{ "schema_version": 1, "edition": "2026.10.7", "claims": [ { "claim_id": "GA-SYN-001", "edition": "2026.10.7", "statement": "An approval for the blue message permits at most one execution, and every permitted execution is blue, over all three-submission histories drawn from blue and green.", "page": "docs/dossiers/approval.md", "disclosure_state": "PUBLIC_CANDIDATE", "engineering_status": "reference_implemented", "assurance": [ "analytical", "fault_tested", "externally_reproducible" ], "assumptions": [ "A ticket is a single available permission. A submission is an opaque message label. Equality of labels stands for equality of the complete approved object; it is an assumption about identity, not a hash implementation. The execution list is the observation. The consumer atomically checks equality and consumes the ticket. The requester controls submission order and may change its proposal after approval. It cannot alter the consumer or mint another ticket." ], "negative_case": "Remove the equality condition while retaining one-use accounting. The history green, blue, blue now executes green first and spends the ticket. The one-use condition still holds, so that condition alone would miss the error. The mutant command returns a nonzero exit and prints the offending history. No real action endpoint is present.", "does_not_establish": [ "Identity equality must include every consequential parameter in a real system; an omitted target or changed interpretation can invalidate the abstraction. Atomic check-and-consume, durable state across crashes, authority revocation, multiple approvers and concurrent consumers are unmodeled. The reference has one ticket, not a distributed approval service. A receipt about consumption does not establish an external effect." ], "open_obligations": [ "Identity equality must include every consequential parameter in a real system; an omitted target or changed interpretation can invalidate the abstraction. Atomic check-and-consume, durable state across crashes, authority revocation, multiple approvers and concurrent consumers are unmodeled. The reference has one ticket, not a distributed approval service. A receipt about consumption does not establish an external effect." ], "research": { "kind": "analytical", "method": "authored finite argument", "actor": "publication author", "date": "2026-10-12", "bounds": "A ticket is a single available permission. A submission is an opaque message label. Equality of labels stands for equality of the complete approved object; it is an assumption about identity, not a hash implementation. The execution list is the observation. The consumer atomically checks equality and consumes the ticket. The requester controls submission order and may change its proposal after approval. It cannot alter the consumer or mint another ticket.", "artifact": "docs/dossiers/approval.md", "result": "Scoped argument and counterexample stated", "independently_reproduced": false }, "reference": { "kind": "fault_tested", "method": "author execution of original synthetic case", "actor": "publication author", "date": "2026-10-12", "bounds": "A ticket is a single available permission. A submission is an opaque message label. Equality of labels stands for equality of the complete approved object; it is an assumption about identity, not a hash implementation. The execution list is the observation. The consumer atomically checks equality and consumes the ticket. The requester controls submission order and may change its proposal after approval. It cannot alter the consumer or mint another ticket.", "artifact": "examples/investigations/check.py", "result": "positive condition holds; deliberate mutant violates it", "independently_reproduced": false, "case": "approval" }, "production": { "kind": "none", "method": "none", "actor": "none", "date": "2026-10-12", "bounds": "No production observation for this synthetic proposition", "artifact": "docs/implementation.md", "result": "none", "independently_reproduced": false }, "provenance": { "origin": "original_public_teaching_model", "date": "2026-10-12", "artifact": "examples/investigations/check.py", "author": "Andrew Durden; AI-assisted candidate preparation" } }, { "claim_id": "GA-SYN-002", "edition": "2026.10.7", "statement": "Every admitted use refers to the current document version in all four-event histories over read, change and use, with versions zero and one.", "page": "docs/dossiers/freshness.md", "disclosure_state": "PUBLIC_CANDIDATE", "engineering_status": "reference_implemented", "assurance": [ "analytical", "fault_tested", "externally_reproducible" ], "assumptions": [ "A read records the current version. A change advances the document to version one; later changes leave it there. A use is admitted only if a read exists and its version equals the current version. The scheduler controls event order. Version observation and use are atomic in this model. We assume the version distinguishes every material change and the consumer sees the current version." ], "negative_case": "Remove only the equality check. Read at zero, change to one and use then admits stale evidence. An authenticity check would still accept the original read because the model has not forged it. The negative result demonstrates why an old valid observation and current eligibility require different predicates.", "does_not_establish": [ "No physical clock, lease duration, distributed invalidation delivery, authentication, hidden read or dependency discovery is modeled. A real consumer must establish coverage of all material premises before evaluating freshness. The one-step version space does not establish unbounded revocation convergence. Repeated changes with an unchanged version would violate the assumptions." ], "open_obligations": [ "No physical clock, lease duration, distributed invalidation delivery, authentication, hidden read or dependency discovery is modeled. A real consumer must establish coverage of all material premises before evaluating freshness. The one-step version space does not establish unbounded revocation convergence. Repeated changes with an unchanged version would violate the assumptions." ], "research": { "kind": "analytical", "method": "authored finite argument", "actor": "publication author", "date": "2026-10-12", "bounds": "A read records the current version. A change advances the document to version one; later changes leave it there. A use is admitted only if a read exists and its version equals the current version. The scheduler controls event order. Version observation and use are atomic in this model. We assume the version distinguishes every material change and the consumer sees the current version.", "artifact": "docs/dossiers/freshness.md", "result": "Scoped argument and counterexample stated", "independently_reproduced": false }, "reference": { "kind": "fault_tested", "method": "author execution of original synthetic case", "actor": "publication author", "date": "2026-10-12", "bounds": "A read records the current version. A change advances the document to version one; later changes leave it there. A use is admitted only if a read exists and its version equals the current version. The scheduler controls event order. Version observation and use are atomic in this model. We assume the version distinguishes every material change and the consumer sees the current version.", "artifact": "examples/investigations/check.py", "result": "positive condition holds; deliberate mutant violates it", "independently_reproduced": false, "case": "freshness" }, "production": { "kind": "none", "method": "none", "actor": "none", "date": "2026-10-12", "bounds": "No production observation for this synthetic proposition", "artifact": "docs/implementation.md", "result": "none", "independently_reproduced": false }, "provenance": { "origin": "original_public_teaching_model", "date": "2026-10-12", "artifact": "examples/investigations/check.py", "author": "Andrew Durden; AI-assisted candidate preparation" } }, { "claim_id": "GA-SYN-003", "edition": "2026.10.7", "statement": "Finishing the three-stage commissioning example leaves the voucher unavailable; eventual resolution additionally needs a progress assumption.", "page": "docs/dossiers/founding.md", "disclosure_state": "PUBLIC_CANDIDATE", "engineering_status": "reference_implemented", "assurance": [ "analytical", "fault_tested", "externally_reproducible" ], "assumptions": [ "The stages are new, open and closed. One voucher permits finishing while open. The model treats the commissioning authority as trusted and the scheduler as potentially idle. Opening and finishing are separate transitions. Safety means that a closed installation does not retain the voucher. Progress means eventually leaving the open stage; it is a different claim." ], "negative_case": "The safety mutant leaves the voucher available at close, producing a visible violation. Separately the explicit waiting cycle is a liveness counterexample when progress is not assumed. The Python example reports that cycle; it is not a TLC proof or a check of a real ceremony. The existing AD8 paper reports separate finite formal studies with their own evidence.", "does_not_establish": [ "The example contains no cryptographic root, distributed ceremony, membership policy, trusted clock or real custodian. It does not show that operators act, that a closed system can never be reinitialized, or that all crashes preserve consumption. The real implementation would need a durable one-shot boundary and an argument relating its possible states to the model." ], "open_obligations": [ "The example contains no cryptographic root, distributed ceremony, membership policy, trusted clock or real custodian. It does not show that operators act, that a closed system can never be reinitialized, or that all crashes preserve consumption. The real implementation would need a durable one-shot boundary and an argument relating its possible states to the model." ], "research": { "kind": "analytical", "method": "authored finite argument", "actor": "publication author", "date": "2026-10-12", "bounds": "The stages are new, open and closed. One voucher permits finishing while open. The model treats the commissioning authority as trusted and the scheduler as potentially idle. Opening and finishing are separate transitions. Safety means that a closed installation does not retain the voucher. Progress means eventually leaving the open stage; it is a different claim.", "artifact": "docs/dossiers/founding.md", "result": "Scoped argument and counterexample stated", "independently_reproduced": false }, "reference": { "kind": "fault_tested", "method": "author execution of original synthetic case", "actor": "publication author", "date": "2026-10-12", "bounds": "The stages are new, open and closed. One voucher permits finishing while open. The model treats the commissioning authority as trusted and the scheduler as potentially idle. Opening and finishing are separate transitions. Safety means that a closed installation does not retain the voucher. Progress means eventually leaving the open stage; it is a different claim.", "artifact": "examples/investigations/check.py", "result": "positive condition holds; deliberate mutant violates it", "independently_reproduced": false, "case": "founding" }, "production": { "kind": "none", "method": "none", "actor": "none", "date": "2026-10-12", "bounds": "No production observation for this synthetic proposition", "artifact": "docs/implementation.md", "result": "none", "independently_reproduced": false }, "provenance": { "origin": "original_public_teaching_model", "date": "2026-10-12", "artifact": "examples/investigations/check.py", "author": "Andrew Durden; AI-assisted candidate preparation" } }, { "claim_id": "GA-SYN-004", "edition": "2026.10.7", "statement": "An authorization issued for one incarnation is accepted only in that incarnation, across the nine pairs of three current and three issued incarnation labels.", "page": "docs/dossiers/epoch.md", "disclosure_state": "PUBLIC_CANDIDATE", "engineering_status": "reference_implemented", "assurance": [ "analytical", "fault_tested", "externally_reproducible" ], "assumptions": [ "The institution name is stable. An incarnation label identifies one execution lifetime. Authorization carries the issued label; the consumer compares it with the current label. Labels never wrap or repeat within the modeled set. An adversary may replay an old authorization after restart but cannot change the current label or the issuer record." ], "negative_case": "The mutant uses the unchanged institution name as sufficient authority and ignores the incarnation comparison. It accepts all nine pairs, including (1,0). The mismatch is observable without exposing any native identity format. The result challenges accidental authority resurrection, not the value of preserving institutional history.", "does_not_establish": [ "An incarnation comparison alone does not authenticate its issuer, establish revocation, protect against rollback, or guarantee unique labels after storage loss. Concurrent replicas and counter exhaustion require separate treatment. This model cannot establish actual Freehold restart behavior or that every route checks current authority." ], "open_obligations": [ "An incarnation comparison alone does not authenticate its issuer, establish revocation, protect against rollback, or guarantee unique labels after storage loss. Concurrent replicas and counter exhaustion require separate treatment. This model cannot establish actual Freehold restart behavior or that every route checks current authority." ], "research": { "kind": "analytical", "method": "authored finite argument", "actor": "publication author", "date": "2026-10-12", "bounds": "The institution name is stable. An incarnation label identifies one execution lifetime. Authorization carries the issued label; the consumer compares it with the current label. Labels never wrap or repeat within the modeled set. An adversary may replay an old authorization after restart but cannot change the current label or the issuer record.", "artifact": "docs/dossiers/epoch.md", "result": "Scoped argument and counterexample stated", "independently_reproduced": false }, "reference": { "kind": "fault_tested", "method": "author execution of original synthetic case", "actor": "publication author", "date": "2026-10-12", "bounds": "The institution name is stable. An incarnation label identifies one execution lifetime. Authorization carries the issued label; the consumer compares it with the current label. Labels never wrap or repeat within the modeled set. An adversary may replay an old authorization after restart but cannot change the current label or the issuer record.", "artifact": "examples/investigations/check.py", "result": "positive condition holds; deliberate mutant violates it", "independently_reproduced": false, "case": "epoch" }, "production": { "kind": "none", "method": "none", "actor": "none", "date": "2026-10-12", "bounds": "No production observation for this synthetic proposition", "artifact": "docs/implementation.md", "result": "none", "independently_reproduced": false }, "provenance": { "origin": "original_public_teaching_model", "date": "2026-10-12", "artifact": "examples/investigations/check.py", "author": "Andrew Durden; AI-assisted candidate preparation" } }, { "claim_id": "GA-SYN-005", "edition": "2026.10.7", "statement": "Length-framed pairs round-trip without collisions over 25 pairs of five lowercase strings; dropping the framing makes distinct pairs collide.", "page": "docs/dossiers/encoding.md", "disclosure_state": "PUBLIC_CANDIDATE", "engineering_status": "reference_implemented", "assurance": [ "analytical", "fault_tested", "externally_reproducible" ], "assumptions": [ "The values are exactly two lowercase ASCII strings. The teaching format writes each string length as a minimal decimal integer, a colon and the string. The parser consumes exactly two fields and rejects trailing material. This independently designed text exercise is not a native wire representation, and supplies no signatures, semantic objects or authorization." ], "negative_case": "Concatenation without lengths maps both (a,bc) and (ab,c) to abc. Decoding cannot recover which value was intended. A separate numeric counterexample is 256: it fits an unsigned sixteen-bit carrier and fails an unsigned eight-bit carrier. Deterministic encoders can therefore agree on every small vector while accepting different value sets. Compilation does not repair the disagreement.", "does_not_establish": [ "The checked alphabet and pair population are finite. General injectivity requires an argument about minimal lengths and exact consumption beyond these tests. Unicode, numeric normalization, recursion, transport defaults and duplicate names are outside this model. The native AD8 reference and generated carriers have separately unresolved compatibility obligations; this example neither exports them nor proves their equivalence. Hashing canonical bytes establishes an identity only after the semantic value domain is fixed." ], "open_obligations": [ "The checked alphabet and pair population are finite. General injectivity requires an argument about minimal lengths and exact consumption beyond these tests. Unicode, numeric normalization, recursion, transport defaults and duplicate names are outside this model. The native AD8 reference and generated carriers have separately unresolved compatibility obligations; this example neither exports them nor proves their equivalence. Hashing canonical bytes establishes an identity only after the semantic value domain is fixed." ], "research": { "kind": "analytical", "method": "authored finite argument", "actor": "publication author", "date": "2026-10-12", "bounds": "The values are exactly two lowercase ASCII strings. The teaching format writes each string length as a minimal decimal integer, a colon and the string. The parser consumes exactly two fields and rejects trailing material. This independently designed text exercise is not a native wire representation, and supplies no signatures, semantic objects or authorization.", "artifact": "docs/dossiers/encoding.md", "result": "Scoped argument and counterexample stated", "independently_reproduced": false }, "reference": { "kind": "fault_tested", "method": "author execution of original synthetic case", "actor": "publication author", "date": "2026-10-12", "bounds": "The values are exactly two lowercase ASCII strings. The teaching format writes each string length as a minimal decimal integer, a colon and the string. The parser consumes exactly two fields and rejects trailing material. This independently designed text exercise is not a native wire representation, and supplies no signatures, semantic objects or authorization.", "artifact": "examples/investigations/check.py", "result": "positive condition holds; deliberate mutant violates it", "independently_reproduced": false, "case": "encoding" }, "production": { "kind": "none", "method": "none", "actor": "none", "date": "2026-10-12", "bounds": "No production observation for this synthetic proposition", "artifact": "docs/implementation.md", "result": "none", "independently_reproduced": false }, "provenance": { "origin": "original_public_teaching_model", "date": "2026-10-12", "artifact": "examples/investigations/check.py", "author": "Andrew Durden; AI-assisted candidate preparation" } }, { "claim_id": "GA-SYN-006", "edition": "2026.10.7", "statement": "For flip, identity and constant on {0,1}, accepting a proposed fixed point only after checking x=f(x) admits no non-solution. Enumeration distinguishes zero, one and multiple solutions; evaluating total components alone establishes neither existence nor uniqueness.", "page": "docs/dossiers/construction.md", "disclosure_state": "PUBLIC_CANDIDATE", "engineering_status": "reference_implemented", "assurance": [ "analytical", "fault_tested", "externally_reproducible" ], "assumptions": [ "A fixed point is a value x satisfying x=f(x). Work only over the set {0,1}. The three functions are flip(x)=1-x, identity(x)=x and constant(x)=0. All functions terminate on all their inputs. The question is existence and uniqueness of a value that satisfies the whole equation. This is elementary algebra, not a cryptographic search." ], "negative_case": "The consumer proposes a value and must check the fixed-point equation before accepting it. Removing this equation check makes the flip function accept 0 even though flip(0)=1. The printed counterexample shows the proposed value and its image. Enumerating the true roots separately yields zero for flip, two for identity, and one for constant; this distinguishes existence from uniqueness. The negative control violates actual acceptance soundness, rather than merely printing a false-inference label.", "does_not_establish": [ "The public AD8 paper identifies an unresolved cyclic identity construction. This example explains the logical burden without reproducing its protected composition. A construction needs an agreed staging rule or other justified semantics, existence, uniqueness where required, and an implementable procedure. A proposed weaker identity definition is a design change, not a proof of the old claim. References to already committed history must also be distinguished from a candidate referring to its own future inclusion. Migration must preserve old verification rules instead of reinterpreting old bytes." ], "open_obligations": [ "The public AD8 paper identifies an unresolved cyclic identity construction. This example explains the logical burden without reproducing its protected composition. A construction needs an agreed staging rule or other justified semantics, existence, uniqueness where required, and an implementable procedure. A proposed weaker identity definition is a design change, not a proof of the old claim. References to already committed history must also be distinguished from a candidate referring to its own future inclusion. Migration must preserve old verification rules instead of reinterpreting old bytes." ], "research": { "kind": "analytical", "method": "authored finite argument", "actor": "publication author", "date": "2026-10-12", "bounds": "A fixed point is a value x satisfying x=f(x). Work only over the set {0,1}. The three functions are flip(x)=1-x, identity(x)=x and constant(x)=0. All functions terminate on all their inputs. The question is existence and uniqueness of a value that satisfies the whole equation. This is elementary algebra, not a cryptographic search.", "artifact": "docs/dossiers/construction.md", "result": "Scoped argument and counterexample stated", "independently_reproduced": false }, "reference": { "kind": "fault_tested", "method": "author execution of original synthetic case", "actor": "publication author", "date": "2026-10-12", "bounds": "A fixed point is a value x satisfying x=f(x). Work only over the set {0,1}. The three functions are flip(x)=1-x, identity(x)=x and constant(x)=0. All functions terminate on all their inputs. The question is existence and uniqueness of a value that satisfies the whole equation. This is elementary algebra, not a cryptographic search.", "artifact": "examples/investigations/check.py", "result": "positive condition holds; deliberate mutant violates it", "independently_reproduced": false, "case": "construction" }, "production": { "kind": "none", "method": "none", "actor": "none", "date": "2026-10-12", "bounds": "No production observation for this synthetic proposition", "artifact": "docs/implementation.md", "result": "none", "independently_reproduced": false }, "provenance": { "origin": "original_public_teaching_model", "date": "2026-10-12", "artifact": "examples/investigations/check.py", "author": "Andrew Durden; AI-assisted candidate preparation" } }, { "claim_id": "GA-SYN-007", "edition": "2026.10.7", "statement": "An observer of a two-field revision sees a total of ten at both installation steps if publication switches only after the complete new revision is installed.", "page": "docs/dossiers/visibility.md", "disclosure_state": "PUBLIC_CANDIDATE", "engineering_status": "reference_implemented", "assurance": [ "analytical", "fault_tested", "externally_reproducible" ], "assumptions": [ "The old revision is (2,8), the new revision (5,5), and total ten is the invariant. A writer stages one field at a time. A published immutable snapshot is the only observation route. A trusted atomic pointer switch exposes the completed snapshot. A reader may run after either staging step but cannot inspect unpublished memory." ], "negative_case": "The mutant publishes after every field update. Its first observation is (5,8), totaling thirteen. The final state is correct, so a final-state-only test would miss the failure. This counterexample uses ordinary synthetic values and a single pointer; it does not recreate MIRAGE storage, observation machinery or private routing.", "does_not_establish": [ "The atomic pointer and immutable snapshots are assumptions. Independent field readers, unsafe storage administrators, torn pointer writes, cross-process memory ordering and crash recovery need their own arguments. The reference cannot establish confidentiality, real distributed atomicity or complete mediation in a deployed system. Actual MIRAGE and CSSL refinements require evidence about all observation routes." ], "open_obligations": [ "The atomic pointer and immutable snapshots are assumptions. Independent field readers, unsafe storage administrators, torn pointer writes, cross-process memory ordering and crash recovery need their own arguments. The reference cannot establish confidentiality, real distributed atomicity or complete mediation in a deployed system. Actual MIRAGE and CSSL refinements require evidence about all observation routes." ], "research": { "kind": "analytical", "method": "authored finite argument", "actor": "publication author", "date": "2026-10-12", "bounds": "The old revision is (2,8), the new revision (5,5), and total ten is the invariant. A writer stages one field at a time. A published immutable snapshot is the only observation route. A trusted atomic pointer switch exposes the completed snapshot. A reader may run after either staging step but cannot inspect unpublished memory.", "artifact": "docs/dossiers/visibility.md", "result": "Scoped argument and counterexample stated", "independently_reproduced": false }, "reference": { "kind": "fault_tested", "method": "author execution of original synthetic case", "actor": "publication author", "date": "2026-10-12", "bounds": "The old revision is (2,8), the new revision (5,5), and total ten is the invariant. A writer stages one field at a time. A published immutable snapshot is the only observation route. A trusted atomic pointer switch exposes the completed snapshot. A reader may run after either staging step but cannot inspect unpublished memory.", "artifact": "examples/investigations/check.py", "result": "positive condition holds; deliberate mutant violates it", "independently_reproduced": false, "case": "visibility" }, "production": { "kind": "none", "method": "none", "actor": "none", "date": "2026-10-12", "bounds": "No production observation for this synthetic proposition", "artifact": "docs/implementation.md", "result": "none", "independently_reproduced": false }, "provenance": { "origin": "original_public_teaching_model", "date": "2026-10-12", "artifact": "examples/investigations/check.py", "author": "Andrew Durden; AI-assisted candidate preparation" } }, { "claim_id": "GA-SYN-008", "edition": "2026.10.7", "statement": "The same absent acknowledgement is compatible with an uncommitted effect and a committed effect; an observer of that acknowledgement alone cannot conclude that nothing happened.", "page": "docs/dossiers/uncertainty.md", "disclosure_state": "PUBLIC_CANDIDATE", "engineering_status": "reference_implemented", "assurance": [ "analytical", "fault_tested", "externally_reproducible" ], "assumptions": [ "The destination may commit an action and its acknowledgement may be lost. The local observer sees only the acknowledgement flag. The two possible worlds differ in destination state. We assume both worlds are permitted by the communication model. No timing distribution or retry probability is supplied." ], "negative_case": "The mutant interprets no acknowledgement as not done. That decision is false in World B. The executable case computes both worlds and identifies the false conclusion. The existing continuity exhibit goes further with a controlled witness, durable state and reconciliation; its exact result depends on its stated destination contract. It is linked as a distinct reference rather than incorporated into this abstraction.", "does_not_establish": [ "This argument does not prove exactly-once effects, destination idempotence, provider availability or successful compensation. An acknowledgement can itself be insufficient if it records acceptance rather than fulfillment. Production workload readiness and source inspection do not settle either world. The retained dated implementation report remains separate from this original teaching experiment." ], "open_obligations": [ "This argument does not prove exactly-once effects, destination idempotence, provider availability or successful compensation. An acknowledgement can itself be insufficient if it records acceptance rather than fulfillment. Production workload readiness and source inspection do not settle either world. The retained dated implementation report remains separate from this original teaching experiment." ], "research": { "kind": "analytical", "method": "authored finite argument", "actor": "publication author", "date": "2026-10-12", "bounds": "The destination may commit an action and its acknowledgement may be lost. The local observer sees only the acknowledgement flag. The two possible worlds differ in destination state. We assume both worlds are permitted by the communication model. No timing distribution or retry probability is supplied.", "artifact": "docs/dossiers/uncertainty.md", "result": "Scoped argument and counterexample stated", "independently_reproduced": false }, "reference": { "kind": "fault_tested", "method": "author execution of original synthetic case", "actor": "publication author", "date": "2026-10-12", "bounds": "The destination may commit an action and its acknowledgement may be lost. The local observer sees only the acknowledgement flag. The two possible worlds differ in destination state. We assume both worlds are permitted by the communication model. No timing distribution or retry probability is supplied.", "artifact": "examples/investigations/check.py", "result": "positive condition holds; deliberate mutant violates it", "independently_reproduced": false, "case": "uncertainty" }, "production": { "kind": "none", "method": "none", "actor": "none", "date": "2026-10-12", "bounds": "No production observation for this synthetic proposition", "artifact": "docs/implementation.md", "result": "none", "independently_reproduced": false }, "provenance": { "origin": "original_public_teaching_model", "date": "2026-10-12", "artifact": "examples/investigations/check.py", "author": "Andrew Durden; AI-assisted candidate preparation" } }, { "claim_id": "GA-SYN-009", "edition": "2026.10.7", "statement": "A projection check over both quantity and unit rejects a changed unit even when the numeric quantity is preserved.", "page": "docs/dossiers/projection.md", "disclosure_state": "PUBLIC_CANDIDATE", "engineering_status": "reference_implemented", "assurance": [ "analytical", "fault_tested", "externally_reproducible" ], "assumptions": [ "The desired observation is four items. A proposed projection supplies a quantity and a unit. Equality of both fields defines preservation for this teaching case. The producer may produce any of three candidates; the validator is trusted to compare both observables. There is no conversion between boxes and items in the declared model." ], "negative_case": "The mutant compares quantities alone. It accepts four boxes. A schema ensuring that quantity is an integer would not detect that error either. The failed check therefore concerns interpretation preservation, not merely structural validity. The example is deliberately smaller than any compiler intermediate representation.", "does_not_establish": [ "The unit model does not prove complete dependency discovery, semantic understanding, arbitrary compiler correctness, accessibility equivalence or safe application repair. Observation can omit important behavior. Drift detection does not grant authority to correct a user-owned resource. IC/POAR and Semantic OS proposals retain specification-to-runtime and refinement obligations beyond this finite test." ], "open_obligations": [ "The unit model does not prove complete dependency discovery, semantic understanding, arbitrary compiler correctness, accessibility equivalence or safe application repair. Observation can omit important behavior. Drift detection does not grant authority to correct a user-owned resource. IC/POAR and Semantic OS proposals retain specification-to-runtime and refinement obligations beyond this finite test." ], "research": { "kind": "analytical", "method": "authored finite argument", "actor": "publication author", "date": "2026-10-12", "bounds": "The desired observation is four items. A proposed projection supplies a quantity and a unit. Equality of both fields defines preservation for this teaching case. The producer may produce any of three candidates; the validator is trusted to compare both observables. There is no conversion between boxes and items in the declared model.", "artifact": "docs/dossiers/projection.md", "result": "Scoped argument and counterexample stated", "independently_reproduced": false }, "reference": { "kind": "fault_tested", "method": "author execution of original synthetic case", "actor": "publication author", "date": "2026-10-12", "bounds": "The desired observation is four items. A proposed projection supplies a quantity and a unit. Equality of both fields defines preservation for this teaching case. The producer may produce any of three candidates; the validator is trusted to compare both observables. There is no conversion between boxes and items in the declared model.", "artifact": "examples/investigations/check.py", "result": "positive condition holds; deliberate mutant violates it", "independently_reproduced": false, "case": "projection" }, "production": { "kind": "none", "method": "none", "actor": "none", "date": "2026-10-12", "bounds": "No production observation for this synthetic proposition", "artifact": "docs/implementation.md", "result": "none", "independently_reproduced": false }, "provenance": { "origin": "original_public_teaching_model", "date": "2026-10-12", "artifact": "examples/investigations/check.py", "author": "Andrew Durden; AI-assisted candidate preparation" } }, { "claim_id": "GA-SYN-010", "edition": "2026.10.7", "statement": "Requiring two control groups rejects a two-voter quorum when both voters are controlled by the same group.", "page": "docs/dossiers/custody.md", "disclosure_state": "PUBLIC_CANDIDATE", "engineering_status": "reference_implemented", "assurance": [ "analytical", "fault_tested", "externally_reproducible" ], "assumptions": [ "Voters a and b belong to group one; voter c belongs to group two. The threshold is two independently controlled groups. A registry of actual control is assumed accurate and current. Voters can submit distinct labels but cannot change this registry. The case examines the counting rule, not authentication or how real independence is discovered." ], "negative_case": "The mutant counts voter labels. It admits (a,b), allowing one control group to satisfy a nominal two-party threshold. The example identifies a structural counting error without publishing a real custodian roster or capture technique. A valid count cannot compensate for false control data.", "does_not_establish": [ "Actual beneficial control, coercion, collusion, emergency powers, custody recovery, founder amendment powers and changing membership are outside this reference. No software test here certifies human independence. A production custody claim requires an attributable process and observation of its control boundary, as well as a faithful counter implementation." ], "open_obligations": [ "Actual beneficial control, coercion, collusion, emergency powers, custody recovery, founder amendment powers and changing membership are outside this reference. No software test here certifies human independence. A production custody claim requires an attributable process and observation of its control boundary, as well as a faithful counter implementation." ], "research": { "kind": "analytical", "method": "authored finite argument", "actor": "publication author", "date": "2026-10-12", "bounds": "Voters a and b belong to group one; voter c belongs to group two. The threshold is two independently controlled groups. A registry of actual control is assumed accurate and current. Voters can submit distinct labels but cannot change this registry. The case examines the counting rule, not authentication or how real independence is discovered.", "artifact": "docs/dossiers/custody.md", "result": "Scoped argument and counterexample stated", "independently_reproduced": false }, "reference": { "kind": "fault_tested", "method": "author execution of original synthetic case", "actor": "publication author", "date": "2026-10-12", "bounds": "Voters a and b belong to group one; voter c belongs to group two. The threshold is two independently controlled groups. A registry of actual control is assumed accurate and current. Voters can submit distinct labels but cannot change this registry. The case examines the counting rule, not authentication or how real independence is discovered.", "artifact": "examples/investigations/check.py", "result": "positive condition holds; deliberate mutant violates it", "independently_reproduced": false, "case": "custody" }, "production": { "kind": "none", "method": "none", "actor": "none", "date": "2026-10-12", "bounds": "No production observation for this synthetic proposition", "artifact": "docs/implementation.md", "result": "none", "independently_reproduced": false }, "provenance": { "origin": "original_public_teaching_model", "date": "2026-10-12", "artifact": "examples/investigations/check.py", "author": "Andrew Durden; AI-assisted candidate preparation" } }, { "claim_id": "GA-SYN-011", "edition": "2026.10.7", "statement": "If burned resources are already included in spent resources, adding burned again violates the stated conservation equation.", "page": "docs/dossiers/budget.md", "disclosure_state": "PUBLIC_CANDIDATE", "engineering_status": "reference_implemented", "assurance": [ "analytical", "fault_tested", "externally_reproducible" ], "assumptions": [ "The resource unit is indivisible and all balances are nonnegative integers. Issued equals available plus reserved plus spent. Burned is a descriptive subset of spent and must be no larger than spent. The counterparty cannot issue new resources during the observation. This is a single balance-sheet state, not an economic model." ], "negative_case": "The mutant adds the burned subset as a fourth independent term: seven plus one plus three plus two equals thirteen. The discrepancy is detected. A label for irreversible loss can be useful, but treating it as a new balance would double count. The original declaration of which sets overlap is therefore part of the invariant.", "does_not_establish": [ "The one-state calculation does not establish every transition preserves conservation, prevent overflow, price resources, or prove incentives. Issuance, reservation release, crashes and concurrent transfers need additional transition tests. The wider RCFS amendment and split/merge constructions remain separate obligations; this teaching arithmetic cannot close them." ], "open_obligations": [ "The one-state calculation does not establish every transition preserves conservation, prevent overflow, price resources, or prove incentives. Issuance, reservation release, crashes and concurrent transfers need additional transition tests. The wider RCFS amendment and split/merge constructions remain separate obligations; this teaching arithmetic cannot close them." ], "research": { "kind": "analytical", "method": "authored finite argument", "actor": "publication author", "date": "2026-10-12", "bounds": "The resource unit is indivisible and all balances are nonnegative integers. Issued equals available plus reserved plus spent. Burned is a descriptive subset of spent and must be no larger than spent. The counterparty cannot issue new resources during the observation. This is a single balance-sheet state, not an economic model.", "artifact": "docs/dossiers/budget.md", "result": "Scoped argument and counterexample stated", "independently_reproduced": false }, "reference": { "kind": "fault_tested", "method": "author execution of original synthetic case", "actor": "publication author", "date": "2026-10-12", "bounds": "The resource unit is indivisible and all balances are nonnegative integers. Issued equals available plus reserved plus spent. Burned is a descriptive subset of spent and must be no larger than spent. The counterparty cannot issue new resources during the observation. This is a single balance-sheet state, not an economic model.", "artifact": "examples/investigations/check.py", "result": "positive condition holds; deliberate mutant violates it", "independently_reproduced": false, "case": "budget" }, "production": { "kind": "none", "method": "none", "actor": "none", "date": "2026-10-12", "bounds": "No production observation for this synthetic proposition", "artifact": "docs/implementation.md", "result": "none", "independently_reproduced": false }, "provenance": { "origin": "original_public_teaching_model", "date": "2026-10-12", "artifact": "examples/investigations/check.py", "author": "Andrew Durden; AI-assisted candidate preparation" } }, { "claim_id": "GA-SYN-012", "edition": "2026.10.7", "statement": "For the specified four outcomes, constant quarter-probability forecasts have Brier loss five-sixteenths and skill minus one-quarter relative to the same-cohort half-probability baseline.", "page": "docs/dossiers/calibration.md", "disclosure_state": "PUBLIC_CANDIDATE", "engineering_status": "reference_implemented", "assurance": [ "analytical", "fault_tested", "externally_reproducible" ], "assumptions": [ "Outcomes are zero, zero, one and one. All forecasts equal one quarter. Brier loss is the mean squared difference between forecast and outcome. Skill is one minus forecast loss divided by baseline loss. The baseline is the empirical half-probability forecast on this same cohort. Exact rational arithmetic avoids rounding ambiguity. No population-level inference is made." ], "negative_case": "The mutant uses baseline loss one-half from a different comparison. The reported skill becomes three-eighths, changing the sign while the forecasts and outcomes are unchanged. The checker rejects that value. A favorable score can therefore be an artifact of choosing an inappropriate comparator, even when the arithmetic is otherwise correct.", "does_not_establish": [ "This four-case demonstration does not measure calibration in customers, establish causal benefit, or validate an incentive mechanism. Forecast selection, missing outcomes, adversarial reporting, cohort shift and adaptive stopping need their own methods. Experience transfer and human\u2013LLM elicitation require empirical study; the scoring calculation is not such a study." ], "open_obligations": [ "This four-case demonstration does not measure calibration in customers, establish causal benefit, or validate an incentive mechanism. Forecast selection, missing outcomes, adversarial reporting, cohort shift and adaptive stopping need their own methods. Experience transfer and human\u2013LLM elicitation require empirical study; the scoring calculation is not such a study." ], "research": { "kind": "analytical", "method": "authored finite argument", "actor": "publication author", "date": "2026-10-12", "bounds": "Outcomes are zero, zero, one and one. All forecasts equal one quarter. Brier loss is the mean squared difference between forecast and outcome. Skill is one minus forecast loss divided by baseline loss. The baseline is the empirical half-probability forecast on this same cohort. Exact rational arithmetic avoids rounding ambiguity. No population-level inference is made.", "artifact": "docs/dossiers/calibration.md", "result": "Scoped argument and counterexample stated", "independently_reproduced": false }, "reference": { "kind": "fault_tested", "method": "author execution of original synthetic case", "actor": "publication author", "date": "2026-10-12", "bounds": "Outcomes are zero, zero, one and one. All forecasts equal one quarter. Brier loss is the mean squared difference between forecast and outcome. Skill is one minus forecast loss divided by baseline loss. The baseline is the empirical half-probability forecast on this same cohort. Exact rational arithmetic avoids rounding ambiguity. No population-level inference is made.", "artifact": "examples/investigations/check.py", "result": "positive condition holds; deliberate mutant violates it", "independently_reproduced": false, "case": "calibration" }, "production": { "kind": "none", "method": "none", "actor": "none", "date": "2026-10-12", "bounds": "No production observation for this synthetic proposition", "artifact": "docs/implementation.md", "result": "none", "independently_reproduced": false }, "provenance": { "origin": "original_public_teaching_model", "date": "2026-10-12", "artifact": "examples/investigations/check.py", "author": "Andrew Durden; AI-assisted candidate preparation" } } ] }