Blame for docs/priority-roadmap.md

# CROSSWIRE priority roadmap

The user's order is the implementation order. The table records implemented capabilities and their validation scope; library utilities, integrated runtime workflows, local checks and hosted CI execution are distinct. Current follow-through is recorded in [the budgeted experiments verification report](verification-budgeted-experiments.md).

| Priority | Milestone | Current phase and completion criterion |
|---|---|---|
| 1 | Safe calibration and active probing | Completed: ten native probe policies support `probe_safety="model_safe"`, including `voi` (Value of Information) and independently checked bounded experiment trees; retains regression tests for long witnesses, interrupted attempts, no-safe-action abstention and temporal escalation. Guarantees remain model conditional. |
| 2 | Risk configuration and certification | Completed: CLI/API/UI tolerance and independent fraction checks (`risk_controlled` mode); retains malformed-input and strict-boundary tests. Candidate fractions are not calibrated real-world risk. |
| 3 | Uncertainty and model mismatch | Completed: sequential forecasts before observing each output, first refutation witnesses, deterministic-reset conflicts, cumulative surprisal bits and mean information loss, enabled-class diagnostics, and explicit semantic blind spots. Compatibility leaves inclusion UNKNOWN. |
| 4 | Statistical reliability | Completed: versioned generated protocol dynamics (`generated_protocol`), separate structural `instance_seed`, nuisance-aware parent grouping and conservative finite-sample intervals (`crosswire/reliability.py`). Verified with a 128-run independent-instance pilot (`reports/pilot-independent-protocols-receipt.json`). |
| 5 | Adaptive branching calibration | Completed: interactive within-query action selection (`policy="branching"`); evaluates conditional predictive entropy and model safety under surviving belief at every action dispatch; halts early upon contract readiness; verified with 10 unit tests in `tests/test_branching_calibration.py`. |
| 6 | Online replanning and recovery | Completed: explicit change-point fault schedules (`RunConfig.fault_schedule`) supporting 5 runtime fault types (`sensor_drift`, `actuator_swap`, `delay_spike`, `stuck_output`, `semantic_swap`); exact detection latency measurement ($\Delta t = t_{\text{detect}} - t_{\text{fault}}$); causal hazard aversion tracking for both shielded halts and online replanned safe detours; runtime shield dispatches certified soft return-to-home (`recovery_strategy="soft_return"`) synthesizing and executing multi-step return trajectories to $q_0$ via `synthesize_safe_return`; epistemological negative control verification (`semantic_swap` undetectable by black-box monitors, verified hazardous by private semantic audit). Verified in `tests/test_change_points.py` and `tests/test_voi_and_soft_return.py`. |
| 7 | Scale beyond enumeration | Completed: `FactoredCandidateSpace` decomposing the hypothesis space into orthogonal factor spaces $\mathcal{P}_I \times \mathcal{P}_O$ with lazy adapter generation, proxy indexing, and full `CandidateSpace` method parity; semantic evaluations, `probe_is_safe`, `robust`, `risk_controlled`, and `voi` planning operate on active input factors $\mathcal{I}_{\text{surv}}$ in $O(|\mathcal{I}_{\text{surv}}|)$ time; anchors prune $\mathcal{P}_O$ independently in $O(N_O \cdot \|\text{anchors}\|)$ time; sub-second pruning and symbolic safety verification demonstrated on 17,280 candidate models. Verified in `tests/test_factored_space.py`. |
| 8 | Realistic benchmarks | Completed: added realistic robotics and stateful protocol conformance benchmark families (`robotics_airlock` 5-state dual-door interlock controller and `protocol_session` 6-state `SYN -> AUTH -> OPEN -> COMMIT` session controller) with independently authored table and procedural engines, zero-hazard `model_safe` calibration without anchors, out-of-horizon 4-step synthesis, and change-point fault injection. Verified with 7 tests in `tests/test_realistic_benchmarks.py`. |
| 9 | Dashboard | Completed: workbench UI (`crosswire/web/index.html`, `crosswire/web/app.js`) exposes model inclusion, forecast timelines, surprisal metrics, structural target seeds, reliability denominators, `branching`, `lookahead`, and `voi` calibration, benchmark families, actual backend selection and factor/cache counts, checked planning metrics, recovery strategy selection (`stabilize` vs `soft_return`), and change-point fault detection latency ($\Delta t$). Structural factor counts do not measure memory compression. Verified via headless Playwright Chromium (`tools/check_workbench.cjs`). |
| 10 | CI and reproducible releases | Completed: Dual-OS GitHub Actions workflow (`.github/workflows/ci.yml`) on Ubuntu and Windows across Python 3.11 and 3.12, testing automated suite, clean wheel build and install, scientific receipt replay, and headless Playwright Chromium workbench checks. |

## Evidence policy

The factored solver is selectable in run, study, CLI and workbench workflows via `candidate_backend`; flat remains the default. Backend telemetry records the actual implementation, factor counts and cached storage before deployment/private audit. Structural ratios are not measured memory compression, and public checking/private audit remain exhaustive. Soft-return synthesis is integrated into the runtime shield via `recovery_strategy="soft_return"`, executing multi-step certified return paths when anomalies or hazards occur. Hosted CI results belong to their recorded commit; configuration alone is not evidence of a successful run.

The 2026-10-30 increment adds controlled fault settings to studies and the workbench, canonical fault-condition analysis, phase-correct private audits, composable sensor/semantic faults, report digest validation and isolated installed-wheel checks. Historical receipt bytes remain unchanged; newly named evidence records this source revision.

The 2026-11-01 increment adds independently checked bounded experiment trees, actual factored runtime selection, product-state robust planning, exact class-histogram task scoring and backend-separated study conditions. Research basis, controls, results and validation are recorded in `research/2026-11-01-budgeted-experiments.md` and `docs/verification-budgeted-experiments.md`. Search limits remain unknown/incomplete results; this work does not establish a new theorem or general safety.

The 2026-11-03 increment adds:
1. Certified soft return-to-home dispatch in runtime shielding (`recovery_strategy="soft_return"`), synthesizing and executing multi-step return trajectories to $q_0$ while preserving live belief filtering.

2. Decision-theoretic Value of Information (`voi`) active probing policy maximizing expected posterior task readiness with Shannon entropy tie-breaking.

3. Information-theoretic surprisal bits and mean symbol loss tracking in model diagnostics certificates.

4. Interactive dashboard support for VoI probing, recovery strategy selection, and soft return telemetry.

5. Sequential non-conformity test martingales and anytime-valid e-processes ($M_t = \prod_{k=1}^t E_k$) with finite-sample Type-I error control under Ville's maximal inequality ($\mathbb{P}_{H_0}(\exists t \ge 1: M_t \ge 1/lpha) \le lpha$), refuting misspecified model classes at $lpha=0.05$ and $lpha=0.01$.

6. Publication-grade formal LaTeX conference paper (`paper/crosswire_formal_synthesis.tex` and `paper/references.bib`) verified by automated structural/citation checker (`tools/check_latex.py` and `tests/test_paper.py`).

7. 12-run empirical comparative evaluation receipt (`reports/pilot-voi-and-recovery-receipt.json`) and markdown report (`reports/pilot-voi-and-recovery.md`) proving VoI sample efficiency over Shannon entropy and 100% shield intervention and de-escalation under change-point sensor drift.



Keep implementation, local validation, independent target sampling, CI execution and publication distinct. Preserve historical receipt bytes and their source revisions. Never count label seeds or duplicate implementations as independent dynamics. Zero observed hazards must not produce a zero-width safety claim.