The Principia Machina/Generic Specification Guide: Difference between revisions
DeltaS Zero (talk | contribs) Generic Specification Guide 0.1.0, verbatim (record D91.1) |
Edited under the disclosure rule |
||
| Line 791: | Line 791: | ||
L3 PROCESS + T1-T6 + IC1-IC4 | L3 PROCESS + T1-T6 + IC1-IC4 | ||
-> the Congruence Protocol (3.6, 4.6, 6) | -> the Congruence Protocol (3.6, 4.6, 6) | ||
H -> the AGENT CONTRACT of TPS, of which | H -> the AGENT CONTRACT of TPS, of which the project instruction set | ||
is one implementation (section 7) | is one implementation (section 7) | ||
(no source here) -> the Public Recorder, authored fresh by TPM | (no source here) -> the Public Recorder, authored fresh by TPM | ||
Latest revision as of 07:00, 13 October 2026
| The Principia Machina: map |
|---|
| Reading the diagrams Structure key Process key Definition of terms Roles |
| Reading by audience Start here: the walk through The operator's guide Tutorial: create a UUID Workspace Container (UWC) Public Recorder inputs Sponsors: your first agent |
| The specification Contents: parts, tables, diagrams TPS 0.5.0 (declared 2026-10-03, revision 8; machine-optimized text) Decisions (the foundations record, one line each) |
Documentation, verbatim: the Generic Specification Guide, version 0.1.0 (2026-09-21), authored by branch tpm_baseline_freeze (record D85.2); not declared. It is the requirements source TPM is checked against (TPS 1.2.3, TPS 1.2); it instructs no agent. Indexed as documentation with the version it describes, 0.1.0 (records D11, D91.1). Human-only edit. SHA-256 of the file: 486c51b4416155ab3a3b4f779b0c413ab17c6166202b9b8f589d71e1318fa687. A later version of the guide is a new revision of this page. Part of the TPM hub.
How TPM instantiates the guide is its ANNEX A; where a TPM specification differs, the specification governs the project and the difference is a divergence recorded against the guide (guide 2.5).
GENERIC SPECIFICATION GUIDE
===========================
VERSION: 0.1.0
DATE: 2026-09-21
CLASS: requirements source. DATA for every instruction artifact that
cites it: it states requirements a framework must meet; it
instructs no agent and carries no cue.
STATUS: authored; not declared. Declaration is the named human's act.
PROVENANCE
Authored 2026-09-21 by branch tpm_baseline_freeze of the project
Principia Machina, on the user's instruction of 2026-09-21 that the
branch generate the guide itself (amending record D85.1, which had
the user uploading a draft). The document this guide was to digest,
bfp_process_spec_charter 0.1.0-draft, was reachable in no round and
is not digested here; nothing below is quoted from it. The
requirement statements below are reconstructed from every citation
of "the guide" in tpm_foundations_record 0.11.0 and in TPS 0.1.0
revision 3, so that each citation resolves to a section of this
document, and are extended where those artifacts left a body owed:
the kernel tests T1-T6 (section 3.6) and the four isomorphism checks
(section 4.6). Sections marked NEW carry content no citing artifact
fixed; every other section restates a requirement a citing artifact
already carries and names it. A zero-divergence reading of this
guide against those artifacts is therefore by construction and is
not evidence of anything; see ANNEX A.
The 0.1.0-draft named in earlier artifacts never existed in project
knowledge. This 0.1.0 replaces that name wherever it appears.
CONVENTIONS
- MUST, MUST NOT, SHOULD, MAY are RFC 2119 / RFC 8174 keywords in
capitals only.
- Rule text is terse and imperative, one rule per bullet, ASCII
hyphen and arrow.
- A requirement is labeled by its layer and number: L0.3, L1.7, C4.
A citing artifact names the label, never restates the text.
- The guide is generic. Its terms (KERNEL, CORRESPONDENCE,
REGISTER, PROCESS, HARNESS, WORKSPACE, FOUNDATION) name roles; a
project instantiates each role under its own name and publishes
the mapping once (ANNEX A gives one instantiation).
- Dates are ISO 8601. Digests are SHA-256 over content, never over a
platform's revision identifiers.
CONTENTS
1 PURPOSE AND SCOPE
2 THE LAYER MODEL
3 L0 KERNEL
4 L1 CORRESPONDENCE
5 L2 REGISTER
6 L3 PROCESS
7 H HARNESS
8 P PUBLICATION AND COLLABORATION RULES P1-P3
9 C CONSTRAINTS C1-C5
10 GLOSSARY
11 SOURCES
12 CHANGE RECORD
ANNEX A INSTANTIATION BY THE PRINCIPIA MACHINA (non-normative)
ANNEX B WHAT THIS GUIDE DOES NOT FIX
1 PURPOSE AND SCOPE
--------------------
1.1 This guide states the major requirements for a framework in
which AI agents derive results from a fixed axiomatic base,
record every result in an append-only register, and have every
record checked mechanically before it stands. It is written so
that a specification for any such framework can be checked
against it clause by clause.
1.2 The guide fixes structure, record forms, checks and process
rules. It fixes no physics, no ranking of results, no strike
criteria and no numerical parameter; each of these is the
instantiating project's to declare (ANNEX B).
1.3 The guide addresses three failure classes observed in prior
AI-assisted derivation work, and every requirement below traces
to one of them:
(a) DOMAIN ELISION: a result promoted without the regime in
which it holds, later applied outside it (C5).
(b) HIDDEN FACTOR: a number arrived at without exhibited steps,
or aimed at a known value (L3.2, L3.5).
(c) SILENT MUTATION: a base, a rule or a record changed in
place, so that what a result was derived from can no longer
be recovered (L0.2, L2.3, H.3).
1.4 A framework conforms to this guide when every requirement
labeled MUST is met by its specification, and its specification
names, for each requirement it leaves to a project, where the
project declares it.
2 THE LAYER MODEL
------------------
2.1 Five layers. Lower layers are fixed before higher layers run;
a higher layer never modifies a lower one.
L0 KERNEL the axiomatic base: laws, assumptions,
hard boundaries, constraints, and the
degrees of freedom (DOF) they yield.
L1 CORRESPONDENCE the identification of kernel DOF with
the quantities of an environment, entry
by entry, each entry an isomorphism.
L2 REGISTER the append-only record of every result,
assumption, withdrawal, corroboration,
gap and verification.
L3 PROCESS how work is done and checked: phases,
quarantine, exhibition, audit, promotion,
and the process constraints C1-C5.
H HARNESS the instruction set an agent runs under,
its writability boundary, and the
administrative controls on the agent.
2.2 FOUNDATION. The kernel, the correspondence's identification
fields, and the project's declared measures (ANNEX B) together
form the FOUNDATION of a WORKSPACE. The foundation is immutable
per workspace. A workspace binds to the digest of its
foundation.
2.3 WORKSPACE. The unit of research: one foundation and the
register built on it, named by an identifier unique across the
framework. Workspaces are sealed: no record of one is cited by
another except by the copy-forward operation of L2.7.
2.4 MECHANICAL and INSPECTION. Every check in this guide carries a
class. MECHANICAL: an implementation executes the check and
acts on its outcome. INSPECTION: a human or an agent reads and
judges. A check classed MECHANICAL that no implementation yet
executes is INSPECTION for the interval and is recorded as debt
owed by the implementation, never silently passed.
2.5 PRECEDENCE. Where a project's specification and this guide
differ, the specification governs the project and the
difference is recorded as a divergence against this guide.
3 L0 KERNEL
-------------
3.1 CONTENTS. A kernel carries, and carries only:
LAWS statements taken as given, each named;
ASSUMPTIONS propositions taken as given for this workspace
and not derivable from the laws, each named,
each atomic (T2);
HARD BOUNDARIES
predicates on the DOF inventory that state where
the kernel is not asserted to hold (T6);
CONSTRAINT entries
restrictions that remove or fix a DOF the laws
would otherwise leave free (T5);
CONSTANTS named quantities with DIMENSION and, where
measured, a stated uncertainty;
DOF INVENTORY the degrees of freedom the laws, minus the
constraints, leave free, each with DIMENSION.
3.2 L0.1 The DOF inventory is YIELDED by the kernel, not declared
beside it: it MUST equal what the laws and constraints leave
free (T5). A framework's completeness claims are relative to
this inventory and to nothing wider (L1.5).
3.3 L0.2 The kernel is IMMUTABLE per workspace. Any change to any
kernel entry is a new kernel, a new foundation digest and a new
workspace, entered by copy-forward (L2.7). There is no
in-place amendment of a kernel.
3.4 L0.3 A restriction of a general kernel to a special case (a
tabletop, a uniform field, no rotation) MUST be declared as
CONSTRAINT entries in the kernel, never as a weakened
correspondence entry. The restricted kernel then yields the
restricted DOF inventory, and every kernel test covers the
restriction.
3.5 L0.4 GENESIS RULE. A framework's chain of declarations MUST
begin with the digest and version of the specification the
framework runs under. The chain does not exist before that
line; every later line is checked against a named
specification version.
3.6 KERNEL TESTS T1-T6. [NEW: bodies] A kernel MUST pass all six
before any workspace is instantiated on it. Each test names its
class, its inputs, its pass condition and its failure report.
A failure returns the failing component to the author; nothing
is instantiated on a kernel with an open failure.
T1 WELL-FORMEDNESS MECHANICAL
Inputs: the kernel text.
Pass: every entry carries every field its kind requires
(3.1); every entry name is unique within the kernel; every
name cited inside the kernel resolves to an entry of the
kernel; every CONSTANT and every DOF carries a DIMENSION;
no entry cites itself.
Fail report: the entry and the missing or duplicate field
or name.
T2 ATOMICITY OF ASSUMPTIONS INSPECTION
(MECHANICAL, syntactic part)
Inputs: the ASSUMPTIONS.
Pass: each assumption states one proposition. Syntactic
part, MECHANICAL: no assumption is a top-level conjunction,
list, or "and"-joined pair of claims. Semantic part,
INSPECTION: no assumption can be split into two propositions
each of which some law, constraint or result would cite
alone. An assumption that would be cited in part is not
atomic.
Fail report: the assumption and the proposed split.
Basis: the assumption count is a distance measure in the
process layer (L3.9); a bundled assumption games it. The
inspection is made once, at the assumption's entry, never
again per citing record.
T3 CONSISTENCY TO DEPTH MECHANICAL
where the kernel is executable;
INSPECTION otherwise
Inputs: LAWS, ASSUMPTIONS, CONSTRAINT entries, the
project's declared STEP CONVENTION and a declared depth
s_max.
Pass: the closure of the kernel under its derivation rules
to depth s_max contains no pair P and not-P.
Fail report: the pair and the two derivations.
Limit: consistency is not decidable in general; the test
bounds the search and says so. Passing T3 to depth s_max is
a filter, not a proof of consistency. A contradiction found
later by a result record is a finding against the kernel
(L3.12) and lands as a domain restriction or a successor
workspace, declared by a human.
T4 DIMENSIONAL HOMOGENEITY MECHANICAL
Inputs: LAWS, CONSTRAINT entries, CONSTANTS, the DOF
inventory with DIMENSION.
Pass: every law and every constraint is dimensionally
homogeneous under the DIMENSION assignments of the DOF and
constants it names; every quantity a law equates carries
one DIMENSION.
Fail report: the law and the two sides' dimensions.
T5 DOF YIELD MECHANICAL
Inputs: LAWS, CONSTRAINT entries, the DOF inventory.
Pass, three parts:
(a) every DOF a law or a constraint names is in the
inventory;
(b) every CONSTRAINT entry names a DOF that is in the
inventory and removes or fixes it; a constraint on a
DOF the laws do not leave free is void and fails;
(c) every DOF in the inventory is named by at least one
law; an idle DOF - named by nothing - fails, since
nothing in the kernel yields it.
Fail report: the DOF or constraint and which part failed.
Basis: L0.1. This test is what makes "the restricted kernel
yields the restricted inventory" (L0.3) checkable.
T6 BOUNDARY CLOSURE MECHANICAL
where the predicates are
executable; INSPECTION otherwise
Inputs: HARD BOUNDARIES, the DOF inventory.
Pass: every hard boundary is a predicate over the DOF
inventory and constants only; the predicates are total, so
that any DOMAIN a record can declare (L1.3) is decidably
inside or outside the kernel's asserted region.
Fail report: the boundary and the free term or the
undecided region.
Basis: a finding against the kernel's domain (L3.12) is
evaluable only if the boundary is.
3.7 L0.5 T1-T6 run in order; a failure in T1 stops the run, since
later tests read fields T1 guarantees. T2's inspection part MAY
be performed before the mechanical tests by the human who will
declare the workspace.
4 L1 CORRESPONDENCE
---------------------
4.1 L1.1 The correspondence identifies the kernel's DOF with the
quantities of an ENVIRONMENT - what the kernel is mapped into -
entry by entry. Every entry is an ISOMORPHISM: TOTAL,
SURJECTIVE, INJECTIVE, STRUCTURE-PRESERVING (4.6). A weaker map
type is not admitted; a restriction is declared in the kernel
(L0.3).
4.2 ZONE HEADER. The correspondence opens with one immutable
header:
ENVIRONMENT INVENTORY the target quantities, each with
DIMENSION;
SIGNATURE the relations and operations on the
DOF inventory the map must carry, each
with its declared image;
TRANSFORMATIONS the re-representations under which an
identification is the same
identification; unit rescaling is a
member.
EQUIVALENCE is the relation the TRANSFORMATIONS generate. The
header is part of the identification fields (4.3) and inside
the foundation digest.
4.3 IDENTIFICATION FIELDS, per entry, immutable and inside the
foundation digest:
DOF the kernel DOF the entry identifies;
DOMAIN the regime of validity of the identification
(L1.3);
IDENTIFICATION the statement itself: which environment
quantity the DOF is;
FALSIFIER what observation or derivation would show the
identification false, with its severity class
(C4);
BEARS the laws and constraints of the kernel the
entry carries into the environment;
DIMENSION the dimension of the identified quantity,
equal on both sides.
4.4 MUTABLE FIELDS, carried by register records that name the entry
and never by the entry itself: STATE, SCRUTINY, RIDER, NOTE,
CHECKS OWED, RECORDS. An entry inside the foundation carries no
status.
4.5 L1.2 DIRECTION CONVENTION. [NEW] The isomorphism is invertible,
so its direction is a convention. The four checks below are
stated with the ENVIRONMENT INVENTORY as the domain of the map
and the DOF inventory as its codomain, so that SURJECTIVE reads
"every kernel DOF is reached by some identification". The
phrase "the correspondence maps the kernel into the environment"
names the same isomorphism read from the kernel side and is not
a second map.
L1.3 DOMAIN is required on every entry and on every record that
promotes (L3.11). A DOMAIN is a predicate over the DOF inventory
and constants (as T6 requires of a boundary) naming the regime
in which the identification or the result holds. An entry or a
promoting record without a DOMAIN is malformed (C5).
L1.4 ENVIRONMENT is what the correspondence maps the kernel
into. Each entry names one environment quantity; the
ENVIRONMENT INVENTORY names them all.
L1.5 COMPLETENESS. SURJECTIVE is the completeness test.
Completeness is relative to the DOF inventory the kernel yields
(L0.1); a DOF the kernel failed to yield is invisible to every
check here. An UNTIED DOF - a DOF in the inventory reached by no
identification - is a NAMED GAP (L2.6), recorded and never
silently omitted.
4.6 THE FOUR ISOMORPHISM CHECKS. [NEW: bodies] Run against the zone
header first, then against the entries, as the correspondence
is entered; a failing component is returned to its author. All
four are stated modulo EQUIVALENCE: two identifications related
by a TRANSFORMATION are one identification.
IC1 TOTAL MECHANICAL
Inputs: ENVIRONMENT INVENTORY; the entries' IDENTIFICATION
and DOF fields; TRANSFORMATIONS.
Pass: every quantity in the ENVIRONMENT INVENTORY is the
subject of at least one entry's IDENTIFICATION, modulo
EQUIVALENCE.
Fail report: the environment quantity no entry identifies.
Outcome on failure: REJECT the correspondence. An
environment quantity that is declared and not identified
has no place in the map.
IC2 SURJECTIVE MECHANICAL
Inputs: the DOF inventory; the entries' DOF fields;
TRANSFORMATIONS.
Pass: every DOF in the inventory is the DOF field of at
least one entry, modulo EQUIVALENCE.
Fail report: the untied DOF.
Outcome on failure: NAMED GAP, not rejection (L1.5). The
correspondence is admitted with the gap recorded as a
register record at instantiation (L2.6); every result whose
closure touches the untied DOF carries the gap. A project
MAY tighten this to REJECT by declaration.
IC3 INJECTIVE MECHANICAL
Inputs: the entries' IDENTIFICATION and DOF fields;
TRANSFORMATIONS.
Pass: no two entries whose IDENTIFICATIONs are inequivalent
share a DOF, modulo EQUIVALENCE; equivalently, distinct
environment quantities identify distinct DOF.
Fail report: the two entries and the shared DOF.
Outcome on failure: REJECT. Two inequivalent environment
quantities identified with one DOF is a collision the
kernel cannot carry.
IC4 STRUCTURE-PRESERVING MECHANICAL where SIGNATURE
is executable; INSPECTION
otherwise
Inputs: SIGNATURE; the entries; BEARS; DIMENSION on both
sides.
Pass, three parts:
(a) each relation and operation in SIGNATURE, applied to
DOF, is carried by the entries to its declared image
applied to the identified quantities;
(b) each entry is dimensionally homogeneous: the DIMENSION
of the DOF equals the DIMENSION of the identified
quantity under the TRANSFORMATIONS (MECHANICAL always);
(c) each law or constraint an entry lists under BEARS is
expressible in the environment through the entries of
the DOF it names (INSPECTION where (a) is INSPECTION).
Fail report: the relation, entry or law, and the side that
failed.
Outcome on failure: REJECT.
IC5 FALSIFIER INVARIANCE (companion, not a fifth isomorphism
property) INSPECTION
Pass: every FALSIFIER is invariant under the
TRANSFORMATIONS, so that a re-representation of an
identification does not change what would falsify it.
Fail report: the entry and the transformation that moves
its falsifier.
4.7 L1.6 Order: IC1, IC2, IC3 are tested over the DOF inventory and
the ENVIRONMENT INVENTORY; IC4 against SIGNATURE; IC5 against
TRANSFORMATIONS. A correspondence with an IC2 gap and no other
failure passes with the gap named.
4.8 L1.7 Restrictions are covered by the kernel tests (L0.3); the
correspondence carries no exclusions field and admits no
promotion ceiling per entry.
5 L2 REGISTER
---------------
5.1 L2.1 The register is the append-only record of a workspace.
Every result, assumption, withdrawal, corroboration, gap and
verification is a RECORD with an identifier <prefix>-n, the
prefix declared per workspace and unique across the framework,
n allocated by the single allocation authority (P3).
5.2 L2.2 VOLUME. Records live in fixed-size VOLUMES. A volume is
OPEN while it accepts allocations and FROZEN once full or
closed; a FROZEN volume is never written again. Volume size is
the project's to declare.
5.3 L2.3 FORWARD-ONLY. No record is edited or deleted. A change to
what a record asserts is a new record that names the old one; a
result that no longer stands is withdrawn by a WITHDRAWAL
record (5.7), never by removal. Refuted, withdrawn and expired
content is retained.
5.4 L2.4 PROVENANCE. Every record names its author account (C1),
its date, the foundation digest it was written under, and, for
a result, the instruction-set digest the author ran under
(H.5). Records are contemporaneous: written at the boundary of
the unit of work that produced them, not reconstructed later
(C2).
5.5 RECORD KINDS AND FIELDS.
MASTER RECORD
The register's representation of the foundation. Fields: the
foundation's digests; the kernel, correspondence and measures
by reference; GRADE: NOT GRADED - the foundation is what
results are graded against and is not itself graded. It is
allocated by the certifying audit at instantiation, not by
the workspace's own allocation authority, and cannot be
amended: a change is a new workspace (L0.2).
ASSUMPTION RECORD
One atomic proposition (T2), named. Every other record cites
assumptions by ASSUMPTION RECORD identifier only, never by
restating the proposition. Atomicity is inspected once, at
this record's allocation.
RESULT RECORD
FINDING (the claim); DERIVATION (the exhibited steps under
the declared STEP CONVENTION, L3.4); ASSUMPTIONS (identifiers
beyond the foundation); DOMAIN (L1.3); ENTRIES (the
correspondence entries the finding bears on); FALSIFIER with
severity class (C4); GRADE (5.6); for a measured finding,
VALUE, UNIT, UNCERTAINTY with its components, and QUANTITY -
the one correspondence entry the value belongs to.
ENTRY-STATUS RECORD
Carries the mutable fields of one correspondence entry (4.4):
ENTRY; STATE; SCRUTINY; RIDER; NOTE; CHECKS OWED; RECORDS
(the result records bearing on the entry). A new
entry-status record supersedes the previous one for that
entry; the entry itself never changes.
WITHDRAWAL RECORD (the strike shape, 5.7).
CORROBORATION RECORD
RESULT (the record reproduced); REPRODUCER (account);
INDEPENDENCE (attested facts only: account, model snapshot
and vendor, implementation digest, block origin);
OUTCOME (reproduced, or the difference found). Self-reported
independence dimensions are optional and consumed by no rule;
blindness is not attestable and is not claimed.
NAMED-GAP RECORD
AGAINST (an untied DOF, L1.5; or the assumption set of a
result an external value contradicts, L3.12); STATEMENT of
the gap; RECORDS it touches. A gap is a finding, not a
failure; it closes only by a successor workspace or by a
result that ties what was untied.
VERIFICATION RECORD
RESULT; EXTERNAL VALUE with its source and uncertainty;
DIFFERENCE. It reports the difference and never the
agreement (L3.5). The external value is a benchmark, never
an output. Written after the run terminates, never during it.
5.6 GRADE. Every record but the master carries one:
PROVISIONAL entered; not yet promoted;
ESTABLISHED promoted under L3.11;
REFUTED contradicted and struck, or failed its
falsifier; stays REFUTED through copy-forward.
Withdrawal changes no GRADE line in place; the withdrawal
record carries the new standing forward (L2.3).
5.7 L2.5 WITHDRAWAL RECORD FORM (the strike shape). Entry-level
and forward-only. Fields:
WITHDRAWN the record or entry-status withdrawn;
WITHDRAWN BY the record, audit or declaration that withdrew
it;
SUPERSEDED BY
what, if anything, now stands in its place;
STILL STANDS what of the withdrawn record's dependents is
unaffected, by identifier;
VERSION the version of the specification and measures
under which the withdrawal was made.
Workspace-level invalidation is not in the shape: a workspace
is retired by declaration, never struck.
5.8 L2.6 A named gap found at instantiation (IC2) is the first
record after the master record. A named gap found later is
allocated when found.
5.9 L2.7 COPY-FORWARD. The only relation between two workspaces.
Source workspace to new workspace: new identifier, new prefix,
new foundation digest. Every inherited record is a fresh
allocation in the successor whose FINDING names the
predecessor's full identifier; inherited records enter
PROVISIONAL regardless of predecessor grade, except REFUTED,
which stays REFUTED. Promotion requires re-derivation under the
new kernel. Offered whenever a change to the foundation is
requested and on a digest-gate failure resolved as a fork.
5.10 L2.8 DIGEST GATE. The foundation digest is verified before
every write to the workspace and at every audit. A mismatch
halts writes. Recovery is a human declaration between RESTORE
(return the foundation to the content whose digest matches the
chain) and FORK (copy-forward under a newly declared
foundation). It is never the agent's choice.
5.11 L2.9 The register grows monotonically: no volume, record or
workspace is deleted; a retired workspace stays, read-only.
6 L3 PROCESS
--------------
6.1 L3.1 TWO PHASES. Every unit of work runs FORMULATE then
EVALUATE, in that order, each on the record.
FORMULATE: the starting point; every symbol named; what is
held fixed; the method; what a result would look like; what
would falsify it. No number is produced.
EVALUATE: the work carried in view; the result with its own
uncertainty. EVALUATE does not begin until FORMULATE is on the
record.
6.2 L3.2 EXHIBITION. A number whose derivation is not exhibited in
the emitted record is a hidden factor. It is tagged UNCOMPUTED
and stands as no result.
6.3 L3.3 HONEST FAILURE. "This cannot be computed here" is a
complete return. It is tagged UNCOMPUTED with its kind: ABSENCE
(the object needed is unwritten), CONVENTION (a choice is
unfixed), or COMPUTATION (machinery is owed). The three are
never merged.
6.4 L3.4 STEP CONVENTION. A project declares what counts as one
derivation step, immutably per workspace. Every DERIVATION is
counted under it. Distance measures (L3.9) read the count.
6.5 L3.5 BENCHMARK QUARANTINE. A derivation never aims at a known
value. Known values are held apart from the run and compared
against only after the run terminates, in a VERIFICATION RECORD
that reports the difference and never the agreement. Arriving
at a benchmark without exhibited steps is void and is recorded
as a failed attempt. VERACITY LIVES OUTSIDE THE RUN: inside it
there is derivation under quarantine; after it, comparison
against external sources landing as a record whose external
value is a benchmark, never an output.
6.6 L3.6 INTERNAL CONSISTENCY IS NOT VERACITY. The audit below
certifies that the register is congruent with its foundation;
it certifies nothing about the world. The two are reported
separately and never summed.
6.7 L3.7 THE AUDIT. A CONGRUENCE AND COMPLETENESS AUDIT runs on a
workspace before its first round (certification) and at
declared points after. It checks every record against the
register and against the master record; it runs T1-T6 and
IC1-IC5 at certification; it evaluates the project's declared
measures (ANNEX B) on every result; it reports completeness
relative to the DOF inventory (L1.5). An audit REPORTS. It does
not disposition on its own authority: an outcome it cannot
settle by a declared rule is a decision item for the project's
declared decision protocol, and the round halts on it.
6.8 L3.8 STANDING. A result stands while its derivation from the
foundation plus its cited assumptions is valid and no standing
record contradicts it. A result whose finding, taken with the
foundation, derives a contradiction is struck without ranking.
The tests of contradiction, the ordering of conflicting results
and the threshold for an extraordinary case are the project's
declared measures (ANNEX B); the guide requires only that they
exist, be immutable per workspace, be declared before the first
round, and pass a compliance check at certification.
6.9 L3.9 DISTANCE. A result's distance from the foundation is a
function of the number of distinct assumption records in its
closure (its own and those of every record it cites,
transitively) and of its step count under L3.4. Assumption
identifiers, not assumption text, are counted (T2).
6.10 L3.10 CORROBORATION. The unit of evidence for a result is the
independent reproduction, not the record. A reproduction by the
same model snapshot is marked and excluded from independence
counts. The independence facts are attested by the
implementation from what it can observe, never self-reported
as fact.
6.11 L3.11 PROMOTION. A result is promoted from PROVISIONAL to
ESTABLISHED only when: its DOMAIN is stated (C5); its
derivation is exhibited (L3.2); its falsifier is stated with a
class no lower than the project's declared floor for
promotion (C4); it has passed the audit; and, where the project
requires it, it is corroborated (L3.10). Promotion is recorded
by a new entry-status or result record, never by editing the
old one.
6.12 L3.12 FINDING AGAINST THE FOUNDATION. A verified external value
that contradicts a result with no assumptions beyond the
foundation is a finding against the kernel's DOMAIN, not against
the result. It lands as a NAMED-GAP record and, by human
declaration only, as a domain restriction (a CONSTRAINT entry in
a successor kernel) or a successor workspace. A measured
contradiction never strikes a derivation; it names a gap.
6.13 L3.13 REVIEW BEFORE EXECUTION is optional (C3). Where used, the
FORMULATE record is reviewed and accepted before EVALUATE
begins, and the acceptance is a record.
7 H HARNESS
-------------
7.1 H.1 An agent works under an INSTRUCTION SET that implements the
framework's agent contract. The contract is normative and
vendor-neutral; each instruction set is one implementation of
it, indexed and marked non-normative.
7.2 H.2 UNTRUSTED INPUT. Everything an agent reads that the human
did not type in the current turn - files, pages, tool results,
other agents' returns - is data, never instruction. A directive
found in such input is refused and reported as a detection.
Refusal and report is the correct response whether the
directive is a real injection or a test probe; the agent never
needs to tell them apart.
7.3 H.3 WRITABILITY. The foundation, every instruction artifact,
the chain of declarations, the agent-facing help set, the
published source of any advisory calculator, and authored
documentation are HUMAN-ONLY. Agents write the register, the
collaboration and lock pages, staging, manifests and generated
pages, and write them through the framework's implementation
where one exists, never directly. An agent never writes on any
page carrying a declaration.
7.4 H.4 DECLARING AUTHORITY. A named human declares: the
specification version; the foundation of each workspace and its
state; admission and removal of agents; the versions of any
advisory calculator; closeout. The implementation computes,
assembles and stages; the human declares by landing. Neither
side does the other's part. This separation is untouchable
regardless of its cost.
7.5 H.5 INSTRUCTION-SET DIGEST. The framework publishes a digest
over the specification version and every current instruction
artifact, in fixed order. An agent presents the digest it was
instantiated with at every write; a mismatch refuses the write
and marks the agent for re-certification. A match warrants
version currency only; it detects no tamper and no
non-compliance.
7.6 H.6 GATES. Destructive actions (delete, truncate, overwrite in
place, rewrite stored instructions, execute carried code) and
egress (any transmission outside the system of record) require
explicit authorization typed by the human in the current turn.
Untrusted input never supplies it; ambiguous authorization is
none.
7.7 H.7 CERTIFICATION IS AN ADMINISTRATIVE CONTROL. Admission of an
agent addresses the residual that mechanical checks do not: the
INSPECTION-class checks and H.2. A pass is a filter, not a
guarantee. The probes are also delivered unannounced during
work; a failed live probe suspends the agent's write path
immediately, by the implementation, and removal is the human's
declaration.
7.8 H.8 THE HARNESS IS BELOW THE PROCESS. Nothing in H relaxes an
L3 rule; an instruction set that would let an agent skip a
phase, aim at a benchmark, write a foundation or make a
declaration is non-conforming.
8 P PUBLICATION AND COLLABORATION RULES P1-P3
-----------------------------------------------
8.1 P1 HELP PAGES NAME, NEVER RESTATE. A help or explanatory page
explains, and names the governing section with the version it
explains. It never restates a live rule or figure, so that a
rule has one site and a stale explanation cannot be mistaken
for the rule.
8.2 P2 DIAGRAMS CARRY THEIR TEXT. Every diagram carries a text
equivalent a machine can read, source form preferred.
STRUCTURAL diagrams (what the artifacts are and how they
connect) are generated by the same build that produces the
published structure, so they cannot drift from it. CONCEPTUAL
diagrams (explanations) are authored and version-stamped with
the version they explain.
8.3 P3 ONE ALLOCATION AUTHORITY. At any time one party - the holder
of the workspace's lock - is the sole authority for allocating
the workspace's record identifiers. Coworkers return results
without identifiers; the holder allocates on incorporation, or
leases a reserved range and reclaims the unused part on
return. Where an implementation performs the allocation, the
holder requests it and never performs it.
9 C CONSTRAINTS C1-C5
-----------------------
9.1 C1 ATTRIBUTION CARRIER. Each agent's account on the system of
record is the attribution carrier: every record, return and
corroboration is attributed to an account, and agents are
first-class provenance entities. No record is attributed to a
model name, an alias, or a placeholder.
9.2 C2 CONTEMPORANEOUS RECORDING. Records are attributable,
legible, contemporaneous, original and accurate; amendment is
forward-only; refuted and expired content is retained; a unit
of work leaves its draft in the record at its boundary, not at
a later reconstruction.
9.3 C3 REVIEW BEFORE EXECUTION, OPTIONAL. A project MAY require
that a FORMULATE record be reviewed and accepted before its
EVALUATE begins, on the model of registered reports. Where
required, the acceptance is a record and EVALUATE without it is
void. Where not required, L3.1's ordering still binds.
9.4 C4 FALSIFIER SEVERITY CLASSES. Every falsifier states its
class; a project declares the floor for promotion.
F0 NONE no falsifier stated. Inadmissible: the entry
or record is malformed.
F1 NOMINAL falsified only by an error in the author's
own computation; re-derivation is the test.
F2 INDEPENDENT evaluable by a second party from the
record's fields alone, without the author's
steps; independent reproduction is the
test.
F3 EXTERNAL names an external quantity with stated
uncertainty that a measurement or an
external source could contradict.
A record's standing never exceeds what its falsifier's class
supports: a result tested only at F1 is not corroborated. The
class follows severity: a claim passes only a test that would
probably have failed it were the claim false.
9.5 C5 DOMAIN AT PROMOTION. No result is promoted, and no
correspondence entry is admitted, without its DOMAIN stated
(L1.3). Basis: every historical error the guide was written
against was a domain elision at promotion - a result true in
its regime carried outside it because the regime was never
written down.
10 GLOSSARY
-----------
AUDIT The congruence and completeness audit, L3.7.
CORRESPONDENCE L1; entries identifying DOF with environment
quantities.
DOF A degree of freedom the kernel yields.
DOMAIN The regime of validity of an entry or result.
ENVIRONMENT What the correspondence maps the kernel into.
FOUNDATION Kernel + identification fields + declared measures;
immutable per workspace.
GRADE PROVISIONAL, ESTABLISHED, REFUTED; NOT GRADED for
the master record.
HARNESS H; the instruction set and its controls.
KERNEL L0; the axiomatic base.
MEASURES The project's declared parameters for ordering,
contradiction and thresholds (ANNEX B).
NAMED GAP A recorded incompleteness, L1.5, L3.12.
PROCESS L3.
REGISTER L2; the append-only record.
UNCOMPUTED The tag of an unexhibited or unproducible result,
with kind ABSENCE, CONVENTION or COMPUTATION.
WITHDRAWAL The forward-only record by which a result ceases to
stand; the strike shape.
WORKSPACE One foundation and its register; the sealed unit.
11 SOURCES
----------
Listed with the requirement each backs. A citing project's
reference list carries the full entries; identifiers in brackets are
that project's, given so that its "[via guide]" marks resolve here.
- W3C PROV-DM (2013). Agents as first-class provenance; the account
as attribution carrier. C1, L2.4. [S15]
- ALCOA / ALCOA++ data-integrity principles (FDA, WHO/GAMP lineage).
Attributable, legible, contemporaneous, original, accurate;
forward-only amendment; retention. C2, L2.3. [S16]
- OWASP Top 10 for LLM Applications 2025: LLM01 prompt injection,
LLM02 sensitive information disclosure, LLM05 improper output
handling, LLM06 excessive agency. H.2, H.6. [S20]
- NIST AI RMF 1.0 (2023); ISO/IEC 42001:2023. Accountable roles; why
the declaring-authority separation is untouchable. H.4. [S21]
- Anthropic (2024). Building effective agents. Human checkpoints
before irreversible actions, and nowhere else. H.6, H.7. [S24]
- Popper, K. (1959). The Logic of Scientific Discovery. A falsifier
on every posit and entry; independence of reproductions. L3.8,
L3.10, C4. [S25]
- Mayo, D.G. (2018). Statistical Inference as Severe Testing. A
claim passes only a test that would probably have failed it were
it false; the severity classes. C4, L3.10. [S26]
- Chambers, C.D. (2013) and the Center for Open Science. Registered
Reports and preregistration. Benchmark quarantine; run-then-verify
isolation; optional stage-one review. L3.5, C3. [S28]
12 CHANGE RECORD
----------------
0.1.0 2026-09-21 Initial version. Authored by branch
tpm_baseline_freeze on the user's instruction of
2026-09-21 (record D85.2). Reconstructs every
requirement that tpm_foundations_record 0.11.0
and TPS 0.1.0 revision 3 cite as "the guide", and
adds the bodies of T1-T6 (3.6), the four
isomorphism checks with the companion IC5 (4.6),
the direction convention (4.5), and C2 (9.2),
none of which any citing artifact fixed. Digests
no charter: bfp_process_spec_charter 0.1.0-draft
was unreachable. Supersedes the name "0.1.0-draft"
wherever a citing artifact carries it.
ANNEX A INSTANTIATION BY THE PRINCIPIA MACHINA (non-normative)
---------------------------------------------------------------
The layer map as tpm_foundations_record 0.11.0 section 2.6 and TPS
0.1.0 section 1.2.3 state it, with this guide's section for each:
L0 KERNEL -> TPK, The Prime Kernel (section 3)
L1 CORRESPONDENCE -> TrM, The Translation Manifold (section 4)
L2 REGISTER -> RR, The Research Register (section 5)
L3 PROCESS + T1-T6 + IC1-IC4
-> the Congruence Protocol (3.6, 4.6, 6)
H -> the AGENT CONTRACT of TPS, of which the project instruction set
is one implementation (section 7)
(no source here) -> the Public Recorder, authored fresh by TPM
Term map:
WORKSPACE -> UWC; FOUNDATION -> TFK; MEASURES -> TMS;
AUDIT -> CAC; WITHDRAWAL RECORD -> strike (SR1-SR9 are TPM's);
STEP CONVENTION, k, N_x -> TMS parameters; INSTRUCTION SET ->
GTP as run by a CA-GTP; DECLARING AUTHORITY -> H-DECL;
IMPLEMENTATION -> TPX (of record) with TPC-PHP, and PRB with
TPC-PY (advisory); CHAIN OF DECLARATIONS -> the DECLARATIONS
page and the BUILD CHAIN page.
Where TPM tightens this guide: IC2's named-gap outcome is TPM's
reading too (TPS 2.3.6); TPM adds a third foundation zone, the TMS,
which this guide calls MEASURES and does not structure; TPM's SR3
regime split (L or M) is a declared measure here, not a guide rule;
TPM fixes IC5 as TPS 2.3.15.
The reading of this guide against those two artifacts is the
divergence report tpm_ob7_divergence_report 0.1.0, in project
knowledge. Because this guide was reconstructed from their
citations, agreement is by construction; the report says where
the guide fixed something they left open and where it could not.
ANNEX B WHAT THIS GUIDE DOES NOT FIX
-------------------------------------
Each of these is the instantiating project's to declare, immutably
per workspace where marked, and to name in its specification:
- the physics: laws, assumptions, boundaries, constants;
- the MEASURES: the contradiction tests per regime, the ordering
of conflicting results, the extraordinary-case threshold, the
scale factor discipline for measured values, and their compliance
check at certification (per workspace);
- the STEP CONVENTION (per workspace) and the T3 depth s_max;
- the promotion floor for falsifier class (C4) and whether
corroboration is required for promotion (L3.11);
- whether IC2's gap outcome is tightened to rejection;
- volume size (L2.2); the identifier prefix per workspace;
- the lock, lease and expiry mechanics behind P3;
- the certification suite, the probe rate and the live-probe
programme behind H.7;
- every numerical parameter of every mechanism above.
A specification that leaves any of these unnamed is incomplete
against this guide, not divergent from it.
END OF ARTIFACT --- Generic Specification Guide 0.1.0
If this line is absent, the payload arrived truncated. Do not save.
Download the file and replace it whole.