04 Solution Strategy

Solution Strategy

This chapter records the load-bearing strategic decisions that shape Prism’s architecture. Each decision is summarized here and elaborated either in the Architecture Decisions chapter (section 9) or in subsequent chapters that depend on it. The decisions below are not exhaustive; only those that shape Prism’s structure — its decomposition, its enforcement model, and its substitution surface — appear here.

Strategic Decisions

Decision	Rationale	Where elaborated
Decompose Prism into three crates: uor-foundation, prism, prism-verify.	The three concerns are: (a) UOR vocabulary — substrate, type-declaration vocabulary, the four UOR-domain sealed types, wire-format type definitions, mint primitives; (b) Prism runtime — pipeline, the three Prism-mechanism sealed types, operation-declaration vocabulary, standard type library; (c) replay surface — a thin façade re-exporting the relevant subset for verification consumers. The concerns have distinct consumers, distinct change cadences, and distinct conformance properties. Combining any two would conflate substrate vocabulary with runtime mechanism, or runtime mechanism with verification surface, and force users of any single concern to depend on the others.	ADR-005 (section 9); section 5.1.
Enforce architectural correctness through the Rust type system at compile time, not through runtime checks.	Constraint TC-01 requires zero-cost runtime; constraint TC-02 requires sealing of certified types; constraint TC-04 requires UORassembly bilateral compile-time enforcement. A runtime-check architecture would violate all three. The Rust type system, with sealed traits, sealed structs, and trait-bound resolution, provides the mechanical means to satisfy these constraints without a runtime layer.	ADR-006 (section 9); section 5.1.
Make the UORassembly contract bilateral.	The contract MUST hold across the boundary between uor-foundation and prism (so that the foundation cannot drift from what prism requires) and across the boundary between prism and the application author’s crate (so that author code that violates the contract cannot reach an executable). Unilateral enforcement (prism-checks-author only) would admit foundation drift; unilateral enforcement (foundation-checks-author only) would admit prism drift. Bilateral enforcement is the only configuration that prevents both.	ADR-006 (section 9); section 5.1; section 8 (UORassembly contract definition).
Allocate the three substitution axes (HostTypes, HostBounds, and the third position generalized to AxisTuple per ADR-030 — originally Hasher, now a tuple of axis trait selections including the prism-crypto-declared HashAxis per ADR-031) across the crates such that uor-foundation defines the trait, prism declares the bound the trait must satisfy, and the application author’s crate selects the implementation.	The three-position allocation makes each axis substitutable without compromising any of the architectural constraints. The foundation’s trait definition gives the bound a precise contract; prism's bound declaration is what uor-foundation MUST satisfy and what the author’s crate MUST select against; the author’s selection is the only point where the variation actually occurs. No axis is fixed at any other position.	ADR-007 (section 9); section 5.1; section 8 (substitution axes).
Commit the architecture to three layers of algebraic closure: substrate (foundation primitives + substrate operator set), prism (operator set on routes over substrate-closed shapes), and implementation (verb sets composed from prism operators applied to substrate primitives). Each layer’s closure is parametric in the substitution axes; the operator sets at substrate and prism are normatively specified; implementation verb sets are pattern-specified.	The framework is parametric in the substitution axes by ADR-007’s three-position pattern; without an explicit closure framing, the operator sets that compose foundation primitives into routes and routes into verbs are unspecified. Substrate closure (ADR-013) addresses one of the three layers; ADR-024, ADR-025, and ADR-026 together address all three. The three-layer closure is what makes the framework parametric in scale: nothing is hardcoded at a specific catalog enumeration, a specific Witt-level ceiling, or a specific verb count, and the closure procedures are theorems whose conformance is checked at each implementation’s compile time.	ADR-024, ADR-025, ADR-026 (section 9); section 8 (Closure Across Layers).
Commit the framework to a universal substrate-extension declaration mechanism via the axis! SDK macro: domain crates declare typed substrate-extension vocabularies (axes) carrying operations whose structural decomposition exceeds the substrate’s PrimitiveOp set; the framework’s substitution-axis triple’s third position generalizes from a single Hasher trait to a tuple of axis trait selections; foundation provides the meta-mechanism (AxisExtension, AxisTuple, Term::AxisInvocation, the catamorphism’s per-variant fold-rule), domain crates provide the specific axes. The prism crate is the standard library — a façade over uor-foundation plus standard-library Layer-3 sub-crates (prism-numerics, prism-crypto, prism-tensor, prism-fhe) carrying application-neutral vocabularies, published from the Prism repository. Third-party Layer-3 crates carry application-specific extensions including format-import tools and architecture-specific compositions. The architecture treats standard-library and third-party sub-crates identically — the distinction is operational, not architectural.	The framework’s universal-model-compiler scope (compile any structurally-deterministic computation as a typed-iso) requires the substrate-extension lane to admit any domain. Hardcoding axis families at the substrate level is non-parametric in the framework’s parametric-in-axes commitment; smuggling everything through the Hasher trait loses per-kernel type safety. The axis! meta-mechanism keeps foundation small, admits open-ended domain extension, and preserves the closure discipline at every layer. The standard-library sub-crate roster (numerics, crypto, tensor, fhe) commits the architecture to a category of foundation-maintained domain extensions for application-neutral domains while leaving format-specific and architecture-specific vocabularies to third-party Layer-3 crates that consume the standard-library vocabularies.	ADR-030, ADR-031 (section 9); section 8 (Closure Across Layers).
Complete the closure-body grammar’s coverage of structured-input destructuring (ADR-033 G20 — Term::ProjectField) and the SDK proc-macro’s compile-time domain-cardinality introspection (ADR-032 CYCLE_SIZE on ConstrainedTypeShape). The two commitments together let the SDK emit correct measure literals for first_admit's domain cardinality and let route bodies access components of product-shape inputs through the typed-iso surface. Combined with ADR-013/TR-08’s existing substrate-amendment rule (used for the byte-comparison and byte-packing PrimitiveOp extensions in foundation 0.3.5), the framework’s typed-iso surface admits the structural commitments end-to-end without implementation-runtime overrides for structural-correctness gaps.	The closure-body grammar’s prior scope (G1-G19) covers scalar inputs, prism operators, substitution-axis-realized verbs, and tuple-literal construction. Without G20 destructuring and CYCLE_SIZE introspection, route bodies whose Input has multiple semantically-distinct components must use opaque whole-input references (the implementation runtime carrying the destructuring), and first_admit's measure literal must be implementation-overridden rather than emitted correctly by the SDK. The PrimitiveOp catalog and reserved-identifier-set enumerations referenced explicit fixed lists; foundation’s substrate amendments (Le/Lt/Ge/Gt/Concat) had landed via TR-08 but the wiki’s enumeration was stale. ADR-032 + ADR-033 + the enumeration reconciliation close all five gaps so the typed-iso surface carries the structural commitments without runtime escape.	ADR-032, ADR-033 (section 9); ADR-022 D3 G3, ADR-026 G12, ADR-029 Term::Application (section 9, reconciled to snapshot-specific catalog references); section 8 (Closure Across Layers).
Complete the first_admit (ADR-026 G16) and fold_n (ADR-026 G14) operators' end-to-end evaluation through foundation’s catamorphism by committing to Term::FirstAdmit (a twelfth Term variant with structural short-circuit semantics) and to iteration-counter binding for Term::Recurse's fold-rule (via the foundation-fixed RECURSE_IDX_NAME_INDEX paralleling the existing RECURSE_PLACEHOLDER_NAME_INDEX). Both commitments together let foundation evaluate bounded search and bounded iteration without escape to the implementation runtime per ADR-026 G16’s three-way responsibility split — the implementation-runtime override remains available for strategy (parallel coset traversal, cancellation policy, cost-budget enforcement) but is no longer load-bearing for structural correctness.	The closure-body grammar’s prior commitments (G1-G20 per ADR-022 D3 + ADR-026 + ADR-033) admit search-with-iteration-index in surface form (ADR-026 G16’s `first_admit(,
Unify the closure-body grammar’s lowering substrate with the framework’s full ontology-defined ψ-chain (ψ_1..ψ_9 per spec/src/namespaces/op.rs and spec/src/namespaces/homology.rs) by introducing nine ψ-chain Term variants per ADR-035, committing the k-invariants branch (ψ_1 → ψ_7 → ψ_8 → ψ_9) as the canonical composition for the framework’s verifiability commitment, and committing the ψ-residuals discipline on verb-body composition (no Term::FirstAdmit, no Term::AxisInvocation, no byte-comparison or byte-concat PrimitiveOp emissions in verb-body terms). Couple with ADR-036’s ResolverTuple substrate parameter (R: ResolverTuple = NullResolverTuple) — the fourth model-declaration parameter alongside H: HostTypes, B: HostBounds, A: AxisTuple + Hasher — that threads application-provided resolver instances through the catamorphism’s evaluation environment for the eight resolver-bound ψ-Term variants. The compiled binary IS the canonical circuit; the data representation is minimal (input bytes + κ-label); the client (the prism model with its typed feature hierarchy, ψ-chain composition, resolvers, substrate) is conceptually larger than the data it operates on; a complete model fuses into a single reference — one verb-body term-arena evaluation producing one label that classifies an equivalence class of values sharing the same canonical structural witness.	The closure-body grammar’s prior commitments (G1-G20 per ADR-022 D3 + ADR-026 + ADR-033 + ADR-034) admitted only combinatorial Term variants. None of them is a ψ-map; the framework’s structural-witness arm (the ψ-chain) was inaccessible from prism vocabulary. Verb authors expressing per-value structural admission relationships had no path through the typed-iso surface; brute-force Term::FirstAdmit enumeration over runtime predicates was the only available shape. ADR-035 + ADR-036 close the gap end-to-end: ψ-Term variants give verb bodies access to the structural-witness arm; the canonical k-invariants branch is the maximum-discriminating composition (the κ-invariants classify the homotopy type up to weak equivalence per homology:KInvariant); the ψ-residuals discipline forces the compiled binary into the canonical form; the ResolverTuple carries the per-value content provision the ψ-chain consults.	ADR-035, ADR-036 (section 9); section 8 (Closure Across Layers).
Complete the path from typed-feature-hierarchy admission-relation declaration through the canonical k-invariants branch to the ontology’s three-primitive verdict surface, through three coupled amendments. ADR-037 completes ADR-018’s commitment that no capacity bound lives outside HostBounds for data-shape capacities: 14 free-standing data-shape capacity caps (TERM_VALUE_MAX_BYTES, AXIS_OUTPUT_BYTES_CEILING, FOLD_UNROLL_THRESHOLD, MAX_BETTI_DIMENSION, NERVE_CONSTRAINTS_CAP, NERVE_SITES_CAP, JACOBIAN_MAX_SITES, RECURSION_TRACE_MAX_DEPTH, MAX_OP_CHAIN_DEPTH, AFFINE_MAX_COEFFS, CONJUNCTION_MAX_TERMS, ROUTE_INPUT_BUFFER_BYTES, ROUTE_OUTPUT_BUFFER_BYTES, UNFOLD_MAX_ITERATIONS) plus the eight ψ-stage resolver output byte-buffer ceilings migrate to HostBounds associated constants; two type-system tuple-impl-table caps (MAX_AXIS_TUPLE_ARITY, MAX_RESOLVER_TUPLE_ARITY) stay foundation-vetted with explicit Rust-language carve-out and structural justification (MAX_RESOLVER_TUPLE_ARITY ≥ card(ResolverCategory), growing with future ADR-013/TR-08 amendments). ADR-038 + ADR-040 extend the substrate’s closed catalogs: the Observable taxonomy admits observable:AxisProjectionObservable (a top-level Observable subclass parallel to the seven internally-derived categories); the BoundShape catalogue carries 7 individuals with type:LessEqBound for integer-valued observables and type:LexicographicLessEqBound for byte-sequence-valued observables under canonical big-endian unsigned ordering; the ConstraintRef::Bound.args_repr: &'static str canonical-string-form carries normative encoding rules for AxisProjectionObservable arguments. ADR-039 commits the inhabitance verdict realization mapping: successful Grounded<Output> realizes cert:InhabitanceCertificate envelope (κ-label as homotopy-classification structural witness at ψ_9; cert:witness ValueTuple derivable from Term::Nerve's 0-simplices at ψ_1; cert:searchTrace as Grounded::derivation().replay()); Err(PipelineFailure) realizes cert:InhabitanceImpossibilityCertificate envelope (with proof:InhabitanceImpossibilityWitness as proof payload). ADR-039 also names the four-family resolver landscape (pipeline ψ-stage resolvers per ADR-036, bridge Observable-category resolvers, user-surface morphism resolvers, ontology resolver:Resolver hierarchy) as parallel resolution categories operating at different layers, not in a subclass relationship.	The framework’s parametric-in-scale commitment requires HostBounds to carry every data-shape capacity bound that varies along the principal data path (ADR-018); 14 foundation-fixed data-shape caps plus 8 ψ-stage resolver output ceilings collapse the substitution axis at those bounds. Type-system impl-table emission limits are structurally bound by Rust’s lack of variadic generics and require honest carve-out with structural justification rather than non-functional macro-emission stories. The canonical k-invariants branch produces a structural witness (κ-label at ψ_9) and concrete witnesses (0-simplices at ψ_1), but the closed catalog must express the application’s admission relation in catalog vocabulary so the witness is well-grounded; without AxisProjectionObservable, applications whose admission relations involve axis-realized projections have no closed-catalog representation. The verdict realization mapping connects the canonical k-invariants branch’s structural output to the ontology’s three-primitive verdict surface; without the mapping, applications consuming the framework as a verdict producer must re-derive the connection between Grounded<Output>/Err(PipelineFailure) and cert:InhabitanceCertificate/cert:InhabitanceImpossibilityCertificate per-application.	ADR-037, ADR-038, ADR-039 (section 9); ADR-018 Consequences (section 9, updated); section 8 (Closure Across Layers).
Commit the implementer-facing typed surface for the substrate-to-verdict path through three coupled amendments. ADR-040 commits a closed BoundShape catalogue of 7 individuals: LessEqBound for integer-valued observables and LexicographicLessEqBound for byte-sequence-valued observables under canonical big-endian unsigned ordering. ADR-041 commits typed-coordinate resolver carriers (#[repr(transparent)] newtype wrappers around byte slices: SimplicialComplexBytes<'a>, ChainComplexBytes<'a>, …, KInvariantsBytes<'a>) so ψ-stage outputs preserve type-system discrimination while threading zero-allocation through the catamorphism. ADR-042 commits the typed Rust surface for the inhabitance verdict envelope: foundation declares InhabitanceCertificate<'a, T> (zero-allocation view over &Grounded<T> exposing κ-label / cert:witness ValueTuple / cert:searchTrace / cert:certifiedType accessors) and InhabitanceImpossibilityCertificate<'a> (typed view over PipelineFailure exposing the proof:contradictionProof accessor), plus the inhabitance::dispatch_through_table helper for optional predicate:InhabitanceDispatchTable consultation.	The architecture commits three load-bearing properties for the substrate-to-verdict path: (1) catalog-level disambiguation of comparison semantics — distinct BoundShape primitives per totally-ordered value type, so the catalog declaration alone determines comparison semantics and resolvers do not dispatch on observable type; (2) type-system discrimination of ψ-stage outputs — typed carriers thread between ψ-stages with zero allocation and cross-stage composition mismatches surface as compile-time type errors; (3) foundation-provided verdict-envelope accessors — applications consume the catamorphism’s Result envelope as the ontology’s three-primitive verdict structure without reimplementing accessor logic.	ADR-040, ADR-041, ADR-042 (section 9); section 8 (Closure Across Layers).
Commit the Fold-Fusion Principle (ADR-054) as the architectural mechanism realizing zero-cost composition across all three layers of closure (ADR-024), and the universal substrate-Term verb body discipline (ADR-055) extending fusion through every axis surface. Every prism transformation — verb-body, prism_model! route, resolver body, every axis-impl body — is a folding operation; the catamorphism’s initial-algebra universal property (ADR-019) fuses composed fold-rules into one Rust routine per substitution-axis selection. Per ADR-055’s SubstrateTermBody sealed supertrait on AxisExtension, axis impls without a substrate-Term body clause fail to compile — fusion is type-system-enforced for every AxisExtension impl (standard-library AND application-author custom), with no carve-out. ADR-054 RA2’s standard-library-only scope is superseded; ADR-010’s arbitrary-Rust Hasher carve-out is amended. The catamorphism’s structural reach has no opaque axis-kernel boundary anywhere in any conforming implementation; operations that genuinely cannot be expressed in substrate Terms are not prism operations per ADR-019’s initial-algebra commitment and must be hosted at the host boundary outside the catamorphism’s reach. The three fusion layers (macro-expansion, catamorphism, monomorphization) and their full mechanics are specified normatively in ADR-054 (§9) and ADR-055 (§9).	The architecture commits the Fold-Fusion Principle as a normative architectural reading that closes the implicit gap between ADR-019’s universal-property uniqueness statement and the standard-library’s body-discipline realization. The principle is closed under composition: any expression in the prism vocabulary — verb-call, prism_model! body, verb-of-verbs, verb-composing-an-axis — compiles to a fused fold by structural induction over the Term language. The principle is the structural mechanism upholding the Conceptual Model’s C2 (zero runtime movement) commitment — "one Rust function per forward invocation" becomes structurally enforceable through three fusion layers, not aspirational. The canonical axis impl body discipline is the bridge from the substrate’s PrimitiveOp vocabulary to the published canonical axis surface: substrate-Term decomposition of the canonical impl bodies (Sha256Hasher as W32 {Add, Xor, And, Or, Bnot} plus rotate; PrimeFieldNumericSecp256k1 as W256 ring primitives plus mod-P reduction; CpuI8MatmulSquare as W8/W16/W32 primitives plus sign-extension; OneTimePadFhe as Xor composition) makes the standard library a substrate-Term realization at the byte-output-equivalence boundary, not an opaque library wall.	ADR-054, ADR-031 (section 9; ADR-031 amended per ADR-054 with the canonical axis impl body discipline subsection and the operational-not-architectural roster framing); section 8 (Closure Across Layers — ADR-054 cross-reference); Conceptual Model intro C2 + SD2 narrative (Conceptual-Model.md — fold-fusion as C2’s structural mechanism).
Read κ-derivation (the eight-resolver ψ-pipeline composed with the ψ_9 σ-projection) as the framework’s compression-to-canonical-form operator (ADR-058), and the Atlas image inside E₈ — coarsely stratified by the Hopf convergence tower per kernel::convergence, finely typed by the exceptional algebraic structures G₂ / F₄ / E₆ / E₇ / E₈ — as that operator’s codomain in operator-geometry coordinates (ADR-059). Both are conceptual-reading commitments over existing constructs (ADR-019 + ADR-035 + ADR-043 + ADR-047 for the operator; the foundation’s kernel::convergence substrate vocabulary for the codomain); neither introduces a new substrate trait or wire-format change.	The architecture commits the κ-label’s status as the minimum-information canonical-form representation (unique under the fixed pipeline order per ADR-035) and the three-tier closure-lossless taxonomy — T1 byte-identical, T2 κ-label-identical (≡ TC-05 trace-replay equivalence), T3 outcome-coarse-equivalent (same C: TypedCommitment per ADR-048) — as a typed equivalence vocabulary for application-level interoperability. Cross-substrate compression universality is a closure property per TC-05 (binary, not statistical: a conforming substrate emits the byte-identical certificate; a non-conforming substrate fails closed at certify_from_trace), sharpened by ADR-059 to a categorical theorem: two conforming substrates compressing the same input land at the same Atlas-image position modulo Weyl-orbit equivalence (universal factorization through the Atlas as the initial object in ResGraph). Application-level TypedCommitment admission predicates per ADR-048 gain a codomain-typed vocabulary (Atlas-image proximity, exceptional-group orbit membership, convergence-tower level-and-residual signature); the Atlas / exceptional-structures code realization is application-level per ADR-031 (TR-22), while the coarse convergence-tower stratification is substrate-native via kernel::convergence.	ADR-058, ADR-059 (section 9); section 8 (Concepts — compression-operator reading + codomain commitment); section 5 + section 12 (kernel::convergence trait surface, Hopf convergence tower); TR-22 (section 11 — Atlas realization deferred).
Verification (prism-verify) is a separate crate, not a feature of uor-foundation or prism.	Constraint TC-05 requires that the verifier never invokes the author’s deciders. The application user, who runs only verification, MUST be able to depend on a minimal surface — Trace, Hasher, Certified<GroundingCertificate>, ReplayError — without dragging in the pipeline runtime or uor-foundation's full vocabulary. prism-verify is the façade that exposes that minimal surface; it re-exports prism's certify_from_trace (the implementation) and the relevant wire-format types from uor-foundation.	ADR-005 (section 9); section 5.1.
The principal data path is singular and is defined by prism. There is exactly one constructor for Grounded<T>.	Constraint TC-03 mandates this. A second constructor — a proc-macro back-door, a feature-gated alternative, a deprecated path — would create a path through which UORassembly enforcement could be bypassed. The architecture admits no such second path.	Constraint TC-03 (section 2); section 5.1; section 6 (runtime view of the principal data path).

How These Decisions Compose

The decisions above produce a system in which:

• uor-foundation is the substrate. It owns the type-declaration vocabulary (including the shape proc-macros via an internal sub-crate, a Cargo packaging detail not exposed in the wiki); the four UOR-domain sealed types (Datum, Triad, Derivation, FreeRank); the trace and certificate wire-format types as data definitions; the mint primitives that are the cross-crate construction surface for the four UOR-domain types.

• prism is the Prism runtime. It owns the pipeline runtime; the three Prism-mechanism sealed types (Validated, Grounded, Certified); the operation-declaration vocabulary; a standard library of pre-declared types. It is closed under uor-foundation's vocabulary (every type it exposes is derived from uor-foundation's type-declaration vocabulary; every operation declaration composes uor-foundation::PrimitiveOp discriminants). It re-exports uor-foundation's vocabulary so application authors import only prism. It declares the bounds uor-foundation MUST satisfy and the surface the author MUST select against.

• prism-verify is the replay surface. A thin façade re-exporting prism's certify_from_trace and Certified, plus uor-foundation's wire-format type definitions. It carries no implementation of its own; the verification machinery lives in prism's replay component.

The three crates compose into Prism through their published interfaces. There is no shared internal state; there is no runtime registry; there is no plugin mechanism. Composition is accomplished entirely by the Rust toolchain at compile time, applying trait-bound resolution and sealed-type discipline to produce a single executable from the application author’s source plus the three crates' source.

The type-system enforcement choice and the bilateral UORassembly contract together ensure that any executable produced by this composition satisfies the architectural constraints in section 2. An executable that fails to satisfy them either does not exist (because compilation rejected it) or is not a Prism implementation (because it was produced through some path other than the three crates).

The substitution axes are the only points at which a single application’s code varies. The choice of HostTypes, HostBounds, and the AxisTuple (per ADR-030; the third position generalizes ADR-007’s original Hasher to a tuple of axis trait selections such as (HashAxis, TensorAxis, FheAxis) declared by standard-library or third-party Layer-3 crates per ADR-031) is the application author’s; everything else is fixed by the architecture. This produces a system in which two applications using the same axis selections produce executables with identical structural properties, differing only in the domain logic the authors specified.

Layered atop the three-crate decomposition is the three-layer algebraic closure: substrate closure (foundation primitives composed under the substrate operator set), prism closure (routes composed under the prism operator set over substrate-closed shapes), and implementation closure (verb sets composed under the prism operator set as named, reusable units). The three closures inherit the axis-allocation pattern’s parametric scaling; each closure’s enumeration at any committed substitution-axis selection is derivable, none is hardcoded.

Layered atop the three-layer closure is the universal substrate-extension mechanism (ADR-030): the third substitution axis generalizes from a single Hasher trait to an AxisTuple of axis trait selections, with axes declared via the axis! SDK macro by any Layer-3 crate. Per ADR-031, prism is the standard library — a façade over uor-foundation plus standard-library Layer-3 sub-crates (prism-numerics, prism-crypto, prism-tensor, prism-fhe), all published from the Prism repository, carrying axis declarations and verb declarations for application-neutral vocabularies. The architecture in uor-foundation lives in the UOR-Framework repository alongside the wiki; the standard library lives in the Prism repository. Format-specific and architecture-specific vocabularies (graph-format imports, transformer architectures, etc.) live in third-party Layer-3 crates that consume the standard-library vocabularies. The architecture’s substrate-extension lane is universal: any domain’s vocabulary is admissible through the same meta-mechanism, with the closure discipline applied per-axis at compile time.