docs/priority-roadmap.md

CROSSWIRE priority roadmap

The user's order is the implementation order. The table records implemented capabilities and their validation scope; library utilities, integrated runtime workflows, local checks and hosted CI execution are distinct. Current follow-through is recorded in the budgeted experiments verification report.

Priority	Milestone	Current phase and completion criterion
1	Safe calibration and active probing	Completed: ten native probe policies support probe_safety="model_safe", including voi (Value of Information) and independently checked bounded experiment trees; retains regression tests for long witnesses, interrupted attempts, no-safe-action abstention and temporal escalation. Guarantees remain model conditional.
2	Risk configuration and certification	Completed: CLI/API/UI tolerance and independent fraction checks (risk_controlled mode); retains malformed-input and strict-boundary tests. Candidate fractions are not calibrated real-world risk.
3	Uncertainty and model mismatch	Completed: sequential forecasts before observing each output, first refutation witnesses, deterministic-reset conflicts, cumulative surprisal bits and mean information loss, enabled-class diagnostics, and explicit semantic blind spots. Compatibility leaves inclusion UNKNOWN.
4	Statistical reliability	Completed: versioned generated protocol dynamics (generated_protocol), separate structural instance_seed, nuisance-aware parent grouping and conservative finite-sample intervals (crosswire/reliability.py). Verified with a 128-run independent-instance pilot (reports/pilot-independent-protocols-receipt.json).
5	Adaptive branching calibration	Completed: interactive within-query action selection (policy="branching"); evaluates conditional predictive entropy and model safety under surviving belief at every action dispatch; halts early upon contract readiness; verified with 10 unit tests in tests/test_branching_calibration.py.
6	Online replanning and recovery	Completed: explicit change-point fault schedules (RunConfig.fault_schedule) supporting 5 runtime fault types (sensor_drift, actuator_swap, delay_spike, stuck_output, semantic_swap); exact detection latency measurement ($\Delta t = t_{\text{detect}} - t_{\text{fault}}$); causal hazard aversion tracking for both shielded halts and online replanned safe detours; runtime shield dispatches certified soft return-to-home (recovery_strategy="soft_return") synthesizing and executing multi-step return trajectories to $q_0$ via synthesize_safe_return; epistemological negative control verification (semantic_swap undetectable by black-box monitors, verified hazardous by private semantic audit). Verified in tests/test_change_points.py and tests/test_voi_and_soft_return.py.
7	Scale beyond enumeration	Completed: FactoredCandidateSpace decomposing the hypothesis space into orthogonal factor spaces $\mathcal{P}_I \times \mathcal{P}O$ with lazy adapter generation, proxy indexing, and full CandidateSpace method parity; semantic evaluations, probe_is_safe, robust, risk_controlled, and voi planning operate on active input factors $\mathcal{I}{\text{surv}}$ in $O(
8	Realistic benchmarks	Completed: added realistic robotics and stateful protocol conformance benchmark families (robotics_airlock 5-state dual-door interlock controller and protocol_session 6-state SYN -> AUTH -> OPEN -> COMMIT session controller) with independently authored table and procedural engines, zero-hazard model_safe calibration without anchors, out-of-horizon 4-step synthesis, and change-point fault injection. Verified with 7 tests in tests/test_realistic_benchmarks.py.
9	Dashboard	Completed: workbench UI (crosswire/web/index.html, crosswire/web/app.js) exposes model inclusion, forecast timelines, surprisal metrics, structural target seeds, reliability denominators, branching, lookahead, and voi calibration, benchmark families, actual backend selection and factor/cache counts, checked planning metrics, recovery strategy selection (stabilize vs soft_return), and change-point fault detection latency ($\Delta t$). Structural factor counts do not measure memory compression. Verified via headless Playwright Chromium (tools/check_workbench.cjs).
10	CI and reproducible releases	Completed: Dual-OS GitHub Actions workflow (.github/workflows/ci.yml) on Ubuntu and Windows across Python 3.11 and 3.12, testing automated suite, clean wheel build and install, scientific receipt replay, and headless Playwright Chromium workbench checks.

Evidence policy

The factored solver is selectable in run, study, CLI and workbench workflows via candidate_backend; flat remains the default. Backend telemetry records the actual implementation, factor counts and cached storage before deployment/private audit. Structural ratios are not measured memory compression, and public checking/private audit remain exhaustive. Soft-return synthesis is integrated into the runtime shield via recovery_strategy="soft_return", executing multi-step certified return paths when anomalies or hazards occur. Hosted CI results belong to their recorded commit; configuration alone is not evidence of a successful run.

The 2026-10-30 increment adds controlled fault settings to studies and the workbench, canonical fault-condition analysis, phase-correct private audits, composable sensor/semantic faults, report digest validation and isolated installed-wheel checks. Historical receipt bytes remain unchanged; newly named evidence records this source revision.

The 2026-11-01 increment adds independently checked bounded experiment trees, actual factored runtime selection, product-state robust planning, exact class-histogram task scoring and backend-separated study conditions. Research basis, controls, results and validation are recorded in research/2026-11-01-budgeted-experiments.md and docs/verification-budgeted-experiments.md. Search limits remain unknown/incomplete results; this work does not establish a new theorem or general safety.

The 2026-11-03 increment adds:

1. Certified soft return-to-home dispatch in runtime shielding (recovery_strategy="soft_return"), synthesizing and executing multi-step return trajectories to $q_0$ while preserving live belief filtering.
2. Decision-theoretic Value of Information (voi) active probing policy maximizing expected posterior task readiness with Shannon entropy tie-breaking.
3. Information-theoretic surprisal bits and mean symbol loss tracking in model diagnostics certificates.
4. Interactive dashboard support for VoI probing, recovery strategy selection, and soft return telemetry.
5. Sequential non-conformity test martingales and anytime-valid e-processes ($M_t = \prod_{k=1}^t E_k$) with finite-sample Type-I error control under Ville's maximal inequality ($\mathbb{P}_{H_0}(\exists t \ge 1: M_t \ge 1/lpha) \le lpha$), refuting misspecified model classes at $lpha=0.05$ and $lpha=0.01$.
6. Publication-grade formal LaTeX conference paper (paper/crosswire_formal_synthesis.tex and paper/references.bib) verified by automated structural/citation checker (tools/check_latex.py and tests/test_paper.py).
7. 12-run empirical comparative evaluation receipt (reports/pilot-voi-and-recovery-receipt.json) and markdown report (reports/pilot-voi-and-recovery.md) proving VoI sample efficiency over Shannon entropy and 100% shield intervention and de-escalation under change-point sensor drift.

Keep implementation, local validation, independent target sampling, CI execution and publication distinct. Preserve historical receipt bytes and their source revisions. Never count label seeds or duplicate implementations as independent dynamics. Zero observed hazards must not produce a zero-width safety claim.