Intent
Build the online promotion ladder system specified in kb/plans/016-online-promotion-ladder.md: a typed substrate + shadow-pair counterfactual harness + verifier-gated promotion ladder, replacing the offline R-vs-C bake-off framing of plans 014/015 with an online, verifier-scored, counterfactual-paired lifecycle.
Scope (this issue)
Plan 016 phases P1-P3 plus the generalisation demo, mechanics-proven with a deterministic scripted driver over real fixture datasets (two tenants). The P4 question (does any agent-authored procedure promote under live traffic) is explicitly out of scope and reported as open.
Deliverables:
src/ladder/ system: typed answer contracts, snapshot mount + drift fingerprints, deterministic replay executor (bin/ladder-replay with --self-test --double-run and --ablate-promoted), shadow-pair episode harness, ladder state machine (quarantine/shadow/candidate/promoted/deprecated) with pre-registered sequential boundary and drift demotion.- Negative-control fixtures (shallow, degenerate, stale-clone forced-drift) wired permanently.
- Two-tenant demo producing the full artifact contract at a committed evidence path, showing per-tenant learning (divergent promoted sets, inline-rederivation falling with usage) and system learning (cross-tenant seed suggestion entering tenant-2 quarantine, aggregate distillation curves).
./verify/ladder.sh <evidence-dir> GREEN on all checks, re-runnable by any reviewer from committed state.
Acceptance
The grounded verifier verify/ladder.sh (checksum-pinned, born-red at plan creation) is the acceptance gate; its checks map 1:1 to the defeaters in plan 016 §2, each a regression against a failure this repo has shipped before (M1 circular seed, armL empty-gold, 0/22 inert gate, M1c thin shim).
Honesty constraints (bind the PR)
- All demo artifacts labeled
driver: scripted; the claim is "ladder mechanics work end to end", never "helpers beat inline for a frontier model" (that live question stays open, see plan 016 P4).
- Dark-store numbers cited only with the empty-gold caveat.
Intent
Build the online promotion ladder system specified in
kb/plans/016-online-promotion-ladder.md: a typed substrate + shadow-pair counterfactual harness + verifier-gated promotion ladder, replacing the offline R-vs-C bake-off framing of plans 014/015 with an online, verifier-scored, counterfactual-paired lifecycle.Scope (this issue)
Plan 016 phases P1-P3 plus the generalisation demo, mechanics-proven with a deterministic scripted driver over real fixture datasets (two tenants). The P4 question (does any agent-authored procedure promote under live traffic) is explicitly out of scope and reported as open.
Deliverables:
src/ladder/system: typed answer contracts, snapshot mount + drift fingerprints, deterministic replay executor (bin/ladder-replaywith--self-test --double-runand--ablate-promoted), shadow-pair episode harness, ladder state machine (quarantine/shadow/candidate/promoted/deprecated) with pre-registered sequential boundary and drift demotion../verify/ladder.sh <evidence-dir>GREEN on all checks, re-runnable by any reviewer from committed state.Acceptance
The grounded verifier
verify/ladder.sh(checksum-pinned, born-red at plan creation) is the acceptance gate; its checks map 1:1 to the defeaters in plan 016 §2, each a regression against a failure this repo has shipped before (M1 circular seed, armL empty-gold, 0/22 inert gate, M1c thin shim).Honesty constraints (bind the PR)
driver: scripted; the claim is "ladder mechanics work end to end", never "helpers beat inline for a frontier model" (that live question stays open, see plan 016 P4).