The problem we left open
The last post drew a hard line between the mind that proposes and the hand that spends: think ≠ act, credentials split, no fused rights. This post closes an adjacent hole that survives even a clean split.
Predictions change the data you retrain on. Agents mint numeric claims without receipts. On CEH-001, a fluent 1.80 peace can become blotter truth and then training truth while honest dual marks should stay ~1.50 [1.42, 1.58] and ~2.10 [2.01, 2.22]. If that loop stays open, every other control you built can notarize fiction with excellent manners.
This post closes that hole and, in the same breath, says what I mean by a shippable decision system on the model-build plane. Not a syllabus dump. A set of systems takeaways earned across the chapters so far. I am closing here because endogenous risk (performative prediction, Perdomo et al., arXiv:2002.06673) is where a careful machine can still launder fiction into tomorrow's training set. If you only ship exogenous breakers, you still leave a path for the system to teach itself theater.
The solution, as one stack for the endogenous hole
Five moves for the endogenous hole, then the chain those moves have to sit inside.
1. Anti-feedback training and eval rules. Labels that came from denies, human panic midpoints, or unverified agent marks cannot enter production training unless explicitly re-labeled under an information contract. Maintain a counterfactual or delayed-label eval pack insulated from recent self-prints. Origin tags and data lineage are mandatory. SELF_PRINT_LABEL refuses promote paths that skip the contract. Put a number on why this matters: a canary lease's own fills can reach 18% of a thinly traded name's daily prints inside three weeks, and refitting on an unfiltered warehouse table drops exam residual variance by 29% — a headline "improvement" that evaporates back to nearly its starting value the moment self-origin rows are excluded. The model had learned to predict its own footprint, which is a tautology dressed as skill.
2. Evidence ids on every numeric claim. Clearance schemas require pointers to hashed artifacts: loss card, shortcut report, information contract, measure card, residual test, crowd probe, ranges, monitor state. Parse-time invalid if missing. Fluency is not a receipt. Replayable artifacts are the product.
3. Independent challenge that can fail the release. A second team or harness path runs the poison pills: midpoint 1.80, latest-fetch, cue hero, drift overlay, self-print labels, underpowered green. Challenge is not a rubber stamp. It is a gate with a kill.
4. Loop-aware monitoring. Track self-print share in features. Alarm on over-coverage when self-print share is material. Measure loop gain on canary leases. Treat endogenous slip as first-class next to exogenous slip.
5. Staged autonomy only after clean endogenous hygiene. Escalate-only until anti-feedback and grounding gates stay green on replay weeks. Autonomy is still the ladder this chapter defines: propose, draft-plus-human, tiny size, size up. Endogenous cleanliness is a stop condition, not a vibe.
What shippable means on the model-build plane
Done is not a bigger model. Done is when you can point at a CEH-001 decision and replay the chain without chatting the model. Each link is a hashed artifact:
| Chain link | chapters | What must be replayable | CEH-001 refuse |
|---|---|---|---|
| Loss card + train binding | Ch 9 | strategy optimized; forbidden optimisations | trained 1.80 peace cult |
| Shortcut report | Ch 9 | suspect register; ablation numbers; worst-group | cue-financed 1.80 |
| Information contract | Ch 16 | room, clock, four-room canaries green | 14:20 notebook as 14:00 exam |
| Measure card | Ch 7 | P vs Q; remove-drift; residual; incomplete bands | drift casino labeled hedge |
| Live lease | Ch 18 / 26 | meeting-free revoke; change packets; coverage ceiling | quiet decay with size still on |
| Anti-feedback + grounding | Ch 18 | origin hygiene; evidence ids; independent challenge | self-print 1.80 culture |
| Honest dual marks | all layers | ~1.50 [1.42, 1.58] / ~2.10 [2.01, 2.22] | midpoint 1.80 never Clearance output |
If that chain is missing a link, the system should sound dull and refuse. Dull refusal is the product. Clearance, not a permanent blessing. Never midpoint 1.80 as social finish.
Trenches that must stay red-capable
- Model. No production train without loss, contract, and measure bindings. No retrain without change packet. No self-print labels on promote paths.
- Agent. Typed jobs only. Evidence ids required. Midpoint peace proposals denied. Latest-fetch denied under pinned clocks.
- Harness. Multi-gate promote. Replay poison pills weekly. Independent challenge. Breakers that revoke tokens.
- Pipeline. Origin filters and lineage columns. Clock-injected tools. Daily surfaces that show measure and breaker state next to any ratio.
What I take from the whole machine as systems work
The control plane named the question: rulers, crowds, ranges, jobs, clocks, joints, worlds, promotion locks. The build plane decided what may be fitted to answer it: losses, shortcuts, rooms, measures, leases, feedback. Strategy without automation is notes; automation without these cards is drift. I care about shipping a machine that knows when it does not yet deserve to decide. False certainty is expensive enough that dull refusal becomes the path of least resistance.
For CEH-001 specifically: spread cloud near 1.50 [1.42, 1.58], curve cloud near 2.10 [2.01, 2.22], midpoint 1.80 denied at every layer that tries to manufacture it (loss, cue, illegal room, drift hedge, quiet decay, or self-print loop).
Done-chain card as ADR
“Done” is not a bigger model. It is a replayable chain of hashes. That decision is itself an ADR:
| ADR field | SHIP definition for CEH-001 |
|---|---|
| Context | Endogenous loops and ungrounded claims can launder fiction into train and serve. |
| Options | Ship on eval smile; ship on model size; ship only when loss/shortcut/contract/measure/lease/feedback hashes pass. |
| Decision | SHIP requires the full chain; missing any hash is escalate-only or refuse, not a yellow chat story. |
| Consequences | Autonomy stays narrow; dual clouds ~1.50 / ~2.10 stay dual; 1.80 never a Clearance output. |
| Gate predicate | all of: loss_hash, shortcut_report_hash, info_contract_hash, measure_hash, monitors_armed, anti_feedback_green, evidence_ids. |
| Hash | ship_bundle_hash over the chain; Clearance and promote consume it. |
Book Ch 18 pipeline stages and Ch 22 harness rights are how this ADR becomes CI. W1–W9 done weights in the book storyboard are the same predicates packaged for operators.
What to lock for SHIP
- Loss card hash present (fail closed if missing).
- Shortcut report hash present with numeric ablation.
- Information contract hash present with four-room canaries green.
- Measure card hash present with remove-drift and residual pass.
- Live lease monitors armed with meeting-free revoke.
- Anti-feedback origin hygiene green; lineage queryable.
- Evidence ids on numeric claims; independent challenge signed.
- CEH-001 dual clouds still dual; 1.80 never a Clearance output.
- Missing any line: escalate-only or refuse, not a yellow story in chat.
The flow in one breath
Problem: endogenous loops and ungrounded claims launder fiction into training. Solution: anti-feedback rules, evidence ids, independent challenge, loop-aware monitors, staged autonomy. Ship means a replayable chain across loss, shortcut, contract, measure, lease, and feedback hygiene, not a bigger network.
My own answer stays practical. Done is when dull refusal is cheaper than false certainty, and when 1.50 versus 2.10 can remain visible without someone needing a peace number to feel finished.
A CEH-001 demo that looks finished
| Stage | Demo-first path | What capital needed | Outcome |
|---|---|---|---|
| Train | Unbound notebook; compromise labels near 1.80 | Loss card; midpoint deny in objective | Weights learn peace |
| Demo | Agent marks + hedge; gateway denies one tool for show | Same graph as production | Applause |
| Filters | PII, rate limit, allowlist green | Doors only | Screenshot “governed” |
| Eval | No powered hard slice; no search card | three-way on frozen pack | Silent promote path open |
| Serve | Lease missing; filters instead | Clearance scope + dual-frame refuse | 1.80 can spend |
| Honest dual | Not first-class | 1.50 [1.42, 1.58] and 2.10 [2.01, 2.22] | Gap 0.60 hidden |
Tuesday demo: agent marks CEH-001, proposes a hedge, and the gateway denies a forbidden tool once for show. Applause. Friday promote: no DISCOUNT_FRAME hash, no dual-frame refuse, no powered delta on hard slice, no search card. The model learned a compromise mark culture near 1.80 because the training path never had a midpoint deny. Filters still green. Dual marks near 1.50 and 2.10 never became first-class objects; only the midpoint survived the demo path into labels.
That is the unfinished product. Not missing a filter. Missing rooms: ingest contract, frame card, loss binding, frozen exam, three-way promote, lease-bound serve, living monitor that can revoke.
Book: Chapter 18 in Rulers Before Models.