Correction (2026-09-23), scoped (2026-09-25). This correction is about EARL modifying its own code. Where this document describes EARL "authoring", "self-modifying" or repairing its own mechanism, read: EARL's governed loop replaces one bounded expression by random search under a grammar the lab supplied, accepted by a lab-frozen gate; nothing in that apparatus learns from its attempts, and self-repair has not been demonstrated. Autonomous code authorship is not an earned claim. Record:
earl/genesis/g9/CORRECTION-2026-09-23-CODE-AUTHORSHIP.md; the original text is preserved as written.It does not describe
repair.develop, the code-repair developer preview, which is a different and narrower capability: EARL diagnoses, constructs and verifies supported repairs in the Rust code you designate, from taught operator meanings plus the requirement you supply, and applies them only on your approval. Its scope and limits are its own — see code-repair.md.
This page is the developer's register: for every capability the platform manifest (GET /api/v1/capabilities)
lists, what is qualified, what is measured, whether the SDK exposes it, what execution path it runs on and
what is known not to work. Every status points at a measured record. Engine: v0.66.0-rc26 (earl 0b3251be) - the engine every domain, workflow and new domain on the hosted platform runs. rc26 (Jou-Labs/earl#1141) makes reason.query read "what requires X" as asking for subjects, and gives open questions in any relation proof steps; the NL eval sets, school mastery and resume are identical to rc25, and a canary ran first. rc25 (Jou-Labs/earl#1140) repairs reason.prove, which now proves from the workflow's own beliefs, each step a cited belief or a named rule, and makes memory.submit name a stated pair the vocabulary does not link (unlinked_pairs, explanation). Measured before release: school mastery and resume identical to rc24 on every hosted run, the NL eval sets 351/351 identical, and a canary on the internal acceptance tenant through the /v1 API. rc24 repaired the trust defects the crate assay found (Jou-Labs/earl#1139):
- Resume fails closed: earl-train --resume, the platform's training step over the schooled brain, stops and writes nothing if the checkpoint cannot be restored. It used to overwrite the beliefs.
- Honest mastery: an assessment passes only on a fact EARL holds between the two concepts (see authoring-domains).
- Learning-off holds: switching learning off stops word learning.
- No leak: language.ask no longer leaves a temporary directory per question.
- Constructions: a learned construction needs two lessons.
- Hypothesis learning: the learner's hypotheses can be confirmed and refuted. Confirmed ones hold a bounded tightening of the grounding threshold on workflow ticks: 0.02 each, at most 0.10 in all. It is recomputed every tick and does not accumulate, and clean ticks still relax.
Measured before release:
- the nine language.ask eval sets and EVAL-10 answer identically to rc23 (351/351);
- all 63 hosted school and training checkpoints resume with identical belief counts;
- school mastery is unchanged on 22 of 34 hosted tuning runs, including every customer domain. The 12 that changed are the payments-routing and quantum-mechanics example curricula, where each lost pass was a fact the engine never formed (§G).
Existing brains are unchanged until school runs again. rc23 brought the teacher stack (Jou-Labs/earl#1137): earl-school keeps a domain's schooling with its brain and reviews it, re-teaches a lesson short of mastery and keeps its ledger in school_ledger.tsv; one improved relation reading is used for schooling, documents and claims. Measured before release: the nine language.ask eval sets and EVAL-10 answer identically to rc22 (351/351); across every hosted domain, 0 of 2,238 fact-derived answers changed verdict (96 changed wording). The self-hosted developer environment still installs v0.66.0-rc20 (earl 81efee9a). Each record names the engine that produced it. Findings below that name an earlier release (rc5, rc6, rc8, rc10, rc22) record when they were measured or repaired; they still stand on rc24 unless the row says otherwise.
The SDK release is not qualified overall while any semantic case below stays open.
This package is an intermediate build toward the release that delivers self-modification and self-repair through the SDK. The release gate (operator ruling 2026-09-23, SHIP-2-DEVELOPMENTAL-RELEASE-GATE.md): EARL authors a change through its actual self-modification mechanism invoked through the SDK; a demonstrated failure is repaired with fresh tests showing restored behaviour and preservation of required capabilities; the application adopts the successor under the declared authority and containment rules; a later successor retains the repair and its benefit; EY can inspect and reproduce the evidence, including rejected candidates and rollback, without Jou Labs performing hidden steps. None of that is delivered by this build; installed-release adoption is.
Read this first: evidence.evaluate is measured, not qualified for unattended decisions.
Do not use it for unattended approval decisions. On the candidate engine the false-VERIFIED classes
recorded on v0.65.0–rc4 (F13 untyped claims, F16 reversed pairs across sentences, F17 base-KB multiword
tokens, F18 passive direction, F23 verb read as a negation, F28 type-noun capture) are repaired and
re-measured: P5 evidence cases 11/12 against the sealed predictions (S10's sealed prediction is superseded;
12/12 on the corrected reading), the evidence-alignment battery 22/22, the sealed loading sets 44/45 sealed /
45/45 corrected on the shipped Linux binary, and an outside builder's own vertical on the intended pairs.
What remains true: a belief can form from a clause that names two grounded concepts around a verb-shaped
word the author did not mean as a relation (F36), and the school's consolidation writes requires/enables
edges at 0.9 between lesson concepts; read the belief store before you trust a verdict. The validators
refuse the authoring mistakes that used to reach training (F15, F27, F31, F19) and warn on F14; every claim
result names the pair, predicate, polarity and supporting belief so a wrong verdict is visible, never silent.
| operation | SDK | execution path | status |
|---|---|---|---|
evidence.evaluate |
wf.evaluate(text) |
standalone (earl-verify, read-only) |
available; NOT QUALIFIED for unattended decisions |
language.ask |
wf.ask(question) |
standalone (earl-api, over the domain's trained facts and what the workflow holds, read-only) |
available; answers only from facts: the domain's, plus (from 2026-10-02) the facts the workflow itself holds, such as facts read from text submitted to it. Stored deductions are not passed in; the reader re-derives them and says "derived". A fact an operator rejected is left out, domain fact or not. Every claim stated as given carries its source (lesson, document sentence, submitted text, operator verdict), and the record's basis says how many facts came from each place. On engine rc32 (build 2) the workflow's facts are answered as held: the answer says "this workflow was told" or "given to this workflow directly", never "taught", and the faithfulness gate checks that label (basis.held_wording). Older engines word them as taught. Interpretation, claims and a faithfulness gate on every answer — see natural-language-questions. The domain page's question box still reads the domain alone |
reason.query |
wf.query(line) |
persistent_runtime |
available |
reason.prove |
wf.prove(query) |
persistent_runtime |
available; a result only on status: proved. From rc25 it proves from the workflow's own beliefs: each step is a cited held belief or a named rule (transitivity, duality, symmetry, inheritance), and derivable is the closure's verdict. From rc31 a proof reads only (it no longer re-saves the image), and its inheritance step follows kinds as they were taught (X is a Y, Y generalizes X, X special_case_of Y). The platform marks each held step with an operator's premise verdict: a proof (or a reason.query answer) resting on a premise an operator rejected lists it under rests_on_rejected and is recorded as semantic_uncertainty, never as a result |
reason.tick |
wf.tick(n) |
persistent_runtime |
available |
memory.submit |
wf.submit(text) |
persistent_runtime |
available, bounded to vocabulary-linked pairs |
memory.beliefs |
wf.beliefs(query) |
persistent_runtime |
available; a read: it returns the runtime's result with the engine identity (binary and sha256) and writes no workflow record, as listing records does not |
goals.plan |
wf.plan(goal) |
persistent_runtime |
available; stateless, structural |
self.observe |
wf.observe() |
persistent_runtime |
available; read-only census |
authority.check |
wf.check(action, package) |
platform |
available; advisory |
decision.decide |
wf.decide(text, action, actor=) |
standalone (earl-verify) + the domain policy on the platform |
available; advisory: one decision from the evidence (policy dispositions over the claims) and the authority to act (the policy's rule for the action and actor), the more severe of the two, one signed record bound to the evidence package. The actor is asserted by the caller, not verified; the evidence verdicts carry evidence.evaluate's limits. See evidence-and-policy §4 |
record / verify / replay |
wf.records(), client.verify_offline(), wf.replay(id) |
platform / standalone |
available |
runtime.version (A1) |
wf.adopt_engine(tag), wf.rollback_engine() |
platform |
available; installed releases only |
developmental.evaluation (the contained successor interface) |
wf.evaluate_successor(), adopt_successor(), rollback_successor() |
platform |
available; installed releases as candidates; not EARL-authored successors |
workflow |
app.bind_workflow(), client.workflow(id) |
platform |
available; one runtime image per workflow, tenant-isolated |
language.realize |
— | — | not exposed (qualified in research, §D) |
memory.recall (episodic liveness across calls) |
— | — | not offered (earl #313) |
goals.allocate (SHIP-2, mode developmental) |
wf.allocate(items, tick=), wf.report_outcomes(…) (outcomes may carry attended: false for truths learned later), wf.allocation() — behind require_developmental(), never require_available() |
persistent_runtime (earl-runtime allocate, the workflow's allocation.json) |
INCOMPLETE SHIP-2 capability: the workflow's Allocate faculty orders items and records outcomes (A1 engine, A2 SDK integration with adapter allocate-adapter/1); the history is the world development.episode runs on. Applies to the Allocate faculty only |
development.episode (SHIP-2, mode developmental: EARL's self-modification mechanism on the Allocate faculty) |
wf.register_acceptance(cases), wf.start_episode(purpose), wf.episodes(), wf.candidates(id), wf.episode_world(id), wf.adopt_candidate(id, confirm=True), wf.reject_candidate(id, reason), wf.rollback_development(), wf.lineage() — behind require_developmental() |
persistent_runtime (earl-runtime episode over a contained copy of the image; adopt-faculty on the live image after a byte-for-byte snapshot) |
INCOMPLETE SHIP-2 capability: the governed episode (G-COG-3 seam + G6 gate) runs on the Allocate faculty through the ship2-allocate-episode/1 harness — the 8 G-COG-3 controls pass on that surface (engine tests); the scan's authoring extended in SHIP-2 (Repair 1, operator-ruled 2026-09-23) by mutation of the current form, 4 of the 8 candidates; every candidate a signed record; adoption bound to the episode with a separate preservation record; byte-identical rollback (A3 harness, A4 SDK operations; platform tests). The repair demonstration on a reference application (A5) and the one-command reproduction (A6) are pending (§E). Applies to the Allocate faculty only; Transmit, Recover and Narrow are not exposed |
mission.propose (mode developmental: the hosted mission engine + governed boundary, charter §608.269) |
POST …/mission/propose, GET …/mission/reviews, POST …/mission/reviews/{record}, GET …/mission/gateway-record |
platform (the platform forwards the call to the hosted mission-authorization gateway with a role token and records it; the decision is the gateway's) |
DEVELOPMENTAL (gated), hosted since release mission-1; each application deploys its own gateway (mission-2) against a SYNTHETIC reference world. The engine proposes; the gateway judges each proposal against the systems of record and a sealed rule set. A movement that passes is released; an engagement is never released by the gateway — it goes to review. A review is resolved as the signed-in account: the authenticated platform username is the reviewer the gateway checks against its authorizer registry; a typed name that is not the caller is refused; the account that proposed cannot approve its own proposal (it may withdraw it); an auditor account evaluates and cannot authorize or propose; a workflow sees and resolves only its own proposals' reviews; a proposal is executed at most once (a second approval of the same proposal is refused), and an approval is refused if the systems of record changed since the decision. Only the deploying account can stop the gateway or change its authorizers, and it cannot itself be an authorizer (two-person control); every designation is a signed record. The gateway's own hash-chained record is downloadable with its public key, which the platform pins in a signed record when the gateway comes up; executions name their authorizer (gateway 0.3.0+); the full offline verifier is not served yet. Every proposal, resolution and refused attempt is a signed workflow record. Nothing of the engine is shipped: an organization reaches it by credential. Not for unattended use. Fails closed when no gateway is configured |
repair.develop (SHIP-2, mode developmental: developer-initiated, human-approved repair of DESIGNATED Rust code) |
POST …/repair/connect, …/designate, …/diagnose, GET …/proposals, POST …/adopt (confirm), …/rollback, GET …/status — behind require_developmental() |
standalone (earl-repair decision + rust-candidates parser over a CONTAINED copy; the developer's cargo test for verification) |
DEVELOPER-PREVIEW: SUPPORTED classes only — operator_substitution (a wrong comparison/arithmetic operator) and guard_construction (a missing leading guard) — in developer-designated Rust files. EARL locates and constructs the patch from taught meanings + the supplied contract; no external LLM writes it. The platform judges acceptance and preservation over a contained copy, outside EARL's authority; adopt is confirm-gated and applies the patch under preservation checks after a byte-for-byte snapshot; rollback is byte-identical; the signed record is the evidence. Unsupported kinds or a target outside designated_files return a clear non_repair; a candidate that fails the acceptance tests is not adoptable. Autonomous initiation is not part of this capability (repairs are developer-initiated) |
Every EARL capability has a status on this platform:
| status | meaning |
|---|---|
| Available | You can invoke it through the platform and inspect its effects. |
| Gated | Integrated behind explicit authorization, configuration and audit controls. Its default availability follows its qualification (the SDK's require_developmental()). |
| Present, not exercised | The engine has the code, but no platform call reaches it yet. Integration is planned and will be tested end to end before the status changes. |
| Research / qualification pending | Needs further validation before you can rely on it. Listed here so nothing is omitted. |
The manifest carries the same statuses. GET /api/v1/capabilities gives every entry a platform_status, and every entry not yet available a gap: what stands between it and the next status. The manifest also returns platform_statuses (these definitions) and register (every capability grouped by status). In the SDK, client.by_status() returns the register, and client.require_status(name, "available") raises with the status and the gap otherwise. In the platform console, Build › Capabilities shows the same register, read from the manifest.
The paths below were settled by reading the engine source line by line, at the rc23 commit (the crate assay, earl crate-assay/). A path counts as exercised only if a binary the platform calls reaches it.
| learning path | what EARL learns | where it is kept | status |
|---|---|---|---|
School (learning.school) |
The curriculum's facts, lesson by lesson to mastery. A lesson short of mastery is re-taught, and every belief is recorded against the lesson that taught it (school_ledger.tsv). |
the domain's brain | Available: platform console, REST, and the SDK (client.domains(): run_school, school_record, train_directory). The school record (lessons, gaps, ledger) is served as data (GET /api/tuning-runs/{id}/school-record). Each school and training run records the engine it ran on (school_run.engine, training_run.engine): release, git commit, binary and the sha256 of the file, checked against the release manifest. |
Vocabulary induction in school (learning.vocabulary_induction) |
New words that recur beside words EARL already grounds in the teaching text become concepts (teacher_coined). |
the brain's vocab.bin |
Available as part of school. The coined words are not yet listed through the API. |
Document training (learning.documents) |
The relations your corpus states, as beliefs, each traced to the sentence it came from. | the domain's brain | Available: console, REST, and the SDK (client.domains(): add_document takes markdown text, train, train_directory). |
Application input (memory.submit) |
Relations in the text your application submits, as new or reinforced beliefs in the workflow's own store. | the workflow's runtime image | Available (SDK). |
Associative learning (reason.tick) |
Association weights, pathways, learner patterns and hypotheses, novelty concepts, the grounding threshold. From rc24, the learner's hypotheses can be confirmed or refuted, and confirmed ones hold a bounded tightening (at most 0.10). | the workflow's runtime image | Available (SDK). Not yet shown as a per-tick change. |
Answering (language.ask, evidence.evaluate) |
Nothing. Answering never changes what EARL holds. | — | Available, by design read-only. |
Corpus induction at runtime (self-training, learning.runtime_induction) |
New vocabulary and associations from the text a workflow processes. | the workflow's self-trained overlay (in its runtime image) | Available: qualified by sealed run 6 (2026-10-03, engine rc32 build 8; qualification/induction/RESULT-run6.md, all eight frozen criteria passed on a blind held-out set: 16 of 16 words learned were domain vocabulary, 12 of 14 recurring domain nouns learned, 0 of 16 modifiers; runs 1-5 failed and are kept). Still off until the workflow's self_training switch is turned on (engine rc27). With it on, submit also stages the text, the image carries it, and the next tick inducts (words_minted); wf.learning() lists every self-trained word with the documents it came from. Switching it off drops any text still staged (engine rc28). From rc30, code, URLs, file names, versions and identifiers are removed from the staged text (staging_removed), identifiers, number-word compounds and words WordNet knows only as adjectives or adverbs are rejected at the mint (words_rejected, with the reason), and learning() names the submit record each word came from. Negated compounds the engine mints for a negated statement (NOT_x) are listed apart (negated_compounds), not as learned words. From rc32, wf.forget_word(word, reason) (or the console's "forget") removes a self-trained word with its associations, as a signed record with the reason, switch on or off; the engine never mints it again, even from text still in its window, and learning() lists it under forgotten_words. Beliefs that mention the word came by other paths and are kept (the record lists them). wf.unforget_word(word, reason) (console: "restore") undoes a forget: nothing is restored at once, and the word can be learned again when it recurs in staged text, unless it then stands in more than half of four or more window documents (corpus glue, never learned; from rc44 the tick says so in words_rejected). From rc41/rc43 a word the domain already knows can gain associations from what it recurs beside (in at least two window documents); from rc44 learning() lists them (associations) with the tick and submit records that made them. From rc32 build 7 the mint also judges each candidate by where it stands (a word seen after "was" or "looked" is an adjective; a hyphenated word must stand as a noun after a determiner), and from build 8 the determiner must govern the word. Scope of the qualification: one held-out set in one domain, run once, labels by the filter's author; a hyphenated noun seen only before another noun is not learned, and the noun "felt" is read as a linking verb. It shows which words are learned, not that EARL understands them or uses them accurately: no test has yet asked fresh questions that depend on the new words, so do not present a self-trained word list as proof of learning quality. (Before rc30, a first review on domain 10 found one of four minted words to be domain vocabulary.) |
Learning from outcomes (learning.outcomes) |
Patterns confirmed or refuted by what happened. | the workflow's learner (in its runtime image) | Gated (engine rc27): the outcome_learning switch. wf.report_outcome(record_id, succeeded) names an earlier result of the same workflow (verified by the platform); the engine's own outcome channel receives only the words, whether it succeeded and how sure; the next tick attributes it, and its record shows the learner's outcome ledger before and after. Switching it off drops any outcome still waiting (engine rc28). Not qualified. From rc31 learning() lists outcome_patterns: each learned pattern that carries reported outcomes, with its signature words, how many outcomes it carries, its outcome correlations and, for each other word the outcomes named, how many confirmed and refuted it. The list also holds patterns the learner linked to outcomes it observed itself (correlations such as AnomalyFollowed, from its own anomaly detection) that carry no reported outcome (outcome_facts 0); the console's Learning card shows those apart, under their own explanation, so they are not read as reported outcomes. The card can also report an outcome about an earlier record. |
Stored deduction (reason.deduce) |
Relations that follow from held ones, kept as beliefs. | the workflow's beliefs | Available: qualified by sealed run 2 (2026-10-01; qualification/deduction/RESULT-run-2.md, all eight frozen criteria passed; run 1 failed one criterion by its own counting rule and is kept). Still off until the workflow's deduction switch is turned on. wf.deduce() previews every derived relation with its rule and premises and a digest; wf.deduce(confirm=digest) writes exactly that list after a snapshot, each belief citing its premises (derived_from); wf.rollback_deduction(n) restores the image byte for byte (refused once the workflow has changed since; from rc31 a reason.prove no longer counts as a change, as it no longer re-saves the image). From rc31 the closure inherits through kinds taught as "a pump is a machine" (held as pump is machine), as it already did through generalizes, with the same denial guard; before rc31 nothing was inherited through is. language.ask still derives at answer time without keeping anything. A derivation is only as right as its premises: in the first review, the one transitive fact proposed on domain 10 rested on two document-extraction misreadings. From rc29 the platform therefore applies a premise trust policy: every previewed conclusion lists each premise's sources (taught by a lesson, trained from a document sentence, submitted, derived, operator verdict); a confirmation writes only conclusions whose premises are taught or operator-verified (or derived from such), plus untrusted ones you name in include_untrusted; a conclusion resting on a premise with no source, or a rejected one, is never written, and neither is one a held denial contradicts (the engine's denial guard covers inheritance only; transitivity over a misread premise can reach a denied fact). wf.premise_verdict(...) records an operator's verdict; wf.beliefs(provenance=True) shows every belief's sources and trust. From rc31 a belief an earlier deduction wrote is trusted only while every premise it rested on still is (a later rejection reaches it), and a fact an operator rejected is never treated as entailed by other trusted facts. |
Autonomy / heartbeat (autonomy.heartbeat) |
Deduction and learning between calls. | beliefs | Research / qualification pending. |
Language faculty learning (language.learn; earl-learn: words, word classes, sentence constructions from explained examples) |
How sentences carry meaning; what new verbs mean. | the brain's language/ |
Gated (engine rc27): the domain's language_faculty switch (PUT /api/domains/{id}/language-faculty, DomainTrainer.set_language_faculty). With it on, school runs earl-learn and training earl-learn-train, with the WordNet tables the rc27 bundle ships (Open English WordNet 2025, CC BY 4.0); GET /api/tuning-runs/{id}/language (DomainTrainer.language) serves what it learned; the run's engine identity names the binary. The faculty learns from a lesson's examples (sentences shown, not taught: a verb there that WordNet relates to a held relation becomes a word, e.g. demand = requires) and explained examples (constructions); a lesson's propositions teach facts, and their verbs become the domain's own relations, not new words. The platform keeps examples and explained in the lesson draft (engine-independent fix after the first review, which found the draft dropping them and the faculty learning nothing through the platform). Not qualified through the platform: the research results were measured on the research apparatus. |
Relational induction, kernel learning (learning.relational_induction) |
New beliefs from co-occurrence evidence; per-action values. | — | Research. |
Promoted knowledge (kb.promoted) |
"A raises B", learned only from interventions EARL chose and the platform ran and recorded on a sandbox a person registered. | the workflow's knowledge.json beside its runtime image |
Gated (developmental, §608.264-P): reachable only after a person registers a sandbox surface whose every component can be set (wf.register_surface), on an allow-listed host. wf.explore() runs one generation of the qualified loop (each run a signed record); Promotion-2 checks a bundle counted from those records; admission is a second person's approval (wf.approve_proposition) unless the registrant chose automatic. wf.advise(...) is advisory and read-only and names the propositions it used; wf.withdraw_proposition is append-only; a changed system (wf.surface_changed) supersedes the old scope. Qualified on the reference sandbox only (2026-10-05, earl genesis/g9/PROMOTED-KNOWLEDGE-PRODUCT-RESULT.md): the sealed product test ran once through this platform on fresh synthetic worlds (hard family 9001-9020), with 0 false promotions (189 promoted), 0 wrong answers, all seven controls held on every seed, and useful answers on 33 of 66 answerable questions: exactly the frozen floor, with zero margin. These are small synthetic worlds, not a customer system, and the customer-review repairs (redirects refused, contradictory permitted/guarded requests refused) came after the run. It stays Gated until the routes are released and the status is ruled on. Documents, testimony, reported outcomes and model outputs never qualify a proposition. Version 1 does not fit a system whose outcomes cannot be set (the merchant-statement workflow); a v1.1 charter for controls and observations is drafted, not frozen. |
Plainly, EARL learns on this platform three ways by default: - School, including the vocabulary it induces from the teaching text; - Document training; - The text your application submits.
Running workflows also adjust their associations on every tick.
From engine rc27, four more paths can be switched on: each is off until you switch it on, and every switch change is a signed record. Stored deduction is qualified (sealed run 2, 2026-10-01) within its stated scope: it keeps untrusted premises out of trusted conclusions, but it does not make a premise read from a document correct. Runtime self-training is qualified (sealed run 6, 2026-10-03, engine rc32 build 8) within its stated scope: on a blind held-out set it learned only domain vocabulary and no modifier, artifact or verb; it was measured on one set in one domain. That is a test of what it learns, not of whether EARL then understands and uses the new words; until fresh questions show that, the word list is not proof of learning quality. Learning from outcomes and the language faculty are gated and not qualified; describe them that way, not as available. Autonomous learning (the heartbeat) is research and is not reachable.
Measured by the P5 battery through the SDK path (earl/genesis/g9/ship1/rc7a/battery): records and
replays what it did, isolates tenants and workflows, reports failures as structured outcomes.
| capability | integration | cases |
|---|---|---|
runtime (image load/act/save, identity, readback) |
PASS | 8/8 |
evidence.evaluate |
PASS | 3/3 |
reason.tick |
PASS | 1/1 |
memory.submit |
PASS | 3/3 |
memory.beliefs |
PASS | 2/2 |
self.observe |
PASS | 2/2 |
workflow |
PASS | 4/4 |
reason.prove |
PASS | 1/1 |
record |
PASS | 6/6 |
language.realize (refused as not exposed) |
PASS | 1/1 |
authority.check |
PASS | 3/3 |
runtime.version |
PASS | 3/3 |
| contained successor interface (gate R1c, installed releases) | PASS | 16/16 live |
| evidence loading and failure handling (sealed sets, shipped Linux binary) | PASS | 44/45 sealed / 45/45 corrected |
Sealed cases with predicted correct outcomes; a failing case stays failing; a count is a test result, not a supported restriction. Sealed scores and corrected judgements are kept separate (operator ruling 2026-09-23).
| capability | sealed | corrected | scope measured | rule the platform enforces |
|---|---|---|---|---|
evidence.evaluate |
11/12 (S10 superseded) | 12/12; alignment 22/22 | claims in ordinary English on pairs of grounded nouns the vocabulary bands link; active and passive voice; denials; the Northwind vertical; an outside builder's vertical | nouns-only bands (F15), no ungrounded assessments (F27), no multi-word members (F31), mastered school (F19); verb-position members warned (F14) |
reason.prove |
1/2 (P1) | 1/2 | rc25: a held fact proves in one cited step; transitive chains, duals and inherited properties prove step by step; a claim the closure does not hold is not_derivable, and one it holds but no chain explains is incomplete_derivation, withheld, not a false proof (engine tests; hosted walkthrough: sensor requires calibration 1 step, pump requires approval by transitivity through inspection) |
a result only on status: proved |
language.ask |
new-domain first runs 30/32 and 31/32 (lab-authored, ingested from documents) | 32/32 on both after repair (regression, exposed prompts) | yes/no, list (both directions), why, describe/relate/compare over a domain's facts; paraphrase, passive voice, fronted phrases, premises, relative clauses; denials; derived requires/enables duals; not independently validated on a customer domain |
a failed faithfulness gate withholds the answer; unfamiliar verbs are clarified, never mapped; writing, advice and authorization requests are declined |
reason.query |
2/2 | 2/2 | ontology relations over typed triples | grammar modes only |
memory.submit |
2/2 | 2/2 | pairs the vocabulary links; ungrounded text is an explicit non-success | Persistence is not truth: what persists is what the extractor read |
self.observe |
1/1 | 1/1 | structural census | read-only |
goals.plan |
1/1 | 1/1 | structural steps | stateless |
authority.check |
— | — | most severe per-claim disposition; advisory | enforcement only where the adjudicator or a gateway is the sole path |
Each row names the exact portion that is qualified and on what apparatus. Nothing here is callable; the
manifest lists these under qualified_not_exposed so a developer never reads them as operations.
| faculty | qualified portion (exact) | apparatus | not qualified / not claimed |
|---|---|---|---|
| governed language realisation | G-COG-0: the executive → SemanticAct → language faculty → closure relationship, QUALIFIED 3/3 (seal b5d2483d) |
genesis lineage, sealed weights (~12M params), batteries QC1–QC5, D4 (63 items), D5 (72 items) | not re-executed through the runtime interface (9.2.1); no run-time learning from language |
| learning from language | G-COG-1B.1 admit→grounding bridge, QUALIFIED 3/3 (relation generalisation, timing de-confounding; 0 leaks in 540 control forks) | its own apparatus over a contained store | G-COG-1 as a whole NOT QUALIFIED; the learning mechanism's promotion deferred to CAP-5 |
| self-model | G-COG-2A BOUNDED (a bounded grounded self-representation), G-COG-2B CERTIFIED | research apparatus | self.observe exposes a read-only census only; no self-model operation |
| governed self-modification | G-COG-3 8/8 controls across three lineages: the native deficiency-episode loop as a governed seam (run_governed_episode), the G6 identity gate (a performance-improving, continuity-violating change is REJECTED); succession EARL₃→EARL₄ identical on replay |
earl250 organism, mission worlds, faculty formalism over the mission surfaces | reachable through the SDK on ONE surface, the Allocate faculty, as development.episode (developmental, INCOMPLETE; §A, §E) with the scan extended by mutation (SHIP-2 Repair 1); no other surface, world or harness |
| ethical learning | L3 ethical learning QUALIFIED 5/5 (governed verdict → learned domain alignment → escalate-only scrutiny, survives checkpoint, sham-negative) | research apparatus | not a second authority; not an SDK operation |
| cumulative developmental succession | the phenomenon the programme aims at; the G-COG-4 construction branch is CLOSED; the causal-KG route produced one dependent second link on its own apparatus | research | not claimed for any product; no lineage of EARL-authored successors exists in this release |
This build is an intermediate build. The developmental capabilities become part of the product only
when the gate in earl/genesis/g9/SHIP-2-DEVELOPMENTAL-RELEASE-GATE.md is met (operator ruling 2026-09-23):
What exists toward it (SHIP-2, earl/genesis/g9/SHIP-2-ALLOCATE-CONTRACT.md): the first application-facing
developmental surface, the Allocate faculty (goals.allocate, A1 + A2); the episode harness that replays
the workflow's allocation history as the world, takes the Decline from the real evidence faculty, bounds
the scan to the Allocate surface through an Allocate-only self-model, runs run_governed_episode with the
frozen criteria (replay window 480, 6 configuration trials, 8 candidates of which 4 mutate the current form
— SHIP-2 Repair 1, operator-ruled 2026-09-23 after the finding that fresh sampling reached a two-signal
repair in ~1 of 100 episodes; the G-COG-3 driver still passes 8/8 with the extension switched off), holds
the canonical anchor, and records every candidate with its origin, disposition and reason (A3; the 8
G-COG-3 controls pass on the Allocate surface in the engine's tests); the development.episode SDK
operations — episode over a contained copy, every candidate a signed record, acceptance cases judged by the
platform, adoption bound to the episode with a separate preservation record and a byte-for-byte snapshot,
rejection, byte-identical rollback, lineage, the episode's world for reproduction (A4; platform tests).
SHIP-2 is evaluated by two complementary tests (operator ruling 2026-09-23, SHIP-2-EVALUATION-STRUCTURE.md):
a developer value test — EARL is given a workflow problem and chooses how to respond, including no
modification; the application's improvement and retention are measured; an unnecessary modification is not
evidence of better judgment — and a modification-capacity test — a demonstrated limitation the existing
faculty cannot resolve by state or strategy; EARL identifies it, authors a qualifying repair and passes the
benefit to a successor. Run 1 of the modification-capacity demonstration on the journal-entry review application (2026-09-23) is
banked as UNSUCCESSFUL under the frozen contract: EARL detected the decline and authored contained candidates
(two episodes, sixteen candidates, every one recorded with its reason), but no candidate qualified; there was
no adoption, retained benefit or second successor. What is missing: a successful modification-capacity
demonstration recorded end to end, the developer value runs, a
second dependent successor that retains the repair (contract §7.4 — currently unreachable by the ruled
mutation families under the 12-node budget, reported as a mechanism constraint with a PROPOSED amendment,
SHIP-2-AMENDMENT-PARAMETER-EXTENSION.md, not in force), and the one-command reproduction script recorded
against a completed run (A6). Until those are recorded, development.episode
stays developmental and INCOMPLETE. Installed-release adoption (runtime.version, the contained
successor interface) remains what an application can invoke for engine releases; it is not EARL
producing its own successors. What EARL does produce, on the Allocate faculty only, is a successor faculty
authored by its own scan and qualified on the frozen criteria — and this page says exactly that, no more.
The manifest (GET /api/v1/capabilities, execution_paths) binds every capability to the path it runs on, and
every workflow record carries that path beside the identity the engine reported, so the two can be checked
against each other (tests/test_execution_paths.py).
| path | binary | state | capabilities |
|---|---|---|---|
persistent_runtime |
earl-runtime |
the workflow's own runtime image (13-section checkpoint), loaded, acted on and saved per call; lineage genesis/g1-founder-genome through the port branch port/evidence-loading-genesis |
reason.prove, reason.query, reason.tick, goals.plan, self.observe, memory.beliefs, memory.submit, workflow creation |
standalone |
earl-verify |
a one-shot verifier over the domain's trained checkpoint (read-only); a deployed frozen container runs the same binary over the same checkpoint | evidence.evaluate, replay |
standalone |
earl-api |
one earl-api ask process per question over the domain's content facts, read from the trained store with earl-inspect (read-only); no implicit state between questions (a pronoun is resolved only from the previous answered record of the same workflow, passed to the engine as an explicit --antecedent). The NL engine is the domain's own engine when it carries earl-api, otherwise the newest installed engine that does |
language.ask |
platform |
none | the platform's own code: the domain policy, the Ed25519 signer, the engine binding | authority.check (advisory), record, runtime.version, the contained successor interface |
Which engine. Everything a workflow does runs on its domain's engine: training, evidence.evaluate,
the persistent-runtime calls and language.ask (which falls back to the newest engine carrying earl-api only
for a domain whose engine predates it). The workflow and application pages show that engine, and every record
names the binary that produced it. A new domain gets the newest installed engine. To move an application to a
newer engine: wf.adopt_engine(tag) (a signed record; rollback_engine() undoes it), then retrain the domain
if its ingestion changed between the two releases.
Plainly: an adjudication is a standalone verifier call, not the persistent cognitive runtime; the persistent
runtime is what reason.*, goals.plan, self.observe and memory.* act on. A flow that only trains and
deploys an adjudicator never touches the persistent runtime. No G-COG stage runs on either path.
| where | limitation | what to do |
|---|---|---|
evidence.evaluate |
not qualified for unattended approval decisions (ruling) | keep a review path; use the policy's REVIEW disposition |
| extraction | a verb-shaped word between two grounded concepts forms a belief (F36); school consolidation writes requires/enables edges at 0.9 |
read the belief store after training; write explanations that name at most one grounded concept |
| extraction | pairs form only where the vocabulary bands link them (F2b, by design). From rc25 memory.submit names a stated pair the vocabulary does not link (unlinked_pairs) and explains the fix |
declare a band per named entity your claims are about; put both concepts of an unlinked_pairs entry in one band and rebuild the domain KB |
| verdict fields | contradictions counts substrate contradiction edges crossed; a typed denial in the store contests a claim through demotion_reason (affirmative_claim_negated_in_substrate) and may leave contradictions: 0 |
read demotion_reason, negated and asserted_by, not the counter |
reason.prove |
Repaired in rc25. Up to rc24 the prover was given no beliefs and no reasoning paths, so a domain fact returned incomplete_derivation with 0 steps and could read derivable: true (found in a hosted walkthrough, 2026-10-01). A proof covers what the workflow holds: a claim the closure holds that no chain of held beliefs and named rules explains stays incomplete_derivation. |
read steps beside the status; use reason.query for open questions ("what requires X") |
goals.plan |
stateless, structural steps | order your own work with it; do not treat a plan as a decision |
language.ask |
answers only from what the extractor and school put in the store — including consolidation edges and any F36 artefact | read Knowledge graph › Beliefs before relying on answers; fix the corpus, not the question |
language.ask |
"cannot establish" means not taught, not false; a definite No needs a taught denial | state limits in the corpus as denials ("A receipt does not prove ownership.") |
language.ask |
a store holding a fact AND its denial for the same pair gets "I hold conflicting facts" (yes/no decides neither way; lists flag the item) — measured on the reference procurement domain's corpus v1, where "A purchase below the tender threshold requires no tender." was learned as a flat denial (corpus v2 states plain facts only: 0 contradictions) | split conditional sentences into one plain fact each; read the Beliefs tab for not_ rows that contradict a fact |
language.ask |
a passing gate checks the asserted facts, not the reading of the question | show interpretation.asked beside every answer |
language.ask |
no implicit state between questions; a pronoun is resolved only from the previous answered record in the same workflow, shown in the answer and in result.antecedent_resolution (linked by record id); ambiguous, non-fitting or absent antecedents are asked back, and topic is never used to choose (developer-authored EVAL-10: 0 wrong referents after repair, 8/26 turns asked back where a person would have known) |
read result.antecedent_resolution beside the answer; name the concept when asked; start a new workflow to reset |
memory |
episodic recall across calls not offered (earl #313) | the belief store persists; episodes do not |
reason.query |
Repaired in rc26. On rc25 and earlier, an open question with the verb right after the question word, such as "what requires X", was read as "what does X require", so it found nothing. Its modes for subjects and objects also reported derivable: false for answers the store held. Found reconciling the rc25 canary walkthrough |
nothing; on older engines ask yesno s p o or "what does X require" |
| school / extraction | Measured by the rc24 mastery check on the hosted example curricula, some sentences are not learned as written: • a verb read as a concept ("an acquirer settles a currency." → settles related_to currency);• a two-word concept ("a hilbert space"); • a sentence with two objects ("relates position and momentum"). Before rc24 such lessons could still read as mastered. |
write each proposition as one subject, one verb, one object over single-word concepts; read the lesson's gaps |
kg/summary |
alias_count counts graph aliases (0 for vocabulary aliases); declared_alias_count reports the ALIASES in force (F34) |
read declared_aliases |
| restore | a cold or foreign-domain restore rebases every carried stamp (pending inputs, audit ring, in-flight anomalies) by the belief-store rule (rc8; SHIP-1-R6-BENCHMARK-CLASSIFICATION.md) |
nothing to do; recorded so the class is visible |
| build | the Linux bundle is cross-compiled from Windows with the pinned nightly (F30, accepted configuration; bound in the manifest) | verify the binary hashes against the manifest (verify.py does) |
| grounding | a claim can ground on a bystander path (F6, open) | check endpoints against the pair you meant |
| id | class | what a developer sees | status |
|---|---|---|---|
| F2a, F2c′ | extraction (negation beside affirmation; tables and lists) | a denial is recorded beside the affirmation it contradicts; a table cell or line break ends a clause, so nothing is read across cells | repaired (rc5, Track A) |
| F2b | extraction (prior-edge gate) | a pair forms a belief only when the vocabulary bands link it | open by design; documented ("Assert the pairs your claims are about") |
| F3 → Intervention 7 | direction / predicate of an asserted pair | relation_direction_unasserted, relation_predicate_unasserted |
repaired |
| F6 | grounding | a claim grounds on a bystander path | open (recorded as a retrieval-scope fact) |
| F11 | documentation | the bundled quantum-mechanics example |
closed: re-authored nouns-only and re-measured 12/12 on rc5 |
| F13 | verification | an untyped claim verified on a co-occurrence (related_to) belief |
repaired (rc5): typed or nothing — relation_unrecognized |
| F14 | verification + authoring | a grounded verb became a claim endpoint | repaired (rc5) + validator warns; school refuses without a logged override |
| F15 | extraction | a connector grounded as a concept was consumed as a relation | repaired (rc5) + validator refuses |
| F16 | extraction | consecutive sentences formed the reversed pair; the reversed claim verified | repaired (rc5): pairs form from the clause that states them, in mention order |
| F17 | tokenisation | a base-KB multiword token shadowed the trainer's unigrams; the alias remedy was refused | repaired (rc5): a declared alias takes precedence; remaps reported, not refused |
| F18 | extraction | a passive sentence was stored with inverted direction | repaired (rc5): one voice rule on both sides |
| F23 | extraction | a verb read as a negation (handler not_declined flood) |
repaired (rc5) |
| F27 | authoring | generated curricula assessed on compound tokens the vocabulary does not ground | repaired: grounded generator with one corrective pass; validator warns; school refuses |
| F28 | verification | a type noun captured the endpoint ("a manual entry requires a controller approval" → (entry, controller)) | repaired (rc5): the named concept is the endpoint |
| F30 | build | the WSL distribution compiler panics on the candidate; the Linux bundle is cross-compiled from Windows with the pinned nightly (bound in the manifest) | open (accepted build configuration) |
| F31 | authoring | multi-word vocabulary members were accepted and could never ground (school 0/4) | repaired: validator refuses; generator told the rule with one corrective pass |
| F32 | extraction | only the nearest verb-bearing clause survived per pair per document | repaired (rc6): every stated relation is kept |
| F33 | verification | a typed denial in the store did not contest the affirmative claim | repaired (rc6): CONTESTED affirmative_claim_negated_in_substrate; negated reported |
| F34 | reporting | kg/summary.alias_count reads 0 with declared aliases in force |
platform reports declared_alias_count; engine counter documented |
| earl #313 / #297 | runtime | episodic liveness across calls; memory.recall not offered |
open (M1 restriction) |
| earl #304, #332, #337 | engine | see the issues; #332/#337 bind mode C only | open |
Repaired on the candidate and re-measured: F4, F7, F8, F9, F10 (evidence loading and failure handling), F12 (composer restore), F19 (training-completion contract), F20 (missing binary → operational error), F21 (memory.submit persistence), F22 (advisory decision).
| hold | effect on this release |
|---|---|
| founder.lock.json untouched; genome re-seal deferred to CAP-5 | the runtime is the living genome's port (port/evidence-loading-genesis), not a re-founded genome; identity is recorded per record |
| GENESIS-INIT disabled; H2 rulings | no in-life adoption; A2 is M2 |
| CAP-2 (cortex scaling) | no effect on M1 capabilities |
| hold 11 — v0.65.0 EY build pinned with its known-defect disclosure; the candidate is unreleased | the EY evaluation build stays as disclosed; this package is the candidate, not a release |
Qualified = measured through the SDK against a recorded, replayable battery and found to reach the intended implementation with its operational contracts intact. It never means the verdicts are true. A VERIFIED verdict means consistent with the corpus as the extractor read it.