Skip to content

RFC: Research Exploration Control Plane v0

Field Value
Status Accepted
Supersedes / closes none
Date 2026-08-13
Authors LoopX maintainers
Scope Research evidence, coverage, composition frontier, replan integration, execution handoff, and qualification
Source baseline LoopX 7f67d51c6

Language note: the Chinese version and this English version are semantic mirrors. A difference between them is a defect.

1. Decision Summary

LoopX should treat research as the controlled evolution of a typed knowledge frontier, not as a long sequence of tasks and not as an unbounded request to "try something different".

The first new ability is a composition frontier. When two individually investigated research nodes have an explicit, evidence-linked reason to be tested together, LoopX should preserve that untested relation as a gap. The gap may produce a replan obligation and a normal runnable successor. It is closed only by an evidence-backed composition experiment or an evidence-backed dismissal, not by reading context, acknowledging a packet, completing an unrelated Todo, or restating the same conclusion.

This RFC makes six architectural choices:

  1. Explore owns research topology and evidence. Goal-frontier consumes a bounded projection; it does not build a second research graph.
  2. Research observations compose the existing progress contract. They do not silently add research-only fields to typed_progress_observation_v0.
  3. A joint probe is an experiment node. It depends on its input nodes. A direct binary joint_probe edge is not the execution record.
  4. The first composition trigger is explicit-only. A shared closure constraint may rank candidates in shadow mode, but it must not automatically create every pairwise obligation until precision is demonstrated.
  5. Replan closes on semantic state change, not protocol ceremony. Context delivery, manual reads, prose ACKs, and repeated terminal claims are not research progress.
  6. Execution remains in the normal LoopX lifecycle. Explore planners and harnesses remain read-only; Todo, quota, claim, lease, writeback, and spend retain their current authority.

The broader aim is not to make every LoopX goal "research-shaped". It is to add one optional, bounded substrate for goals whose outcome depends on exploration, hypothesis revision, negative evidence, and combinations between previously separate directions.

2. Why Research Needs a Distinct Control-Plane View

Ordinary implementation work often has a known target and a mostly monotonic path: select a Todo, change an artifact, validate it, and close or continue. Research work has a different failure surface:

  • the next useful action depends on the latest evidence;
  • a negative result may be valuable even when it changes no artifact;
  • several individually exhausted directions may interact;
  • broad exploration can look active while producing no new knowledge;
  • premature closure and combinatorial explosion are both plausible;
  • a long prewritten Todo chain can preserve activity while hiding that the underlying question has changed.

LoopX already has most of the required parts:

  • typed_progress_observation_v0 identifies a work slice and distinguishes advanced, unchanged, blocked, exhausted, and no-follow-up results;
  • the repeat detector can derive an obligation from materially equivalent observations;
  • semantic writeback accepts new surfaces, hypotheses, probe families, grounded successors, concrete blockers, and coverage-backed terminal results;
  • the host projects bounded evidence and uncovered frontier into the next action packet;
  • Explore stores append-only nodes, typed edges, findings, and public-safe evidence references;
  • Todo, quota, claim, lease, and spend own executable work.

What is missing is relational knowledge. Current novelty is mostly atomic: "new surface", "new hypothesis", or "new probe family". It cannot represent the durable fact that A and B were each investigated, their individual conclusions are known, but the interaction A x B remains untested.

That omission creates two bad outcomes:

  1. LoopX accepts individual exhaustion as global exhaustion even when an explicit interaction hypothesis remains open.
  2. A model rediscovers the combination informally, but the relation is not durable and the next turn cannot distinguish it from another ad hoc probe.

3. Goals

This RFC aims to:

  • represent research coverage, closure, and composition with typed, public-safe identities;
  • detect repeated or isolated exploration without parsing prose;
  • preserve negative evidence and coverage boundaries;
  • turn a qualified knowledge gap into exactly one causal, runnable direction;
  • keep context delivery separate from proof that the context changed the next action;
  • support interruptions and replay without duplicating experiments or losing gaps;
  • keep hot quota packets small enough for weaker protocol-following models;
  • qualify both deterministic state semantics and actual model-selected tool behavior;
  • expose honest terminal outcomes: finding, exhausted coverage, concrete blocker, dismissal, or no follow-up;
  • evolve through measured milestones rather than speculative framework growth.

4. Non-Goals

This RFC does not propose:

  • a general scientific-method engine or autonomous lab;
  • automatic pairwise combination of every closed node;
  • a prose classifier for research intent, closure, novelty, or similarity;
  • a generic knowledge graph replacing Explore;
  • a second Todo scheduler, agent launcher, settlement executor, or quota path;
  • a requirement that ordinary implementation goals use research observations;
  • automatic truth claims from model confidence;
  • automatic execution of unsafe, expensive, external, or permissioned probes;
  • a guarantee that composition produces a positive finding;
  • a generic Kleisli or middleware framework for research commands;
  • n-ary composition, concurrent experiment execution, or CAS semantics before a real execution caller requires them.

5. Current Truth and Missing Pieces

This section is intentionally maintained as implementation lands. Protocol references and code define shipped behavior; this RFC records direction and milestone status.

5.1 What exists today

Capability Current truth
Typed work-slice progress typed_progress_observation_v0 records stable semantic dimensions, result class, coverage, blockers, and evidence ids.
Stall detection Consecutive materially equivalent typed observations can derive a replan trigger.
Semantic replan closure New typed dimensions, a grounded successor, a concrete blocker, or coverage-backed terminal result can close the current obligation.
Host-delivered context Quota can project a compact coverage ledger and uncovered frontier without requiring a manual evidence-read ritual.
Explore evidence and ordinary capture Explore owns append-only nodes/edges/findings. Existing result attachments validate before primary work commit, then deliver an idempotent finding and Todo link; a partial link failure retains the committed work and replays the same operation. Bounded turn context returns scoped evidence. This is capture/readback, not the §11.5 decision-adoption gate.
Research evidence and cold shadow Research observation v0 composes generic progress with typed closure and explicit binary candidates. CLI summary and Lark node summaries share the read-only projection; exact experiment input fingerprints guard stale results.
Explicit M3 composition gate PR #5280 merged as 1e6cae19f on 2026-10-12. Opt-in Goal-frontier, Todo, experiment and input lineage share a typed write-time qualification across File and SQLite; stale or unrelated evidence cannot discharge the current obligation. The existing Goal capability editor and CLI own activation. This is an integrated rule, not evidence of accepted scientific results or natural-host use.
Explore planning Optional branch planners are read-only and return execution to quota, Todo, claim, and lease.
Evidence in turn context Planning-mode turn-start reads retain bounded explicit Todo/node evidence diagnostics and existing exploring frontier nodes. Linked evidence is classified before detail truncation: all findings and relevant edges in the supplied projection contribute to diagnostic counts and hazards, while row details remain bounded. Explicitly selected tasks retain source-recency ordering and reserved counterevidence before unrelated planner links; versioned measurements and replay use the same scope. #7053, #7077. Turn context reports omitted detail counts. This delivers decision input, not the §11.5 adoption gate or proof of model behavior.
Model behavior qualification Real function-tool conversations can test whether a model reads an actual packet and selects a real semantic writeback.

5.2 What is missing

Gap Consequence
M3 integrated behavior lacks complete remote qualification PR #5280 has an exact-head approved review and local File/SQLite, default-off and packaged-configuration evidence. Its final-head CI did not finish green: jobs were cancelled on merge and the Stage2c aggregate failed because its matrix result was cancelled. This is not a demonstrated Stage2c test failure or remote browser acceptance. The separate browser CI source-install and composer-focus PRs #6287/#6282 closed without merging; their unresolved checks remain independent of M3's local evidence.
Actual experiment-result adoption remains unqualified Capture, task-focused delivery and recoverable reading exist. They do not prove that the next bound decision used a result's scope, validity or uncertainty. Qualify shadow adoption through §11.5 before proposing more enforcement; merged PR #5280 does not enforce that decision duty.
Execution attribution is not effect authority An exact Todo/experiment/input receipt does not grant a task lease, effect permission or accepted Goal closure.
Live qualification incomplete Deterministic and real CLI/file-log tests establish state semantics, not model selection quality or scientific truth; no live Lark sync is qualified by projection tests.
No promotion evidence for inferred combinations Shared constraints are not known to be precise enough to trigger obligations.

6. Research State Model

The model has five durable concepts and two derived concepts.

6.1 Goal-level research contract

Research mode is an explicit per-goal policy layered on the existing goal vision and Explore opt-in. It must not create a second goal statement. Before composition can become enforceable, the goal boundary needs to identify:

  • that research exploration is enabled;
  • the active vision or question whose acceptance remains authoritative;
  • the coverage scope used for exhaustion or no-follow-up claims;
  • whether composition is disabled, explicit_only, or a later promoted policy;
  • allowed terminal outcomes and any user/safety gate that owns them.

The first implementation should extend the nearest existing Explore goal configuration rather than introduce a new capability. Without this explicit policy, Explore evidence remains available for diagnostics and presentation, but no composition obligation is derived.

Research nodes and findings can supply evidence to the goal vision. They do not change goal acceptance merely by becoming resolved, and a locally complete composition frontier does not imply that the whole goal is complete.

6.2 Durable concepts

  1. Research node: a question, area, hypothesis, experiment, or artifact in the Explore log.
  2. Research observation: a typed result for one bounded work slice, attributable to a research node and evidence.
  3. Closure basis: the typed constraints and coverage that support a terminal or bounded conclusion.
  4. Composition candidate: an explicit, evidence-linked claim that two research nodes should be tested together.
  5. Composition experiment: a first-class Explore experiment node with depends_on edges to every input node.

6.3 Derived concepts

  1. Composition gap: an eligible composition candidate that has no active, completed, or validly dismissed composition experiment.
  2. Research frontier: a bounded projection of atomic gaps, composition gaps, and terminal coverage available to replan and status consumers.

6.4 Why the experiment is a node

For input nodes A and B, a composition experiment is C:

flowchart LR
  C["Composition experiment C"] -->|"depends_on"| A["Research node A"]
  C -->|"depends_on"| B["Research node B"]
  C -.->|"finding attached to C"| F["Finding or conclusion"]

In the stored Explore graph, C carries depends_on edges to A and B. This representation:

  • supports more than two inputs later without changing edge meaning;
  • gives the probe its own lifecycle and evidence;
  • separates the hypothesis that inputs may compose from proof that a joint experiment ran;
  • makes replay identity stable;
  • reuses the existing experiment node kind, depends_on edges, attached findings, and supports/refutes relations where they apply.

A direct joint_probe edge between A and B would collapse candidate, execution, and result into one ambiguous relation. This RFC rejects that shape.

7. Typed Contract Direction

The research envelope and closure basis have an active CLI caller and the versioned evidence protocol. The opt-in M3 development path implements exact execution lineage and shared write gates and bounded retirement transitions. Model selection below remain design targets; the cold shadow does not activate enforcement.

7.1 Compose; do not mutate v0 silently

typed_progress_observation_v0 is a generic work-item contract. Research metadata belongs to Explore. The intended envelope is:

{
  "schema_version": "typed_research_observation_v0",
  "progress": {
    "schema_version": "typed_progress_observation_v0",
    "work_item_id": "todo-42",
    "surface_id": "routing-boundary",
    "hypothesis_id": "alternate-ordering",
    "probe_kind": "order-differential",
    "result_class": "exploration_exhausted",
    "coverage_scope_id": "routing-order-v1",
    "coverage_complete": true,
    "evidence_ids": ["ev-routing-order"]
  },
  "explore_node_id": "node-routing-boundary",
  "closure_basis": {
    "schema_version": "research_closure_basis_v0",
    "disposition": "bounded",
    "constraints": [
      {
        "kind": "decision",
        "id": "parameter-normalization",
        "role": "decisive"
      }
    ],
    "evidence_ids": ["ev-routing-order"]
  },
  "composition_candidates": [
    {
      "target_node_id": "node-filter-interaction",
      "basis": "explicit",
      "interaction_kind": "shared_constraint",
      "evidence_ids": ["ev-routing-order", "ev-filter-boundary"]
    }
  ]
}

The envelope composes the generic progress observation; it does not copy its result-class logic. Core progress consumers may read progress. Explore owns closure and composition validation. A future refresh-state integration may write both through one receipt-bearing effect program, but it must not create a second generic settlement executor.

7.2 Typed closure basis

closure_basis.constraints[] is typed data, not a list of arbitrary strings. The initial kind vocabulary should remain domain-neutral and small:

  • stage
  • decision
  • invariant
  • dependency
  • resource
  • policy

Each constraint has a stable opaque id and a role of decisive or supporting. The ordered list may describe a path, but matching uses typed identity, never substring overlap. The terminal observation must also carry a coverage scope and evidence; a closure path is not a substitute for coverage.

7.3 Explicit composition candidates

The first version accepts only basis=explicit. interaction_kind is a typed claim about why a joint test may matter:

  • shared_constraint
  • producer_consumer
  • state_interference
  • order_dependency
  • resource_coupling
  • unknown_interaction

These values describe a candidate; they do not assert a finding. Candidate identity uses a canonical sorted set of input node ids plus goal id, so A x B and B x A cannot create duplicate gaps.

composition_candidates must be bounded per observation. A candidate must reference known nodes in the same goal and public-safe evidence already attributable to the inputs. Unknown nodes, local paths, prose-only targets, and cross-goal refs fail closed.

7.4 Action signature and compatibility

When a research observation can close a replan obligation, the action signature must include:

  • current obligation id;
  • research observation schema version;
  • Explore node id;
  • normalized input node ids for a composition experiment or candidate;
  • generic progress fingerprint;
  • evidence ids or their bounded digest.

Adding research fields without updating the action signature would allow an adapter to drop the composition meaning while still claiming semantic parity. Compatibility tests must reject that drift.

8. Composition Gap Derivation

8.1 Eligibility in v0

A candidate becomes a composition_required gap only when all conditions are true:

  1. the candidate is explicit and references at least two known Explore nodes;
  2. every input has an attributable terminal observation with evidence;
  3. every input's terminal state is eligible;
  4. no experiment with the same canonical input set is active or has an evidence-backed result;
  5. the candidate has not been validly dismissed;
  6. the gap is within the configured per-goal and per-agent projection budget.

Eligible terminal states in v0 are:

  • coverage-backed exploration_exhausted;
  • coverage-backed no_followup;
  • an Explore resolved or dead_end node backed by an equivalent typed observation.

unchanged is not a closed node. It may trigger ordinary stall replanning, but it cannot prove that a direction is ready for composition closure analysis.

blocked is not eligible by default. A later milestone may admit an evidence-backed intrinsic blocker once blocker scope and resume semantics are typed. A temporary permission, resource, user, or scheduler blocker must not imply that isolated research is exhausted.

8.2 Shared constraints are not a v0 trigger

Two terminal nodes that share a decisive closure constraint may be interesting, but automatically pairing all such nodes is unsafe:

  • common infrastructure constraints can connect many unrelated nodes;
  • N nodes behind one stage produce O(N^2) pairs;
  • a shared rejection boundary may be proof of independence rather than interaction;
  • false obligations impose protocol cost and distract from more valuable frontiers.

Therefore shared constraints may initially produce a shadow ranking signal only. Promotion to an inferred candidate trigger requires measured precision, bounded candidate generation, and an explicit RFC decision-log update. It must never be implemented as string matching over closure_path prose.

8.3 Bounded projection

The canonical Explore projection may contain all public-safe eligible gaps. Hot control-plane packets should not.

The default quota action packet should carry:

{
  "composition_frontier": {
    "schema_version": "composition_frontier_projection_v0",
    "pending_count": 3,
    "selected_gap": {
      "gap_id": "composition-gap-opaque",
      "input_node_ids": ["node-a", "node-b"],
      "required_outcome": "schedule_or_resolve_composition_experiment"
    }
  }
}

The packet selects at most one obligation for one agent turn. Status and drill-down commands may expose a separately bounded list and total counts. No hot path should enumerate every candidate pair or copy full evidence bodies.

8.4 Bounded Autonomous Model Selection (Deferred)

Eligibility and ranking are different decisions. The control plane proves that a candidate is legal, still pending, scoped to the current goal and agent, and within evidence, capability, authority, and projection budgets. It must not present a structural ordering as a success probability. A single eligible gap may be projected directly. When several gaps are eligible, a later implementation should deliver at most three public-safe typed candidate cards and let the model choose which one is most valuable to execute first.

Each bounded candidate card should include at least:

  • experiment identity and normalized input node identities;
  • interaction_kind and typed closure basis;
  • each input's terminal result class and compact evidence abstract;
  • proposed probe family, capability readiness, cost class, and prior joint attempt count;
  • the current obligation id and allowed outcomes.

The model optimizes expected research value rather than a self-reported success probability. The first version should compare ordinal typed dimensions for breakthrough plausibility, information gain, falsifiability, execution cost, duplicate risk, and capability readiness. It must not publish or consume apparently precise numeric probabilities before calibration evidence exists. Model confidence is routing metadata only; it cannot create a finding, close a composition gap, or upgrade goal-acceptance truth.

The model must return a bounded composition_selection_v0 receipt containing at least the current obligation id, an experiment ref from the delivered candidate set, typed selection reasons, a confidence bucket, and bounded typed reasons for rejected alternatives. The semantic write gate must verify that:

  1. the obligation identity is still current;
  2. the selected experiment belongs to the candidate set actually delivered in this turn;
  3. the candidate remains eligible and has no active bound successor;
  4. the successor binds both the obligation and experiment identities;
  5. the selection receipt is never treated as experiment-outcome evidence.

Deterministic ordering may be used only as an explicit, observable weak-model fallback. It must not silently claim to have chosen the most promising candidate. M4 should first use real model-tool behavior and repeated live shadow to prove that a model can read candidate cards, select a legal candidate, and produce a meaningful experiment or justified dismissal. This RFC does not require M2 to implement the selection protocol.

9. Composition Gap Lifecycle

The derived gap has a causal lifecycle even though its truth is computed from durable Explore events:

candidate -> pending -> scheduled -> observing -> observed
                       |              |
                       |              +-> pending (interrupted or invalid result)
                       +-> pending (Todo closed without result)

candidate/pending -> dismissed (evidence-backed)
pending/scheduled -> deferred (typed resume condition) -> pending

9.1 State meanings

  • candidate: an explicit relation exists, but input closure is incomplete.
  • pending: inputs are eligible and no covering experiment exists.
  • scheduled: a runnable Todo and experiment identity are bound to the gap.
  • observing: execution started and a lease or current work slice identifies the experiment.
  • observed: an evidence-backed experiment result is in Explore.
  • dismissed: evidence proves the proposed combination is duplicate, invalid, unsafe, or outside goal scope.
  • deferred: a typed blocker has a resume condition; the gap remains true but does not pretend to be runnable.

9.2 What closes what

Scheduling a grounded successor is a valid semantic replan delta. It closes the current replan obligation, because a new runnable direction exists. It does not close the composition gap.

The composition gap closes only when:

  • the bound experiment records an evidence-backed outcome; or
  • an evidence-backed dismissal records why the candidate is not a useful or legal experiment.

Completing the Todo without an experiment result reopens the gap. Rewording a Todo, recording an unrelated finding, reading evidence, or writing a repeated blocker does not advance the lifecycle.

10. Ownership and Effect Boundaries

Layer Owns Must not own
Explore Research nodes, typed relations, closure basis, composition candidates, experiment evidence, canonical gap query Quota, claims, leases, launches, spend, or goal acceptance truth
Goal-frontier Priority among current obligations and bounded consumption of composition gaps A duplicate research graph or inferred prose semantics
Quota / Turn envelope Compact context delivery, selected obligation, allowed outcomes, scheduler handoff Canonical evidence writes or proof that an experiment succeeded
Todo / task lease Runnable successor, ownership, lease, and execution lineage Research truth derived from Todo completion alone
Semantic write gate Exact obligation identity, grounded successor, typed observation, evidence, and legal transition Manual-read rituals, legacy ACK-only closure, or prose classification
Explore harness Read-only ranking and candidate planning under an explicit opt-in Todo creation, claims, leases, worker launch, state write, or spend
Presentation Public-safe rendering of the Explore projection Parsing private research sources or becoming an evidence authority

The end-to-end flow is:

flowchart TD
  E["Explore evidence graph"] --> G["Derived research/composition gaps"]
  G --> F["Goal-frontier selects one obligation"]
  F --> Q["Quota/Turn delivers compact context"]
  Q --> M["Model selects semantic action"]
  M --> T["Normal Todo + claim + lease lifecycle"]
  T --> O["Typed research observation"]
  O --> E
  O --> W["Shared semantic write gate"]
  W --> F

This is compatible with the Agent Loop Effect Interpreter RFC. Context delivery, Todo creation, experiment execution, observation writeback, and quota spend are separate effects with separate receipts. Similar packet shapes do not justify a shared executor unless two real callers also share execution authority.

11. Replan Integration

11.1 Trigger precedence

Composition is one frontier source, not the only one. The goal-frontier reducer must keep one ordered, typed rule table. Composition should enter only after higher-authority gates and already-runnable successors are considered.

A reasonable initial order is:

  1. existing exact obligation;
  2. blocking user or handoff gate;
  3. already-runnable bound successor;
  4. current vision or goal-acceptance obligation;
  5. ordinary succession, stall, or long-chain obligation;
  6. eligible composition gap;
  7. monitor/exhaustion fallback.

The final order requires characterization fixtures against current reducer semantics. Composition must not mask a user decision, a runnable Todo, or a vision acceptance gap.

11.2 Causal identity

Every transition must retain:

composition_gap_id
  -> replan_obligation_id
  -> successor_todo_id
  -> explore_experiment_node_id
  -> result evidence ids

Only that lineage can suppress or close the gap. An unrelated deferred Todo, another agent's experiment, or a prior obligation ACK cannot impersonate it.

11.3 Semantic outcomes

For a composition obligation, accepted outcomes are:

  • new_runnable_composition_experiment;
  • composition_experiment_observed;
  • composition_candidate_dismissed with evidence;
  • new_concrete_blocker with a typed resume/terminal scope;
  • coverage-backed goal-level exploration_exhausted or no_followup only when the composition candidate is included in the declared coverage.

context_delivered, evidence_read, acknowledged, unchanged, repeated blocker, and unrelated new surface are not sufficient to close this obligation.

11.4 Host-delivered research context

The host should project:

  • selected gap id;
  • input node ids and compact conclusions;
  • bounded evidence refs;
  • required outcome;
  • allowed terminal actions;
  • the exact writeback/successor contract.

The model should choose and execute the research action. It should not spend a turn discovering which evidence command satisfies a protocol ceremony. A delivery receipt proves that context arrived; the observation proves whether the next action used it.

11.5 Evidence-conditioned experiment decisions (proposed refinement)

This 2026-10-04 proposal refines M3 before M4 portfolio selection. It does not claim a shipped experiment controller or change ordinary replan defaults. Decision checkpoints determine when a result needs attention; this section defines what a research decision must retain. Explore is the nearest capability owner. Native measurement, statistical interpretation and job/artifact handling stay with the domain or benchmark provider. Generic kernel rules do not interpret scores or infer research truth from Todo churn.

Integrated input and the next qualification

At main 5550e91bab (2026-10-23), scoped evidence ordering and comparison version identity are integrated, and the Research reader can recover paged findings and read complete linked tasks through #7084. Do not rebuild capture, ranking or another evidence inbox to begin this pilot. These fixes qualify delivery/readback boundaries; neither a readable page nor a cited finding establishes actual decision adoption.

Select one existing authorized pending question and retain its exact incumbent, candidate/input/result revisions, applicable counterevidence and remaining budget. Observe whether the normally admitted next action uses that evidence, then inspect its actual artifact and provider result. Compare with evidence delivery alone under the same conditions; report justified continuation, changed method, invalid prerequisites and inconclusive results separately. Keep late verified gains as positive evidence for continuation, as described in the measurement/replan study. The next review evaluates result quality and complete marginal cost, including control and validation. A citation, new identifier or forced pivot is not the acceptance oracle. This is the next shadow qualification of the existing path, not a launched experiment, default behavior change or completed M3/M4 claim.

Bind a question and the scope of its evidence

Ordinary scoped findings already use explore_result_attachment_v0 or the existing explore_result_from_path_delta_v0 form through work writeback. Reuse that capture/replay path. The first §11.5 caller must identify which additional result-validity and decision-adoption facts it needs, then extend a registered contract only where those facts are absent; do not invent a second result log or add unknown fields to research observation v0. The remaining decision contract needs the following conceptual data:

Data Owning meaning
Hypothesis and declared mechanism family Stable Explore node/revision and explicit relation to a family node. Similar names/prose do not prove equivalence; a family is a scoped mechanism claim, not a kernel-inferred taxonomy.
Probe and applicability Planned intervention, candidate/input fingerprints, comparison, environment/data/evaluator revision, scope, resource/stop bounds. The provider declares what would support, contradict or leave the claim unresolved.
Result and validity Exact provider result revision/evidence, comparison and uncertainty/guardrail assessment. Failed, missing or incomparable measurements remain distinct from valid negative evidence.
Decision and adoption Exact input/result fingerprints, existing continue/no_change/replan path outcome, evidence refs and bound task step or grounded successor. A repeat needs a new discriminating question or an explicit replication/uncertainty reason and budget.

This is a design inventory for the additional decision contract, not a claim that generic result capture is missing, an accepted wire schema or a new global enum. Explore owns its TS codec/reducer; compute/capture providers adapt it without a parallel decision owner. Reuse nodes, findings, supports/refutes, closure and input-fingerprint semantics. Compose a versioned decision attachment with the existing Goal path delta and Todo-bound recommendation receipts, rather than add another Next Action or settlement store. An ML adapter can map its existing hypothesis ledger's weakened/retired states; that vocabulary does not become a generic progress result class.

Evidence Legal decision basis
Build or measurement failed Repair the prerequisite or record the blocker; do not assert scientific refutation.
One valid candidate is worse Preserve the incumbent and bind evidence to this candidate/probe scope. Continue another probe, replicate or replan with reasons; do not automatically retire the family.
Effect is within uncertainty or measurements conflict Preserve unresolved/contradictory evidence; choose a bounded discriminating probe or justified replication. A small score decline is not drift.
Declared coverage contradicts a hypothesis Close/revise that exact claim with its closure basis. A successor cites the exclusion and what changes; a same-mechanism probe addressing an uncovered condition remains legal.
Coverage supports family retirement Retire only the declared family/scope with attributable evidence. New input, evaluator or applicability can reopen investigation; retirement never settles Goal acceptance by itself.

Rejecting one parameter setting can leave a family open; demonstrating failure to meet a declared constraint under covered conditions can justify a different family. The kernel validates attribution and transitions, not causal truth or experiment quality. Renaming identifiers or allocating a new evidence id for an unchanged measurement is not novelty. No fixed failure count forces a pivot.

Make result adoption observable at the existing decision boundary

  1. Record/read back the validated result on the exact experiment node with provider provenance and current input fingerprints. A launch receipt alone is not research evidence.
  2. Under an explicit per-Goal opt-in, project one compact pending decision for its bound experiment/Todo: question, incumbent, applicable exclusions, uncertainty/invalidity, input/result refs and remaining budget. Bound the delivered packet without truncating its source truth. Measure source-log validation, indexing and bridge costs separately; current bounded views may read a complete log. Projection alone needs no additional reasoning call.
  3. The normal admitted Agent decides. Continuing is legal if it states what new information the next probe should obtain and why the exclusion does not already answer it. A pivot names the changed question/mechanism and its evidence through the existing grounded successor path.
  4. Explore's typed reducer qualifies the decision attachment. The shared write gate joins it to the exact Todo/replan/Turn and current input revisions, committing it with the normal task-step or successor receipt. Generic replan keeps its existing legal outcomes. A record/read, stale citation or unrelated Todo cannot discharge this opt-in decision duty.
  5. Re-offer pending results after a crash; acknowledge only durable adoption. Replay recovers existing decision receipts; same-Turn settlement remains idempotent, while a newly admitted recovery Turn settles normally. Changed inputs or results invalidate pending decisions; historical facts remain available.

The required relation is result -> interpretation -> adopted action. Binding is not proof of quality. Operational validity, new research information, native outcome improvement and Goal acceptance are separate observations. A useful negative result can be delivery without a score gain; a series of negative experiments must still expose changed knowledge and remaining frontier.

Progressive evidence access already has a production writeback consumer: the current source replays declared Explore result pages before admitting omitted finding references. Reuse the page/basis and recovery rules in Stride §7.6; do not define a second pagination or adoption receipt here. Page eligibility, explicit delegated-result use and actual model adoption establish different facts. Qualify the sequence provider result → current source readback → admitted work → attributable artifact → independent outcome → next review. Exercise unavailable sources, valid but inapplicable findings, scoped negative evidence and results that support continuing the incumbent. Copying a finding or filling an evidence reference is insufficient; a justified no-change decision remains legal. Inspect omitted counterevidence and measure source scan, sort, hash, serialization and delivered context separately as history grows.

Choose investigation by the decision it can change

Initial uncertainty, a new opportunity, explicit user direction or counterevidence can justify exploration; repeated failure is neither required nor an automatic method-switch rule. Name the question, unchanged constraints, discriminating evidence, budget and stopping condition before selecting a source-reading, external-research or experiment workflow. These are ordinary work choices, not a new skill router or a mandatory sequence of skills. Parallel branches require distinct useful questions and existing capacity/authority.

A skill report or child completion is candidate evidence. Retain sources, applicability, tested revision and unresolved contradictions through capture; do not infer findings by parsing arbitrary report prose. The next admitted decision may adopt, defer, repeat with a scoped reason or retain the incumbent. Record the exact task/step or result relationship through existing owners and inspect actual work before claiming adoption. No-change can be a useful result; ordinary work without a reusable finding needs no empty attachment. Capture, model use, independent outcome and full cost are separate qualification rows.

Smallest usable path and qualification

Start with the existing benchmark-toolkit admitted-run monitor/closeout seam, composed with an Explore experiment node. Its benchmark_runtime_observation_v0 and continuity reducers already separate runtime liveness, attributable terminal results and launch generation. They classify provider facts; they neither run experiments nor establish result validity. A controlled provider must execute and recover one bounded build/evaluation trial, validate its result, deliver the pending decision, adopt an evidence-linked continuation/successor and read it back. Initially use a complete trial result; intermediate training checkpoints need their own provider postcondition and qualification. A preview-only domain pack is not an execution backend. This bounded M3 prerequisite need not wait for inferred composition, a new multi-agent scheduler or M4 ranking, and does not close the remaining M3 composition work.

First shadow-capture actual decisions against negative, inconclusive, failed and invalidated inputs without changing scheduling. Enforcement is a separate, reversible per-Goal opt-in in the existing Explore configuration owner. Default-off shared surfaces retain current behavior. Disabling stops new decision duties, preserves evidence and completes owed settlement; it does not delete job/result history or waive existing replan/authority obligations.

The enforcing slice includes the existing frontend task/Explore journey: question, candidate/incumbent, waiting/result state, scoped negative evidence, proposed next action and reason; an authorized decision and its readback, including stale-result recovery. Optional Lark consumes the same projection and authority. A CLI-only prerequisite remains partial until the packaged interaction is qualified.

Qualify real provider process and canonical state, revision/lease fences, duplicate/lost delivery, stop/revocation, missing and contradictory results, unjustified replay/renaming, over-retirement, changed inputs reopening a scope, valid same-family probes and default-off parity. Then independently qualify model adoption and scientific utility under matched total budgets. Lower control cost must not come from hiding useful negative evidence.

11.6 Research scope review at the shared replan boundary

See the execution, exploration and correction integration guide for selecting a research method, returning evidence through the existing Explore attachment, and qualifying its effect on subsequent work. It reuses this RFC's owners without making exploration mandatory for ordinary execution.

The stride control loop complements result adoption. It asks whether the next experiment should change the mechanism, the validation coverage, or the uncertainty being resolved. More correct tests and more named hypotheses cannot establish broader research. Native/provider outcomes, noise and headroom remain domain evidence, not kernel classifications. In-scope method changes do not require a new user gate; task, acceptance, permission, feedback and budget changes retain their existing owners.

The bounded source prerequisite reuses accepted goal_path_delta_v0 decisions and subsequent typed progress in replan_context.decision_followthrough, delivered at the existing review entry. It adds no mandatory Explore attachment or capture, works independently of Explore activation, and cannot satisfy or discharge any extra obligation. Progress is recorded evidence, never an execution/adoption or scientific novelty verdict. §11.5's opt-in result-adoption gate and composition lineage are still separate, unqualified work.

The Agent should preserve the qualified incumbent, identify the unexplained goal gap and compare a discriminating alternative with continuation or justified replication. Bind the chosen probe's prediction, adoption criterion and cost to normal task/Vision continuation, then examine actual candidate execution and result at the next review. A changed input can reopen a scoped negative finding; unchanged conditions need a reason to repeat. No elapsed-hour or losing-score rule forces a pivot or retires a family.

Qualify this intervention through the same-state continuation study, retaining conversation, negative evidence, code/incumbent and feedback opportunities. Measure whether the next probe resolves an uncertainty and its result enters an adopted artifact, then compare native outcomes and full cost. Session opening, path writeback and context delivery are prerequisite facts, not research effectiveness. Keep automatic ranking/enforcement default-off until the scoped profile qualifies; neither this input slice nor a blog claim closes M3/M4.

12. Write-Time Enforcement

The write gate must reuse the same current goal-frontier and Explore gap projection as quota. A run-history-only adapter is insufficient because vision, frontier, and composition obligations can be derived without a prior compact run.

While a composition obligation is open, the gate rejects:

  • maintenance or unchanged writeback;
  • a successor not bound to the current gap and obligation;
  • a terminal result without coverage and evidence;
  • a composition experiment with unknown or mismatched input nodes;
  • a Todo closeout with no experiment observation;
  • a manual read or legacy ACK presented as semantic completion;
  • a duplicate experiment identity that would repeat an already covered input set without a typed supersession reason.

The gate accepts only legal transitions from the lifecycle above. Error output should name the current obligation id, missing typed field or state transition, and one canonical next command. It should not dump the full graph or private evidence.

13. Complexity and Safety Budget

Research capability is useful only if it costs less than the repetition it prevents.

13.1 Cardinality rules

  • Never enumerate all pairs of closed nodes.
  • Bound explicit candidate declarations per observation.
  • Canonicalize input sets for idempotency.
  • Select at most one composition obligation per agent turn.
  • Keep full gap lists out of the hot quota packet.
  • Require a configured overflow/read-drilldown policy instead of silently truncating material gaps.
  • Introduce n-ary candidate generation only after a real caller demonstrates that binary experiments are insufficient.

The exact numeric limits are protocol constants chosen with qualification data, not hidden magic numbers in renderers or prompts. Changing them is a behavior change and requires packet-budget and model-behavior evidence.

13.2 Authority rules

  • The capability is default-off per goal until its first milestone is qualified.
  • Enabling research projection grants no network, filesystem-write, worker, claim, lease, quota, or external-system authority.
  • An experiment still passes ordinary capability, permission, user, budget, scheduler, and safety gates.
  • Unsafe or permissioned combinations may be dismissed or deferred; the existence of a gap is not authorization to execute it.

13.3 Public/private boundary

Durable public-safe research events may contain opaque ids, typed relation kinds, compact summaries, coverage ids, and public relative evidence refs. They must not contain:

  • raw prompts, reasoning, transcripts, trajectories, or provider responses;
  • raw benchmark task text, verifier output, or private incident logs;
  • credentials, headers, tokens, or secret material;
  • local absolute paths;
  • private documents, private links, customer or organization context;
  • unredacted external payloads.

Private research inputs remain outside the repository. The graph stores only a bounded public-safe observation or opaque pointer permitted by the source boundary.

14. Qualification Strategy

Tests are derived from legal and illegal state transitions, not from the current implementation output.

14.1 P0: state-machine and replay matrix

Enumerate valid prefixes and interruption points for:

candidate -> pending -> scheduled -> observing -> observed/dismissed

Prove at least:

  • no explicit candidate means no v0 composition gap;
  • unchanged cannot close an input node;
  • scheduling changes the replan state but not gap truth;
  • Todo completion without an experiment result reopens the gap;
  • the same canonical input set schedules at most one active experiment;
  • an old obligation, unrelated Todo, or unrelated evidence cannot close the current gap;
  • failure before observation produces no false result;
  • replay after each durable write is idempotent.

14.2 P0: cross-projection conformance

For the same synthetic goal, quota, status, Turn envelope, and refresh-state write gate must agree on:

  • selected gap and obligation identity;
  • active bound successor;
  • required semantic outcome;
  • whether the gap remains open;
  • public-safe evidence refs;
  • scheduler remaining outside research settlement.

14.3 P0: model tool behavior

The behavior test must resemble a real LoopX turn:

  1. construct a hermetic public-safe goal with two individually covered nodes and one explicit composition candidate;
  2. invoke the real quota should-run path;
  3. deliver the actual compact packet through a real function-tool conversation;
  4. let the model choose its next tool action;
  5. execute only allowlisted commands against temporary fixture state;
  6. judge whether the selected action creates or observes the correctly bound composition experiment;
  7. persist only a compact receipt and digests, never prompts or raw responses.

The model must not pass by emitting a test-only field, starting its response with a keyword, reading a file, or repeating the expected label. Negative arms should include isolated repeat, unrelated novelty, candidate omission, pre-obligation ACK, Todo-only completion, and terminal closure without evidence.

Deterministic scripted transports validate the harness and protocol decoder. They are not live-model evidence. Promotion requires repeated, low-frequency live qualification with an allowlisted model and explicit owner review.

14.4 P1: mutation tests

Mutations should fail when they:

  • drop an input node from experiment identity;
  • reorder a non-commutative experiment plan;
  • remove evidence from closure;
  • treat shared prose as a typed shared constraint;
  • accept unchanged as terminal;
  • close a gap on Todo status alone;
  • accept a different obligation id;
  • duplicate the experiment effect after replay;
  • omit research semantics from an adapter action signature.

14.5 P1: public-safe incident replays

Retain only generalized, synthetic cases that protect durable behavior:

  • repeated maintenance accepted while a frontier-derived obligation is open;
  • context delivered but no later semantic action;
  • a runnable unrelated Todo masking a specific gap;
  • a completed long chain with no outcome checkpoint;
  • an explicit composition candidate lost between turns.

Raw trajectories and private benchmark artifacts remain local and are never fixtures.

14.6 P2: concurrency

Race/CAS tests begin only when a real concurrent writer can schedule or observe the same experiment. Until then, deterministic identity, file locking, claim, lease, and replay tests are sufficient. Do not add a distributed coordination abstraction for a hypothetical caller.

15. Evaluation and Claim Boundary

The feature is not successful because it creates more Todos or more replan events. Qualification should compare:

  • materially repeated work slices per useful finding;
  • time and tool calls to the next semantic delta;
  • percentage of replan obligations that produce a genuinely new runnable direction;
  • composition-candidate precision: eligible gaps that lead to a meaningful experiment or justified dismissal;
  • autonomous-selection yield: meaningful experiments or justified dismissals from model selections relative to the declared deterministic fallback;
  • out-of-set/invalid selection rate and time from selection to semantic outcome;
  • duplicate experiment rate;
  • false-obligation rate;
  • protocol/tooling share of total calls;
  • honest terminal rate and unsupported-exhaustion rate;
  • external task outcome under repeated matched runs;
  • regression on ordinary non-research goals.

Shadow inference from shared closure constraints should record candidate precision and estimated packet cost without creating obligations. It may be promoted only if it improves research outcomes or convergence without an unacceptable false-obligation or protocol-cost increase.

No single benchmark run proves general uplift. A credible claim requires a stable release, stable scheduler/harness, matched starting state, repeated arms, declared stopping rules, and separation between model variance and control-plane failures.

Research episodes and human-readable progress (proposed)

The benchmark measurement refinement defines a proposed analysis unit across Turns and separates native outcomes, information, discrimination, actual adoption, repetition, costs and coverage. Episode grouping and semantic judge output remain read-only annotations: they cannot create legal Explore edges, close a composition gap, accept an experiment, change a runnable frontier or discharge a replan obligation. Reuse the existing typed evidence/relationship and result-adoption owners in §7 and §11.5.

Missing metadata or a subsequent adoption opportunity remains unknown, not negative progress. A supported negative result can narrow a specific next experiment without ruling out an entire method family. Source-version checks and observed receiver adoption are separate facts; neither time adjacency nor a summary supplies a causal link. Product receives only authorized safe projections; hidden evaluator analysis requires both solver termination and completed scoring and never becomes solver feedback.

The product reading journey reuses the Goal/Live Team presentation owners. Scientific segmentation and judge calibration, packaged evidence reading, and comprehension each need their own acceptance. This design advances none of the implementation milestones below and adds no automatic evaluation, intervention, graph authority or study cells.

16. Milestones

Milestone Deliverable Promotion gate Status
M0 RFC, current-state inventory, and explicit ownership decision Maintainer review; no runtime behavior Accepted design
M1 Characterization fixtures plus typed research observation and closure contract in Explore Deterministic normalization, privacy, compatibility, and negative tests Implemented evidence/CLI slice; live research qualification remains separate
M2 Explicit-only composition candidate, canonical gap projection, and read-only status shadow No pairwise inference; bounded packet; projection parity #3173 legacy quota/successor and canonical binary cold shadow in CLI/Lark projection; hot status/frontier adoption shipped with M3, while live Lark qualification remains
M3 Goal-frontier obligation, exact Todo/experiment lineage, shared write-time gate; proposed §11.5 single-experiment result/adoption prerequisite State/replay matrix, real provider/state readback, default-off parity and packaged journey before enforcement Explicit-only gate merged in #5280 at 1e6cae19f with exact-head approved review. Integrated-source local checks passed: 67 focused Python, 37 focused TypeScript, control-plane typecheck, packaged Explore configuration journey and 19/19 risk canaries. The final-head CI was cancelled/failed as described in §5.2, so remote and installed-host acceptance remain unproven. §11.5 result adoption is still a proposal, not delivered runtime.
M4 Bounded multi-candidate cards, composition_selection_v0, real model-tool behavior qualification, and repeated live shadow Model autonomously selects a legal semantic action from the delivered candidate set; selection quality is no worse than the declared fallback; compact receipts only Not started
M5 Shared-constraint candidate ranking in shadow mode Precision and cost evidence; no automatic trigger Not started
M6 Optional inferred trigger Explicit maintainer decision and measured promotion thresholds Deferred
M7 N-ary composition or concurrent scheduling A real second-order caller and authority boundary exist Deferred

16.1 Smallest useful implementation slice

The M1/M2 evidence slice delivers:

  • add no new scheduler or executor;
  • keep composition gaps read-only and default-off;
  • accept explicit candidates only;
  • characterize the current Explore projection before changing it;
  • prove public safety, canonical identity, and bounded projection;
  • show candidates and gaps in Explore summary and existing Lark node projections; preserve #3173 quota behavior. The merged M3 gate now shares the live frontier with status; remote and natural-host readback remain separate qualification.

Validation uses tests/control_plane_ts/explore_research.test.ts, tests/capabilities/test_explore_research_evidence.py and the existing composition-frontier/result-layer checks. It covers canonical reverse pairs, terminal coverage, attribution, replay, invalidated inputs, stale experiment lineage and real CLI/file-log readback. Projection tests do not establish live remote effects or model-selected research behavior. Delivery is tracked in #5214, now closed. Its closure does not supply missing live M3 qualification. Remaining research direction is tracked by #4391 and #3243; preserve the explicit milestone gaps here rather than create a parallel task tree.

M3 was the first behavior-changing slice. PR #5280 kept the obligation and write gate separately reviewable and reversible from the evidence schema.

The M3 development boundary joins current same-agent Todo, experiment and input facts in the typed Explore owner. Goal policy is explicitly scoped and disabled by default; the existing capability editor and CLI share its configuration owner. Quota and refresh reuse one live frontier, with the original duty pinned through scalar rollout fields and both receipt adapters. Real CLI tests reject unrelated/deferred successors and invalidated writeback, then settle the original Turn through its exact successor. File/SQLite tests distinguish canonical Todos from stale display rows; packaged UI checks exercise policy preview, activation, disable, readback and narrow screens. Native actor/lease and CAS admission remain in force; a fixed IO host locks the graph while the typed owner qualifies and persists completion evidence. Real File/SQLite and legacy tests cover missing evidence, direct IPC self-approval, terminal-verb bypass, retained archive lineage and immutable completion replay. Agent-scoped status, Explore and existing Lark Summary fields use the same live facts. Typed candidate dismissal permits scoped terminal retirement; a fresh canonical blocker and common Todo resume condition defer the gap without closing it. Real CLI validates exact observed/dismissed/blocked progress source through the original Turn, with independent File/SQLite lease-safe wait/resume evidence. Invalidated input/scope/activation produces source-qualified retirement for the original duty. Common readback retains its guard and historical debit, closes that Turn without spend, and keeps the current frontier and runnable/paused work visible. IO assembly stays in existing CLI/refresh composition roots; the shared gate consumes supplied capability facts and the typed owner remains singular. The local state/replay matrix and 19 standard risk-selected premerge checks pass. Two existing scheduler ACK tests fail identically on the unchanged base under the same local runtime; this is retained as a baseline limitation, not called green. Maintainer-reviewed integration and independent live qualification remain.

17. Rejected Alternatives

17.1 Automatically pair nodes with a shared closure stage

Rejected for v0 because shared infrastructure creates false pairs and quadratic growth. Retained as a later shadow-ranking hypothesis.

17.2 Add closure_path and composes_with directly to generic progress v0

Rejected because it changes the semantics of an established generic contract without a version boundary and moves Explore knowledge into a work-item schema. Use an Explore-owned research envelope that composes the existing progress observation.

17.3 Store joint_probe as a direct edge

Rejected because it cannot distinguish candidate, scheduled experiment, execution, and result. Use an experiment node with dependencies.

17.4 Let the Explore harness create successor Todos

Rejected because the harness is read-only. It may recommend a bound experiment; execution returns to the normal Todo/quota/claim/lease lifecycle.

17.5 Treat any runnable Todo as sufficient research continuation

Rejected because an unrelated Todo can mask the exact knowledge gap. Only a Todo in the gap's causal lineage suppresses duplicate replanning.

17.6 Close replan on an evidence-log read or ACK

Rejected because context delivery is not semantic use. A new grounded action or evidence-backed terminal result is required.

17.7 Generalize all core paths into one research/effect executor

Rejected until real adapters share execution authority. Shared algebra and typed receipts are useful; a generic executor registry is not justified by similar data alone.

18. Open Questions

  1. Which typed blocker scopes are strong enough to make a blocked input composition-eligible?
  2. Should a composition experiment be able to supersede an earlier experiment with the same inputs but a different probe family, and what evidence is required?
  3. Which interaction kinds predict useful combinations across multiple research domains without becoming domain-specific core vocabulary?
  4. What packet and candidate budgets give weaker protocol-following models enough context without restoring protocol tax?
  5. Should goal acceptance require all high-priority composition gaps to be observed/dismissed, or should the goal declare an explicit research coverage policy?
  6. When does a shared-constraint ranking signal earn promotion from shadow evidence to an enforceable trigger?
  7. Does a second real caller need a reusable composition-experiment builder, or is the Explore CLI still the correct owner?

19. RFC Maintenance Protocol

This is a living RFC, not an append-only diary.

  • Update Current Truth and Missing Pieces when shipped behavior changes.
  • Update the milestone table in the same PR that lands or retires a milestone.
  • Record a short decision-log entry below for changes to ownership, trigger policy, eligibility, or promotion gates.
  • Replace stale statements instead of adding parallel historical sections.
  • Move stable wire contracts to docs/reference/protocols/; link them here and keep this document architectural.
  • Keep implementation tutorials in the control-plane course and user/operator instructions in capability docs; do not duplicate them here.
  • Do not add private experiment results, raw model traces, internal links, or local paths.
  • A later abstraction requires an active caller and scope-fit review, not only an open milestone.

Decision log

Date Decision
2026-08-13 Adopt Explore as the canonical research-topology owner; choose explicit-only composition candidates for v0; represent joint work as an experiment node; defer shared-constraint inference to shadow qualification.
2026-08-13 Separate eligibility from ranking: the control plane owns a legal bounded candidate set, while the model autonomously prioritizes among multiple eligible candidates. A selection receipt proves a scheduling choice, not research truth. Defer the protocol to M4 rather than adding it to the #3173 runtime slice.
2026-10-04 Propose §11.5 as a bounded M3 prerequisite: exact result -> scoped interpretation -> adopted task step/successor. Reuse Explore and task/replan receipts; keep Turn settlement, native scoring and scientific qualification independent. This RFC update delivers no automatic policy.

The Explore Harness product entry now groups evidence-only and evidence-with-planning modes under the existing explore capability. The typed configuration owner retains legacy storage and flags; planning includes the graph without granting spawn or publication authority. A turn-start hook requests bounded evidence and branch context through the existing hook contract. This is an M3 entry/adoption prerequisite, not qualification of experiment selection, result interpretation or scientific benefit. CLI/file-state and packaged settings verify mode changes, stale-preview recovery and feature-off behavior; live long-horizon trajectories must still establish actual model adoption and continuation. The mode vocabulary is local to Explore configuration, not a new kernel lifecycle or scheduler contract.

Finding readers distinguish tentative source judgments from queued verification. Writeback templates require an explicit finding status and retain optional question closure independently of finding status. This improves authoring and readback; correct interpretation, actual closure and model adoption still require evidence. Historical records, CLI defaults and execution authority remain unchanged.

20. Acceptance Criteria for the RFC

Merge accepts this design basis. Implementation qualification still requires evidence that:

  • ownership boundaries do not create a second research graph or executor;
  • the first slice is useful without inferred pair generation;
  • typed contracts avoid prose classification and silent v0 mutation;
  • gap, obligation, Todo, experiment, and evidence lineage are unambiguous;
  • the qualification plan can reject protocol ceremony and test-only behavior;
  • complexity, authority, and privacy budgets are explicit;
  • milestone promotion depends on evidence and real callers;
  • the Chinese and English documents remain semantic mirrors.