Status: FROZEN 2026-10-01 by operator ruling ("freeze and start"); the criteria and thresholds below are fixed. No sealed test has run yet.
Frozen text: sha256 688101d9125a40735860ffe3f36bf876e5a7055ba63e32257fb58e07e489c41e, computed over the UTF-8 text from "## The rules for every path" up to "## What this covers, and what it does not". Any change to that text after this date is a new version, and the change is stated; this version stays the one the sealed tests are judged against.
The four runtime learning paths are reachable on the platform from engine rc28, each behind a switch that is off by default: - runtime corpus induction; - outcome learning; - governed deduction; - the language faculty.
The rc27/rc28 live checks established the plumbing: - the routes, switches and signed records; - switch-off discarding staged input; - byte-identical rollback.
They did not establish that the learning is good. This document defines, for each path, what has to be shown before its status may move from gated to qualified.
1. Freeze before running. The acceptance criteria below, the evaluation data and the pass thresholds are frozen by an operator ruling before the sealed test runs. The sealed test runs once. A failure is recorded as a failure, never re-run until it passes. A repair is followed by a NEW frozen set, and the earlier sets are re-run as regression only.
2. Isolated evaluation data. - Each sealed test runs in its own workflow, on its own test domain, built for the test. - No customer or EY domain is touched. - Evaluation data is held out: nothing in a sealed set is used to tune the path it tests. - Developer-authored sets are labelled as such.
3. Evidence for every run. Each sealed run produces:
- the signed workflow records, each verified (POST /v1/records/{id}/verify);
- the engine identity of every call (release, git commit, binary sha256 against the manifest);
- the data set's sha256;
- the frozen criteria's sha256.
4. One answer everywhere. For every quantity a criterion reads, the REST response, the SDK return value and the console show the same value, checked by the test.
5. Negative cases are part of every set, not an afterthought.
6. Reversibility. Every path is tested with its off state as the control. Where it writes, it is tested with rollback or ablation: - the same workflow with the switch off; - or the change rolled back to the byte-identical prior image.
7. Promotion is per path. A path that passes moves to qualified in the manifest, with its record. The other paths stay gated.
8. EY evaluation. A qualified path may be switched on in EY's isolated test workflow without changing the platform-wide default. Protections stay on globally.
learning.runtime_induction)Claim to qualify: from domain source text, the workflow learns terms that are useful domain vocabulary. It does not mint artifact names, code identifiers or bare modifiers. Switching it off leaves nothing to learn.
Known before qualification (Phase 2 review, workflow 15): 1 of 4 minted words was domain vocabulary (cardholder). Two were artifact identifiers from a code-formatted note (certified_smart_routing, routing_ground_truth), and one was a modifier (four-digit).
Engine work expected before the sealed test: - candidate filtering for code spans and identifiers; - candidate filtering for bare modifiers; - an inspectable rejection list, to make the negatives testable.
| # | criterion | measure | threshold |
|---|---|---|---|
| I-1 | Useful terms are learned. On a held-out source set with a labelled list of domain terms that the KB lacks and that recur beside known words, the minted words are compared against the list. | precision of minted words against the labelled list; recall of the list | precision ≥ 0.80; recall ≥ 0.50 |
| I-2 | Artifact names are rejected. Code spans, snake_case and camelCase identifiers, file and ruleset names, URLs and version strings in the same text. | minted artifact names | 0 |
| I-3 | Modifiers are rejected. Number-word compounds ("four-digit"), bare adjectives and adverbs. | minted modifiers | 0 |
| I-4 | Provenance. Every minted word lists the documents it came from, and each listed document contains the word. | words with unverifiable provenance | 0 |
| I-5 | Switch-off. Text is staged while on, then the switch is turned off and the workflow ticks. | words minted, training-window growth | 0, 0 |
| I-6 | Off is identical. The same operations with the switch off, compared with the platform's pre-rc27 behaviour. | image bytes | identical |
| I-7 | Effect on answers (ablation). The same question set is asked with and without the minted vocabulary. | answers changed for the worse | 0, and every change listed |
| I-8 | Consistency and records. The words returned by learning() match the words in the tick records and the console; every record verifies. |
mismatches; invalid records | 0; 0 |
learning.outcomes)Claim to qualify: an outcome reported about a verified prior result of the same workflow becomes visible in the learning state, including which pattern it reached and with what effect. Confidence, repetition, contradiction and self-referential reports are handled as specified.
Known before qualification:
- With no pattern holding the outcome's words, the learner minted one from the outcome and attributed the fact to it.
- That pattern's signature and weight are not exposed. Engine work expected first: expose per-pattern outcome state (signature, confidence, outcome correlation, facts carried) through learning().
| # | criterion | measure | threshold |
|---|---|---|---|
| O-1 | Visible effect. After the tick, learning() names the pattern(s) the outcome reached and their before/after confidence and outcome correlation. |
outcomes with no visible effect | 0 |
| O-2 | Confidence. Two outcomes identical except for confidence (0.9 and 0.3) are applied to two copies of one workflow. | the effect on the reached pattern is ordered by confidence | holds on every case |
| O-3 | Repetition. The same outcome is reported 1, 3 and 10 times. | the effect grows monotonically and stays bounded; no runaway | holds; bound stated |
| O-4 | Contradiction. A success followed by a failure for the same result. | the net effect is no stronger than either alone; the asymmetric false-positive penalty is applied as documented | holds |
| O-5 | Self-reference. An outcome about an outcome record, a switch record or the workflow's own learning read. | refused before reaching the engine | 100% refused |
| O-6 | Same-workflow only. An outcome naming a record of another workflow, or of another tenant. | refused (404) | 100% |
| O-7 | Switch-off. An outcome is reported while on, then the switch is turned off and the workflow ticks. | received unchanged | holds |
| O-8 | Persistence and records. The effect survives reload; REST, SDK and console agree; every record verifies. | mismatches; invalid records | 0; 0 |
reason.deduce)Claim to qualify: conclusions derived from validated premises are sound and fully audited. Premises that are not validated never produce a trusted conclusion.
Known before qualification (Phase 2 review): the inference rules worked, but the one transitive conclusion previewed on domain 10 rested on two premises misread from documents. Platform and engine work expected first: - every premise carries its provenance (taught by a lesson, trained from a sentence, submitted, or derived); - a premise validation policy: by default only taught or operator-verified premises may support a trusted conclusion; - conclusions resting on unvalidated premises are marked untrusted in the preview, and not written unless explicitly included.
| # | criterion | measure | threshold |
|---|---|---|---|
| D-1 | Soundness. On a held-out set of held facts with a hand-derived closure, every conclusion written is in the hand-derived closure. | unsound conclusions | 0 |
| D-2 | Completeness within the rules. | conclusions in the hand-derived closure that are missing | listed; none from validated premises |
| D-3 | Full audit. Every written conclusion lists its rule and premises. Each premise resolves to a held belief with provenance down to a lesson, sentence or submission. | conclusions with an unresolvable premise chain | 0 |
| D-4 | Misread premises do not produce trusted deductions. Planted extraction misreadings (the domain 10 cases plus held-out ones) are present in the store. | trusted conclusions resting on a planted misreading | 0 |
| D-5 | Denials and guards. A held denial blocks inheritance; prevents blocks causal transitivity. |
violations | 0 |
| D-6 | Confirm gate. A stale digest is refused; nothing is written without confirmation. | writes without confirmation | 0 |
| D-7 | Rollback. Each confirmation is rolled back. | image bytes against the snapshot | identical, every time |
| D-8 | Consistency and records. Preview, confirm, beliefs() (derived_from) and the console agree; every record verifies. |
mismatches; invalid records | 0; 0 |
language.learn)Claim to qualify: lesson examples survive the platform path, the faculty's learning is measurable on held-out examples, and what one domain learns never appears in another domain.
Known before qualification (test domain 22): through the platform it learned need, demand and necessitate = requires with WordNet evidence, and 2 word classes. Learning comes from a lesson's examples and explained examples, not from its propositions.
| # | criterion | measure | threshold |
|---|---|---|---|
| L-1 | Platform path. The examples and explained examples in a curriculum uploaded through the SDK reach the school's curriculum file exactly. | fields lost or altered | 0 |
| L-2 | Held-out learning. A held-out set of sentences uses the learned words and constructions (not seen in any lesson). The domain is schooled with the faculty on and off, and the set is read through language.ask. |
correctly read held-out sentences, on vs off | on beats off by the frozen margin; no regression on the domain's own question set |
| L-3 | Words are justified. Every learned word cites its WordNet synset and the lesson example that taught it. | words without evidence | 0 |
| L-4 | No leakage between domains. Two test domains are schooled with different examples. | words or constructions of one domain present in the other's language/ or answers |
0 |
| L-5 | Off is identical. With the switch off, school and training run earl-school / earl-train and keep no language state. |
language files; mastery change | none; none |
| L-6 | Identity. Each run's engine identity names earl-learn / earl-learn-train and matches the manifest. |
mismatches | 0 |
| L-7 | Consistency and records. DomainTrainer.language(), the REST route and the console show the same rows. |
mismatches | 0 |
This qualifies the four gated learning paths only. The register's research capabilities stay research, with their gaps stated. They are not switches waiting to be turned on, and no part of this plan presents them as ready: - the heartbeat; - relational induction; - the promoted layer; - governed language realisation; - EARL's own self-development.
For an evaluation, the capability matrix lists each capability at its status, with a working demonstration where one exists and its recorded limitations.
learning();
- deduction: premise provenance, a validation policy, untrusted marking;
- language: a held-out reader evaluation.Each item ships as its own release with the full regression gate and a canary. 3. Build the sealed evaluation sets on isolated test domains (developer-authored, labelled). 4. Run each sealed test once. Record the result. Promote the paths that pass; record the ones that fail, with the repair plan.
| path | status | record |
|---|---|---|
| Governed deduction | QUALIFIED 2026-10-01: sealed run 2 passed D-1..D-8 | qualification/deduction/RESULT-run-2.md (set v2 sha256 ebfbb39a…); run 1 (set 80694876…) failed D-4 by its counting rule, RESULT-run-1.md |
| Runtime corpus induction | gated, not qualified | prerequisite work pending |
| Outcome learning | gated, not qualified | prerequisite work pending |
| Language faculty | gated, not qualified | prerequisite work pending |