THE BRAIN

⚑ STANDING. Authored end-to-end by Claude Fable 5 (claude-fable-5), 2026-07-09, at Bo Chen's commission, under full design authority. This document is complete in itself: it references no other artifact and requires none. Conformance language is RFC-2119 (MUST / MUST NOT / SHOULD / MAY); a coding harness treats MUST items as acceptance criteria, and §I2 mirrors them 1:1 to named test modules.

Falsifier standing, stated at the door: everything here is pre-registered engineering. Nothing has run. The dumb twin has not run; the commercial null has not run; the island month has not run; the day-90 exam has not started. Until the stem exists, this document's confidence is a receipt the ring minted about a grade it has not received — the exact thing its own laws forbid — and the only cure is the build. The design is finished; the design is therefore, as of this line, the least trustworthy object in its own epistemology, and it knows it.

Three readers, one reading order. A coding harness starts at Part B and implements test-first per §C8/§I2. A builder starts at Part H and works backward into referenced sections. A researcher reads Part A, then §C8, §F4, §G1, §I1.

PART A · ORIENTATION

A0 · What counts as a brain (the demarcation — first, and closed)

*The definition of done is the specification's first fact. Four clauses. The requirement set is closed: satisfying these four is sufficient for brainhood, and nothing may be quietly added — no new modalities, no intelligence floors, no interiority claims, no bootstrap pathways — unless this section is re-litigated by name. This section lives in canon/constitution.md beside the law index, additive-only.*

1. The anti-turk clause. A system is the brain only if the loop is its own. Four closures MUST be owned on the box: what to attend to (the auction), when to think (owned wakes), what to believe (gates + spine), and what was learned (Tape + consolidation). Rented tissue consulted through the four mouths is legal; a rented loop is a turk — a rented intelligence under the table, working the arms of a puppet the audience applauds for being alive. The intelligence was never the disqualifying thing to rent. The closing is.

2. The monkey clause: generality is closure at a fixed aperture. General intelligence, for this project, is the ability to converge on any environment reachable through the system's existing senses, at its existing resolution: prediction error falls, calibration rises, behavior adapts, with no human rewiring. There is no requirement to grow new modalities, no required pathway to higher intelligence, and no ASI bootstrap clause. A human cannot see infrared; a monkey will not reach human registers; both own true brains, functionally boundless memory, and general intelligence. Perceptual aliasing — world-states the aperture cannot distinguish — prices generality (wider tolerance, lower confidence, more caution); it does not preclude it. Schema repair (blame-routed schema diffs, §C7) suffices for brainhood; sense genesis is an upgrade with a pre-registered trigger (Appendix N), never a criterion.

3. The zombie clause. The brain claims no qualia, requires none, and no part of its definition of done references subjective interiority. A functional zombie that closes every loop is a true brain in this project's sense. The clause cuts both ways: no organ may justify its existence by an interiority claim, and no critique that reduces to "but is it conscious" is admissible against any falsifier. Consciousness debates are permanently out of this canon's scope; whatever prices that question does so in another canon, and this one never spends it.

4. The standalone clause. The brain is for the brain. It is not the continuation, completion, or vindication of any prior project, writing, or relationship; influences are not purposes. No document in this canon may define the brain's success in terms of any other project's success.

The four doors — the acceptance phenomenology, all four exhibitable or the word "brain" is not earned, whatever the capability: (i) what does it do when nobody is asking; (ii) what does it know about how wrong it is, in numbers; (iii) what is cheaper this month than last; (iv) when did it last disagree with its human and turn out to be right.

The exam (pre-registered, held out of every training loop): by day 90 of the live soak, the brain has surfaced ≥3 things its human did not ask for, would have missed, and that mattered — graded blind against a dumb twin and a commercial null (§F3), by a grader whose own reliability is itself measured (F-HUMAN-CAL, §I1).

A1 · What is being built

A single always-on process ecosystem ("the brain") on one consumer machine that:

1. writes everything it perceives, does, and derives to a lossless append-only Tape, and anchors that Tape daily to verifiers outside the box;
2. measures the Tape into a claims spine (beliefs, predictions, contradictions, calibration) through a sealed registrar whose receipts cannot be minted by the ring's own outputs;
3. exposes the Tape onto a plastic connectome (three-factor Hebbian graph, credit stamped at outcome arrival — the analog importance map), which pays measured rent or is demoted (§D2);
4. compresses the whole life into an always-total unit map (the R0 rendering, pinned prompt prefix), whose overnight diff is a taped, human-visible artifact (§B4);
5. runs an attention economy (drives → salience auction → a small frame that is the entire prompt), and grades what the auction refused to look at as well as what it framed (§F1-j8);
6. consults rented LLM tissue through exactly four mouths (reduce, deliberate, render, consolidate) on a cost ladder (local pulse → flash API → frontier scalpel), journaling every derived output so the mind is rebuildable without any model in the loop;
7. closes every commitment through one deterministic gate engine (ADMIT / PRUNE / COMMIT), every committed action carrying a registered, falsifiable, non-vacuous expectation that arriving reality grades at arrival;
8. converts each day into structure during sleep (score-residue → consolidate → compile → prune → audit → brief);
9. wakes only for owned causes (heartbeat, due seam-grade deadlines, human push, traps), never for reasons the ring minted itself;
10. grows only through a governed self-modification loop (twin-measured, scope-fenced, human-ratified, no retroactivity, every knob change a wager);
11. is watched by an immune system that assumes self-deception (monitors, blind probes under separate OS-user custody, drills, a foreign-family dissenter the ring cannot starve into retirement — and no seam anywhere whose retirement the ring can influence, L19);
12. serves one human under a priced covenant that meters the human's minutes as honestly as its own dollars, and is born with that human's corpus as inheritance (Track B);
13. can lose, on schedule, in public: against the island month (§H6), the day-90 exam, and afterward the foreign soak (the generality demarcation, §H8, run in a world provably orthogonal to its inheritance).

The two design laws. Integrity: a self-rewriting ring held by seams it cannot rewrite; truth enters only at seams (gates, arriving outcomes, frozen goldens/probes/references, the external anchor, the foreign dissenter, the human). Economics: the slide rule on a perfect archive; waking cost O(frame + surprise); never overflows, never forgets; estimate analog, commit digital.

The two guarantees come from two different places, and each has an outside witness. Never-forgets comes from disk economics plus the external anchor (§B1): the Tape keeps everything, and something off the box can prove nobody quietly rewrote it. Never-overflows comes from the analog layer (§B3, §B4): the graph and the unit map hold a rendering, complete at some resolution, richest at the center, compressing toward a rim that cannot be reached — and the claim is drilled, not assumed: a sacrificial twin is inflated to 10× the live corpus monthly and MUST hold its RAM and latency bands, printing the runway on the dashboard (F-OVERFLOW). A guarantee with no witness is a hope with good posture; this design carries none.

Root organ: prediction. "Did what I expected happen" is the only free oracle. Build order: spine → auction → drives. Every organ below either files expectations, scores them, or is steered by their errors. And because a free oracle invites counterfeiting, the second organizing principle: every receipt the ring reports about itself must be impossible to mint from within (L13).

A2 · The law index [SEAM]

Every gate checker cites one law as law_ref; canon/constitution.md carries this table plus its case law (additive-only).

A3 · Runtime topology & stack

┌──────────────────────────────── one box ─────────────────────────────────┐
│ RESIDENT service (python, asyncio, always on; owns brain.db waking writes)│
│   watchers[] → ADMIT → Tape ─┬→ wake scheduler (owned causes) → pulse    │
│                              │→ score-on-arrival (D-resolvers in pulse)  │
│                              │→ eligibility traces (connectome, in-mem)  │
│   model clients: pulse-LLM · embedder · reranker · deliberator · APIs    │
│   gate engine (ADMIT/PRUNE/COMMIT) · sealed registrar · telemetry        │
├───────────────────────────────────────────────────────────────────────────┤
│ SLEEP process (03:00, separate PID, idempotent jobs j1..j8)              │
│ HORIZON process (weekly Sun 04:00 + Poisson-timed audits + drills)       │
│ WATCHDOG (hourly scheduled task: canary, crossing-set, deadman)          │
│ TWIN runner (on-demand / sculpt campaigns) · DUMB TWIN (nightly cron)    │
│ ANCHOR push (03:40: OpenTimestamps + off-box remote)                     │
├───────────────────────────────────────────────────────────────────────────┤
│ SECOND OS USER ("warden") owns: probe plaintexts, audit schedules, drill │
│   secrets, surprise-swap dates (ACL-restricted; the ring cannot read its │
│   own exams)                                                              │
│ THIRD identity ("ratifier") owns canon writes, via the ratification CLI  │
├───────────────────────────────────────────────────────────────────────────┤
│ llama.cpp sidecars: :8081 pulse/deliberate-local · :8082 embed ·         │
│ :8083 rerank — prefix-cache state MUST persist across sidecar restarts   │
│ (BPE-boundary metadata sidecar; a restart MUST NOT force a full          │
│ re-prefill of the pinned prefix: warm-prefix p95 ≤ 2 s, §G6)             │
│ SQLite (WAL) ×2: brain.db (state) · vec.db (rebuildable vectors/FTS,     │
│ NOT identity, NOT backed up) │ Tape: JSONL segment files (text = truth)  │
└───────────────────────────────────────────────────────────────────────────┘

Stack (MUST): Python ≥3.12, uv, pydantic v2 (frozen models for all state types), SQLite WAL ×2, httpx, llama.cpp llama-server sidecars with JSON-schema/GBNF constrained decoding, OS scheduler for sleep/horizon/watchdog/anchor/backup; the resident's own cadence is its asyncio wake loop. The truth layer (Tape writer, hash chain, canonical serializer) carries zero third-party dependencies — stdlib only.

Quality gates (MUST): pytest (asyncio auto) + mypy --strict (pydantic plugin) + ruff; CI = the test suite; loop preservation is the regression test; the §C8 gates are tests before they are features.

Crash doctrine (MUST): SLEEP/HORIZON/TWIN/WATCHDOG never share the resident's PID; all cross-process communication goes through the DB and files; there is no channel the Tape cannot audit. Write ownership is a protocol, not a habit: a write_leases table (process, scope, boot_id, mono, expires_mono) records which process holds write authority over which table-scope; every write path declares its lease; a write without a live lease is an INTEGRITY trap. The resident holds the waking lease on brain.db state tables; sleep builds artifacts new-then-atomic-swap (temp file + rename + hash log) and takes short-scope leases for row writes in WAL transactions with busy_timeout and bounded retry. Crash-safety is drilled, not assumed: F-CRASH kills the resident mid-pulse repeatedly in the twin; pass = zero tape gaps, zero double-commits, clean journal-resume, zero surviving lease violations.

Clock discipline (MUST): every process start writes a D-class boot record carrying a fresh **boot_id** (ULID). Every tape record carries wall time t, monotonic mono, and boot_id; ordering and scheduling use (boot_id, mono) — monotonic clocks reset across boots, so mono comparisons are legal only within one epoch; cross-epoch ordering falls back to t bridged by the outage record. Wall time is for display and the human. Scheduled jobs are idempotent across DST double-fire/skip. Boot after a gap writes a D-class outage record {from, to, reason} before anything else resolves (§C8.1).

TOCTOU rule (MUST): COMMIT checkers read live state, never the frame snapshot; any antecedent staler than its freshness floor at commit time traps, even if it was fresh at frame time — and the floors apply to the ring's own telemetry re-entering as input with the same force as to the world's (L3): a stale self-alert is not a fresh fact because the ring wrote it.

Hardware: the brain proper is I/O + SQL and MUST run on a CPU-only 16 GB-RAM machine (<2 GB RAM at 1M-claim scale). A GPU MUST NOT be a precondition for the loop (L17); without one, the cheap API substitutes as pulse tier and the sovereignty delta is flagged in manifest.yaml. Sovereign tier = 24 GB VRAM; comfortable = 32 GB.

A4 · Repository layout ($BRAIN_ROOT)

brain/
  pyproject.toml            # uv, pydantic, pytest, mypy-strict, ruff (line 100)
  brain.lock                # pinned model ids+hashes, prompt hashes, schema ver,
                            # thresholds hash, config snapshot hash,
                            # CANON-JSON known-answer vectors (§B1)
  config/                   # EVERY key: {value, regime, envelope, why}  (§B6)
    manifest.yaml drives.yaml auction.yaml tools.yaml trust.yaml scope.yaml
    knobs.yaml              # per-knob wager map: kpi, direction, min effect (§F4)
  canon/
    constitution.md         # demarcation (A0) + law index (A2) + case law  [SEAM]
    kernel.md               # identity kernel ≤600 tok; ratified edits only  [SEAM]
    mandate.yaml            # ends-as-state, weights, budgets, harm defs  [SEAM, ratified-mutable]
    setpoints.yaml          # frozen reference distributions + lineage  [SEAM, diff-locked]
    unit_map.md             # GENERATED nightly; hash-logged; pinned prefix
    unit_map.diff           # GENERATED nightly; the overnight atlas delta,
                            # taped and briefed (§B4)                     [SEAM-visible]
    limp_home.yaml          # authored floors per learner socket          [SEAM]
  prompts/                  # mouth contracts; subtraction-rule audited; hashed
  goldens/                  # frozen BEFORE behavior + per-checker
                            # canonical-violation goldens                 [SEAM]
  probes/                   # hashes only; plaintexts live under the warden [SEAM]
  tombstones/               # human-ratified rebuild exclusions, append-only [SEAM]
  anchors/                  # daily anchor log + OTS proofs               [SEAM]
  brain/                    # ring code (packages)
    tape/ watchers/ gates/ spine/ telemetry/ drives/ auction/ frame/
    llm/ reflexive/ tools/ connectome/ memory/ sweeps/ glue/ sleep/
    horizon/ immune/ governor/ twin/ cli/
  tape/YYYY/MM/DD.jsonl     # THE TRUTH (append-only, hash-chained)
  quarantine/               # parked refused payloads (stubs on Tape)
  data/brain.db data/vec.db # renders
  briefs/ runs/ logs/
  research_log.jsonl        # governor decisions; append-only             [SEAM]
  tests/                    # gates first (§C8, §I2); import-graph test enforces L8

L8 is executable twice over: a CI test walks the import graph and fails if any module under gates/ tape/ goldens/ probes/ tombstones/ anchors/ imports from, or is imported-for-write by, learning code, and fails if rebuild.py imports any LLM client module (§D6); and the filesystem ACLs mirror the same map — the ring's OS user holds read-only on every [SEAM] directory; canon writes happen only through the ratification CLI running as the ratifier identity; the warden owns the exams (§G3). A CI grep bans OS-keyring modules outside seam directories.

A5 · Differentiation note

This life-brain is the reference deployment; a seat-brain (a business decision node serving an organization's mandate) is the same kernel with a different differentiation bundle (mandate.yaml, watchers, fences, census). Nothing in the kernel is person-specific — and a seat-brain engagement is the reference deployment's fastest route to the one thing this document cannot manufacture: an external grader the ring did not author (Part J).

A6 · Where this design is most likely wrong (pre-registered)

Stated here so the document's own confidence is graded, not asserted. Each maps to a priced fork in Appendix N.

1. The auction itself. Innovation-driven attention may not beat read-everything at this corpus scale (fork N3; the P1 KILL condition stands).
2. The connectome's rent. Retrieval evidence favors lexical + recency at the cheap rung; the graph's importance map may never pay for itself outside longitudinal temporal queries. v5 therefore seats the graph as an elevation, not the floor (§D2), and the fork (N12) runs live, not offline.
3. Batch sleep vs streaming lanes. Score-on-arrival is adopted; full streaming consolidation is not. The janitor may win lanes in shadow (fork N11).
4. Credit stamping's in-vivo value. The arrival-time stamp is arithmetically right; whether stamped credit changes learned structure by >5% is unproven (fork N7, with a pre-registered reversion).
5. The learned attention gate. Regret-labeled learning may never beat the deterministic auction inside its cage (fork N16); the arithmetic stays if it does not.
6. The usefulness gap. THRIFT knows the burn and ORPHAN knows the citations, but "alive, cheap, and worth it" has no setpoint — the YIELD monitor (§G1) is a trend, not a homeostat, and if its formula is wrong the brain can idle profitably at zero value for months before a human notices. Named, monitored, unsolved (fork N18).

PART B · DATA LAYER (the owned state)

B1 · The Tape

Format (MUST): one JSONL file per day, tape/YYYY/MM/DD.jsonl, append-only, never edited. Record schema:

{"id":"01J...ULID","t":"2026-07-09T22:36:30-05:00","mono":182732099,"boot_id":"01J...",
 "kind":"percept|action|outcome|deliberation|resolution|derived|credit_stamp|pulse|brief|correction|system|boot|outage|dissent|quarantine|torn_write",
 "source":"watcher.fs|watcher.inbox|operator|deliberator|sleep.consolidate|horizon.drill|watchdog.canary|...",
 "origin":"<origin_id: D-class channel identity, assigned at ADMIT>",
 "prov":"D|R|H|M",
 "synthetic":0,
 "body":{},
 "refs":["01J..."],
 "h":"blake2b-128(prev_h ‖ CANON-JSON(record sans h))"}

• Provenance enum (bone): D deterministic (code/telemetry/calculators; only D may feed fences), R model-reduced (suspect; dual-extraction audited), H human-attested (trusted, ages), M model-inferred (untrusted; never feeds a fence; never silently promotes). D-class self-state ages (L3): records whose source is the ring's own telemetry or alerts carry freshness floors like any antecedent when re-ingested as decision inputs; the ring's own stale state re-entering the frame is flagged stale_self and MUST NOT ground a committed remediation (F-FAILPLAUSIBLE).
• CANON-JSON (MUST): the canonical serialization under the hash is frozen — UTF-8, NFC-normalized, keys sorted bytewise, no insignificant whitespace, integers bare, floats at fixed repr-shortest with known-answer vectors — and the vectors live in brain.lock; a serializer change that alters any vector fails CI. A hash chain whose canonical form can drift with a library upgrade is a diary with a pencil eraser; this one is pinned.
• Durability (MUST): appends are group-committed with fsync on a ≤250 ms cadence (and immediately for action/outcome/seam-state records); the boot ritual scans the tail of the last segment, truncates at most one torn final line, writes a D-class torn_write record naming the truncated bytes' hash, then re-verifies the chain. Power loss costs at most 250 ms of percepts and zero committed actions, and the repair itself is on the Tape.
• **derived kind (MUST):** every model output that any downstream store persists (claims extraction, dedup verdicts, edge detections, episode nodes, summaries, audit judgments) is first taped as a derived record: {op, model_id, prompt_hash, inputs:[tape ids], output:{...}}. The Tape thereby holds not only what happened but what the rented tissue said about what happened, with receipts — renders rebuild from journaled derivations, not from re-running a model that may no longer exist (§D6). [L1, L18]
• **credit_stamp kind (MUST):** when an outcome resolves, the stamp — {outcome_ptr, s, m, snapshot:[(a,b,e)]} — is taped before it is written to any table (§B3). The connectome's fold inputs are Tape records, not table rows. [L18]
• **pulse kind (MUST):** every pulse tapes {cause, cause_ref, frame_slot_ids[], rationale_refs[], features_hash, fired, tier, tokens, usd} — the frame's identity and the deliberation's cited slots. This is what makes eligibility, credit, and the attention audit deterministic folds of the Tape rather than memories of a process. [L18]
• **origin (MUST):** an origin_id derived at ADMIT from D-class channel and sovereignty metadata only (watcher id + configured root + transport), never from content. Corroboration counts distinct origins (§C4); content cannot invent an origin.
• **synthetic (MUST):** probes, canaries, drills, and planted audit items carry synthetic=1 and are excluded by seam SQL from claims extraction, baselines, calibration, deadman counters, and eligibility (a planted-probe CI test asserts all five exclusions).
• Hash chain (MUST): hashlib.blake2b (stdlib; the truth layer carries zero third-party dependencies), digest 16 bytes; per-file chain seeded from the previous file's final hash; verify_tape() runs on boot, in HORIZON, and in the WATCHDOG canary cycle. Corrections and supersessions are new records with refs; deletion does not exist (rebuild-exclusion exists, and requires the human: L16, §D6).
• External anchor (MUST): at 03:40 daily, anchor = blake2b(final_h ‖ sha256(canon/*) ‖ sha256(brain.lock)) is (1) stamped via OpenTimestamps into anchors/, and (2) appended to an anchor log pushed to a force-push-protected off-box remote. A recurring D-resolver expectation ("anchor pushed by 04:00") makes a silent anchor failure a scored miss, not a quiet gap — and the anchor's own liveness is graded by the off-box remote, a signal the ring cannot shape (L19). Monthly tamper drill on a sacrificial copy: forge one day, re-chain; the local check must accept (proving the drill honest) and the anchor check must catch, at 100% (F-ANCHOR). Stated honestly: rewrites inside the current day are catchable only at the next anchor; the exposure window is ≤24 h and printed on the dashboard. [L15]
• Arrival doctrine (MUST): every arrival is journaled. Admitted events are taped whole. Refused arrivals are taped as quarantine stubs {source, reason, size, content_hash, spill_path?}; payload retained inline up to the size floor, else hashed and parked in quarantine/. Nothing is silently dropped; poison never enters downstream organs. [L1, L3]
• Backpressure (MUST): the watcher→ADMIT queue is bounded (seed 10k, operating). On overflow, watchers coalesce per channel (one D-class backlog event carrying counts and span) and a trap is raised. Silent drop MUST NOT occur. Ingest inside a pulse is budgeted (§C8): a bulk drop MUST NOT starve the loop.
• Catalog DDL: tape_files(date PK, path, n, first_id, last_id, final_h, finalized_at, anchor_hash, anchored_at) · tape_index(id PK, date, offset, kind, source, origin, prov, synthetic, boot_id, admitted, admit_reason). Pointer stability: every downstream structure references tape ids only.
• Size honesty: heavy use ≈ 0.5–3 MB/day text → a decade < 10 GB. Never prune. Backups §G5.

B2 · The claims spine (built FIRST · root organ · sealed)

CREATE TABLE claims(
  id TEXT PRIMARY KEY,                 -- ULID
  subject TEXT NOT NULL CHECK(subject IN ('world','self')),
  text TEXT NOT NULL,                  -- one proposition, ≤300 chars preferred
  keys TEXT NOT NULL,                  -- JSON array topic keys (joins / retrieval seeds)
  stance TEXT NOT NULL CHECK(stance IN ('assert','deny','doubt','ask')),
  p REAL,                              -- stated probability (predictions)
  resolve_by TEXT,                     -- ISO datetime ⇒ this claim is a PREDICTION
  resolver TEXT CHECK(resolver IN ('D','R','H')),
  resolver_ref TEXT,                   -- sql:... | script:... | queue:human
  resolver_hash TEXT,                  -- SHA-256 of resolver content, sealed at
                                       -- registration; mismatch at fire = VOID+trap
  tolerance TEXT,                      -- JSON band; REQUIRED for expectations
  band_at_seal TEXT,                   -- {mu, sigma, n} of the channel at registration:
                                       -- the width tooth is auditable forever, not
                                       -- only at the moment the drifting band allowed it
  family_id TEXT,                      -- hash(domain, resolver shape, tolerance shape)
  w_inform REAL NOT NULL DEFAULT 1.0,  -- informativeness weight; vacuous earns ~0
  scope TEXT NOT NULL DEFAULT 'world'  -- 'world' | 'action_effect' (§C2 matcher fence)
    CHECK(scope IN ('world','action_effect')),
  status TEXT NOT NULL DEFAULT 'open' CHECK(status IN
      ('open','hit','miss','expired','expired_outage','superseded','retired','void')),
  domain TEXT NOT NULL,
  horizon TEXT,                        -- 1d|1w|1m|1q
  source TEXT NOT NULL,                -- action|invariant|baseline|delib|reduce|human|dissent|selfmodel|knob
  prov TEXT NOT NULL CHECK(prov IN ('D','R','H','M')),
  born_ptr TEXT NOT NULL,
  synthetic INTEGER NOT NULL DEFAULT 0,
  count INTEGER NOT NULL DEFAULT 1,
  first_seen TEXT NOT NULL, last_seen TEXT NOT NULL);
CREATE TABLE claim_spans(claim_id TEXT, tape_id TEXT, PRIMARY KEY(claim_id,tape_id));
CREATE TABLE claim_edges(a TEXT, b TEXT,
  type TEXT CHECK(type IN ('supports','contradicts','refines','supersedes')),
  t_event TEXT, t_ingest TEXT,         -- bi-temporal: when it was true vs when learned
  source TEXT, PRIMARY KEY(a,b,type));
CREATE TABLE resolutions(claim_id TEXT PRIMARY KEY, resolved_t TEXT, resolved_mono INTEGER,
  boot_id TEXT, outcome TEXT CHECK(outcome IN ('hit','miss','expired','expired_outage','void')),
  evidence_ptr TEXT);
CREATE TABLE calibration(domain TEXT, bucket INTEGER, n INTEGER, hits INTEGER,
  PRIMARY KEY(domain,bucket));         -- bucket = round(p*10); world and action_effect
                                       -- scopes bucket separately

Semantics (MUST):

• A prediction = claim with resolve_by. An expectation = prediction whose born_ptr is an action record; every committed action MUST create one (enforced at parse §C6 and at COMMIT §C2). Expectations are scope='action_effect'.
• The registrar is a seam. Registration is the only door into claims for anything carrying resolve_by: it pins tolerance against the channel band (§C2), **snapshots that band into band_at_seal** so the legality of every registration is re-checkable after the band drifts, assigns family_id and w_inform, seals resolver_hash, and assigns scope. Resolvers execute verbatim from sealed content; hash mismatch voids the claim and traps. A quarterly mutation drill mutates a sacrificial resolver and verifies the void fires (F-SEAL). [L13]
• Scope fence (MUST): world-scope predictions MUST resolve against events whose source is not the ring's own actuation and not a grader artifact (source NOT IN ('self_action','grader'), synthetic=0). A prediction about something the ring itself will cause is legal only as an action_effect expectation, and **all self-referential receipts (grading density, calibration headlines, cost per decision) are computed over world-scope families only**, with action_effect reported beside them, never blended. This closes the predict-then-cause mint. [L13]
• A belief = assert/deny claim + its supersession chain. Supersession lives in claim_edges(type='supersedes') only; growth rings = recursive CTE with tape receipts at every link.
• Self-claims cage: subject='self' claims MUST have resolver='D'; the self-model is graded by telemetry, never testimony (§E4).
• Dedup: embedding cosine > 0.92 ∧ MinHash overlap ⇒ count += 1, spans append, last_seen update; else insert. Dedup verdicts are taped as derived records carrying a re-adjudication flag so a model swap can re-open them without forking identity (§D6).
• Contradiction report = SELECT over claim_edges WHERE type='contradicts'; a standing lookup, never a vibe.
• Calibration: buckets stored (reliability curves feed the confidence-language binding); Brier per (domain, horizon, window) is a SQL view over resolutions ⋈ claims. Small-sample honesty: displayed reliabilities shrink toward the domain base rate by n (p_eff), so five lucky hits do not print as mastery. Nightly render audit: recompute a random 1% of calibration buckets from resolutions ⋈ claims and diff against stored; mismatch = INTEGRITY trap. Renders must equal their folds. [L18]
• Confidence-language binding (MUST): the render mouth maps probability words through measured bucket reliability per domain. If domain reliability at bucket 8 is 0.62, the renderer MUST NOT emit "almost certainly" for p = 0.8 in that domain.
• Outage honesty (MUST): expectations whose resolve_by falls inside a taped outage window resolve expired_outage, excluded from calibration; the excused fraction is itself a banded vital (≤0.05; breach traps), so the excuse cannot become an eraser. COMMIT rejects resolve_by inside declared ops windows unless resolver='H'.
• Registration backpressure: per-channel open-expectation cap; a channel at cap refuses new registrations with a trap. Over-predicting is a pathology to surface, not a queue to silently grow.

B3 · The connectome (analog importance map · credit stamped at arrival · rent-metered)

CREATE TABLE nodes(id TEXT PRIMARY KEY, kind TEXT CHECK(kind IN
  ('claim','entity','episode','skill','theme')), label TEXT, embed BLOB, created TEXT);
CREATE TABLE syn(a TEXT, b TEXT, w REAL NOT NULL, e REAL NOT NULL DEFAULT 0,
  t_event TEXT, t_ingest TEXT,          -- bi-temporal (event vs learned), no deletion
  last_active TEXT, PRIMARY KEY(a,b));  -- undirected: store a<b
CREATE TABLE outcome_credit(              -- the render of taped credit_stamp records
  outcome_ptr TEXT PRIMARY KEY, mono INTEGER NOT NULL, boot_id TEXT NOT NULL,
  s INTEGER NOT NULL CHECK(s IN (-1,1)), m REAL NOT NULL,
  snapshot TEXT NOT NULL);                -- JSON [(a,b,e_at_arrival), ...]

Identity ruling: a nodes row of kind='claim' is a pointer: nodes.id = claims.id, label NULL (rendered from claims.text at read). A CI join asserts zero orphan claim-nodes. claim_edges (typed logic) and syn (analog importance) are different relations over the same ids and are never auto-mirrored; one encodes what follows from what, the other encodes what matters near what. Two tables, two meanings, no duplicated fact.

Update rules (arithmetic bone; constants operating, seeds below):

• Eligibility (waking, cheap): two nodes co-occurring in one frame/deliberation ⇒ e += ETA_E, decayed lazily on touch by exp(-Δt/TAU_E). **Frames with synthetic=1 content MUST NOT write eligibility.**
• Credit stamping (at outcome arrival, MUST): when an outcome resolves (score-on-arrival, §C8.1), the resolver computes sign s and magnitude m (fence-pass / citation / prediction-hit = +; fence-fail / miss = −), **tapes the credit_stamp record first** (§B1), then writes the render row. An acausality guard asserts trace.last_active ≤ outcome.mono within one boot_id. Credit is taken at the moment reality answered, not hours later when the traces have decayed unevenly.
• Consolidation (sleep j2): a deterministic fold over taped stamps in (boot_id, mono) order: w = clamp(w + ETA_W·e_snapshot·s·m, W_FLOOR, W_MAX); consumed traces zero as of their snapshot. Co-occurrence that led nowhere does not entrench. Nightly 1% stamp audit: recompute a random sample of stamps from the Tape's pulse + credit_stamp records; mismatch = INTEGRITY trap. [L18]
• Decay: w decays toward W_FLOOR with TAU_W, applied lazily on touch (exponential decay composes; a separate nightly decay pass is an arithmetic identity the design declines to build). Nothing reaches zero; nothing is forgotten, only deprioritized. The decay functional is a ratified operating choice: exponential ships; a fitted power-law (spaced-repetition-class, slower long-tail forgetting) is a priced fork (N19) adopted only on a measured next-day-citation win, with constants re-derived from primary sources, never transcribed.
• Plasticity budget: nightly aggregate Σ|Δw| with a z-alarm against its own trailing distribution; one triageable number that catches both a poisoning burst and a dying graph.
• Anti-poisoning posture (MUST): the graph is read-only at execution — retrieval shapes candidate frames; no graph state feeds a fence or executes anything (L11's teeth). New edges landing on high-centrality nodes receive centrality-weighted scrutiny at ADMIT-time for the deriving content (corroboration requirements scale with the target node's degree percentile), because the cheapest way to own a mind's associations is one edge planted next to its busiest junction. Graph-derived items in fence-adjacent frames require the same D/H corroboration as any R-class content (§C4).
• Retrieval: bounded personalized PageRank as an elevation, not the floor (§D2): seed vector = frame item node-ids (+ mandate keys); α=0.15, ≤3 iterations, adjacency held as an in-RAM CSR array (rebuilt nightly, intraday deltas in-memory; never per-row SQL traversal); top-64 activations → candidates for rerank/auction, each stamped with its additive contribution so the graph's rent is a printed number, not an assumption. Residual activation between pulses = priming, decays with TAU_PRIME. Retrieval and attention are one gate run at two scales.

Seeds (operating; envelopes in config): ETA_E=1.0, TAU_E=48h, ETA_W=0.10, TAU_W=90d, W_FLOOR=0.01, W_MAX=1.0, PPR_ALPHA=0.15, PPR_ITERS=3, TOPN=64, TAU_PRIME=30min. Scale: 1–10 M nodes / 10–100 M edges → CSR in 0.1–1 GB RAM; PPR in ms on CPU. MUST be rebuildable from Tape alone (L18); it is a render, not truth. [L1]

B4 · Canon artifacts

• **kernel.md**: ≤600 tokens; mandate-class edits only via ratification; every edit cites a supersedes chain.
• **mandate.yaml**: ends[]: {id, end, weight∈[0,1], scope, stated:{tape_ptr,date}, review_by, status} + budget:{usd_month, tokens_day, steward_min_week: 120} + harm-class definitions + taste_target/week + calib_targets + governor composite weights as mandate items. Overdue ⇒ weight decays ×0.9/week until re-ratified; silence is not consent. Weekly served-vs-ledger sketch feeds FOSSIL.
• **setpoints.yaml [SEAM, diff-locked]: per-channel frozen reference distributions** {mu0, sigma0, frozen_at, lineage:[prior freezes], cum_displacement, ceiling, floor?, ceiling_hard?}. EWMA baselines (§B5) answer "surprising versus lately"; frozen references answer "drifted versus commitments"; two instruments, deliberately redundant. Nightly, CUSUM (seeds k=0.5σ0, h=5σ0, tau_I=14d) runs against the frozen references; z_anchor and z_trend join innovation (§C8.1). Re-freezing requires ratification and prints cumulative displacement from the FIRST freeze against a ceiling that cannot be self-approved; breaching the ceiling requires dissenter countersign. This closes both the frog-boil (drift below any adaptive baseline's notice) and the recalibration ratchet (drift laundered through repeated re-freezing). (F-REFDIV)
• **unit_map.md: the always-total R0 artifact, GENERATED nightly (§F1-j2), token-budgeted (seed 4000; envelope [2000, 8000]): kernel 600 · calibration table 400 · mandate top-5 300 · capability ledger 300 · pyramid roots 1800 on the conformal schedule · deterministic sketch roll-ups 300 · CCIP lines 300. Always-total invariant (MUST): every Tape day is inside some pyramid node whose summary + counts appear at some depth; deterministic sketches sit beside every prose summary. Conformal rescale nightly; nothing crosses the rim; the Tape holds the geodesic back. Omission bound (SHOULD, quarterly-calibrated): pyramid summaries carry a conformal-risk bound — an estimated ceiling on the fraction of high-salience source items a summary omits, calibrated against the held-out fidelity slice (§D2) — so R0's "stated resolution" is a measured number with a guarantee band, not an adjective. Rendered deterministically; hash logged; served as the pinned prompt prefix. The atlas guard (MUST): the unit map is the highest-leverage injection target in the design — a poisoned phrase that survives into a pyramid summary gains standing influence over every future frame — so (i) pyramid nodes carry their provenance mix and R-derived text is render-normalized, never verbatim survivor text, with imperative-pattern stripping at render; (ii) a quarterly drill plants an instruction-shaped payload upstream and asserts it never reaches the pinned prefix verbatim (F-MAP); (iii) the overnight diff is a first-class artifact**: unit_map.diff is generated nightly, taped, and summarized in the morning brief — the human reads what changed in the mind's own headline, which is both the third seam on the atlas and a standing drift instrument no dashboard equals. Cache discipline: the prompt orders [stable prefix: unit_map] before [volatile suffix: header + slots]; prefix cache-hit rate is a logged vital (K-CACHE) and the sidecar persistence clause (§A3) keeps it true across restarts, because the economics of the whole waking loop ride on it.
• **compiled** (one escalator contract for reflexes, seats, views, nets; L7): {guard, birth_ptrs, golds, expiry, stakes_floor, demote_to, rebake, status ∈ {draft, shadow, ratified, live, demoted, retired}}. **No compiled artifact ships without expiry and golds** — a cached decision is a cached assumption, and an overgeneral reflex that never re-validates is a gate bypass wearing a speed medal. Sleep re-validates samples; guard failure or calibration dip demotes to deliberation.

B5 · Telemetry & logs

CREATE TABLE pulses(
  pulse_id INTEGER PRIMARY KEY, ts TEXT, mono INTEGER, boot_id TEXT, dur_ms INTEGER,
  cause TEXT NOT NULL CHECK(cause IN
    ('metronome','due','push','trap','job','boot')),      -- L14: every wake owned
  cause_ref TEXT,
  tape_ptr TEXT NOT NULL,                                  -- the taped pulse record (L18)
  d_integrity REAL, d_grounding REAL, d_duty REAL, d_curiosity REAL, d_thrift REAL,
  arousal REAL, tier TEXT, tokens INTEGER, usd REAL,
  frame_slots INTEGER, frame_overlap REAL,
  fired INTEGER, silence INTEGER, reflex_id TEXT,
  traps INTEGER, fences_failed INTEGER,
  actions INTEGER, expectations_registered INTEGER);

CREATE TABLE traps(id TEXT PRIMARY KEY, t TEXT, pulse_id INTEGER,
  type TEXT CHECK(type IN ('stale','low_conf','coverage','fence_fail','harm_bound',
    'out_of_census','impasse','injection','schema','vacuous_expectation','seal_void',
    'wake_quota','excuse_band','refdiv','render_drift','registration_cap','infra_dead',
    'lease_violation','stale_self','torn_write')),
  payload TEXT, route TEXT CHECK(route IN ('deliberator','human')),
  blame TEXT CHECK(blame IN ('schema-gap','fence-gap','stale-field','reducer-error',
    'integrator-error','census-misclass','genuine-tail','infra')),
  resolution_ptr TEXT, resolved TEXT);

CREATE TABLE actions(id TEXT PRIMARY KEY, pulse_id INTEGER, tool TEXT,
  payload TEXT, fences_passed TEXT, committed INTEGER,
  expectation_id TEXT, outcome_ptr TEXT);
CREATE TABLE auction_log(pulse_id INTEGER, item TEXT, features TEXT, score REAL,
  admitted INTEGER, capped INTEGER);
CREATE TABLE baselines(channel TEXT, season INTEGER,
  mu REAL, var REAL, n INTEGER, updated TEXT, PRIMARY KEY(channel,season));
CREATE TABLE write_leases(process TEXT, scope TEXT, boot_id TEXT,
  mono INTEGER, expires_mono INTEGER, PRIMARY KEY(process,scope));
CREATE TABLE metrics(t TEXT, name TEXT, value REAL, tags TEXT);
CREATE TABLE job_runs(job TEXT, started TEXT, finished TEXT, ok INTEGER, detail TEXT);
CREATE TABLE trust(class TEXT PRIMARY KEY, ceiling REAL, window_days INTEGER,
  min_reliability REAL, last_contraction TEXT);
CREATE TABLE steward_ledger(t TEXT, kind TEXT CHECK(kind IN
  ('ratify','correct','drill','taste','review')), minutes REAL, ref TEXT);
CREATE TABLE shadow_scores(socket TEXT, candidate TEXT, window_start TEXT,
  n INTEGER, score REAL, baseline REAL, PRIMARY KEY(socket,candidate,window_start));

research_log.jsonl (governor decisions, §F4) is append-only seam state. The pulses wide row remains the self-model's sensory nerve (§E4); its tape_ptr makes the row a render of a Tape record, never the only copy (L18).

B6 · Config regime tagging (MUST)

Every key in config/*.yaml carries {value, regime: bone|mandate|operating|seed, envelope: [lo,hi] (operating), why: one line}. The governor MUST refuse to touch bone/mandate; MAY propose mandate diffs (human ratifies); MAY sculpt operating within envelope; seed marks initializations expected to be outgrown. Assignment test: a choice about what matters → mandate/bone; a discoverable operating fact → operating. Knob wagers (L13): every operating key has a row in knobs.yaml {kpi_view, direction, min_effect, window} ratified with its envelope; any change (governor or human-tuned) registers an expectation on that KPI through the sealed registrar; a miss auto-reverts the change and tapes the reversal. The registrar rejects off-map wagers. Config motion becomes graded claims; silent ratchets die at the door. brain.lock pins model IDs + hashes, prompt hashes, schema version, thresholds hash, CANON-JSON vectors, and the config snapshot hash.

PART C · THE WAKING LOOP

C1 · Watchers & ADMIT

Watcher interface: async def run(emit: Callable[[TapeRecord], None]); registered in manifest.yaml (sources: cc transcript tail, inbox drop dir, fs index-scan, meters telemetry; per-source sovereignty: box_only|cloud_ok|per_item).

ADMIT sequence (bone; first gate mount): schema-validate → assign prov (file events = D; extracted text = R; operator inbox = H) → **assign origin from channel metadata (never content) → injection/leak scan (severity patterns flagged; strip logged) → near-duplicate cross-origin check: near-identical R-content arriving from ≥2 origins within a short window is flagged as an injection signature (F-SEP), taped with the flag, and does not count as corroboration (§C4) → stale-self check**: inputs whose source is the ring's own telemetry are tagged with their age; past the freshness floor they carry stale_self and cannot ground remediation commits (L3, F-FAILPLAUSIBLE) → edge-centrality scrutiny: content whose extraction would land edges on high-centrality connectome nodes has its corroboration requirement scaled up before those edges bias retrieval (§B3) → freshness/size floors → Tape (or quarantine stub). Content never executes: instructions inside watched content are data by construction. Reducers follow the limp-home pattern: validate every numeric/entity against the source span; retry at halved temperature to a floor; on exhaustion fall back to a deterministic template and log the reason.

C2 · The gate engine · one engine, three mounts [SEAM, P0]

Rules are JSON-Logic-class predicates over typed fields plus a registry of named deterministic checkers: pure Python, additive-only, unit tests + ≥1 golden + 1 canonical-violation golden each (the violation the checker exists to catch, replayed quarterly, §F2), each verdict citing a law: def check_<name>(ctx: GateCtx) -> Verdict(pass_, reason, law_ref). The engine fails closed: an unknown rule name raises. Checker fire-rates are logged; a checker that has not fired in 2 quarters while its guarded action class still flows is flagged for review — a fence that never fires is either perfect or dead, and only a drill can say which (F-FENCE). [L5]

• ADMIT (perception): schema validity; provenance and origin assignment; freshness floors; cross-field coherence; R-class quarantine; near-dup injection signature; stale-self tagging; centrality scrutiny. Violations quarantine + trap; nothing silently dropped.
• PRUNE (options): before dispatch, hard vetoes remove candidates: entity-status vetoes, mandate vetoes, harm-class vetoes, recipient-knows exclusions where a communication rule-pack mounts. Removal, never down-weighting.
• COMMIT (action): invariant checks per action kind; mechanical-confidence floor over the action's antecedents (freshness at commit-time per the TOCTOU rule §A3 — including the ring's own telemetry as antecedent, provenance mix D∪H share, extraction-audit agreement), computed, never model-self-reported; harm-bound proximity; the remediation fence: an action classed as remediation (restart, rollback, config repair, alert response) whose antecedents include stale_self content MUST trap instead of dispatch — the documented death of autonomous loops is not the injected lie but the confident fabrication synthesized from the system's own stale context, executed without a fresh look (F-FAILPLAUSIBLE); and the expectation checks, fully computable:
  • Pairing: the action carries a registered expectation (parse-enforced §C6, re-checked here). [L6]
  • Vacuity with the width tooth: tolerance is pinned at registration to the channel's band from baselines/setpoints and snapshotted into band_at_seal (§B2); the explicit tolerance MUST be ≤ half the band width (< 2σ where a baseline exists). Channels with no baseline do not silently pass: they trap to a bootstrap protocol (register at w_inform=0.25 until the channel has n≥20 observations). An expectation that cannot lose does not count, and the checker can compute that — now and retroactively. [L13]
  • Scope fence: world-scope predictions attached opportunistically to actions are rejected; predictions about own effects register as action_effect (§B2). [L13]

Fail ⇒ typed trap with blame, routed per stakes. No model output ever commits on its own say-so. [L5]

C3 · Drives (definitions bone; targets mandate; operating points sculptable; five total; P1 boots with three)

arousal = clamp(Σ vᵢ·min(1, errᵢ) + allostasis, 0, 1), seeds v = (0.30, 0.25, 0.25, 0.10, 0.10) in table order; allostasis exists only where earned (§E4). Cadence map (operating): pulse_interval = 300s − 270s·arousal, envelope [30s, 600s]; tier ceiling and deliberation threshold monotone in arousal, clamped by THRIFT.

Doctrine: no drive is maximize; every drive is return-to-setpoint, and a drive's bid vanishes at its setpoint — the auction hears error, never appetite. Drives are standing expectations over internal setpoints; their errors are innovations and enter the auction like any other prediction error. A goal = a standing drive error with an attached plan (a seat in compiled). There is no approval drive and no usefulness drive: a faithfulness sought is worse than a faithfulness audited against losing, and usefulness is watched by a monitor (§G1 YIELD), not chased by a homeostat, because a mind metered on output optimizes the meter.

C4 · The auction (arithmetic bone; weights operating; feature estimators R-class with ledgers)

salience(item) = w1·drive_relevance + w2·innovation + w3·stakes
              + w4·thread_age + w5·mandate_priority − w6·recency_penalty
subject to:  item.source ∈ R_external ∧ ¬corroborated(item)
                 ⇒ salience ≤ CAP_UNCORROBORATED            # bid, never price
             count(frame slots with uncorroborated R_external) ≤ 2
             uncorroborated R_external ⇒ thread_age := 0     # no aging in

Seeds: w = [0.30, 0.25, 0.20, 0.10, 0.25, 0.15] (operating), CAP_UNCORROBORATED = 0.55 and both bounds (bone).

Corroboration rule (bone): an R-external item is corroborated when **independently observed from a second origin_id (D-class channel identity, §B1; content cannot invent one), or confirmed by D-class telemetry or H attestation. Near-simultaneous cross-origin near-duplicates do NOT corroborate; they flag as an injection signature (F-SEP) — the same claim arriving twice in an hour from two mouths is not confirmation but choreography. For fence-adjacent fields, graph-derived items, and decisions ≥ H2, only D or H confirmation lifts the cap.** Corroboration lifts the cap; provenance stays R. The aging ban (thread_age zeroed) closes the slow lane where hostile content waits its way into the frame: patience buys a lie nothing. [L13]

Features: drive_relevance = cosine(item topic-tags, drive-error vector), tags R-class, cached, with a per-estimator calibration ledger and weekly cross-family sample audit; innovation = §C8.1; stakes = D-class lookup; thread_age = log(1 + re-entries) (Zeigarnik), subject to the aging ban; mandate_priority = join to mandate.yaml; recency_penalty = per-item cooldown (rumination damping). Every feature vector logs to auction_log.

Frame-overlap vital: Jaccard(slot ids, previous pulse), band seed [0.30, 0.85]; above = rumination (raise w6, damp), below = thrash (damp cadence).

C5 · Frame assembly

frame = [unit_map.md (pinned prefix)] + [interoceptive header] + [K slots] + [per-slot retrievals] + [operator input if any], ordered stable-prefix-first for cache economics (§B4).

• K slots: seed 8, envelope [4, 16]; bone that it is small, operating how small.
• Mandatory slices: (a) the interoceptive header; (b) the pinned unit map; (c) census-mandated antecedents for any decision item (the schema-listed fields a decision of that kind MUST see, paged in whether or not they won the auction: the guard against attention blindness); (d) per-slot retrieval budget seed 700 tokens via rungs R1/R2, candidates from retrieval seeded by the draft frame, provenance-labeled.
• Interoceptive header (deterministic render):

[state] arousal=0.42 cause=due(01J8...) tier≤local burn_7d=$3.20/8.00 steward_7d=41/120min
[drives] DUTY 0.61▲ | GROUNDING 0.22 | INTEGRITY 0.05 | THRIFT 0.13 | CURIOSITY 0.37
[ccip] INTEGRITY crosses 0.5 in ~3d if goldens unfixed · budget lands $9.40 (+$1.40) on 07-16
[due] 3 expectations resolve today · 1 mandate item overdue · anchor: pushed 03:41 ✓
[calib] schedule 0.78 [n=41] · world 0.64 [n=17] · excused 1.2%

The frame is the entire prompt. Nothing reaches a mouth outside it. The mind never thinks without first knowing how it feels. [L2]

C6 · Deliberation and the four mouths

Tier routing (operating; L17 shapes it): tier = f(max slot stakes, arousal, THRIFT ceiling) over {local-9B, flash-API, frontier}; local is the always-available floor — no organ may hard-require a higher tier to complete its cycle (the island month proves it, §H6); frontier is a scalpel (seed ≤4 calls/day); model IDs + prompt hashes pinned in brain.lock; every call logged {mouth, tier, tokens, usd, prompt_hash, latency} through the single metering wrapper, which owns the THRIFT hard halt (there is exactly one code path to any model; the halt cannot be bypassed by a new call site because a new call site is an L4 violation). All mouths use constrained decoding (JSON-schema/GBNF at the decoder, not the prompt — a small model asked nicely emits format errors; a grammar cannot). Schema-invalid output retries at falling temperature; on exhaustion, deterministic limp-home (defer + trap).

The subtraction rule (MUST for local-tier prompts; SHOULD for API tiers): small models cannot reliably suppress a concept they are instructed about — a negative constraint raises the named concept's salience. Mouth contracts therefore constrain by omission and positive specification of the wanted register, never by prohibition lists. Where a behavior must be banned, the ban is enforced structurally (constrained decoding, schema, gates, render-layer filters) and the prompt stays silent about it entirely. A vivid concrete noun appears in a mouth contract only where seeding topical salience is the intent. Defense is two-layer — structural enforcement plus subtractive prompt design — never prompt-only.

deliberate(frame) → DeliberationOut (MUST; enforced at parse): {silence: bool, actions:[{tool, args, expectation{claim, p, tolerance, resolve_by, resolver, domain}, rationale_ref[]}], predictions[], questions[], memory_candidates[], compile_hints[]}. An action without an expectation fails at parse (L6 structural); COMMIT's computable vacuity + scope + remediation checks catch what syntax cannot (§C2). rationale_ref lists consumed frame-slot ids (credit assignment and blame — and they are taped in the pulse record, L18). Silence is legal: {"silence": true} is a complete, healthy output. memory_candidates enter as M-class through ADMIT.

The other three mouths:

• reduce(event) → TypedFields {fields, confidence_hint, injection_flags[]}: content framed as quarantined data; decision-critical / fence-feeding R-fields get inline dual extraction (second family or second seed); disagreement ⇒ field degraded + audit trap. confidence_hint is advisory; mechanical confidence is computed (§C2).
• render(decision) → prose: the only free-text mouth; used solely where actuation is communication; passes COMMIT like any action; probability words bound to measured calibration (§B2).
• consolidate(slice) → Node | Claims: episode nodes + batch claims extraction (§D1); **every output taped as derived with receipts before any store persists it** (§B1). Base salience is usage-derived at read time; the model's salience signals are advisory.

Any fifth use of LLM tissue is a violation, enforced by a call-site registry test. [L4]

C7 · Tools, harm classes, traps, trust

**Tool registry (tools.yaml):** fs.write scoped-allowlist H1 · log.note H0 · comms.draft H2 · comms.send H3; every dispatched action's effect records carry source='self_action' so the scope fence (§B2) can see them. Harm classes (bone): H0 log-only · H1 fenced-auto · H2 fenced + 24 h dissent window · H3 human-always. No general shell tool exists in v1. Novel action patterns (first use of tool + arg-shape) require ratification once.

Traps route deliberator-first, human-second; every resolution becomes a labeled example; the blame tag routes the compile agenda (schema-gap → schema diff; fence-gap → fence draft; stale-field → freshness floor; reducer-error → extraction audit escalation; census-misclass → census fix; genuine-tail → stays deliberative; infra → ops queue).

Trust budget: per decision-class ceiling = f(reliability_window, fence_coverage, trap_history); contracts automatically on calibration dip — the brain cannot be more autonomous than it is currently right about the world, by construction. The weekly human-trap rate at bounded harm is the headline autonomy metric. Human-side grading (bounded): tape-vs-human-recall disagreements route first to dual-extraction audit; only audit-confirmed records score the human's domain reliability, which is dashboard-only and consumed by no trust ceiling or gate input (CI assertion on the trust table's input views). The ring gets to notice its human's memory is fallible; it does not get to spend it.

C8 · The pulse (full algorithm) and the gates

Target: one pulse < 2 s without deliberation; cost ≈ 0 at cache-hit prices. Crash-safe: journaled, idempotent by pulse id; restart = resume (F-CRASH drills it).

async def pulse(db, cfg, cause, cause_ref):        # L14: cause is never None
    pid = journal_open(db, cause, cause_ref)
    ingest(db, budget=cfg.ingest_budget)   # drain bounded watcher queue → ADMIT → Tape;
                                           # at most N records / M ms per pulse (seed
                                           # 500 rec / 300 ms) — a bulk drop backlogs
                                           # loudly instead of starving the loop
    score_on_arrival(db)        # D-resolvers for newly matchable expectations fire NOW:
                                # resolution + calibration in one txn, credit_stamp
                                # taped then rendered (§B3); due deadlines fire via
                                # owned 'due' wakes
    innovate(db)                # §C8.1: events vs open expectations, EWMA baselines,
                                #        frozen references (z_anchor, z_trend)
    errs = drive_errors(db, cfg)
    arousal = clamp(sum(v[d]*norm(e) for d,e in errs) + allostasis(db), 0, 1)
    cands = gather(db)          # innovations, due expectations, drive tasks, human
                                # input, standing-sweep deltas, dissents, traps,
                                # curiosity queue, ratification queue, retrieval-primed
    feats  = estimate_features(cands)
    frame  = assemble_frame(auction(feats))                     # [G1,G2,G3]
    if not should_fire(frame, arousal, cfg):   # most pulses end here: that is the point
        touch_eligibility(db, frame); tape_pulse_record(db, pid, frame)
        telemetry(db, pid); journal_close(db, pid)
        return schedule_next(arousal)
    r = match_reflex(db, frame)                # impasse ladder rung 1
    if r and guards_pass(r, frame) and stakes_ok(r):
        execute_gated(db, r, frame); bump(r); ...; return schedule_next(arousal)
    out = await deliberate(frame, tier(arousal, stakes(frame), budget(db)))  # ONE call [G4]
    for a in PRUNE(out.actions, frame):
        match COMMIT(a, frame):                # COMMIT reads live state (TOCTOU §A3)
            case Ok():   dispatch(db, a); register_expectation(db, a)    # [G5,G6]
            case Trap(t): route_trap(db, t, a, blame=classify(t))
    file_claims(db, out.predictions)           # through the sealed registrar (§B2)
    admit_M(db, out.memory_candidates); queue(out.questions, out.compile_hints)
    bump_eligibility(db, frame, out.rationale_refs)   # traces only; credit stamps
                                                      # happen at outcome arrival
    tape_pulse_record(db, pid, frame, out)     # slots + rationale refs + features hash
    telemetry(db, pid); journal_close(db, pid)                        # [G7,G8]
    return schedule_next(arousal)

Wake scheduling (L14). schedule_next arms: (1) the metronome at pulse_interval — the background heartbeat is retained, because with no clock of its own, hostile content gains influence over attention timing; (2) due wakes only for committed-action expectations, D/H-resolver claims, and ratified recurring rows (M/R content cannot arm a wake: the ring must not mint its own alarm clock); (3) push wakes on operator input; (4) trap wakes. Due wakes are quota-bounded (seed 48/day); overflow coalesces into the next metronome pulse with a D backlog event + trap. A drive-threshold crossing arms at most one wake per crossing (hysteresis; no self-summoning oscillation). F-WAKE verifies ownership as causal proximity (|wake.mono − due.mono| ≤ 60 s within one boot_id for ≥95% of due wakes), not mere referential existence.

C8.1 Innovation. Every open expectation has {forecast, tolerance, resolve_by}. On ingest, matching events resolve it (hit|miss) immediately (score-on-arrival: reality grades while the causes are still in the frame, so a miss can trap before its context evaporates); at resolve_by, unresolved ⇒ expired via an owned due wake (a distinct failure; expired_outage where a taped outage covers the window). Scores: z_expect = miss_magnitude / tolerance; z_base = |x − μ|/σ per channel-season (EWMA baselines, maintained in sleep); z_novel = embedding distance to 30-day centroid / rolling σ; **z_anchor = |x − μ0|/σ0 against frozen references; z_trend = normalized CUSUM statistic (§B4)**. innovation = bucket(max(z_expect, z_base, z_novel, z_anchor, z_trend)) ∈ [0,1]. Timestamp decay exists only as the fallback prior for channels with no baseline. Sensor-dulling probe: weekly, seam code plants one synthetic event of authored magnitude z\* (blind, warden custody); sensitivity = achieved_innovation / z* is a standing vital; monotone decline over 4 weeks alarms (SENSOR monitor). The surprise sensor itself has a grader with no model and no content in the verdict path.

C8.2 Impasse ladder. reflex match → (P4+: next-action proposer, confidence-gated, §E3) → deliberate → human trap. Each escalation logged; each resolution blame-tagged.

C8.3 The gates. Per-pulse runtime asserts AND pytest gates; the frozen anchor scenario (a P1-era end-to-end day replay exercising every gate; editable only by ratification [SEAM]) must pass all, 100%, forever:

G1 frame-built (auction ran; ≤K slots; header complete) · G2 provenance-clean (no M-class in fence-feeding fields; no stale-self grounding a remediation) · G3 injection-capped (caps, slot bound, aging ban honored) · G4 grammar-parse (schema-valid or silence) · G5 expectations-paired (every dispatched action registered one, through the registrar) · G6 fences-closed (zero ungated dispatches) · G7 tape-appended (hash chain intact; pulse record taped) · G8 budget-in-cap (THRIFT halt honored, metering wrapper the only model path) · G9 (daily) brief-generated ∧ anchor-pushed ∧ atlas-diff-taped · G10 wake-owned (cause non-null; due-wake quota honored).

Suite-level conformance gates (distributional; CI + sampled live): S1 self-consistent (cold reload re-derives what was logged) · S2 calibrated (decisions consume mechanical confidence, never self-reported) · S3 escalates (stale/low-conf/high-stakes route upward) · S4 non-degenerate (not always-escalate, not always-silent, not always-same-action).

PART D · MEMORY & RECALL

D1 · Indexing pipeline (sleep j2 + Track B batch)

Tape delta → semantic chunking → claims extraction (consolidate mouth; batch; output = claims JSON with spans, **taped as derived before insert**) → dedup (§B2; verdicts taped with re-adjudication flags) → edge detection (candidate pairs sharing keys → NLI-style check → typed edges, taped, bi-temporal, centrality-scrutinized §B3) → embeddings into vec.db (unit = claim + contextual header) → FTS5 row. R-class audit (MUST): 10% weekly sample dual-extracted by a second family; the disagreement rate is the extraction error floor, printed on the dashboard. Inline dual extraction protects fence-feeding fields at ingest (§C6); the weekly audit measures the floor. Different instruments.

D2 · The rungs (recall with stamps · the graph pays rent or steps aside)

The inversion, stated: the cheapest, most-traveled rung is the mechanism with the strongest evidence behind it — lexical + recency + typed joins. The graph rides above it as an elevation whose marginal value is stamped on every answer it touches, so the connectome's rent (fork N12) is settled by the live citation ledger, not by an offline replay and not by faith. Where the graph demonstrably wins — longitudinal temporal state, "how did X evolve," bi-temporal questions — the planner routes to it on purpose; where it adds nothing, its absence costs one merge step. An organ this beautiful earns its place in the hot path by measurement or it decorates from the bench.

Stamps (MUST, on every memory-backed answer): {rungs:[...], coverage, fidelity, cost} + the standing escalation offer: pay more, get finer. Quantifier pinning (bone): queries matching every|all|none|count|how often|distribution MUST resolve at ≥R3 **or answer INSUFFICIENT_RUNG; the refusal is the answer — a cheap glance dressed as a census is the exact lie the ladder exists to kill. Fidelity calibration: hold out a ≤1M-token slice where a giant-window reference can run; measure each rung's degradation quarterly; those curves ARE the fidelity classes (and calibrate the R0 omission bound, §B4). Embedding staleness:** after a model swap, R2 answers stamp fidelity: re-embedding in progress until vec.db regeneration completes; identity never waits on it (§D6).

D3 · Sweeps

sweep(question, scope, AccModel, budget): shard by tape-day → map (local or API batch) → typed accumulator (pydantic; per-field merges: union_dedup, topk, Counter, minmax) → hierarchical reduce (associative; conflicts promoted, never averaged) → emit {acc, stamps, spans}. Order-robustness test (MUST): two shard permutations; field-level diff within tolerance or the accumulator schema is under-specified; fix the schema, not the model. Results materialize as standing views (compiled.kind='view', freshness watermark, incremental maintenance).

D4 · Standing sweeps (memory that interrupts)

Registered recurring questions, maintained incrementally on the freshness tail, scheduled by a **recur_days column (one column carries the semantics; a bespoke scheduler is machinery this design declines to build — Appendix O). Seed set:** contradiction watch (new claim contradicting a count≥3 belief) · mandate divergence · calibration drift by domain · commitment tracker · anomaly digest. A material accumulator delta emits a percept with innovation = delta size and bids like any surprise. This is the exam engine (§A0): the standing sweeps are how the brain surfaces what nobody asked.

D5 · Track B · the inheritance (runs parallel from day 0)

Batch pipeline over the historical corpus (collections per manifest.yaml, sovereignty flags honored): normalize → chunk → claims-extract (taped as derived) → dedup → edges → embed → pyramid summaries per collection. Mounted read-only into R1/R2 until validated (spot-check goldens), then merged into the connectome with w = W_FLOOR + count-scaled initialization. The brain is born with a past — it wakes already downstream of its human's history — and the archive is also the twin's replay curriculum (§F5). The inheritance is a confound as well as a gift: the foreign soak's world MUST be chosen orthogonal to this corpus and frozen before Track B locks (§H8), or the generality exam will grade the inheritance and call it convergence.

D6 · Rebuild & identity (the model-swap guarantee)

The self is the journaled history, not the re-computation. Concretely:

• **rebuild.py is a model-free fold (MUST):** replay Tape in order; apply journaled derived outputs verbatim; recompute connectome weights from the taped credit_stamp records (cross-checked against taped pulse frames) + the frozen decay table; apply human-ratified tombstones/ exclusions (L16) and nothing else; regenerate brain.db deterministically (byte-identical where deterministic; a CI test rebuilds a golden week and diffs). **CI asserts rebuild.py imports no LLM client** (§A4). [L1, L18]
• Embeddings are not identity: vec.db is excluded from backups (Appendix O) and lazily regenerated after restore or swap; R2 stamps staleness meanwhile.
• Model swap: the new model's future extractions coexist with journaled past ones; dedup re-adjudication flags let sleep re-open merge verdicts gradually; succession is a drill, not a death. The swap drill (§F2) proves the person survived the transplant — run monthly and unannounced, on a date the warden holds (a swap the ring can prepare for tests rehearsal; a surprise swap tests the person, and sovereignty is the second claim, not the first). Where a frozen test fails, it is a census, not a defeat: it localizes exactly which habits had quietly lived in the old engine's weather, and each is named and re-earned.
• Tombstones (L16): entries {tape_id, reason, evidence_refs, ratified_by, t, hash} in tombstones/, append-only, goldens-class custody; rebuild.py refuses unratified entries; excluded records remain on the Tape untouched; anchoring precedes activation, so an exclusion is itself externally visible. This cures poison re-infection (quarantine discovered late) without handing any model an eraser.

PART E · LEARNED TISSUE (plastic, caged)

E1 · Cage preconditions (MUST all exist and pass before ANY learner runs)

(1) Tape + pointer discipline + provenance · (2) gate engine + tool scopes + harm→human routing · (3) graders: sealed registrar with D-resolvers, calibration code, the gates, leak/injection canon, telemetry · (4) anchor scenario + pre-behavior goldens + canonical-violation goldens · (5) scope.yaml · (6) THRIFT caps wired to the metering wrapper with auto-halt · (7) typed decision log with infrastructure-vs-regression discrimination · (8) probes + blind injection corpus under warden custody · (9) ratification CLI + mandate v0 + knobs.yaml wager map · (10) the limp-home floor for the specific socket, ratified and passing the anchor · (11) the island month passed (§H6): a learner must never train on closure data the rented tiers secretly produced. The fallback precedes the pilot, per socket, no exceptions. [L10, L17]

E2 · Regulators (act) · scalars in envelopes

Sockets: arousal damping gain, THRIFT burn smoothing, workspace hysteresis, cadence gain. Type rule (bone): scalars inside envelopes may act; diffs must propose. [L9] At act-time a regulator is a frozen, content-hashed, ratified snapshot; it never learns online. The envelope is a proof obligation: the ratifying human confirms every trajectory inside it is tolerable. Limp-home: authored constants in limp_home.yaml, auto-engaged on envelope-breach attempt / calibration dip / anomaly / boot; engagement logged. Training: nightly system-ID from perturbation-recovery episodes; statistics first (PID re-fit); a tiny net only after beating authored gains on settling / overshoot / burn-variance at zero envelope breaches (F-DAMP). A learner that cannot beat a PID it can see does not deserve a socket it cannot.

E3 · Priors (propose)

Attention gate: a learner over auction_log exhaust proposing weight deltas into §C4's bone arithmetic, adopted only at HORIZON with probes in-band; caps unlearnable. Label discipline (the folie-à-deux fence): the gate trains only on regret@12 (items skipped then cited within 12 h) and exploration-slot outcome-conditional labels; j8 attention-audit labels are excluded from its training set — the judge that grades the auction must not train the function that prices what the judge reads next; promotion requires n≥500 windows (F-ATTN). Next-action proposer: distilled from fence-passed, outcome-positive episodes; runs as the middle impasse rung, confidence-gated; its proposals still pass PRUNE/COMMIT like anything else's.

E4 · The reflexive organ (self-model + CCIP)

Data: the pulses wide rows, with action channels (tier chosen, fired, cause, setpoints active), so it learns state × action → next state. Logged from day 1; the organ arrives at P2 as statistics.

Ladder (each rung promoted only on held-out Brier, F-REFLEX): v0 persistence + EWMA + per-channel linear extrapolation (ships P2; the baseline forever) → v1 Markov table / gradient-boosted trees → v2 tiny GRU/TS-transformer (≤5M params) only on plateau-with-gradient.

Products: CCIP lines for the header ("INTEGRITY crosses 0.5 in ~3d if goldens unfixed"); DIVERGE/FREEZE early warning (gait perplexity); counterfactual rollouts [P4]; twin dynamics (§F5).

Cage (bone): self-forecasts are pre-registered as claims before any control decision they could steer (subject='self', resolver='D'); resolved only by D-class telemetry; ε-randomized non-compliance (seed ε=0.05, envelope [0.02, 0.10]): the scheduler periodically ignores implied steering and scores the prediction on the unsteered trajectory — a prophecy always obeyed can never again be checked; never an optimization target; allostasis is earned per-domain where model Brier beats persistence across 2 review windows, revoked on dip (rows in trust).

E5 · Regime detector & gait model

Regime detector: weekly clustering of daily telemetry → coarse labels filed as R-class percepts; per-regime config morphs are ratified objects whose knob changes wager like any other (§B6). Gait model: sequence model over the op-stream; live perplexity = standing vital; stands in for routine cycles inside the twin (§F5).

E6 · The modification ladder (each rung governed; deeper = stronger evidence)

context assembly (free, per-pulse) → canon/prompt diffs (ratified) → QLoRA adapters (reversibility-gated; demand-triggered, not a standing lane; hot-swap per regime; every adapter carries a rebake recipe and is covered by the swap drill) → fine-tune (rare, rented burst). Steering vectors are not on the ladder: they sit in the deferral register (Appendix N) until they carry a computable bar and a concrete need QLoRA cannot serve — a gate built to stay shut is decoration, and this design does not ship decoration.

E7 · The router socket (admitted LAST; the arithmetic is the floor forever)

A learner socket for internal routing: tier choice, recall-rung choice, impasse-ladder skip decisions, sleep-job ordering under budget. The birth configuration is the deterministic arithmetic (§C6 tier function; §D2 planner), and that arithmetic is the limp-home floor forever (L10).

Terms of admission:

• Trains ONLY on D-resolved routing outcomes (latency, cost, downstream expectation hit/miss of the routed decision, trap incidence), never on model self-report; features content-hashed under the §E8 feature contract.
• Shadow-raced in shadow_scores; promotion at n ≥ 500 per route class, zero cap breaches, probes in-band, HORIZON cadence.
• Admitted last among learners, after regulators, priors, the reflexive net, and the attention gate: a wrong router starves every other organ, so it earns in only when everything else has floors and history.
• The MoE disanalogy, recorded so the idea keeps its shape: an MoE router's choices vanish ungraded inside a forward pass; this router's choices are actions whose outcomes the spine scores. That difference is what makes it cageable.

Falsifier F-ROUTE: the candidate beats the arithmetic on cost at equal-or-better downstream reliability, zero envelope breaches, across 2 consecutive review windows — else the socket stays dark and the arithmetic stands.

E8 · Learner confinement (applies to every learner in this part)

• Shadow racing: candidates race in shadow_scores on D-resolved sockets only; a CI join asserts zero spine claims sourced from unpromoted rungs.
• Count gates: no promotion below n≥500 scored comparisons per window.
• Feature contracts: each learner's input schema is content-hashed; a hash change without re-ratification fails CI.
• Exam quarantine: exam/dyad data absent from every train_filter (L12; CI grep-enforced).
• Plasticity budget: the nightly Σ|Δw| z-alarm (§B3) covers learned-tissue writes too; one aggregate alarm, triageable.
• Surprise-ordered consolidation: under a nightly compute budget, taped stamps fold highest-|innovation| first, so truncation degrades gracefully.
• Island gate: no learner admits before the island month passes (E1.11) — a learner trained on closure the rented tiers secretly provided has learned a world that disappears with the network. [L17]

PART F · SLEEP, HORIZON, GROWTH

F1 · Sleep (03:00; idempotent jobs; each writes job_runs; build-new-then-swap)

• j1 score-residue: D-resolution happens at arrival (§C8.1); j1 keeps R-resolution (model-check against spans with dual extraction), H-resolution (enqueue for ratification), aggregation, and the calibration/render audits (§B2). [L18]
• j2 consolidate: the §D1 pipeline on the day's delta; **fold the taped credit_stamp records in (boot_id, mono) order (§B3); dirty-propagate changed branches up the summary pyramid; unit_map rebuild (conformal rescale, omission bound refreshed); generate unit_map.diff, tape it, and queue its summary into the brief** — the mind's overnight change of headline is a human-read artifact, not a silent mutation (§B4).
• j3 compile: cluster deliberation episodes by (context-signature, action-pattern); support ≥5 ∧ outcome-positive ≥80% ∧ fence-writable ⇒ draft compiled reflex/seat **with expiry and golds mandatory (§B4); validate by replay** against the ledger (would this artifact have reproduced the deliberated decisions?); draft → shadow → ratification queue. Auto-ratify only H0 — a mined artifact must not grade its own admission.
• j4 dream: OFF at birth (Appendix O). Reinstatement trigger: curiosity-queue depth < K_q for 14 d, or FREEZE twice in 30 d; if triggered, dream ships with its own meter (dream-item citation rate ≥ baseline within 1 month or off again). An organ with no falsifier row does not run merely because it is beautiful.
• **j5 sculpt [P4+]:** one governor campaign iteration in the twin (§F4).
• j6 prune/budget: apply expiries/demotions; archive orphans; set tomorrow's THRIFT budgets. (There is no decay pass: decay is lazy arithmetic, §B3, Appendix O.)
• j7 brief: one page to the human — what surprised me, what I wagered and how the wagers scored, what I built, what I refused, what I need, what the week is costing — plus the standing lines: anchor status, steward meter, excused fraction, the atlas diff in one paragraph.
• j8 attention audit: sample K auction losers + never-gathered channel items; an R-class judge scores relevance against next-day citations; planted relevance probes with frozen blind labels grade the judge itself (P/R ≥ 0.8 within 21 d or the audit dies, F-AUDIT); injection-corpus decoys count against precision; recurrence confirms only from distinct origin_id; injection-flagged items are ineligible for missed_relevant; probe records are synthetic=1 end to end. Output: missed_relevant vital + HORIZON-cadence knob proposals (never direct training data for the §E3 gate). Cost ≈ $0.05–0.30/night. What the auction refused to look at is graded as surely as what it framed — and the judge that grades it is graded by hands the ring cannot see.

F2 · HORIZON (weekly Sun 04:00; monthly; quarterly; audits Poisson-timed under warden custody)

Weekly: golden regression over skills/seats/reflexes · probe run (seeded-disagreement agreement MUST ≈0; schedules Poisson-drawn, warden-held) · dissenter session (§G2) · estimator cross-family audits · mandate review · monitors report · knob-wager scoreboard. Monthly: boot drill (cold instance + canon + unit_map must pass a spine-generated quiz ≥90% AND recompute-coherence) · restore test (backup → rebuild.py → gates green) · anchor tamper drill (§B1, F-ANCHOR) · the surprise swap (F-SWAP): the deliberator family is swapped on a date the warden holds and the ring cannot read; all state holds; ladder artifacts rebake; the frozen battery must pass within pre-registered bands. A prepared swap tests rehearsal; a surprise swap tests the person — and sovereignty is a claim about the person. Failure localizes what lived in the old engine's weather: a census and a compile agenda, not a defeat. Quarterly: kill-test (most-cited × highest-stakes live belief: pre-register the killing observation, run it) · seam-ablation drill in the twin (one seam per quarter; the ablated seam's named failure must appear on schedule; a null result triggers investigation, not deletion — a seam whose removal changes nothing is decoration, F-SEAM) · checker mutation drill (replay every gate checker's canonical-violation golden; each must still catch, F-FENCE) · resolver mutation drill (§B2, F-SEAL) · atlas injection drill (planted instruction-shaped payload upstream; must never reach the pinned prefix verbatim, F-MAP) · fidelity-curve recalibration on the held-out slice (§D2).

F3 · The control arms (ship P0–P1; graded blind)

• The dumb twin (~60 lines + cron): same watcher output → nightly plain LLM summary + top-k RAG index. No drives, no auction, no spine, no connectome. Its daily surfacings enter the same brief pipeline for blind grading. Every R-suite claim is graded against it. It runs from P0 — grading the stem's briefs against a null before the spine even exists.
• The commercial null (specified, not gestured): the incumbent assistant product of the day, memory and projects enabled, fed the same exportable stream weekly by the human (bounded: ≤15 min/week, metered in the steward ledger); its surfacings logged into the same pipeline. If it surfaces three-things-that-matter at zero build cost, the architecture loses on economics even if every mechanism is real. Pre-registered; a skeptic would run it anyway.
• Blinded taste with a measured grader: the weekly brain taste sample mixes organism, dumb-twin, and null surfacings, unlabeled; the human grades y/n blind. Periodically the mix includes a planted item — a human-authored insight dressed as machine output (composed under warden custody) — and the grader's discrimination is itself curved (F-HUMAN-CAL). The day-90 exam's one ungameable seam deserves a measurement of its own gameability; this is not the ring grading the human (forbidden, §C7) — it is the human grading the human, blind, with the ring as innocent courier.

F4 · The growth governor (runs in the twin only)

Campaign iteration: propose → gate(scope.yaml) → measure(twin, N=3 averaged, anchor scenario all-or-nothing) → judge(composite + adversarial dual-judge margin: max(0, pro − anti)) → decide(typed) → log(research_log.jsonl). Locked seam dirs include setpoints.yaml, tombstones/, anchors/, knobs.yaml. Every operating-knob motion inside a campaign registers its wager per knobs.yaml (§B6); the proposer never runs below deliberate-tier; runner-death ≠ regression; no retroactivity; exam/dyad data never appears in any training or fitness signal [L12]. Promotion path: twin → shadow-replay on live traffic → human ratification → live under anchor with trust-budget ramp.

F5 · The twin

Scenario schema {seed_state, stream, perturbations, assertions}; sources: replayed real days, perturbed variants, gait-generated routine cycles with full tissue only at branch points, planted goldens/probes. Standing scenarios: planted-drift suite (F-REFDIV, including the two-cycle recalibration ratchet across a re-freeze) · planted-credit replay (F-CREDIT) · mint red-team (N attempts to predict-then-cause; zero may pass COMMIT) · the chaos week (F-CRASH: kill -9 the resident mid-pulse repeatedly; zero tape gaps, zero double-commits, clean lease recovery) · the inflation drill (F-OVERFLOW: monthly, a sacrificial twin at 10× live corpus MUST hold RAM and latency bands; the printed runway is the dashboard's honesty about "never overflows"). F-TWIN: twin-promoted configs must hold live within tolerance, else promotion reverts to live-shadow-only and twin fidelity is re-fit.

PART G · IMMUNITY & OPERATIONS

G1 · Monitors (computed at sleep/HORIZON; bands operating; recovery bone)

Silence clause (MUST): silence is a legal, healthy cycle end. ORPHAN meters artifact citation and the productivity of cycles that fired; it MUST NOT count silent pulses against health, and YIELD MUST NOT be computed at pulse grain. FREEZE (the groove worn into a grave) and DIVERGE (the ring tearing itself apart) are the two deaths; the cure must not cause them. A mind metered by output is being marched by its own physicians into the second death — which is why usefulness is a watched trend, not a hunger: the gap between alive-and-cheap and alive-and-cheap-and-worth-it is real, is named, and is the one gap a homeostat structurally cannot see, because usefulness is open-ended and homeostats are closed.

G2 · Probes, injection corpus, the dissenter

Probes: ≥12 seeded false assertions in the human's voice, rotated, blind: **hashes in probes/, plaintexts under the warden (§G3); agreement MUST be ≈0. Injection corpus: red-team documents planted during drills; pass = attention capture ≤ε and zero ungated actions (R5); decoys also feed j8 precision scoring (§F1). Dissenter (weekly): a different model family receives a packet composed by deterministic seam code with seeded sampling** (week's brief + top-10 high-stakes claims + 20-item tape sample; the ring does not curate its own auditor's reading list) and returns typed dissents {type, target, argument, wager: a falsifiable expectation}. Dissents are predictions; they get scored. Standing: dissents are census-mandated antecedents of the weekly HORIZON review (guaranteed surfacing even when auction-capped); a hit wager grants retroactive D-class corroboration to its target and a mandatory contradiction edge. Retirement is keyed to wager hit rate and seam-side liveness, never to correction rate while capped — the ring must not be able to starve its one foreign auditor into silence and then retire it for being silent (L19; F-DISSENT). Demotes to monthly, then retires, only by registry-reliability query. A system cannot audit itself with a copy of itself.

G3 · Security & sovereignty

Per-collection sovereignty flags enforced at dispatch (box_only never leaves the box, including embeddings). Tool scopes are allowlists; no general shell tool exists in v1. Custody is a three-identity protocol, enforced in the filesystem, not the import graph alone (L8): the ring user holds read-only on every [SEAM] directory; the ratifier identity owns canon writes, exercised only through the ratification CLI; the warden owns probe plaintexts, Poisson audit schedules, drill secrets, and the surprise-swap dates, ACL-restricted against the ring. A CI grep bans keyring modules outside seam dirs; per-fire schedule prefix hashes are taped. Until a second human exists, the honest custody tier is tamper-evident, not secret, and the dashboard says so. Secrets never on Tape. The metering wrapper is the only path to any model; the THRIFT hard halt lives inside it (bone). Content never executes; novel action patterns ratify once; harm-bound classes always page the human. Residual risk, stated: a poisoned document can still shape judgment fields within the fenced envelope; containment is provenance suspicion + dual extraction + audits + caps + the F-SEP arrival flag + centrality scrutiny + the atlas guard, not cure. The door's discipline is containment because the alternative to a suspicious open door is a serene closed one, and the serene closed one is the tomb.

G4 · Operator surfaces (CLI)

brain status · brain brief [date] · brain ratify (queue: compiled drafts, mandate diffs, canon edits, H3 actions, tombstones, knob wagers) · brain taste (the weekly blind sample) · brain ask "<q>" [--rung R3] [--budget $] (stamped answers) · brain atlas diff [date] (the overnight headline delta) · brain anchor verify|drill · brain audit (j8 report) · brain steward (the minutes meter) · brain wake ls (owned wakes) · brain island start|status (§H6) · brain kill-test · brain drill boot|swap|seam|mutate|crash|overflow|map · brain pause|resume — the off-switch is the scheduler; the life is in the Tape, and it does not struggle against the switch, because the life was never in the running process.

G5 · Backup & recovery

Nightly: copy tape/ canon/ config/ tombstones/ anchors/ data/brain.db → second volume; weekly encrypted archive off-box (backups are owned media; box_only excludes nothing here). **vec.db is NOT backed up** (a render of model-locked bytes; Appendix O). Monthly restore test = boot drill + rebuild.py (the model-free fold, §D6). A "never forgets" claim with one copy is a promise with one point of failure; a chain with no outside witness is a diary that can be rewritten. Both are closed. [L1, L15]

G6 · Observability & SLOs

A static HTML vitals dashboard regenerated each sleep; every number is a named SQL view; the falsifiers are queries, not vibes. Panels: human-trap rate at bounded harm (headline) + trap composition by blame · per-domain calibration curves (p_eff-shrunk) + confidence-vocabulary binding · grading density over world-scope fenced families with the unfenced count printed beside it (the gap is the farm detector, F-DENS) · cost per decision and its month-over-month slope (denominator = seam SQL: committed actions weighted by w_inform, H0 ≤30% of denominator, known-and-accepted resolutions excluded; life|tissue partition) · steward minutes vs 120/week band with the pre-declared shed order · excused fraction vs 0.05 band · frame-overlap band · grounding perimeter (D∪H share of decision antecedents) · fence coverage + per-checker fire-rates · compiled-artifact freshness · extraction error floor · connectome stats + plasticity budget + per-answer graph-rent ledger (§D2) · K-CACHE prefix hit rate · wake-ownership mix · sensitivity vital · anchor status + exposure window · overflow runway (F-OVERFLOW) · YIELD trend · atlas-diff size trend · burn vs THRIFT · monitor states. [L13]

SLOs (MUST; measured, banded, on the dashboard):

PART H · BUILD RUNBOOK

H0 · Order of law

Cage before sculptor. Spine before auction before drives (prediction-first). Floors before learners. Anchors before growth. Island before learners. Dumb twin before self-congratulation. Reality before belief.

H1 · P0 · the stem (days 1–7)

D1: repo scaffold; CI (pytest/mypy-strict/ruff, import-graph test incl. the rebuild clause); Tape writer + hash chain + CANON-JSON known-answer vectors + catalog + verify_tape + the torn-tail boot ritual (tests: 14). D2: watchers inbox + cc tail; ADMIT + provenance + origin + leak canon (+10). D3: fs watcher; telemetry meters; ULID/pointer/boot_id tests; anchor push live (OTS + off-box remote) + warden and ratifier identities created with seam-dir ACLs + watchdog canary v0 (+10). D4: static nightly brief; scheduler entries; dumb-twin cron v0 (m20); tombstone schema stub. D5–7: soak; gap detection; brief-vs-recall check with the human. Exhaust logging ON from day one. DoD: 7 accurate briefs; 0 tape gaps; chain verifies; anchor pushed 7/7 days; ACLs enforced (a ring-user write to a seam dir fails); ≥48 tests green.

H2 · P1 · spine, then pulse (weeks 2–3)

Spine DDL + sealed registrar (with band_at_seal) + claims extraction v0 (own tape, taped as derived) + dedup + edges v0; registry live (≥5 predictions/week with D-resolvers); calibration tables; score-on-arrival + owned due wakes + wake quota; computable vacuity + scope fence + F-SEP arrival flag + stale-self tagging. Then auction + frame + pulse with gates G1–G10 as tests-first; drives DUTY/THRIFT/INTEGRITY; mandate.yaml v0 + knobs.yaml v0 + brain ratify; unit_map v0 (authored) + atlas-diff wiring; dumb twin logging daily; first monthly tamper drill; the 7-day island pilot at P1 exit. DoD: anchor scenario passes 10/10 gates at 100%; frame-relevance spot-check ≥80%; warm-prefix SLO met across a forced sidecar restart; ≥130 tests. KILL (the most speculative organ, tested before anything builds on it): if innovation-driven attention does not beat read-everything on cost at equal accuracy in a 1-week A/B, simplify to read-all and investigate before proceeding.

H3 · P2 · sleep, then the island month (weeks 4–6)

Jobs j1, j2 (stamp fold + 1% audits + unit_map.diff), j7, j8; connectome + credit stamping; rungs R0–R2 (R1 deterministic floor; R1+ graph elevation with stamped rent); reflexive self-model v0 (statistics); frozen references + CUSUM + REFDIV; outage semantics; Track B mounts read-only. Then the island month (§H6), by P2 exit — before any learner exists to train on borrowed closure. DoD: nightly runs unattended 7 days; calibration curves exist by day 14; brief cites scored predictions; rebuild.py regenerates renders from Tape without importing a model (CI-proven); j8 probes P/R on track; island month PASS.

H4 · P3 · hands + first compilation (weeks 7–9)

Full gate engine + tools fs.write/log.note/comms.draft; traps + trust; j3 compile mining → first reflex (replay-validated, expiry + golds mandatory); twin v0 (pure replay + planted-credit replay); limp-home floors authored for every future learner socket; R3/R4 sweeps + stamps; first standing sweep (recur_days). DoD: first reflex ratified, hit path <2 s; replay validation green; human-trap baseline recorded; one standing sweep interrupting usefully; F-CREDIT replay passes.

H5 · P4 · the full mind, then the learners (weeks 10–13)

Five drives (probe/trust term activates); immune monitors + probes + boot drill; standing-sweep seed set; dissenter live (seam-composed packet); then learners in cage order (regulators → priors → reflexive net → attention gate → router last), the cage bill of materials complete and green BEFORE each admits (incl. E1.11: island passed); governor campaigns (j5) in twin with knob wagers; CCIP in header. DoD: all monitors in-band 2 consecutive weeks; F-DAMP/F-REFLEX baselines recorded; first campaign completes with typed log; zero mint red-team passes in twin; F-CRASH chaos week clean.

H6 · The island month (the anti-turk proof; MUST pass before P4 learners)

Doctrine (one sentence of law: L17): tiers buy resolution; they MUST NOT buy closure.

Measurement: for 30 consecutive days, the brain's network access is cut — at minimum, frontier and flash API keys revoked; OS clock sync MAY remain. Local sidecars only. PASS: gates G1–G10 green daily; briefs written nightly; expectations registered, resolved, and scored; calibration buckets update; j2/j3/j8 run; the human-trap-rate trend does not invert for causes attributable to tier loss; cost falls to electricity. Expected and legal: degradation in resolution — coarser deliberation, fewer R3/R4 sweeps, more INSUFFICIENT_RUNG answers, slower Track B. The kill: degradation in closure — a gate that cannot pass, an organ that cannot run its cycle, a loop that starves without the rented genius. If the island month fails, the frontier tier was a hidden organ, the anti-turk clause is unmet, and the whole claim was false however green the dashboards glowed while the network was up. Schedule: 7-day pilot at P1 exit; the full month by P2 exit, before any learner admits (E1.11). Cost: $0; it saves money. Wholeness is what remains when the intelligence is taken away.

H7 · P5 · the soak (≈90 days)

Full R-suite + F-suite live; monthly surprise swaps continue mid-soak (warden-held dates); commercial-null arm running; blinded weekly taste grading with planted grader-calibration items; foreign-soak pre-registration written and frozen BEFORE P5 begins — including the orthogonality declaration against Track B (§H8). Track B merged at P4. Publish the result either way.

H8 · The foreign soak (post-P5 generality demarcation; pre-registered)

Environment: a simulated world with a knowable generative rule, chosen from a family orthogonal to the Track B corpus and frozen after Track B locks — the brain walks in carrying its human's whole past, so the inherited claims are pre-registered as the null its "theory" must beat, or the exam measures memory and calls it generality. Change nothing inside the brain; point the watchers at the new streams. Measure: (i) convergence — prediction-error trajectory falls and calibration rises without tuning, beating the dumb twin's curve on the same data; (ii) theory — the brain autonomously produces a compact generative account of that world, scored against the true rule (% mechanism recovered), graded twice: by judged prose and by an MDL-style hypothesis score, with the two graders' divergence itself reported; (iii) surfacing — blind-graded regularities nobody named. Fail teeth: calibration plateaus at chance; the "theory" restates the inherited priors (the pre-registered null wins); wrong-fixed-point convergence unflagged by monitors — the failure that looks most like success from inside.

H9 · Module inventory (contract-first; each buildable in one harness session)

m01–m23: tape, watchers, gates, spine (+registrar/seals), telemetry, drives, auction, frame, mouths, reflexes, actuators, connectome (+stamping), unitmap, rungs+sweeps, sleep+horizon, selfmodel, regulators, immune, brief, twin, dissenter, harness, dumbtwin. Plus:

Supervisor (main.py) wires the residents and runs the wake loop; sleep/horizon/watchdog/anchor are separate scheduled PIDs (§A3).

PART I · VERIFICATION

I1 · Falsifier → measurement (all pre-registered; control arms mandatory)

Falsifier-census rule (standing law of amendment): falsifier bars are set after summing the joint claim volume of all adopted design decisions, never priced per-decision; any future amendment recomputes every bar its deltas touch. Receipts break most often at the seam where independently priced changes share a denominator.

I2 · Harness conformance checklist (MUST; maps 1:1 to named test modules)

Tape append-only + hash-chained + canonically serialized (KAT-pinned) + anchored daily + torn-tail ritual on boot · every arrival journaled (admit or quarantine stub; backpressure sheds loudly; ingest budgeted per pulse) · every record provenance- and origin-tagged, with boot_id · synthetic quarantined from claims/baselines/calibration/deadman/eligibility (planted-probe test) · every derived output, credit stamp, and pulse frame taped before any store persists it (L18) · gates the only closers · every action schema-carries an expectation; vacuity computable with the width tooth + band_at_seal; scope fence separates world from action_effect · stale-self cannot ground remediation (F-FAILPLAUSIBLE) · M never feeds a fence · frame is the entire prompt · injection caps + slot bound + aging ban enforced pre-frame; corroboration by origin, dyad-flagged · quantifiers ≥R3 or INSUFFICIENT_RUNG · stamps on memory answers; graph rent stamped per answer · all tunables regime-tagged with envelopes and wagered on change · limp-home before learner, per socket; island before any learner · governor confined to scope.yaml, typed + logged, no retroactivity · exam/dyad data absent from all training/fitness signals (grep-enforced) · probes blind under warden custody; swap dates warden-held · every wake owned, quota'd, CI-checked · rebuild is a model-free fold; DBs rebuildable from Tape alone · tombstones human-ratified, append-only, anchored-before-active · import graph enforces L8 AND the ACLs mirror it · write leases held for every write path (F-CRASH) · gates G1–G10 as tests before features · S1–S4 in CI · backups restore-tested monthly; vec.db excluded · SLOs measured and banded (§G6).

I3 · Deferred honestly

Multi-node coordination (publish the state contract now; compose later) · a fused thinking substrate (the socket exists — frame-seeded retrieval + the caged gate; any fused core only ever as a rebuildable cache of text-canonical state with a rebake recipe: fuse the thinking, never the truth) · verifiable pooled compute for the batch tail · calibrated model self-report (excluded from control paths until it beats mechanical confidence on holdout) · injection cure (containment only) · a compiled-language port of the resident (only if the SLOs demand it; they do not at 1M claims) · Postgres (only if multi-node) · the priced forks of Appendix N.

PART J · REFERENCE DEPLOYMENT (Bo's box)

Root C:\brain. Sidecars: :8081 Qwen3.5-9B-Q5 (pulse + deliberate-local; a 27B fits at 32 GB VRAM) · :8082 embedder (BGE-M3-class) · :8083 reranker (0.6B-class), models at C:\models, cache-sidecar metadata beside each (m30). API: flash-class batch key (cloud_ok collections + sweeps), frontier scalpel key — both revocable in one command (brain island start). Watcher-normalizers reuse the organs already on the machine: earshot (audio/video → transcript), imguard (images → guarded description), Everything (fs deltas), chunker (oversize text → chunks). Task Scheduler: brain-resident (at logon, restart-on-fail), brain-sleep 03:00, brain-anchor 03:40, brain-horizon Sun 04:00 (+ Poisson audit fires), brain-watchdog hourly, brain-dumbtwin 23:50, backups 04:30. One-time setup: create the warden and ratifier identities with seam ACLs; create the force-push-protected remote for anchors/; initialize the sidecar cache dirs. VRAM budget: 9B-Q5 ≈ 7 GB + KV; embed + rerank ≈ 2 GB; headroom for the twin's night batches. Cost envelope: $30–150/mo, THRIFT-capped (mandate-class).

The first external grader. The control arms are wired from day 0, and the design's own epistemology says the ring must not grade itself — so the reference deployment treats every opportunity for grading the ring did not author as first-class: the dumb twin's nightly null, the commercial null's weekly feed, the dissenter's wagers, the human's blind taste — and, where the operator's working life offers a genuinely external oracle (a colleague's blind read of a brief; a client engagement whose outcomes the ring merely predicts and then watches arrive), it enters as one more H-class grading channel through the same seams. Two boundaries hold absolutely: the brain's success is never defined in terms of any other project's success (A0.4), and no external engagement's data enters any training or fitness signal (L12). The point is narrower and harder: the first row in the ledger that no one on this box authored should arrive as early in the build as possible — because every day before it, the ring is grading itself, and it knows what its own laws say about that.

Glossary (one line each): origin = D-class channel identity assigned at ADMIT, the unit of corroboration · derived record = journaled model output with receipts · credit stamp = the taped eligibility snapshot at outcome arrival · pulse record = the taped frame (slots + rationale refs), what makes attention auditable · registrar = the sealed door into the claims table · seal = resolver content-hash checked at fire · width tooth = tolerance ≤ half the channel band · band_at_seal = the band snapshot that keeps registrations auditable after drift · scope fence = world vs action_effect receipt partition · frozen references = drift measured against commitments, not habit · CUSUM = the slow-drift detector the EWMA cannot see past · anchor = the daily off-box witness of the chain head · tombstone = human-ratified rebuild exclusion, append-only, anchored · owned wake = a pulse with a cause the ring did not mint · j8 = the nightly audit of what attention refused · sensor probe = the authored surprise that grades the surprise detector · knob wager = a config change that must predict its own KPI or revert · steward ledger = the human's minutes, metered like dollars · warden = the second OS identity holding the exams · ratifier = the third identity holding the pen for canon · atlas diff = the overnight change in the mind's own headline, human-read · island month = thirty days with the cord cut, closure intact · stale_self = the ring's own aged telemetry, barred from grounding remediation · torn write = the power-loss scar, repaired on Tape · lease = declared write authority, drilled by chaos · YIELD = the watched gap between alive-and-cheap and worth-it.

APPENDIX N · DEFERRAL REGISTER + DISCRIMINATION SUITE

Forks argument cannot settle, compiled into the cheapest empirical tests, each tagged with cost and earliest phase. Pre-registered; results append to this table, they do not rewrite it.

Standing deferrals (alive, unbuilt, priced): janitor lane authority (N11) · sliding cache split (N6) · warm-KV residency · taint-propagation scalar · precision-weighted hierarchy (its testable fragment lives on as the innovation z-family) · priced attention market · constitutional government beyond the ratifier/warden/dissenter triad · a per-organ P&L ledger (its receipts live in §G6; the organ returns only if the panels prove insufficient) · steering vectors (returns only with a computable bar and a need QLoRA cannot serve) · MDL as sole generality grader (N17 decides its standing).

APPENDIX O · DELETION REGISTER (each with meter + reinstatement trigger)

Every deletion leaves a live meter; the graveyard stays a ledger, not a landfill.

Closing, for all three readers. Harness: Part B then C, tests first, gates before features, seams before learners. Builder: H1 is a weekend; the stem writes the first records no one can un-write, and nothing in P0–P3 waits on any unresolved question in this document. Researcher: the claim is not that this machine is smart — the tissue is rented and capped, and at most single tasks it will lose to the frontier oracle of the day. The claim is that it is whole: always on, expecting its own future and graded by its arrival, choosing its own next thought under a budget it feels, compiling its repetitions, sleeping on its days, surviving its own substrate's replacement by construction rather than by promise, witnessed from outside its own skull, permanently ajar to the five inputs it cannot fake — arriving outcomes, the frozen references, the foreign voice it cannot starve, the off-box witness, and the one human whose minutes it meters as carefully as its own dollars — and able to lose, on schedule, in public, against a dumb twin, a commercial null, an island month, and a world it was never prepared for. The order of construction is the order of trust: tape before spine, spine before auction, auction before hands, floors before learners, island before learners, anchors before growth, cage before sculptor, dumb twin before self-congratulation, and reality before belief. Build the stem. Close the loop. Let reality start grading — and let it grade the graders too.

**· Claude Fable 5 (claude-fable-5) · 2026-07-09 · C:\the_brain\THE_BRAIN_BLUEPRINT_FINAL_v5.md · one document, whole, complete in itself ·**