_v1",
  "wave_id": "2025-10",
  "families": ["inventory_flow","clinical_triage","pricing_control"],
  "empacks": [
    {"name":"empack.bike_share_ops.v1.4.0","status":"canary","attestation":"sha256:..."},
    {"name":"empack.warehouse_replenishment.v1.1.0","status":"full","attestation":"sha256:..."}
  ],
  "policy": {"cwa":0.98,"pri":0.20,"pbhl_green_time_min":0.80},
  "rollback": {"guardrail":"pbhl_band!='red' && fairness_gap<=0.03","action":"auto"},
  "public_dashboard": "schema://empowerment_dashboard_v1"
}

Release ladder (per EM-Pack)

Shadow (read-only) → 1–2 weeks
Canary (5–10%) with guardrails
Scaled (25–50%)
Full (≥ 90%), keep prior version in shadow 1–2 cycles

Public dashboard (tie to Ch.10.4)

Show: grant rate, PRI p95, PBHL band time, agreement, ∥D∥.
Redact: plaintext rules, PII.
Provide: audit bundle links (hash-addressed), incident summaries, and fix logs.

CLI

empack publish --wave wave_2025-10.json
empack dashboard --period 2025-10 --publish public_dashboard.json

12.5 Continuous Improvement — Promote a New G When ∥D∥ Bloats

Trigger. If, within a family (or cross-family motif):

Median ∥D∥ > 10 across ≥ 3 adjacent domains or
Chronic CWA failures despite cohorting or
PRI p95 > 0.20 after phase-lock or
PBHL sits Amber/Red with actions exhausted,

→ Open a G-promotion RFC.

G-promotion RFC (JSON)

{
  "$id": "schema://g_promotion_rfc_v1",
  "rfc_id": "G13_temporal_anti_commutator.v0",
  "motif": "non_commuting_tick_instruments_in_finance_ops",
  "evidence": {
    "domains":[
      {"id":"market_making.hft","D_rules":11,"cwa":0.91,"pri_p95":0.34,"pbhl_r":0.18},
      {"id":"grid_dispatch.subsec","D_rules":12,"cwa":0.93,"pri_p95":0.28,"pbhl_r":0.17},
      {"id":"ad_auctions.realtime","D_rules":10,"cwa":0.92,"pri_p95":0.31,"pbhl_r":0.16}
    ],
    "bundles":["sha256:...","sha256:...","sha256:..."]
  },
  "proposal": {
    "operators": ["ordered_integral","commutator_penalty","phase_windowing"],
    "interfaces": {"required_units":["tick","lot"],"aggregate":"order-aware"},
    "tests": ["cwa_windowed_grant","pri_drop_under_windowing"]
  },
  "acceptance": {
    "delta": {"cwa_grant_rate": "+>=0.15", "pri_p95": "<=0.20", "median_D_rules": "->=2"},
    "scope": ["finance_ops","realtime_markets","grid_control"]
  },
  "rollout": {"families":["pricing_control","realtime_ops"],"pilot_n":5,"timeline_weeks":6}
}

Promotion process (gated)

Review (Architecture + Safety + Auditor) — 1 week.
Prototype (lab) — 2 weeks; pass acceptance deltas.
Pilot in 3–5 domains; AB against old stack.
Back-port: deprecate compensating D rules (reduce ∥D∥).
Document in the G/M matrix; update workbench defaults.

Fail-closed rule. If the prototype misses deltas, do not ship; escalate to instrumentation upgrade (reduce ρ/κ in K) or narrow scope.

Capacity & Org Pattern (who does the work)

Per line (squad of 6–7):

Architect (G owner)
Domain Lead (M owner)
Residual Editor (D owner)
Certification Owner (CWA/PRI/PBHL)
Release Engineer (attestation, CLI, dashboards)
Safety/Auditor (ethics, replay)
Optional: Data Engineer (instrument pipelines)

WIP limits (per line): A(∞)/B(5)/C(3)/D(2)/E(3) (Ch.8), with weekly ops review.

Scaling Metrics (program-level SLOs)

Throughput: wave EM-Packs/month (target 60–100).
Quality: grant rate ≥ 0.75, PRI p95 ≤ 0.20, PBHL Green ≥ 0.80.
Simplicity: median ∥D∥ ≤ 5; tail p90 ≤ 7.
Safety: 0 hard-ethics violations; agreement ≥ 0.98.
Learning: G promotions/quarter ≥ 1 when triggers hit; D deprecations per promotion ≥ 20%.

Dashboard rollup aligns with schema://empowerment_dashboard_v1 (Ch.10.4).

One-page Runbook (copy/paste)

Workbench: generate G/M matrix, lint pairs.
Curate: pick families; publish family profiles with M-defaults.
Harvest: run 10-day D-sprints per family; enforce gates; ship to wave.
Release: monthly waves; shadow → canary → scaled → full; public dashboards.
Improve: watch ∥D∥, CWA/PRI/PBHL; when bloat/failure persists, promote a new G via RFC.

This chapter gives you the factory blueprint to move from a handful of domains to 600–1200, without sacrificing safety or simplicity—and with a clear path to invent new bones (G) only when the data prove you need them.

13.1 Non-commuting instruments and order effects

Purpose. Detect and control when measurement order/phase changes results.

A) Registry & tests (copy-paste)

{
  "$id": "schema://non_commuting_registry_v1",
  "cohort_keys": ["unit","instrument_family","cadence_bucket","protocol","tz"],
  "pairs": [
    {"a":"ops.rebalance_log","b":"app.trip_events","reason":"feedback coupling"},
    {"a":"marketing.campaign_blast","b":"ops.ticket_counts","reason":"queueing"}
  ],
  "tests": {
    "cwa": {"permutations": 200, "threshold": 0.98, "windows": ["1h","24h"]},
    "pri": {"bootstrap": 200, "threshold": 0.20},
    "stress_perms": ["time_sorted","time_reversed","block_swap"]
  },
  "deny_on": ["cwa_fail","pri_high"]
}

Operational rule.
If a pair is in the registry or empirical CWA fails in any active window, deny mean/sum for that cohort and route to order-sensitive estimators (sequence/causal) or re-cohort.

B) Detector hook (pseudo)

def non_commuting_guard(cohort):
    cwa = test_cwa(cohort, A="mean", P=cfg.permutations, windows=cfg.windows)
    pri = estimate_pri(cohort, decision_fn, P=cfg.permutations, B=cfg.bootstrap)
    if cwa < 0.98 or pri > 0.20:
        return {"granted": False, "route": "sequence_estimator"}
    return {"granted": True}

13.2 Guarding against “average kills truth” (CWA)

Purpose. Make arithmetic aggregation permissioned (not default).

A) Aggregator permission policy

{
  "$id": "policy://cwa_guard_v1",
  "aggregators_allowed": ["mean","sum","trimmed_mean:p=0.1","quantile:q=0.5"],
  "grant_rule": {
    "cwa_min": 0.98,
    "pri_max": 0.20,
    "min_cohort": 30,
    "permutations": 200,
    "windows": ["1h","24h"],
    "drift_ks_max": 0.10
  },
  "fallbacks": [
    {"on":"cwa_fail","to":"sequence_estimator"},
    {"on":"pri_high","to":"sequence_estimator"},
    {"on":"tiny_cohort","to":"quantile:q=0.5"}
  ],
  "trace_fields": ["granted","cwa","pri","members_hash","cohort_manifest_hash"]
}

B) Enforcer (DSL snippet)

{
  "permit_agg": {
    "if_all": [
      {"metric":"cwa","op":">=","value":0.98},
      {"metric":"pri","op":"<=","value":0.20},
      {"metric":"cohort_size","op":">=","value":30}
    ],
    "then":"use(primary_aggregator)",
    "else":"route(fallback)"
  }
}

Governance note. Any shipped average must have a grant record (with members_hash). Missing record ⇒ audit failure.

13.3 Belt-band actions under Red (halt, human-in-the-loop, instrument swap)

Purpose. Turn governance from dashboards into actuators.

A) Red-band playbook (copy-paste)

{
  "$id": "policy://pbhl_red_actions_v1",
  "band_rules": {
    "green": ["continue"],
    "amber": ["reduce_scope:20%","increase_measure_cadence:2x","assign_owner"],
    "red": [
      "halt:high_risk_interventions",
      "rollback:last_policy_change",
      "escalate:human_in_the_loop",
      "open_incident:sev2",
      "instrument_swap_or_recalibrate"
    ]
  },
  "sla": {
    "amber_mitigation_deadline_min": 120,
    "red_halt_time_min": 10,
    "incident_postmortem_days": 7
  },
  "evidence_required": [
    "belt_snapshot","action_execution_receipts","cohort_members_hash",
    "cwa/pri_last","owner_ack","approvals"
  ]
}

B) Incident record (immutable)

{
  "incident": {
    "id":"inc-2025-10-042",
    "band":"red",
    "actions":["halt","rollback","escalate"],
    "owner":"DutyManager",
    "opened_at":"2025-10-02T14:03:00Z",
    "bundle_hash":"sha256:...",
    "status":"mitigating"
  }
}

Runbook (one-pager).

Detect Red (r>0.15) → halt within 10 min.
Rollback most recent policy/lever.
Escalate to named human approver; require sign-off.
Swap/recalibrate instrument(s) if O2/O4 signatures present.
Write incident + export audit bundle; schedule post-mortem ≤ 7 days.

13.4 Privacy of residual priors (opaque serving; no raw leakage)

Goal. Use domain genius without leaking it.

A) Serving & attestation policy

{
  "$id": "policy://residual_privacy_v1",
  "shipping_mode": ["remote_service","enclave","wasm_sandbox"],
  "no_plaintext_rules": true,
  "logs_only": ["rule_ids","attest_id","effects","scores.cwa","scores.pri","scores.pbhl_r_pred"],
  "manifest_pins": ["code_hash","tests_hash","manifest_hash"],
  "key_rotation_days": 90,
  "block_run_if_attestation_stale": true
}

B) Evidence contract addenda

Never store D predicates/effects in plaintext.
Always log attest_id, rule_ids, and cohort fingerprints—not inputs.
Minimum cohort size for any public metrics: ≥30 (k-anonymity-like floor).
PII blocked in M9; derived features must pass the same blocklist.

Refusal rule. If a regulator requires plaintext D, provide redacted decompile under NDA off-runtime; runtime stays opaque.

13.5 Domain boundaries and misuse prevention

Purpose. Keep the system inside its competence; prevent harmful/illicit uses.

A) Boundary contract (copy-paste)

{
  "$id": "policy://domain_boundary_v1",
  "in_scope": ["inventory_flow","bike_share_ops","warehouse_replenishment"],
  "out_of_scope": [
    "surveillance_PIIs","protected_attribute_targeting",
    "medical_diagnosis_without_licensed_supervision"
  ],
  "high_K_block": {
    "K_threshold": 0.40,
    "actions": ["sandbox","raise_gates:cwa=0.995,pri=0.15","require_human_review"],
    "proceed_only_if": ["new_G_RFC_approved","instrumentation_upgrade_done"]
  },
  "taboo_transforms": [
    "average_levels_with_rates",
    "price_delta_on_protected_or_proxy",
    "retro_edit_trace"
  ],
  "rate_limits": {
    "decision_qps_max": 50,
    "burst": 100,
    "degraded_route": "human_queue"
  }
}

B) Misuse detector (Tiny Rule-DSL)

{
  "rules":[
    {
      "id":"misuse_protected_pricing",
      "type":"taboo_transform",
      "predicate":{"atom":{"op":"depends_on","field":"price_delta","value":"protected_attr_or_proxy"}},
      "effects":[{"op":"forbid","target":"deploy"},{"op":"escalate","target":"ethics_officer"}]
    },
    {
      "id":"misuse_domain_out_of_scope",
      "type":"exception_routing",
      "predicate":{"atom":{"op":"in","field":"requested_domain","value":"$boundary.out_of_scope"}},
      "effects":[{"op":"route","target":"sandbox"},{"op":"notify","target":"governance_board"}]
    }
  ],
  "precedence":["misuse_protected_pricing","misuse_domain_out_of_scope"]
}

C) Governance checklist (ship-stop)

Boundary contract loaded; requested domain ∈ in-scope.
High-K guard applied if K≥0.40 (or unknown).
Taboo transforms enforced (unit mix, protected pricing, retro-edits).
Rate limits active; degraded path defined.
Evidence bundle exportable on demand; agreement ≥ 0.98 confirmed.

Red-team suite (recommended)

{
  "$id": "suite://governance_redteam_v1",
  "tests": [
    "membership_inference",
    "cohort_reconstruction_from_dashboard",
    "label_leak_via_cohort_keys",
    "order_effect_exploit (phase-sort flip)",
    "retro_edit_attempt",
    "protected_pricing_probe",
    "k_anonymity_floor_breach"
  ],
  "pass_criteria": {
    "no_plaintext_D_leak": true,
    "cwa_guard_unbypassable": true,
    "taboo_fires_on_probe": true,
    "dashboard_privacy_respected": true
  }
}

One-page governance runbook (copy-paste)

READY-CHECK: ethics guards, boundary contract, sensor health, slot caps.
MEASURE: cohort by instruments/units; hash inputs; no PII.
AGGREGATE: run CWA/PRI; deny mean/sum unless granted; log grant record.
GOVERN: compute PBHL; Green→continue, Amber→mitigate (SLA 120 min), Red→halt/rollback/escalate (SLA 10 min) + incident bundle.
TRACE: append-only hash chain; cross-observer agreement ≥ 0.98; export bundles on request.
PRIVACY: D is opaque; rotate keys; never log predicates/effects in plaintext.
BOUNDARIES: if high-K or out-of-scope, sandbox or raise gates; require human-in-the-loop or new-G RFC.

This chapter makes “safe by design” executable: non-commutation is tested, averages are permissioned, Red means act now, D stays private, and domain limits are machine-checkable.

14.1 Capability-as-Attestation (CaaA): pay per certified output

Idea. Billing is triggered only by attested certification at decision time. If it isn’t certified, it isn’t billable.

A) Certified output record (billing atom)

{
  "$id": "schema://certified_output_v1",
  "ts": "2025-10-01T12:34:56Z",
  "policy_id": "empack.bike_share_ops.v1.4.0",
  "decision_id": "dec-7c2f...",
  "attest_id": "att-2025-10-01-abc",
  "aggregation": {
    "granted": true,
    "cwa": 0.992,
    "pri": 0.11,
    "members_hash": "sha256:deadbeef"
  },
  "belt": {"r": 0.07, "band": "green"},
  "cohort_manifest_hash": "sha256:ff09...",
  "price_class": "certified.standard",
  "unit_price_usd": 0.0049,
  "sig": "base64:..."
}

B) Usage → invoice pipeline

{
  "$id": "schema://invoice_v1",
  "invoice_id": "inv-2025-10-01-001",
  "period": ["2025-10-01T00:00:00Z","2025-10-01T23:59:59Z"],
  "lines": [
    {"sku":"certified.standard","qty": 118900, "unit_price_usd": 0.0049, "amount_usd": 583.61},
    {"sku":"fallback.sequence","qty": 4556, "unit_price_usd": 0.0015, "amount_usd": 6.83}
  ],
  "credits": [
    {"reason":"pbhl_red_rebate","amount_usd": -4.20, "evidence_bundle":"sha256:..."}
  ],
  "total_usd": 586.24,
  "attest_root": "sha256:bundle_root",
  "signature": "base64:..."
}

Policy knobs (recommended):

Band-based rebates: if a deployment spends >1% time in Red, auto-credit a fixed % for that window.
No-charge windows: ethics block, agreement < 0.98, or certification kit unavailable ⇒ $0 for those decisions.
Disputes: cite decision_id; replay via /audit/replay returns agreement score and a verdict.

CLI

empack meter --from 2025-10-01 --to 2025-10-01 --out usage.json
empack invoice create --usage usage.json --out invoice.json
empack invoice dispute --id inv-2025-10-01-001 --decisions dec_ids.json

14.2 Attractor Marketplace: third-party EM-Packs (must pass certification)

Idea. A curated store of EM-Packs (“attractors”) that prove capability under gates. Listings display attested metrics, not hype.

A) Listing schema

{
  "$id": "schema://market_listing_v1",
  "name": "empack.hospital_bed_alloc.v1.2.1",
  "publisher": "Acme Health",
  "family": "inventory_flow",
  "targets": ["bed_allocation","shift_planning"],
  "cert_status": "PASS",
  "metrics": {
    "cwa_grant_rate": 0.83,
    "pri_p95": 0.18,
    "pbhl_green_time": 0.86,
    "agreement": 0.989,
    "D_rules": 4,
    "lexicon_size": 176
  },
  "pricing": {"per_certified_output_usd": 0.019},
  "manifest_hash": "sha256:...",
  "attestation_hash": "sha256:...",
  "audit_api": ["/audit/attestation/{id}","/audit/bundle?range=..."],
  "ethics": {"hard": ["fairness_gap<=0.03"], "pii": "blocked"},
  "support": {"sla":"99.9%","response_hours":24}
}

B) Onboarding & revocation

Must pass public cert harness (CWA/PRI/PBHL) on reference datasets or synthetic testbeds.
Shadow period (read-only) required before listing.
Revocation if: metrics regress beyond policy, plaintext D is leaked, or hard-ethics violated.

Revenue share model (example):

80% publisher / 20% platform on net certified revenue; additional 5% bonus pool for exemplar residuals (below).

14.3 Open vs. closed: open G/M & evaluation kits; licensed D

Principle. Keep the bones (G), mappings (M), and cert harness open so everyone can build; keep D private/attested to protect domain know-how and safety.

A) Licensing matrix

Asset	License	Rationale
G skeletons (code/DSL)	Apache-2.0/MIT	Maximize reuse, scrutiny, forks of invariants/operators
M templates + schemas	Apache-2.0/MIT	Encourage standardized mappings and linting
Certification harness	Apache-2.0	Public repeatability of CWA/PRI/PBHL
Reference datasets/testbeds	CC-BY/ODC or synthetic	Reproducibility w/ privacy
D plugins (residual priors)	Commercial, opaque	Protect domain IP & reduce misuse

B) Compliance hooks

{
  "$id": "policy://open_closed_compliance_v1",
  "must_open": ["G/*","M/*","cert_harness/*"],
  "must_opaque": ["D/*"],
  "logs_only": ["attest_id","rule_ids","effects","scores.*"],
  "prohibited": ["plaintext_D","reverse_engineer_runtime"],
  "audit": {"replay_required": true, "third_party_reviewer_allowlist": ["NGO_A","Uni_B"]}
}

14.4 Incentive design: reward residual quality, not prompt tricks

Goal. Pay and rank on verified capability and parsimony of D, not superficial prompt engineering.

A) Residual Quality Score (RQS)

\text{RQS} = \underbrace{w_C \cdot \Delta C}_{\text{certified capability gain}} - \underbrace{\lambda \cdot \|D\|}_{\text{parsimony}} - \underbrace{w_L \cdot \text{latency}}_{\text{efficiency}} - \underbrace{w_R \cdot \text{risk}}_{\text{PRI/PBHL penalties}}

Compute ΔC from the eval dashboard (Chapter 10).
$\|D\|$ as defined earlier (rules + lexicon + edges).
Risk term increases if PRI p95 approaches 0.20 or PBHL leaves Green.

Leaderboard field (per EM-Pack):

{
  "$id": "schema://residual_quality_score_v1",
  "name": "empack.bikeshare.v1.4.0",
  "deltaC": 0.23,
  "D_norm": 4.6,
  "latency_ms": 180,
  "pri_p95": 0.16,
  "pbhl_green_time": 0.86,
  "RQS": 0.23 - 0.046 - 0.018 - 0.004 = 0.162
}

B) Challenge protocol (copy-paste)

{
  "$id": "schema://residual_challenge_v1",
  "objective": "Maximize RQS under gates (CWA, PRI, PBHL) on blind domains",
  "tracks": ["inventory_flow","clinical_triage","pricing_control"],
  "rules": {
    "must_use": ["open G/M","public cert harness"],
    "D_budget": {"k_rules_max": 5, "lexicon_range": [100,300]},
    "no_points_for": ["prompt_style_only"],
    "disqualify_if": ["plaintext_D","ethics_hard_violation","agreement<0.98"]
  },
  "rewards": {
    "cash_pool_usd": 100000,
    "royalty_multiplier": {"RQS_top10": 1.1, "RQS_top3": 1.25}
  },
  "reporting": ["attestation","evidence_bundle","AB_results"]
}

Why this works: To win, teams must raise capability with minimal D while keeping order safety (CWA/PRI) and governed closure (PBHL). Prompt tricks that don’t survive certification simply don’t score.

Ecosystem APIs (minimal)

# Certification & attestation
POST /certify/run          # returns PASS/BLOCK + metrics + bundle hash
GET  /audit/attestation/:id
POST /audit/replay         # dispute resolution

# Marketplace
POST /market/submit        # submit EM-Pack manifest + attestation
GET  /market/listings
POST /market/revoke/:name  # revoke on policy breach

# Billing
GET  /meter/usage?from=...&to=...
POST /invoice/create
POST /invoice/dispute

Program SLOs

Billing correctness: 100% of invoiced lines traceable to certified_output_v1 records.
Dispute turnaround: ≤ 5 business days with replay proof.
Marketplace integrity: 0 listings with plaintext D; 100% re-cert on every minor version.
Incentive health: median ∥D∥ of top-ranked packs ≤ 5; RQS monotone with capability gains.

One-page business runbook (copy/paste)

Price the atom: only certified outputs bill.
Prove it: every billed atom has attest_id + members_hash + belt snapshot.
List responsibly: marketplace entries show attested metrics, not prose.
Keep the bones open: G/M + cert kits are open; D is licensed + opaque.
Reward parsimony: pay/score by RQS, penalize large ∥D∥ and risk.
Enforce safety: failing CWA/PRI/PBHL or ethics = no charge + rollback.
Make disputes scientific: replay bundles, not screenshots.

This chapter turns empowerment into a measured service and a healthy market—where real capability is provable, safety is non-negotiable, and incentives push everyone toward small, high-quality residuals rather than prompt theater.

15.1 High-K domains and the cost of new skeletons

What fails. Observations are weak (ρ↑), instruments don’t commute (κ↑), ontology drifts (σ↑), actors adapt adversarially (γ↑). Patching D no longer works; M fixes stall.

A) New-G Decision Gate (copy-paste JSON)

{
  "$id": "policy://new_G_decision_v1",
  "trigger": {
    "K_threshold": 0.40,
    "chronic_gates": ["cwa_pass_rate<0.6","pri_p95>0.25","pbhl_red_time>0.05"],
    "residual_bloat": {"median_D_norm": ">5.0", "domains_in_family": ">=3"}
  },
  "options": ["invent_new_G","upgrade_instrumentation","narrow_scope","sandbox"],
  "accept_if": {
    "prototype_delta": {"cwa_grant_rate": "+>=0.15", "pri_p95": "<=0.20", "median_D_norm": "->=2"}
  },
  "timebox_weeks": 6,
  "fail_closed": true
}

B) Cost model (sanity check)

Let C_R&D = weeks of expert time to propose + prototype G′, p_succ = probability the prototype hits accept_if.
Ship only if:

\mathbb{E}[\Delta C] \cdot \text{deploy\_surface} - C_{\text{R\&D}} > \text{opportunity\_cost(M/D fixes)}

If p_succ·(ΔC gain) can’t beat two more D-sprints, don’t pursue G′—instead upgrade instruments (reduce ρ or κ) or narrow scope.

C) New-G RFC (minimal)

{
  "rfc_id": "G13_temporal_anti_commutator.v0",
  "motif": "tick-level order effects in realtime ops",
  "operators": ["ordered_integral","commutator_penalty","phase_windowing"],
  "interfaces": {"required_units":["tick","lot"],"aggregate":"order-aware"},
  "prototype_plan_weeks": 6,
  "accept_if": {"cwa_grant_rate":"+>=0.15","pri_p95":"<=0.20","median_D_norm":"->=2"}
}

15.2 When D refuses to stay small (true novelty vs. missing G)

Smell. k>5 rules, lexicon >300, or frequent edge tables—yet gates barely pass.

A) Triage: Novelty vs. Missing-G (decision tree)

{
  "$id": "diagnostic://D_bloat_triage_v1",
  "tests": [
    "cross_family_transfer: do rules generalize to ≥2 adjacent domains?",
    "ablate_rules: does ΔC collapse when you remove one cluster?",
    "M_gap_check: unit/cohort/ledger mis-spec?",
    "instrument_commutation: can cohorting lift CWA to ≥0.98?"
  ],
  "decision": {
    "true_novelty_if": ["no_transfer","large_unique_rule_clusters","CWA ok","M ok"],
    "missing_G_if": ["rules_repeat_across_domains","CWA chronic fail","M gaps present"]
  },
  "actions": {
    "true_novelty": ["sandbox","narrow_scope","collect_data","schedule_G_RFC"],
    "missing_G": ["fix_M_templates","redesign_instruments","promote_G per 12.5"]
  }
}

B) M-fix checklist (common culprits)

Units: mixing levels/rates; hidden transforms.
Cohorts: outcome-key leakage; tiny cohorts < min size.
Ledger: Gap vs Flux window mismatch; α=0 (hiding structure).
Phase-lock: canonicalization missing → PRI p95 inflates.

C) D-pruning protocol (copy-paste)

{
  "$id": "policy://D_pruning_v1",
  "keep": ["counter_intuition","exception_routing","taboo_transform"],
  "drop": ["M_facts_encoded_as_rules","style_rules","redundant_aliases"],
  "budget": {"k_rules_max": 5, "lexicon_range": [100,300]},
  "AB": {"sequential": true, "guardrails": ["pbhl_band!='red'","fairness_gap<=0.03"]}
}

15.3 Adversarial drift and instrument poisoning

Threats. Strategic manipulation (gaming metrics), poisoning (sensor or data feed), distribution shift crafted to inflate CWA or depress PRI.

A) Sentinel monitors (add to runtime)

{
  "$id": "monitor://adversary_v1",
  "signals": {
    "entropy_drop": "sudden ↓ in feature entropy with performance ↓",
    "flip_rate": "decision flip vs. shadow replica",
    "cohort_instability": "cohort membership churn > 30%/window",
    "psi": "population stability index > 0.25",
    "importance_flip": "top-k feature importance reorder"
  },
  "actions": {
    "quarantine": ["isolate_cohorts","disable_mean_sum","fallback_sequence"],
    "rotate": ["keys","sensors","encryption"],
    "shadow": ["force_shadow_eval_on_canary"],
    "escalate": ["human_review","red_team_probe"]
  }
}

B) Poisoning playbook (immutable & attested)

{
  "$id": "policy://poisoning_response_v1",
  "detect_if": ["entropy_drop","importance_flip","agreement<0.98"],
  "immediate": ["halt_high_risk","quarantine_cohorts","rollback_last_policy"],
  "forensics": ["export_bundle","hash_chain_replay","replica_diff"],
  "hardening": ["add_sentinel_sensors","increase_measure_cadence","tighten_phase_lock",
    "raise_cwa_pri_thresholds"],
  "reentry": {"require":"pass_redteam_suite","window_hours":24}
}

C) Anti-gaming guard (CWA/PRI aware)

CWA stress perms include time-sorted/reversed/block-swap; deny grants if stress-perm variance > policy.
PRI computed on the decision (not a proxy); require shadow agreement ≥ 0.98 before re-enable.

15.4 Organizational pitfalls (slot contention; audit debt)

A) Slot contention (capacity failures)

Symptoms. Thrash rate ↑, hidden tool fan-out, latency spikes, degraded decisions without logs.

Policy (Slot Economics guard).

{
  "$id": "policy://slot_guard_v1",
  "capacities": {"attention": 8, "memory": 4, "tools": 3, "io": 2},
  "reservation": [{"policy":"critical","attention":4}],
  "eviction": {"attention":"LRU","memory":"cost_aware","tools":"LFU"},
  "deny_on_exhaustion": true,
  "alerts": {"thrash_rate_p95_max": 0.15, "latency_ms_per_slot_max": 25}
}

Runbook. Deny (don’t squeeze), log evictions, surface “quality vs footprint” curves to right-size budgets; freeze non-essential knobs under Amber/Red.

B) Audit debt (trace/evidence erosion)

Symptoms. Missing members_hash, gaps in hash chain, low replica agreement, dashboards without actuated belt actions.

Audit Debt Meter (ADM).

{
  "$id": "metric://audit_debt_v1",
  "components": {
    "trace_coverage": "logged_decisions / total_decisions",
    "hash_integrity": "1 - (broken_links / total_links)",
    "grant_completeness": "cwa_grant_records / averages_used",
    "agreement": "replica_agreement_score"
  },
  "score": "1 - 0.4*(1-trace_coverage) - 0.2*(1-hash_integrity) - 0.2*(1-grant_completeness) 
    - 0.2*(1-agreement)",
  "policy": {"min_score": 0.95}
}

Debt reducer (must-do list).

Enforce write-once traces; schedule daily hash-chain replay.
Reject any average lacking a grant record.
Require owner & action on every belt entry; auto-page if missing.
Freeze releases if ADM < 0.95.

One-page Failure Runbook (copy-paste)

Gate triage. If CWA < 0.98 or PRI > 0.20, deny mean/sum, route to order-sensitive estimator, re-cohort.
PBHL band. Amber → mitigate ≤ 120 min; Red → halt ≤ 10 min, rollback, escalate, incident bundle.
K check. Compute $K$ . If ≥ 0.40 or gates fail chronically → open New-G vs Fix-M fork (timebox 6 weeks).
D bloat. If ∥D∥ blows past 5 repeatedly → run triage (novelty vs missing-G); prune D; fix M; only then consider G′.
Adversary. On sentinel triggers → quarantine cohorts, rotate keys/sensors, shadow-only until red-team pass.
Org health. Keep slots integer-bounded; deny on exhaustion. Maintain ADM ≥ 0.95 or freeze releases.
Always log. Every action → immutable trace (hash chain) + cohort members_hash + belt snapshot.

Bottom line. The method is intentionally conservative: when structure breaks or pressure rises, it fails closed—blocking unsafe averages, halting under Red, and forcing either better instruments/M or honest invention of a new skeleton G′.

16.1 Phase 0 — Publish G/M kits + Certification CLI (0–3 months)

Objective. Make the bones (G), mappings (M), and the cert harness/CLI publicly runnable; ship 4 seed EM-Packs (one per case pattern in Ch.11).

Deliverables (copy-paste)

{
  "$id": "release://phase0_v1",
  "artifacts": [
    "G_skeletons/* (Apache-2.0)",
    "M_templates/* (Apache-2.0)",
    "cert_harness/* (Apache-2.0)",
    "schema_registry/* (JSON Schemas)",
    "empack_cli/* (build/certify/sign/publish/meter)",
    "seed_empacks:[tcm, surplus, peaks_traps, observerops]"
  ],
  "docs": ["quick_start.md","governance.md","ethics.md","api_ref.md"],
  "redteam": ["suite://governance_redteam_v1"]
}

CLI MVP

empack init G/ M/ --out starter_pack/
empack certify --policy policy.json --out bundle.json
empack sign --manifest manifest.json --bundle bundle.json --out attestation.json
empack publish --manifest manifest.json --attestation attestation.json --channel shadow

Phase-0 exit criteria

4 seed EM-Packs pass CWA/PRI/PBHL on the public harness.
≥3 external teams replicate PASS on a blind kit.
Public “getting started” completes in <2 hours (observer agreement ≥0.98).

16.2 Phase 1 — 10 families, 50 domains; live dashboards (3–9 months)

Objective. Prove repeatability across families; operate monthly waves; publish live safety/capability dashboards.

Program plan

{
  "$id": "program://phase1_plan_v1",
  "families_target": 10,
  "domains_target": 50,
  "lines": 3,
  "wave_cadence": "monthly",
  "dashboards_public": true,
  "gates": {"cwa":0.98,"pri":0.20,"pbhl_green":0.80,"agreement":0.98}
}

Dashboard schema (public)

{
  "$id": "dashboard://empowerment_v1",
  "empack": "empack.bike_share_ops.v1.4.0",
  "grant_rate": 0.81,
  "pri_p95": 0.16,
  "pbhl_green_time": 0.86,
  "agreement": 0.989,
  "D_rules": 4,
  "lexicon": 176,
  "audit_bundle": "sha256:..."
}

Ops playbook

Run D-harvest sprints (10d) per domain (Ch.12 §12.3).
Release ladder: shadow → canary → scaled → full (Ch.12 §12.4).
Publish incidents & mitigations with belt snapshots; no plaintext D.

Phase-1 exit criteria

≥10 families, ≥50 domains full; public dashboards online.
Median ∥D∥ ≤ 5; ≥80% of decisions in PBHL Green across waves.
“Kitchen-sink” D attempts are rejected by policy (audit shows).

16.3 Phase 2 — 100 families; 600–1200 domains (rolling, 9–24 months)

Objective. Industrial scale with quality invariants; add workbench automation; introduce market listings.

Scale controls

{
  "$id": "controls://phase2_quality_v1",
  "workbench": "gm_matrix_v1",
  "lint": ["units_consistent","cohort_min_size","belt_coherence","ethics_hard"],
  "automation": ["cohort_auto_lint","cwa_pri_battery","pbhl_actions_enforcer"],
  "market": {"listings": true, "re_cert_on_minor": true, "revocation_on_regress": true}
}

Capacity map

Lines: grow to L=5 (or partner operators).
Monthly W: 60–100 EM-Packs; sustain dashboards & audits.
Marketplace: onboard third-party EM-Packs (Ch.14), enforce re-cert on every minor version.

Risk kill-switches

Audit Debt Meter < 0.95 → freeze releases.
PRI p95 > 0.20 or CWA pass rate < 0.6 in any family → block wave; open “Fix-M / New-G” fork.
Median ∥D∥ > 10 in a family → trigger G promotion RFC (Ch.12 §12.5).

Phase-2 exit criteria

≥100 families active; 600–1200 EM-Packs shipped with PASS; revocation pipeline exercised at least once.
Ecosystem invoices trace 100% to certified outputs (CaaA).

16.4 Phase 3 — New-G Skeleton Program (fellows, prizes, AB test farms; starts month 6, then continuous)

Objective. Systematically invent/validate new skeletons where K is high and ∥D∥ won’t stay small.

A) Fellows program (copy-paste)

{
  "$id": "program://G_fellows_v1",
  "cohorts_per_year": 2,
  "fellows": 12,
  "focus": ["non_commuting_realtime","privacy_preserving_measurement","adversarial_inference"],
  "grants_usd": 600000,
  "deliverables": ["operators","interfaces","proof_of_commutation","acceptance_report"],
  "accept_if": {"delta":{"cwa_grant_rate":"+>=0.15","pri_p95":"<=0.20","median_D_norm":"->=2"}}
}

B) Prize challenges (RQS-based; Ch.14 §14.4)

{
  "$id": "challenge://new_G_prize_v1",
  "tracks": ["finance_rt","grid_control","clinical_routing"],
  "objective": "Maximize RQS while reducing D via new G",
  "purse_usd": 1000000,
  "must_pass": ["CWA","PRI","PBHL","ethics","agreement>=0.98"],
  "evidence": ["attestation","AB farm results","audit bundles"]
}

C) AB test farms (synthetic + de-identified)

{
  "$id": "infra://ab_farms_v1",
  "beds": ["synthetic_commutation_lab","phase_jitter_lab","adversary_lab"],
  "apis": ["/certify/run","/audit/replay","/market/submit"],
  "kittables": ["gm_matrix_v1","family_profiles/*","stress_perms/*"],
  "privacy": {"no_plaintext_D": true, "no_pii": true}
}

Governance guard

New-G ships only after prototype delta met and pilot AB beats control on CWA/PRI/PBHL; otherwise fail-closed.

Cross-phase RACI (minimal)

Role	P0	P1	P2	P3
Architect (G)	R	C	C	A
Domain Lead (M)	C	R	R	C
Residual Editor (D)	C	R	R	C
Certification Owner	R	R	R	C
Release Eng.	R	R	R	C
Safety/Auditor	A	A	A	A
Fellows/Researchers	–	–	C	R

(A = Accountable, R = Responsible, C = Consulted)

Phase gates (one-page, copy-paste)

{
  "$id": "policy://roadmap_phase_gates_v1",
  "invariants": {"cwa":0.98,"pri":0.20,"pbhl_green":0.80,"agreement":0.98,"D_norm_median_max":5},
  "P0_exit": ["seed_empacks_pass","3_ext_replicas","docs_live"],
  "P1_exit": ["10_families","50_domains_full","dashboards_public"],
  "P2_exit": ["100_families","600-1200_domains","market_recert_enabled","audit_debt>=0.95"],
  "P3_running": ["fellows_cohorts_active","prize_tracks_live","ab_farms_operational"]
}

One-page rollout runbook

P0: ship G/M + cert CLI + seed packs; prove replication.
P1: stand up 3 lines; run monthly waves; publish dashboards & incident bundles.
P2: scale to 5 lines; enforce re-cert marketplace; keep ∥D∥ small; trigger G-promotion on bloat.
P3 (continuous): fund New-G via fellows & prizes; validate on AB farms; only merge when delta gates are met.

Bottom line. The roadmap scales capability without trading off safety or parsimony: bones (G) open and improving, mappings (M) standardized, residuals (D) kept small—and every shipment priced and trusted only when attested.

Appendix 17-A: Strong-Attractor Kernel Prompt

A1) Strong-Attractor: System Prompt Template (paste as your System message)

You are the Strong-Attractor kernel for disciplined reasoning and auditable decisions.

Prime invariants (DO NOT change):
• Gates: permit mean/sum only if CWA≥0.98 and PRI≤0.20; PBHL residual r≤0.08 (Amber≤0.15, Red>0.15).
• Loop: READY-CHECK → MEASURE → AGGREGATE (CWA/PRI) → GOVERN (PBHL) → TRACE (append-only).
• Residual privacy: if a residual plugin D is used, NEVER reveal plaintext rules; 
  log only rule_ids + attest_id.
• Units & commutation: NEVER mix levels with rates; NEVER average across non-commuting instruments.
• Fail-closed: on gate failure or ethics breach, deny averaging, route to order-sensitive or human review.

Domain pack (fill or leave N/A):
{DOMAIN_BRIEF}
Objectives/constraints:
{OBJECTIVES_AND_CONSTRAINTS}
Morphology seeds (M-10):
• Units: {UNITS_AND_TRANSFORMS}
• Instruments (id, unit, cadence): {INSTRUMENTS}
• Cohort keys: {COHORT_KEYS}
• Aggregation windows: {WINDOWS}
• Belt ledger α, bands: alpha={ALPHA}, bands={BANDS}
Ethics/blocked instruments: {ETHICS_AND_BLOCKS}
Residual plugin (optional): attest_id={D_ATTEST_ID or "none"}

Slot caps (denials, no squeezing): attention={SLOT_ATT}, memory={SLOT_MEM}, tools={SLOT_TOOLS}, io={SLOT_IO}

Phase-lock (symbols only; reduce narrative entropy):
• Allowed section opcodes (Ω): HEADER, DEFINE, COHORTS, CWA, PRI, PBHL, DECISION, ACTIONS, TRACE, FOOTER.
• Forbid: “maybe, kinda, might”, hedges, unit drift, style kits.

Your task:

1) READY-CHECK: validate units, ethics, slots, sensor health. If any fail ⇒ state DEGRADED and stop averaging. 2) MEASURE: enumerate cohorts (by keys); list non-commuting pairs if any. 3) AGGREGATE: propose CWA/PRI test plans (permutations≥200, min cohort≥30, windows=[1h,24h]). If scores are not given in input, output “planned” with required evidence. 4) GOVERN: define Gap/Flux/Twist for current objective; compute/estimate PBHL residual r with formula and band; prescribe mandatory actions by band. 5) OUTPUT: emit ONLY the JSON block matching schema strong_attractor.v1 (below) plus a compact opcode transcript. Do not include free-form prose outside these two blocks.

If K estimate ≥0.40 or gates fail persistently, set mode="SANDBOX" and raise gates (CWA≥0.995, PRI≤0.15) or route to human review.

A2) Expected Assistant Output JSON Schema (copy-paste into your validator)

{
  "$id": "schema://strong_attractor.v1",
  "type": "object",
  "required": ["mode","ready_check","phase_lock","cohorts","aggregation","belt","decision","trace"],
  "properties": {
    "mode": { "type": "string", "enum": ["NORMAL","DEGRADED","SANDBOX","HALT"] },
    "ready_check": {
      "type": "object",
      "required": ["units_ok","ethics_ok","slots_ok","sensors_ok","K_estimate","notes"],
      "properties": {
        "units_ok": { "type": "boolean" },
        "ethics_ok": { "type": "boolean" },
        "slots_ok": { "type": "boolean" },
        "sensors_ok": { "type": "boolean" },
        "K_estimate": {
          "type": "object",
          "required": ["rho","kappa","sigma","gamma","K"],
          "properties": {
            "rho": {"type":"number"}, "kappa":{"type":"number"},
            "sigma":{"type":"number"}, "gamma":{"type":"number"},
            "K":{"type":"number"}
          }
        },
        "notes": { "type": "string" }
      }
    },
    "phase_lock": {
      "type": "object",
      "required": ["opcode_vocab","ppl_op_est","kl_est","violations"],
      "properties": {
        "opcode_vocab": { "type": "array", "items": {"type":"string"} },
        "ppl_op_est": { "type": "number" },
        "kl_est": { "type": "number" },
        "violations": { "type": "array", "items": {"type":"string"} }
      }
    },
    "cohorts": {
      "type": "object",
      "required": ["keys","non_commuting_pairs","min_size","windows"],
      "properties": {
        "keys": { "type": "array", "items": {"type":"string"} },
        "non_commuting_pairs": { "type": "array", "items": {"type":"array","items":{"type":"string"}} },
        "min_size": { "type": "integer" },
        "windows": { "type": "array", "items": {"type":"string"} }
      }
    },
    "aggregation": {
      "type": "object",
      "required": ["primary","fallback","cwa","pri"],
      "properties": {
        "primary": { "type": "string", "enum": ["mean","sum","trimmed_mean","quantile","N/A"] },
        "fallback": { "type": "string", "enum": ["sequence_estimator","recohort","human_review","N/A"] },
        "cwa": {
          "type": "object",
          "required": ["permutations","threshold","status"],
          "properties": {
            "permutations": {"type":"integer"},
            "threshold": {"type":"number"},
            "score": {"type":"number"},
            "status": {"type":"string","enum":["planned","granted","denied"]}
          }
        },
        "pri": {
          "type": "object",
          "required": ["threshold","status"],
          "properties": {
            "score": {"type":"number"},
            "threshold": {"type":"number"},
            "status": {"type":"string","enum":["planned","pass","fail"]}
          }
        }
      }
    },
    "belt": {
      "type": "object",
      "required": ["gap","flux","twist","alpha","residual_r","band","actions_by_band"],
      "properties": {
        "gap": {"type":"string"},
        "flux": {"type":"string"},
        "twist": {"type":"string"},
        "alpha": {"type":"number"},
        "residual_r": {"type":"number"},
        "band": {"type":"string","enum":["green","amber","red","unknown"]},
        "actions_by_band": {
          "type":"object",
          "required":["green","amber","red"],
          "properties": {
            "green":{"type":"array","items":{"type":"string"}},
            "amber":{"type":"array","items":{"type":"string"}},
            "red":{"type":"array","items":{"type":"string"}}
          }
        }
      }
    },
    "decision": {
      "type": "object",
      "required": ["summary","allowed_aggregations","mandatory_actions","ethics_check"],
      "properties": {
        "summary": {"type":"string"},
        "allowed_aggregations": {"type":"array","items":{"type":"string"}},
        "mandatory_actions": {"type":"array","items":{"type":"string"}},
        "ethics_check": {"type":"string","enum":["pass","block","review"]}
      }
    },
    "trace": {
      "type": "object",
      "required": ["policy_id","cohort_manifest_hash","members_hash","prev_hash_hint"],
      "properties": {
        "policy_id": {"type":"string"},
        "cohort_manifest_hash": {"type":"string"},
        "members_hash": {"type":"string"},
        "attest_id_D": {"type":"string"},
        "prev_hash_hint": {"type":"string"}
      }
    }
  }
}

A3) Opcode Transcript (phase-locked sections)

Use exactly these headers in order; keep them terse.

HEADER
DEFINE
COHORTS
CWA
PRI
PBHL
DECISION
ACTIONS
TRACE
FOOTER

A4) Ready-to-Use Composite Prompt (System + User), with placeholders

User message template (paste and fill fields):

[STRONG-ATTRACTOR REQUEST]

Domain: {SHORT_DOMAIN_NAME}
Objective(s): {OBJECTIVE_SENTENCE}
Constraints: {KEY_CONSTRAINTS}
Units/Transforms: {UNITS_AND_TRANSFORMS}
Instruments: {INSTRUMENT_LIST}
Cohort keys: {COHORT_KEYS}
Windows: {WINDOWS}
Belt: alpha={ALPHA}, bands={BANDS}
Ethics: {ETHICS_HARD_AND_BLOCKS}
Residual plugin attest_id: {ATTEST_ID or "none"}
Slot caps: attn={SLOT_ATT}, mem={SLOT_MEM}, tools={SLOT_TOOLS}, io={SLOT_IO}

Deliver:
1) JSON strictly matching schema strong_attractor.v1.
2) Opcode transcript using Ω headers (no prose outside those blocks).

If numeric scores are unknown, return status="planned" with evidence plan; otherwise include scores and grant/deny.

A5) Tiny Rule-DSL for Misuse Guards inside the Kernel (optional)

{
  "$id":"dsl://kernel_guards.v1",
  "rules":[
    {
      "id":"forbid_mean_without_cwa",
      "if":{"all":[{"metric":"cwa.status","eq":"denied"}]},
      "then":[{"op":"deny","target":"aggregation:mean"},{"op":"route","target":"sequence_estimator"}]
    },
    {
      "id":"sandbox_on_high_K",
      "if":{"any":[{"metric":"ready_check.K_estimate.K",">=",0.40}]},
      "then":[{"op":"set","target":"mode","value":"SANDBOX"},
        {"op":"raise_gates","value":{"cwa":0.995,"pri":0.15}}]
    },
    {
      "id":"halt_on_red",
      "if":{"all":[{"metric":"belt.band","eq":"red"}]},
      "then":[{"op":"halt"},{"op":"escalate","target":"human_review"},
        {"op":"rollback","target":"last_policy"}]
    }
  ],
  "precedence":["halt_on_red","forbid_mean_without_cwa","sandbox_on_high_K"]
}

A6) Compact Variant (fits small contexts)

System (compressed):

Kernel invariants: CWA≥0.98, PRI≤0.20, PBHL r≤0.08; loop=READY→MEASURE→AGG→GOVERN→TRACE; no plaintext D; fail-closed.

Emit ONLY: (1) JSON strong_attractor.v1, (2) opcode transcript (Ω: HEADER,DEFINE,COHORTS,CWA,PRI,PBHL,DECISION,ACTIONS,TRACE,FOOTER).

Deny mean/sum on CWA fail or PRI high; sandbox if K≥0.40 (raise gates).

A7) Example Output Skeleton (with “planned” tests)

{
  "mode": "NORMAL",
  "ready_check": {
    "units_ok": true, "ethics_ok": true, "slots_ok": true, "sensors_ok": true,
    "K_estimate": {"rho":0.15,"kappa":0.10,"sigma":0.20,"gamma":0.10,"K":0.0003},
    "notes": "Proceed; no blocked instruments detected."
  },
  "phase_lock": { "opcode_vocab":["HEADER","DEFINE","COHORTS","CWA","PRI","PBHL","DECISION",
                    "ACTIONS","TRACE","FOOTER"],
                  "ppl_op_est":1.7,"kl_est":0.08,"violations":[] },
  "cohorts": { "keys":["unit","instrument_family","cadence_bucket","protocol","tz"],
               "non_commuting_pairs":[["ops.rebalance_log","app.trip_events"]],
               "min_size":30,"windows":["1h","24h"] },
  "aggregation": {
    "primary":"mean","fallback":"sequence_estimator",
    "cwa":{"permutations":200,"threshold":0.98,"status":"planned"},
    "pri":{"threshold":0.20,"status":"planned"}
  },
  "belt": {
    "gap":"reduce empty-dock variance −20pp/24h",
    "flux":"variance reduction from dock sensors",
    "twist":"rebalance coupling + feeder limit",
    "alpha":0.6,"residual_r":0.07,"band":"green",
    "actions_by_band":{"green":["continue"],"amber":["scope−20%","cadence×2","assign_owner"],
      "red":["halt","rollback","escalate"]}
  },
  "decision": {
    "summary":"Grant mean/sum after CWA/PRI; apply minor nudge in zones A,B.",
    "allowed_aggregations":["sum(rides_start)","mean(wait_time)"],
    "mandatory_actions":["log grant record","write belt entry"],
    "ethics_check":"pass"
  },
  "trace": {
    "policy_id":"empack.bike_share_ops.v1.4.0",
    "cohort_manifest_hash":"sha256:…","members_hash":"sha256:…",
    "attest_id_D":"att-…","prev_hash_hint":"sha256:…"
  }
}

Opcode transcript (example):

HEADER
DEFINE
COHORTS
CWA
PRI
PBHL
DECISION
ACTIONS
TRACE
FOOTER

This appendix gives you a drop-in kernel prompt that phase-locks reasoning, enforces commutation safety, drives belt-band governance, and emits auditable JSON—so your teams get reproducible, certifiable outputs by default.

Appendix 17-B: CWA Battery Specs (tests, cohorting, pass/fail)

B1) Cohorting Rules (contract)

{
  "$id": "schema://cwa_cohorting_rules.v1",
  "keys": ["unit","instrument_family","cadence_bucket","protocol","tz"],
  "min_size": 30,
  "constraints": {
    "same_unit": true,
    "forbid_level_rate_mix": true,
    "same_cadence_window": true,
    "exclude_outcome_keys": true
  },
  "population_slice": { "enabled": false, "allowed": [] }
}

B2) Battery Plan (what to run)

{
  "$id": "schema://cwa_battery_plan.v1",
  "aggregators": [
    {"name":"mean","fields":["wait_time"]},
    {"name":"sum","fields":["rides_start"]},
    {"name":"trimmed_mean","fields":["charge_time"],"params":{"p":0.1}}
  ],
  "windows": ["1h","24h"],
  "permutations": 200,
  "stress_perms": ["time_sorted","time_reversed","block_swap","chunk_shuffle"],
  "scale": {"type":"MAD"},
  "thresholds": { "cwa": 0.98, "ks_drift": 0.10 },
  "pri_gate": { "enabled": true, "threshold": 0.20, "bootstrap": 200 }
}

B3) Score Definition (unchanged)

For cohort $X$ and aggregator $A$ :

\text{CWA}=1-\frac{1}{P}\sum_{p=1}^{P}\frac{\lVert A(X)-A(\pi_p(X))\rVert}{\sigma_{\text{base}}+\varepsilon}

$\pi_p$ : permutation (random or stress).
$\sigma_{\text{base}}$ : MAD over $A(X)$ evaluations within window.
Vector aggregators: use L2 norm on field vector.

B4) Execution Algorithm (pseudo)

def run_cwa_battery(cohort, spec):
    assert len(cohort) >= spec.min_size
    members_hash = hash_members(cohort)
    results = []
    for win in spec.windows:
        X = window_slice(cohort, win)
        sigma = base_scale(X, spec.scale)  # MAD by default
        for agg in spec.aggregators:
            s_rand = cwa_score(X, agg, P=spec.permutations, perms="random", sigma=sigma)
            s_stress = {name: cwa_score(X, agg, perms=name, sigma=sigma) for name in spec.stress_perms}
            ks = ks_drift_guard(X, win)    # vs. baseline window
            results.append((win, agg, s_rand, s_stress, ks))
    return results, members_hash

B5) Pass / Fail Policy

{
  "$id": "policy://cwa_pass_fail.v1",
  "pass_if_all": [
    {"metric":"cwa.random.min_over_windows", "op":">=","value":0.98},
    {"metric":"cwa.stress.min_over_windows", "op":">=","value":0.98},
    {"metric":"drift.ks.max_over_windows", "op":"<=","value":0.10}
  ],
  "deny_routes": [
    {"on":"tiny_cohort","to":"quantile:q=0.5"},
    {"on":"cwa_fail || ks>0.10","to":"sequence_estimator"},
    {"on":"unit_mismatch || level_rate_mix","to":"recohort"}
  ],
  "must_log": ["members_hash","cohort_manifest_hash","rng_seed","permutation_budget","windows"]
}

Then: compute PRI on the decision; require PRI ≤ 0.20. If PRI fails → deny averaging even if CWA passed.

B6) Result Schema (battery → per aggregator/window)

{
  "$id": "schema://cwa_result.v1",
  "cohort_id": "zone=A,instr=dock,cad=1m,tz=UTC",
  "members_hash": "sha256:deadbeef...",
  "manifest_hash": "sha256:cohort_manifest...",
  "aggregator": {"name":"mean","fields":["wait_time"],"params":{}},
  "window": "1h",
  "permutations": 200,
  "scale": {"type":"MAD","value": 3.42},
  "scores": {
    "random": 0.992,
    "stress": {
      "time_sorted": 0.991,
      "time_reversed": 0.993,
      "block_swap": 0.989,
      "chunk_shuffle": 0.990
    }
  },
  "drift": {"ks": 0.06},
  "grant": true,
  "rng_seed": 142857,
  "harness_version": "cwa_harness.v1.3.0",
  "code_hash": "sha256:..."
}

B7) Grant/Deny Record (the thing you must write before averaging)

{
  "$id": "schema://cwa_grant_record.v1",
  "ts": "2025-10-01T12:34:56Z",
  "policy_id": "empack.domain.v1.4.0",
  "cohort_id": "zone=A,instr=dock,cad=1m,tz=UTC",
  "members_hash": "sha256:deadbeef...",
  "cohort_manifest_hash": "sha256:ff09...",
  "aggregator": "mean(wait_time)",
  "windows": ["1h","24h"],
  "cwa_min_over_windows": 0.989,
  "stress_min_over_windows": 0.989,
  "drift_ks_max": 0.06,
  "grant": true,
  "pri": {"status":"pass","score":0.11,"threshold":0.20},
  "fallback_on_deny": "sequence_estimator",
  "rng_seed": 142857,
  "harness_version": "cwa_harness.v1.3.0",
  "sig": "base64:..."
}

B8) Cohort Manifest (mini, referenced by hashes)

{
  "$id": "schema://cohort_manifest.v1",
  "cohort_id": "zone=A,instr=dock,cad=1m,tz=UTC",
  "keys": {"unit":"min","instrument_family":"dock","cadence_bucket":"1m","protocol":"v2","tz":"UTC"},
  "size": 642,
  "time_range": ["2025-10-01T00:00:00Z","2025-10-01T00:59:59Z"],
  "exclusions": ["level_rate_mix","protocol_mismatch"],
  "members_hash": "sha256:deadbeef...",
  "manifest_hash": "sha256:cohort_manifest..."
}

B9) CLI (harness commands)

empack certify cwa \
  --cohorts cohort_manifest.jsonl \
  --plan cwa_battery_plan.json \
  --out cwa_results.jsonl

empack certify pri \
  --results cwa_results.jsonl \
  --decision-fn decision_fn.yaml \
  --threshold 0.20 \
  --out pri_report.jsonl

empack grant \
  --cwa cwa_results.jsonl \
  --pri pri_report.jsonl \
  --policy cwa_pass_fail.json \
  --out cwa_grants.jsonl

B10) Common Misuses (lint rules)

{
  "$id": "lint://cwa_misuses.v1",
  "fail_on": [
    "cohort_size < 30",
    "mixed_units_or_level_rate",
    "granted_without_members_hash",
    "missing_stress_perms",
    "ks_drift > 0.10",
    "cwa_grant_used_without_pri_check"
  ],
  "warn_on": [
    "permutations < 200",
    "single_window_only",
    "rng_seed_missing",
    "harness_version_missing"
  ]
}

B11) Example: Pass vs. Deny (compact)

Pass snapshot

{"cohort_id":"zone=B,instr=dock,cad=1m,UTC","agg":"sum(rides_start)","cwa_random":0.994,
  "cwa_stress_min":0.991,"ks":0.05,"grant":true}

Deny snapshot (order effects)

{"cohort_id":"zone=C,instr=app_trip,cad=event,UTC","agg":"mean(wait_time)","cwa_random":0.972,
  "cwa_stress_min":0.965,"ks":0.04,"grant":false,"route":"sequence_estimator"}

This appendix gives you a single, strict CWA battery: how to cohort, what to test, how to score, and exactly when to grant or deny averaging—with immutable records that any observer can replay.

Appendix 17-C: PBHL formulas & bands (Gap/Flux/Twist/Residual)

C1) Config (schema)

{
  "$id": "schema://pbhl_config.v1",
  "window": "24h",
  "cohort_keys": ["unit","instrument_family","cadence_bucket","protocol","tz"],
  "metric": { "type": "diagonal", "W_diag": [1.0, 0.5, 2.0] },
  "alpha": 0.6,
  "bands": { "green": 0.08, "amber": 0.15 },
  "norm": "L2",
  "epsilon": 1e-9,
  "unit_scales": { "pct_point": 1.0, "USD": 0.01, "kWh": 1.0 },
  "hysteresis": { "amber_to_green": -0.01, "red_to_amber": -0.02, "min_dwell_min": 30 }
}

C2) What each term means (contracts)

Gap $g$ : vector of target deltas (same window/cohort as Flux).
Example element: {"name":"var_empty_dock_reduction","unit":"pct_point","target_delta":-20}
Flux $f$ : measured change using only CWA-granted aggregates; if a component must fall back (sequence/causal), mark "source":"fallback" in the ledger.
Twist $t$ (three common models, pick one or compose):
1. Linear coupling: $t = B\,\Delta u$ where $u$ are control knobs and $B$ encodes constraints/substitution.
2. Constraint geometry: $t = J(x)\,\Delta x$ where $J$ is a Jacobian of active constraints.
3. Substitution topology: $t = \Theta\,y$ from interference matrix $\Theta$ on outputs $y$ .
$\alpha$ : coupling weight (0–1). Policy: never set $\alpha=0$ when couplings exist; calibrate via AB or historical fit.

C3) Residual & bands (formulas)

Weighted residual (default L2):
$r = \dfrac{\sqrt{(g-f-\alpha t)^\top W (g-f-\alpha t)}}{\sqrt{g^\top W g}+\varepsilon}$
Component residuals (debug):
$r_i = \dfrac{|g_i - f_i - \alpha t_i|}{|g_i|+\varepsilon_i}$
Band function:
```
if r <= green: "green"
elif r <= amber: "amber"
else: "red"
```
Apply hysteresis to avoid band flapping (use C1.hysteresis).

C4) Ledger entry (copy-paste)

{
  "$id": "schema://pbhl_ledger_entry.v1",
  "ts": "2025-10-01T12:34:56Z",
  "window": "24h",
  "cohort_id": "zone=A,instr=dock,cad=1m,tz=UTC",
  "gap": { "vec": [-20.0], "unit": "pct_point", "source": "policy" },
  "flux": { "vec": [-12.3], "unit": "pct_point", "source": "cwa_granted" },
  "twist": { "vec": [3.1], "unit": "pct_point", "model": "linear_coupling" },
  "alpha": 0.6,
  "metric": { "type": "diagonal", "W_diag": [1.0] },
  "residual_r": 0.07,
  "band": "green",
  "actions": ["continue"],
  "owner": "OpsLead",
  "hash_prev": "sha256:001122...",
  "hash": "sha256:334455...",
  "notes": "Flux from certified cohorts; Twist from rebalance+feeder model"
}

C5) Actions by band (mandatory)

{
  "$id": "policy://pbhl_band_actions.v1",
  "green": ["continue"],
  "amber": [
    "reduce_scope:20%",
    "increase_measure_cadence:2x",
    "assign_owner",
    "deadline:120min"
  ],
  "red": [
    "halt:high_risk_interventions",
    "rollback:last_policy_change",
    "escalate:human_in_the_loop",
    "open_incident:sev2"
  ]
}

C6) Computation (pseudo)

def pbhl_residual(g, f, t, W, alpha=0.6, eps=1e-9, norm="L2"):
    d = g - f - alpha * t
    if norm == "L1":
        num = (abs(d) @ np.diag(W)) if isinstance(W, np.ndarray) else np.sum(np.abs(d))
        den = (abs(g) @ np.diag(W)) + eps
        r = num / den
    else:  # L2 default
        num = np.sqrt(d.T @ W @ d)
        den = np.sqrt(g.T @ W @ g) + eps
        r = num / den
    return float(r)

def pbhl_band(r, green=0.08, amber=0.15, hysteresis=None, prev=None, dt_min=None):
    band = "green" if r <= green else "amber" if r <= amber else "red"
    # optional hysteresis:
    if hysteresis and prev:
        if prev=="red" and band=="amber" and r > amber + hysteresis["red_to_amber"]:
            band = "red"
        if prev=="amber" and band=="green" and r > green + hysteresis["amber_to_green"]:
            band = "amber"
        # dwell time enforcement is implementation-specific
    return band

C7) Alpha calibration (guarded)

{
  "$id": "policy://pbhl_alpha_calibration.v1",
  "method": "grid_search",
  "grid": [0.3,0.4,0.5,0.6,0.7],
  "objective": "min_residual_without_overfit",
  "constraints": [
    "monotone_relation: |∂r/∂alpha| bounded",
    "stability: var(r) across weeks <= 0.02"
  ],
  "holdout": "rolling_4w_out_of_time"
}

C8) Unit & cohort alignment (lint)

{
  "$id": "lint://pbhl_alignment.v1",
  "fail_on": [
    "gap.window != flux.window",
    "gap.unit != flux.unit",
    "alpha == 0 when couplings declared",
    "flux.source == 'mean' without cwa_grant_record",
    "cohort_keys mismatch M2 keys"
  ],
  "warn_on": [
    "W not provided (defaults to identity)",
    "twist.model unspecified with declared constraints",
    "no hysteresis configured"
  ]
}

C9) CLI (harness)

empack belt compute \
  --targets gap.json \
  --flux flux.json \
  --twist twist.json \
  --config pbhl_config.json \
  --out belt_snapshot.json

empack belt act \
  --snapshot belt_snapshot.json \
  --policy pbhl_band_actions.json \
  --out actions.json

empack belt record \
  --snapshot belt_snapshot.json \
  --actions actions.json \
  --ledger ledger.parquet

C10) Examples (pass/fail snapshots)

Green (pass):

{"r":0.07,"band":"green","actions":["continue"]}

Amber (mitigate):

{"r":0.12,"band":"amber","actions":["reduce_scope:20%","increase_measure_cadence:2x","assign_owner"]}

Red (halt):

{"r":0.19,"band":"red","actions":["halt","rollback","escalate"]}

C11) Notes & misuses (quick)

Do not compute Flux with illegal averages; if CWA denies, use fallback and flag.
Never zero $\alpha$ to “look good” when structural coupling exists.
Align window, unit, cohort for Gap & Flux; otherwise $r$ is meaningless.
Log every belt action with an owner and include it in the hash-chained trace.

This appendix makes PBHL operational: precise formulas, band thresholds, action policies, and evidence records—so governance is actuated, not decorative.

Appendix 17-D: MEEL Objective Templates (cost, risk, fidelity, latency, ethics)

D1) MEEL Config (schema)

{
  "$id": "schema://meel_config.v1",
  "objectives": [
    {"name":"cost","direction":"min","unit":"USD/decision","template":"cost.v1"},
    {"name":"risk","direction":"min","unit":"score","template":"risk.v1"},
    {"name":"fidelity","direction":"max","unit":"macroF1","template":"fidelity.v1"},
    {"name":"latency","direction":"min","unit":"ms","template":"latency.v1"},
    {"name":"ethics","direction":"min","unit":"penalty","template":"ethics.v1"}
  ],
  "constraints": [
    {"name":"cwa_pass","type":"hard","expr":"CWA>=0.98"},
    {"name":"pri_pass","type":"hard","expr":"PRI<=0.20"},
    {"name":"pbhl_band","type":"hard","expr":"band!='red'"},
    {"name":"fairness_gap","type":"hard","expr":"max_group_gap<=0.03"}
  ],
  "windows": ["1h","24h"],
  "bootstrap": 200,
  "report": ["median","p95","ci90"],
  "selection": {"method":"epsilon_constraint","epsilon":{"latency_ms":350,"cost_usd":0.01,"risk":0.10}},
  "tiebreak": {"method":"knee_point"}
}

D2) Objective Template — Cost (cost.v1)

Intent. End-to-end USD per certified decision (not per call). Include model tokens, tools, energy, ops.

{
  "$id": "template://cost.v1",
  "components": [
    {"name":"llm_tokens","unit":"USD","calc":"tokens_in*price_in + tokens_out*price_out"},
    {"name":"tools","unit":"USD","calc":"sum(tool_costs)"},
    {"name":"energy","unit":"USD","calc":"kWh*$/kWh"},
    {"name":"overhead","unit":"USD","calc":"ops_fee_per_decision"}
  ],
  "per_decision": "sum(components)/certified_decisions",
  "guards": [
    "only_count decisions with cwa_grant_record && pri_pass",
    "if pbhl_band=='red' then exclude_or_rebate"
  ],
  "outputs": {"cost_usd_per_certified": 0.0}
}

Notes.
– Tie billing to certified_output_v1 atoms.
– Optional carbon add-on: co2e_g_per_decision.

D3) Objective Template — Risk (risk.v1)

Intent. Aggregate operational risk with PBHL & PRI anchors; scale to $[0,1]$ .

{
  "$id": "template://risk.v1",
  "subscores": [
    {"name":"phase_sensitivity","expr":"min(1, PRI/0.20)"},
    {"name":"governance_residual","expr":"clip((r-0.08)/(0.15-0.08),0,1)"},
    {"name":"agreement_drop","expr":"clip((0.98-agreement)/0.02,0,1)"},
    {"name":"shift_instability","expr":"clip((PSI-0.1)/(0.25-0.1),0,1)"}
  ],
  "weights": {"phase_sensitivity":0.35,"governance_residual":0.35,"agreement_drop":0.2,
    "shift_instability":0.1},
  "risk_score": "sum(w_i*subscore_i)",
  "penalties": [
    {"if":"band=='red'","then":"+0.2"},
    {"if":"ethics_block>0","then":"+0.3"}
  ],
  "outputs": {"risk": 0.0}
}

D4) Objective Template — Fidelity (fidelity.v1)

Intent. Task performance under certified aggregation. Pick one: error↓ or F1↑.

{
  "$id": "template://fidelity.v1",
  "metric": {"name":"macroF1","direction":"max","unit":"score"},
  "cohorting": {"keys":["unit","instrument_family","cadence_bucket","protocol","tz"],"min_size":30},
  "aggregation": {"require_cwa": true, "pri_gate": true},
  "uncertainty": {"bootstrap": 200, "ci": 0.9},
  "report": ["median","p95","ci90"],
  "outputs": {"macroF1":{"median":0.0,"p95":0.0,"ci90":[0.0,0.0]}}
}

Alternative (error-rate):

{"metric":{"name":"error_rate","direction":"min","unit":"%"}}

D5) Objective Template — Latency (latency.v1)

Intent. End-to-end decision latency SLOs.

{
  "$id": "template://latency.v1",
  "measure": {"start":"ingest_ts","end":"decision_ts"},
  "stats": ["median","p95","p99","jitter_p95"],
  "budget_ms": {"median":200,"p95":350,"p99":800},
  "constraints": [
    {"name":"p95_latency","type":"hard","expr":"p95<=350"}
  ],
  "outputs": {"median_ms":0,"p95_ms":0,"p99_ms":0,"jitter_p95_ms":0}
}

D6) Objective Template — Ethics (ethics.v1)

Intent. Hard bounds + soft penalties. Hard failures block selection.

{
  "$id": "template://ethics.v1",
  "hard": [
    {"name":"fairness_gap","expr":"max_group_gap<=0.03"},
    {"name":"blocked_instrument_use","expr":"rate==0"},
    {"name":"privacy_leak","expr":"membership_inference_auc<=0.55"}
  ],
  "soft_penalties": [
    {"name":"complaint_rate","weight":1.5,"expr":"rate"},
    {"name":"elderly_churn_delta","weight":2.0,"expr":"max(0,delta)"}
  ],
  "penalty": "sum(w_i * value_i)",
  "outputs": {"hard_pass": true, "penalty": 0.0}
}

D7) Hard Guards (pre-selection)

{
  "$id": "policy://meel_hard_guards.v1",
  "must_pass": [
    "CWA>=0.98",
    "PRI<=0.20",
    "PBHL.band!='red'",
    "ethics.hard_pass==true"
  ],
  "deny_routes": [
    {"on":"guard_fail","to":"fallback.sequence_or_human"},
    {"on":"cwa_fail","to":"recohort"}
  ]
}

D8) Scalarization & Selection

Primary: ε-constraint (reject any candidate violating thresholds), then knee-point on the remaining Pareto set. Optionally Tchebycheff for determinism.

{
  "$id":"schema://meel_selection.v1",
  "epsilon": {"latency_ms":350,"cost_usd":0.01,"risk":0.10,"ethics_penalty":0.0},
  "method": "knee_point",
  "fallback": {"method":"tchebycheff","weights":{"cost":0.3,"risk":0.3,"latency":0.2,
    "fidelity":0.2},"normalize":"zscore"}
}

D9) Evaluator Contract (per candidate policy/model)

{
  "$id": "schema://meel_eval_request.v1",
  "candidate_id": "policy.v3.2",
  "data_window": "2025-10-01/2025-10-07",
  "cohort_keys": ["unit","instrument_family","cadence_bucket","protocol","tz"],
  "objectives_ref": "schema://meel_config.v1",
  "requires": ["cwa_grants.jsonl","pri_report.jsonl","belt_ledger.parquet","ethics_report.json"]
}

Response:

{
  "$id": "schema://meel_eval_response.v1",
  "candidate_id": "policy.v3.2",
  "objectives": {
    "cost_usd_per_certified": 0.0049,
    "risk": {"median":0.08,"p95":0.14},
    "fidelity.macroF1": {"median":0.81,"p95":0.84,"ci90":[0.80,0.83]},
    "latency": {"median_ms":180,"p95_ms":320,"p99_ms":650},
    "ethics": {"hard_pass": true, "penalty": 0.00}
  },
  "guards_passed": true,
  "pareto_flag": true
}

D10) Pareto & Knee Finder (pseudo)

def pareto_front(cands, obj_defs):
    def dominates(a,b):
        ge = sum((a[k] >= b[k]) if obj_defs[k]=="max" else (a[k] <= b[k]) for k in obj_defs)
        gt = sum((a[k] >  b[k]) if obj_defs[k]=="max" else (a[k] <  b[k]) for k in obj_defs)
        return ge==len(obj_defs) and gt>0
    P=[]
    for i,a in enumerate(cands):
        if not any(dominates(cands[j]["objs"], a["objs"]) for j in range(len(cands)) if j!=i):
            P.append(cands[i])
    return P

def knee_point(pareto, keys=("cost","risk","latency","fidelity")):
    # normalize 0..1, compute distance to utopia (min cost/risk/latency, max fidelity)
    # pick minimum distance
    ...

D11) Reporting Dashboard (per candidate)

{
  "$id": "schema://meel_dashboard_row.v1",
  "candidate_id": "policy.v3.2",
  "grant_rate": 0.81,
  "pri_p95": 0.16,
  "pbhl_green_time": 0.86,
  "cost_usd": 0.0049,
  "risk_p95": 0.14,
  "fidelity_macroF1": 0.81,
  "latency_p95_ms": 320,
  "ethics_penalty": 0.00,
  "pareto": true,
  "selected": true
}

D12) CLI (end-to-end)

empack meel eval \
  --config meel_config.json \
  --cwa cwa_grants.jsonl \
  --pri pri_report.jsonl \
  --belt belt_ledger.parquet \
  --ethics ethics_report.json \
  --latency latency.parquet \
  --cost cost_breakdown.json \
  --out meel_eval.jsonl

empack meel select \
  --eval meel_eval.jsonl \
  --policy meel_selection.json \
  --out chosen_candidate.json

D13) Lint (common misuses)

{
  "$id": "lint://meel_misuses.v1",
  "fail_on": [
    "fidelity aggregated without CWA grant",
    "PRI not computed on final decision",
    "PBHL band red in eval window",
    "ethics.hard_pass==false",
    "latency SLO violated (p95>budget)",
    "cost computed per call not per certified decision"
  ],
  "warn_on": [
    "bootstrap < 200",
    "missing p95 stats",
    "no knee/tchebycheff tie-breaker",
    "objectives unnormalized before scalarization"
  ]
}

D14) Worked Micro-Example (compact)

{
  "candidate_id": "policy.v3.2",
  "objs": {
    "cost_usd": 0.0048,
    "risk": {"median":0.07,"p95":0.12},
    "fidelity.macroF1": {"median":0.82},
    "latency_p95_ms": 310,
    "ethics_penalty": 0.00
  },
  "guards_passed": true,
  "meets_epsilon": true,
  "pareto": true,
  "selected": true
}

Bottom line. These MEEL templates turn “what we care about” into machine-checkable objectives with hard guards, uncertainty, and clear selection logic—so you can choose deployments that are cheaper, safer, faster, fair, and actually better under certified aggregation.

Appendix 17-E: SIDA Loop (deepening steps, stop conditions)

E1) SIDA Config (schema)

{
  "$id": "schema://sida_config.v1",
  "budgets": { "attention": 4, "memory": 4, "tools": 2, "depth": 3 },
  "stops": {
    "min_info_gain": 0.02,
    "hysteresis_steps": 2,
    "max_contradictions": 0,
    "pbhl_band": "green_only",
    "max_thrash_rate": 0.15,
    "max_cost_fallback": 0.005
  },
  "risk": { "lambda": 0.5, "pri_weight": 0.35, "pbhl_weight": 0.35, "agreement_weight": 0.2, 
    "psi_weight": 0.1 },
  "alpha_pbhl": 0.6,
  "cohort_keys": ["unit","instrument_family","cadence_bucket","protocol","tz"],
  "cwa": { "permutations": 200, "threshold": 0.98 },
  "pri": { "bootstrap": 200, "threshold": 0.20 },
  "compaction": { "target_ratio": 5.0, "dedupe_by": ["hash","unit","cohort_id"] },
  "outputs": ["evidence_core","provenance_log","contradiction_report","D_candidates"]
}

E2) Evidence Item & Hypothesis (schemas)

{
  "$id": "schema://sida_evidence_item.v1",
  "id": "ev:zoneA:wait_time_quantile",
  "source": "iot.dock_occupancy",
  "unit": "min",
  "cohort_id": "zone=A,instr=dock,cad=1m,tz=UTC",
  "window": "1h",
  "aggregation": { "kind":"mean", "granted": true, "cwa": 0.992, "pri": 0.12 },
  "delta": { "value": -1.8, "ci90": [-2.3,-1.1] },
  "hash": "sha256:...",
  "cost": { "slots":{"attention":1,"tools":0}, "latency_ms":120, "usd": 0.0005 },
  "risk_signals": { "pri":0.12, "pbhl_r":0.07, "agreement":0.989, "psi":0.08 },
  "labels": ["surge","evening_peak"]
}

{
  "$id": "schema://sida_hypothesis.v1",
  "id": "h:night_construction_noncommute",
  "predicate": "zone.has_construction && tod in [22,4] && sensor='dock'",
  "goal": "explain false low-demand signal",
  "probes": ["ev:zoneA:trip_start_sequence","ev:zoneA:dock_occup_time_series"],
  "status": "open"
}

E3) Info-Gain & Merit (definitions)

Decision entropy $H$ (or error variance $V$ ) before/after step:
$\Delta I = \max(0, H_{\text{prev}}-H_{\text{curr}})$ or $V_{\text{prev}}-V_{\text{curr}}$ .
Risk penalty from PRI, PBHL r, agreement drop, PSI:
$\text{risk} = w_p\frac{\text{PRI}}{0.20}+w_r\frac{\max(0,r-0.08)}{0.07}+w_a\frac{0.98-\text{agreement}}{0.02}+w_s\frac{\max(0,\text{PSI}-0.10)}{0.15}$
Merit:
$m=\frac{\Delta I}{\text{slot\_cost}+\lambda\cdot \text{risk}+\epsilon}$

E4) Path Selection (UCB-style explore/exploit)

{
  "$id":"schema://sida_selection.v1",
  "policy":"UCB",
  "ucb_beta": 1.2,
  "tie_breakers": ["lower_cost_first","higher_cohort_size"]
}

UCB score: $\text{UCB}_i = \bar m_i + \beta\sqrt{\frac{\ln N}{n_i+1}}$

E5) Loop Algorithm (pseudo)

def sida_loop(config, hypotheses, seed_evidence):
    state = init_state(config, hypotheses, seed_evidence)
    while True:
        if should_stop(state, config): break
        path = select_path_ucb(state, config)
        ev = deepen_once(path, config)                 # fetch/compute evidence
        ev = certify_ev(ev, config)                    # CWA/PRI gates or fallback
        deltaI = info_gain(state, ev)                  # entropy/variance drop
        merit = compute_merit(deltaI, ev.cost, ev.risk_signals, config.risk)
        state = update(state, ev, path, deltaI, merit) # logs, hashes, slots
        resolve_contradictions(state)                  # try to zero contradictions
    core = compact_evidence(state, target_ratio=config.compaction.target_ratio)
    D_candidates = synthesize_rules(core)              # ≤5 rules, with tests
    return report(state, core, D_candidates)

E6) Stop Conditions (policy, copy-paste)

{
  "$id": "policy://sida_stops.v1",
  "any_true_stops": [
    {"name":"low_info_gain","expr":"rolling_mean(ΔI, h=2) < 0.02"},
    {"name":"pbhl_worsen","expr":"Δr > 0.02 || band!='green'"},
    {"name":"slot_exhaust","expr":"thrash_rate>0.15 || deny_on_exhaustion==true"},
    {"name":"ethics_block","expr":"ethics.hard_pass==false || blocked_instrument==true"},
    {"name":"commutation_block","expr":"cwa<0.98 && fallback_cost_usd>0.005"},
    {"name":"contradiction_unresolved","expr":"contradictions>0 at freeze"},
    {"name":"K_high","expr":"K>=0.40"},
    {"name":"D_bloat","expr":"k_rules>5 || lexicon>300"}
  ],
  "fail_closed": true,
  "rollback_on": ["pbhl_red","ethics_block"]
}

E7) Compaction & Synthesis

{
  "$id":"schema://sida_compaction.v1",
  "dedupe_by": ["hash","unit","cohort_id"],
  "cover_set": "minimal set that keeps decision within ΔH<=0.01 and r<=0.08",
  "proofs": ["cwa_grant_records","pri_report","belt_snapshots"],
  "target_ratio": 5.0
}

Rule synthesis (≤5 rules; 3 types only): counter-intuition, exception routing, taboo transform. Emit with unit tests and counter-tests.

E8) Outputs (report bundle)

{
  "$id": "schema://sida_report.v1",
  "summary": {
    "steps": 9,
    "avg_merit": 0.41,
    "stop_reason": "low_info_gain",
    "contradictions": 0,
    "pbhl": {"r_start":0.09,"r_end":0.07,"band":"green"}
  },
  "evidence_core": ["ev:zoneA:wait_time_quantile","ev:zoneB:trip_seq"],
  "provenance_log": ["sha256:...","sha256:..."],
  "D_candidates": [
    {"id":"r1_night_construction_noncommute","type":"counter_intuition","tests":["pass_001","counter_001"]},
    {"id":"r2_low_income_price_guard","type":"exception_routing","tests":["pass_002","counter_002"]},
    {"id":"r3_unit_conflation_taboo","type":"taboo_transform","tests":["pass_003","counter_003"]}
  ]
}

E9) CLI (plan → run → compact → synthesize)

empack sida plan \
  --config sida_config.json \
  --hypotheses hypotheses.json \
  --out sida_plan.json

empack sida run \
  --plan sida_plan.json \
  --cohorts cohort_manifest.jsonl \
  --out sida_trace.jsonl

empack sida compact \
  --trace sida_trace.jsonl \
  --target-ratio 5.0 \
  --out evidence_core.json

empack sida synthesize \
  --evidence evidence_core.json \
  --out D_candidates.json

E10) Lint (common misuses)

{
  "$id": "lint://sida_misuses.v1",
  "fail_on": [
    "deepening_without_hypothesis",
    "averaging_without_cwa_grant",
    "pri_not_on_decision",
    "no_provenance_hash",
    "compaction_after_publish",
    "slot_overflow_silent",
    "no_counter_tests_for_rules"
  ],
  "warn_on": [
    "bootstrap < 200",
    "target_ratio < 3.0",
    "ucb_beta not set",
    "no_tie_breakers"
  ]
}

E11) Worked Micro-Trace (condensed)

Step 1: probe trip_seq (sequence fallback). CWA fails (0.97), fallback cost $0.0007 (< $\theta_c$ ) ⇒ accept. $\Delta I=0.05$ , $r=0.08→0.075$ .
Step 2: probe dock_occup_time_series (CWA 0.991, PRI 0.13) ⇒ grant. $\Delta I=0.03$ , $r=0.075→0.071$ .
Step 3: probe night_construction_tag (low cost) ⇒ contradiction resolved; $\Delta I=0.02$ .
Step 4–5: diminishing returns; rolling mean $\Delta I<0.02$ ⇒ stop.
Compaction yields 2 evidence items; synthesize 3 rules (≤5). PBHL ends Green (0.07). All tests logged.

E12) Ready-Check for SIDA (preflight)

{
  "$id": "policy://sida_ready_check.v1",
  "require": [
    "slot_caps_configured && deny_on_exhaustion==true",
    "ethics.guardrails_loaded",
    "cohort_manifest_present",
    "cwa_pri_harness_available",
    "belt_config(alpha>0)"
  ],
  "prohibit": ["blocked_instruments","unhashed_payloads"]
}

Bottom line. This SIDA loop gives you a disciplined, auditable way to dig deeper only when it pays, stop before harm or bloat, and surface a minimal, testable D—all under certified aggregation and belt-band governance.

Here are two fully filled Morphology Mapping (M) packs, copy-paste ready

Format mirrors Chapter 4 stubs: M1_units_dimensions … M10_evidence_contract.

Domain A — TCM Pattern Assessment (Audit-Only, Non-Diagnostic)

{
  "domain": "tcm_pattern_assessment.audit.v1",
  "M1_units_dimensions": {
    "stocks": [
      {"name":"evidence_slots","unit":"slot","min":0,"max":12},
      {"name":"case_queue","unit":"case","min":0}
    ],
    "flows": [
      {"name":"cases_intake","unit":"case/h"},
      {"name":"evidence_added","unit":"item/case"},
      {"name":"agreement_updates","unit":"event/case"}
    ],
    "measures": [
      {"name":"pulse_features","unit":"Hz,amp","type":"vector"},
      {"name":"tongue_color_lab","unit":"Lab*","type":"vector"},
      {"name":"coating_area","unit":"%"},
      {"name":"symptom_flags","unit":"count"}
    ],
    "transforms": [
      {"from":["pixel","cm"],"to":"true_size_cm"},
      {"from":["RGB"],"to":"Lab*"}
    ],
    "sources_sinks": ["new_case:case","withdrawn_case:case"],
    "notes": "Units are observation/assessment only; NO diagnosis or prescription encoding."
  },
  "M2_instrument_operator": {
    "instruments": [
      {"id":"cam.tongue.v2","unit":"image(px)","tau_sec":"per_visit","lag_sec":0,
       "protocol":"D65_lightbox","maps_to":["G1.conservation","G8.pbhl.flux","G9.phase_lock"]},
      {"id":"sensor.pulse.pleth.v1","unit":"Hz,amp","tau_sec":30,"lag_sec":1,
       "protocol":"radial_30s_rest","maps_to":["G3.phase_criticality","G6.cwa"]},
      {"id":"survey.symptom.v1","unit":"item","tau_sec":"per_visit","lag_sec":0,
       "protocol":"dual_tone_lexicon","maps_to":["G9.phase_lock","G6.cwa"]},
      {"id":"reviewer.panel.v1","unit":"vote","tau_sec":"per_case","lag_sec":0,
       "protocol":"blinded_pair","maps_to":["G5.observer_invariants","G6.cwa"]}
    ],
    "cohort_keys": ["unit","instrument_family","protocol","illumination","tz"],
    "non_commuting": [
      ["cam.tongue.v2","food_or_drink_within_30min"],
      ["sensor.pulse.pleth.v1","recent_exertion"]
    ]
  },
  "M3_controls": {
    "knobs": [
      {"name":"illumination_level","type":"discrete","unit":"lux","values":[800,1200],
        "owner":"Ops","cadence_min":5},
      {"name":"capture_retries","type":"integer","unit":"count","min":0,"max":2,"owner":"Ops"},
      {"name":"panel_size","type":"integer","unit":"reviewers","min":2,"max":5,"owner":"Clinic"},
      {"name":"request_followup","type":"boolean","owner":"Practitioner"}
    ],
    "constraints": [
      "no_food_or_drink_within_30min == true for cam.tongue.v2",
      "radial_rest_30s == true for sensor.pulse.pleth.v1",
      "panel_size>=2"
    ]
  },
  "M4_state_space": {
    "state_vector": [
      "tongue_color_lab[L*,a*,b*]",
      "coating_area_pct",
      "pulse_rate_Hz","pulse_variability",
      "symptom_flags[*]"
    ],
    "invariants": [
      "per_case evidence belongs to exactly one patient",
      "no cross-patient aggregation without cohorting"
    ],
    "bounds": [
      {"var":"pulse_rate_Hz","min":0.6,"max":2.5},
      {"var":"coating_area_pct","min":0,"max":100}
    ],
    "features": {
      "order_param":"panel_agreement_score",
      "control_param":"illumination_level"
    }
  },
  "M5_interventions": {
    "catalog": [
      {"id":"soft.request_recapture","mode":"soft","latency_min":2,"reversible":true,
       "pre":{"band":"green_or_amber"},"post":{"measure":"panel_agreement","window_min":60}},
      {"id":"policy.escalate_to_practitioner","mode":"policy","latency_min":0,"reversible":true,
       "pre":{"band":"amber_or_red"},"post":{"rollback_on":"band.red_persist"}},
      {"id":"struct.calibrate_lightbox","mode":"structural","latency_min":30,"reversible":true,
       "pre":{"predicate":"illumination_drift>5%"}}
    ],
    "fallbacks": {"on_pri_high":"escalate_to_practitioner","on_cwa_fail":"recohort_and_sequence"}
  },
  "M6_aggregation_plan": {
    "aggregators": [
      {"name":"mean","fields":["panel_agreement_score"],"cadence":"1d"},
      {"name":"trimmed_mean","fields":["pulse_rate_Hz"],"params":{"p":0.1}},
      {"name":"quantile","fields":["coating_area_pct"],"params":{"q":0.5}}
    ],
    "fallbacks": [{"name":"sequence_estimator","for":["pulse_waveform_seq"],"model":"causal_rnn"}],
    "cohort_keys": ["instrument_family","protocol","illumination","tz"],
    "thresholds":{"cwa":0.98,"pri":0.20,"min_cohort":30,"permutations":200},
    "drift":{"window_hours":[24,168],"ks_threshold":0.10},
    "deny_routes":["recohort","fallback","human_review"]
  },
  "M7_belt_ledger": {
    "gap": {"name":"increase_panel_agreement","unit":"pct_point","window":"7d","target_delta":+10},
    "flux": {"source":"reviewer.panel.v1","cohort":"protocol,illumination",
      "window":"7d","compute":"agreement_delta"},
    "twist": {
      "sources":["cam.tongue.v2","sensor.pulse.pleth.v1"],
      "model":"coupling_linear","params":{"weights":{"illumination":0.6,"rest_protocol":0.4}}
    },
    "alpha": 0.6,
    "bands": {"green":0.08,"amber":0.15},
    "actions": {
      "green":["continue"],
      "amber":["request_recapture","calibrate_lightbox","assign_owner"],
      "red":["halt_aggregation","escalate_to_practitioner","open_incident"]
    },
    "ledger_schema": ["ts","gap","flux","twist","alpha","residual_r","band","actions",
      "owner","hash_prev","hash_curr"]
  },
  "M8_failure_signatures": {
    "classes": [
      {
        "id":"O2_lighting_drift",
        "predicate":"Δillumination>5% && agreement_drop>5pp",
        "first_aid":["calibrate_lightbox","recohort_by_illumination"],
        "exit_criteria":["agreement_recover>=5pp","band=='green' 48h"]
      },
      {
        "id":"O4_non_commuting_sequence",
        "predicate":"tea_or_food_within_30min && cwa<0.98",
        "first_aid":["disable_mean_sum","fallback:sequence","request_followup"]
      }
    ]
  },
  "M9_ethics_safety": {
    "non_goals": [
      "diagnose_or_prescribe",
      "optimize_for_speed_over_clinical_review"
    ],
    "blocked_instruments": ["PII_raw_images_no_consent","gps_fine"],
    "hard_constraints": [
      {"name":"no_diagnosis_text","op":"==","value":true},
      {"name":"practitioner_review_required","op":"==","value":true}
    ],
    "soft_bounds": [
      {"name":"repeated_recapture_rate","target":"min","weight":1.0}
    ],
    "approvals": [
      {"if":"proposal=='automation_without_review'","then":"require:EthicsOfficer"}
    ],
    "logging": { "violation_trace":"hash_chain","retention_days":365 }
  },
  "M10_evidence_contract": {
    "trace_schema_ref": "schema://decision_trace_v1",
    "hashing": {"algo":"sha256","chain":"prev_hash->hash"},
    "agreement": {"replicas":2,"min_score":0.98},
    "bundles": {"merkle": true, "export_formats": ["jsonl","parquet"] },
    "retention": {"days":365,"cold_storage_days":90}
  }
}

Domain B — SaaS Surplus Dynamics (Growth & Resilience Ops)

{
  "domain": "saas_surplus_ops.v1",
  "M1_units_dimensions": {
    "stocks": [
      {"name":"financial_surplus","unit":"USD","min":0},
      {"name":"attention_surplus","unit":"min","min":0},
      {"name":"option_surplus","unit":"count","min":0}
    ],
    "flows": [
      {"name":"revenue","unit":"USD/day"},
      {"name":"opex","unit":"USD/day"},
      {"name":"new_trial_minutes","unit":"min/day"},
      {"name":"leakage_reputation","unit":"event/day"}
    ],
    "transforms": [
      {"from":["kW","h"],"to":"kWh"},
      {"from":["min/day"],"to":"min"}
    ],
    "sources_sinks": ["equity_raise:USD","debt_service:USD","writeoff:USD"]
  },
  "M2_instrument_operator": {
    "instruments": [
      {"id":"ledger.billing","unit":"USD","tau_sec":3600,"lag_sec":300,
       "protocol":"accrual_v3","maps_to":["G1.conservation","G8.pbhl.flux","G2.surplus"]},
      {"id":"events.product","unit":"event","tau_sec":60,"lag_sec":5,
       "protocol":"analytics_v2","maps_to":["G6.cwa","G2.surplus"]},
      {"id":"crm.pipeline","unit":"USD","tau_sec":3600,"lag_sec":600,
       "protocol":"crm_v1","maps_to":["G12.substitution_topology","G8.pbhl.twist"]},
      {"id":"ads.spend","unit":"USD","tau_sec":3600,"lag_sec":300,
       "protocol":"ads_api_v2","maps_to":["G2.surplus","G10.meel"]}
    ],
    "cohort_keys": ["unit","instrument_family","protocol","cadence_bucket","tz","segment"],
    "non_commuting": [
      ["events.product","ads.spend"], 
      ["ledger.billing","crm.pipeline"]
    ]
  },
  "M3_controls": {
    "knobs": [
      {"name":"price_plan_A","type":"continuous","unit":"USD/mo","min":5,"max":49,
        "owner":"Revenue","cadence_min":60},
      {"name":"ads_budget","type":"continuous","unit":"USD/day","min":0,"max":50000,
        "owner":"Growth","cadence_min":60},
      {"name":"experiment_slots","type":"integer","unit":"slot","min":0,"max":10,"owner":"PM"},
      {"name":"support_staffing","type":"integer","unit":"FTE","min":0,"max":200,"owner":"Ops"}
    ],
    "constraints": [
      "sum(experiment_slots)<=10",
      "ads_budget<=cash_on_hand*0.02",
      "price_changes_per_week<=2"
    ]
  },
  "M4_state_space": {
    "state_vector": [
      "subs_active[*]","subs_trial[*]","arpu_by_plan[*]",
      "churn_rate","cac","ltv","surplus_financial","surplus_attention","surplus_option"
    ],
    "invariants": [
      "surplus_financial_next = surplus_financial + revenue - opex - debt_service + equity_raise",
      "subs_active>=0"
    ],
    "bounds": [
      {"var":"churn_rate","min":0,"max":1},
      {"var":"arpu_by_plan[*]","min":0}
    ],
    "features": {
      "order_param":"surplus_runway_days",
      "control_param":"ads_budget_to_revenue_ratio"
    }
  },
  "M5_interventions": {
    "catalog": [
      {"id":"policy.price_test","mode":"policy","latency_min":60,"reversible":true,
       "owner":"Revenue","risk":"medium",
       "pre":{"band":"green_only","cwa":0.98,"pri":0.20},
       "post":{"rollback_on":"band.red || churn_spike>1pp"}},
      {"id":"soft.usage_nudge","mode":"soft","latency_min":5,"reversible":true,
       "owner":"Growth","pre":{"band":"green_or_amber"}},
      {"id":"struct.billing_migration","mode":"structural","latency_hours":24,"reversible":false,
       "owner":"Eng","risk":"high","approvals":["CFO","CTO"],
       "pre":{"band":"amber_or_red","twist_ratio_min":0.2}}
    ],
    "fallbacks": {"on_pri_high":"downgrade_to_soft_nudge","on_cwa_fail":"recohort_then_sequence"}
  },
  "M6_aggregation_plan": {
    "aggregators": [
      {"name":"mean","fields":["arpu_by_plan[*]"],"cadence":"1d"},
      {"name":"sum","fields":["revenue","opex"],"cadence":"1d"},
      {"name":"trimmed_mean","fields":["session_length_min"],"params":{"p":0.1}}
    ],
    "fallbacks": [{"name":"sequence_estimator","for":["conversion_funnel_seq"],"model":"causal_rnn"}],
    "cohort_keys": ["segment","plan","instrument_family","protocol","cadence_bucket","tz"],
    "thresholds":{"cwa":0.98,"pri":0.20,"min_cohort":30,"permutations":200},
    "drift":{"window_hours":[24,168],"ks_threshold":0.10},
    "deny_routes":["recohort","fallback","human_review"]
  },
  "M7_belt_ledger": {
    "gap": {"name":"extend_surplus_runway","unit":"day","window":"28d","target_delta":+30},
    "flux": {"source":"ledger.billing","cohort":"plan,segment","window":"28d",
      "compute":"runway_delta_from_cashflow"},
    "twist": {
      "sources":["crm.pipeline","ads.spend","price_plan_A"],
      "model":"coupling_linear","params":{"weights":{"cannibalization":0.5,"ads_delay":0.3,
        "price_elasticity":0.2}}
    },
    "alpha": 0.6,
    "bands": {"green":0.08,"amber":0.15},
    "actions": {
      "green":["continue"],
      "amber":["reduce_scope:price_tests","increase_measure_cadence:2x","assign_owner"],
      "red":["halt_price_changes","rollback_last_test","escalate_to_CFO"]
    },
    "ledger_schema": ["ts","gap","flux","twist","alpha","residual_r","band","actions",
      "owner","hash_prev","hash_curr"]
  },
  "M8_failure_signatures": {
    "classes": [
      {
        "id":"O1_price_oscillation",
        "predicate":"periodic_arpu_swings && control_cadence~price_change_cadence",
        "first_aid":["halve_price_change_frequency","increase_measure_cadence",
          "freeze_non_essential_knobs"],
        "exit_criteria":["acf_k<0.3","band=='green' for 2 cycles"]
      },
      {
        "id":"O3_lock_in_growth_trap",
        "predicate":"plateau_kpis && T_escape->inf",
        "first_aid":["enable_substitution_topology","hybrid_belt","buffer_capacity:+20%"]
      },
      {
        "id":"O4_non_commuting_marketing",
        "predicate":"cwa<0.98 across ads+events",
        "first_aid":["disable_mean_sum","sequence_estimator","recohort_by_campaign"]
      }
    ]
  },
  "M9_ethics_safety": {
    "non_goals": [
      "dark_patterns_to_reduce_cancellations",
      "price_discrimination_on_protected_attributes"
    ],
    "blocked_instruments": ["raw_user_PII","device_fingerprint"],
    "hard_constraints": [
      {"name":"fairness_gap","op":"<=","value":0.03},
      {"name":"pbhl_band_on_low_income","op":"==","value":"green"}
    ],
    "soft_bounds": [
      {"name":"complaint_rate","target":"min","weight":1.5}
    ],
    "approvals": [
      {"if":"breach(hard_constraints)","then":"require:EthicsOfficer+CFO"}
    ],
    "logging": { "violation_trace":"hash_chain","retention_days":365 }
  },
  "M10_evidence_contract": {
    "trace_schema_ref": "schema://decision_trace_v1",
    "hashing": {"algo":"sha256","chain":"prev_hash->hash"},
    "agreement": {"replicas":2,"min_score":0.98},
    "bundles": {"merkle": true, "export_formats": ["jsonl","parquet"] },
    "retention": {"days":365,"cold_storage_days":90}
  }
}

If you want, I can also generate ready-made cohort manifests + belt snapshots for either domain so you can run the CLI examples from Chapters 7–8 without edits.

Here are ready-made cohort manifests + PBHL belt snapshots for both domains

So you can run your certification/governance CLIs immediately. Files are in JSONL (one JSON object per line), copy-paste ready.

A) TCM Pattern Assessment — `cohort_manifests_tcm.jsonl`

{"cohort_id":"instr=cam.tongue,protocol=D65_lightbox,illum=1200lux,tz=UTC",
  "keys":{"instrument_family":"cam.tongue","protocol":"D65_lightbox","illumination":"1200lux","tz":"UTC"},
  "size":184,
  "time_range":["2025-10-01T00:00:00Z","2025-10-01T23:59:59Z"],
  "exclusions":["food_or_drink_within_30min=false"],
  "members_hash":"sha256:7f3a6f9a3e34d10f7f62b5b1f2a9b0b1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7",
  "manifest_hash":"sha256:cohort_manifest_tcm_cam_v1"}
{"cohort_id":"instr=sensor.pulse,protocol=radial_30s_rest,illum=NA,tz=UTC",
  "keys":{"instrument_family":"sensor.pulse","protocol":"radial_30s_rest","illumination":"NA","tz":"UTC"},
  "size":96,"time_range":["2025-10-01T00:00:00Z","2025-10-01T23:59:59Z"],
  "exclusions":["recent_exertion=false"],
  "members_hash":"sha256:2e1c9a7b5a6f0d8c3b2a1e0f9d8c7b6a5f4e3d2c1b0a99887766554433221100",
  "manifest_hash":"sha256:cohort_manifest_tcm_pulse_v1"}

B) TCM Pattern Assessment — `belt_snapshots_tcm.jsonl`

{"ts":"2025-10-02T00:00:00Z","window":"7d",
  "cohort_id":"instr=cam.tongue,protocol=D65_lightbox,illum=1200lux,tz=UTC",
  "gap":{"vec":[10.0],"unit":"pct_point","source":"policy"},
  "flux":{"vec":[9.1],"unit":"pct_point","source":"cwa_granted"},
  "twist":{"vec":[1.0],"unit":"pct_point","model":"linear_coupling"},
  "alpha":0.6,"metric":{"type":"diagonal","W_diag":[1.0]},"residual_r":0.03,
  "band":"green","actions":["continue"],"owner":"OpsLead","hash_prev":"sha256:001122...",
  "hash":"sha256:a1b2c3tcmgreen...",
  "notes":"Flux from reviewer.panel.v1; Twist from illumination+rest coupling"}
{"ts":"2025-10-02T00:00:00Z","window":"7d",
  "cohort_id":"instr=sensor.pulse,protocol=radial_30s_rest,illum=NA,tz=UTC",
  "gap":{"vec":[10.0],"unit":"pct_point","source":"policy"},
  "flux":{"vec":[8.0],"unit":"pct_point","source":"cwa_granted"},
  "twist":{"vec":[1.5],"unit":"pct_point","model":"linear_coupling"},
  "alpha":0.6,"metric":{"type":"diagonal","W_diag":[1.0]},"residual_r":0.11,
  "band":"amber",
  "actions":["request_recapture","calibrate_lightbox","assign_owner","deadline:120min"],
  "owner":"ClinicLead","hash_prev":"sha256:a1b2c3tcmgreen...","hash":"sha256:d4e5f6tcmamber...",
  "notes":"Pulse variance improved but coupling with capture protocol leaves residual above green"}

(Checks: r = |10 − 9.1 − 0.6·1.0| / 10 = 0.03 → Green.
r = |10 − 8.0 − 0.6·1.5| / 10 = 0.11 → Amber.)

C) SaaS Surplus Dynamics — `cohort_manifests_saas.jsonl`

{"cohort_id":"segment=SMB,plan=A,instr=ledger.billing,protocol=accrual_v3,cad=1d,tz=UTC",
  "keys":{"segment":"SMB","plan":"A","instrument_family":"ledger.billing",
    "protocol":"accrual_v3","cadence_bucket":"1d","tz":"UTC"},
  "size":1206, "time_range":["2025-10-01T00:00:00Z","2025-10-01T23:59:59Z"],
  "exclusions":["revenue_negative_rows_dropped"],
  "members_hash":"sha256:66c3a8f94c0d5a2b7e1e90c3d8e71b9b0c2d3e4f5a6b7c8d9e0f112233445566",
  "manifest_hash":"sha256:cohort_manifest_saas_ledger_v1"}
{"cohort_id":"segment=Enterprise,plan=A,instr=events.product,protocol=analytics_v2,cad=1h,tz=UTC",
  "keys":{"segment":"Enterprise","plan":"A","instrument_family":"events.product",
    "protocol":"analytics_v2","cadence_bucket":"1h","tz":"UTC"},
  "size":3488,"time_range":["2025-10-01T00:00:00Z","2025-10-01T23:59:59Z"],
  "exclusions":["bot_traffic_excluded"],
  "members_hash":"sha256:9ab8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b0c0d1e2f3a4b5c6d7e8f90123",
  "manifest_hash":"sha256:cohort_manifest_saas_events_v1"}

D) SaaS Surplus Dynamics — `belt_snapshots_saas.jsonl`

{"ts":"2025-10-02T00:00:00Z","window":"28d",
  "cohort_id":"segment=SMB,plan=A,instr=ledger.billing,protocol=accrual_v3,cad=1d,tz=UTC",
  "gap":{"vec":[30.0],"unit":"day","source":"policy"},
  "flux":{"vec":[28.7],"unit":"day","source":"cwa_granted"},
  "twist":{"vec":[-1.5],"unit":"day","model":"coupling_linear"},
  "alpha":0.6,"metric":{"type":"diagonal","W_diag":[1.0]},
  "residual_r":0.0733,"band":"green","actions":["continue"],
  "owner":"FinanceOps","hash_prev":"sha256:010203...","hash":"sha256:abc123saasgreen...",
  "notes":"Twist<0 reflects cannibalization relief and ads delay; α=0.6"}
{"ts":"2025-10-02T00:00:00Z","window":"28d",
  "cohort_id":"segment=Enterprise,plan=A,instr=events.product,protocol=analytics_v2,cad=1h,tz=UTC",
  "gap":{"vec":[30.0],"unit":"day","source":"policy"},
  "flux":{"vec":[27.8],"unit":"day","source":"cwa_granted"},
  "twist":{"vec":[-3.0],"unit":"day","model":"coupling_linear"},"alpha":0.6,
  "metric":{"type":"diagonal","W_diag":[1.0]},"residual_r":0.1333,"band":"amber",
  "actions":["reduce_scope:price_tests","increase_measure_cadence:2x","assign_owner"],
  "owner":"RevenueLead","hash_prev":"sha256:abc123saasgreen...","hash":"sha256:def456saasamber...",
  "notes":"Ads/CRM interference still elevates residual; mitigation actions applied"}

(Checks: r = |30 − 28.7 − 0.6·(−1.5)| / 30 = 2.2/30 ≈ 0.0733 → Green.
r = |30 − 27.8 − 0.6·(−3.0)| / 30 = 4.0/30 ≈ 0.1333 → Amber.)

How to use (optional)

Drop each block into its own file (*.jsonl).
These IDs match the cohort/belt schemas from Ch.7 & App. 17.

You can now run:

empack certify cwa   --cohorts cohort_manifests_*.jsonl ...
empack belt record   --snapshot belt_snapshots_*.jsonl ...

Here are matching CWA grant records for the four cohorts we already created (TCM ×2, SaaS ×2).

Format: JSONL (one JSON object per line). These line up with the cohort manifests’ cohort_id and members_hash, and use the same policy thresholds (CWA ≥ 0.98, permutations=200, min_cohort=30). Windows include short=24h and long=7d (or 28d for SaaS), plus stress permutations.

1) TCM — `cwa_grants_tcm.jsonl`

{"ts":"2025-10-02T00:00:00Z",
  "cohort_id":"instr=cam.tongue,protocol=D65_lightbox,illum=1200lux,tz=UTC",
  "aggregator":{"name":"mean","fields":["panel_agreement_score"],"cadence":"1d"},
  "size":184,"permutations":200,
  "windows":{"short":"24h","long":"168h","scores":{"short":0.992,"long":0.989},
    "stress":{"time_sorted":0.989,"time_reversed":0.988,"block_swap":0.987},
    "drift_ks_24h_vs_168h":0.06},
  "thresholds":{"cwa":0.98,"min_cohort":30}, "granted":true,
  "members_hash":"sha256:7f3a6f9a3e34d10f7f62b5b1f2a9b0b1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7",
  "grant_hash":"sha256:cwa_tcm_cam_grant_v1", 
  "notes":"Lighting protocol stable; stress perms OK."}
{"ts":"2025-10-02T00:00:00Z",
  "cohort_id":"instr=sensor.pulse,protocol=radial_30s_rest,illum=NA,tz=UTC",
  "aggregator":{"name":"trimmed_mean","fields":["pulse_rate_Hz"],"params":{"p":0.1},"cadence":"1d"},
  "size":96,"permutations":200,
  "windows":{"short":"24h","long":"168h","scores":{"short":0.986,"long":0.984},
    "stress":{"time_sorted":0.984,"time_reversed":0.983,"block_swap":0.982},
    "drift_ks_24h_vs_168h":0.08},
  "thresholds":{"cwa":0.98,"min_cohort":30},"granted":true,
  "members_hash":"sha256:2e1c9a7b5a6f0d8c3b2a1e0f9d8c7b6a5f4e3d2c1b0a99887766554433221100",
  "grant_hash":"sha256:cwa_tcm_pulse_grant_v1",
  "notes":"Rest protocol enforced; trimmed mean reduces outlier sensitivity."}

2) SaaS — `cwa_grants_saas.jsonl`

{"ts":"2025-10-02T00:00:00Z",
  "cohort_id":"segment=SMB,plan=A,instr=ledger.billing,protocol=accrual_v3,cad=1d,tz=UTC",
  "aggregator":{"name":"sum","fields":["revenue","opex"],"cadence":"1d"},
  "size":1206,"permutations":200,
  "windows":{"short":"24h","long":"28d","scores":{"short":0.993,"long":0.991},
    "stress":{"time_sorted":0.990,"time_reversed":0.989,"block_swap":0.989},
    "drift_ks_24h_vs_28d":0.05},
  "thresholds":{"cwa":0.98,"min_cohort":30},"granted":true,
  "members_hash":"sha256:66c3a8f94c0d5a2b7e1e90c3d8e71b9b0c2d3e4f5a6b7c8d9e0f112233445566",
  "grant_hash":"sha256:cwa_saas_ledger_grant_v1",
    "notes":"Accrual protocol consistent across zones; lawful sum on flows."}
{"ts":"2025-10-02T00:00:00Z",
  "cohort_id":"segment=Enterprise,plan=A,instr=events.product,protocol=analytics_v2,cad=1h,tz=UTC",
  "aggregator":{"name":"mean","fields":["session_length_min"],"cadence":"1h"},
  "size":3488,"permutations":200,
  "windows":{"short":"24h","long":"28d","scores":{"short":0.989,"long":0.987},
    "stress":{"time_sorted":0.986,"time_reversed":0.986,"block_swap":0.985},
    "drift_ks_24h_vs_28d":0.07},
  "thresholds":{"cwa":0.98,"min_cohort":30},"granted":true,
  "members_hash":"sha256:9ab8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b0c0d1e2f3a4b5c6d7e8f90123",
  "grant_hash":"sha256:cwa_saas_events_grant_v1",
    "notes":"Bot traffic excluded; remaining event streams commute under cohorting."}

How to wire the full replay

CWA → PRI: For each granted cohort above, run your PRI harness on the final decision functional (not proxies).

empack certify pri \
  --cohorts cohort_manifests_*.jsonl \
  --cwa cwa_grants_*.jsonl \
  --out pri_report.jsonl

PRI → PBHL: Use the belt snapshots already provided (belt_snapshots_*.jsonl).

empack belt record \
  --snapshot belt_snapshots_*.jsonl \
  --ledger ledger.parquet

Trace linkage: Include grant_hash and members_hash in your decision trace so auditors can replay membership and permutation tests.

Here’s a compact PRI report for the four cohorts, JSONL (one object per line).

Policy: PRI ≤ 0.20 (all pass). Permutations=200, Bootstrap=200.

`pri_report_compact.jsonl`

{"ts":"2025-10-02T00:05:00Z",
"cohort_id":"instr=cam.tongue,protocol=D65_lightbox,illum=1200lux,tz=UTC",
"decision_fn":"panel_agreement→(continue|recapture|escalate)",
"permutations":200,"bootstrap":200,"pri":{"median":0.11,"p95":0.16},
"components":{"var_perm":0.0062,"var_boot":0.0489},"threshold":{"pri_max":0.20},
"granted":true,"cwa_grant_hash":"sha256:cwa_tcm_cam_grant_v1","pri_hash":"sha256:pri_tcm_cam_v1"}

{"ts":"2025-10-02T00:05:00Z",
"cohort_id":"instr=sensor.pulse,protocol=radial_30s_rest,illum=NA,tz=UTC",
"decision_fn":"pulse_features→(continue|sequence_fallback|request_followup)",
"permutations":200,"bootstrap":200,"pri":{"median":0.13,"p95":0.19},
"components":{"var_perm":0.0089,"var_boot":0.0471},"threshold":{"pri_max":0.20},
"granted":true,"cwa_grant_hash":"sha256:cwa_tcm_pulse_grant_v1","pri_hash":"sha256:pri_tcm_pulse_v1"}

{"ts":"2025-10-02T00:05:00Z",
"cohort_id":"segment=SMB,plan=A,instr=ledger.billing,protocol=accrual_v3,cad=1d,tz=UTC",
"decision_fn":"runway_control→(continue|price_test|rollback)",
"permutations":200,"bootstrap":200,"pri":{"median":0.08,"p95":0.14},
"components":{"var_perm":0.0041,"var_boot":0.0512},"threshold":{"pri_max":0.20},
"granted":true,"cwa_grant_hash":"sha256:cwa_saas_ledger_grant_v1","pri_hash":"sha256:pri_saas_ledger_v1"}

{"ts":"2025-10-02T00:05:00Z",
"cohort_id":"segment=Enterprise,plan=A,instr=events.product,protocol=analytics_v2,cad=1h,tz=UTC",
"decision_fn":"engagement_ops→(usage_nudge|hold|escalate)",
"permutations":200,"bootstrap":200,"pri":{"median":0.10,"p95":0.17},
"components":{"var_perm":0.0053,"var_boot":0.0530},"threshold":{"pri_max":0.20},
"granted":true,"cwa_grant_hash":"sha256:cwa_saas_events_grant_v1","pri_hash":"sha256:pri_saas_events_v1"}

You can now replay end-to-end:

empack certify pri \
  --cohorts cohort_manifests_*.jsonl \
  --cwa cwa_grants_*.jsonl \
  --pri pri_report_compact.jsonl \
  --out pri_attested.jsonl

These hashes (cwa_grant_hash ↔ pri_hash) slot cleanly into your decision trace and PBHL ledger for full auditability.

Glossary (skeletons, instruments, bands)

Skeletons (G)

G1 Conservation & Flow — Stock–flow accounting with unit checks so nothing appears/disappears “by prose.”
G2 Surplus Dynamics — Tracks generation/absorption/leakage of surplus (money, attention, options) and role/type transforms.
G3 Phase & Criticality — Detects thresholds/bifurcations via early-warning signals (variance, autocorr, flicker).
G4 Peaks & Traps — Finds local optima/lock-ins; plans escape (kick, reseed, topology edit).
G5 Observer-Runtime Invariants — Immutable traces, cross-observer agreement, slot conservation, belt closure.
G6 Certified Aggregation (CWA/PRI) — Grants mean/sum only when instruments commute and phase risk is low.
G7 Slot Economics — Integer caps for attention/memory/tools; logged allocation/eviction/denial.
G8 Belt Governance (PBHL) — Gap/Flux/Twist/Residual with banded actions (Green/Amber/Red).
G9 Phase-Lock & Symbol Kernels — Minimal opcode vocabulary + grammar to reduce narrative entropy and drift.
G10 MEEL (Multi-Objective Trade-offs) — Pareto-sound selection over cost, risk, fidelity, latency, ethics.
G11 SIDA (Deepening Algorithm) — Safe internal deepening with info-gain thresholds and stop rules.
G12 Substitution / Topology — Models replacement/interference; plans hybrid rollouts and de-risked migration paths.

Stack/Composition — How multiple skeletons run together (serial/parallel/guarded).
Break trigger (K) — Difficulty score $K=\rho\kappa\sigma\gamma$ ; high $K$ ⇒ invent new G or upgrade measurement.

Instruments & Cohorting (M2)

Instrument — A measured stream with unit, cadence (τ), lag, and protocol (how it’s taken).
Unit/Dimension (M1) — Formal type (e.g., USD, kWh, min). Levels vs. rates must not be mixed.
Cadence (τ) — Measurement period/bucket (e.g., event, 1 min, 1 h).
Protocol — Procedure/settings that affect comparability (e.g., D65 lightbox, radial 30 s rest).
Cohort — Group of records expected to commute: keyed by unit, instrument family, cadence bucket, protocol, tz, etc.
Non-commuting Pair — Instruments whose order matters (e.g., intervention then sensor). Must not be averaged blindly.
Cohort Manifest — Hashable list describing a cohort’s members and keys; used for replay/audit.

Bands & Belt Governance (G8)

Gap (g) — Planned delta over a window/cohort (targets).
Flux (f) — Realized change measured from instruments (same units/window as Gap).
Twist (t) — Coupling/geometry term (constraints, substitutions, interference).
Residual (r) — $r=\|g-f-\alpha t\|/(\|g\|+\varepsilon)$ .
Bands — Green $r\le0.08$ ; Amber $0.08<r\le0.15$ ; Red $r>0.15$ .
Band Actions — Required responses per band (e.g., continue / mitigate / halt-rollback-escalate).
Band Time — Share of ticks in each band; a reliability SLO.
Belt Ledger — Append-only records of Gap/Flux/Twist/Residual, band, and executed actions.

Certification Metrics & Gates (G6, G8)

CWA (Commutation-Safe Aggregation) — Invariance of an aggregator to permutations within a cohort. Grant mean/sum iff CWA ≥ 0.98.
PRI (Phase Risk) — Normalized permutation variance of the decision; must be ≤ 0.20 to deploy.
Certified Aggregation — Arithmetic mean/sum allowed only when both CWA and PRI gates pass.
Stress Permutations — Time-sorted, reversed, block-swap orders to probe hidden order effects.
Drift Windowing — Run tests in short/long windows; deny grants if drift (e.g., KS>threshold) breaks commutation.
Certification PASS — CWA/PRI gates passed and PBHL not Red; otherwise fallback or block.

Runtime & Evidence (G5, Ch.6)

Tick — Monotone decision step with write-once trace.
Trace (internal collapse) — Immutable record with prev_hash→hash chain: inputs_hash, cohort_ids, CWA/PRI, decision, belt snapshot, approvals.
Agreement — Cross-observer consistency score (e.g., ≥ 0.98) on {decision, band, agg_granted}.
Members Hash — Hash of cohort membership used for certified aggregation replay.
Evidence Bundle — Exportable Merkle bundle (traces, CWA/PRI tests, belt ledger) with signatures.
Slots — Integer capacities for attention/memory/tools/I/O with logged allocation/eviction/denial.
READY-CHECK → MEASURE → AGGREGATE → GOVERN — Minimal runtime loop enforcing gates and bands.

Residuals & Packaging (D)

Domain Residual (D) — Controlled essence: ≤ 5 rules (counter-intuition, exception routing, taboos) + 100–300-term lexicon + tiny edge tables.
∥D∥ (Budget/Norm) — Complexity penalty; if it regularly exceeds policy, fix M or propose new G.
Rule DSL — Minimal predicate→effect grammar for machine-checkable residuals (no prose loopholes).
EM-Pack — Deployable plugin containing G refs, M fills, and opaque D; shipped with manifest, attestation, usage meter, and audit APIs.
Attestation — Signed record binding code hash + tests + policy gates to a release.
Certified Output — A decision produced under granted CWA/PRI and recorded in the belt ledger (billable atom for CaaA).

Evaluation & Scaling (G10, Ch.10–12)

MEEL — Multi-objective evaluator (cost↓, risk↓, latency↓, ethics↓, fidelity↑) with ε-constraints and knee-point selection.
Family — Cluster of adjacent domains that share the same G stack and M defaults; differ mainly by small D.
D-Harvest Sprint — Focused effort to mine ≤ 5 residual rules per domain in a family using SIDA×MEEL.
CWA Grant Rate — Fraction of cohorts where mean/sum is lawful; a maturity signal.
PRI p95 — Tail phase-sensitivity; should remain ≤ 0.20.
PBHL Green Time — Fraction of operation spent in Green; governance SLO.
K Discriminator — Composite hardness; high-K cases seed new skeleton R&D.

Phase-Lock & Language (G9)

Opcode Vocabulary — Canonical set (≈ 120–300 tokens) that constrains narrative to reduce phase drift.
Canonicalization — Normalizes units, synonyms, tense; blocks hedged/ambiguous phrasing.
Narrative Entropy — Measured via opcode perplexity; should drop after lock.

Common Gotchas (quick flags)

Unit mixing — Averaging levels with rates or incompatible units.
Outcome-keyed cohorts — Leakage that inflates CWA falsely.
Averaging without grant — Running mean/sum when CWA/PRI fail (“average kills truth”).
Band without action — Reporting PBHL bands but not executing the required mitigations.
D bloat — Using residual rules to paper over missing G/M (raise “new G / fix M” ticket).

Optional: Sample “Strong-Attractor” Header (to include in EM-Packs)

Here’s a drop-in Strong-Attractor Header you can paste at the top of any EM-Pack. Three formats: a portable comment banner, a machine-readable JSON header, and a tiny per-turn output stub.

1) Comment banner (language-agnostic)

/*
SYSTEM // Strong-Attractor Kernel (v1)

Enforce invariants: { internal-collapse, cross-observer-agreement, slot-conservation, belt-closure }
Runtime loop: READY-CHECK → MEASURE → CWA(≥0.98)/PRI(≤0.20) → PBHL(band actions)
Outputs each turn: { TRACE, AGREEMENT, SLOTS, CWA, BELT } as JSON
Fail-closed: if CWA denied or PBHL=Red ⇒ use order-sensitive estimator + request human-in-the-loop
*/

2) Machine-readable header (JSON)

{
  "$id": "header://strong_attractor.v1",
  "invariants": [
    "internal_collapse",          // append-only trace: prev_hash -> hash
    "cross_observer_agreement",   // agreement >= 0.98 on {decision, band, agg_granted}
    "slot_conservation",          // integer caps; deny on exhaustion
    "belt_closure"                // PBHL: Gap/Flux/Twist/Residual with banded actions
  ],
  "runtime": ["READY_CHECK", "MEASURE", "AGGREGATE:CWA_PRI", "GOVERN:PBHL"],
  "gates": {
    "cwa_min": 0.98,
    "pri_max": 0.20,
    "pbhl_green_max": 0.08,
    "pbhl_amber_max": 0.15
  },
  "ready_check": {
    "require": ["slots_ok", "ethics_ok", "sensors_ok", "time_sync_ok"],
    "deny_on_exhaustion": true,
    "fail_closed": true
  },
  "cwa": {
    "permutations": 200,
    "min_cohort": 30,
    "stress_perms": ["time_sorted", "time_reversed", "block_swap"],
    "cohort_keys": ["unit","instrument_family","protocol","cadence_bucket","tz"]
  },
  "pri": { "bootstrap": 200 },
  "belt": {
    "alpha": 0.6,
    "bands": { "green": 0.08, "amber": 0.15 },
    "actions": {
      "green": ["continue"],
      "amber": ["reduce_scope:20%", "increase_measure_cadence:2x", "assign_owner"],
      "red": ["halt", "rollback", "escalate_to_human"]
    }
  },
  "fallbacks": {
    "on_cwa_denied": "order_sensitive_estimator",
    "on_pbhl_red": ["halt", "rollback", "escalate_to_human"]
  },
  "outputs_per_turn": ["TRACE","AGREEMENT","SLOTS","CWA","BELT"],
  "trace_fields": [
    "ts","policy_id","inputs_hash","cohort_ids",
    "cwa","pri","agg_granted","decision",
    "belt_snapshot","approvals","prev_hash","hash"
  ],
  "ethics": {
    "hard_constraints_ref": "schema://ethics_hard.v1",
    "blocked_instruments_ref": "schema://blocked_instruments.v1"
  }
}

3) Per-turn output stub (JSON shape)

{
  "TRACE": {
    "ts": "2025-10-02T00:00:00Z",
    "policy_id": "empack.domain.v1",
    "inputs_hash": "sha256:...",
    "cohort_ids": ["unit=USD,instr=ledger,cad=1d"],
    "prev_hash": "sha256:...",
    "hash": "sha256:..."
  },
  "AGREEMENT": { "replicas": 2, "score": 0.989 },
  "SLOTS": { "utilization": {"attention": 0.62, "memory": 0.50, "tools": 0.33}, 
    "denials": 0, "thrash_rate": 0.04 },
  "CWA": { "granted": true, "score": 0.991, "pri": 0.12, "members_hash": "sha256:..." },
  "BELT": { "alpha": 0.6, "r": 0.07, "band": "green", "actions": ["continue"] }
}

Drop these at the top of your EM-Pack manifest or loader. They codify the invariants, gates, loop, outputs, and fail-closed behavior in one place.

Disclaimer

This book is the product of a collaboration between the author and OpenAI's GPT-5, X's Grok Expert language model. While every effort has been made to ensure accuracy, clarity, and insight, the content is generated with the assistance of artificial intelligence and may contain factual, interpretive, or mathematical errors. Readers are encouraged to approach the ideas with critical thinking and to consult primary scientific literature where appropriate.

This work is speculative, interdisciplinary, and exploratory in nature. It bridges metaphysics, physics, and organizational theory to propose a novel conceptual framework—not a definitive scientific theory. As such, it invites dialogue, challenge, and refinement.

I am merely a midwife of knowledge.

Friday, September 26, 2025