Honest boundary: without an NLI model, SZL does NOT have semantic entropy — only a lexical ANALOGY

The clustering step REQUIRES an entailment judge; a 2-vCPU CPU-only estate with no NLI model cannot run it as published. What SZL's /api/decay consistency probe actually computes is exact-match clustering over lexically NORMALIZED answers (lowercase, first-line, punctuation-stripped) plus agreement ratio (HEADLINE) and discrete entropy (secondary, coarse at small k) — the SelfCheckGPT sampling-consistency family, an ANALOGY to semantic entropy, and the caption must always say so. Claiming "semantic entropy" without NLI clustering would fabricate a capability — the exact violation the honesty doctrine forbids. The discrete-entropy arithmetic itself is trivially CPU-honest once clusters exist.

Applies to: honesty-doctrine.

Evidence: .local/ingest-lab/wave11/report-a-detection-science.md (CPU-only reproducibility verdicts, all 7 items)


Zero-resource black-box detection: if the model knows, k samples agree; if it confabulates, they diverge

SelfCheckGPT's core intuition needs no logits, no external database, no white-box access — just the ability to sample k generations and measure their consistency (variants: BERTScore, QA, n-gram, NLI, LLM-Prompt). The n-gram/exact-match end of that family is the ONLY published hallucination-detection paradigm honestly runnable on SZL's black-box CPU router, and it is precisely the shape of the /api/decay consistency probe: k sovereign-served samples, lexical exact-match clusters, agreement ratio. CONVERGENT by design and cited as the probe's method family — with the standing caveat that lexical agreement is weaker than their NLI/BERTScore variants and is labeled ANALOGY to semantic clustering.

Applies to: backbone-loop.

Evidence: https://arxiv.org/abs/2303.08896 ; https://github.com/potsawee/selfcheckgpt


Sovereign-only sampling gate: a consistency measurement over a MIXED provider pool measures nothing

SelfCheckGPT assumes all k samples come from the SAME model. SZL's probe therefore counts ONLY sovereign-served samples (servedProvider=sovereign, named node, receipt-backed); cloud-served fallbacks are excluded and counted as excludedNotSovereign, and fewer than 2 sovereign samples yields status INSUFFICIENT with agreementRatio null — agreement is undefined, not zero, and never fabricated. This gate is SZL's own doctrine-driven addition, not part of the upstream method.

Applies to: sovereign-serving.

Evidence: scripts/src/consistency-probe-run.ts (sovereign gate + INSUFFICIENT semantics)


The field's honest split: every production hallucination check is either a model or a deterministic string/schema check

Across ten surveyed tools the mechanism is always one of: an NLI-style classifier (HHEM's FLAN-T5 consistency scorer, LettuceDetect's ModernBERT span classifier), an LLM-as-judge (RAGAS faithfulness, DeepEval G-Eval, TruLens RAG Triad, Phoenix eval templates, FacTool), a hosted proprietary scorer (Cleanlab TLM — thin MIT client, cloud-only scoring, NOT self-hostable), or deterministic checks (Guardrails schema/regex validators, RAGAS exact-match/BLEU/ROUGE). Nothing semantic runs without a model somewhere. For SZL's no-GPU TS estate the honestly portable subset is the deterministic one — sampling-consistency over lexical clusters, schema validation — which is exactly what /api/decay ships, with the limitation stated rather than hidden. A GitLab sweep found no comparable tool: recorded as none-found-in-survey, never "none exists".

Applies to: honesty-doctrine.

Evidence: .local/ingest-lab/wave11/report-b-tooling.md (summary table, all REPORTED verbatim 2026-07-12)


Convergence map verdict: none of the ten ships signed receipts or in-browser verification — our sharpest gap-in-our-favor

Mapped against Alloy's existing organs: Cleanlab TLM's per-response trust score is CONVERGENT in spirit with our per-run receipt but mechanically opposite (their learned confidence from a hosted model vs our cryptographic provenance anyone recomputes offline); RAGAS/DeepEval/Guardrails' falsifiable pass/fail discipline is CONVERGENT with /api/invariants (different object: content factuality vs ledger self-consistency); RAGAS/HHEM per-claim verification parallels LivingPaper's verify rubric (their NLI judge vs our named-live-endpoint recompute). The signed hash-chained receipt form and the reader's-own-browser Ed25519 verify appear in ZERO surveyed tools. Stated falsifiably — a single counterexample disproves it — and it grants SZL no accuracy advantage: it is a provenance property, not a detection score.

Applies to: honesty-doctrine.

Evidence: .local/ingest-lab/wave11/report-b-tooling.md (convergence map, CONVERGENT/ABSENT markers)


Three construction-side primitives converge: span-level grounding, per-hop signed artifacts, append-only verifiable logs

The frontier's leaders each harden one hop: Anthropic Citations pins generated spans to exact char-ranges in caller-supplied documents (grounds against YOUR documents only — not the world, not a signature); C2PA hard-binds media assets to signed, offline-verifiable manifests (and states itself it makes no truth judgment and detects no deepfakes); CT/Rekor make signing events publicly auditable via Merkle logs with inclusion+consistency proofs. These are the same three primitives /api/decay's antiDecayMap claims for Alloy's own hops (source-pinned blocks, Ed25519 receipts, hash-chained ledger + signed checkpoint) — each mapped as a labeled ANALOGY with its falsifiable check, never as adoption of any surveyed system.

Applies to: honesty-doctrine.

Evidence: .local/ingest-lab/wave11/report-d-frontiers.md (items 1-4, quotes verbatim)


Honest self-note carried into the organ: our ledger is a hash chain, NOT a Merkle transparency log

Rekor/CT produce O(log n) inclusion and consistency proofs against a signed tree head; Alloy's ledger is a linear hash chain (rowHash = sha256(prevHash|contentHash), recomputed on read) with a signed checkpoint over count+head — tamper-evident, but it cannot hand a client an inclusion proof for one row without replaying the chain. The /api/decay receipts hop says exactly this instead of borrowing Merkle credibility. Also recorded verbatim from the survey's falsifiable frontier list: no public LLM API today ships per-response offline-verifiable signed receipts, a response transparency log, robust free-text provenance (SynthID is statistical, key-holder-side, paraphrase-fragile; "no methods widely accepted as effective" is the field's own position), real-time proof-of-model-execution, or an in-browser don't-trust-us verifier. Each stated so one counterexample disproves it; the two we DO ship (receipts, browser verify) were verified against our own source before being claimed.

Applies to: honesty-doctrine.

Evidence: .local/ingest-lab/wave11/report-d-frontiers.md (frontier list 1-5 + our-own baseline, verified against receipts.ts/runLedger.ts/browserVerify.ts)


Ed25519-signed refs with no central host is the sovereign-git thesis — it maps onto Alloy's receipt chain, not onto a forge SZL runs

Radicle replaces the trusted central server with cryptographic identity: every repository and every ref update is signed by an Ed25519 key, and history is gossip-replicated peer-to-peer so no single host is authoritative. For SZL this is the crown-jewel ANALOGY — Alloy already establishes trust in signature space (ed25519 over sha256 canonical bytes, plaintext never in the receipt), verified per request by the `receipt-ed25519-verify` invariant. The honest boundary: SZL does NOT run Radicle and has NOT made its git storage peer-to-peer (code lives on github.com/szl-holdings + Carlota-1/Machine-Innovate). The lesson adopted is at the receipt/storage-integrity layer SZL already ships; standing up a P2P forge is a DECLARED roadmap gap, never a claimed fact. Convergence ≠ adoption.

Applies to: receipt-chain.

Evidence: .local/ingest-lab/wave12/report-doctrine-map.md (Ed25519-signed refs → receipt-ed25519-verify)


Append-only, tamper-evident history is the same property the Ouroboros closes on its own tail

Radicle's signed, content-addressed history cannot be silently rewritten — a tamper breaks the signature chain. Alloy's run ledger is a linear hash chain (rowHash = sha256(prevHash|contentHash), recomputed on read), and the `receipt-chain-continuity` invariant recomputes that chain over its own prior hashes every request — the Ouroboros closing on its own tail. Stated with the same honesty carried from wave-11: Alloy's ledger is a hash chain, NOT a Merkle transparency log, so it cannot hand a client an O(log n) inclusion proof for one row without replaying the chain. The forge primitive is mapped as a labeled ANALOGY to that EXISTING falsifiable check — it adds zero proofs and upgrades nothing; Λ stays Conjecture-1.

Applies to: ouroboros-invariants.

Evidence: .local/ingest-lab/wave12/report-doctrine-map.md (append-only history → receipt-chain-continuity)


Self-hostable single-binary sovereignty is the own-metal thesis SZL already lives at the serving layer

Gitea's whole design is 'own your git host on your own hardware, one binary, no cloud dependency' — the code-storage version of SZL's sovereign-GPU default (serve from tower/laptop before any cloud). The honest mapping: SZL's sovereignty today is at the INFERENCE layer (own-metal nodes, `served-run-has-model` invariant proves a live-served run names the model that served it), not the STORAGE layer — SZL's git still lives on GitHub. A self-hosted Gitea/Forgejo mirror of Carlota-1/Machine-Innovate is a plausible DECLARED roadmap step toward storage sovereignty, recorded as a gap, never as done.

Applies to: sovereign-serving.

Evidence: .local/ingest-lab/wave12/report-forge-leaders.md (Gitea MIT, single Go binary)


Gitea Actions (GitHub-Actions-compatible on your own metal) is the pattern for portable, non-lock-in CI

Gitea Actions runs GitHub-Actions-syntax workflows on a self-hosted runner, so the same workflow file is portable between a cloud host and own metal — no vendor lock-in on the automation layer. For SZL this is the honest CI-portability lesson: the szl-holdings CI (SLSA L1 / SBOM / DCO / CodeQL / Gitleaks) is GitHub-hosted today; keeping workflows in portable Actions syntax means they could run on a sovereign runner without a rewrite. Adopting a self-hosted runner is a roadmap item; convergence ≠ adoption.

Applies to: forge-training.

Evidence: .local/ingest-lab/wave12/report-forge-leaders.md (Gitea Actions, portable CI)


Merge-request approval rules → Alloy's per-action approval tickets (a human approval gates before any provider call)

GitLab's approval rules require N designated reviewers to approve before a merge can land — governance enforced at the change boundary. Alloy already ships the runtime analogue: `A11OY_APPROVAL_MODE=required` makes every /run and /run/stream spend a single-use, short-TTL approval ticket minted by the run-key holder — one mint is one explicit human approval for one action, and gateRun() refuses BEFORE any provider call (denied requests are never ledger rows). The honest limit carried from the audit: those tickets are in-memory (cleared on restart), a DECLARED roadmap gap toward a durable ticket store. The forge primitive is mapped as an ANALOGY to an EXISTING enforced gate, never a new claim.

Applies to: backbone-loop.

Evidence: .local/ingest-lab/wave12/report-doctrine-map.md (MR approval rules → approval tickets)


Integrated supply-chain scanning + SBOM is the DevSecOps ceiling SZL tracks at SLSA L1, honestly below it

GitLab bundles SAST/DAST/dependency scanning/container scanning/SBOM into the pipeline as first-class gates. SZL's szl-holdings CI is honestly at SLSA L1 (SBOM + DCO) with CodeQL + Gitleaks — a real but LOWER rung, stated as such (the estate's own attestations directory enumerates the certifications it does NOT hold, which is the strongest form of the honesty doctrine). The wave-12 lesson is the target shape (provenance + SBOM + scanning as enforced gates), recorded as a roadmap toward SLSA L2 on the SZL-1 model pipeline — never as a level SZL has already reached.

Applies to: ouroboros-invariants.

Evidence: .local/ingest-lab/wave12/report-doctrine-map.md (SLSA/SBOM → signed-columns-atomic)


Radical minimalism (one small binary, cross-platform, low-resource) is the honest fit for SZL's constrained own metal

Gogs's founding constraint — run a full git host on the cheapest hardware, a Raspberry Pi included — matches SZL's reality: consumer GPUs (RTX 4060 Ti-class tower) and a laptop node, not a datacenter. The lesson is the same one KTransformers taught at the inference layer (measure the host, degrade honestly) applied to storage: a mirror host, if ever stood up, should be the minimal footprint that fits the metal, not an enterprise stack the fleet cannot carry. Recorded as design guidance for a DECLARED roadmap mirror, never as deployed infrastructure.

Applies to: sovereign-serving.

Evidence: .local/ingest-lab/wave12/report-forge-leaders.md (Gogs MIT, minimal footprint)


Built-in CI/CD + symbol-level code search as first-class forge features → the shape of a self-contained sovereign workspace

OneDev bakes the pipeline engine and semantic (symbol-level) code search directly into the forge rather than wiring external services — one self-hosted process is the whole loop: store, search, build. For SZL this is the design shape for an eventual sovereign code workspace on own metal (the Machine-Innovate mirror + a build/eval loop), where the szl-forge SZL-1 pipeline (rebirth.ps1 → eval_szl.py → calibrate.ps1) would be the 'CI' over the 269-formula calibration set. Recorded strictly as a DECLARED roadmap shape — SZL runs no OneDev instance and claims none; convergence ≠ adoption.

Applies to: forge-training.

Evidence: .local/ingest-lab/wave12/report-forge-leaders.md (OneDev MIT, built-in CI/CD + code search)


Copyleft-as-anti-capture governance is the licensing analogue of the honesty doctrine's 'no repaint' rule

Forgejo forked Gitea and relicensed to GPL-3.0-or-later specifically so the project cannot be quietly enclosed by a single vendor — copyleft as a structural anti-capture guarantee, stewarded by a non-profit (Codeberg e.V.). This is a governance ANALOGY, not a technique SZL imports: it mirrors the honesty doctrine's binding rule that outside inspiration is pattern-study ONLY, never a repaint of SZL's own #3af4c8 identity, and that license/archival decisions stay owner-only. SZL's repos are proprietary/Apache-2.0 per repo (owner's choice) — Forgejo's copyleft is studied, explicitly NOT adopted, and the licensing decision is recorded as owner-only.

Applies to: honesty-doctrine.

Evidence: .local/ingest-lab/wave12/report-doctrine-map.md (Forgejo copyleft → no-repaint governance)


Minimal-JS, fully-scriptable, don't-trust-the-UI is the same posture as Alloy's in-browser Ed25519 verifier

SourceHut ships almost no client-side JavaScript and exposes everything through a plain, scriptable API — the user never has to trust an opaque web app to do the real work. Alloy's honesty organs share the posture inverted into cryptography: the ReceiptChain component runs WebCrypto Ed25519 verification in the reader's OWN browser against the source endpoint's label (a don't-trust-us verifier), and the `receipt-columns-consistent` invariant proves each receipt payload matches its indexed columns. The forge primitive is mapped as an ANALOGY to that EXISTING falsifiable surface — SZL does not run SourceHut and claims no adoption.

Applies to: honesty-doctrine.

Evidence: .local/ingest-lab/wave12/report-doctrine-map.md (SourceHut minimal-JS → in-browser verify)


Sigstore-backed artifact attestation + SLSA provenance is the exact target for the SZL-1 model pipeline's next rung

GitHub's Artifact Attestations bind a built artifact to its build provenance via a Sigstore-signed, Rekor-logged attestation (SLSA lineage) — machine-verifiable 'this artifact came from this source, built this way'. The szl-forge SZL-1 pipeline currently produces a signed GGUF but has NO such provenance attestation on the model artifact itself — a DECLARED gap identified in the architecture audit. The honest wave-12 target: add a cosign attest step after rebirth.ps1 so every SZL-1 download carries offline-verifiable provenance (Rekor already ingested in wave-11). Mapped as an ANALOGY to Alloy's signed checkpoint (`signed-columns-atomic` invariant); recorded as a roadmap rung toward SLSA L2, never a level already reached.

Applies to: forge-training.

Evidence: .local/ingest-lab/wave12/report-doctrine-map.md (SLSA/Sigstore attestation → SZL-1 provenance gap)


Protected branches + required reviews is the machine form of SZL's two-account PR flow on protected mains

GitHub enforces 'no direct writes to main; every change lands via a reviewed PR' as a repo setting. SZL already runs exactly this by hand on protected mains — one account authors the PR, a second approves, squash-merge with a DCO trailer — because branch protection is ON. The wave-12 lesson is that this process discipline is the same governance primitive GitLab/GitHub bake in, and it composes with Alloy's runtime approval tickets: change-time review (git) plus action-time approval (run gate) are two independent gates, not a duplication. Recorded as the governance posture SZL already practices, stated as process doctrine.

Applies to: ouroboros-invariants.

Evidence: .local/ingest-lab/wave12/report-doctrine-map.md (protected branches → two-account PR flow)


RRF: fuse rankings by rank, not by score — RRFscore(d) = Σ 1/(k + rank_i(d))

The paper's whole method is one line: given multiple rankings of the same documents, score each document by the sum of reciprocal ranks 1/(k + rank) across rankers (k=60 in the paper, chosen to damp the impact of outlier top ranks) and re-sort. Because it consumes RANKS, not raw scores, it needs no score calibration or normalization between rankers on incomparable scales. This is the one wave-13 technique SZL ADOPTED in code (2026-07-14): /brain/ask ranking is now the RRF fusion (k=60, DECLARED constant from this paper) of two deterministic lexical rankers — classic BM25 and distinct-term coverage — both MEASURED signals over the committed corpus. Adoption is disclosed as a DECLARED technique choice with fixture-pinned behavior; it is never claimed as 'better' — the paper's win claims stay the paper's.

Applies to: second-brain.

Evidence: https://dl.acm.org/doi/10.1145/1571941.1572114 (Section 2, the RRF equation)


Rank fusion tolerates one weak ranker — robustness over tuning

The authors' argument for RRF's k damping is that a document ranked #1 by one ranker and poorly by another should not dominate; the constant k=60 keeps any single ranker from owning the fused order. For SZL's adoption this is the property that matters: the term-coverage ranker is deliberately crude (count of distinct query terms matched), and RRF lets it act as a corrective vote against BM25's known long-document/rare-term-repetition bias without ever overruling BM25 outright. The retrieval floor still gates on the raw BM25 top score — fusion reorders WHICH grounding is shown first, it never manufactures grounding that BM25 did not find.

Applies to: second-brain.

Evidence: https://dl.acm.org/doi/10.1145/1571941.1572114


Honest boundary: the paper's effectiveness wins are ITS claims on ITS collections

Cormack et al. report RRF beating Condorcet fusion and individual learning-to-rank methods on TREC collections. SZL re-implements only the equation; none of those effectiveness claims transfer to the Second Brain corpus and none are restated as SZL results. What SZL pins instead is fixture behavior: deterministic tests assert the fused ordering is exactly the RRF of the two component rankings — a correctness-of-implementation claim, never a retrieval-quality claim.

Applies to: honesty-doctrine.

Evidence: artifacts/api-server/src/lib/brainIndex.test.ts (fixture-pinned RRF exactness)


Graph-indexed retrieval: extract an entity graph, retrieve through structure not just text

GraphRAG builds an LLM-extracted entity-relationship graph over the corpus, clusters it into communities (Leiden), pre-summarizes each community, and answers 'global' questions by map-reducing over community summaries instead of top-k chunk retrieval. The structural insight — retrieval can traverse RELATIONS between chunks, not just rank chunks — is the frontier thesis of this wave. SZL's Brain Atlas already has a graph (BM25 lexical adjacency, S2), so the convergence is real but bounded: SZL's edges are shared-rare-words, GraphRAG's are LLM-extracted semantic relations. The resemblance stays labeled ANALOGY; convergence ≠ adoption.

Applies to: second-brain.

Evidence: https://raw.githubusercontent.com/microsoft/graphrag/main/README.md


Community pre-summarization = generated prose in the index — a lane SZL will not cross today

GraphRAG's community reports are LLM-GENERATED summaries baked into the index at build time. For SZL that is the honest blocker to adopting the pattern: the in-repo lane is MEASURED precisely because every chunk is committed, human-authored or deterministically derived text with a content fingerprint. Injecting model-generated summaries would make the retrieval substrate itself partially SIMULATED and every downstream citation would inherit that taint. Recorded as a DECLARED roadmap gap with the blocker named, not a rejection of the technique.

Applies to: honesty-doctrine.

Evidence: https://microsoft.github.io/graphrag/ (indexing pipeline docs)


Their eval claims stay theirs

Microsoft reports GraphRAG substantially outperforming naive RAG on comprehensiveness/diversity for global sensemaking questions (their arXiv:2404.16130 evaluation, their LLM-as-judge methodology). SZL restates none of it — the Second Brain has run no comparable evaluation and scores no quality. The only thing adopted from studying GraphRAG is the framing that a corpus graph is a retrieval asset, which SZL already possessed in lexical form.

Applies to: honesty-doctrine.

Evidence: https://raw.githubusercontent.com/microsoft/graphrag/main/README.md


Learned sparse expansion: the model adds terms the document never contains

SPLADE learns sparse lexical representations where a document's vector can activate vocabulary terms that do not literally appear in it — closing BM25's vocabulary-mismatch gap while staying an inverted-index-compatible sparse model. This names the exact ceiling of SZL's retrieval honestly: the Second Brain's BM25+coverage fusion can NEVER match a query term the chunk does not contain. That gap is now a DECLARED limitation of the in-repo lane rather than an unexamined blind spot.

Applies to: second-brain.

Evidence: https://raw.githubusercontent.com/naver/splade/main/README.md


Hard honest boundary: CC BY-NC-SA + a trained model SZL does not have

Two independent blockers, both recorded: (1) the repo license is NON-COMMERCIAL ShareAlike — SZL, a commercial holding, does not touch the code; (2) even the idea requires a trained expansion model, and nothing in SZL is TRAINED until real signed artifacts exist and verify in-app (forge doctrine). So learned sparse expansion is studied, named as the technique that would lift the vocabulary-mismatch ceiling, and left honestly un-adopted on both legal and evidentiary grounds.

Applies to: honesty-doctrine.

Evidence: https://raw.githubusercontent.com/naver/splade/main/LICENSE (verbatim: CC BY-NC-SA 4.0, NAVER Corp.)


Recursive abstraction tree: retrieve at multiple granularities at once

RAPTOR clusters chunks, LLM-summarizes each cluster, then recursively clusters the summaries — producing a tree where retrieval can hit a leaf (detail) or an internal node (theme). The lesson SZL takes is the FRAMING: a flat top-k over uniform chunks structurally cannot answer 'what is the overall shape of X' questions, because no committed chunk speaks at that altitude. The Second Brain's honest equivalent of an abstraction layer is its hand-AUTHORED doc chunks (data-surfaces.md sections, doctrine prose), which are committed human abstractions rather than generated ones.

Applies to: second-brain.

Evidence: https://raw.githubusercontent.com/parthsarthi03/raptor/master/README.md


Same blocker as GraphRAG, recorded once more because the failure mode differs

RAPTOR's internal nodes are LLM-generated summaries that get CITED as retrieval results. In SZL's citation-gated ask flow that is the worst-case taint: a [S#] citation pointing at generated prose would launder a model's own words into 'grounding'. GraphRAG's summaries at least sit behind a map-reduce; RAPTOR's sit directly in the citable index. DECLARED roadmap gap, blocker named, not adopted.

Applies to: honesty-doctrine.

Evidence: https://raw.githubusercontent.com/parthsarthi03/raptor/master/README.md


Late interaction: score at the token level, aggregate with MaxSim

ColBERT encodes query and document into per-token embeddings and scores by summing, over query tokens, the maximum similarity against any document token — richer than a single-vector dot product, cheaper than full cross-attention. The transferable shape (not the neural machinery) is 'per-query-term evidence, aggregated' — which is exactly what SZL's term-coverage ranker does in degenerate lexical form: each distinct query term contributes evidence, and fusion aggregates. The family resemblance is labeled ANALOGY; SZL runs no encoder and computes no similarity — token identity, not token meaning.

Applies to: second-brain.

Evidence: https://raw.githubusercontent.com/stanford-futuredata/ColBERT/main/README.md


Neural retrieval is a dependency wall the in-repo lane deliberately stays behind

ColBERT needs a trained checkpoint, a GPU-class encoder at query time, and a vector index — three dependencies the Second Brain's in-repo lane is DEFINED by not having (dependency-free, deterministic, pure function of committed bytes). Studying ColBERT sharpened the boundary into a positive statement: the lane trades retrieval ceiling for verifiability — anyone can recompute the exact ranking from the committed corpus with no model weights. That trade is now a DECLARED design position, not an accident of history.

Applies to: second-brain.

Evidence: https://raw.githubusercontent.com/stanford-futuredata/ColBERT/main/README.md


Eager sparse scoring: precompute per-term score contributions at index time

BM25S's core trick is computing each term's BM25 contribution for every document AT INDEX TIME into a sparse matrix, so a query is just slicing rows and summing — no per-query TF/IDF arithmetic. SZL's index computes contributions at query time; over a ~1.6k-chunk corpus that is microseconds and honesty-neutral, so nothing is adopted NOW — but this is the named, license-compatible (MIT) optimization path if the committed corpus ever grows to where query-time scoring measurably matters. Adopt-when-measured, not adopt-because-frontier.

Applies to: second-brain.

Evidence: https://raw.githubusercontent.com/xhluca/bm25s/main/README.md


External validation that dependency-free lexical retrieval is a legitimate design point

BM25S exists because a plain, well-implemented BM25 on a numpy-only stack remains competitive infrastructure in 2024+ — the author positions it against both heavyweight Java (Anserini) and slow pure-Python (rank_bm25) incumbents. For SZL this is convergent evidence (their thesis, not SZL's proof) that the Second Brain's zero-dependency BM25 lane is a defensible engineering position rather than a naive placeholder. Their speed numbers stay theirs; SZL's corpus is small enough that none of it is load-bearing here.

Applies to: second-brain.

Evidence: https://raw.githubusercontent.com/xhluca/bm25s/main/README.md


MIT at the ~1T-parameter frontier — the permissive-license ceiling moved

The checkable fact from the card is the license tag: a frontier-class MoE released mid-June 2026 under plain MIT. Third-party trackers (Artificial Analysis Intelligence Index v4.1) rank it the #1 open-weight model — THEIR ranking on THEIR methodology, recorded here as their claim. What this changes for SZL is the study landscape, not the serving reality: no estate GPU can host a ~1T MoE, and the only named path to ever touching such a model on owned metal remains the wave-1 KTransformers arithmetic-intensity offload thesis — which stays ROADMAP, unmeasured.

Applies to: frontier.

Evidence: https://huggingface.co/zai-org/GLM-5.2 (card license tag, release date)


Open weights ≠ open source — the wave-14 boundary, stated once for the whole wave

Every model in this wave publishes weights, not provenance: training data, pipeline, and RL recipes stay closed. 'MIT weights' means the artifact is permissively licensed, not that the system is reproducible. SZL records the distinction as doctrine because it mirrors the forge rule at home: SZL's own models are nothing but UNTRAINED declarations until signed receipts verify in-app — a public weight file with a benchmark table is an artifact plus ITS AUTHOR'S claims, and ingesting the card never converts those claims into SZL facts.

Applies to: honesty-doctrine.

Evidence: https://huggingface.co/zai-org/GLM-5.2


Alloy's moonshot pin already names this exact model — offline-until-keyed, now source-verified

The provider registry pins kimi-k2.6 as the moonshot lane's default, and wave-14 verification confirms that id corresponds to a real, current frontier release on the primary source (HF card, image-text-to-text pipeline tag). What 'verified' means here is precisely bounded: the model EXISTS with this identity and license — Alloy has never served it (the lane is honestly offline until MOONSHOT_API_KEY lands) and no capability claim transfers from the card to the app.

Applies to: frontier.

Evidence: artifacts/api-server/src/lib/registry.ts (moonshot lane, model kimi-k2.6) + https://huggingface.co/moonshotai/Kimi-K2.6


modified-mit is its own license, not MIT

The card's machine tag is license:other with license_name modified-mit. SZL records that verbatim and treats it as a distinct set of terms that must be read before any use beyond study — collapsing 'modified MIT' into 'MIT' in a registry would be a small fabrication of exactly the kind the ingest iron rules exist to prevent. Study is unrestricted; anything more waits on the actual license text.

Applies to: honesty-doctrine.

Evidence: https://huggingface.co/moonshotai/Kimi-K2.6 (card metadata: license_name modified-mit)


Alloy's deepseek-chat alias tracks this family with zero code change — and that cuts both ways

The deepseek lane pins the provider's deepseek-chat serving alias, so if the lane is ever keyed, requests route to whatever DeepSeek currently serves under that name — presumably V4-era today, but 'presumably' is exactly the word the honesty doctrine bans. The run receipt therefore reports the SERVED model verbatim from the provider response and Alloy never captions the lane as 'DeepSeek V4': an alias pin buys currency at the price of not knowing the model until the response arrives, and the UI must keep saying so.

Applies to: frontier.

Evidence: artifacts/api-server/src/lib/registry.ts (deepseek lane, model deepseek-chat) + https://huggingface.co/deepseek-ai/DeepSeek-V4-Flash


80.6% SWE-bench Verified stays DeepSeek's number

V4-Pro's headline coding-agent score is reported by DeepSeek on their harness configuration; V4-Flash's 'most of the capability at pareto-frontier price' framing is reviewer prose. SZL restates neither as fact — Alloy has run no SWE-bench, and the Proving Ground scores no quality by design. The MIT license on both cards is the one claim SZL verified directly (card tags, 2026-07-14).

Applies to: honesty-doctrine.

Evidence: https://huggingface.co/deepseek-ai/DeepSeek-V4-Pro (card)


Native image+video understanding at open weights — a lane Alloy's backbone does not have

M3's card pipeline tag is image-text-to-text and its positioning is native multimodality (screenshots, UI states, diagrams, video) at open weights. Alloy's backbone is text-only end to end — no provider lane, receipt schema, or cost table models image inputs. Wave-14 records this as a DECLARED capability gap with a named exemplar, not a roadmap promise: if agent-vision ever matters to SZL verticals, this is the open-weights lane the study points at first.

Applies to: frontier.

Evidence: https://huggingface.co/MiniMaxAI/MiniMax-M3 (pipeline tag image-text-to-text)


A community license is not an open-source license until the text says so

license:other + license_name minimax-community + a LICENSE file link is everything the card machine-declares. SZL records exactly that and nothing more — no 'effectively Apache' paraphrase, no adoption on vibes. The SPLADE precedent from wave-13 (CC BY-NC-SA, study-only forever) is the standing example of why the license text, not the license vibe, gates every next step.

Applies to: honesty-doctrine.

Evidence: https://huggingface.co/MiniMaxAI/MiniMax-M3 (card metadata: license_name minimax-community, license_link LICENSE)


Apache-2.0 at 675B — permissive frontier licensing is a pattern now, not an outlier

Together with GLM-5.2's MIT, a second pole of the wave-14 landscape is a frontier-scale MoE under a standard permissive license from a European lab. The DECLARED observation SZL takes is about the FIELD: permissive licensing at frontier scale recurred within a year across two continents, which materially widens what a sovereign-minded holding can legally study, fine-tune from, or serve — someday, on hardware SZL does not have. No Alloy surface changes because of this entry.

Applies to: frontier.

Evidence: https://huggingface.co/mistralai/Mistral-Large-3-675B-Instruct-2512 (card license tag)


Studying a model is not wiring a provider lane

Alloy has no mistral provider today, and this entry does not imply one: adding a lane is a deliberate registry + cost-table + policy decision, made when there is a reason, not because a card was ingested. The ingest iron rule 'convergence ≠ adoption' has a provider-shaped corollary recorded here: presence in the study registry NEVER leaks into ProviderFleet, which renders only what registry.ts actually declares.

Applies to: honesty-doctrine.

Evidence: artifacts/api-server/src/lib/registry.ts (no mistral lane declared)


Alloy's qwen-plus pin is Alibaba's HOSTED alias — a different artifact from these open weights

The qwen lane pins qwen-plus, a DashScope-hosted serving alias whose underlying model Alibaba chooses and may change; this card is the OPEN-WEIGHTS Qwen3 flagship, a related but distinct artifact. Wave-14 records the split loudly because it is easy to blur: if the lane is ever keyed, Alloy serves whatever the hosted alias routes (reported verbatim per response), while the Apache-2.0 weights studied here are something SZL could in principle self-host — 22B active is the one geometry in this wave within eventual reach of the KTransformers offload thesis on owned metal. That remains ROADMAP, unmeasured, like everything unmeasured.

Applies to: frontier.

Evidence: artifacts/api-server/src/lib/registry.ts (qwen lane, model qwen-plus) + https://huggingface.co/Qwen/Qwen3-235B-A22B


The 269-formula corpus and every SZL surface are untouched by this wave

Six frontier cards entered the study registry; zero SZL claims changed. Nothing here trains, evaluates, or upgrades anything — the forge family keeps its receipt-gated floors, the Lean locked-proven count stays 8, Λ stays Conjecture-1, and the formula corpus stays 269. Recording that explicitly is the wave's own fourth-wall discipline: an ingest wave that quietly inflated an SZL surface would be the exact failure mode the registry exists to make impossible.

Applies to: honesty-doctrine.

Evidence: artifacts/api-server/src/data/ingestRegistry.ts (this entry; registry is DECLARED study, never SZL fact)


Ouroboros invariants — doctrine

Runtime self-consistency invariants — MEASURED, recomputed per request over the enumerated ledger window. These are DISTINCT from the Lean proof corpus (see the Lean proof ledger): none of them prove or upgrade Λ, which stays Conjecture-1. The Ouroboros closes on its own tail — the receipt chain recomputes its own prior hashes, and the flywheel consumes only its own verified own-metal serves.

Every invariant shown is FALSIFIABLE: it can be VIOLATED by real ledger corruption, receipt tamper, or a write-path regression. A check that cannot fail would be verification theater and is deliberately excluded. Ledger-shape checks catch corruption or a write-path regression, not runtime correctness. Count is enumerated rows only, never a claimed total.


Receipt chain recomputes over its own tail (Ouroboros closure)

The literal Ouroboros: the receipt chain closes on its own tail. Every ledger row that carries a stored hash must recompute exactly — its rowHash from its own content hash chained to the previous row's hash, and its prevHash must equal the next-older row's rowHash. The chain is recomputed per request, never trusted from a cached verdict. A row that fails to recompute means ledger corruption or tamper; rows that predate the hash chain are stated as such and are never counted as failures.

Falsifiable predicate: for every ledger row with a stored hash: rowHash === sha256(prevHash | contentHash), and each row's prevHash === the next-older row's rowHash

Doctrine: notarized receipt chain — tamper-evident, recomputed per request

This chunk is the DECLARED definition of a runtime invariant; its live status is MEASURED per request at /api/invariants and is never stored in this corpus.


Failed runs claim no serving provider or latency

Honest failure shape: a run that failed must not claim any part of a successful serve. A failed ledger row carrying a serving provider or a latency figure would be a fabricated serve — the exact kind of invented value the honesty doctrine forbids. This check audits ledger shape: it catches corruption or a write-path regression, not runtime correctness.

Falsifiable predicate: for every row where ok = false: servedProvider IS NULL and latencyMs IS NULL

Doctrine: honest failure — a failed run never fabricates a serve

This chunk is the DECLARED definition of a runtime invariant; its live status is MEASURED per request at /api/invariants and is never stored in this corpus.


Live-served runs name the model that served them

Provenance floor: every live (non-demo) successful run must name the model that actually served it. A live serve with no recorded model is a provenance gap — the ledger would be claiming a real serve while hiding what produced it. Demo runs are excluded because they are honestly labeled as demo, not as serves.

Falsifiable predicate: for every row where ok = true and demo = false: model IS NOT NULL

Doctrine: provenance — a real serve always records its model

This chunk is the DECLARED definition of a runtime invariant; its live status is MEASURED per request at /api/invariants and is never stored in this corpus.


Receipt columns are all-present or all-absent

Signing is atomic: a ledger row is either fully signed (receiptId, signature, keyId, and the receipt payload all present) or honestly unsigned (all absent). A partial receipt column set is unrepresentable in a correct write path, so any half-signed row indicates a write-path regression or tamper. Unsigned rows are an honest state, never a violation.

Falsifiable predicate: for every row: (receiptId, signature, keyId, receiptJson) are ALL present or ALL absent

Doctrine: no partial receipts — a row is signed or honestly unsigned, never half

This chunk is the DECLARED definition of a runtime invariant; its live status is MEASURED per request at /api/invariants and is never stored in this corpus.


Every live-served run took at least one loop step

The bounded agent loop leaves a floor: any run that really served took at least one loop step, so a live-served row recording zero steps contradicts its own serve. Only the lower bound is asserted — the per-run upper bound is targets.length, which is not persisted in the ledger, and asserting an invented ceiling would itself be a doctrine violation.

Falsifiable predicate: for every row where ok = true and demo = false: loopSteps >= 1 (lower bound only — the per-run upper bound targets.length is not persisted, so it is not asserted)

Doctrine: LOOP_DOCTRINE — bounded, terminating, receipt-closed

This chunk is the DECLARED definition of a runtime invariant; its live status is MEASURED per request at /api/invariants and is never stored in this corpus.


Each signed receipt verifies under ed25519

Every signed receipt must verify under ed25519 against the exact sha256 canonical bytes it was signed over — plaintext never enters a receipt, so the signature binds hashes, not prose. A hard verification failure means tamper or canonical drift. Rows signed under a rotated key are reported as KEY_ROTATED — an honest state, never a tamper verdict — and when no signing key is configured the check reports UNAVAILABLE rather than guessing.

Falsifiable predicate: for every signed row: ed25519_verify(receiptJson, signature) === true under the current key

Doctrine: notarized receipts — signature checks the exact canonical bytes

This chunk is the DECLARED definition of a runtime invariant; its live status is MEASURED per request at /api/invariants and is never stored in this corpus.


Receipt payload matches its indexed columns

The signed canonical payload and the ledger's indexed columns are two records of the same facts, and they must agree exactly: receiptId, goalSha256, outputSha256, and keyId parsed from the stored receipt must equal the row's own columns. Any disagreement is canonical/column drift or tamper — one of the two records is lying about the run.

Falsifiable predicate: for every row with a stored receipt: parse(receiptJson).{receiptId, goalSha256, outputSha256, keyId} === the row's indexed columns

Doctrine: canonical/column consistency — the signed payload and the columns cannot disagree

This chunk is the DECLARED definition of a runtime invariant; its live status is MEASURED per request at /api/invariants and is never stored in this corpus.


Flywheel eats only its own verified tail (own-metal, never demo/cloud)

Sovereign flywheel lineage: the training loop consumes ONLY its own verified own-metal tail. Every training sample that carries a receiptId must join back to a real ledger run that was not a demo and was served by a named sovereign node. A sample tracing to a demo, cloud, or missing run violates the lineage claim — the flywheel would be eating something other than its own verified serves. Samples with no receiptId to join are excluded and stated, never silently counted.

Falsifiable predicate: every training sample with a receiptId joins to a runs row with demo = false and servedNode IS NOT NULL

Doctrine: sovereign flywheel lineage — samples come only from real own-metal serves

This chunk is the DECLARED definition of a runtime invariant; its live status is MEASURED per request at /api/invariants and is never stored in this corpus.


Conjecture Factory batch is internally consistent (counts, totals, accept provenance)

Self-audit of the committed Conjecture Factory batch artifact: the transcribed kernelAccepted count must equal the enumerated KERNEL_ACCEPTED rows, the per-family and per-generator totals must each sum to batchTarget (the factory's own candidate count — NOT the 269-formula corpus), and every accepted row must carry its leanSha256 provenance. This audits ARTIFACT INTEGRITY — transcription drift or a bad hand-edit — never the mathematics: a kernel accept is pipeline evidence only, it does not expand locked-proven (stays exactly 8) and does not upgrade Conjecture-1/2.

Falsifiable predicate: over the committed factory batch: counts.kernelAccepted === |{results: verdict = KERNEL_ACCEPTED}|; Σ byFamily.total === Σ byGenerator.total === batchTarget; every KERNEL_ACCEPTED result has a non-null leanSha256

Doctrine: artifact integrity — audits the batch transcription, NOT the mathematics; an accept never expands locked-proven (stays 8) and never upgrades Λ

This chunk is the DECLARED definition of a runtime invariant; its live status is MEASURED per request at /api/invariants and is never stored in this corpus.


Latent-space verification coverage (ANALOGY, not an invariant)

MEASURED coverage — fraction of the enumerated ledger window whose trust is established purely in hash/signature space (ed25519 over sha256 canonical bytes, never plaintext). ANALOGY to the JEPA latent-space objective (verify over a compact derived space, not the raw object); the mechanism is a cryptographic digest + signature, NOT a learned embedding — nothing here is trained or predictive, and this does not prove or upgrade Λ. tamperFailed lowers the ratio; rotated (signed under a rotated key) and unsigned (rows predating signing) are honest complements, never failures.