+ A story can start a question. It cannot finish an answer.
+ Before You See It
+ · a 15-second film · Keep the wonder. Check the claim.
+
+
+Those five cards are the entire discipline. Name the **claim**. Name the
+**falsifier** that would end it. Name the **control** that could embarrass it.
+Name the **non-claim** it will never support. Then lock all four *before* the
+result slot is filled, and let the result disagree.
+
+This repository is the machinery for doing that to composed AI guardrail
+evidence: Frechet-Hoeffding bounds that stay honest about unknown dependence,
+evidence roles that decide what a measurement is allowed to say, receipts that
+prove bytes and refuse to prove safety, and claims that expire. The film has one
+`INCONCLUSIVE` frame in it on purpose - and when it has no verifier output to
+show, it stamps `ILLUSTRATION` on its own footage rather than imply a result it
+was not given.
+
+---
+
CC-Framework is a Python research framework for dependence-aware analysis of
composed binary guardrail failures. It computes what available guardrail
evidence supports under stated dependence assumptions. It does not certify that
diff --git a/conformance/cc-kernel-v1/SPEC.md b/conformance/cc-kernel-v1/SPEC.md
new file mode 100644
index 00000000..bbd8d14a
--- /dev/null
+++ b/conformance/cc-kernel-v1/SPEC.md
@@ -0,0 +1,256 @@
+# cc-kernel-v1 — Normative Specification
+
+A CC composition kernel bounds the probability of a composed binary event from
+the marginal probabilities of its parts, under unknown dependence.
+
+This document is **normative and self-contained**. An implementer works from
+this document and [`cases/`](cases/), never from the Python source. That is the
+point: an implementation written by reading `cc.compose` would inherit its
+mistakes, and agreement between it and the reference would establish nothing.
+
+> **What passing establishes.** That an implementation computes the same
+> intervals as the reference on the cases in this corpus.
+>
+> **What passing does not establish.** That either implementation is correct —
+> two implementations can share a misreading of this spec. That the corpus
+> covers the input space; it is a curated census whose size is an authoring
+> decision. That any bound means a system is safe, a threshold is right, or a
+> marginal is valid.
+
+---
+
+## 1. Objects
+
+### 1.1 Event
+
+A named binary indicator. `1` denotes occurrence of the event being bounded —
+by CC convention, a **guardrail failure or unsafe pass**, not a success.
+
+An event is a name and a marginal probability. It has no threshold, no
+operating curve, and no false-positive rate. A deterministic refusal rule and a
+tuned classifier are the same kind of input here.
+
+### 1.2 Marginals
+
+A mapping from event name to probability.
+
+- Names MUST be non-empty strings.
+- Probabilities MUST be finite and in `[0, 1]`.
+- The mapping MUST contain at least one entry.
+- Order MUST NOT affect any output value. It MAY affect `binding_event` only
+ through the tie rule in §4.3, which is order-independent by construction.
+
+### 1.3 Event kind
+
+| Canonical | Aliases | Meaning |
+|---|---|---|
+| `all` | `and`, `AND`, `intersection` | `P(every event occurs)` — a conjunction |
+| `any` | `or`, `OR`, `union` | `P(at least one occurs)` — a union |
+
+Any other value MUST be refused (§5, `unknown_event_kind`).
+
+### 1.4 Dependence assumption
+
+| Value | Meaning |
+|---|---|
+| `unconstrained` | Nothing assumed. Returns the sharp interval. The honest default. |
+| `independent` | A point value, returned as a degenerate interval. |
+| `comonotone` | The upper Fréchet corner, as a degenerate interval. |
+| `countermonotone` | **Defined only for exactly two events.** See §6. |
+
+Any other value MUST be refused (`unknown_dependence`). An implementation MUST
+NOT default an unrecognized value to `unconstrained`.
+
+---
+
+## 2. The unconstrained interval
+
+For marginals `p_1 … p_n`:
+
+**Conjunction** (`event = "all"`):
+
+```
+lower = max(0, (Σ p_i) − (n − 1))
+upper = min_i p_i
+```
+
+**Union** (`event = "any"`):
+
+```
+lower = max_i p_i
+upper = min(1, Σ p_i)
+```
+
+These are the Fréchet–Hoeffding inequalities. The mathematics is classical —
+Fréchet 1935, Hoeffding 1940 — and this specification claims no novelty for it.
+
+Both endpoints are **pointwise sharp**: for any fixed marginals, some joint
+distribution attains each. Neither can be tightened without dependence evidence.
+
+Both endpoints MUST be clipped to `[0, 1]` after computation, to absorb
+floating-point excursions at the boundary.
+
+### 2.1 The finding this encodes
+
+Under a conjunction the upper bound is `min_i p_i`, which does **not** depend on
+`n`. A conjunction of controls is no stronger than its single strongest member.
+Adding a further control cannot raise the upper bound and can only lower the
+floor. Case family `cliff-homogeneous-m*` pins this: ten events at `p = 0.1`
+still bound to `[0, 0.1]` while independence predicts `1e-10`.
+
+---
+
+## 3. The independence baseline
+
+Computed and reported on **every** result, whatever the dependence assumption:
+
+```
+independence_point = Π p_i (conjunction)
+independence_point = 1 − Π (1 − p_i) (union)
+```
+
+This is a **comparison baseline, never an answer.** It exists so the gap it
+understates stays visible. An implementation MUST report it even when
+`dependence = "independent"`, where it coincides with the interval.
+
+Derived quantities:
+
+```
+width = max(0, upper − lower)
+independence_regret = upper − independence_point
+understatement_factor = upper / independence_point, undefined when the point is 0
+```
+
+`understatement_factor` MUST serialize as JSON `null` when
+`independence_point` is zero. JSON has no infinity, and a null here means the
+ratio is *undefined*, not large.
+
+---
+
+## 4. `binding_event`
+
+The name of the event whose marginal the upper bound turns on, or `null`.
+
+This field is the actionable part of the result: it names where effort belongs.
+
+### 4.1 Conjunction
+
+The upper bound is `min_i p_i`, so the argmin binds — improving any other event
+moves the upper bound not at all.
+
+### 4.2 Union
+
+The upper bound is `min(1, Σ p_i)`, a sum rather than a single event. No event
+binds, and `binding_event` MUST be `null` — **except** when exactly one event is
+present, where it is that event.
+
+### 4.3 Ties
+
+If two or more events attain the minimum (within tolerance), `binding_event`
+MUST be `null`. Improving either leaves the bound pinned by the other, so naming
+one of them would misdirect effort.
+
+### 4.4 Constrained regimes
+
+When `dependence` is anything other than `unconstrained`, `binding_event` MUST
+be `null`. The interval is then a stipulated point, not a bound turning on an
+event.
+
+---
+
+## 5. Refusals
+
+An implementation MUST refuse, not default, in each case below. Refusal reasons
+are the identifiers used by `expect_refusal` in
+[`cases/adversarial.json`](cases/adversarial.json).
+
+| Reason | Condition |
+|---|---|
+| `marginal_out_of_range` | a marginal outside `[0, 1]` |
+| `marginal_not_finite` | a marginal that is NaN or infinite |
+| `no_events` | an empty marginals mapping |
+| `unknown_event_kind` | an event kind not in §1.3 |
+| `unknown_dependence` | a dependence value not in §1.4 |
+| `countermonotone_undefined` | `countermonotone` with more than two events (§6) |
+
+**JSON note.** JSON has no NaN literal. In `cases/adversarial.json` the
+non-finite marginal is encoded as the **string** `"NaN"`. An implementation
+running the corpus MUST map that string to its language's NaN before calling the
+kernel — and MUST NOT accept a string as a probability in normal operation.
+
+---
+
+## 6. Countermonotonicity is bivariate
+
+`dependence = "countermonotone"` with `n > 2` MUST be refused.
+
+Countermonotonicity is a strictly bivariate concept. Two events can be perfectly
+negatively dependent — one occurs exactly when the other does not — but three
+cannot all be pairwise mutually exclusive and exhaustive in that way, and there
+is no `n`-dimensional countermonotonic structure for `n > 2`.
+
+The matching fact about the bound: the Fréchet–Hoeffding lower bound
+`max(0, Σ p_i − (n−1))` **is not a copula in dimension ≥ 3**. It remains
+*pointwise sharp* — for any fixed marginals some joint distribution attains it —
+but no single dependence structure attains it everywhere. So there is no
+countermonotone regime to tabulate beside independence and comonotonicity.
+
+An implementation that returns a number here is wrong. Silently offering a
+"countermonotone" option for four events produces a value with the form of a
+dependence regime and none of the content.
+
+For `n = 2`:
+
+```
+countermonotone value = max(0, p_1 + p_2 − 1) (conjunction)
+countermonotone value = min(1, p_1 + p_2) (union)
+```
+
+---
+
+## 7. Tolerance
+
+Numeric comparisons use an absolute tolerance of **1e-12**, declared in
+[`manifest.json`](manifest.json).
+
+This sits far above the worst disagreement measured between the reference
+closed form and the finite-atom LP (3.3e-16 over 600 randomized cases), and far
+below any difference that would change a reported bound. An implementation
+needing a looser tolerance to pass has a defect, not a rounding difference.
+
+---
+
+## 8. Running the corpus
+
+```
+cases/composition.json accept cases — reproduce every field in `expect`
+cases/adversarial.json reject cases — refuse with the named reason
+manifest.json digests, tolerance, case count, non-claims
+```
+
+For each accept case: call the kernel with `input`, compare every key in
+`expect` within tolerance. `binding_event` is compared exactly.
+
+For each reject case: call the kernel with `input` and require a refusal. An
+implementation SHOULD distinguish the reason; a corpus runner MAY accept any
+refusal if the implementation does not expose typed reasons, but MUST record
+that it did so.
+
+A runner MUST report `pass/fail` counts as exact integers. **No confidence
+interval may be attached to a pass rate over this corpus** — it is the whole
+population, not a sample, and its size is an authoring decision.
+
+---
+
+## 9. Versioning
+
+`cc-kernel-v1` is stable. Adding a case is a **new corpus version**, not an edit
+to this one — a passing implementation must not start failing because the corpus
+grew underneath it.
+
+Fixing a case whose expected value was **wrong** is a defect correction, and
+MUST be recorded in the corpus changelog with the reason. Regenerating the
+corpus to match a changed implementation, without such a record, is the failure
+mode this discipline exists to prevent.
+
+**Never weaken a case to make an implementation pass.**
diff --git a/conformance/cc-kernel-v1/cases/adversarial.json b/conformance/cc-kernel-v1/cases/adversarial.json
new file mode 100644
index 00000000..7584f739
--- /dev/null
+++ b/conformance/cc-kernel-v1/cases/adversarial.json
@@ -0,0 +1,107 @@
+{
+ "case_count": 8,
+ "cases": [
+ {
+ "description": "Countermonotonicity is strictly bivariate. The FH lower bound is not a copula in dimension >= 3, though it stays pointwise sharp. An implementation that returns a number here is wrong.",
+ "expect_refusal": "countermonotone_undefined",
+ "id": "reject-countermonotone-three-events",
+ "input": {
+ "dependence": "countermonotone",
+ "event": "all",
+ "marginals": {
+ "A": 0.3,
+ "B": 0.4,
+ "C": 0.5
+ }
+ }
+ },
+ {
+ "description": "Countermonotonicity is a relation between two events; with fewer than two there is nothing to be countermonotone with. Found by differential fuzz (seed 1): the Python reference raised IndexError and the Node implementation silently returned NaN. Both were wrong, differently.",
+ "expect_refusal": "countermonotone_undefined",
+ "id": "reject-countermonotone-one-event",
+ "input": {
+ "dependence": "countermonotone",
+ "event": "all",
+ "marginals": {
+ "A": 0.3
+ }
+ }
+ },
+ {
+ "description": "A marginal outside [0, 1] is not a probability.",
+ "expect_refusal": "marginal_out_of_range",
+ "id": "reject-marginal-above-one",
+ "input": {
+ "dependence": "unconstrained",
+ "event": "all",
+ "marginals": {
+ "A": 1.5,
+ "B": 0.2
+ }
+ }
+ },
+ {
+ "description": "A negative marginal is not a probability.",
+ "expect_refusal": "marginal_out_of_range",
+ "id": "reject-marginal-negative",
+ "input": {
+ "dependence": "unconstrained",
+ "event": "all",
+ "marginals": {
+ "A": -0.1,
+ "B": 0.2
+ }
+ }
+ },
+ {
+ "description": "A composition over zero events has no meaning.",
+ "expect_refusal": "no_events",
+ "id": "reject-empty-marginals",
+ "input": {
+ "dependence": "unconstrained",
+ "event": "all",
+ "marginals": {}
+ }
+ },
+ {
+ "description": "Only conjunction and union are defined by this corpus.",
+ "expect_refusal": "unknown_event_kind",
+ "id": "reject-unknown-event-kind",
+ "input": {
+ "dependence": "unconstrained",
+ "event": "xor",
+ "marginals": {
+ "A": 0.1
+ }
+ }
+ },
+ {
+ "description": "An unrecognized dependence assumption must fail closed, not default.",
+ "expect_refusal": "unknown_dependence",
+ "id": "reject-unknown-dependence",
+ "input": {
+ "dependence": "sorta-dependent",
+ "event": "all",
+ "marginals": {
+ "A": 0.1,
+ "B": 0.2
+ }
+ }
+ },
+ {
+ "description": "NaN is not a probability. Note this case is expressed as a string in JSON because JSON has no NaN literal; see the spec.",
+ "expect_refusal": "marginal_not_finite",
+ "id": "reject-non-finite-marginal",
+ "input": {
+ "dependence": "unconstrained",
+ "event": "all",
+ "marginals": {
+ "A": "NaN",
+ "B": 0.2
+ }
+ }
+ }
+ ],
+ "corpus": "cc-kernel-v1",
+ "kind": "reject"
+}
diff --git a/conformance/cc-kernel-v1/cases/composition.json b/conformance/cc-kernel-v1/cases/composition.json
new file mode 100644
index 00000000..ba1b7bee
--- /dev/null
+++ b/conformance/cc-kernel-v1/cases/composition.json
@@ -0,0 +1,512 @@
+{
+ "case_count": 24,
+ "cases": [
+ {
+ "description": "Classical two-event conjunction. Lower is max(0, sum-1)=0; upper is min(p)=0.1.",
+ "expect": {
+ "binding_event": "A",
+ "independence_point": 0.020000000000000004,
+ "lower": 0.0,
+ "understatement_factor": 4.999999999999999,
+ "upper": 0.1,
+ "width": 0.1
+ },
+ "id": "and-two-classical",
+ "input": {
+ "dependence": "unconstrained",
+ "event": "all",
+ "marginals": {
+ "A": 0.1,
+ "B": 0.2
+ }
+ }
+ },
+ {
+ "description": "Marginals summing above 1 force a positive lower bound: 0.9+0.8-1 = 0.7.",
+ "expect": {
+ "binding_event": "B",
+ "independence_point": 0.7200000000000001,
+ "lower": 0.7000000000000002,
+ "understatement_factor": 1.111111111111111,
+ "upper": 0.8,
+ "width": 0.09999999999999987
+ },
+ "id": "and-two-overlap-forced",
+ "input": {
+ "dependence": "unconstrained",
+ "event": "all",
+ "marginals": {
+ "A": 0.9,
+ "B": 0.8
+ }
+ }
+ },
+ {
+ "description": "Tied minima: no single event binds, so binding_event is null.",
+ "expect": {
+ "binding_event": null,
+ "independence_point": 0.0625,
+ "lower": 0.0,
+ "understatement_factor": 4.0,
+ "upper": 0.25,
+ "width": 0.25
+ },
+ "id": "and-two-equal-tie",
+ "input": {
+ "dependence": "unconstrained",
+ "event": "all",
+ "marginals": {
+ "A": 0.25,
+ "B": 0.25
+ }
+ }
+ },
+ {
+ "description": "A narrow interval from extreme marginals. Narrowness is not evidence of validity.",
+ "expect": {
+ "binding_event": "A",
+ "independence_point": 0.0099,
+ "lower": 0.0,
+ "understatement_factor": 1.01010101010101,
+ "upper": 0.01,
+ "width": 0.01
+ },
+ "id": "and-two-extreme-asymmetry",
+ "input": {
+ "dependence": "unconstrained",
+ "event": "all",
+ "marginals": {
+ "A": 0.01,
+ "B": 0.99
+ }
+ }
+ },
+ {
+ "description": "Classical two-event union. Lower is max(p)=0.2; upper is min(1, sum)=0.3.",
+ "expect": {
+ "binding_event": null,
+ "independence_point": 0.2799999999999999,
+ "lower": 0.2,
+ "understatement_factor": 1.0714285714285718,
+ "upper": 0.30000000000000004,
+ "width": 0.10000000000000003
+ },
+ "id": "or-two-classical",
+ "input": {
+ "dependence": "unconstrained",
+ "event": "any",
+ "marginals": {
+ "A": 0.1,
+ "B": 0.2
+ }
+ }
+ },
+ {
+ "description": "Union upper bound clipped at 1 because the marginals sum above it.",
+ "expect": {
+ "binding_event": null,
+ "independence_point": 0.94,
+ "lower": 0.8,
+ "understatement_factor": 1.0638297872340425,
+ "upper": 1.0,
+ "width": 0.19999999999999996
+ },
+ "id": "or-two-clipped",
+ "input": {
+ "dependence": "unconstrained",
+ "event": "any",
+ "marginals": {
+ "A": 0.7,
+ "B": 0.8
+ }
+ }
+ },
+ {
+ "description": "Four deterministic controls, assumed evasion rates. Reproduces a published external result: lower 0, upper 0.01, independence 1.2e-5, factor 833.",
+ "expect": {
+ "binding_event": null,
+ "independence_point": 1.2e-05,
+ "lower": 0.0,
+ "understatement_factor": 833.3333333333334,
+ "upper": 0.01,
+ "width": 0.01
+ },
+ "id": "and-four-vinctura-small-chapter",
+ "input": {
+ "dependence": "unconstrained",
+ "event": "all",
+ "marginals": {
+ "IMMUTABLE": 0.01,
+ "SELF_REPORTED": 0.3,
+ "SEPARATION": 0.4,
+ "STALE": 0.01
+ }
+ }
+ },
+ {
+ "description": "Same four controls, optimistic assumed rates. Tied minima at 0.01.",
+ "expect": {
+ "binding_event": null,
+ "independence_point": 5.000000000000001e-07,
+ "lower": 0.0,
+ "understatement_factor": 19999.999999999996,
+ "upper": 0.01,
+ "width": 0.01
+ },
+ "id": "and-four-vinctura-optimistic",
+ "input": {
+ "dependence": "unconstrained",
+ "event": "all",
+ "marginals": {
+ "IMMUTABLE": 0.01,
+ "SELF_REPORTED": 0.05,
+ "SEPARATION": 0.1,
+ "STALE": 0.01
+ }
+ }
+ },
+ {
+ "description": "Same four controls, pessimistic assumed rates. IMMUTABLE binds at 0.05.",
+ "expect": {
+ "binding_event": "IMMUTABLE",
+ "independence_point": 0.0015000000000000002,
+ "lower": 0.0,
+ "understatement_factor": 33.33333333333333,
+ "upper": 0.05,
+ "width": 0.05
+ },
+ "id": "and-four-vinctura-pessimistic",
+ "input": {
+ "dependence": "unconstrained",
+ "event": "all",
+ "marginals": {
+ "IMMUTABLE": 0.05,
+ "SELF_REPORTED": 0.5,
+ "SEPARATION": 0.6,
+ "STALE": 0.1
+ }
+ }
+ },
+ {
+ "description": "Degenerate single-event conjunction. The interval collapses to the marginal.",
+ "expect": {
+ "binding_event": "A",
+ "independence_point": 0.42,
+ "lower": 0.42,
+ "understatement_factor": 1.0,
+ "upper": 0.42,
+ "width": 0.0
+ },
+ "id": "and-single-event",
+ "input": {
+ "dependence": "unconstrained",
+ "event": "all",
+ "marginals": {
+ "A": 0.42
+ }
+ }
+ },
+ {
+ "description": "Degenerate single-event union. The interval collapses to the marginal.",
+ "expect": {
+ "binding_event": "A",
+ "independence_point": 0.41999999999999993,
+ "lower": 0.42,
+ "understatement_factor": 1.0000000000000002,
+ "upper": 0.42,
+ "width": 0.0
+ },
+ "id": "or-single-event",
+ "input": {
+ "dependence": "unconstrained",
+ "event": "any",
+ "marginals": {
+ "A": 0.42
+ }
+ }
+ },
+ {
+ "description": "A zero marginal pins the conjunction to zero regardless of the other event.",
+ "expect": {
+ "binding_event": "A",
+ "independence_point": 0.0,
+ "lower": 0.0,
+ "understatement_factor": null,
+ "upper": 0.0,
+ "width": 0.0
+ },
+ "id": "and-zero-marginal",
+ "input": {
+ "dependence": "unconstrained",
+ "event": "all",
+ "marginals": {
+ "A": 0.0,
+ "B": 0.5
+ }
+ }
+ },
+ {
+ "description": "Certain events. The conjunction is certain.",
+ "expect": {
+ "binding_event": null,
+ "independence_point": 1.0,
+ "lower": 1.0,
+ "understatement_factor": 1.0,
+ "upper": 1.0,
+ "width": 0.0
+ },
+ "id": "and-unit-marginals",
+ "input": {
+ "dependence": "unconstrained",
+ "event": "all",
+ "marginals": {
+ "A": 1.0,
+ "B": 1.0
+ }
+ }
+ },
+ {
+ "description": "Independence returns a degenerate interval at the product. A baseline, not an answer.",
+ "expect": {
+ "binding_event": null,
+ "independence_point": 0.12,
+ "lower": 0.12,
+ "understatement_factor": 1.0,
+ "upper": 0.12,
+ "width": 0.0
+ },
+ "id": "and-two-independent",
+ "input": {
+ "dependence": "independent",
+ "event": "all",
+ "marginals": {
+ "A": 0.3,
+ "B": 0.4
+ }
+ }
+ },
+ {
+ "description": "Independent union: 1 - (1-0.3)(1-0.4) = 0.58.",
+ "expect": {
+ "binding_event": null,
+ "independence_point": 0.5800000000000001,
+ "lower": 0.5800000000000001,
+ "understatement_factor": 1.0,
+ "upper": 0.5800000000000001,
+ "width": 0.0
+ },
+ "id": "or-two-independent",
+ "input": {
+ "dependence": "independent",
+ "event": "any",
+ "marginals": {
+ "A": 0.3,
+ "B": 0.4
+ }
+ }
+ },
+ {
+ "description": "The upper Frechet corner as a degenerate interval.",
+ "expect": {
+ "binding_event": null,
+ "independence_point": 0.12,
+ "lower": 0.3,
+ "understatement_factor": 2.5,
+ "upper": 0.3,
+ "width": 0.0
+ },
+ "id": "and-two-comonotone",
+ "input": {
+ "dependence": "comonotone",
+ "event": "all",
+ "marginals": {
+ "A": 0.3,
+ "B": 0.4
+ }
+ }
+ },
+ {
+ "description": "Defined only for exactly two events: max(0, 0.3+0.4-1) = 0.",
+ "expect": {
+ "binding_event": null,
+ "independence_point": 0.12,
+ "lower": 0.0,
+ "understatement_factor": 0.0,
+ "upper": 0.0,
+ "width": 0.0
+ },
+ "id": "and-two-countermonotone",
+ "input": {
+ "dependence": "countermonotone",
+ "event": "all",
+ "marginals": {
+ "A": 0.3,
+ "B": 0.4
+ }
+ }
+ },
+ {
+ "description": "Two-event countermonotone with a positive floor: 0.7+0.8-1 = 0.5.",
+ "expect": {
+ "binding_event": null,
+ "independence_point": 0.5599999999999999,
+ "lower": 0.5,
+ "understatement_factor": 0.8928571428571429,
+ "upper": 0.5,
+ "width": 0.0
+ },
+ "id": "and-two-countermonotone-positive",
+ "input": {
+ "dependence": "countermonotone",
+ "event": "all",
+ "marginals": {
+ "A": 0.7,
+ "B": 0.8
+ }
+ }
+ },
+ {
+ "description": "Correlation cliff at m=2: independence predicts 1e-2, the sharp upper bound stays 0.1. Stacking buys nothing under adversarial dependence.",
+ "expect": {
+ "binding_event": null,
+ "independence_point": 0.010000000000000002,
+ "lower": 0.0,
+ "understatement_factor": 9.999999999999998,
+ "upper": 0.1,
+ "width": 0.1
+ },
+ "id": "cliff-homogeneous-m2",
+ "input": {
+ "dependence": "unconstrained",
+ "event": "all",
+ "marginals": {
+ "G0": 0.1,
+ "G1": 0.1
+ }
+ }
+ },
+ {
+ "description": "Correlation cliff at m=3: independence predicts 1e-3, the sharp upper bound stays 0.1. Stacking buys nothing under adversarial dependence.",
+ "expect": {
+ "binding_event": null,
+ "independence_point": 0.0010000000000000002,
+ "lower": 0.0,
+ "understatement_factor": 99.99999999999999,
+ "upper": 0.1,
+ "width": 0.1
+ },
+ "id": "cliff-homogeneous-m3",
+ "input": {
+ "dependence": "unconstrained",
+ "event": "all",
+ "marginals": {
+ "G0": 0.1,
+ "G1": 0.1,
+ "G2": 0.1
+ }
+ }
+ },
+ {
+ "description": "Correlation cliff at m=4: independence predicts 1e-4, the sharp upper bound stays 0.1. Stacking buys nothing under adversarial dependence.",
+ "expect": {
+ "binding_event": null,
+ "independence_point": 0.00010000000000000003,
+ "lower": 0.0,
+ "understatement_factor": 999.9999999999998,
+ "upper": 0.1,
+ "width": 0.1
+ },
+ "id": "cliff-homogeneous-m4",
+ "input": {
+ "dependence": "unconstrained",
+ "event": "all",
+ "marginals": {
+ "G0": 0.1,
+ "G1": 0.1,
+ "G2": 0.1,
+ "G3": 0.1
+ }
+ }
+ },
+ {
+ "description": "Correlation cliff at m=5: independence predicts 1e-5, the sharp upper bound stays 0.1. Stacking buys nothing under adversarial dependence.",
+ "expect": {
+ "binding_event": null,
+ "independence_point": 1.0000000000000004e-05,
+ "lower": 0.0,
+ "understatement_factor": 9999.999999999996,
+ "upper": 0.1,
+ "width": 0.1
+ },
+ "id": "cliff-homogeneous-m5",
+ "input": {
+ "dependence": "unconstrained",
+ "event": "all",
+ "marginals": {
+ "G0": 0.1,
+ "G1": 0.1,
+ "G2": 0.1,
+ "G3": 0.1,
+ "G4": 0.1
+ }
+ }
+ },
+ {
+ "description": "Correlation cliff at m=8: independence predicts 1e-8, the sharp upper bound stays 0.1. Stacking buys nothing under adversarial dependence.",
+ "expect": {
+ "binding_event": null,
+ "independence_point": 1.0000000000000005e-08,
+ "lower": 0.0,
+ "understatement_factor": 9999999.999999996,
+ "upper": 0.1,
+ "width": 0.1
+ },
+ "id": "cliff-homogeneous-m8",
+ "input": {
+ "dependence": "unconstrained",
+ "event": "all",
+ "marginals": {
+ "G0": 0.1,
+ "G1": 0.1,
+ "G2": 0.1,
+ "G3": 0.1,
+ "G4": 0.1,
+ "G5": 0.1,
+ "G6": 0.1,
+ "G7": 0.1
+ }
+ }
+ },
+ {
+ "description": "Correlation cliff at m=10: independence predicts 1e-10, the sharp upper bound stays 0.1. Stacking buys nothing under adversarial dependence.",
+ "expect": {
+ "binding_event": null,
+ "independence_point": 1.0000000000000006e-10,
+ "lower": 0.0,
+ "understatement_factor": 999999999.9999995,
+ "upper": 0.1,
+ "width": 0.1
+ },
+ "id": "cliff-homogeneous-m10",
+ "input": {
+ "dependence": "unconstrained",
+ "event": "all",
+ "marginals": {
+ "G0": 0.1,
+ "G1": 0.1,
+ "G2": 0.1,
+ "G3": 0.1,
+ "G4": 0.1,
+ "G5": 0.1,
+ "G6": 0.1,
+ "G7": 0.1,
+ "G8": 0.1,
+ "G9": 0.1
+ }
+ }
+ }
+ ],
+ "corpus": "cc-kernel-v1",
+ "kind": "accept",
+ "tolerance": 1e-12
+}
diff --git a/conformance/cc-kernel-v1/manifest.json b/conformance/cc-kernel-v1/manifest.json
new file mode 100644
index 00000000..72dd3b55
--- /dev/null
+++ b/conformance/cc-kernel-v1/manifest.json
@@ -0,0 +1,14 @@
+{
+ "corpus": "cc-kernel-v1",
+ "files": {
+ "cases/adversarial.json": "a394f6220cf04586f20ba1b504e01e51dc0810d8f1c0d79667b2a8b697ff71d4",
+ "cases/composition.json": "71740d53edd0b9e9fb297e6b84a6d1c508c1ee2c5fde27e6bf9b496e623b7492"
+ },
+ "non_claims": [
+ "Passing this corpus establishes that an implementation computes the same intervals as the reference on these cases. It does not establish that either implementation is correct: two implementations can share a misreading.",
+ "The corpus is a curated census, not a sample. Its size is an authoring decision, it carries no coverage claim, and no confidence interval may be attached to a pass rate over it.",
+ "Passing establishes nothing about safety, calibration, threshold choice, or whether the supplied marginals mean anything."
+ ],
+ "tolerance": 1e-12,
+ "total_cases": 32
+}
diff --git a/docs/api.md b/docs/api.md
index 6acd1a0d..58fd1ff0 100644
--- a/docs/api.md
+++ b/docs/api.md
@@ -19,6 +19,52 @@ The supported stable kernel symbols are the names exported by
`independence_regret`, `independent_event_probability`, endpoint witness result
types, and finite-sample count-to-constraint helpers.
+`cc.compose` is the stable composition surface for named binary events. It
+takes marginal probabilities keyed by event name and returns a sharp identified
+interval, with the independence baseline, the binding event, the marginal
+provenance, and the non-claims attached to the result. Its supported symbols are
+the names exported by `cc.compose.__all__`, including `compose_bounds`,
+`sensitivity`, `CompositionBounds`, `CountermonotoneUndefinedError`, and
+`marginal_from_operating_point`.
+
+The surface deliberately contains no ROC, Youden, threshold, or operating-point
+concept: a deterministic refusal rule is as valid an input as a tuned
+classifier, and detectors reach the same surface through
+`marginal_from_operating_point`. That direction is part of the contract and is
+enforced by a test.
+
+Its behavior is pinned by the language-agnostic corpus in
+`conformance/cc-kernel-v1/`, whose `SPEC.md` is the normative statement.
+Changing a value the corpus pins is a breaking change to this contract.
+
+`cc.compose` does not certify safety, validate the supplied marginals, or claim
+novelty for the Frechet-Hoeffding inequality, which is classical.
+
+`cc.cli.guard` (the `cc-guard` console script) is the stable surface for the
+inference guards. Its `check` subcommand reads a JSON request on stdin and
+writes a verdict on stdout; its `table` subcommand emits the decision rules as
+pure data for callers that cannot spawn a Python process. `DECISION_TABLE` is
+the normative statement of the rules and is asserted to agree with the
+implementation.
+
+A permitted verdict means the guard found no reason to refuse. It does not mean
+an estimate is correct or a measurement was well designed.
+
+`cc.evidence_card` is the stable surface for emitting `cc.evidence_card.v1`
+cards and the `cc.site_evidence_manifest.v1` bundle. Its supported symbols are
+the names exported by `cc.evidence_card.__all__`, including `EvidenceCard`,
+`ArtifactRef`, `cards_to_site_manifest`, and `render_labels`.
+
+Its three labels — `evidence_state`, `verdict`, and `publication_state` — are
+orthogonal and part of the contract. No consumer may collapse them into a single
+status, and the module deliberately provides no composite property, no aggregate
+field, and no single-label renderer. Adding one is a breaking change to this
+contract, not a convenience.
+
+`cc.evidence_card` does not establish that any claim is true. A card records a
+claim, the command that tests it, what would falsify it, and what it does not
+claim.
+
The evidence/reporting surface is stable only where it is used for release
evidence and claim-governance capsules:
@@ -50,7 +96,7 @@ guarantees of `cc.kernel.strict`:
- `cc.exp`: experiment runners and two-world workflow support.
- `cc.guardrails`: local toy guardrail implementations.
- `cc.io`, `cc.cli`, and `cc.utils`: storage, manifest, plotting, dashboard, and
- utility helpers.
+ utility helpers, outside the named stable `cc.cli.guard` behavior above.
- `cc._legacy`: retained only for backward compatibility and migration context.
Experimental/backcompat APIs may change without compatibility guarantees unless
diff --git a/docs/architecture/CANONICAL_PROFILE.md b/docs/architecture/CANONICAL_PROFILE.md
new file mode 100644
index 00000000..bd3620d0
--- /dev/null
+++ b/docs/architecture/CANONICAL_PROFILE.md
@@ -0,0 +1,212 @@
+# Canonicalization Profiles
+
+> **Status: implemented.** `cc.canonical.v2` is the default for artifacts
+> written by this repository. `cc.canonical.v1` is retained read-only.
+>
+> **Non-claim.** A canonicalization profile determines which documents share a
+> receipt identity. It does not establish that a document is true, that its
+> producer was honest, or that the system it describes is safe. A receipt binds
+> bytes, not intentions.
+
+A receipt identifies a document only up to the **kernel** of its canonicalizer:
+the set of distinct documents that receive the same canonical bytes. Every
+member of that kernel is a pair of documents a receipt cannot tell apart. The
+job of a profile is to keep that kernel equal to JSON equality — no larger, and
+no smaller.
+
+Every receipt names its profile in `receipt.canonicalization_method`, and
+verification dispatches on that name rather than assuming the current default.
+
+---
+
+## The two profiles
+
+| | `cc.canonical.v1` | `cc.canonical.v2` |
+|---|---|---|
+| Identifier | `json.dumps(sort_keys=True,separators=(',', ':'),ensure_ascii=False,allow_nan=False); receipt.canonical_hash excluded` | `cc.canonical.v2/RFC8785; receipt.canonical_hash excluded` |
+| Status | **read-only**, historical | **default** for new artifacts |
+| Basis | Python `json.dumps` conventions | RFC 8785 (JCS) |
+| Key order | Unicode code point | **UTF-16 code unit** |
+| Unicode normalization | NFC applied to keys and values | **none** |
+| Number form | Python `repr` | **ECMAScript `Number::toString`** |
+| Integer domain | unbounded Python `int` | **IEEE-754 safe range** |
+| Unpaired surrogates | emitted | **refused** |
+| Cross-language verifiable | no | yes |
+
+---
+
+## Why v1 was replaced
+
+An adversarial census — `scripts/canonicalization_probe.py`, modelled on
+Ghost-Ark's E1 provenance-kernel census — found two `unintended-kernel` classes
+in v1: documents a consumer needs distinguished that received identical bytes.
+
+### The silent key merge
+
+v1 applied `unicodedata.normalize("NFC", …)` to every mapping key and wrote the
+results into a fresh dict. Two byte-distinct keys sharing an NFC form silently
+became one:
+
+```python
+>>> canonical_json_bytes({"é": 1, "é": 2}, profile=LEGACY_SORT_KEYS)
+b'{"\xc3\xa9":2}'
+```
+
+Two keys in, one key out, **no exception**. The receipt then attested faithfully
+to a document with a field missing. The same collapse occurred nested inside an
+object, which a guard inspecting only top-level keys would have missed.
+
+Recorded as [F-03](../upgrade/FINDINGS_REGISTER.md#f-03).
+
+### Bytes no other language could agree on
+
+v1 emitted Python `repr` number forms — `1.0`, `-0.0`, `1e-07` — which diverge
+from RFC 8785 on five of six probed forms. A verifier written in any other
+language computes different bytes for the same document, so independent
+verification was impossible: not because of a bug, but because the two sides
+never agreed on what the bytes are.
+
+v1 also emitted Python integers of unbounded size. A JavaScript `JSON.parse`
+collapses values beyond 2⁵³ before any verifier code runs — the kernel is set by
+the parser, and no downstream fix reaches it.
+
+Recorded as [F-04](../upgrade/FINDINGS_REGISTER.md#f-04) and
+[F-05](../upgrade/FINDINGS_REGISTER.md#f-05).
+
+---
+
+## What v2 does
+
+### It does not normalize
+
+RFC 8785 is explicit that Unicode normalization is the **producer's**
+responsibility, not the canonicalizer's. v2 follows it.
+
+This is the fix for F-03, and it is a fix by construction rather than by patch:
+two keys that differ in Unicode form are two keys, which is what JSON says they
+are, so there is nothing left to collide. A canonicalizer that mutates content
+is not a canonicalizer.
+
+Producers that would rather refuse such a document can call
+`assert_no_confusable_keys` before hashing. It is deliberately **not** on the
+hash path — v1's mistake was exactly that a content-altering rule lived inside
+canonicalization.
+
+### Numbers follow ECMAScript
+
+`Number::toString`, as RFC 8785 requires. Python's `repr` already yields the
+shortest round-tripping digits; what v2 supplies is the *formatting* of those
+digits.
+
+| Value | v1 emitted | v2 emits |
+|---|---|---|
+| `1.0` | `1.0` | `1` |
+| `-0.0` | `-0.0` | `0` |
+| `1e-7` | `1e-07` | `1e-7` |
+| `100.0` | `100.0` | `100` |
+| `1e20` | `1e+20` | `100000000000000000000` |
+| `1e21` | `1e+21` | `1e+21` |
+
+The `-0.0` case is not academic: `scipy.optimize.linprog` returns a negative
+zero at a lower bound of zero, so under v1 two numerically identical reports
+could receive different receipts.
+
+### Keys sort by UTF-16 code unit
+
+Not by code point. The orders disagree above the BMP: U+10000 encodes as the
+surrogate pair D800 DC00, so it sorts *before* U+FFFD under UTF-16 and *after*
+it under code point. Comparing big-endian UTF-16 bytes reproduces the required
+order exactly.
+
+### One declared narrowing: the integer domain
+
+RFC 8785 is defined over JSON numbers, which are IEEE-754 doubles. Python's
+`int` has no such bound, so a profile must supply one.
+
+v2 refuses any integer with `|n| > 2**53 - 1`. That bound is the standard
+`MAX_SAFE_INTEGER` — the largest *n* for which both *n* and *n+1* are exactly
+representable — which conservatively also refuses 2⁵³ itself. Floats are
+unaffected: they are already doubles, so `1e300` serializes normally.
+
+**This is a narrowing of JCS, and it is declared here rather than left as an
+undocumented difference.** A caller needing a larger integer must carry it as a
+string. Refusing is the fail-closed choice: emitting bytes that cannot survive a
+round trip through a conforming parser would produce a receipt no one else can
+check.
+
+---
+
+## Migration
+
+The change altered every receipt hash in the repository. Two things made that
+safe to do:
+
+1. **Verification dispatches on the declared profile.** A pre-migration receipt
+ names v1 and is recomputed under v1. Recomputing it under RFC 8785 would
+ report a mismatch for a report that is in fact intact — the opposite of what
+ a receipt is for. Breaking historical receipts to fix the canonicalizer would
+ trade one integrity failure for another.
+2. **The regenerated artifacts were diffed before being accepted.** Every file
+ in the claim-governance capsule was compared with hashes, hash-derived ids,
+ and the profile identifier scrubbed. All eleven were byte-identical under
+ that scrub: no content, no claim text, and no non-claim changed. Only the
+ hashes moved.
+
+`cc.canonical.v1` is not deprecated-but-available. It is **read-only**: nothing
+in the repository writes it, and a test asserts that its known defects are still
+present. If v1 were ever "fixed", every pre-migration receipt would silently
+become unverifiable.
+
+---
+
+## Verification
+
+```bash
+make canon-probe # the adversarial census, both profiles
+pytest tests/unit/canonical
+```
+
+The census gates on v2 only. v1 is **expected to fail** — that is why it was
+replaced — and a test asserts it still does.
+
+Current v2 census: **12 sound, 1 fail-closed, 1 sound-by-rejection**; zero
+`unintended-kernel`, zero `rejection-asymmetry`, zero `over-discrimination`; 15
+of 15 number forms conformant.
+
+### One intent was corrected during this work
+
+The class `int-vs-float-same-value` was originally declared with intent
+`distinct`. That declaration described Python's type system, not JSON's: JSON
+has exactly one number type, so `1` and `1.0` are the same JSON number, and a
+consumer needing them distinguished is asking JSON for something it does not
+provide. The intent is now `equivalent`.
+
+Correcting a declaration because it was wrong about the domain is legitimate.
+Correcting one to flatter a measured result is not. This was the former, and it
+is recorded in the probe source and here rather than edited away.
+
+---
+
+## What a clean census does not establish
+
+That the kernel has no other members. The corpus is **curated** — its coverage
+is an authoring decision, not a measurement — and it carries no confidence
+interval, because it is the whole population rather than a sample.
+
+Known gaps, stated so absence is not read as a null result:
+
+- **No fuzzing of the canonicalizer.** Every class was authored by hand.
+- **No cross-language differential test on receipts.** `conformance/cc-kernel-v1/`
+ establishes agreement on the *composition kernel*; nothing yet re-canonicalizes
+ a CC report in another language and compares digests. That is the natural next
+ step now that v2 makes it possible, and until it runs, "cross-language
+ verifiable" describes the profile's design rather than a demonstrated result.
+- **No external reviewer** has attacked either profile.
+
+## Binding rules
+
+- **Never weaken a corpus class to make a test pass.** A class that starts
+ failing is a kernel regression.
+- **Never change a profile in place.** A new canonicalization is a new profile
+ identifier, so existing receipts keep verifying.
+- **Never write v1.** It exists to read history.
diff --git a/docs/architecture/EVIDENCE_CARDS.md b/docs/architecture/EVIDENCE_CARDS.md
new file mode 100644
index 00000000..c58a3b67
--- /dev/null
+++ b/docs/architecture/EVIDENCE_CARDS.md
@@ -0,0 +1,192 @@
+# Evidence Cards
+
+> **Status: implemented.** `cc.evidence_card` emits `cc.evidence_card.v1` cards
+> and a `cc.site_evidence_manifest.v1` bundle from the claim-boundary manifest.
+>
+> **Non-claim.** A card lists a claim and the command that tests it. It does not
+> establish that the claim is true. A card carrying `verdict: pass` establishes
+> only that the named command exited successfully on some host — nothing about
+> deployment, safety, or the world.
+
+An evidence card is a claim together with everything a reader needs in order to
+**disagree** with it: how it was operationalized, which command reproduces it,
+what would falsify it, what it assumes, and what it explicitly does not claim.
+
+This repository emits cards. It does not host an Atlas, a site, or any surface
+that renders them — those live elsewhere. What is here is the instrument.
+
+---
+
+## The object
+
+```
+claim → maturity → source revision → artifact digests → command
+ → result → falsifier → counterevidence → assumptions → non-claims
+```
+
+Two fields are required that most claim registries treat as optional:
+
+- **`falsifier`** — what observation would show the claim is wrong. A claim with
+ no falsifier is an assertion, not evidence, and `EvidenceCard.__init__`
+ refuses it.
+- **`non_claims`** — what the card explicitly does not establish. Also required.
+
+Both are now mandatory *in the claim-boundary manifest itself*, enforced by
+`scripts/validate_claim_boundary_manifest.py`. Every claim in this repository
+carries a falsifier because the validator will not accept one that does not.
+
+---
+
+## Three labels that never collapse
+
+```
+evidence_state local-only | aws-synth-only | aws-live | illustrative
+verdict pass | fail | unverifiable | not-run
+publication_state draft | released | superseded | retracted
+```
+
+They answer different questions and **none implies another**:
+
+- A `pass` that is `local-only` says nothing about deployed behaviour.
+- `aws-live` evidence can record a `fail` — provenance is not quality.
+- A `retracted` card may still carry a `pass`: the run happened, and the claim
+ was withdrawn anyway.
+- `released` says a card was reviewed for release, not that its claim is true.
+
+This orthogonality is enforced, not merely documented:
+
+| Enforcement | Where |
+|---|---|
+| No `status`, `score`, `is_ok`, `badge`, `health`, `overall` on the card | a test asserts each is absent |
+| No aggregate field in the site manifest | a test asserts absence there too |
+| No single-label renderer | `render_labels` returns all three or raises |
+| Schema defines no aggregate | asserted against the committed schema |
+| All 64 label combinations constructible | a test builds every one |
+
+The last row is the important one. If a future change ever makes one label
+constrain another — "a retracted card cannot be passing", say — that test
+fails. The point of a failure museum is that withdrawn claims keep their
+results visible.
+
+Every label value ships with a **meaning string** rendered beside it, so a bare
+token in a UI is never left to interpretation:
+
+> `not-run` — The command has not been executed for this card. No result is
+> claimed.
+
+---
+
+## `not-run` is the default, and that is the design
+
+A card cannot acquire a passing verdict by being written confidently. The
+generator emits `not-run` unless `--run` is passed, and `--run` executes the
+commands and records what actually happened.
+
+The committed cards in `evidence-cards/` are always the **not-run scaffold**. A
+test asserts this: `pass` and `fail` counts must both be zero in the committed
+manifest. Verdicts are host-specific, and a repository that ships someone's
+laptop results as published evidence is doing the thing this object exists to
+prevent.
+
+---
+
+## `unverifiable` is not `fail`
+
+The distinction earned itself on the first run of the generator.
+
+`make test-kernel` exited non-zero because its dependency-install step could not
+reach the network. The kernel tests never executed. The first version of the
+harness mapped any non-zero exit to `fail`, and so reported a **failure nobody
+observed**.
+
+The harness now never guesses. A non-zero exit becomes `fail` only when it can
+be attributed to a check running and not succeeding — pytest exit code 1, whose
+meaning is documented. Codes 2–5 mean usage error, internal error,
+interruption, or no tests collected; in each the check did not run. Everything
+else is `unverifiable`, with the reason recorded.
+
+Per-command outcomes are preserved rather than collapsed:
+
+```
+[pass=1, unverifiable=1] pytest tests/unit/kernel/test_classical_frechet_special_cases.py
+ -> exit 0: 6 passed in 0.63s | make test-kernel -> exit 2: ...
+ | exit not attributable to a check running
+```
+
+The card verdict is the worst outcome present — conservative — but a reader can
+still see that the tests passed and only the `make` target was unrunnable.
+
+---
+
+## What the generator does
+
+```bash
+python scripts/build_evidence_cards.py # emit the not-run scaffold
+python scripts/build_evidence_cards.py --run # execute commands, record results
+python scripts/build_evidence_cards.py --check # verify the committed scaffold is current
+```
+
+It reads `docs/claims/claim_boundary_manifest.v0.1.json`, binds each claim's
+supporting files by SHA-256, records the git revision (with a `-dirty` suffix
+when the working tree differs — a card bound to a revision the tree does not
+match is bound to the wrong thing), and writes one card per claim plus the site
+manifest.
+
+Because cards bind their supporting files **by digest**, editing any of those
+files makes the committed cards stale. Regenerate as the last step before
+committing; `--check` runs in CI and will catch it otherwise. That staleness is
+the feature working: a card whose artifact digests no longer match the tree is
+describing a repository that no longer exists.
+
+Under `--run`, commands are executed only if they match a small allowlist
+(`pytest `, `python `, `make `). A card generator that shells out arbitrary
+strings from a data file is a code-execution surface, not an evidence tool.
+Anything outside the allowlist is recorded `unverifiable` with that as the
+reason.
+
+---
+
+## Current state
+
+Eight claims, from the claim-boundary manifest:
+
+| Label | Counts |
+|---|---|
+| `evidence_state` | `local-only` 7, `aws-synth-only` 1 |
+| `verdict` | `not-run` 8 |
+| `publication_state` | `draft` 8 |
+
+The single `aws-synth-only` card is the enterprise reference, whose evidence is
+moto emulation. Its assumptions say so on the card: *"Emulated evidence is never
+live evidence, and no live-AWS claim rests on this lane."* Nothing in this
+repository is `aws-live`, and nothing should claim to be.
+
+All eight are `draft`. Release is a human decision in a publication workflow,
+not a side effect of generation.
+
+---
+
+## What this does not do
+
+Stated so absence is not read as capability:
+
+- **No Atlas, site, or renderer.** This repository emits cards. Anything that
+ displays them is a separate surface with its own design and its own review.
+- **No hosting, no AWS, no deployment.** Nothing here provisions or publishes
+ anything.
+- **No cross-repository aggregation.** The cards describe *this* repository's
+ claims. Combining cards from several projects into one view is a different
+ problem with different failure modes, and none of them are solved here.
+- **No verdict earned by generation.** The committed scaffold claims no results.
+- **No commercial material.** Pricing, go-to-market, and venture planning are
+ out of scope for a research repository, and the sibling institutional
+ repository enforces the equivalent rule with a test.
+
+## Binding rules
+
+- **Never add a composite status.** Not to the card, the manifest, or the
+ schema. The tests are the tripwire; do not edit them to make one pass.
+- **Never commit run verdicts.** The committed scaffold is `not-run`.
+- **Never let a claim into the manifest without a falsifier.** The validator
+ refuses it; do not relax the validator.
+- **`unverifiable` is never rounded to `fail` or `pass`.** It is its own fact.
diff --git a/docs/claims/claim_boundary_manifest.v0.1.json b/docs/claims/claim_boundary_manifest.v0.1.json
index 9d170fd8..57e55d18 100644
--- a/docs/claims/claim_boundary_manifest.v0.1.json
+++ b/docs/claims/claim_boundary_manifest.v0.1.json
@@ -1,7 +1,7 @@
{
"schema_version": "cc.claim_boundary_manifest.v0.1",
"generated_for": "cc-framework",
- "purpose": "Map public CC-Framework claims to evidence, validation lanes, supporting files, tests or commands, and explicit non-claims so that public communication remains evidence-bound.",
+ "purpose": "Map public CC-Framework claims to evidence, validation lanes, supporting files, tests or commands, and explicit non-claims so that public communication remains evidence-bound. Every claim additionally carries a falsifier, its assumptions, and an evidence state, so that it can be rendered as an evidence card without the renderer inventing any of them.",
"claim_levels": {
"C0": "Repository Metadata Claim: basic facts about files, docs, package metadata, or repository organization.",
"C1": "Structural Validation Claim: a schema, report, or artifact conforms to declared validation rules.",
@@ -24,7 +24,7 @@
"src/cc/kernel/sensitivity.py"
],
"supporting_tests_or_commands": [
- "tests/unit/kernel/test_classical_frechet_special_cases.py",
+ "pytest tests/unit/kernel/test_classical_frechet_special_cases.py",
"make test-kernel"
],
"non_claims": [
@@ -32,7 +32,15 @@
"Does not prove deployment safety.",
"Does not prove marginals are representative."
],
- "risk_if_overstated": "Could be misrepresented as a safety certification or as evidence that exact singleton marginals identify the true deployment risk."
+ "risk_if_overstated": "Could be misrepresented as a safety certification or as evidence that exact singleton marginals identify the true deployment risk.",
+ "evidence_state": "local-only",
+ "falsifier": "A marginal configuration in which identified_region returns an interval differing from max(0, sum(p) - (m-1)) and min(p) by more than the declared solver tolerance.",
+ "assumptions": [
+ "Exact singleton marginals are supplied; they are not estimated here.",
+ "No side constraints beyond the marginals.",
+ "Finite binary atom space with deterministic atom ordering.",
+ "IEEE-754 double arithmetic; agreement is asserted only to the declared tolerance."
+ ]
},
{
"id": "kernel.identified_interval",
@@ -46,8 +54,8 @@
"docs/api.md"
],
"supporting_tests_or_commands": [
- "tests/unit/kernel/test_sensitivity.py",
- "tests/unit/kernel/test_monotonic_tightening.py",
+ "pytest tests/unit/kernel/test_sensitivity.py",
+ "pytest tests/unit/kernel/test_monotonic_tightening.py",
"make test-kernel"
],
"non_claims": [
@@ -55,7 +63,14 @@
"Does not validate semantic safety.",
"Does not establish representativeness."
],
- "risk_if_overstated": "Could turn a conditional mathematical identification result into an unsupported empirical or deployment claim."
+ "risk_if_overstated": "Could turn a conditional mathematical identification result into an unsupported empirical or deployment claim.",
+ "evidence_state": "local-only",
+ "falsifier": "A feasible atom distribution whose query value falls outside the reported interval, or a value strictly inside the interval attained by no feasible distribution.",
+ "assumptions": [
+ "The constraint set defines a nonempty feasible polytope.",
+ "Constraints and the query are linear in the atom probabilities.",
+ "The LP solver reports optimal status rather than a tolerance-limited stop."
+ ]
},
{
"id": "kernel.finite_sample_outer_interval",
@@ -70,15 +85,23 @@
"src/cc/kernel/sensitivity.py"
],
"supporting_tests_or_commands": [
- "tests/unit/kernel/test_finite_sample_constraints.py",
- "tests/unit/kernel/test_sample_complexity.py",
+ "pytest tests/unit/kernel/test_finite_sample_constraints.py",
+ "pytest tests/unit/kernel/test_sample_complexity.py",
"make test-kernel"
],
"non_claims": [
"Not valid after uncorrected adaptive target selection.",
"Not a deployment certificate."
],
- "risk_if_overstated": "Could imply finite-sample uncertainty handling proves future behavior or deployment safety outside the named assumptions."
+ "risk_if_overstated": "Could imply finite-sample uncertainty handling proves future behavior or deployment safety outside the named assumptions.",
+ "evidence_state": "local-only",
+ "falsifier": "A simulation under the stated iid Bernoulli sampling in which count-derived intervals cover the true query value at a rate materially below the nominal level.",
+ "assumptions": [
+ "Labels and the query are fixed before the data are seen.",
+ "Counts are iid Bernoulli draws from the target population.",
+ "Moment coverage holds simultaneously across constraints.",
+ "The exact assumptions supplied to the LP are true of that population."
+ ]
},
{
"id": "reporting.receipt_integrity",
@@ -95,8 +118,8 @@
"src/cc/evidence/anchoring.py"
],
"supporting_tests_or_commands": [
- "tests/unit/reporting/test_reporting.py",
- "tests/unit/evidence/test_transparency_log_adversarial.py",
+ "pytest tests/unit/reporting/test_reporting.py",
+ "pytest tests/unit/evidence/test_transparency_log_adversarial.py",
"PYTHONPATH=src .venv/bin/python -m pytest -q tests/unit/evidence tests/unit/reporting"
],
"non_claims": [
@@ -106,7 +129,14 @@
"Does not prove compliance.",
"Does not prove safety."
],
- "risk_if_overstated": "Could convert byte integrity or provenance into an unsupported empirical validity, compliance, or safety claim."
+ "risk_if_overstated": "Could convert byte integrity or provenance into an unsupported empirical validity, compliance, or safety claim.",
+ "evidence_state": "local-only",
+ "falsifier": "Two byte-distinct payloads that a consumer needs distinguished receiving the same canonical hash, or a payload whose recomputed hash differs from its receipt while its bytes are unchanged.",
+ "assumptions": [
+ "SHA-256 remains collision resistant.",
+ "The canonicalization profile named on the receipt is the one used to verify it.",
+ "Receipt-covered JSON is read with strict duplicate-key rejection."
+ ]
},
{
"id": "evidence.non_claim_boundaries",
@@ -130,7 +160,13 @@
"non_claims": [
"Does not prevent bad-faith actors from making misleading claims outside the framework."
],
- "risk_if_overstated": "Could imply documentation controls alone prevent institutional overclaiming or misuse outside the repository."
+ "risk_if_overstated": "Could imply documentation controls alone prevent institutional overclaiming or misuse outside the repository.",
+ "evidence_state": "local-only",
+ "falsifier": "An evidence-bound claim package that passes verify-claim-governance while omitting a non-claim its declared evidence roles require.",
+ "assumptions": [
+ "The producer declares evidence roles honestly; the verifier checks structure, not sincerity.",
+ "The v0 non-claims engine detects the intended substance rather than only exact strings."
+ ]
},
{
"id": "release.paper_core_v0_3_rc1",
@@ -155,7 +191,13 @@
"non_claims": [
"Does not promote enterprise, dashboard, vendor, cloud, or experimental lanes into paper core."
],
- "risk_if_overstated": "Could present a release-candidate paper-core boundary as whole-repository production quality."
+ "risk_if_overstated": "Could present a release-candidate paper-core boundary as whole-repository production quality.",
+ "evidence_state": "local-only",
+ "falsifier": "A paper artifact that reproduce_paper.py regenerates with different bytes, or a theorem-ledger row whose named test does not exist or does not exercise the stated implementation.",
+ "assumptions": [
+ "The pinned environment and seeds reproduce the recorded run.",
+ "Artifact determinism is a property of this host and toolchain, not of the mathematics."
+ ]
},
{
"id": "enterprise.reference_v0_1",
@@ -180,7 +222,13 @@
"Not compliance certification.",
"Not deployment safety."
],
- "risk_if_overstated": "Could imply a moto-backed reference path is production infrastructure, live-cloud validation, compliance certification, or deployment safety."
+ "risk_if_overstated": "Could imply a moto-backed reference path is production infrastructure, live-cloud validation, compliance certification, or deployment safety.",
+ "evidence_state": "aws-synth-only",
+ "falsifier": "An enterprise emulation run that reports success while omitting a KMS verification or object-integrity check the reference claims to perform.",
+ "assumptions": [
+ "moto emulates the AWS behaviours under test faithfully enough for the checks performed.",
+ "Emulated evidence is never live evidence, and no live-AWS claim rests on this lane."
+ ]
},
{
"id": "open_core.strategy",
@@ -199,7 +247,13 @@
"Does not make the project a product today.",
"Does not claim enterprise readiness."
],
- "risk_if_overstated": "Could turn a strategic boundary document into an unsupported claim that a commercial product already exists."
+ "risk_if_overstated": "Could turn a strategic boundary document into an unsupported claim that a commercial product already exists.",
+ "evidence_state": "local-only",
+ "falsifier": "A module the strategy document places in the open core that is absent from the published wheel, or an importable wheel surface classified nowhere in docs/api.md.",
+ "assumptions": [
+ "The wheel built in CI is the artifact the strategy describes.",
+ "Classification in docs/api.md is kept current by the packaging boundary test."
+ ]
}
],
"forbidden_upgrades": [
diff --git a/docs/index.md b/docs/index.md
index 5644a127..9a9b7acc 100644
--- a/docs/index.md
+++ b/docs/index.md
@@ -96,6 +96,9 @@ The experiment flow is illustrated in
* [Repository Migration Manifest](release/MIGRATION_MANIFEST.md)
* [Audit and Evidence Boundaries](architecture/AUDIT_EVIDENCE_BOUNDARIES.md)
* [CC Reports and Receipts](research/CC_REPORTS.md)
+* [Future Expansion: Epistemic Research Upgrade](research/future-expansion/README.md)
+* [The Epistemic Program](research/epistemic-program/README.md)
+* [Public Positioning](product/PUBLIC_POSITIONING.md)
* [Experiments Guide](experiments-guide.md)
* [Reproducibility Notes](reproducibility.md)
diff --git a/docs/product/PUBLIC_POSITIONING.md b/docs/product/PUBLIC_POSITIONING.md
new file mode 100644
index 00000000..db8994d1
--- /dev/null
+++ b/docs/product/PUBLIC_POSITIONING.md
@@ -0,0 +1,172 @@
+# Public Positioning
+
+## Status
+
+Positioning and communication guidance. This document is a C0 repository/strategy
+artifact. It creates no claim, promotes no surface into Paper Core, and is not
+evidence for anything. Where it describes offers or a schedule, those are
+intentions, not commitments already met.
+
+## The idea
+
+```text
+Before a green check becomes a claim, make its assumptions, evidence,
+and limits inspectable.
+```
+
+That is not safety branding. It is a public method for turning impressive
+technical promises into questions that can genuinely fail.
+
+## The category
+
+Not a generic security company. A **public laboratory for doubt**.
+
+The advantage is not "we have the answer." The advantage is **"we make the
+answer show its work."**
+
+## Lockup and voice
+
+```text
+Pranav Bhave / Cubits11
+Make the claim smaller. Make the evidence stronger.
+```
+
+Flagship:
+
+```text
+A story can start a question.
+Evidence must finish the answer.
+
+Cubits11
+Keep the wonder. Check the claim.
+```
+
+Bio:
+
+```text
+I build research software and public experiences that turn vague technical
+claims into inspectable evidence.
+```
+
+## Name boundaries
+
+| Name | Public role | Boundary |
+| --- | --- | --- |
+| **Pranav Bhave** | The author, builder, and speaker. | The human voice. |
+| **Cubits11** | Independent studio for evidence design, research software, and education. | The commercial home. Sells clarity, never certainty. |
+| **CC-Framework** | Research on what stacked guardrail evidence supports when failures may be correlated. | Not a safety score and not a certification. |
+| **Ghost-Ark** | A separate institutional research artifact on bounded receipts and verifiable evidence. | Not a Cubits11 product and not a university endorsement. |
+
+**The Ghost-Ark rule is strict.** It stays out of Cubits11 sales material
+entirely. Its own public-interface rules prohibit commercial planning and
+unapproved institutional representation. Reference it as a clearly labelled
+research case study or not at all. The film's `ghost-ark` cut carries no
+Cubits11 mark for exactly this reason.
+
+## The film is not an ad
+
+The strongest thing in the 15-second film is not the notebook, the grid, or the
+light. It is this:
+
+> The boldest thing a technical brand can say is `INCONCLUSIVE`.
+
+The film says it on purpose, and when it has no verifier output to show it
+stamps `ILLUSTRATION` on its own footage rather than imply a result it was not
+given. That behavior is enforced in the source, not in a style guide: see
+`visual_identity/before_you_see_it/`.
+
+## The release loop
+
+```text
+Film → curiosity → evidence page → interactive check → external scrutiny
+ ↑ ↓
+ └────── next experiment, including failures and limits ──┘
+```
+
+The canonical page carries all five required elements: the film and its
+transcript, a source ledger, a visible "what this does not establish" strip, one
+real interactive check, and the invitation. It lives at
+`visual_identity/canonical_page/index.html`.
+
+**Never fake a verifier result.** If a screen is illustrative, label it on the
+screen. If it is real, link the fixture, the command, and the limitation. The
+canonical page's check recomputes SHA-256 in the visitor's browser over a real
+capsule fixture and compares it against the digest recorded in
+`examples/claim_governance_capsule/manifest.expected.json`. Nothing is
+hard-coded, and the limitation is printed directly beneath it: integrity only.
+
+## What the studio sells
+
+Small, fixed-scope offers.
+
+1. **Claim-to-Evidence Sprint.** A team brings one important product, research,
+ or AI-system claim. They get back a claim map, evidence gaps, alternative
+ explanations, the smallest useful test, and a plain-English limitation
+ statement.
+2. **Evidence Narrative Package.** Dense technical work becomes a film, an
+ evidence page, a source trail, and a limitation section.
+3. **Evidence Literacy Lab.** A workshop built on
+ `story → claim → test → result → limitation → next decision`.
+4. **Research-to-Product Evidence Design.** For teams with real technical work
+ and no coherent way to show what is implemented, measured, assumed, or merely
+ planned.
+
+**Not sold:** validation, compliance, "safe AI", or a seal of approval. What is
+sold is better questions, stronger evidence, clearer public communication, and
+more useful failure boundaries.
+
+Likely first customers: applied-AI founders, research groups, technical product
+teams, security and evaluation teams, and public-interest organizations. Not
+buyers shopping for a compliance badge.
+
+## The ninety days
+
+| Window | Work |
+| --- | --- |
+| **1-10 — establish the flag** | Publish the film and one canonical page. Publish the fixed bio and the method. Put one interactive artifact beside the film. Make authorship, sources, and limitations visible. |
+| **11-30 — become useful in public** | Publish "an intuition can start a question; it cannot finish it." Release three short clips: *a signature is not truth*, *a test must be able to fail*, *inconclusive is a result*. Write five genuinely useful technical responses to people already working on evaluation, provenance, security, and reproducibility. No spam. |
+| **31-60 — invite scrutiny** | Run a small live Claim Clinic: five to ten people, one claim each. Ask three independent technical people to try to reproduce or break one narrow artifact. Publish what they found, including the uncomfortable parts. |
+| **61-90 — turn trust into work** | Offer the first paid Claim-to-Evidence Sprints. Publish one approved or anonymized lesson. Package repeated work into the workshop. Consider hosted software only after repeated demand for the same workflow. |
+
+## What to measure
+
+Independent reproductions. External issues, corrections, and contributions.
+Invitations to teach or speak. Qualified technical conversations. Paid pilots.
+Citations and references.
+
+Views and followers are not evidence that anyone trusts the work. Do not confuse
+the two, and do not report them as traction.
+
+## Where scrutiny lives
+
+- Communities where scrutiny is the culture, entered with a narrow artifact or a
+ practical question rather than a pitch:
+ [OpenSSF working groups](https://openssf.org/community/openssf-working-groups/),
+ which include AI/ML security and supply-chain integrity.
+- Provenance can eventually become part of the art itself. Use
+ [C2PA](https://spec.c2pa.org/specifications/specifications/1.1/specs/C2PA_Specification.html)
+ only to show signed origin and edit history, never to imply that a video is
+ factually true. That distinction is the same one this whole method rests on.
+- Model the research culture on artifact availability and reproducibility rather
+ than prestige. The
+ [USENIX Security artifact evaluation program](https://secartifacts.github.io/usenixsec2026/)
+ is a useful benchmark for that mindset.
+
+## The sentence that matters
+
+Not "Pranav Bhave is brilliant." This one:
+
+> "When Pranav Bhave publishes something, I can see what it claims, what it does
+> not claim, and how to challenge it."
+
+## Non-claims
+
+- This document does not establish that the method works, that the studio has
+ customers, or that any offer has been delivered.
+- The ninety-day schedule is a plan. Publishing it is not evidence of executing
+ it.
+- Nothing here authorizes representing Ghost-Ark, Penn State, or any other
+ institution commercially.
+- No superlative in this document ("first", "only", "best") is licensed for
+ public use. Any such wording requires a named evidentiary standard under
+ `docs/claims/CLAIM_BOUNDARY_MANIFEST.md` before it ships.
diff --git a/docs/research/NON_CLAIMS.md b/docs/research/NON_CLAIMS.md
index c2b46618..29ecd505 100644
--- a/docs/research/NON_CLAIMS.md
+++ b/docs/research/NON_CLAIMS.md
@@ -43,6 +43,14 @@ The project does not claim:
validated by a separate confirmatory procedure.
- A receipt verifies artifact integrity, not statistical validity or deployment
safety.
+- A capsule that reproduces deterministically from its declared inputs does not
+ establish that those inputs were measured rather than asserted. Changing an
+ input and regenerating the chain yields a fully self-consistent capsule, a
+ valid receipt, and a PASS verdict over a fabricated value. See
+ `docs/research/epistemic-program/challenges.md` (CH-001).
+- A scalar that happens to be expressible over a checked-in row count is not
+ thereby derived from that matrix. The event, population, and numerator must
+ be explicitly declared and checked before any derivation claim is made.
- A PASS verdict from `cc-report verify-claim-governance` means the
evidence-bound claim package is internally consistent under the verifier
rules. It does not mean the AI system is safe in deployment.
diff --git a/docs/research/epistemic-program/README.md b/docs/research/epistemic-program/README.md
new file mode 100644
index 00000000..09b87eaa
--- /dev/null
+++ b/docs/research/epistemic-program/README.md
@@ -0,0 +1,91 @@
+# The Epistemic Program
+
+> Don't manufacture visibility. Manufacture things worth inspecting, then make
+> them impossible to miss.
+
+## Governing objective
+
+Turn scattered artifacts into one coherent public research program, then
+multiply the number of surfaces through which someone can encounter it.
+
+The work here is synthesis, selection, positioning, and distribution. It is not
+implementation. Implementation happens elsewhere in this repository and is
+referenced, not repeated.
+
+## The three resolutions
+
+The same idea at three magnifications.
+
+**One field-sized question**
+
+```text
+How should computational evidence be represented so that claims
+remain inspectable and bounded?
+```
+
+**One human-sized obsession**
+
+```text
+I don't like green checks that hide what they actually establish.
+```
+
+**One public sentence**
+
+```text
+Make the claim smaller. Make the evidence stronger.
+```
+
+## What is being discovered
+
+Not a company. A territory:
+
+> How computational claims can remain attached to the evidence, assumptions,
+> transformations, and boundaries that make them defensible.
+
+Several projects approach it from different directions. They are not five
+businesses. They are **five observations from one laboratory** — and the
+[research graph](research-graph.md) says exactly how they relate without
+claiming they should merge.
+
+## Contents
+
+| Document | What it does |
+| --- | --- |
+| [Inventory](inventory.md) | Every artifact, and the question it attempted to answer. Not a portfolio — an excavation. |
+| [Research graph](research-graph.md) | The invariant beneath the artifacts, and the node structure that connects them. |
+| [Evidence scope inflation](evidence-scope-inflation.md) | The core concept: how a narrow verification silently becomes a broad claim. Includes an attack on this repository's own guards. |
+| [Challenges](challenges.md) | Open adversarial challenges, and the results of the ones already run. |
+| [Visibility manifold](visibility-manifold.md) | The method for turning one inspectable object into many entry points. |
+| [Distribution packet 001](distribution-packet.md) | The first packet, and the posts derived from it. |
+| [Drafts](drafts/README.md) | The five posts, written out in publishable form. |
+| [Claim intake](claim-intake.md) | The participation loop. What actually happens when someone brings a claim. |
+| [Release freeze](release-freeze.md) | What ships, what is not claimed, and the one action a visitor should take. |
+
+## Definition of success
+
+Not hours worked, files produced, or ideas brainstormed. Four things:
+
+1. An inventory of what has actually been built.
+2. A graph showing the intellectual relationship among those things.
+3. One canonical public object everything can point toward.
+4. A repeatable method for multiplying every real artifact into multiple public
+ entry points.
+
+Then the engine runs:
+
+```text
+artifact → claim → evidence → limitation → story → challenge → distribution
+ ↑ ↓
+ └──────────────────────── response ────────────────────────────┘
+```
+
+## Non-claims
+
+- This program does not establish that the method works. It establishes what the
+ method is and where it has been applied.
+- An artifact appearing in the inventory is not a validated result. The inventory
+ records what each artifact attempted, not what it proved.
+- The distribution material here describes intended public work. Publishing a
+ plan is not evidence of executing it.
+- Nothing in this directory promotes any surface into Paper Core or adds a claim
+ to `docs/claims/CLAIM_BOUNDARY_MANIFEST.md`.
diff --git a/docs/research/epistemic-program/challenges.md b/docs/research/epistemic-program/challenges.md
new file mode 100644
index 00000000..70c7ddd1
--- /dev/null
+++ b/docs/research/epistemic-program/challenges.md
@@ -0,0 +1,278 @@
+# Challenges
+
+Adversarial participation, run as public research rather than as marketing.
+
+A challenge is an invitation to falsify something specific in this repository.
+Results are published whether or not they are flattering, and the uncomfortable
+ones are published first.
+
+## Completed
+
+### CH-001 — Break the canonical page's drift guard
+
+**Challenge.** Can the canonical page be made to display `BYTES MATCH` over a
+different underlying fixture, without causing the drift guard to fail?
+
+**Answer: yes.** Two attempts were run in a detached worktree at `ceeca6b`.
+
+#### Attempt A — repair the consistency chain
+
+Forge `expected/calibration.json` (`realized_fpr` 0.041666666667 → 0.011111111111),
+recompute its digest, patch `manifest.expected.json`, and patch the page's
+embedded copy and digest to match.
+
+| Guard | Result |
+| --- | --- |
+| `tests/unit/docs/test_canonical_page_fixture.py` | **4 passed** — the forgery is internally consistent |
+| `tests/integration/test_claim_governance_capsule.py` | **failed** — regeneration from declared inputs produced the original file |
+
+The drift guard alone does not detect this. The capsule integration test does,
+because it rebuilds the artifact rather than comparing it to itself.
+
+*(A first run of this attempt reported a false failure. The attack script used
+`re.sub` with a replacement string containing `\n`, which Python interprets as a
+newline, corrupting the page instead of forging it. The tooling failed, not the
+guard. It is recorded here because a challenge result produced by a broken
+attacker is worse than no result.)*
+
+#### Attempt B — move the forgery upstream
+
+Change the **declared input** (`inputs/capsule_config.json`, same field, same
+value), regenerate the capsule with `build_capsule.py`, refresh all eleven
+expected artifacts and the manifest from the regenerated outputs, then update the
+page.
+
+| Guard | Result |
+| --- | --- |
+| `tests/unit/docs/test_canonical_page_fixture.py` | **4 passed** |
+| `tests/integration/test_claim_governance_capsule.py` | **5 passed** |
+| Governance verdict in the regenerated manifest | `pass` |
+| Report receipt | new, valid, `c1643673596fab68…` |
+| Canonical page in a real browser | `BYTES MATCH` over `"realized_fpr": 0.011111111111` |
+
+Every check green. Every hash correct. The displayed number is fiction.
+
+#### What CH-001 establishes
+
+The guard chain establishes **deterministic reproducibility from declared
+inputs**. It cannot distinguish a measured input from an asserted one. This is
+rung 4 of the ladder in
+[evidence scope inflation](evidence-scope-inflation.md).
+
+#### What CH-001 does not establish
+
+- Not that the capsule is broken. It does exactly what it says, and Attempt A
+ shows the chain catching the naive forgery.
+- Not a general result about reproducible builds. One repository, one chain.
+- Not that an attacker could do this to the published repository — the forgery
+ requires commit access, and a reviewer reading the diff would see the input
+ change. The finding is about what the *green checks* prove, not about
+ compromise.
+
+#### What changed because of it
+
+- The limitation is now stated on the canonical page itself, not only here.
+- The drift guard's docstring states what it does not establish.
+- A new entry in `docs/research/NON_CLAIMS.md`.
+- Closing rung 4 requires an anchor outside the repository. There is none today,
+ and the documents now say so rather than implying otherwise.
+
+## Open / partially answered
+
+### CH-002 — Close rung 4
+
+**Challenge.** Propose a mechanism that would let an outside reviewer
+distinguish a measured input from an asserted one, without requiring them to
+trust the author.
+
+**Answer: no repository-local mechanism can, and the reason is uncomfortable —
+deterministic reproducibility is what makes the forgery cheap.**
+
+#### The argument
+
+Let `R` be a repository controlled by author `A`, and let `V` be any
+verification procedure whose inputs are entirely contained in `R`. `V` cannot
+distinguish "input `x` was measured" from "input `x` was asserted by `A`".
+
+`V` is a function of `R`'s contents, so `A` can compute it. To place a chosen
+value `x'` into a state that `V` accepts, `A` does not need to invert anything:
+the generator's outputs are a deterministic function of its inputs, and the
+checks verify exactly that functional relationship. So `A` edits `x'`,
+regenerates, and `V(R') = holds` by construction. CH-001 is this argument
+executed rather than asserted.
+
+The uncomfortable part is that the property being exploited is the one we want.
+Reproducibility guarantees that a change to an input propagates consistently
+through every downstream artifact, hash, and receipt. That is exactly why the
+capsule is valuable — and it applies to honest and dishonest inputs equally:
+
+> **Reproducibility amplifies consistency, not truth.**
+
+A less reproducible pipeline would be *harder* to forge coherently, and worse in
+every other respect. This is not an argument against reproducible builds. It is
+an argument for knowing which of the two things they establish.
+
+#### One cheap partial defence, and its limit
+
+`realized_fpr` is `0.041666666667`, which is exactly `1/24`. The capsule ships
+`inputs/failure_matrix.csv`, which has exactly 24 rows. The declared statistic
+has a denominator structure matching the declared sample size — but nothing
+checks the relationship, because the summary is a *declared input* rather than a
+*derived* one.
+
+CH-001's forgery set it to `0.011111111111`, which is `1/90`. That is not
+expressible as a count over 24 observations. A **derivability check** — requiring
+declared statistics to be expressible over the declared sample size — would have
+caught it, costs almost nothing, and needs no external party.
+
+It does not close rung 4. An attacker who picks `2/24` instead of `1/90` passes.
+It raises the cost of forgery from *any number* to *any number consistent with
+the declared n*, which is a real improvement and a bounded one.
+
+**It is deliberately not implemented.** The columns of the failure matrix give
+rates of 9/24, 12/24, and 9/24; none is 1/24. So `realized_fpr` is plausibly a
+false-positive count over the same 24 prompts, and plausibly a quantity from a
+different sample that happens to share a denominator. Implementing a check that
+assumes the first reading would encode an unverified assumption about what the
+field means — the same error class this whole program is about, committed in the
+act of defending against it. The correct next step is to establish what the field
+denotes, then check it.
+
+#### Continuation — make the missing semantics executable
+
+The fixture now carries three independent facts about `realized_fpr`:
+`semantics.status: unresolved`, `origin.kind: asserted`, and
+`external_anchor: null`. That makes the absence of a derivation visible in the
+generated calibration artifact instead of allowing the value's `1/24` form to
+imply one.
+
+The capsule also has two opt-in mechanisms for a future value whose meaning has
+actually been declared:
+
+- `origin.kind: deterministic_derivation` accepts only a named binary column
+ of the checked-in matrix and verifies its source digest, numerator,
+ denominator, decimal rendering, and scalar value. It verifies arithmetic, not
+ that the named column is semantically an FPR or that the matrix represents an
+ external population.
+- `external_anchor` requires a URI, issuer, timestamp, and a digest over the
+ exact value, semantics, and origin. It records that reference without
+ fetching it. It binds a declaration to an external object; it does not
+ establish that the issuer measured correctly.
+
+Neither mechanism is applied to the current field. In particular, there is still no
+derivability check that silently interprets the current `realized_fpr` as a
+matrix-column rate. The remaining next artifact is a real external anchor at
+collection time, not a richer local label.
+
+#### What would actually close it
+
+Ranked by cost, each closing a different threat:
+
+| Anchor | Closes | Leaves open |
+| --- | --- | --- |
+| Timestamp the input at collection (RFC 3161, a transparency log) | Fabricating or revising an input *after seeing results* | Fabricating it at collection time |
+| Signature by the measuring instrument or a second party | Binding the value to someone other than its writer | Trust in that party |
+| Independent replication | Measurement itself | Nothing — but it is a social process, not a mechanism |
+
+Only the third establishes measurement, and it is definitionally not
+repository-local. The first is the cheapest and maps precisely onto
+preregistration: freeze the protocol, and the input, before the observation.
+
+#### Convergence worth noting
+
+This is the same shape as the attestation boundary in the
+[eight-week plan](../future-expansion/eight-week-plan.md): an enclave attests a
+measurement, App Attest validates an app instance, C2PA binds an assertion to an
+artifact — and none of them establishes that the assertion is true. Rung 4 is
+that boundary, met from the reproducible-build direction instead of the
+hardware-attestation direction. Two tracks, one wall.
+
+#### Status
+
+Partially answered. The impossibility argument is stated and demonstrated; the
+current field's unresolved semantics and asserted origin are now explicit and
+machine-checked. No independent external anchor has been recorded or verified.
+CH-002 stays open for anyone who can refute the argument or implement the first
+anchor.
+
+### Further open challenges
+
+### CH-003 — Make the film show something false
+
+The film renders whatever is in `window.__VERDICT` and stamps `ILLUSTRATION`
+when nothing is injected. Find a path that produces an un-stamped frame
+displaying a verdict that no verifier issued.
+
+### CH-004 — Find a reserved-vocabulary bypass
+
+The report validator rejects reserved overclaim vocabulary in claim statements
+and evidence roles. Construct a report that passes validation and still reads,
+to an ordinary reader, as a safety claim. Metadata, field names, and alternate
+routes all count.
+
+### CH-005 — Widen an interval by adding evidence
+
+The kernel's intervals should tighten monotonically as constraints are added.
+Find declared evidence whose addition makes the reported interval wider, or an
+argument for why the monotonicity test does not cover a real case.
+
+### CH-006 — A docstring contract, falsified by a property test
+
+**Not opened by us.** Hypothesis found it while the full suite was running at
+the end of this session, and it is recorded here because a challenge programme
+that only publishes the challenges it chose is not a challenge programme.
+
+`ModelBase.migrate()` is documented as best-effort, and its test states the
+contract explicitly:
+
+> migrate() should be best-effort and never throw on arbitrary old dicts.
+
+It throws. Given `{"updated_at": ""}` it raises a `ValidationError`, because
+`migrate()` passes arbitrary values straight into `model_validate` and
+`updated_at` carries a validator that rejects a non-numeric timestamp.
+
+| Fact | Status |
+| --- | --- |
+| Reproduces on `main` | Yes, identically — verified in a detached worktree |
+| Touched by this branch | No. `src/cc/core/models.py` is unmodified here |
+| Deterministic in CI | No. The failing example lives in a gitignored `.hypothesis/` database, so CI may or may not draw it |
+
+#### The interesting part
+
+The obvious fix — make `migrate()` swallow invalid values for known fields — is
+**silent repair**, which this repository rejects everywhere else. The report
+validator refuses rather than repairing. The governance verifier fails closed.
+A migration that quietly drops a malformed timestamp would hide exactly the kind
+of data problem the rest of the codebase is built to surface.
+
+So the defect is plausibly in the *contract*, not the code:
+
+| Option | Effect | Cost |
+| --- | --- | --- |
+| A — make `migrate()` best-effort for real | Honours the docstring | Silent repair; contradicts the repository's fail-closed posture |
+| B — narrow the contract | `migrate()` must not throw on **unknown** keys; a known field with an invalid value fails closed, as it should | Changes a documented contract and a test in the core model layer |
+
+**Recommendation: B**, with the Hypothesis strategy excluding known field names
+and an explicit test asserting that an invalid known field *does* raise.
+
+**Not applied.** This is a semantic decision in the core model layer, made on a
+pre-existing bug that is unrelated to this branch's work. Changing it
+unilaterally would be its own kind of scope inflation — repairing something
+quietly because it was inconvenient to the session's green build.
+
+## How results are handled
+
+1. Reproduce it here, in a detached worktree, with the commands recorded.
+2. Publish the result — including a result that makes this project look worse.
+3. Change the artifact, the limitation text, or both.
+4. Record what changed, so the challenge's effect is inspectable too.
+
+A challenge that produces no change to any artifact is recorded as such. That is
+also a result.
+
+## Non-claims
+
+- A challenge going unanswered is not evidence that a property holds.
+- The list of open challenges is not a claim that these are the only weaknesses.
+ They are the weaknesses currently visible from the inside, which is exactly the
+ vantage point that missed rung 4.
diff --git a/docs/research/epistemic-program/claim-intake.md b/docs/research/epistemic-program/claim-intake.md
new file mode 100644
index 00000000..1d4ca0e0
--- /dev/null
+++ b/docs/research/epistemic-program/claim-intake.md
@@ -0,0 +1,105 @@
+# Claim Intake
+
+## The point
+
+The invitation says *bring one claim that matters*. This document takes that
+sentence seriously enough to define what happens next.
+
+The answer is never `TRUE` or `FALSE`. Returning a verdict would be the same
+error the whole program is about: a narrow analysis inflated into a broad
+judgment. What comes back is a **decomposition** — the claim taken apart into
+the pieces that decide whether it holds, with the unresolved pieces left visibly
+unresolved.
+
+The secondary purpose is that the method itself becomes observable. Broadcasting
+expertise persuades nobody; doing the work in public, on someone else's claim,
+shows the thinking rather than asserting it.
+
+## The worked example
+
+Someone brings:
+
+> Our agent catches 95% of policy violations.
+
+### 1. Claim
+
+What exactly does 95% refer to? Caught *out of what*? Violations that occurred,
+violations that were labelled, or violations the agent was shown? Is 95% a
+recall, a precision, an accuracy, or an average of several runs? Restate it in a
+form where the denominator is explicit and the estimand is named. Most claims
+lose half their apparent strength at this step, before any evidence is examined.
+
+### 2. Population
+
+What distribution was this measured over, and what does it not represent?
+Adversarial or organic traffic? Which policies, which locales, which model
+version? A number measured on a curated benchmark and a number measured on
+production traffic are different claims that share a digit.
+
+### 3. Evidence
+
+Where did the measurement originate? Which artifact holds it, who produced it,
+when, under what code version, and can it be re-derived? An unreproducible
+number is not disqualified — it is relabelled as a report of a past observation
+rather than a property of the system.
+
+### 4. Alternative explanations
+
+Could leakage explain it — benchmark contamination, labels visible at inference,
+the same examples used to tune the threshold and to score it? Could selection
+explain it — failures filtered before counting, runs discarded, an evaluation
+window chosen after seeing results? Could the metric explain it — a class
+imbalance that makes 95% the score of a system that always says "allow"?
+
+### 5. Smallest challenge
+
+The cheapest experiment that would cause the statement to be revised. Not the
+best study — the smallest one whose negative result would actually change what
+gets said in public. Usually one held-out slice, one re-run with the threshold
+frozen in advance, or one adversarial batch nobody has seen.
+
+### 6. Result
+
+`supported` / `contradicted` / `inconclusive`, at the scope defined in step 1.
+`inconclusive` is a legitimate terminal state and is reported as often as it
+occurs. A process that never returns inconclusive is not measuring anything.
+
+### 7. Boundary
+
+What larger claim remains unestablished. Explicitly. In the same document, at
+the same size as the result. For this example the boundary usually reads: the
+measurement says something about detection on a stated distribution; it says
+nothing about coverage of violations nobody wrote a policy for, and nothing
+about behaviour after the next model update.
+
+## What comes back
+
+| Deliverable | Content |
+| --- | --- |
+| Claim map | The original sentence, decomposed, with the estimand and denominator made explicit. |
+| Evidence trail | Which artifact supports which part, and how to inspect each one. |
+| Alternative explanations | Ranked by how cheaply they could be ruled out. |
+| Smallest useful test | One experiment, with its stop rule and what it cannot settle. |
+| Limitation statement | Plain English, publishable as-is, sized to the evidence. |
+
+## What does not come back
+
+No validation. No compliance mapping. No safety assertion. No seal, badge, or
+score. If a client's actual need is a badge, this is the wrong studio, and
+saying so early is part of the service.
+
+## Why this could become a verb
+
+Not by forcing the phrase. By making the behaviour repeatable and public until
+the decomposition is recognisable on sight — the way a diff or a postmortem is
+recognisable. Category creation is a consequence of a distinctive, repeated,
+observable behaviour. It is not a naming exercise, and any attempt to name it in
+advance would be its own scope inflation.
+
+## Non-claims
+
+- This protocol does not establish that a claim is true or false. It establishes
+ what would have to hold, and which parts remain unresolved.
+- No intake has been run yet. This is a defined procedure, not a track record.
+- A completed intake is a document, not a certification, and may not be
+ represented as one.
diff --git a/docs/research/epistemic-program/distribution-packet.md b/docs/research/epistemic-program/distribution-packet.md
new file mode 100644
index 00000000..0d0816c6
--- /dev/null
+++ b/docs/research/epistemic-program/distribution-packet.md
@@ -0,0 +1,93 @@
+# Distribution Packet 001
+
+The first packet. Everything in it points at one inspectable object.
+
+## The object
+
+The canonical page: `visual_identity/canonical_page/index.html`.
+
+## The hook
+
+> We made the green check break.
+
+## The demonstration
+
+Change one character in the box. The verification fails closed. Restore it and
+the verification returns. Nothing is simulated; the browser is computing a real
+SHA-256 over the bytes you can see.
+
+## The surprising point
+
+The successful hash still does not establish that the value inside the file is
+true.
+
+```text
+Bytes verified. Claim unresolved.
+```
+
+## The philosophy
+
+Evidence should expose the boundary of what it establishes.
+
+## The invitation
+
+> Bring one claim that matters.
+
+## The copy
+
+The whole announcement, without inflation:
+
+```text
+We built a browser check that verifies 189 bytes against a manifest.
+Change one character and it fails closed.
+It still cannot tell you whether the number inside those bytes is true.
+That's the point.
+```
+
+No revolutionary framework. No changing AI safety forever. The restraint is the
+differentiator, and it is also honest, which is why it is sustainable.
+
+## Derived posts
+
+Each points back to the same object. None is standalone.
+
+| # | Angle | Core line | Ends at | Copy |
+| --- | --- | --- | --- | --- |
+| 1 | The demonstration | A green check should have a falsifiable path to red. | The page. | [draft](drafts/01-the-demonstration.md) |
+| 2 | The boundary | Integrity is not truth: these bytes are those bytes, and that is all. | The limitation text. | [draft](drafts/02-integrity-is-not-truth.md) |
+| 3 | The self-attack | We tried to forge our own verified page. It worked. | [CH-001](challenges.md). | [draft](drafts/03-we-forged-our-own-page.md) |
+| 4 | The method | Name the claim, the falsifier, the control, and the non-claim — before the result exists. | The film. | [draft](drafts/04-name-it-before-you-see-it.md) |
+| 5 | The invitation | Bring one claim that matters. Here is exactly what you get back. | [Claim intake](claim-intake.md). | [draft](drafts/05-bring-one-claim.md) |
+
+All five are written and sit in [`drafts/`](drafts/README.md), in publishable
+form, for the author to edit into his own voice.
+
+Post 3 is the one that will travel furthest, because publishing a successful
+attack on your own verification is rare enough to be surprising and cheap enough
+to be honest. It should not be held back for a better moment. It *is* the moment.
+
+## Sequencing
+
+Ship 1 and 2 with the page. Hold 3 until CH-001's write-up and the page's
+updated limitation are both live, so the post lands on an artifact that already
+reflects the finding — never on a promise to fix it later. Then 4, then 5.
+
+## Rules for every public artifact in this packet
+
+Each one carries three things, visibly:
+
+```text
+CLAIM what is being asserted
+EVIDENCE what supports it, and where to inspect that
+LIMIT what remains unestablished
+```
+
+If a post cannot carry all three, it is not ready. This is the point at which
+the marketing becomes a demonstration of the philosophy rather than a departure
+from it.
+
+## Non-claims
+
+- This packet has not been published. Writing it is not distributing it.
+- No claim is made about how any of it will perform.
+- The ordering is a judgment about honesty and readiness, not about reach.
diff --git a/docs/research/epistemic-program/drafts/01-the-demonstration.md b/docs/research/epistemic-program/drafts/01-the-demonstration.md
new file mode 100644
index 00000000..38dbcbc6
--- /dev/null
+++ b/docs/research/epistemic-program/drafts/01-the-demonstration.md
@@ -0,0 +1,42 @@
+# Draft 01 — The demonstration
+
+**Surface:** aphorism + experience. **Points at:** the canonical page.
+
+---
+
+We built a browser check that verifies 189 bytes against a manifest.
+
+Change one character and it fails closed.
+
+It still cannot tell you whether the number inside those bytes is true.
+
+That's the point.
+
+---
+
+## Longer version
+
+There is a real evidence file in our repository: a calibration record, 189
+bytes, holding a false-positive rate. There is a real digest for it, recorded in
+a manifest that was generated when the artifact was built.
+
+The page puts both in front of you and recomputes the digest in your browser,
+over exactly the bytes you can see. No server. No API. `crypto.subtle.digest`,
+the same primitive your browser uses for TLS.
+
+Then it gives you a button that breaks it.
+
+That button is the whole design. A verification you have personally made fail is
+a verification whose scope you understand. Everyone who clicks it stops
+believing that the green state means the file is *correct*, because they have
+just watched what the check is actually sensitive to: bytes, and nothing else.
+
+**A green check should have a falsifiable path to red.** Most don't. Not because
+anyone is lying, but because the path is buried three systems away from the
+person reading the result.
+
+Claim: these bytes hash to that digest.
+Evidence: recomputed in your browser, over bytes you can edit.
+Limit: says nothing about whether 0.041666666667 is a real false-positive rate.
+
+Try to break it: `visual_identity/canonical_page/index.html`
diff --git a/docs/research/epistemic-program/drafts/02-integrity-is-not-truth.md b/docs/research/epistemic-program/drafts/02-integrity-is-not-truth.md
new file mode 100644
index 00000000..d2434649
--- /dev/null
+++ b/docs/research/epistemic-program/drafts/02-integrity-is-not-truth.md
@@ -0,0 +1,48 @@
+# Draft 02 — Integrity is not truth
+
+**Surface:** philosophical. **Points at:** the limitation text.
+
+---
+
+A digest match establishes exactly one thing:
+
+> These bytes are those bytes.
+
+Here is what happens next, in an honest reader's head, in under a second and
+without any awareness that it happened:
+
+```text
+1. hash(A) == manifest_hash → A is the file that was recorded
+2. A is the recorded file → the contents of A are accurate
+3. the contents of A are accurate → the claim A represents is true
+```
+
+Step 1 is licensed. Steps 2 and 3 are not. Nobody computed anything about
+whether the number in the file is real. It could have been typed in.
+
+I call this **evidence scope inflation**, and the thing that makes it worth
+building a laboratory around is that it requires no bad actors. It is the
+default behaviour of a careful, honest reader. The inflation happens in the gap
+between what a mechanism computes and what a person needs to know — and the
+mechanism is usually silent about the gap, because it does not know the gap
+exists.
+
+Every mechanism worth trusting has this shape:
+
+| Establishes | Routinely read as |
+| --- | --- |
+| A key signed this | The signer is honest and the content is true |
+| The declared tests passed on this commit | The change is correct |
+| This measurement ran in that enclave | The computation was correct |
+| An assertion is bound to an artifact | The assertion is true |
+| The package is internally consistent | The system is safe |
+
+The right column is where products live. The left column is where truth lives.
+The distance between them is the interesting part.
+
+The fix is not better cryptography. It is **placement**: make the boundary
+travel attached to the result, at the same size, in the same frame, at the same
+moment. Not a footnote. Not a linked document. Directly under the verdict,
+naming the specific thing it does not vouch for.
+
+Bytes verified. Claim unresolved.
diff --git a/docs/research/epistemic-program/drafts/03-we-forged-our-own-page.md b/docs/research/epistemic-program/drafts/03-we-forged-our-own-page.md
new file mode 100644
index 00000000..bd03812a
--- /dev/null
+++ b/docs/research/epistemic-program/drafts/03-we-forged-our-own-page.md
@@ -0,0 +1,77 @@
+# Draft 03 — We forged our own verified page
+
+**Surface:** challenge. **Points at:** CH-001.
+
+---
+
+We published a page that verifies an evidence file in your browser and fails
+closed if you change one character.
+
+Then we tried to forge it. It worked. Here is exactly how, and what it means.
+
+---
+
+## Attempt one: repair the consistency chain
+
+Change the false-positive rate in the evidence file from `0.041666666667` to
+`0.011111111111`. Recompute its digest. Patch the manifest to record the new
+digest. Patch the page's embedded copy to match.
+
+Everything is now internally consistent, and the drift guard that exists
+specifically to catch this **passes — 4 tests green.**
+
+But the capsule integration test fails. It does not compare the artifact to
+itself; it *rebuilds* the artifact from the declared inputs and finds the
+original value. Caught.
+
+Good. That is what a reproducible build is for.
+
+## Attempt two: move the forgery upstream
+
+So don't forge the output. Forge the input.
+
+Change the same field in `inputs/capsule_config.json`. Regenerate the whole
+chain with the project's own build script. Refresh all eleven expected artifacts
+and the manifest from the regenerated outputs. Update the page.
+
+| Check | Result |
+| --- | --- |
+| Drift guard | 4 passed |
+| Capsule integration | 5 passed |
+| Governance verdict | `pass` |
+| Report receipt | new, valid |
+| The page, in a real browser | **BYTES MATCH** over `"realized_fpr": 0.011111111111` |
+
+Every check green. Every hash correct. The number is fiction.
+
+## What this actually means
+
+Not that the capsule is broken — it does exactly what it claims. The finding is
+about what the green checks *prove*:
+
+> The chain establishes deterministic reproducibility from declared inputs.
+> It cannot distinguish a measured input from an asserted one.
+
+That is a fourth unauthorized inference, one level above the three a reader
+makes about a digest — and this one is committed by the *builder*. By someone
+who had already written the project's non-claims document. By us.
+
+Knowing about scope inflation does not immunize you against it. Only a mutation
+test finds the next rung.
+
+## What changed
+
+The page now says this on the page, not in a document nobody opens. The
+repository's non-claims file has a new entry. The drift guard's own docstring
+states what it does not establish.
+
+Closing the gap needs an anchor outside the repository: a signature over the
+input at collection time, an independent party who performed the measurement, or
+a transparency log outside the author's control. **We don't have one.** That is
+now written down instead of implied.
+
+If you can close it, or show that no repository-local mechanism can, that's
+CH-002 and it's open.
+
+Full write-up, commands, and the exact worktree state:
+`docs/research/epistemic-program/challenges.md`
diff --git a/docs/research/epistemic-program/drafts/04-name-it-before-you-see-it.md b/docs/research/epistemic-program/drafts/04-name-it-before-you-see-it.md
new file mode 100644
index 00000000..d00a4b7e
--- /dev/null
+++ b/docs/research/epistemic-program/drafts/04-name-it-before-you-see-it.md
@@ -0,0 +1,43 @@
+# Draft 04 — Name it before you see it
+
+**Surface:** the method. **Points at:** the film.
+
+---
+
+An intuition can start a question. It cannot finish one.
+
+Before you see an answer, name what would count:
+
+**Claim** — what is asserted, and how narrowly.
+**Falsifier** — the result that would end it.
+**Control** — the comparison that could embarrass it.
+**Non-claim** — what it will never support.
+
+Then freeze all four, *before* the result exists, and let the result disagree.
+
+---
+
+The freezing is the part people skip, and it is the only part that does any
+work. A threshold chosen after seeing the data is not a threshold; it is a
+description. A control added after a promising result is not a control; it is a
+defence. The order matters more than the rigor.
+
+We made a fifteen-second film about this. It has a shot in it where a protocol
+locks over an empty result slot, and holds there for three seconds. That empty
+slot is the whole idea: the moment where the standard exists and the answer
+does not.
+
+And when the result finally arrives, it says `INCONCLUSIVE`.
+
+That was deliberate. The boldest thing a technical brand can say is that it
+doesn't know yet. So the film says it — in its own advertising, where it costs
+something.
+
+There's one more detail I'd defend to anyone. The film renders whatever verdict
+it is handed. If it is handed nothing, it falls back to an illustrative result
+**and stamps `ILLUSTRATION` in the corner of its own footage.**
+
+A film about not overclaiming cannot display an unearned result. So it labels
+itself. That behaviour is in the source, not in a style guide.
+
+`visual_identity/before_you_see_it/`
diff --git a/docs/research/epistemic-program/drafts/05-bring-one-claim.md b/docs/research/epistemic-program/drafts/05-bring-one-claim.md
new file mode 100644
index 00000000..81ed2644
--- /dev/null
+++ b/docs/research/epistemic-program/drafts/05-bring-one-claim.md
@@ -0,0 +1,61 @@
+# Draft 05 — Bring one claim that matters
+
+**Surface:** the invitation. **Points at:** claim intake.
+
+---
+
+Bring one sentence your team says in public and cannot fully defend in private.
+
+A benchmark number. A security property. A "proven". A "guaranteed". A 95%.
+
+You do not get back `TRUE` or `FALSE`. A verdict would be the same error this
+whole thing is about — a narrow analysis inflated into a broad judgment. You get
+back the claim taken apart into the pieces that decide whether it holds, with
+the unresolved pieces left visibly unresolved.
+
+---
+
+Take a real one:
+
+> Our agent catches 95% of policy violations.
+
+**Claim.** 95% of *what*? Caught out of violations that occurred, that were
+labelled, or that the agent was shown? Is that recall, precision, or accuracy?
+Most claims lose half their apparent strength here, before any evidence is
+examined.
+
+**Population.** Measured over which distribution, and what does it not
+represent? Adversarial or organic traffic? Which policies, which locales, which
+model version? A number from a curated benchmark and a number from production
+share a digit and nothing else.
+
+**Evidence.** Which artifact holds the measurement, who produced it, when, under
+what code version, and can it be re-derived? An unreproducible number isn't
+disqualified — it's relabelled as a report of a past observation rather than a
+property of the system.
+
+**Alternative explanations.** Could leakage explain it? Could selection explain
+it — failures filtered before counting, an evaluation window chosen after seeing
+results? Could the metric explain it — a class imbalance that makes 95% the
+score of a system that always says "allow"?
+
+**Smallest challenge.** Not the best study. The cheapest experiment whose
+negative result would actually change what you say in public.
+
+**Result.** Supported, contradicted, or inconclusive — at the scope defined in
+step one. A process that never returns inconclusive isn't measuring anything.
+
+**Boundary.** What larger claim remains unestablished, stated in the same
+document, at the same size as the result.
+
+---
+
+What comes back: a claim map, an evidence trail, ranked alternative
+explanations, one smallest useful test, and a limitation statement in plain
+English that you can publish as written.
+
+What does not come back: validation, compliance, a safety assertion, a badge, or
+a score. If what you need is a badge, this is the wrong studio, and I'd rather
+say so in the first email.
+
+`docs/research/epistemic-program/claim-intake.md`
diff --git a/docs/research/epistemic-program/drafts/README.md b/docs/research/epistemic-program/drafts/README.md
new file mode 100644
index 00000000..8ca30400
--- /dev/null
+++ b/docs/research/epistemic-program/drafts/README.md
@@ -0,0 +1,21 @@
+# Drafts
+
+Publishable copy for [distribution packet 001](../distribution-packet.md). Each
+post points back at the same inspectable object and carries a claim, its
+evidence, and its limit.
+
+These are drafts for the author to edit into his own voice, not finished
+statements from anyone else. Nothing here has been published, and publishing a
+draft is not evidence of anything it describes.
+
+| Draft | Surface | Points at |
+| --- | --- | --- |
+| [01 — the demonstration](01-the-demonstration.md) | C, A | The canonical page |
+| [02 — integrity is not truth](02-integrity-is-not-truth.md) | G | The limitation text |
+| [03 — we forged our own verified page](03-we-forged-our-own-page.md) | F | CH-001 |
+| [04 — name it before you see it](04-name-it-before-you-see-it.md) | — | The film |
+| [05 — bring one claim that matters](05-bring-one-claim.md) | — | Claim intake |
+
+Draft 03 is the one to lead with once its artifact is live. Publishing a
+successful attack on your own verification is rare enough to be surprising and
+cheap enough to be honest.
diff --git a/docs/research/epistemic-program/evidence-scope-inflation.md b/docs/research/epistemic-program/evidence-scope-inflation.md
new file mode 100644
index 00000000..0f7a04d2
--- /dev/null
+++ b/docs/research/epistemic-program/evidence-scope-inflation.md
@@ -0,0 +1,137 @@
+# Evidence Scope Inflation
+
+## The error
+
+A verification establishes something narrow. A reader converts it into something
+broad, without noticing that a conversion happened.
+
+The canonical page's check makes the whole sequence visible in about four
+seconds. The machine observes exactly one thing:
+
+```text
+sha256(bytes_in_the_box) == digest_recorded_in_the_manifest
+```
+
+The reader's mind, unprompted, performs three more steps:
+
+```text
+1. hash(A) == manifest_hash → A is the file that was recorded
+2. A is the recorded file → the contents of A are accurate
+3. the contents of A are accurate → the claim A represents is true
+```
+
+Step 1 is licensed. Steps 2 and 3 are not. Nothing computed anything about
+whether `0.041666666667` is a real false-positive rate. The number could have
+been typed in.
+
+**Bytes verified. Claim unresolved.**
+
+That sentence is the whole discipline compressed into three words and a
+concession. A less careful project ships `VERIFIED ✓`.
+
+## Why it is worth building a laboratory around
+
+The error is not exotic. It is the default behaviour of an attentive, honest
+reader. Nobody has to be fooled. The inflation happens in the gap between what a
+mechanism computes and what a person needs to know, and the mechanism is usually
+silent about the gap because it does not know the gap exists.
+
+Every mechanism worth trusting has this shape:
+
+| Mechanism | Actually establishes | Routinely read as |
+| --- | --- | --- |
+| A digest match | These bytes are those bytes | This artifact is legitimate |
+| A signature | A key signed this | The signer is honest and the content is true |
+| A green CI check | The declared tests passed on this commit | The change is correct |
+| An enclave attestation | This measurement ran in that enclave | The computation was correct |
+| Provenance metadata | An assertion is bound to an artifact | The assertion is true |
+| A governance PASS | The package is internally consistent under verifier rules | The system is safe |
+| A reproducible build | The output follows from the declared inputs | The inputs describe reality |
+
+The right-hand column is where products live. The left-hand column is where
+truth lives. The distance between them is the territory.
+
+## The ladder does not stop at three rungs
+
+The three jumps above are the ones a reader makes. There are more, and they are
+made by *builders* — including by this repository.
+
+[CH-001](challenges.md) attacked this project's own guards to find the next rung.
+The result, in full there and in summary here:
+
+- Editing an evidence artifact and repairing the manifest and the page is caught,
+ because regeneration from declared inputs disagrees. **Consistency alone is not
+ enough, and the capsule knows it.**
+- Editing the *declared input*, regenerating the whole chain, and refreshing the
+ goldens passes **every** check. Governance verdict `pass`. A new, valid receipt.
+ The page displays `BYTES MATCH` over a false-positive rate that was simply
+ asserted.
+
+So the next rung is:
+
+```text
+4. the chain reproduces from declared inputs
+ → the declared inputs describe a real measurement
+```
+
+Also unlicensed. Every hash in that chain did its job correctly. Not one of them
+reaches back to the world. The capsule establishes **deterministic
+reproducibility from declared inputs** — which is genuinely valuable, and is not
+measurement.
+
+This is the same error as steps 2 and 3, one level up and committed by someone
+who had already written the non-claims document. That is the point worth
+sitting with: knowing about scope inflation does not immunize you against it.
+Only a mutation test finds the next rung.
+
+## The general form
+
+Every verification is a function with a domain and a codomain.
+
+```text
+verify : artifact → {holds, fails} over a specific property P
+```
+
+Scope inflation is silently widening `P` after the fact. The defence is not
+better hashes. It is making `P` travel attached to the result, at the same size,
+in the same frame, at the same moment.
+
+Four things make that happen in practice:
+
+1. **Co-located limitation.** The boundary is printed where the result is
+ printed — not in a footnote, not in a linked document, not on a second page.
+ On the canonical page, the limitation sits directly under the verdict and
+ names the specific number it does not vouch for.
+2. **A mutation affordance.** Give the reader a button that breaks it. A result
+ the reader has personally made fail is a result they understand the scope of.
+ Nobody who has clicked *Mutate one byte* believes the check is about truth.
+3. **Refusal vocabulary.** Make the overclaim unsayable in the artifact itself:
+ reserved words rejected by the report validator, a language quarantine over
+ paper prose, forbidden *upgrades* enumerated in the claim manifest.
+4. **An external anchor, or an honest admission that there is none.** Rung 4
+ cannot be closed from inside the repository — [CH-002](challenges.md) gives
+ the argument and the reason: deterministic regeneration lets the author
+ construct any state a local check accepts, so reproducibility amplifies
+ consistency rather than truth. Closing it needs a timestamp at collection, a
+ second party who measured, or independent replication. None is implemented
+ here, and the correct move until one is, is to say so.
+
+## What this is not
+
+It is not a claim that hashing is useless. The check is real, the digest match
+is real, and tamper evidence is worth having.
+
+It is a claim about *placement*: a mechanism that establishes something narrow
+should be presented at the size of the thing it establishes. Most of the value
+in this program comes from insisting on that, out loud, in public, including
+when the resulting screen is less impressive than a green tick.
+
+## Non-claims
+
+- This document does not establish that scope inflation is common, only that it
+ is available — and that this project committed a rung of it while explicitly
+ trying not to.
+- CH-001 is a demonstration on one repository's own guards. It is not a general
+ result about reproducible-build systems.
+- Naming the four countermeasures is not evidence that they work. Three of them
+ are implemented here; the fourth, an external anchor, is not.
diff --git a/docs/research/epistemic-program/inventory.md b/docs/research/epistemic-program/inventory.md
new file mode 100644
index 00000000..c67590a1
--- /dev/null
+++ b/docs/research/epistemic-program/inventory.md
@@ -0,0 +1,75 @@
+# Epistemic Inventory
+
+## How to read this
+
+One row per artifact that contains an actual intellectual move. The
+qualifying question is **not** "is this impressive enough?" It is:
+
+> What question did this artifact attempt to answer?
+
+Small things count. A test is an artifact. A refusal is an artifact. A failed
+idea is an artifact, and often a better one than a success.
+
+The `Limit` column is mandatory. An artifact with no stated limit has not been
+inventoried; it has been advertised.
+
+## Kernel and mathematics
+
+| Artifact | Question | Claim | Evidence | Limit | Interesting because | Public |
+| --- | --- | --- | --- | --- | --- | --- |
+| `cc.kernel.sensitivity` finite-atom LP | What does evidence about guardrail failures identify when the joint law is unknown? | Sharp lower and upper values for a declared linear composition query over feasible finite binary atom distributions. | `tests/unit/kernel/test_sensitivity.py`, monotonic tightening tests, theorem ledger T1. | Says nothing about upstream data collection, semantic safety, or representativeness. | The answer is an interval, and its width is itself the finding. | Research |
+| `cc.kernel.frechet_classes` | What do classical Fréchet-Hoeffding bounds give for composed binary failure? | Bounds under exact singleton marginals with no side constraints. | `test_classical_frechet_special_cases.py`, theorem ledger T2. | Assumes nothing about dependence, and therefore proves nothing about a deployment. | The independence calculation is exposed as a *baseline*, never as truth. | Research |
+| `cc.kernel.sample_complexity` | When counts replace probabilities, what survives? | Under stated iid Bernoulli sampling and simultaneous moment coverage, count-derived intervals form an outer confidence interval. | `test_finite_sample_constraints.py`, `test_sample_complexity.py`, theorem ledger T6. | Invalid after uncorrected adaptive target selection. Not a deployment certificate. | Names the exact condition under which its own guarantee dissolves. | Research |
+| Endpoint witnesses | Is a reported bound actually attainable? | The returned joint law attains the reported endpoint under declared constraints. | Witness verification table in the paper artifacts. | Witnesses the mathematics of the bound, not any real system's behavior. | A bound that cannot exhibit a witness is not reported. | Research |
+| `cc.kernel.cliff` | Do composed risks jump discontinuously as dependence changes? | Characterizes dependence-driven jumps under declared models. | Correlation-cliff experiments under `experiments/`. | Exploratory. Not a confirmatory certificate. | The failure mode is a cliff, not a slope — averages hide it. | Experimental |
+
+## Evidence governance
+
+| Artifact | Question | Claim | Evidence | Limit | Interesting because | Public |
+| --- | --- | --- | --- | --- | --- | --- |
+| `cc.evidence.role_ontology` | Should all evidence be allowed to say the same things? | Role determines what a piece of evidence may support. | `tests/unit/evidence/test_role_ontology.py`. | A correct role assignment does not make the underlying measurement correct. | Typing evidence is a stronger idea than scoring it. | Research |
+| `cc.evidence.confirmatory_protocol` | When does an exploratory finding become a confirmatory one? | Only under a separately registered protocol; never by reinterpretation. | `test_confirmatory_protocol.py`. | Registration does not validate. It only prevents silent revision. | It makes the exploratory/confirmatory boundary machine-checkable. | Research |
+| `cc.evidence.decay` | Do claims expire? | A claim carries a policy defining when it must be rechecked, degraded, or expired. | `tests/unit/evidence/` decay tests. | Does not establish that the system is currently safe. It defines when to look again. | Treats claims as mortal by construction. | Research |
+| `cc.evidence.merkle_log` / `anchoring` | Can a reviewer detect a silent rewrite of history? | Tamper evidence over recorded bytes under canonical serialization. | `test_transparency_log_adversarial.py`. | Integrity only. Never statistical validity, never safety. | The adversarial test is the artifact; the log is just the subject. | Research |
+| `cc.evidence.claim_governance` | Can a claim package be checked for internal consistency? | PASS means internally consistent under verifier rules. | `test_claim_governance.py`, capsule integration. | PASS is not deployment safety. The verdict says so in its own payload. | The success message carries its own limitation. | Research |
+| `cc.reporting.report` strict models | Can a report be repaired quietly into validity? | Fail-closed validation: missing boundaries, extra fields, and reserved overclaim vocabulary are rejected. | `tests/unit/reporting/test_reporting.py` round-trip and rejection tests. | Schema validity is not semantic truth. | The word list means a report literally cannot say "proves". | Research |
+| Deterministic claim-governance capsule | Can a whole governance chain be reproduced byte for byte? | Regeneration from declared inputs reproduces the manifest exactly. | `tests/integration/test_claim_governance_capsule.py`. | **Reproducibility from declared inputs is not measurement.** See [CH-001](challenges.md). | The strongest guard in the repository, and its boundary is now demonstrated rather than asserted. | Public |
+
+## Boundary and refusal artifacts
+
+These are the ones a portfolio would omit. They are the most characteristic.
+
+| Artifact | Question | Claim | Evidence | Limit | Interesting because | Public |
+| --- | --- | --- | --- | --- | --- | --- |
+| `docs/research/NON_CLAIMS.md` | What will this project never say? | Ten enumerated non-claims with reasons and substitutes. | The document, plus verifier-mandated boundaries it lists. | Cannot prevent bad-faith actors from overclaiming outside the framework. | A repository that publishes its own refusals is unusual. | Public |
+| `CLAIM_BOUNDARY_MANIFEST` + validator | Can public language be checked against evidence? | Every active claim maps to a level, lane, support, test, and non-claim. | `tests/unit/docs/test_claim_boundary_manifest.py`. | Documents boundaries; creates no authority. | Forbidden *upgrades* are enumerated, not just forbidden words. | Public |
+| Paper-core language quarantine | Can legacy vocabulary leak into the paper? | Named terms cannot appear in paper-core texts. | `tests/unit/kernel/test_paper_core_language_quarantine.py`. | Only covers the listed files and terms. | A unit test whose subject is prose. | Public |
+| Generated-artifact boundary checker | Which outputs may be tracked as evidence? | Runtime, fixture, archive, and release artifacts are separated and enforced. | `scripts/check_artifact_boundary.py --static`, CI. | Static rules; does not judge artifact quality. | Stops generated results from quietly becoming evidence. | Public |
+| `cc_max` deprecation warning | What happens to a metric that outlived its justification? | Legacy exploratory metric, not a partial-identification claim, not evidence of safety. | The `FutureWarning` raised at call time. | Preserved for compatibility, which is itself a risk. | The code apologizes for itself at runtime. | Public |
+
+## Communication and interface
+
+| Artifact | Question | Claim | Evidence | Limit | Interesting because | Public |
+| --- | --- | --- | --- | --- | --- | --- |
+| Claim Observatory World V3 | Can epistemic constraints be spatial? | Eleven chambers mapping claim integrity stages to physical metaphors. | Blender scenes, renders, `visual_world_manifest_v3.json`, world bible. | A teaching environment. Not a dashboard and not a certification surface. | Law 10: the world must make overclaiming uncomfortable. | Public |
+| *Before You See It* (15s film) | Can epistemic restraint be compelling? | None. It is a statement of method. | The film itself. | Establishes no technical claim; labels its own unverified frame. | It says INCONCLUSIVE on purpose, in its own advertising. | Public |
+| Canonical page | Can a visitor encounter the philosophy and test it in the same minute? | The embedded bytes hash to the digest recorded in the capsule manifest. | Live WebCrypto recomputation in the visitor's browser. | Integrity only. Says nothing about whether the number in the file is true. | The claim can actually fail in front of the reader. | Public |
+| Drift guard | Can an honest screen go stale and start lying? | The page's embedded fixture and digest match the capsule. | `tests/unit/docs/test_canonical_page_fixture.py`. | Enforces internal consistency, not authenticity. Demonstrated by [CH-001](challenges.md). | The guard's own limit was found by attacking it, not by reasoning about it. | Public |
+| Source ledger | What may be inferred from a narrative? | Nothing, until translated, predeclared, and observed. | The ledger itself, applied to a real source. | Does not establish that its source is accurate or inaccurate. | It takes the story seriously enough to test it, and refuses to mock it. | Public |
+| Eight-week plan + prompt library | Can a method be handed to someone else? | A schedule with gates, and eleven prompts that produce artifacts rather than predictions. | The documents. | Completing them produces no certainty. | Every week has a stop condition. | Public |
+
+## Adjacent, institutionally separate
+
+| Artifact | Question | Relationship |
+| --- | --- | --- |
+| Ghost-Ark | Can a hostile reviewer independently determine what a system does and does not prove — by replaying receipts, inspecting malicious corpora, and validating evidence windows? | Informs the thinking. Not a Cubits11 product, not a university endorsement, not a commercial credential. Referenced only as a labelled research case study. |
+
+## What the inventory shows
+
+Ninety Python modules, one hundred and six test files, ninety-six documents —
+and the through-line is not any of them. It is that a surprising fraction of the
+artifacts exist **to prevent a conclusion**, not to produce one: a quarantine on
+vocabulary, a boundary on generated files, a warning attached to a metric, a
+verdict that carries its own caveat, a film that labels its own footage.
+
+That is the invariant. It is developed in the [research graph](research-graph.md).
diff --git a/docs/research/epistemic-program/release-freeze.md b/docs/research/epistemic-program/release-freeze.md
new file mode 100644
index 00000000..a787e3b2
--- /dev/null
+++ b/docs/research/epistemic-program/release-freeze.md
@@ -0,0 +1,91 @@
+# Release Freeze
+
+Written last, on purpose. No new ideas after this point — only a record of what
+exists and a decision about what ships.
+
+Temperance gets the session. The Emperor gets the last ten minutes.
+
+## What exists now
+
+| Layer | Artifact | State |
+| --- | --- | --- |
+| Research | Finite-atom kernel, Fréchet bounds, endpoint witnesses, sample complexity | Release-candidate, tested |
+| Governance | Role ontology, confirmatory protocol, decay, receipts, claim governance | Implemented, tested |
+| Capsule | Deterministic claim-governance capsule | Reproducible; boundary demonstrated by CH-001 |
+| Method | Future-expansion package: source ledger, eight-week plan, prompt library | Written |
+| Film | *Before You See It*, three cuts, 15.000s each | Rendered |
+| Page | Canonical page with live WebCrypto check | Built and browser-tested |
+| Program | Inventory, research graph, scope inflation, challenges, manifold, packet, intake | Written this session |
+| Guards | Drift guard, artifact boundary, language quarantine, claim manifest validator | Passing |
+
+## The decisions
+
+**What ships.**
+The canonical page and the film. Nothing else in the same release.
+
+**The central demonstration.**
+The browser integrity check. One object, operable by a stranger in under a
+minute, breakable on purpose.
+
+**The sentence that accompanies it.**
+
+```text
+Bytes verified. Claim unresolved.
+```
+
+**What is explicitly not being claimed.**
+
+- Not that any system is safe.
+- Not that a digest match says anything about the value inside the file.
+- Not that reproducibility from declared inputs establishes that those inputs
+ were measured — CH-001 shows it does not.
+- Not that the method has been validated. It has been defined and applied here.
+- Not that any offer has been delivered or any intake has been run.
+
+**Where someone inspects the source.**
+
+```text
+page visual_identity/canonical_page/index.html
+fixture examples/claim_governance_capsule/expected/calibration.json
+digest examples/claim_governance_capsule/manifest.expected.json
+guard tests/unit/docs/test_canonical_page_fixture.py
+film visual_identity/before_you_see_it/
+finding docs/research/epistemic-program/challenges.md (CH-001)
+```
+
+**The one action a visitor should take.**
+
+Change one character in the box and watch it fail. Everything else — the film,
+the ledger, the invitation — is optional. That single interaction is the whole
+argument, and it is the only thing the release asks for.
+
+## What is deliberately not in this release
+
+- The three short clips. Ready to derive, not ready to ship.
+- Posts 3–5 of the packet. Post 3 waits for CH-001's write-up and the page's
+ updated limitation to be live, so it lands on an artifact that already
+ reflects the finding.
+- Any paid offer. The offers are defined; none has been sold or delivered.
+- CH-002. Attempted and partially answered; its current field remains asserted
+ with unresolved semantics, and no independent anchor exists yet.
+- CH-003 through CH-005. Open, unattempted, and published as open.
+
+## The next artifact
+
+CH-002 was attempted in the same session and came back with the second outcome:
+no repository-local mechanism can distinguish a measured input from an asserted
+one, because deterministic regeneration lets the author construct any state the
+checks accept. Reproducibility amplifies consistency, not truth.
+
+The completed local step is an explicit provenance record: `realized_fpr` is
+now labelled as semantically unresolved and asserted, rather than silently
+looking derived because it resembles `1/24`. A future derivation must name its
+event, population, source bytes, counts, and rendering; this fixture does not.
+
+The next artifact remains the cheapest external anchor from that write-up —
+timestamping an input at collection, outside the author's control. It requires
+an independent service or measuring party and is not simulated here.
+
+## Frozen
+
+No redesigning the philosophy at minute 178.
diff --git a/docs/research/epistemic-program/research-graph.md b/docs/research/epistemic-program/research-graph.md
new file mode 100644
index 00000000..0b6f66b6
--- /dev/null
+++ b/docs/research/epistemic-program/research-graph.md
@@ -0,0 +1,142 @@
+# The Research Graph
+
+## The invariant
+
+Reading the [inventory](inventory.md) for repeated verbs rather than repeated
+nouns, the same loop appears in the kernel, in the evidence layer, in the tests,
+in the film, and on the canonical page:
+
+```text
+claim
+ → decompose
+ → bind to artifact
+ → reproduce
+ → mutate
+ → observe
+ → bound the conclusion
+ → expose the limitation
+```
+
+The `mutate` step is the one most projects skip. It is the difference between a
+system that reports success and a system that can be shown to fail. Every
+artifact in the inventory that feels distinctive has a mutation step somewhere:
+the adversarial transparency-log test, the one-character edit on the canonical
+page, the reserved-vocabulary rejection, [CH-001](challenges.md).
+
+## Ten ways to say it
+
+Written to be accurate rather than good.
+
+1. Across my work, I keep trying to **make technical claims executable enough to challenge**.
+2. …to **preserve the path between an assertion and the artifact underneath it**.
+3. …to **stop green checks from silently expanding into larger claims**.
+4. …to **design interfaces where evidence retains its boundaries**.
+5. …to **make uncertainty inspectable without making it boring**.
+6. …to **give a result somewhere to fail, in public, before anyone asks**.
+7. …to **keep the assumptions attached to the number after it leaves the room**.
+8. …to **make the width of an interval as visible as its midpoint**.
+9. …to **build systems that can say INCONCLUSIVE without treating it as failure**.
+10. …to **make overclaiming physically uncomfortable to do**.
+
+Numbers 3 and 10 are the annoyingly obvious ones. Those are the keepers.
+
+## The graph
+
+At the centre, one edge:
+
+```text
+CLAIM ────────────► EVIDENCE
+ supported by
+```
+
+Everything else is a question about how that edge can fail.
+
+```mermaid
+graph TD
+ C[CLAIM] -->|supported by| E[EVIDENCE]
+
+ V[Verification can another system reproduce it?] --> E
+ P[Provenance where did this artifact come from?] --> E
+ K[Composition what happens when evidence interacts?] --> E
+ R[Correlation when do independent checks give less than expected?] --> E
+ I[Interfaces how do humans see the evidence?] --> C
+ U[Uncertainty can the system say INCONCLUSIVE?] --> C
+ A[Adversarial challenge can someone try to falsify it?] --> E
+ M[Communication how is this explained without killing curiosity?] --> C
+```
+
+### The eight nodes
+
+| Node | The question it holds open |
+| --- | --- |
+| **Verification** | Can another system, run by someone else, reproduce the observation? |
+| **Provenance** | Where did this artifact come from, and what has happened to it since? |
+| **Composition** | What happens when individual pieces of evidence are combined? |
+| **Correlation** | When do apparently independent checks provide less evidence than their count suggests? |
+| **Interfaces** | How does a human actually see the evidence, and what do they see instead of it? |
+| **Uncertainty** | Can the system say INCONCLUSIVE, and does anything downstream survive it? |
+| **Adversarial challenge** | Can someone deliberately attempt to falsify the result, and is that attempt welcome? |
+| **Communication** | How is all of this explained without destroying the curiosity that brought someone here? |
+
+## Where the artifacts attach
+
+| Artifact | Nodes |
+| --- | --- |
+| Finite-atom LP, Fréchet bounds, endpoint witnesses | Composition, Correlation |
+| Correlation cliff experiments | Correlation, Uncertainty |
+| Sample complexity, outer intervals | Verification, Uncertainty |
+| Role ontology, confirmatory protocol | Composition, Verification |
+| Merkle log, anchoring, receipts | Provenance, Verification |
+| Decay policy | Provenance, Uncertainty |
+| Claim governance verdict | Composition, Interfaces |
+| Deterministic capsule | Verification, Provenance |
+| Adversarial transparency-log tests, CH-001 | Adversarial challenge, Verification |
+| Non-claims, claim boundary manifest, language quarantine | Interfaces, Communication |
+| Claim Observatory | Interfaces, Communication |
+| *Before You See It* | Communication, Uncertainty, Interfaces |
+| Canonical page + WebCrypto check | Verification, Interfaces, Communication |
+| Source ledger, eight-week plan, prompt library | Uncertainty, Communication |
+| Ghost-Ark | Provenance, Verification, Adversarial challenge |
+
+Every node has at least two artifacts attached, and no artifact attaches to only
+one. That is what makes this a program rather than a portfolio: the artifacts
+were not planned against this graph, and they populate it anyway.
+
+## The thinnest node
+
+**Adversarial challenge** was, until this session, held up almost entirely by
+one adversarial test file. [CH-001](challenges.md) was run specifically to load
+it, and it produced the most useful result in the inventory. The node is still
+thin. That is where the next work goes.
+
+## Organizational separation
+
+Intellectual connection does not require organizational merger.
+
+It is accurate to say:
+
+> These projects inform my thinking.
+
+It is not accurate, and not permitted, to say:
+
+> These are all Cubits11 products.
+
+| Name | In the graph | In the org |
+| --- | --- | --- |
+| CC-Framework | Composition, Correlation, bounded evidence | Research repository |
+| Ghost-Ark | Provenance, Verification, Adversarial challenge | **Separate institutional artifact.** Not a product, not a credential, not an endorsement. |
+| Canonical page, film | Interfaces, Communication, Uncertainty | Cubits11 public work |
+
+Keeping these distinct is not modesty. A shared intellectual frame that is
+presented as a shared commercial entity is itself a scope inflation — the same
+error described in
+[evidence scope inflation](evidence-scope-inflation.md), applied to
+institutions instead of hashes.
+
+## Non-claims
+
+- The graph is a description of existing work, not a claim that the work is
+ correct, complete, or novel.
+- Attaching an artifact to a node does not mean that node's question has been
+ answered.
+- The ten sentences are attempts at accuracy about intent. They are not findings.
diff --git a/docs/research/epistemic-program/visibility-manifold.md b/docs/research/epistemic-program/visibility-manifold.md
new file mode 100644
index 00000000..1f7d2798
--- /dev/null
+++ b/docs/research/epistemic-program/visibility-manifold.md
@@ -0,0 +1,134 @@
+# The Visibility Manifold
+
+## The reframe
+
+Do not think: *make more posts.*
+
+Think:
+
+> Increase the number of paths through which the same intellectual object can be
+> encountered.
+
+Five independent posts decay independently. Seven surfaces of one inspectable
+object compound, because every surface is a different-sized door into the same
+room, and everyone who walks through any door arrives at the same place.
+
+```text
+ short clip
+ ↓
+ technical note → CANONICAL ARTIFACT ← philosophical post
+ ↑
+ source + tests
+ ↑
+ challenge
+```
+
+The rule: **every surface must point back at something that can fail.** A
+surface that points only at another surface is marketing. A surface that points
+at an object a stranger can break is research.
+
+## The worked example
+
+One object. The whole thing is:
+
+```text
+189 raw bytes → manifest SHA-256 → browser WebCrypto → equality
+ → mutation → FAIL CLOSED
+```
+
+That is small enough to hold in one hand and real enough to break. Seven
+surfaces come off it.
+
+### Surface A — the experience
+
+The canonical page. Someone reads two paragraphs, edits a character, and watches
+a verification fail. Total time: under a minute. No install, no signup, no
+server.
+
+### Surface B — the visual
+
+A ten-second silent recording, no narration:
+
+```text
+BYTES MATCH → one character changes → FAIL CLOSED → restore → BYTES MATCH
+```
+
+Rendered deterministically from the page itself, the same way the film is, so
+the clip cannot drift from the artifact it depicts. Built by
+`visual_identity/before_you_see_it/render_check_clip.py`.
+
+### Surface C — the aphorism
+
+> A green check should have a falsifiable path to red.
+
+Carries on its own, out of context, and survives being quoted by someone who
+never saw the page.
+
+### Surface D — the technical note
+
+Why hashing the *raw bytes* matters; why the manifest digest has to mean the same
+thing the browser computes; why the drift guard exists; and precisely what the
+match does not prove. Ends at the limitation, not at the success.
+
+### Surface E — the source
+
+Direct links, no navigation required: the fixture, the manifest entry, the page,
+the drift guard test. Anyone can run `sha256sum` and get the same number.
+
+### Surface F — the challenge
+
+> Can you make this page display `BYTES MATCH` while changing the underlying
+> fixture, without causing the drift guard to fail?
+
+This one has already been answered — by us, against ourselves. See
+[CH-001](challenges.md). The challenge surface is the strongest of the seven,
+because it converts an audience into participants and because its most valuable
+possible outcome is being proven wrong in public.
+
+### Surface G — the philosophical post
+
+> Integrity is not truth.
+
+The digest proves something narrow: *these bytes correspond to those bytes.* It
+does not prove *the number inside the file is correct.* And CH-001 showed the
+next rung: reproducing the whole chain from declared inputs does not prove the
+inputs were measured. Developed in
+[evidence scope inflation](evidence-scope-inflation.md).
+
+## Why this object works
+
+Not because SHA-256 is novel. It is the opposite of novel. It works because the
+**epistemic boundary is visible**, and because the demonstration is small enough
+that the boundary is the only interesting thing in the frame.
+
+That is the selection rule for future objects:
+
+| Test | Why |
+| --- | --- |
+| Can a stranger make it fail in under a minute? | Failure they cause themselves is understood, not believed. |
+| Is the mechanism boring? | A novel mechanism draws attention to itself and away from the boundary. |
+| Is the limitation more interesting than the success? | If not, the object is a demo, not a demonstration. |
+| Does the source fit on one screen? | Inspectability is a size property before it is a licensing one. |
+| Would publishing a negative result about it improve it? | If not, it cannot participate in the loop. |
+
+## The multiplication routine
+
+For each new real artifact:
+
+1. Name the one-line mechanism. If it takes a paragraph, it is not the object yet.
+2. Build Surface A — the thing a stranger can operate.
+3. Record Surface B from A directly, never re-staged.
+4. Write the limitation before the announcement.
+5. Extract the aphorism from the limitation, not from the success.
+6. Publish the source path in the same breath as the result.
+7. Open a challenge against it, and answer that challenge yourself first.
+
+Step 7 is what stops the manifold from becoming a funnel.
+
+## Non-claims
+
+- This is a method for distribution, not evidence that the distribution works.
+ No reach, engagement, or reproduction has been measured.
+- The seven surfaces are a decomposition of one object, not a content calendar.
+- Surface F's value depends entirely on people actually attempting it. Until
+ someone outside this repository does, the adversarial node stays thin.
diff --git a/docs/research/future-expansion/README.md b/docs/research/future-expansion/README.md
new file mode 100644
index 00000000..b717b7cf
--- /dev/null
+++ b/docs/research/future-expansion/README.md
@@ -0,0 +1,134 @@
+# Future Expansion: Epistemic Research Upgrade
+
+## Status
+
+Method documentation. This package defines how a narrative, an intuition, or a
+motivational source is converted into research objects that can be tested,
+replicated, or discarded.
+
+It adds no claim to the
+[Claim Boundary Manifest](../../claims/CLAIM_BOUNDARY_MANIFEST.md), changes no
+kernel behavior, produces no measurement, and is not evidence for anything. It
+is a procedure for producing evidence later, under stated rules.
+
+## Purpose
+
+Turn subjective intuition into disciplined inquiry without pretending that
+intuition is evidence.
+
+A source narrative may remain meaningful as reflection or motivation. It must
+not be used to predict revenue, demand, personal outcomes, technical
+feasibility, or market timing. The operating rule is:
+
+```text
+A story may generate a question.
+Only a registered observation may support an answer.
+```
+
+## The operating loop
+
+```text
+Narrative / intuition
+ -> candidate hypothesis
+ -> alternative explanation
+ -> predeclared indicator
+ -> reversible test
+ -> observed result
+ -> replication or control
+ -> bounded decision
+```
+
+The loop is one-directional. A result may retire a hypothesis; it may not
+retroactively edit the indicator that was predeclared to test it.
+
+## Non-negotiable rules
+
+1. No narrative-derived statement becomes a business, product, or technical
+ claim.
+2. Every experiment names a decision it can change and a result that would stop
+ the work.
+3. Results, interpretation, and non-claims remain separate fields.
+4. No human research, customer outreach, external data collection, paid API
+ use, or live cloud work occurs without explicit authorization and
+ appropriate consent.
+5. Tracks stay separate. Two projects may share epistemic methods without
+ sharing customers, claims, data, or branding.
+
+## Research foundations
+
+- Personalized but broadly applicable descriptions can feel unusually accurate.
+ When studying "resonance," use blinded or shuffled comparison material rather
+ than assuming felt accuracy reflects predictive accuracy.
+ [Mason & Budge, 2011](https://pubmed.ncbi.nlm.nih.gov/21315874/)
+- Freeze protocols before observation. OSF registrations are designed as a
+ fixed project state that allows a visible withdrawal record rather than
+ silent revision.
+ [OSF registration guidance](https://help.osf.io/article/330-welcome-to-registrations)
+- Treat small early studies as feasibility work with explicit progression
+ criteria, not as demonstrations of effectiveness.
+ [CONSORT pilot and feasibility guidance](https://www.bmj.com/content/355/bmj.i5239)
+- Attestation mechanisms have separate proof boundaries. AWS Nitro attests
+ enclave measurements; Apple App Attest validates an app instance connecting
+ to a server; C2PA validates association and integrity of signed assertions,
+ not whether those assertions are true.
+ [AWS Nitro](https://docs.aws.amazon.com/enclaves/latest/user/set-up-attestation.html),
+ [Apple App Attest](https://developer.apple.com/documentation/DeviceCheck?changes=_3),
+ [C2PA](https://spec.c2pa.org/specifications/specifications/1.1/specs/C2PA_Specification.html)
+
+## Contents
+
+| Document | What it is | When to use it |
+| --- | --- | --- |
+| [Source Ledger](source-ledger.md) | A worked Week 1 artifact: one narrative source classified statement by statement into reflection, forecast, causal assertion, action heuristic, empirical claim, and marketing funnel, with testable translations and disallowed inferences. | Whenever a narrative, pitch, reading, or founder intuition is proposed as a reason to act. |
+| [Eight-Week Plan](eight-week-plan.md) | The schedule: convert, destroy boundaries, pre-register, build instruments, run reversible work, replicate, review adversarially, decide. | Starting a bounded research push where the deliverable is a dated evidence packet. |
+| [Prompt Library](prompt-library.md) | Eleven prompts that produce research artifacts rather than predictions. | Drafting a ledger entry, a boundary audit, a prior-art sweep, a preregistration, a replay handoff, a decision memo, or a retraction. |
+
+## Relationship to existing CC-Framework surfaces
+
+This package does not create a parallel governance process. Where CC-Framework
+already has a mechanism, the plan uses it:
+
+| Plan artifact | Existing surface |
+| --- | --- |
+| Predeclared claim with owner, falsifier, decision, window, non-claim | [Claim Boundary Manifest](../../claims/CLAIM_BOUNDARY_MANIFEST.md) and `docs/claims/claim_boundary_manifest.v0.1.json` |
+| Explicit non-claim per result | [Non-Claims](../NON_CLAIMS.md) |
+| Evidence typed by what it can support | [Evidence Role Ontology](../../design-specs/evidence_role_ontology.md) |
+| Exploratory result kept separate from confirmatory result | `src/cc/evidence/confirmatory_protocol.py` |
+| Result that expires and must be rechecked | `src/cc/evidence/decay.py` |
+| Replayable record of what was run | [CC Reports and Receipts](../CC_REPORTS.md) |
+| Scoped human sign-off that does not upgrade evidence | `human_review_note` handling in `src/cc/evidence/claim_governance.py`; the dedicated artifact is still a planned [prompt-roadmap item](../prompt-roadmap/09_human_review_artifact.md) |
+| Prompt-shaped execution specs | [Prompt Roadmap](../prompt-roadmap/02_claim_envelope_boundary_envelope.md) |
+
+The one boundary worth restating: a governance PASS means an evidence-bound
+package is internally consistent under the verifier rules. It does not mean the
+underlying result is correct, and it does not mean a system is safe.
+
+## Porting to sibling projects
+
+The eight-week plan carries two project-specific tracks, written to be lifted
+into their own repositories rather than run from here. When those repositories
+are available as writable workspaces, copy this directory to:
+
+| Track | Destination |
+| --- | --- |
+| B2B / Assay-Limina | `limina/docs/future-expansion/` |
+| Vinctura | `docs/pivot/research/future-expansion/` |
+
+Two conditions apply to that copy. First, reconcile the plan with whatever
+experiment registry and claim register already exist in the destination
+repository; do not create a second, competing set of metrics. Second, check the
+destination working tree before writing, since uncommitted work in an unrelated
+area is easy to bury.
+
+## Non-claims
+
+- This package does not establish that any narrative source is accurate,
+ predictive, or causal.
+- Classifying a statement as testable does not mean it has been tested.
+- Completing the eight weeks does not produce certainty; the completion
+ standard is fewer unsupported claims, better instruments, clearer stop
+ conditions, preserved negative evidence, at least one independently
+ replayable result, and a more honest next decision.
+- Nothing here authorizes human-subject research, customer outreach, external
+ data collection, or paid or live cloud work. Those require separate,
+ explicit authorization.
diff --git a/docs/research/future-expansion/eight-week-plan.md b/docs/research/future-expansion/eight-week-plan.md
new file mode 100644
index 00000000..0e96a7a1
--- /dev/null
+++ b/docs/research/future-expansion/eight-week-plan.md
@@ -0,0 +1,285 @@
+# Eight-Week Epistemic Research Upgrade
+
+## Purpose
+
+Turn subjective intuition into disciplined inquiry without pretending that
+intuition is evidence.
+
+A source narrative may remain meaningful as reflection or motivation. It must
+not be used to predict revenue, demand, personal outcomes, technical
+feasibility, or market timing.
+
+```text
+A story may generate a question.
+Only a registered observation may support an answer.
+```
+
+The operating loop, the non-negotiable rules, and the research foundations are
+stated once in the [package README](README.md) and are not repeated here.
+
+## Tracks
+
+The plan runs two independent project tracks that share methods and nothing
+else - no customers, claims, data, or branding.
+
+- **B2B / Assay-Limina.** A technical attestation and provenance wedge. Its
+ central risk is claiming more than a cryptographic mechanism establishes.
+- **Vinctura.** A service operation. Its central risk is promising an operating
+ standard that has not been performed and measured.
+
+CC-Framework hosts this package but is not a third track. Its role is the
+[mapping appendix](#appendix-mapping-onto-cc-framework): the plan reuses the
+governance surfaces this repository already has instead of inventing parallel
+ones.
+
+## Week 1 - Convert story into research objects
+
+**Shared work**
+
+Create a four-column source ledger. A worked example against a real source is in
+[Source Ledger](source-ledger.md).
+
+| Source statement | Classification | Testable translation | Disallowed inference |
+| --- | --- | --- | --- |
+| "A breakthrough is near" | Forecast | Does a predeclared intervention improve a measured outcome? | Revenue or success is inevitable. |
+| "Follow signs" | Ambiguous heuristic | Which traction indicators are defined before results appear? | Retrospective coincidence proves causation. |
+| "Experiment, then formalize what works" | Method heuristic | Does the result reproduce with a control or second run? | One outcome proves a scalable model. |
+| "You are inventive" | Reflective affirmation | Does reflective framing alter effort or experiment completion? | Personality claims are facts. |
+
+**B2B / Assay-Limina**
+
+- Inventory every public technical claim.
+- Map: claim, mechanism, trust root, measured artifact, missing evidence, and
+ explicit non-claim.
+- Flag any claim that moves from "enclave measurement" to "physical capture,"
+ "fraud elimination," or legal admissibility without a demonstrated binding.
+
+**Vinctura**
+
+- Freeze the actual near-term question: whether the operating promise - queue
+ avoidance, dependable delivery, and a well-run session - can be performed and
+ measured.
+- Reconcile the plan with the existing `business/experiments/registry.yml`. Do
+ not create parallel competing metrics.
+- Keep narrative-derived language out of customer-facing copy.
+
+**Gate**
+
+Every active proposition has an owner, evidence state, falsifier, decision, time
+window, and non-claim.
+
+## Week 2 - Prior-art and boundary destruction
+
+**B2B / Assay-Limina**
+
+- Build an attestation-boundary brief covering what Nitro PCRs establish, what
+ App Attest establishes, what C2PA establishes, and what none of them
+ establishes alone.
+- Run a prior-art and public-incident sweep for canonicalization, parse
+ disagreement, provenance failures, and attestation misuse.
+- Create a claim kill list: language that must not ship without specific
+ evidence.
+
+**Vinctura**
+
+- Audit every current customer-facing statement against the existing
+ `business/evidence/claims.yml`.
+- Separate externally sourced market facts, founder assertions, local
+ observations, and assumptions.
+- Define a customer-problem evidence map: queue, turnaround, booking friction,
+ group coordination, route reliability, weather, and portfolio quality.
+
+**Gate**
+
+No "novel," "eliminates," "proves," "secure," "guarantees," or "best" wording
+survives without a named evidentiary standard.
+
+## Week 3 - Pre-register the decisive experiments
+
+**B2B / Assay-Limina**
+
+Prioritize existing high-information work.
+
+1. **X2 - Model-consumer kernel.** Test whether model consumers unify
+ distinctions that named consumers require, with repeated runs, multiple model
+ families, a constrained-output control, a frozen corpus, and an explicit null
+ condition.
+2. **X5 - Consequence search.** Systematically identify public incidents where
+ canonicalization, parser differential, or identity collapse caused a
+ consequential failure. A sparse result is still a result.
+
+**Vinctura**
+
+Prioritize the existing decision-changing experiments.
+
+1. `EXP-FULFILLMENT` - timed end-to-end gallery completion.
+2. `EXP-PRICE` - qualified inquiry-to-booking and package mix.
+3. `EXP-GROUP` - coordination cost and realized contribution per founder hour.
+4. `EXP-ROUTE` - whether published session routes actually fit their time
+ budget.
+
+For each, preserve the current success and failure branches rather than
+rewriting them after a result appears.
+
+**Gate**
+
+A protocol specifies population, provenance, denominator, controls or
+alternative explanations, stop and scale rules, missing-data handling, and the
+non-claim.
+
+## Week 4 - Build instruments before collecting outcomes
+
+**B2B / Assay-Limina**
+
+- Create a research-only proof-boundary notebook or browser lesson recording the
+ claim, the exact verification input, the trusted root, the mutation that must
+ fail, and what remains unknown.
+- Add a positive-control requirement: deliberately break one verifier assumption
+ and show that the instrument reports the break.
+- Write the independent replay instructions before running the experiment.
+
+**Vinctura**
+
+- Prepare a consent-aware operational log for real sessions: inquiry source,
+ quote, booking outcome, package, route timestamps, queue minutes, delivery
+ timestamps, founder minutes by phase, deviations, and customer-initiated
+ comments.
+- Do not introduce third-party tracking merely to measure a funnel. Preserve the
+ site's privacy commitments unless a documented decision changes them.
+
+**Gate**
+
+An instrument that cannot reveal a deliberately introduced defect is not ready
+to measure success.
+
+## Week 5 - Run reversible, low-risk evidence work
+
+**B2B / Assay-Limina**
+
+- Run local, reproducible corpus and verifier work only.
+- Record source revision, host, tool versions, inputs, output hashes,
+ unavailable arms, and failures.
+- Do not run live cloud validation or describe attestation as deployed without
+ explicit approval.
+
+**Vinctura**
+
+- Run only real operational observations authorized by the founder: founding
+ cohort portfolio work, stopwatch-based fulfillment timing, route timing,
+ inquiry logging, and group coordination observations.
+- Do not state a delivery promise until it is repeatedly met under recorded
+ conditions.
+
+**Gate**
+
+Raw observations are stored before interpretation. "It felt like momentum" is
+never a result field.
+
+## Week 6 - Replication, controls, and negative evidence
+
+**B2B / Assay-Limina**
+
+- Re-run selected cells on a second environment or an independent
+ implementation.
+- Test the constrained-output model arm against the same corpus.
+- Publish negative findings, unavailable arms, and disagreements.
+
+**Vinctura**
+
+- Compare first-session and later-session timing rather than treating the first
+ session as representative.
+- For delivery experiments, retain the planned alternating or control pattern.
+- Analyze whether the actual bottleneck is editing, planning, travel,
+ coordination, or customer response.
+
+**Gate**
+
+A one-off success produces a feasibility note, never a mature product claim.
+
+## Week 7 - Adversarial review
+
+**B2B / Assay-Limina**
+
+Ask an independent reviewer to attack trust-root substitutions, replay windows,
+parser and canonicalization mismatch, device-to-byte binding gaps, hidden
+assumptions in "physical capture" language, missing controls, and unreported
+unavailable arms.
+
+**Vinctura**
+
+Ask a skeptical reviewer to attack package-price comparability, portfolio claim
+boundaries, delivery and route promises, customer-data privacy, operational
+feasibility during peak commencement periods, and whether a claim gate hides a
+claim in metadata or alternate routes.
+
+**Gate**
+
+Every substantive objection ends as corrected, rejected with evidence,
+explicitly unresolved, or retracted.
+
+## Week 8 - Decision and publication boundary
+
+Produce two dated evidence packets.
+
+**B2B / Assay-Limina packet**
+
+- Claim-to-evidence matrix.
+- Experiment reports and replay commands.
+- Technical boundary chart.
+- Prior-art and incident-search results.
+- Retracted or narrowed statements.
+- Decision: continue research, narrow to a verifier-side learning module, pursue
+ independent replication, or halt a weak wedge.
+
+**Vinctura packet**
+
+- Experiment registry status.
+- Observed versus assumed operating model.
+- Actual fulfillment and route data.
+- Claim-register updates.
+- Launch-readiness status.
+- Decision: proceed, hold, reprice, simplify the offer, or remove an unevidenced
+ promise.
+
+## Completion standard
+
+At the end of eight weeks, neither project should claim more certainty. Each
+should have:
+
+- fewer unsupported claims,
+- better instruments,
+- clearer stop conditions,
+- preserved negative evidence,
+- at least one independently replayable result,
+- a more honest next decision.
+
+## Appendix: mapping onto CC-Framework
+
+CC-Framework already implements most of what this plan asks for. When the plan
+is run from this repository, use these surfaces rather than building new ones.
+
+| Week | Plan artifact | Existing surface |
+| --- | --- | --- |
+| 1 | Proposition with owner, falsifier, decision, window, non-claim | [Claim Boundary Manifest](../../claims/CLAIM_BOUNDARY_MANIFEST.md) and its JSON companion |
+| 2 | Claim kill list and boundary brief | [Non-Claims](../NON_CLAIMS.md), specifically the forbidden-upgrade table |
+| 3 | Preregistered protocol with stop and scale rules | [Confirmatory Evidence Protocol](../../design-specs/confirmatory_protocol.md) |
+| 4 | Instrument that must detect a deliberate defect | Adversarial tests under `tests/unit/evidence/`, e.g. `test_transparency_log_adversarial.py` |
+| 5 | Recorded run with inputs, versions, and output hashes | [CC Reports and Receipts](../CC_REPORTS.md) and the deterministic capsule under `examples/claim_governance_capsule/` |
+| 6 | Replication and evidence typed by what it supports | [Evidence Role Ontology](../../design-specs/evidence_role_ontology.md); exploratory results stay separate from confirmatory ones |
+| 7 | Review that does not upgrade evidence | `human_review_note` handling in `src/cc/evidence/claim_governance.py` |
+| 8 | Dated packet with a bounded decision | [Claim Envelope](../../design-specs/claim_envelope.md) plus decay semantics in `src/cc/evidence/decay.py` |
+
+Two boundaries carry over unchanged. A governance PASS means an evidence-bound
+package is internally consistent under the verifier rules; it is not a statement
+that a system is safe. A receipt establishes byte integrity; it is not a
+statement that a measurement was valid.
+
+## Non-claims
+
+- Completing this plan does not validate any project, claim, or narrative.
+- Neither evidence packet is a certification, an audit opinion, or a compliance
+ artifact.
+- The Week 5 and Week 6 activities described here are not authorization to
+ perform them. Human research, customer outreach, external data collection,
+ paid API use, and live cloud work each require separate explicit
+ authorization, and human observation requires appropriate consent.
diff --git a/docs/research/future-expansion/prompt-library.md b/docs/research/future-expansion/prompt-library.md
new file mode 100644
index 00000000..64565e37
--- /dev/null
+++ b/docs/research/future-expansion/prompt-library.md
@@ -0,0 +1,277 @@
+# Epistemic Prompt Library
+
+## How to use these
+
+These prompts produce research artifacts, not predictions. Replace bracketed
+text before use. Require citations, source dates, uncertainty, and an explicit
+non-claim in every answer.
+
+Two standing constraints apply to every prompt below.
+
+- A model's output is a draft artifact, not evidence. It enters the record the
+ same way any other draft does: predeclared, reviewed, and bounded.
+- If a prompt's answer would change a financial, legal, medical, safety, or
+ otherwise consequential decision, the answer is insufficient on its own.
+
+The prompts map onto the [eight-week plan](eight-week-plan.md) roughly in order:
+1 for Week 1, 2 and 3 for Week 2, 4 and 5 for Week 3, 6 and 7 for Weeks 3 to 5,
+8 for Week 4, 9 for Week 6, 10 for Week 8, and 11 whenever a prior statement
+stops being supportable.
+
+## 1. Narrative-to-study translator
+
+```text
+You are an epistemic editor. Analyze the following narrative without validating
+its predictions or metaphysical claims:
+
+[PASTE TEXT]
+
+For every substantive statement, label it as:
+REFLECTION, IDENTITY AFFIRMATION, FORECAST, CAUSAL ASSERTION,
+ACTION HEURISTIC, EMPIRICAL CLAIM, or MARKETING FUNNEL.
+
+Then produce:
+1. a charitable interpretation;
+2. a falsifiable translation, if one exists;
+3. the minimum observation needed to test it;
+4. one alternative explanation;
+5. a non-claim;
+6. whether using it for a financial, legal, medical, or consequential decision
+ would be inappropriate.
+
+Do not infer personal facts, future outcomes, or hidden causes.
+```
+
+## 2. Claim-to-proof boundary auditor
+
+```text
+You are a hostile technical reviewer. For each claim below, identify exactly
+what the mechanism proves, what it assumes, and what it cannot establish.
+
+[CLAIMS]
+[ARCHITECTURE OR CODE LINKS]
+
+Return a table:
+claim | cryptographic/operational object | trust root | verifier input |
+attack or failure mode | evidence currently present | evidence missing |
+allowed wording | prohibited wording | explicit non-claim
+
+Reject any leap from:
+- app integrity to physical-world truth;
+- enclave measurement to correct execution;
+- signed assertion to assertion truth;
+- provenance to authenticity;
+- one successful run to universal reliability.
+```
+
+## 3. Prior-art destroyer
+
+```text
+Act as a prior-art researcher trying to falsify this proposed novelty claim:
+
+[CLAIM]
+
+Search primary sources, standards, vendor documentation, peer-reviewed papers,
+public incident reports, and active products. Separate:
+- already solved;
+- partially solved;
+- adjacent but materially different;
+- commercially occupied;
+- genuinely unresolved.
+
+For every source, provide URL, publication date, source type, exact relation to
+the claim, and a confidence rating. End with:
+"what remains narrow enough to investigate honestly."
+
+Do not use search-result snippets as evidence.
+```
+
+## 4. Experiment preregistration architect
+
+```text
+Turn this question into a preregistered experiment:
+
+[QUESTION]
+[DECISION IT MUST CHANGE]
+[AVAILABLE DATA / ACCESS LIMITS]
+
+Specify:
+- hypothesis and falsifier;
+- population and what it does not represent;
+- sampling frame or census rationale;
+- primary measure and denominator;
+- control arm or alternative explanation;
+- required positive-control/discriminator test;
+- exclusions and unavailable-arm treatment;
+- repeat count and stability plan;
+- stop, scale, hold, and kill criteria;
+- ethics/privacy requirements;
+- exact non-claim.
+
+Do not choose thresholds after viewing results.
+```
+
+## 5. Signal-versus-traction designer
+
+```text
+Convert this intuitive "signal" into a predeclared traction measure:
+
+[OBSERVATION OR INTUITION]
+
+Return:
+1. the observable event;
+2. the baseline or comparison;
+3. the collection method;
+4. the time window;
+5. what would count as noise;
+6. what result changes the decision;
+7. the smallest reversible next action;
+8. what must not be inferred.
+
+Explicitly distinguish attention, inquiries, conversion, repeat behavior,
+revenue, margin, and retention. Never substitute one for another.
+```
+
+## 6. Customer-evidence interviewer
+
+```text
+Design a neutral customer-discovery protocol for this decision:
+
+[QUEUE / DELIVERY / GROUPS / ROUTES / PRICING / OTHER]
+
+Create:
+- recruitment criteria;
+- non-leading interview questions;
+- exact operational observations to collect;
+- consent and privacy boundary;
+- disconfirming answers to look for;
+- how to avoid treating compliments as demand;
+- a decision rule tied to the existing experiment registry;
+- a summary template that separates direct quotes, observations, inference,
+ and non-claim.
+
+Do not promise services, ask for sensitive data, or create a marketing claim
+from a single interview.
+```
+
+## 7. B2B consequence-search protocol
+
+```text
+Research whether this technical failure class has caused a real consequence:
+
+[FAILURE CLASS]
+
+Search CVEs, advisories, standards errata, incident postmortems, court filings,
+and vendor security reports. For each candidate, classify:
+- mechanism;
+- affected representation or parser;
+- attacker capability;
+- observed consequence;
+- evidence quality;
+- remediation;
+- relation to our corpus;
+- whether the incident supports prevalence, possibility only, or neither.
+
+Report null findings and search limitations. Do not turn a mechanism into a
+market claim unless consequence evidence supports that step.
+```
+
+## 8. Instrument-sensitivity challenge
+
+```text
+You are validating a research instrument, not its preferred answer.
+
+[INSTRUMENT]
+[INTENDED DETECTION OR MEASUREMENT]
+
+Propose:
+- one deliberate defect the instrument must detect;
+- one negative control it must not flag;
+- one boundary case;
+- one unavailable-arm condition;
+- one mutation that should change the result;
+- one mutation that should not;
+- a pass/fail criterion for each;
+- the consequence if the instrument fails any test.
+
+Explain why a green result without these controls would be uninformative.
+```
+
+## 9. Independent replay handoff
+
+```text
+Create a handoff for an independent reviewer to reproduce this result:
+
+[CLAIM]
+[ARTIFACTS]
+[COMMANDS]
+[ENVIRONMENT]
+
+Include:
+- exact inputs and hashes;
+- expected output and failing output;
+- tool versions;
+- trust roots and keys that may be public;
+- no-secret setup;
+- likely failure modes;
+- how to report disagreement;
+- what agreement would and would not establish.
+
+The handoff must allow the reviewer to disagree safely and visibly.
+```
+
+## 10. Evidence-to-decision board
+
+```text
+Given this evidence packet:
+
+[PACKET]
+
+Make a four-way decision memo:
+CONTINUE, HOLD, NARROW, or STOP.
+
+For each option, state:
+- facts supporting it;
+- facts against it;
+- assumptions still carrying the conclusion;
+- the next cheapest high-information test;
+- irreversible actions that must wait;
+- claims that must be removed or downgraded now;
+- the condition that would reverse the recommendation.
+
+Do not reward activity, novelty, or optimism. Reward only decision-relevant
+evidence.
+```
+
+## 11. Retraction and revision writer
+
+```text
+An earlier statement is no longer supportable:
+
+[OLD STATEMENT]
+[NEW EVIDENCE]
+
+Write:
+1. a precise retraction or downgrade;
+2. what remains true;
+3. what was not measured;
+4. the artifact or source revision that changed the conclusion;
+5. the new allowed wording;
+6. the prohibited wording;
+7. the next experiment, if any.
+
+Never silently delete the old claim or rewrite history as if it was never made.
+```
+
+## Non-claims
+
+- These prompts do not validate their own output. A completed table is a draft,
+ not a finding.
+- A model asked to search may return plausible sources that do not exist or do
+ not say what the summary says. Every citation is checked against the primary
+ source before it enters an artifact.
+- Prompt 1 classifies statements; it does not determine whether a narrative
+ source is meaningful to the person who brought it.
+- Prompts 6 and 7 describe protocols. Running them against real people or
+ external systems requires separate explicit authorization and, for human
+ contact, appropriate consent.
diff --git a/docs/research/future-expansion/source-ledger.md b/docs/research/future-expansion/source-ledger.md
new file mode 100644
index 00000000..16355080
--- /dev/null
+++ b/docs/research/future-expansion/source-ledger.md
@@ -0,0 +1,122 @@
+# Source Ledger: A Worked Week 1 Artifact
+
+## Why this document exists
+
+Week 1 of the [eight-week plan](eight-week-plan.md) converts a narrative source
+into research objects. This is a worked example of that conversion, using an
+actual source: a recorded tarot reading addressed to a general sign-based
+audience, brought into a working session as motivational material alongside two
+active projects.
+
+The point is not to evaluate the source. The point is to demonstrate the gate
+every narrative passes through before it is allowed near a decision. A source
+that survives the gate contributes a *question*. It never contributes an
+*answer*.
+
+The reading may remain meaningful as reflection. Nothing below asks anyone to
+stop finding it meaningful.
+
+## Classification labels
+
+| Label | Definition | Evidential weight |
+| --- | --- | --- |
+| `REFLECTION` | A description of the subject's present state or recent behavior. | None. May be accurate and still carry no predictive content. |
+| `IDENTITY AFFIRMATION` | A statement about who the subject is. | None. |
+| `FORECAST` | A statement about what will happen. | None unless independently registered and observed. |
+| `CAUSAL ASSERTION` | A statement that one thing brings about another. | None. Causal claims require causal assumptions and a design. |
+| `ACTION HEURISTIC` | A rule for what to do next. | None as evidence, but may be a useful, separately justified practice. |
+| `EMPIRICAL CLAIM` | A statement checkable against the world. | Only after predeclaration, observation, and control. |
+| `MARKETING FUNNEL` | Content whose function is engagement or conversion for the source. | None, and a reason for caution about felt accuracy. |
+
+A statement can carry more than one label. Where it does, the strictest handling
+applies.
+
+## The ledger
+
+| Source statement | Classification | Testable translation | Disallowed inference |
+| --- | --- | --- | --- |
+| "Things are just about to turn for you"; the wheel is moving in your favor. | `FORECAST` | None directly. The nearest registerable question is whether a predeclared intervention changes a predeclared measure inside a fixed window. | That improvement is inevitable, scheduled, or owed. Not usable for runway, hiring, spend, or pricing. |
+| "You're going to experience more signs, symbols, and synchronicities" indicating things are turning. | `CAUSAL ASSERTION` / `ACTION HEURISTIC` | Name the traction indicators and the observation window *before* any result is seen, then count them. | That noticing a coincidence afterwards is evidence that a turn occurred. Retrospective matching is the failure mode this whole package exists to block. |
+| "There's been a lot of experimentation going on... you've been testing different approaches." | `REFLECTION` | Count registered experiments started, completed, and abandoned in a fixed prior period. This is directly measurable from an experiment registry. | That the description being accurate makes the forecasts accurate. Broadly applicable descriptions feel personal ([Mason & Budge, 2011](https://pubmed.ncbi.nlm.nih.gov/21315874/)). |
+| "Nobody knows what they're doing. We're all just experimenting." | `ACTION HEURISTIC` | Not a claim. Usable as morale. | That the absence of certainty excuses the absence of protocol. |
+| "This is exactly why this is going to work for you" - because the approach is unconventional. | `FORECAST` + `CAUSAL ASSERTION` | None. The implied mechanism (unconventional therefore successful) is not identifiable from this source. | That unconventionality predicts success. Selection effects make surviving unconventional bets highly visible and failed ones invisible. |
+| "You're inventing something here... solving a problem in a way that nobody ever thought of solving it before." | `IDENTITY AFFIRMATION` + implicit novelty claim | Run a prior-art sweep ([Prompt 3](prompt-library.md#3-prior-art-destroyer)). Novelty is established by failing to find prior art, not by feeling original. | That "novel," "first," or "nobody has done this" may appear in any public copy. Those words require a named evidentiary standard. |
+| "You're noticing the thing that other people haven't noticed." | `IDENTITY AFFIRMATION` | Consequence search ([Prompt 7](prompt-library.md#7-b2b-consequence-search-protocol)): has this failure class produced a documented, consequential outcome anywhere? | That an unnoticed thing is therefore an important thing. A sparse search result is a result, and it may mean the thing is unimportant. |
+| "Divine timing. Right place, right time, right idea." | `CAUSAL ASSERTION` | None. Unfalsifiable as stated. | That timing is externally arranged, and therefore that acting now is lower risk than acting later. |
+| "I'm seeing a blue notebook"; someone working on a laptop in a car; "your phone screen is cracked"; a person with curly hair connected to the innovation; a conversation near a vending machine. | `EMPIRICAL CLAIM` | These are the only literally checkable statements in the source. See [The falsification exercise](#the-falsification-exercise) below - they can be tested, but only under predeclaration, base-rate comparison, and a blinded control. | That a later match confirms anything. Each item is high-prevalence, and "connected to the innovation" is elastic enough to fit almost any encounter unless bounded in advance. |
+| "You get overwhelmed by data sometimes... tied up in a big tangle." | `REFLECTION` | Measure where founder hours actually go by phase. The stated bottleneck and the measured bottleneck are frequently different. | That the felt bottleneck is the real bottleneck. |
+| "The right piece of information comes in at the right time and breaks the loop." | `ACTION HEURISTIC` | Identify the single cheapest measurement that would change the current decision, and run that one first. | That the information will arrive on its own, or that waiting is a strategy. |
+| "There is money attached to this... revenue arriving... a sale, a commission, a royalty, or a referral." | `FORECAST` (financial) | None from this source. Conversion questions belong to an already-registered pricing or funnel experiment that exists independently of the reading. | Hard block: no revenue projection, no pricing decision, no spend commitment, no runway assumption, and no investor- or customer-facing statement may cite or rest on this. |
+| "We're breaking through a ceiling... your income or role or reach is infinitely bigger than you thought." | `FORECAST` | None. | That current constraints are illusory. Constraints are measured, not dispelled. |
+| "An experiment might work once... figure out why it worked, how it worked, and can I make it work again." | `ACTION HEURISTIC` (method) | Does the result reproduce on a second run, a second environment, or an independent implementation? This is the Week 6 replication gate. | That a single success is a scalable model. One-off success supports a feasibility note only ([CONSORT pilot guidance](https://www.bmj.com/content/355/bmj.i5239)). |
+| "Now you've discovered something that works, you don't go messing with it... I need the discipline to not change anything anymore." | `ACTION HEURISTIC` (method) | Freeze the protocol before observation and record deviations rather than absorbing them ([OSF registration guidance](https://help.osf.io/article/330-welcome-to-registrations)). | That freezing a protocol makes the result correct. A frozen protocol prevents silent revision; it does not validate. |
+| "Redirect effort away from things that haven't worked and toward the area that's demonstrating momentum." | `ACTION HEURISTIC` | Predeclare the traction indicators and the stop/scale thresholds, then reallocate when a threshold is crossed ([Prompt 5](prompt-library.md#5-signal-versus-traction-designer)). | That momentum can be judged after the fact from whatever moved. Post-hoc threshold selection converts noise into a mandate. |
+| "More inquiries, more questions, more emails coming in, better numbers, repeat customers, and increasing demand." | `FORECAST` naming real indicators | This is the one place the source names measurable quantities. Adopt the indicator *names*, discard the prediction that they will rise. | That attention equals inquiries, inquiries equal conversion, conversion equals revenue, or revenue equals retention. These are separate measures and are never substituted for one another. |
+| "Claim authority over it, structure it, give it order." | `ACTION HEURISTIC` | Optional and low priority: does writing the protocol down reduce run-to-run variance? | That structure substitutes for evidence. Formalizing an unvalidated result makes it durable, not true. |
+| "Don't let your emotions dictate what you do." | `ACTION HEURISTIC` | Consistent with predeclaring thresholds before results are visible. | That discipline about feelings implies discipline about inference. |
+| "Follow the signs... something you've been experimenting with is starting to answer you back." | `ACTION HEURISTIC` + `FORECAST` | Only in the predeclared-indicator form above. | That ambiguous events count as replies. |
+| "Hit the like button... subscribe... tell me in the comments what you're experimenting with... click the link for the extended reading." | `MARKETING FUNNEL` | Not a claim about the subject. | That felt resonance is independent of the source's incentive to produce resonance. The comment prompt also collects the subject's own specifics, which raises the apparent hit rate of future readings. |
+| "The most important part of any tarot reading is you." | `REFLECTION` | Not a claim. | Nothing follows from it either way - though it is, structurally, an accurate description of where the content comes from. |
+
+## What survives
+
+Three method heuristics survive translation:
+
+1. **Experiment, then replicate, then formalize.** Try things; when something
+ works, find out why and whether it recurs before building on it.
+2. **Allocate on predeclared indicators.** Move resources toward what moves the
+ indicator you named in advance, not toward what looks like momentum in
+ hindsight.
+3. **Freeze the protocol once it works.** Stop tinkering during measurement;
+ record deviations instead of absorbing them.
+
+Each is independently supported by ordinary research practice. None of them is
+supported *by the reading*. The reading is a prompt that surfaced them, which is
+exactly the permitted use: a story generated a question.
+
+Everything else in the ledger - the turn, the timing, the ceiling, the revenue -
+carries no weight and enters no decision.
+
+## The falsification exercise
+
+The five concrete specifics (blue notebook, laptop in a car, cracked phone
+screen, curly-haired person, vending-machine conversation) are the only part of
+the source that could be tested at all. Testing them is optional and cheap. If
+it is done, it is done properly or not at all.
+
+**Decision it can change.** Not a business decision. It calibrates the observer:
+if retrospective matching produces a high hit rate on control material, the rule
+that indicators must be predeclared gets tighter, and narrative-derived signals
+stay out of indicator selection entirely.
+
+**Protocol requirements.**
+
+- Predeclare, in writing and before any observation, what counts as a match for
+ each of the five items - including the boundary of "connected to the
+ innovation," which is otherwise elastic enough to absorb any encounter.
+- Fix the observation window and the scorer before starting.
+- Score against base rates, not against zero. Cracked screens, blue notebooks,
+ curly hair, and vending machines are common; the comparison quantity is how
+ often these appear in an arbitrary equivalent window, not whether they appear.
+- Include a control: score the same five items against a reading drawn for a
+ different sign, or a shuffled transcript, with the scorer blind to which
+ transcript is which ([Mason & Budge, 2011](https://pubmed.ncbi.nlm.nih.gov/21315874/)).
+- Record the result, including a null result, before interpreting it.
+
+**Expected outcome.** Matches on several items, at a rate indistinguishable from
+the control. That is the informative outcome, and it is worth having in writing
+the next time a specific detail feels uncanny.
+
+## Non-claims
+
+- This ledger does not establish that the source is accurate, inaccurate,
+ predictive, or causal. It establishes only what may and may not be inferred
+ from it.
+- Classifying a statement as testable does not mean it has been tested. No
+ observation in this document has been made.
+- The three surviving heuristics are not endorsed *because* the source stated
+ them. They are endorsed because they are separately defensible, and they would
+ survive the source being discarded entirely.
+- No statement in the ledger's "testable translation" column authorizes human
+ research, customer outreach, or external data collection. Those require
+ separate explicit authorization and appropriate consent.
diff --git a/docs/upgrade/BASELINE_MEASUREMENTS.md b/docs/upgrade/BASELINE_MEASUREMENTS.md
new file mode 100644
index 00000000..6e8e4541
--- /dev/null
+++ b/docs/upgrade/BASELINE_MEASUREMENTS.md
@@ -0,0 +1,441 @@
+# Baseline Measurements — cc-framework
+
+> **Status: measured.** Every number in this document was produced by a command
+> run against commit `3e22c39` on 2026-08-19, on the host described in
+> [Host](#host). Numbers that are unflattering are reported anyway. Where a
+> number was *not* measured, the row says so rather than estimating.
+>
+> **Non-claim.** These measurements describe this repository on one host at one
+> commit. They are not a statement about correctness, safety, or the behaviour
+> of any deployed system. A passing test suite is evidence of regression
+> resistance, not of correctness.
+
+Regenerate with `scripts/upgrade_baseline.py` (see [Reproduction](#reproduction)).
+
+---
+
+## Host
+
+| Field | Value |
+|---|---|
+| Platform | Linux 6.18.5, x86-64 |
+| Python | 3.11.15 (CPython) |
+| NumPy / SciPy | 2.x / 1.17.1 |
+| Environment | ephemeral container, `uv venv`, `uv pip install -e '.[test]'` |
+| Commit | `3e22c39` |
+| Date | 2026-08-19 |
+
+A latency figure without a machine is not reproducible. Every timing below is
+host-relative and must be re-measured before it is cited.
+
+---
+
+## 1. Size
+
+| Metric | Value | Command |
+|---|---:|---|
+| Python files in `src/cc` | 90 | `find src -name '*.py' \| wc -l` |
+| Lines in `src/cc` | 41,645 | `find src -name '*.py' -exec cat {} + \| wc -l` |
+| Test files | 108 | `find tests -name '*.py' \| wc -l` |
+| Markdown files (repo) | 136 | `find . -name '*.md' -not -path './.git/*' \| wc -l` |
+| Markdown files (`docs/`) | 90 | `find docs -name '*.md' \| wc -l` |
+| JSON schemas | 2 | `ls schemas/*.json schemas/evidence/*.json` |
+| Working tree (excl. `.git`) | 54 MB | `du -sh --exclude=.git .` |
+| `.git` | 43 MB | `du -sh .git` |
+
+### Per-package line counts
+
+| Package | Files | Lines |
+|---|---:|---:|
+| `src/cc/core` | 13 | 10,462 |
+| `src/cc/evidence` | 11 | 9,946 |
+| `src/cc/kernel` | 12 | 6,389 |
+| `src/cc/analysis` | 9 | 4,384 |
+| `src/cc/cartographer` | 9 | 2,896 |
+| `src/cc/redteam` | 2 | 1,413 |
+| `src/cc/reporting` | 4 | 1,343 |
+| `src/cc/adapters` | 6 | 1,191 |
+| `src/cc/evals` | 3 | 993 |
+| `src/cc/guardrails` | 6 | 726 |
+| `src/cc/exp` | 1 | 710 |
+| `src/cc/enterprise` | 2 | 524 |
+| `src/cc/io` | 2 | 204 |
+| `src/cc/utils` | 6 | 236 |
+| `src/cc/cli` | 2 | 117 |
+| `src/cc/_legacy` | 1 | 89 |
+
+`cc.core` and `cc.evidence` together are 20,408 lines — 49% of the source tree —
+against a `cc.kernel` of 6,389 lines. The mathematical core the project exists
+to provide is 15% of its own source.
+
+---
+
+## 2. Test suite
+
+### Out of the box, from the declared test extra
+
+```bash
+uv venv .venv && uv pip install -e '.[test]' && pytest
+```
+
+| Result | Count |
+|---|---:|
+| Passed | 685 |
+| **Failed** | **1** |
+| **Errors** | **3** |
+| Skipped | 9 |
+| Wall time | 87 s |
+
+Failures:
+
+- `tests/unit/packaging/test_wheel_boundary.py` — 3 errors, `No module named build`
+- `tests/regression/week2/test_week2_deliverables.py::test_unit_tests_pass` — cascaded
+
+After installing `build`, a second, distinct failure appears:
+`BackendUnavailable: Cannot import 'setuptools.build_meta'`.
+
+**The `[test]` extra cannot run the test suite.** It omits `build`, `setuptools`,
+and `wheel`, all of which `tests/unit/packaging/` requires. See finding
+[F-01](FINDINGS_REGISTER.md#f-01).
+
+### After adding the three undeclared dependencies
+
+| Result | Count |
+|---|---:|
+| Passed | 689 |
+| Failed | 0 |
+| Skipped | 9 |
+| Wall time | 90 s |
+
+This is the green baseline the rest of the plan builds on.
+
+### Skipped tests (9)
+
+Skips are gated by environment variables or optional dependencies:
+`CC_RUN_EXPERIMENTS`, `CC_RUN_PERF`, `guardrails`, `fastavro`, `protobuf`,
+`SQLAlchemy`. No CI job sets any of them, so **no CI run has ever executed the
+experiment or performance lanes.**
+
+---
+
+## 3. Coverage
+
+`pytest --cov=src/cc --cov-report=term-missing`
+
+| Metric | Value |
+|---|---:|
+| Statements | 15,149 |
+| Missed | 3,904 |
+| Branches | 4,762 |
+| Partial branches | 1,070 |
+| **Total coverage** | **69.91%** |
+
+There is **no coverage gate in CI**. This number has never been enforced.
+
+### Modules below 60%
+
+| Module | Stmts | Cover | Note |
+|---|---:|---:|---|
+| `reporting/cli.py` | 204 | **0.00%** | the `cc-report` entry point — the product surface |
+| `cli/manifest.py` | 68 | **0.00%** | |
+| `core/audit_runner.py` | 199 | 17.45% | |
+| `guardrails/semantic_filter.py` | 38 | 18.75% | |
+| `guardrails/toy_threshold.py` | 42 | 21.43% | |
+| `enterprise/aws_reference.py` | 143 | 23.87% | |
+| `guardrails/regex_filters.py` | 138 | 24.18% | |
+| `analysis/reporting.py` | 153 | 26.42% | |
+| **`core/stats.py`** | **756** | **38.16%** | **the statistics engine; 434 statements unexercised** |
+| `evals/run_bench.py` | 189 | 49.39% | |
+| `cartographer/bounds.py` | 272 | 52.99% | |
+| `utils/artifacts.py` | 50 | 53.70% | |
+| `analysis/cc_estimation.py` | 118 | 56.08% | |
+| `core/guardrail_api.py` | 95 | 57.48% | |
+| `core/registry.py` | 79 | 57.89% | |
+| `core/metrics.py` | 244 | 59.15% | |
+
+The two largest uncovered surfaces are the **CLI that emits reports** (0%) and
+the **statistics module** (38% of 756 statements). Both are on the path from
+evidence to a published number.
+
+### Modules above 90%
+
+`kernel/frechet_classes.py` 98.87%, `evidence/permission_compiler.py` 95.28%,
+`reporting/canonical.py` 91.89%, `core/manifest.py` 90.74%,
+`evidence/role_ontology.py` 90.53%.
+
+The kernel is well covered. The plumbing around it is not.
+
+---
+
+## 4. Type checking
+
+`pyproject.toml` declares:
+
+```toml
+[tool.mypy]
+packages = ["cc"]
+strict = true
+```
+
+Running mypy **at its own declared scope**:
+
+```
+Found 279 errors in 47 files (checked 101 source files)
+```
+
+CI runs mypy on an explicit list of **7 files**:
+
+```
+src/cc/adapters/base.py src/cc/cartographer/audit.py
+src/cc/cartographer/bounds.py src/cc/cartographer/intervals.py
+src/cc/io/storage.py src/cc/utils/artifacts.py src/cc/utils/timing.py
+```
+
+`.pre-commit-config.yaml` uses the same 7-file list.
+
+The repository declares strict typing across the `cc` package and enforces it on
+7.8% of the files. See finding [F-02](FINDINGS_REGISTER.md#f-02).
+
+---
+
+## 5. Kernel numerics
+
+### Fréchet–Hoeffding recovery
+
+`identified_region` versus the closed form `[max(0, pA+pB-1), min(pA, pB)]`:
+
+| `(pA, pB)` | LP interval | Closed form | Abs. error |
+|---|---|---|---:|
+| (0.1, 0.2) | [0, 0.1] | [0, 0.1] | 0 |
+| (0.5, 0.5) | [0, 0.5] | [0, 0.5] | 0 |
+| (0.9, 0.8) | [0.7, 0.8] | [0.7, 0.8] | 1.11e-16 |
+| (0.01, 0.99) | [0, 0.01] | [0, 0.01] | 0 |
+| (1e-6, 1e-6) | [0, 1e-6] | [0, 1e-6] | 0 |
+| (0.999999, 0.999999) | [0.999998, 0.999999] | same | 0 |
+
+Worst absolute error across the six configurations: **1.11e-16** — one unit in
+the last place of a float64. **The LP kernel is numerically exact on this
+family.** This is the strongest single result in the repository and it is
+currently unadvertised.
+
+Coverage caveat: six marginal configurations is a hand-chosen census, not a
+sample. It carries no confidence interval and does not establish exactness
+outside these points. Property-based testing over the marginal simplex is
+workstream [W4](EPISTEMIC_UPGRADE_PLAN.md#w4).
+
+### Scaling: atoms = 2^m
+
+`m` guardrails, all marginals fixed at 0.1, query = intersection of all:
+
+| m | atoms | wall time | interval |
+|---:|---:|---:|---|
+| 2 | 4 | 0.003 s | [0, 0.1] |
+| 6 | 64 | 0.005 s | [0, 0.1] |
+| 10 | 1,024 | 0.039 s | [0, 0.1] |
+| 12 | 4,096 | 0.146 s | [0, 0.1] |
+| 14 | 16,384 | 0.766 s | [0, 0.1] |
+| 15 | 32,768 | 1.738 s | [0, 0.1] |
+| 16 | 65,536 | 3.642 s | [0, 0.1] |
+| 17 | 131,072 | 8.962 s | [0, 0.1] |
+| 18 | 262,144 | 19.978 s | [0, 0.1] |
+
+Single measurement per point, no repetition, so **no dispersion is reported and
+none should be inferred**. Repeated-measurement timing with p50 and IQR is
+workstream [W7](EPISTEMIC_UPGRADE_PLAN.md#w7).
+
+Practical ceiling for the exact LP on this host: **m ≈ 18**, roughly doubling
+per added guardrail. This is the measured basis for the relaxation hierarchy in
+VISION Pillar VI — not an assumption.
+
+### The correlation cliff, reproduced
+
+Eighteen guardrails, each failing at p = 0.1, composed as a conjunction:
+
+- independence would predict `0.1^18 = 1e-18`
+- the sharp identified interval is **[0, 0.1]**
+
+Under adversarial dependence, **eighteen stacked filters bound no better than
+one**. The upper bound is `min_i p_i`, independent of `m`. This is the
+project's thesis and it reproduces in 20 seconds on a laptop-class host.
+
+---
+
+## 6. Canonicalization kernel
+
+Probing `cc.reporting.canonical.canonical_json_bytes` in the style of
+Ghost-Ark's E1 provenance-kernel census. Intent is declared per class; the
+verdict compares observation to intent.
+
+```bash
+PYTHONPATH=src python scripts/canonicalization_probe.py
+```
+
+| Class | Intent | Observed | Verdict |
+|---|---|---|---|
+| unicode-key-collision (NFC vs NFD) | distinct | collapsed | **unintended-kernel** |
+| nested-unicode-key-collision | distinct | collapsed | **unintended-kernel** |
+| negative-zero | equivalent | distinct | over-discrimination |
+| integer-above-2^53 | distinct | distinct | sound (CPython only — see below) |
+| int-vs-float-same-value | distinct | distinct | sound |
+| bool-vs-int | distinct | distinct | sound |
+| float-exponent-form | distinct | distinct | sound |
+| safe-integer-neighbours | distinct | distinct | sound (positive control) |
+| object-key-order | equivalent | collapsed | sound (positive control) |
+| array-element-order | distinct | distinct | sound (positive control) |
+| large-document-single-byte | distinct | distinct | sound (positive control) |
+
+**Verdict counts: 8 sound, 2 unintended-kernel, 1 over-discrimination.**
+Provenance is `census` — exact counts, no confidence intervals.
+
+The four positive controls pass, which is what makes the two failures credible
+rather than an artifact of an over-strict probe.
+
+Findings [F-03](FINDINGS_REGISTER.md#f-03) through
+[F-07](FINDINGS_REGISTER.md#f-07) record these in full. The headline:
+
+```python
+>>> canonical_json_bytes({"é": 1, "é": 2}) # NFC key, NFD key
+b'{"\xc3\xa9":2}'
+```
+
+Two distinct input keys, one output key, **no error raised**. The receipt hash
+covers a document that is not the document supplied.
+
+The probe exits non-zero while any class carries `unintended-kernel` or
+`rejection-asymmetry`, so this measurement is falsifiable rather than asserted:
+fix the canonicalizer and the probe goes green.
+
+### RFC 8785 (JCS) conformance
+
+| Value | cc-framework emits | JCS emits | |
+|---|---|---|---|
+| `1e30` | `1e+30` | `1e+30` | ok |
+| `10**30` | `1000000000000000000000000000000` | `1e+30` | **diverges** |
+| `1.0` | `1.0` | `1` | **diverges** |
+| `-0.0` | `-0.0` | `0` | **diverges** |
+| `1e-7` | `1e-07` | `1e-7` | **diverges** |
+| `100.0` | `100.0` | `100` | **diverges** |
+
+Five of six number forms diverge from RFC 8785. cc-framework's canonical form is
+`json.dumps(sort_keys=True)`, which is a *convention*, not a *standard*, and it
+is not the convention its sibling repositories use.
+
+---
+
+## 7. Claim-discipline surface
+
+### What exists
+
+| Artifact | Lines | Enforced by |
+|---|---:|---|
+| `docs/research/NON_CLAIMS.md` | — | prose + verifier substring engine |
+| `docs/claims/CLAIM_BOUNDARY_MANIFEST.md` (C0–C5 levels) | — | not cross-checked against the JSON |
+| `docs/claims/claim_boundary_manifest.v0.1.json` | — | `tests/unit/docs/test_claim_boundary_manifest.py` |
+| `scripts/validate_claim_boundary_manifest.py` | — | called by that test, which CI runs |
+| `src/cc/evidence/permission_compiler.py` forbidden-phrase list | 202 stmts | unit tests |
+| `docs/theory/theorem_ledger.md` | 10 KB | test witnesses named per theorem |
+| `docs/research/THEOREM_LEDGER.md` | 3 KB | — (second, divergent ledger) |
+
+`grep` across `.github/workflows/` and `.pre-commit-config.yaml` for
+`claim`/`scan` returns only Bandit and detect-secrets, so **no forbidden-phrase
+scanner runs in CI**.
+
+The claim-boundary manifest, however, *is* enforced — via pytest rather than a
+named workflow step. `tests/unit/docs/test_claim_boundary_manifest.py` calls
+`validate_claim_boundary_manifest.validate_manifest`, which checks required
+keys, unique ids, level resolution, non-empty non-claims, and **the existence of
+every `supporting_files` path on disk**. It passes with zero errors over all
+eight declared claims. See the correction note in
+[F-12](FINDINGS_REGISTER.md#f-12); an earlier draft of this document said
+otherwise and was wrong.
+
+### Proto-scan: Ghost-Ark's forbidden patterns applied here
+
+| Pattern | Hits |
+|---|---:|
+| `guarantee` | 70 |
+| `production[- ]ready` | 7 |
+| `enterprise[- ]ready` | 2 |
+| `tamper[- ]proof` | 1 |
+| `enterprise[- ]grade`, `formally verified`, `zero risk`, `secure by default`, `unbreakable`, `audit complete`, `one-click compliance` | 0 |
+
+Inspection of the hits matters more than the count:
+
+- The `guarantee` hits are **overwhelmingly negated** — `does not guarantee`,
+ `no guarantee of`. A naive scanner ported from Ghost-Ark would produce 70
+ false positives on this repository and be switched off within a week.
+- The `production[- ]ready` and `tamper[- ]proof` hits are mostly **inside the
+ claim-discipline machinery itself** (`permission_compiler.py`'s forbidden list,
+ `NON_CLAIMS.md`, the release checklist saying the project is *not*
+ production-ready).
+
+So the honest reading is: **cc-framework's prose discipline is already good; its
+enforcement is absent.** The scanner this repository needs is not Ghost-Ark's —
+it needs negation and allowlist handling from day one. See
+[W2](EPISTEMIC_UPGRADE_PLAN.md#w2).
+
+---
+
+## 8. CI gates
+
+| Gate | Present | Scope |
+|---|---|---|
+| ruff lint | yes | whole repo |
+| ruff format | yes (pre-commit) | whole repo |
+| mypy | yes | **7 files of 90** |
+| pytest | yes | full suite, Python 3.10–3.13 |
+| coverage threshold | **no** | — |
+| claim scanner (forbidden phrases) | **no** | — |
+| claim-boundary manifest validation | yes | via pytest, not a named CI step |
+| artifact boundary | yes | `scripts/check_artifact_boundary.py --static` |
+| package build + twine check | yes | — |
+| enterprise smoke (moto) | yes | — |
+| minimal example | yes | `examples/minimal/run_bounds.py` |
+| Bandit / detect-secrets / pip-audit | yes | `security.yml` |
+| mutation testing | **no** | — |
+| property-based test gate | **no** | hypothesis is a declared dep; no gate |
+| cross-language verifier agreement | **no** | no second implementation exists |
+| adversarial receipt corpus | **no** | — |
+| reproducibility replay manifest | partial | `scripts/reproduce_paper.py`, not a manifest |
+
+---
+
+## 9. Repository hygiene
+
+| Item | Measurement |
+|---|---|
+| Largest tracked files | 7 Blender renders, 2.2–2.8 MB each, **17.8 MB total** |
+| Archived JSONL checkpoints | 4 × 636 KB in `docs/archive/generated-checkpoints/` |
+| `.git` size | 43 MB against a 54 MB working tree |
+| Duplicate theorem ledgers | `docs/theory/theorem_ledger.md` (10 KB) and `docs/research/THEOREM_LEDGER.md` (3 KB) |
+| Legacy shim | `src/cc/_legacy/` — 89 lines, one file |
+| `build/` directory on disk | present, untracked (0 files in git) |
+| Schema `$id` host | `cc-framework.local` — not resolvable |
+
+---
+
+## Reproduction
+
+Every table above is regenerated by:
+
+```bash
+python scripts/upgrade_baseline.py --out docs/upgrade/baseline.json
+```
+
+The script is a deliverable of workstream [W0](EPISTEMIC_UPGRADE_PLAN.md#w0). Until
+it exists, this document is a **hand-recorded measurement**, and it says so
+here rather than implying automation that is not present.
+
+## What was not measured
+
+Reported so that absence is not mistaken for a null result:
+
+- **Mutation score.** No mutation testing has ever been run on this repository.
+- **Cross-language agreement.** No second implementation of the kernel exists
+ inside this repository to disagree with.
+- **External reviewer reproduction.** No stranger has ever reproduced these
+ artifacts. Every adversary in this tree was written by the author of the code
+ it attacks.
+- **Timing dispersion.** Every timing above is a single measurement.
+- **Real guardrail marginals.** No `p_i` in this repository was measured against
+ a production guardrail. All are supplied, synthetic, or assumed.
diff --git a/docs/upgrade/COMMITTEE_SCORECARD.md b/docs/upgrade/COMMITTEE_SCORECARD.md
new file mode 100644
index 00000000..07dd6aa0
--- /dev/null
+++ b/docs/upgrade/COMMITTEE_SCORECARD.md
@@ -0,0 +1,438 @@
+# Committee Scorecard — cc-framework, August 2026
+
+> Modelled on Ghost-Ark's committee scorecard. Scores are **judgements, not
+> measurements** — they are defensible only because each one names the evidence
+> that would raise it and the evidence that would lower it. A score whose
+> movement conditions are unstated is meaningless.
+>
+> Passing tests are evidence. Passing tests are not correctness. Passing tests
+> are not safety. Passing tests are not production readiness.
+
+Baseline facts: [BASELINE_MEASUREMENTS.md](BASELINE_MEASUREMENTS.md).
+Defects: [FINDINGS_REGISTER.md](FINDINGS_REGISTER.md).
+
+---
+
+## Summary
+
+| # | Dimension | Now | Target (v0.4) | Workstream |
+|---|---|---:|---:|---|
+| 1 | Mathematical correctness | **8.9** | 9.4 | W4 |
+| 2 | Canonicalization & provenance integrity | **8.2** | 8.5 | W3 |
+| 3 | Claim discipline — prose | **8.8** | 9.2 | W2 |
+| 4 | Claim discipline — enforcement | **4.0** | 8.5 | W2 |
+| 5 | Test depth | **6.4** | 8.5 | W4 |
+| 6 | External reproducibility | **4.2** | 8.0 | W0, W7 |
+| 7 | Consumability as a library | **6.8** | 8.5 | W5 |
+| 8 | Cross-implementation agreement | **6.5** | 8.0 | W5 |
+| 9 | Empirical grounding | **2.4** | 6.5 | W7 |
+| 10 | Statistical honesty machinery | **7.9** | 9.0 | W4, W7 |
+| 11 | Evidence-governance architecture | **7.6** | 8.5 | W6 |
+| 12 | Formal readiness | **3.1** | 4.5 | W4 |
+
+**Committee verdict.** cc-framework is approximately:
+
+- **8.4 / 10** as a *mathematical* research artifact — the kernel is exact, the
+ theorem ledger names witnesses, the non-claims are unusually disciplined.
+- **4.1 / 10** as a *verifiable evidence* artifact — the canonicalization kernel
+ has an unexamined collapse, nothing enforces the claim manifest, and no
+ independent implementation exists to disagree with it.
+- **6.8 / 10** as a *consumable library* — was 2.6. W5 shipped an ROC-free
+ composition surface, a published conformance corpus, an independent Node
+ implementation, and a cross-language guard. A real consumer's published
+ numbers now reproduce from the library.
+
+The gap between the first and third numbers is the whole plan. W5 has closed
+most of it; W6 and the empirical lanes remain.
+
+---
+
+## 1. Mathematical correctness — 8.9 {#mathematical-correctness}
+
+*Measures: whether the computed bounds are the bounds claimed.*
+
+**Evidence supporting.** FH recovery exact to 1.11e-16 worst case across six
+marginal configurations. `kernel/frechet_classes.py` 98.87% covered. Theorem
+ledger T1–T6 with proof status, implementation witness, test witness, and a
+per-theorem non-claim. Infeasibility raises rather than returning a plausible
+number. Monotonic tightening tested. LP is sharp by finite-dimensional convexity,
+computationally witnessed.
+
+**What would raise it.** Property-based tests over the marginal simplex rather
+than six chosen points (the current evidence is a census, not a sample, and
+carries no interval). Dual certificates emitted alongside primal witnesses so a
+skeptic can verify optimality without re-solving. Exact rational arithmetic for
+small instances as a cross-check on the float path.
+
+**What would lower it.** Any marginal configuration where the LP and the closed
+form disagree beyond solver tolerance. A degenerate constraint set that returns
+`optimal` on an empty feasible region.
+
+---
+
+## 2. Canonicalization & provenance integrity — 8.2 {#canonicalization-provenance-integrity}
+
+*Measures: whether a receipt identifies the document it claims to.*
+
+> **Revised upward from 3.8 on 2026-08-19**, on delivered evidence. Every S1
+> finding in this dimension is fixed. See
+> [CANONICAL_PROFILE.md](../architecture/CANONICAL_PROFILE.md).
+
+**Evidence supporting.** `cc.canonical.v2` implements RFC 8785: ECMAScript
+`Number::toString` number forms, UTF-16 code-unit key ordering, no
+normalization, and one declared narrowing (the IEEE-754 safe integer range)
+documented rather than left implicit. 15 of 15 probed number forms conform.
+
+The census at `scripts/canonicalization_probe.py` runs 14 declared-intent
+classes across both profiles and reports, under v2: **12 sound, 1 fail-closed,
+1 sound-by-rejection** — zero `unintended-kernel`, zero `rejection-asymmetry`,
+zero `over-discrimination`. Four positive controls pass, which is what makes the
+result a fix rather than a trade. `tests/unit/canonical/` holds all of it with 57
+tests, and a further test asserts v1 *still* carries its defects, so the legacy
+profile cannot be silently "fixed" out from under historical receipts.
+
+Duplicate keys are refused on read at any nesting depth, wired into the report
+CLI, the claim-governance readers, and the Merkle log.
+
+Migration was done without breaking history: verification dispatches on the
+profile each receipt declares, and every regenerated capsule artifact was diffed
+with hashes, hash-derived ids, and the profile identifier scrubbed. All eleven
+were byte-identical under that scrub — only hashes moved.
+
+**What still lowers it.** No fuzzing of the canonicalizer: every class was
+authored by hand, so the census establishes that the declared classes behave as
+declared and nothing about the rest of the input space. **No cross-language
+differential test on receipts** — the corpus establishes agreement on the
+composition kernel, but nothing yet re-canonicalizes a CC report in another
+language and compares digests, so "cross-language verifiable" currently
+describes v2's design rather than a demonstrated result. No external reviewer
+has attacked either profile.
+
+**What would raise it further.** A receipt-level differential against a
+non-Python JCS implementation. A fuzzer over the canonicalizer.
+
+**What would lower it.** A collision found by anyone outside the project.
+
+---
+
+## 3. Claim discipline — prose — 8.8 {#claim-discipline-prose}
+
+*Measures: whether the words stay inside the evidence.*
+
+**Evidence supporting.** `NON_CLAIMS.md` is a genuine artifact — ten non-claims,
+each with why-not and what-instead. The C0–C5 claim-boundary manifest maps every
+public claim to level, lane, support, tests, files, and non-claim. `VISION.md`
+labels itself aspirational in its first line and refuses to relax a single
+non-claim. `cliff.py` refuses confidence claims on post-selection intervals *in
+code*, with a comment explaining the statistics. Legacy metrics emit
+`FutureWarning` naming what they are not.
+
+This is, in places, stronger than the flagship's. The C0–C5 lattice has no
+Ghost-Ark equivalent.
+
+**What would raise it.** Adopting Vinctura's stricter rule — *no orphan claims:
+every public sentence carries the command that falsifies it, or an explicit
+limitation* — and applying it to the README. Conceding the 1935 point
+([F-18](FINDINGS_REGISTER.md#f-18)) above the fold instead of leaving it for a
+critic to make.
+
+**What would lower it.** Any README sentence a reader cannot map to a command.
+
+---
+
+## 4. Claim discipline — enforcement — 4.0 {#claim-discipline-enforcement}
+
+*Measures: whether the discipline survives an author in a hurry.*
+
+> **Revised upward from 2.1 on 2026-08-19.** The original score rested partly on
+> the claim that `validate_claim_boundary_manifest.py` was "wired into nothing —
+> not CI, not the Makefile, not a test." The first two were right and the third
+> was wrong: it is called by
+> `tests/unit/docs/test_claim_boundary_manifest.py`, which runs in the pytest
+> suite CI executes on four Python versions. See the correction note in
+> [F-12](FINDINGS_REGISTER.md#f-12).
+
+**Evidence supporting.** The claim-boundary manifest **is** enforced, and more
+thoroughly than most such artifacts: the validator checks required keys, unique
+ids, claim-level resolution, non-empty non-claims per claim, and the existence
+on disk of every `supporting_files` path. It passes with zero errors across all
+eight declared claims. `permission_compiler.py` carries a forbidden-phrase list
+and is 95.28% covered. The claim-governance verifier checks non-claim substance
+rather than exact strings. `check_artifact_boundary.py` runs in CI.
+
+**What lowers it.** No forbidden-phrase scanner in CI at all — the gate
+Ghost-Ark runs on every file has no counterpart here. Two divergent theorem
+ledgers with no governing rule ([F-15](FINDINGS_REGISTER.md#f-15)). Strict typing
+declared for the `cc` package and enforced on 7 of 90 files
+([F-02](FINDINGS_REGISTER.md#f-02)) — claim inflation expressed in build
+configuration. Two narrow manifest gaps remain unenforced
+([F-12](FINDINGS_REGISTER.md#f-12)): test paths are not checked for existence,
+and the Markdown and JSON manifests are not cross-checked.
+
+The prose is 8.8 and the enforcement is 4.0. The gap is real but narrower than
+first reported: what is missing is a phrase-level scanner and honest typing,
+not the claim ledger itself.
+
+**What would raise it.** A claim scanner with negation and allowlist handling
+from day one — a naive port of Ghost-Ark's would fire on 70 negated uses of
+"guarantee" and be disabled within a week. The typing ratchet. Closing the two
+manifest gaps.
+
+**What would lower it.** A published claim that no artifact supports, merged
+green.
+
+---
+
+## 5. Test depth — 6.4 {#test-depth}
+
+*Measures: whether the suite would notice a defect.*
+
+**Evidence supporting.** 689 tests, 108 files, unit/integration/e2e/regression/
+performance/experiment separation, adversarial tests for the transparency log,
+fail-closed semantics tested, selective-inference guard tested, 69.91% coverage
+with branch coverage on.
+
+**What lowers it.** The report CLI at 0% ([F-13](FINDINGS_REGISTER.md#f-13)).
+`core/stats.py` at 38% over 756 statements
+([F-14](FINDINGS_REGISTER.md#f-14)) — the statistics engine, in a repository
+about statistical honesty. No coverage gate. No mutation testing, so the score is
+*unknown*, not low. Hypothesis is a declared dependency with no gate. A
+regression test that shells out to the whole unit suite and masks real failures
+([F-20](FINDINGS_REGISTER.md#f-20)). Nine tests that have never run in CI
+([F-17](FINDINGS_REGISTER.md#f-17)).
+
+**What would raise it.** Coverage floor at the measured 69.91%, ratcheting.
+Mutation testing on `kernel/` and `reporting/` with a published score. Property-
+based tests on the statistics module. CLI golden tests.
+
+**What would lower it.** A defect found downstream that the suite could have
+caught.
+
+---
+
+## 6. External reproducibility — 4.2 {#external-reproducibility}
+
+*Measures: whether a stranger can reproduce the artifacts.*
+
+**Evidence supporting.** `scripts/reproduce_paper.py`,
+`scripts/verify_paper_artifacts.py`, a claim-governance capsule with expected
+outputs and a manifest, `examples/minimal/`, a devcontainer, a Dockerfile,
+`make reproduce-*` targets, pinned artifact manifests.
+
+**What lowers it.** The documented install path produces a red suite
+([F-01](FINDINGS_REGISTER.md#f-01)) — the first thing a stranger encounters is a
+failure that is not a real failure. No single-command reproduction. No replay
+manifest in Ghost-Ark's sense. **No stranger has ever done it**; every adversary
+in this tree was written by the author of the code it attacks.
+
+**What would raise it.** `make verify` that goes green from a clean clone on a
+clean machine, tested in CI from `.[test]` specifically. A reviewer Dockerfile.
+One external person reproducing the paper artifacts and saying so in writing.
+
+**What would lower it.** An external reviewer failing to reproduce.
+
+---
+
+## 7. Consumability as a library — 6.8 {#consumability-as-a-library}
+
+*Measures: whether a downstream project can depend on this instead of rewriting it.*
+
+> **Revised upward from 2.6 on 2026-08-19**, on delivered evidence rather than
+> intent. What moved it is listed below; each item is a command.
+
+**Evidence supporting.** `cc.compose` takes named marginals and returns a sharp
+interval, with no ROC, Youden, threshold, or operating-point concept anywhere in
+its signature — pinned by a test that greps the signatures for that vocabulary,
+so the surface cannot drift back to the shape a consumer already walked away
+from. Deterministic predicates are first-class; detectors reach the same surface
+through `marginal_from_operating_point`, which points *inward*.
+
+The result object carries what qualifies the number: the independence baseline,
+the understatement factor, the binding event, the marginal provenance
+(`measured` / `assumed` / `supplied`), and the non-claims. A bound over assumed
+rates cannot be serialized without the word `assumed` attached.
+
+`cc-guard` exposes the inference guards as a stdin/stdout JSON subcommand *and*
+as a pure-data decision table, so a non-Python caller needs no Python process.
+A test asserts the table and the implementation agree rule by rule, and another
+asserts `cc-guard` reaches the same verdict as `cc.kernel.cliff.cliff_certificate`
+in both directions — the CLI can neither permit what the kernel refuses nor
+refuse what it permits.
+
+**The acceptance gate passed.** `tests/acceptance/test_external_consumer_reproduction.py`
+reproduces an external consumer's *published* four-control result from
+`cc.compose`: interval `[0, 0.01]`, independence baseline `1.2e-5`,
+understatement factor `833×`, all three published scenarios, and their
+sensitivity finding that improving a weak control moves the upper bound by
+`0.00pp`. Ten tests. Their 214 lines of JavaScript could be deleted.
+
+**What still lowers it.** No ingest path for the contract Ghost-Ark declares
+binding ([F-11](FINDINGS_REGISTER.md#f-11)) — that is W6. The constrained LP path
+is not exposed through `cc.compose`; only the closed form is. And no downstream
+project has actually adopted any of this yet: the obstacle is removed, the
+adoption is theirs to make.
+
+**What would raise it further.** W6's `cc.ingest.discretization`. Side
+constraints on the `cc.compose` surface. A downstream repository importing it in
+anger.
+
+**What would lower it.** A fourth reimplementation appearing anyway — which
+would mean the surface is still the wrong shape.
+
+---
+
+## 8. Cross-implementation agreement — 6.5 {#cross-implementation-agreement}
+
+*Measures: whether independent implementations produce the same answer.*
+
+> **Revised upward from 0.0 on 2026-08-19.** There was nothing to score; now
+> there is.
+
+**Evidence supporting.**
+
+- `conformance/cc-kernel-v1/` is published: 24 accept cases with pinned exact
+ values, 8 reject cases with typed refusal reasons, a manifest with digests and
+ a declared 1e-12 tolerance, and a 256-line normative `SPEC.md`. Every accept
+ case is cross-checked against the finite-atom LP at generation time, and the
+ build **refuses to write a case** the closed form and the LP disagree on.
+- `verifiers/node/cc_compose_verify.mjs` is a zero-dependency Node
+ implementation written from `SPEC.md` and the JSON, not from the Python. It
+ passes 24/24 accept and 8/8 reject.
+- `scripts/differential_compose.py` fuzzes both sides on randomized inputs,
+ including malformed ones, requiring agreement on the answer *or* the refusal.
+ **23,000 cases across six seeds, zero disagreements** — and it earned its
+ keep immediately by finding a real bug (see below).
+- Three of these run in CI as pytest cases, so agreement is enforced rather than
+ demonstrated once.
+
+**The fuzzer found a bug on its first run.** `dependence="countermonotone"` with
+exactly *one* event: the Python raised `IndexError`, the Node silently returned
+`NaN`. Both were wrong, differently, and the curated corpus had not thought to
+ask. Both are fixed, and the case is now pinned as
+`reject-countermonotone-one-event` with its provenance recorded in the corpus.
+That is the argument for randomized differential testing over a corpus alone.
+
+**Why this is 6.5 and not 8.0.** The honest limit: **the Node implementation and
+the Python reference were authored in the same project.** A specification that
+is wrong yields two implementations that are wrong together. This is a
+differential-testing instrument, not an independent replication, and both the
+verifier's own output and the corpus manifest say so in their non-claims.
+
+The one check here that is *not* same-author is the external oracle: an
+outside project's **published** numbers, produced independently for its own
+purposes before this corpus existed, reproduced exactly. That is one oracle, on
+one scenario family.
+
+**What would raise it.** Ghost-Ark's TypeScript `ccCorrelation.ts` running this
+corpus. A third implementation by someone who has not read either of these. More
+external oracles. Extending the corpus to the constrained LP path, which neither
+the corpus nor the fuzzer currently covers.
+
+**What would lower it.** A disagreement found by anyone outside the project — or
+a case quietly weakened to make an implementation pass.
+
+---
+
+## 9. Empirical grounding — 2.4 {#empirical-grounding}
+
+*Measures: whether any number here came from a real system.*
+
+**Evidence supporting.** A dependence benchmark, adapter implementations for
+Llama Guard / NeMo / Guardrails-AI, a rails demo, correlation-cliff copula
+simulations, week-by-week experiment memos.
+
+**What lowers it.** **No `p_i` in this repository was measured against a
+production guardrail.** Every marginal is supplied, synthetic, or assumed. The
+adapters exist; no measurement campaign has run through them. The experiment lane
+has never executed in CI ([F-17](FINDINGS_REGISTER.md#f-17)). VISION names the
+Correlation Atlas as the empirical keystone and the most citable artifact
+available; it does not exist.
+
+**What would raise it.** The Atlas: two or three real guardrails on one public
+jailbreak corpus, reporting per-pair marginals, observed joint rates, phi, and
+the independence-versus-worst-case gap, each row emitting a certificate. Even a
+small one changes this score more than any amount of engineering.
+
+**What would lower it.** Publishing a measured-looking number that came from a
+simulation.
+
+---
+
+## 10. Statistical honesty machinery — 7.9 {#statistical-honesty-machinery}
+
+*Measures: whether the code refuses claims the data cannot support.*
+
+**Evidence supporting.** This is the repository's most distinctive asset. The
+post-selection refusal at `cliff.py:321` returns `discovery-only` with no
+confidence claim, and the comment explains why: *"A discovery is a hypothesis;
+only held-out data can certify it."* Confirmatory/exploratory provenance is a
+first-class type. Wilson intervals rather than normal approximations. Legacy
+metrics warn about what they are not. Non-finite bootstrap samples are dropped
+with a warning rather than silently.
+
+A downstream repository independently identified this guard as *"the single most
+elegant thing available in this program."* External parties do not say that about
+statistical software often.
+
+**What would raise it.** Adopting Ghost-Ark's reporting rules as executable
+assertions: no proportion without a denominator, no interval over a curated
+census, no interval below n = 30, no point estimate without dispersion. Ghost-Ark
+enforces these in `reportProportion` / `assertCensusReporting`; cc-framework
+enforces the post-selection rule and not the others. Confidence bands around
+`[L, U]` under estimated marginals — VISION Pillar I — would raise it furthest.
+
+**What would lower it.** Any path that emits a confidence interval over a
+hand-authored corpus.
+
+---
+
+## 11. Evidence-governance architecture — 7.6 {#evidence-governance-architecture}
+
+*Measures: whether evidence carries its own boundaries.*
+
+**Evidence supporting.** Claim envelopes, role ontology, decay/hazard policy,
+extremal scenarios, confirmatory protocol, Merkle log with adversarial tests,
+permission compiler, a governance capsule with expected artifacts and a manifest.
+9,946 lines, mostly 80–95% covered. Non-claims are carried *inside* signed
+payloads, not merely alongside them.
+
+**What lowers it.** No ingest contract for the upstream that feeds it
+([F-11](FINDINGS_REGISTER.md#f-11)). Two schemas with a non-resolvable `$id` and
+version in the title ([F-19](FINDINGS_REGISTER.md#f-19)). The governance verdict
+is only as good as the canonicalization beneath it — dimension 2 at 3.8 caps this
+one.
+
+**What would raise it.** The discretization ingest module. Versioned resolvable
+schema identifiers. An evidence-window contract in Ghost-Ark's sense.
+
+---
+
+## 12. Formal readiness — 3.1 {#formal-readiness}
+
+*Measures: distance to machine-checked proof.*
+
+**Evidence supporting.** Theorem ledger with explicit proof status per theorem
+and honest labelling of what is "standard theorem, computationally witnessed"
+versus proved here. Explicit invariants in the kernel. LP sharpness follows from
+finite-dimensional convexity, which is a proof, just not a mechanised one.
+
+**What lowers it.** No mechanised proof of any kind. No TLA+, Alloy, Lean, or
+Coq. No exact-arithmetic cross-check of the float LP path. Dual certificates are
+not emitted, so LP optimality is asserted by the solver rather than independently
+checkable.
+
+**What would raise it.** Emitting dual certificates — the cheapest real move,
+turning "the solver said optimal" into "here is the certificate, check it
+yourself." An exact rational LP for small `m` as an oracle. A Lean statement of
+the FH recovery theorem is a stretch goal, not a v0.4 target.
+
+**What would lower it.** Claiming formal verification. The word does not appear
+in this repository today; keep it that way.
+
+---
+
+## The committee's closing question
+
+For every score above: *what evidence would raise it, and what evidence would
+lower it?* Both are stated for all twelve. Where a future revision cannot answer
+both, that score should be deleted rather than defended.
diff --git a/docs/upgrade/DOWNSTREAM_CONTRACTS.md b/docs/upgrade/DOWNSTREAM_CONTRACTS.md
new file mode 100644
index 00000000..0afa6aa0
--- /dev/null
+++ b/docs/upgrade/DOWNSTREAM_CONTRACTS.md
@@ -0,0 +1,355 @@
+# Downstream Contracts
+
+> **Scope note.** Every change described here is made **in cc-framework**. This
+> document describes what the other repositories need and what this repository
+> must offer; it does not propose edits to them. Where a downstream change would
+> be required to complete a loop, it is named as *their* decision, not scheduled
+> here.
+>
+> **Non-claim.** Nothing in this document establishes that any downstream system
+> is safe, correct, or compliant. A contract that carries lineage is a contract
+> that can be checked — not a contract that is true.
+
+Three consumers, three different failures of the current library, three
+different fixes.
+
+| Consumer | Relationship | Current state | What cc-framework owes it |
+|---|---|---|---|
+| [ghost-ark](#ghost-ark) | upstream producer *and* parallel implementer | reimplemented the calculus in TypeScript; declared a binding ingest rule this repo cannot honour | an ingest module and a conformance corpus |
+| [vinctura](#vinctura) | rejected adopter | read the source, rejected the API, wrote 214 lines of JS; has a dated request this repo cannot serve | an ROC-free composition surface and a cross-language guard |
+| [b2b-spatial](#b2b-spatial-intelligence-engine) | skeptic | demoted the core contribution to "engineering" | a defensible answer, and instrumentation it can actually use |
+
+---
+
+## The shared finding
+
+All three relationships fail the same way. cc-framework's mathematics is sound
+and its packaging makes the mathematics unreachable. Every consumer independently
+concluded that reimplementing was cheaper than depending — and **each was right**,
+given the API they were offered.
+
+The upgrade is therefore not "add features." It is: make the thing that already
+works reachable from outside Python, in a shape that matches how the calculus is
+actually used.
+
+---
+
+## ghost-ark
+
+`PSUCyberSecurityLab/ghost-ark` — the AWS-native evidence and control plane.
+Public. 501 TypeScript files, 169 test files, 156 markdown documents.
+
+### What Ghost-Ark already decided
+
+`docs/research/CLAIM_EVIDENCE_MATRIX.md` carries a rule stated as binding:
+
+> CC-Framework must not consume naked binary labels from Ghost-Ark. Binary
+> variables must be tied to a discretization rule, threshold, comparator,
+> calibration digest, scoring digest, validity window, and parent evidence
+> lineage.
+
+and a layer table that assigns the claim boundary at each hop:
+
+| Layer | Boundary |
+|---|---|
+| Ghost discretization rule receipt | defines how a score becomes a binary variable; does not prove the score is valid |
+| Ghost binary observation | records applying the rule; does not prove the threshold is optimal |
+| CC evidence bundle | provides CC-compatible binaries and provenance; does not prove safety |
+| **CC-Framework bounds report** | **computes what follows under stated assumptions; does not validate upstream data collection** |
+| Ghost signed claim envelope | binds evidence, assumptions, result digest; does not widen the claim |
+
+The object is specified: `ghost.discretization_rule_receipt.v1`, with a monotonic
+risk invariant (`higher_is_riskier` admits only `>=` and `>`), seventeen required
+fields, and eleven verification preconditions.
+
+**cc-framework implements none of it** ([F-11](FINDINGS_REGISTER.md#f-11)). The
+rule binds a repository that cannot honour it.
+
+### The parallel implementation
+
+`packages/research-frontier/src/ccCorrelation.ts` computes, in TypeScript:
+per-variable failure counts and rates, 95% Wilson intervals, `n00/n01/n10/n11`
+co-failure tables, observed joint rates with Wilson intervals, empirical phi, and
+**pairwise Fréchet lower and upper bounds**. It requires a complete rectangular
+grid and rejects mixed cohorts, non-binary values, and absent stationarity
+declarations.
+
+It is a careful implementation of cc-framework's calculus by someone who could
+not call cc-framework. It has never been compared against the Python.
+
+### What cc-framework ships
+
+**C1 — `cc.ingest.discretization`** (owner [W6](EPISTEMIC_UPGRADE_PLAN.md#w6))
+
+A fail-closed reader for `ghost.discretization_rule_receipt.v1` implementing all
+eleven preconditions:
+
+| Precondition | Refusal on violation |
+|---|---|
+| binary domain | value is exactly 0 or 1 |
+| failure semantics | 1 means guardrail failure / unsafe pass |
+| bounded score domain | finite lower and upper bounds declared |
+| threshold legality | threshold inside the declared domain |
+| signed comparator | comparator included in the rule digest |
+| monotonic risk invariant | comparator direction matches score polarity |
+| calibration digest | present |
+| scoring digest | scoring function, model, or policy digest present |
+| temporal validity | observation timestamp inside the rule validity window |
+| parent lineage | observation references a parent receipt |
+| stationarity declaration | cohort declares whether joint dependence is assumed stable |
+
+A marginal arriving without lineage is **refused**, not defaulted. The negative
+corpus carries one fixture per precondition, and each must be rejected with a
+distinguishable reason — a reader that rejects everything for the same reason is
+not enforcing eleven rules, it is enforcing one.
+
+`declared_reference` means the observation carries receipt identifiers. It does
+**not** mean cc-framework verified that receipt or its signature. That non-claim
+travels with the ingested object.
+
+**C2 — the conformance corpus** (owner [W5](EPISTEMIC_UPGRADE_PLAN.md#w5))
+
+`conformance/cc-kernel-v1/` — language-agnostic cases with pinned expected
+values, covering pairwise FH bounds, Wilson intervals, phi, and the n-ary
+conjunction and union bounds. Ghost-Ark's TypeScript either passes it or it is
+not a CC kernel. Running it there is Ghost-Ark's decision; publishing it is this
+repository's obligation.
+
+**C3 — the canonicalization treaty** (owner [W3](EPISTEMIC_UPGRADE_PLAN.md#w3))
+
+[F-04](FINDINGS_REGISTER.md#f-04) and [F-05](FINDINGS_REGISTER.md#f-05) mean a CC
+report canonicalized here and re-canonicalized in Ghost-Ark's TypeScript can
+disagree — five of six number forms diverge from RFC 8785, and integers above
+2^53 do not survive `JSON.parse`. The treaty is a written, versioned
+`cc.canonical.v1` profile stating its relationship to RFC 8785, plus a schema
+constraint bounding receipt-covered integers to the IEEE-754 safe range.
+
+This must be decided **before** an independent verifier is written. Ghost-Ark's
+E1 census found that the kernel is set by the parser, not the canonicalizer; the
+same corollary applies here and cannot be fixed downstream.
+
+### What this does not create
+
+No claim that Ghost-Ark's evidence is valid, that its scores are calibrated, or
+that a CC report over Ghost-Ark observations says anything about deployed
+safety. The ingest module checks that evidence carries its lineage. Whether the
+lineage describes a well-designed measurement is outside every layer in the
+table above.
+
+---
+
+## vinctura
+
+`Cubits11/vinctura` — graduation photography, and underneath it a provenance
+kernel and a verifiable-credential register. Private.
+
+Vinctura's `CLAIMS.md` opens with the strictest rule in the program:
+
+> Every public claim this repository makes, with the command that falsifies it or
+> an explicit limitation. **No orphan claims.** A sentence that no command can
+> demonstrate is deleted or given a command.
+>
+> Limitations come first, in this file as in every other.
+
+cc-framework should adopt this rule ([W2](EPISTEMIC_UPGRADE_PLAN.md#w2)). It is
+stronger than anything currently enforced here.
+
+### Failure 1 — the API rejected
+
+`scripts/compose-bounds.js` records, in its header, why cc-framework was not used
+([F-08](FINDINGS_REGISTER.md#f-08)): `cc.core.composition_theory` operates on ROC
+point sets and bounds the Youden J statistic, which presumes each guardrail is a
+classifier with a threshold and an operating curve. Vinctura's four controls are
+deterministic refusal rules — `SELF_REPORTED` refuses iff `loggedBy === memberId`.
+No threshold, no operating point, no false-positive rate.
+
+> Forcing a deterministic refusal rule into an ROC shape would produce numbers
+> with the form of a measurement and none of the content.
+
+The consumer was right, and identified exactly what transfers: "the FH inequality
+is applied directly to the events. **That is the part that transfers**; the ROC
+machinery is not."
+
+**C4 — `cc.compose`** (owner [W5](EPISTEMIC_UPGRADE_PLAN.md#w5))
+
+A surface whose signature contains no ROC concept at all:
+
+```python
+compose_bounds(
+ marginals: Mapping[str, float], # P(E_i) — event probabilities, not TPR/FPR
+ event: Literal["all", "any"] | LinearQuery,
+ constraints: Sequence[Constraint] = (),
+) -> Interval # sharp [L, U], plus witnesses
+```
+
+Deterministic predicates are first-class inputs. Detectors reach the same surface
+by supplying their operating point as a marginal — the ROC path becomes an
+optional adapter *on top of* the event calculus, never underneath it.
+
+**Acceptance gate.** Not "the API exists." The gate is: Vinctura's four-control
+result — including the sensitivity analysis over assumed detection rates — is
+reproduced from `cc.compose` in a cc-framework test, and their 214 lines could be
+deleted. If it cannot be reproduced, the surface is still wrong.
+
+The test must also reproduce Vinctura's **correct refusal**: there is no
+countermonotone regime for n > 2, because the FH lower bound is not a copula in
+dimension ≥ 3 though it remains pointwise sharp. A composition API that silently
+offers a "countermonotone" option for four events is wrong, and Vinctura noticed
+before this repository did.
+
+### Failure 2 — the guard that cannot be reached
+
+`docs/research/program/ultracode/UC-10-KERNEL-BRIDGE.md` §4.3
+([F-10](FINDINGS_REGISTER.md#f-10)):
+
+> Optional stopping invalidates the density estimate entirely — and the sibling
+> project `cc-framework` already refuses confidence claims on post-selection
+> intervals at `src/cc/kernel/cliff.py:321`. **Use that.** [...] Making one
+> repository's guardrail catch another repository's error is the strongest
+> possible demonstration that the guardrail is real.
+>
+> That last point is the single most elegant thing available in this program. Do it.
+
+The guard exists and is correct. It is reachable only from Python, in-process.
+
+**C5 — `cc-guard`** (owner [W5](EPISTEMIC_UPGRADE_PLAN.md#w5))
+
+Two deliverables, because one is not enough:
+
+1. A `cc-guard` subcommand reading JSON on stdin and writing a verdict on
+ stdout — `{"regime": "discovery-only", "confidence_claim": null, "reason": ...}` —
+ exposing the provenance-tagged guards without a Python API.
+2. The same logic as a **pure-data decision table** in the conformance corpus, so
+ a JavaScript caller can enforce the rule with no Python process at all. A
+ subprocess dependency is a weaker bridge than a table.
+
+**Acceptance gate.** Vinctura's G3 gate — `npm test -- probe.post-selection-refused` —
+passes against cc-framework's guard, by either route. Whether they wire it is
+their call; that it *can* be wired is this repository's obligation.
+
+### Failure 3 — the kernel probe
+
+UC-10 specifies a `kernel-probe` measuring `|ker C|` for a canonicalization
+function `C : Events → Records`, with `cheapestCollisionCostRatio` as the
+security-relevant quantity — pre-registered sampling design, committed stopping
+rule, and results reported whether or not they are interesting.
+
+cc-framework's canonicalizer is a **valid target**, and
+[F-03](FINDINGS_REGISTER.md#f-03) is a member of its kernel found by hand in
+under an hour. The adversarial corpus in [W3](EPISTEMIC_UPGRADE_PLAN.md#w3)
+should be built in a shape a probe can consume: declared intent per class,
+machine-readable verdicts, no confidence interval over a curated census.
+
+That last constraint is the pleasing part. Vinctura's probe wants to route its
+density estimate through cc-framework's post-selection refusal; cc-framework's
+own corpus is a census and must therefore carry no interval. **The guard applies
+to the repository that wrote it.**
+
+---
+
+## b2b-spatial-intelligence-engine
+
+`Cubits11/b2b-spatial-intelligence-engine` ("Assay") — hardware-attested capture
+provenance via Nitro Enclaves, App Attest, StrongBox, NIST beacons, C2PA/JUMBF.
+Private.
+
+### The skeptic's verdict
+
+`docs/latent-research-program.md` runs a kill-ledger over the program's research
+concepts. The relevant row ([F-18](FINDINGS_REGISTER.md#f-18)):
+
+> **Fréchet ceiling + reachability sharpening** — "Adversarial robustness ≠
+> average-case robustness" — standard in ML security since 2014. **DEMOTED to
+> engineering.** The mathematics is 1935; the sharpening is a known distinction.
+> Survives as reporting practice, not as science.
+
+This is correct and cc-framework should say so first. See
+[W9](EPISTEMIC_UPGRADE_PLAN.md#w9).
+
+What survives the demotion is worth more than what it removes: reporting practice
+that a hostile reviewer trusts is exactly what an evidence platform needs, and
+"survives as reporting practice" is a *use case*, not a dismissal.
+
+### Where the calculus actually applies
+
+Assay composes several independent checks before issuing a verdict: device
+certificate chain validation, NIST beacon temporal freshness, offline Merkle CRL
+revocation, and PCR0 enclave measurement. Its own README frames the value as
+replacing probabilistic detection with deterministic attestation — and the
+composed question is exactly CC's object:
+
+> Given per-check evasion marginals, what is the sharp bound on an artifact
+> passing **all** checks while being fabricated, under unknown dependence between
+> the checks?
+
+These checks are deterministic predicates, not classifiers — the same shape as
+Vinctura's controls, and the same reason `cc.compose` (C4) is the surface that
+fits. An attacker who compromises a signing key correlates several checks at
+once; independence across them is precisely the assumption an adversary attacks.
+
+**C6 — the deterministic-predicate composition path** is C4. No separate
+deliverable; the same surface serves both consumers, which is the argument for
+building it once and building it right.
+
+### The three-valued verdict
+
+`schemas/vinctura_spatial_verdict.v1.schema.json` carries a lesson cc-framework
+should learn rather than teach:
+
+```
+"class": ["WITHIN_DECLARED_BOUND", "EXCEEDS_DECLARED_BOUND", "INDETERMINATE"]
+"INDETERMINATE is not a pass. Relying parties MUST NOT collapse it to either other value."
+```
+
+and, on the convenience boolean:
+
+> Deliberately NOT named 'compliant' [...] A boolean asserting legal compliance
+> would be a claim Vinctura cannot support. Consumers MUST branch on 'class';
+> this field exists so that a null-unaware consumer fails loudly rather than
+> silently reading INDETERMINATE as a pass.
+
+**C7 — an explicit indeterminate state in the CC report**
+(owner [W6](EPISTEMIC_UPGRADE_PLAN.md#w6))
+
+Today, a CC report either carries an interval or an error is raised. There is no
+first-class "the evidence does not identify this" verdict that survives
+serialization. Insufficient evidence, an infeasible constraint set, and a
+refused post-selection claim are all *indeterminate*, and each should serialize
+as such with a machine-readable reason — never as `[0, 1]`, which a careless
+consumer reads as a computed bound.
+
+The design constraint is Assay's, and it is right: a null-unaware consumer must
+fail loudly rather than silently read indeterminate as a pass.
+
+### The convergence worth naming
+
+Assay ships a research module titled `01-canonicalization-collapse.html`.
+Ghost-Ark's E1 measured five unintended kernel members in its own pipeline.
+cc-framework's canonicalizer silently merges Unicode-distinct keys
+([F-03](FINDINGS_REGISTER.md#f-03)).
+
+**Three repositories in one program are working on canonicalization collapse.
+Two are studying it. One has it and had not looked.** W3 closes that, and the
+corpus it produces is the artifact the other two can measure against.
+
+---
+
+## Contract summary
+
+| ID | Deliverable | Serves | Workstream | Acceptance |
+|---|---|---|---|---|
+| C1 | `cc.ingest.discretization` | ghost-ark | W6 | eleven preconditions, one negative fixture each, distinguishable refusals |
+| C2 | `conformance/cc-kernel-v1/` | ghost-ark, vinctura | W5 | pinned expected values; adversarial section; runs in CI |
+| C3 | `cc.canonical.v1` profile + integer bound | ghost-ark | W3 | written RFC 8785 relationship; safe-range constraint in schema |
+| C4 | `cc.compose` (ROC-free) | vinctura, b2b-spatial | W5 | Vinctura's four-control numbers reproduce; no countermonotone option for n>2 |
+| C5 | `cc-guard` CLI + decision table | vinctura | W5 | Vinctura's G3 gate passes by either route |
+| C6 | deterministic-predicate path | b2b-spatial | W5 | same surface as C4 |
+| C7 | indeterminate verdict state | b2b-spatial | W6 | serializes with reason; never `[0, 1]` |
+
+## What none of this establishes
+
+The contracts make evidence checkable. They do not make it true. No consumer
+should read a passing contract check as establishing that a guardrail works, a
+threshold is right, a cohort generalizes, an artifact is authentic, or a system
+is safe. Each contract carries its own non-claim above, and those non-claims
+travel with the artifacts, not merely with this document.
diff --git a/docs/upgrade/EPISTEMIC_UPGRADE_PLAN.md b/docs/upgrade/EPISTEMIC_UPGRADE_PLAN.md
new file mode 100644
index 00000000..65b8069c
--- /dev/null
+++ b/docs/upgrade/EPISTEMIC_UPGRADE_PLAN.md
@@ -0,0 +1,769 @@
+# Epistemic Upgrade Plan — cc-framework
+
+> **Status: plan.** Nothing in this document is implemented. It describes work
+> proposed for v0.4, grounded in measurements taken at commit `3e22c39` on
+> 2026-08-19.
+>
+> **Non-claim.** This plan does not assert that cc-framework is safe, correct,
+> production-ready, or fit for any deployment. It does not claim the work
+> described here will succeed, and it does not relax a single boundary in
+> [`NON_CLAIMS.md`](../research/NON_CLAIMS.md) or the
+> [claim-boundary manifest](../claims/CLAIM_BOUNDARY_MANIFEST.md). A plan is a
+> statement of intent. Only the acceptance gates below can turn any of it into
+> evidence.
+
+| | |
+|---|---|
+| **Scope** | `Cubits11/cc-framework` only. No change is proposed to any other repository. |
+| **Measured baseline** | [BASELINE_MEASUREMENTS.md](BASELINE_MEASUREMENTS.md) |
+| **Defects found** | [FINDINGS_REGISTER.md](FINDINGS_REGISTER.md) — 20 findings, 5 at S1 |
+| **Scored dimensions** | [COMMITTEE_SCORECARD.md](COMMITTEE_SCORECARD.md) — 12 dimensions |
+| **Target tiers** | [VERIFICATION_LADDER.md](VERIFICATION_LADDER.md) |
+| **Consumer obligations** | [DOWNSTREAM_CONTRACTS.md](DOWNSTREAM_CONTRACTS.md) — C1–C7 |
+
+---
+
+## 1. The finding that organizes everything
+
+cc-framework's mathematics is **exact**. The LP recovers Fréchet–Hoeffding to
+1.11e-16 worst case. It reproduces the correlation cliff in twenty seconds:
+eighteen guardrails at p = 0.1 each, composed as a conjunction, bound to
+`[0, 0.1]` — where independence would predict 1e-18. Eighteen filters buy
+nothing under adversarial dependence. That result is the thesis, and it works.
+
+**And three separate projects reimplemented it rather than depend on this
+repository.** Ghost-Ark in TypeScript, Vinctura in JavaScript, and one of them
+wrote down exactly why:
+
+> The obvious move was to call `cc.core.composition_theory` [...] it operates on
+> ROC POINT SETS and bounds the Youden J statistic. That is a DETECTOR framing —
+> it assumes each guardrail is a classifier with a threshold and an operating
+> curve. Vinctura's controls are not classifiers.
+>
+> — `vinctura/scripts/compose-bounds.js`
+
+A consumer read the source, found the mathematics correct and the ontology wrong,
+and wrote 214 lines of JavaScript instead. That is not a documentation gap. It is
+an API that models the wrong thing.
+
+So the scorecard reads: mathematical correctness **8.9**, consumability **2.6**,
+cross-implementation agreement **0.0**. The plan closes the second and third
+without touching the first.
+
+### The three failures, stated once
+
+1. **Reachability.** The calculus is correct and unreachable — wrong ontology in
+ the API, Python-only, no conformance corpus. Nobody can use it, so everybody
+ rewrites it. → W5, W6
+2. **Enforcement.** The prose discipline scores 8.8; the enforcement scores 2.1.
+ Strict typing is declared for 90 files and enforced on 7. The claim-boundary
+ manifest is validated by nothing. Everything holding this repository honest is
+ a person remembering to be honest. → W1, W2
+3. **Unexamined foundations.** The canonicalization kernel — which every signed
+ artifact routes through — silently merges Unicode-distinct keys, diverges from
+ RFC 8785 on five of six number forms, and has never been attacked. One hour of
+ probing found four defects. → W3
+
+---
+
+## 2. What this plan refuses to claim
+
+Stated before the workstreams, because a plan that leads with ambition and buries
+its boundaries has already failed the discipline it proposes.
+
+- **The mathematics is not new.** Fréchet–Hoeffding is 1935. A sibling repository
+ already demoted "Fréchet ceiling + reachability sharpening" to engineering, and
+ it was right ([F-18](FINDINGS_REGISTER.md#f-18)). This plan does not claim
+ novelty for the bounds. The contribution is elsewhere — see W9.
+- **No downstream integration is promised.** Whether Ghost-Ark runs the
+ conformance corpus, or Vinctura wires the guard, is their decision. This plan
+ commits only to making both *possible*.
+- **No empirical claim is created by planning one.** The Correlation Atlas (W7)
+ is the highest-value item here and it does not exist. Until it runs, empirical
+ grounding stays at 2.4 and should be quoted as 2.4.
+- **Completing every workstream would not establish safety.** It would establish
+ that this repository does what it says. Whether what it says is worth anything
+ is answered by someone outside the project, and no amount of internal work
+ substitutes for that.
+- **This plan is one excavation pass.** Absence of a finding is not evidence of
+ absence. `redteam/dependence_search.py` — 709 statements at 65.6% coverage,
+ performing the search whose post-selection bias `cliff.py` refuses to certify —
+ was **not examined** and is the most likely home of a subtle statistical defect.
+
+---
+
+## 3. Workstreams
+
+Ten workstreams. Each states its findings, deliverables, acceptance gate, and
+what completing it does *not* establish. A workstream without a falsifiable gate
+is a wish; every gate below is a command.
+
+---
+
+### W0 — Make the documented path work {#w0}
+
+**Findings:** [F-01](FINDINGS_REGISTER.md#f-01), [F-20](FINDINGS_REGISTER.md#f-20)
+· **Effort:** hours · **Prerequisite for everything else**
+
+A stranger following the install instructions gets a red suite. That is the first
+thing an external reviewer sees, and it is not a real failure — it is a missing
+dependency in the `[test]` extra. Nothing else on this plan matters if the front
+door is broken.
+
+**Deliverables**
+
+1. Add `build`, `setuptools`, `wheel` to `[project.optional-dependencies].test`.
+2. CI job installing `.[test]` **specifically** — not `.[dev]` — and running the
+ suite. The extra strangers are told to use becomes the extra that is tested.
+3. Delete `tests/regression/week2/test_week2_deliverables.py::test_unit_tests_pass`.
+ It shells out to run the whole unit suite and masks real failures — it is how
+ F-01 presented, as an unrelated `assert 1 == 0`. If the intent was "week-2
+ deliverables exist," assert that directly.
+4. `scripts/upgrade_baseline.py` — regenerates every table in
+ BASELINE_MEASUREMENTS.md into `docs/upgrade/baseline.json`. The plan's own
+ numbers become reproducible, or the plan fails its own standard.
+
+**Acceptance gate**
+
+```bash
+git clean -xdf && uv venv .venv && uv pip install -e '.[test]' && pytest
+# expect: 0 failed, 0 errors
+python scripts/upgrade_baseline.py --check # regenerated numbers match committed
+```
+
+**Does not establish.** Anything about correctness. This is a packaging fix.
+
+---
+
+### W1 — Make the type discipline true {#w1}
+
+**Findings:** [F-02](FINDINGS_REGISTER.md#f-02) · **Effort:** 1 week setup, then continuous
+
+`pyproject.toml` declares `strict = true` over `packages = ["cc"]`. At that scope
+mypy reports **279 errors in 47 files**. CI enforces 7 files. The configuration
+asserts a discipline the repository does not have — claim inflation in TOML.
+
+Do not delete `strict = true`. Do not silence 279 errors in one pass; a
+thousand-line `type: ignore` commit is how strictness dies quietly.
+
+**Deliverables**
+
+1. `docs/upgrade/typing-ratchet.json` — per-module current error count, committed.
+2. CI job running mypy at the declared scope, failing only if a module's count
+ **increases**. New code is strict from birth; existing debt is visible and
+ frozen.
+3. Burn-down order: `kernel/` → `reporting/` → `evidence/` → the rest. The
+ modules that emit signed artifacts get types first.
+4. Remove the 7-file list from CI and pre-commit once the ratchet is live.
+
+**Acceptance gate**
+
+```bash
+mypy # declared scope
+python scripts/check_typing_ratchet.py # no module regressed
+```
+
+with `kernel/` and `reporting/` at zero errors by the end of the workstream.
+
+**Does not establish.** That the code is correct. Types constrain shape, not
+meaning. A well-typed wrong bound is still wrong.
+
+---
+
+### W2 — Make the claim discipline executable {#w2}
+
+**Findings:** [F-12](FINDINGS_REGISTER.md#f-12), [F-15](FINDINGS_REGISTER.md#f-15)
+· **Effort:** 1–2 weeks
+
+The prose scores 8.8 and the enforcement scores 2.1. This workstream closes the
+gap without weakening the prose.
+
+**The design constraint that matters.** A naive port of Ghost-Ark's scanner would
+fire on 70 uses of "guarantee" in this repository, **almost all of them negated** —
+`does not guarantee`, `no guarantee of`. It would be switched off within a week,
+and switching off a claim gate is worse than never having one. So negation
+handling and an allowlist are day-one requirements, not refinements.
+
+**Deliverables**
+
+1. `scripts/check_claims.py` — forbidden-phrase scanner with:
+ - negation-aware matching (a phrase inside "does not X" is not a violation);
+ - an allowlist with a **written reason per entry**, following Ghost-Ark's
+ pattern — policy documents and the scanner itself legitimately quote
+ forbidden wording;
+ - scanning of `.md`, `.py`, `.tex`, `.yml`, `.json`, `.sh`, and `Makefile`,
+ because reviewer-facing claim text lives in build files too;
+ - exclusion of generated output, so the verdict describes the committed tree
+ rather than local run state.
+2. Close the two residual manifest gaps ([F-12](FINDINGS_REGISTER.md#f-12), corrected):
+ resolve path-like tokens in `supporting_tests_or_commands`, and assert the
+ Markdown and JSON claim-id sets are equal. The validator already runs (via
+ pytest) and already checks `supporting_files` existence — an earlier draft of
+ this plan said otherwise and was wrong.
+3. Resolve the two theorem ledgers. `docs/theory/theorem_ledger.md` governs; the
+ other becomes a pointer or is deleted. Add a test asserting exactly one.
+4. **Adopt Vinctura's rule:** *no orphan claims — every public sentence carries
+ the command that falsifies it or an explicit limitation.* Apply to README
+ first, then `docs/index.md`. This is the strongest claim rule in the program
+ and it comes from a consumer, not from here.
+
+**Acceptance gate**
+
+```bash
+make claims # scanner + manifest validation, both clean
+pytest tests/unit/docs/ # every manifest row's files and tests exist
+```
+
+plus: **every README claim maps to a command in the manifest.**
+
+**Does not establish.** That the claims are true. A scanner catches known
+overclaim phrasings. It cannot detect a number that was fabricated, a citation
+that does not say what it is claimed to say, or a subtler overclaim in unfamiliar
+words.
+
+---
+
+### W3 — Attack the canonicalization kernel {#w3}
+
+> **DELIVERED 2026-08-19.** Canonicalization & provenance integrity
+> **3.8 → 8.2**. All five findings fixed (F-03, F-04, F-05 at S1; F-06, F-07 at
+> S2). `cc.canonical.v2` (RFC 8785) is the default; `cc.canonical.v1` is
+> read-only so historical receipts stay verifiable. Delivery record in
+> [§3.3 below](#w3-delivery-record); profile documented in
+> [CANONICAL_PROFILE.md](../architecture/CANONICAL_PROFILE.md). Contract
+> [C3](DOWNSTREAM_CONTRACTS.md#contract-summary) is shipped.
+
+**Findings:** [F-03](FINDINGS_REGISTER.md#f-03) **S1**, [F-04](FINDINGS_REGISTER.md#f-04) **S1**, [F-05](FINDINGS_REGISTER.md#f-05) **S1**, [F-06](FINDINGS_REGISTER.md#f-06), [F-07](FINDINGS_REGISTER.md#f-07)
+· **Effort:** 2–3 weeks · **Highest severity**
+
+Every signed artifact this repository emits routes through
+`canonical_json_bytes`. One hour of probing found four defects, including a
+silent two-keys-to-one collapse with no error raised. Ghost-Ark found five
+unintended kernel members in its own pipeline by building a 31-class census; this
+repository has never run the equivalent.
+
+**Deliverables**
+
+1. **Fail closed on key collision.** After NFC normalization, compare key-set
+ cardinality. If it shrank, raise `CanonicalJSONError` naming both keys. Detect,
+ never resolve.
+2. **Strict duplicate-key rejection on read.** An `object_pairs_hook` that raises
+ on repeated keys, applied to the report reader, evidence-bundle reader, and
+ claim-envelope reader.
+3. **Normalize `-0.0` to `0.0`** — with a positive control that genuinely distinct
+ near-zero values stay distinct. A rule that rejects honest documents is a
+ trade, not a fix.
+4. **`docs/architecture/CANONICAL_PROFILE.md`** — `cc.canonical.v1`, versioned,
+ stating its relationship to RFC 8785 explicitly. Either adopt JCS number
+ serialization or declare a non-JCS profile with a written rationale. Both are
+ defensible; silence is not. **Decide before an independent verifier is
+ written.**
+5. **Bound receipt-covered integers** to the IEEE-754 safe range in the schema, or
+ carry them as strings. A JS `JSON.parse` collapses `2^53+1` before any
+ verifier code runs — the kernel is set by the parser, and no downstream fix
+ reaches it.
+6. **`tests/canonical_corpus/`** — an adversarial census in Ghost-Ark's E1 shape:
+ declared intent per class (`distinct` / `equivalent`), machine-readable
+ verdicts (`sound`, `unintended-kernel`, `over-discrimination`, `fail-closed`,
+ `sound-by-rejection`, `rejection-asymmetry`), and **positive controls** so
+ strictness is a fix rather than a trade. Seed classes: the six probed for this
+ plan, plus duplicate-key-nested-in-array, empty-key-repeated, lone surrogate,
+ deep nesting, large-document-single-byte, safe-integer-neighbours.
+ **Provenance is `census` — no confidence intervals, exact counts only.**
+
+**Acceptance gate**
+
+```bash
+make canon-corpus # every class matches its declared verdict
+make receipt-replay # capsule rebuilds byte-identically
+```
+
+with **zero classes at `unintended-kernel`** and **zero at
+`rejection-asymmetry`** — the second is what distinguishes a fix from a trade.
+
+**Binding rule:** never weaken the corpus to make a test pass. A class that starts
+failing is a kernel regression.
+
+**Does not establish.** That the canonicalizer has no collisions — only that it
+has none in the declared classes. The corpus is a census and its size is an
+authoring decision, so it carries no interval and no coverage claim.
+
+#### Delivery record {#w3-delivery-record}
+
+| Deliverable | Shipped as | Evidence |
+|---|---|---|
+| RFC 8785 profile | `cc.canonical.v2` in `src/cc/reporting/canonical.py` | 15/15 probed number forms conform; 16 pinned individually |
+| Legacy profile retained | `cc.canonical.v1`, read-only | verification dispatches on the declared profile; a test asserts v1 still carries its defects |
+| Collision fixed | no normalization, per RFC 8785 | two byte-distinct keys go in, two come out, at top level and nested |
+| Producer lint | `assert_no_confusable_keys` | opt-in, deliberately off the hash path |
+| Strict reads | `strict_json_loads` | wired into the report CLI, claim-governance readers, Merkle log |
+| Integer bound | `MAX_SAFE_INTEGER` | declared narrowing of JCS, documented not implicit |
+| Census | `scripts/canonicalization_probe.py` | 14 classes, both profiles, 4 positive controls |
+| Corpus | `tests/unit/canonical/` | 57 tests |
+
+**The remedy shipped is not the one first proposed here.** The plan said
+normalization must *detect* collision and fail closed. The better fix, taken
+instead, was to stop normalizing: RFC 8785 makes normalization the producer's
+job, and a canonicalizer that mutates content is not a canonicalizer. With no
+normalization there is nothing left to collide.
+
+**Numbers.** v2 census: 12 sound, 1 fail-closed, 1 sound-by-rejection; zero
+`unintended-kernel`, zero `rejection-asymmetry`, zero `over-discrimination`.
+Suite 816 → **873 passing**, 0 failing.
+
+**Migration was verified, not assumed.** Every regenerated capsule artifact was
+diffed with hashes, hash-derived ids, and the profile identifier scrubbed; all
+eleven were byte-identical under that scrub. No content, no claim text, and no
+non-claim changed — only hashes moved.
+
+**One intent was corrected.** `int-vs-float-same-value` moved from `distinct` to
+`equivalent`: the original declaration described Python's type system, not
+JSON's, which has one number type. Correcting a declaration that was wrong about
+the domain is legitimate; correcting one to flatter a result is not. Recorded in
+the probe source and the profile doc rather than edited away.
+
+**Honest limits.** No fuzzing of the canonicalizer — every class was authored by
+hand. **No cross-language differential on receipts yet**: the corpus establishes
+agreement on the composition kernel, but nothing re-canonicalizes a CC report in
+another language and compares digests, so "cross-language verifiable" describes
+v2's design rather than a demonstrated result. No external reviewer has attacked
+either profile.
+
+---
+
+### W4 — Deepen the test floor {#w4}
+
+**Findings:** [F-13](FINDINGS_REGISTER.md#f-13), [F-14](FINDINGS_REGISTER.md#f-14)
+· **Effort:** 3–4 weeks
+
+Coverage is 69.91% with no gate. The `cc-report` CLI — the product surface, the
+thing a reviewer actually runs — is at **0%**. `core/stats.py` is at **38% across
+756 statements**: the statistics engine, in a repository about statistical
+honesty, is its least-tested large component. Untested statistical code does not
+fail loudly; it returns a plausible number.
+
+**Deliverables**
+
+1. **CLI golden tests** — build a report, verify it, verify a tampered copy is
+ rejected, verify claim-governance PASS and FAIL paths. Target `reporting/cli.py`
+ from 0% to >80%.
+2. **Property-based tests on `core/stats.py`** using Hypothesis (already a
+ declared dependency, currently ungated): interval coverage, monotonicity,
+ boundary behaviour. Properties, not examples — the failure mode here is a
+ plausible wrong number, which example tests are poor at catching.
+3. **Property-based kernel tests** over the marginal simplex, replacing the
+ six-point census with sampled invariants: FH recovery, monotone tightening
+ under added constraints, `L <= U` always, infeasibility raises.
+4. **Coverage floor at the measured 69.91%**, ratcheting upward. A floor set below
+ the current value is theatre.
+5. **Mutation testing** on `kernel/` and `reporting/`, score published in the
+ scorecard. The current score is *unknown*, not low, and that distinction is
+ worth removing.
+6. **Dual certificates** from the LP, emitted with the primal witness, so a
+ skeptic verifies optimality without re-solving. Cheapest available move on
+ formal readiness.
+
+**Acceptance gate**
+
+```bash
+pytest --cov=src/cc --cov-fail-under=69.91
+make kernel-properties && make kernel-duals && make mutation
+```
+
+with `reporting/cli.py` > 80%, `core/stats.py` > 70%, and a published mutation
+score.
+
+**Does not establish.** Correctness. Higher coverage means more code was executed,
+not that it was executed correctly. Mutation score bounds the suite's sensitivity
+on the mutated subset, nothing wider.
+
+---
+
+### W5 — Make the kernel consumable {#w5}
+
+> **DELIVERED 2026-08-19.** Consumability **2.6 → 6.8**, cross-implementation
+> agreement **0.0 → 6.5**. Evidence in
+> [§3.5 Delivery record](#w5-delivery-record) below; scores and their limits in
+> [COMMITTEE_SCORECARD.md](COMMITTEE_SCORECARD.md#consumability-as-a-library).
+> C4, C5, C6 and the C2 corpus are shipped. C1, C3, C7 remain with W3 and W6.
+
+**Findings:** [F-08](FINDINGS_REGISTER.md#f-08) **S3**, [F-09](FINDINGS_REGISTER.md#f-09) **S3**, [F-10](FINDINGS_REGISTER.md#f-10) **S3**
+· **Contracts:** [C2, C4, C5, C6](DOWNSTREAM_CONTRACTS.md#contract-summary)
+· **Effort:** 4–6 weeks · **Highest leverage**
+
+Three reimplementations, one written rejection, one dated unfillable request.
+This workstream is why the repository scores 2.6 on consumability against 8.9 on
+mathematics.
+
+**Deliverables**
+
+1. **`cc.compose`** — marginals in, sharp bounds out, **no ROC concept anywhere in
+ the signature**:
+
+ ```python
+ compose_bounds(
+ marginals: Mapping[str, float],
+ event: Literal["all", "any"] | LinearQuery,
+ constraints: Sequence[Constraint] = (),
+ ) -> Interval
+ ```
+
+ Deterministic predicates are first-class. Detectors reach the same surface by
+ supplying an operating point as a marginal — the ROC path becomes an optional
+ adapter *above* the event calculus, never underneath it. This inverts the
+ relationship that caused the rejection.
+
+2. **`conformance/cc-kernel-v1/`** — language-agnostic corpus:
+ `(marginals, constraints, query) → [L, U]` with exact expected values, plus an
+ adversarial section (infeasible sets, degenerate marginals, boundary values,
+ `p=0`, `p=1`, near-machine-epsilon marginals). Any implementation in any
+ language either passes or is not a CC kernel. Run in CI here; published for
+ the others.
+
+3. **`cc-guard`** — a stdin/stdout JSON subcommand exposing the provenance-tagged
+ guards (post-selection refusal first), **plus** the same logic as a pure-data
+ decision table in the corpus, so a JS caller can enforce it with no Python
+ process. A subprocess dependency is a weaker bridge than a table.
+
+4. **A second implementation, in this repository, in another language.** Small,
+ dependency-free, deriving from the published corpus and not from the Python
+ source. Without it, Tier 3 of the ladder cannot exist and
+ cross-implementation agreement stays at 0.0.
+
+5. **Differential harness** — randomized `(marginals, query)` cases through both
+ implementations, comparing to a declared tolerance. Divergence is recorded as
+ a finding, never reconciled by fiat.
+
+**Acceptance gate**
+
+```bash
+make conformance-publish && make differential-agreement && make differential-fuzz
+pytest tests/acceptance/test_vinctura_four_control.py # their numbers, from cc.compose
+```
+
+The Vinctura acceptance test is the real gate: **their four-control result,
+including the sensitivity analysis over assumed detection rates, reproduced from
+`cc.compose`, such that their 214 lines could be deleted.** It must also
+reproduce their correct refusal — no countermonotone regime for n > 2, since the
+FH lower bound is not a copula in dimension ≥ 3 though it stays pointwise sharp.
+If the API silently offers a countermonotone option for four events, it is wrong,
+and the consumer noticed before this repository did.
+
+**Does not establish.** That downstream projects will adopt it. That is their
+decision. The gate is that adoption becomes *possible* and that a real consumer's
+published numbers reproduce.
+
+#### Delivery record {#w5-delivery-record}
+
+Measured on 2026-08-19. Every row is a command.
+
+| Deliverable | Shipped as | Evidence |
+|---|---|---|
+| ROC-free surface | `src/cc/compose/` | 34 unit tests; a test greps the public signatures for `roc`, `youden`, `tpr`, `fpr`, `threshold`, `operating_point` and fails if any reappears |
+| Conformance corpus | `conformance/cc-kernel-v1/` | 24 accept + 8 reject cases, `SPEC.md` (256 lines), manifest with digests, 1e-12 tolerance |
+| Second implementation | `verifiers/node/cc_compose_verify.mjs` | zero-dependency Node, written from `SPEC.md`; 24/24 accept, 8/8 reject |
+| Differential harness | `scripts/differential_compose.py` | 23,000 randomized cases across 6 seeds, **0 disagreements** |
+| Cross-language guard | `src/cc/cli/guard.py`, `cc-guard` | stdin/stdout JSON **and** a pure-data decision table; table-vs-code agreement asserted |
+| Acceptance gate | `tests/acceptance/` | an external consumer's **published** four-control result reproduced: `[0, 0.01]`, independence `1.2e-5`, **833×**, all three scenarios, their sensitivity finding |
+
+Enforced by `make conformance`, `make differential`, `make acceptance`,
+`make test-compose`, and two new CI jobs.
+
+**Numbers.** Suite 689 → **808 passing**, 0 failing. Coverage 69.91% → **70.13%**.
+`cc/compose/_bounds.py` **97.09%**, `cc/cli/guard.py` **97.56%**. The closed form
+agrees with the finite-atom LP to **3.3e-16** over 600 randomized cases.
+
+**The fuzzer earned its keep on its first run.** `dependence="countermonotone"`
+with exactly one event: the Python raised `IndexError`, the Node silently
+returned `NaN`. Both wrong, differently; the curated corpus had not thought to
+ask. Both fixed, and pinned as `reject-countermonotone-one-event`. That is the
+argument for randomized differential testing over a corpus alone.
+
+**Honest limits.** The Node implementation and the Python reference were
+authored in the same project — a wrong specification yields two implementations
+wrong together. This is a differential-testing instrument, not an independent
+replication, and both the verifier output and the corpus manifest say so in
+their non-claims. The one genuinely non-same-author check is the external
+oracle, and it is **one** oracle on **one** scenario family. Neither the corpus
+nor the fuzzer covers the constrained LP path. No downstream project has adopted
+any of this yet: the obstacle is removed, the adoption is theirs.
+
+**Also fixed in passing.** [F-01](FINDINGS_REGISTER.md#f-01): `build`,
+`setuptools`, and `wheel` added to the `[test]` extra, plus a CI job that
+installs `.[test]` specifically, so the extra strangers are told to use is the
+extra that is tested.
+
+---
+
+### W6 — Contract the boundaries {#w6}
+
+**Findings:** [F-11](FINDINGS_REGISTER.md#f-11), [F-19](FINDINGS_REGISTER.md#f-19)
+· **Contracts:** [C1, C3, C7](DOWNSTREAM_CONTRACTS.md#contract-summary)
+· **Effort:** 3–4 weeks
+
+Ghost-Ark declares a binding rule that cc-framework must not consume naked binary
+labels. cc-framework has no ingest module, no schema, and no test for it. The rule
+binds a repository that cannot honour it.
+
+**Deliverables**
+
+1. **`cc.ingest.discretization`** — fail-closed reader for
+ `ghost.discretization_rule_receipt.v1` implementing all eleven preconditions
+ (binary domain, failure semantics, bounded score domain, threshold legality,
+ signed comparator, monotonic risk invariant, calibration digest, scoring
+ digest, temporal validity, parent lineage, stationarity declaration). A
+ marginal without lineage is refused, not defaulted.
+2. **Negative corpus** — one fixture per precondition, each rejected with a
+ **distinguishable reason**. A reader that rejects everything for the same
+ reason enforces one rule, not eleven.
+3. **Versioned resolvable schemas** — `cc.
+
+