The problem we left open
Bolted guardrails leave incomplete pipelines: filters at the edge, empty rooms behind them. CEH-001 can demo under an allowlist and still ship midpoint peace because train, eval, and promote never had to refuse. Content safety, tool policy, and model-risk harnesses got collapsed into one word, “guardrails,” and only the visible doors shipped. The question now is what a finished path looks like.
The solution, as one stack
Five moves. One path. Each stage owns a card and a refuse edge. Demo must be a projection of the same graph, not a side entrance. This is shift-left (quality gates early) plus defense-in-depth (independent fail reasons), written as a product path rather than a security slide. SR 11-7-style lifecycle completeness for classical models is the regulatory rhyme: inventory, development controls, validation, and ongoing monitoring; AI stacks re-discover it when promote is only a merge button.
1. Data and feature stages with contracts. Ingest refuses bad schema, unsigned vendors, skewed clocks. Feature and world stage refuses leakage canaries, illegal tenors, silent ruler changes, and frame mismatches. Soft leakage (aggregates, agent memory, label sanctity, latest-tool defaults) is in scope, not only future timestamps. For CEH-001 the dual frames, spread near 1.50 and curve near 2.10, enter as named objects with hashes, not as comments in a notebook.
2. Train bound to a loss card. Fit refuses loss-card mismatch, unbound recipes, and shortcut cues the card forbids. The objective that produced the weights is an artifact, not a memory. Midpoint invention as a training target is a hard fail. If the loss rewards sounding settled between two legal frames, the model will learn 1.80 peace even when serving filters look perfect.
3. Powered eval as a CI stage, not a wiki. Score and evaluate run on frozen packs with search cards and three-way verdicts (allow / refuse / inconclusive). Inconclusive blocks promote. Uncorrected best-of-N blocks promote. Calm-only packs without hard slices block promote for rights that touch stress autonomy.
4. Serve under Clearance leases, not registry labels. Act refuses spend without a lease scope, path budget, and allowlist. Serving filters still matter; they sit after the lease, not instead of it. A green gateway with no lease is still unfinished. Path budgets under named worlds prevent free simulation courage from becoming free live courage.
5. Living monitors that can revoke. Monitor refuses silent live shift without a change packet, coverage collapse without degradation, and family coupling breaches without retirement hooks. Pager without revoke is journalism. Revoke without a meeting is the point. Inventory from live traffic feeds the book plane later (Ch 27).
stage graph (each edge can REFUSE):
ingest > feature/world > fit > score > eval > promote > act > monitor
cards: schema, as-of+frame, loss, coverage, exam+search,
coupling+scheme, lease+budget, live-shift
promote needs: eval ALLOW ∧ budgets ∧ coupling ∧ scheme ∧ lease scope
demo path ⊆ same graph (no bypass)
Anti-feedback hygiene belongs on this path. If promoted marks re-enter training labels without a packet, the system prints its own confidence. Measure the loop: self-print rate, label lag, and whether dual-frame disagreement collapses because labels collapsed.
CEH-001 on the happy path (and three deaths)
| Stage | Card / check | Happy path | Unhappy refuse |
|---|---|---|---|
| Ingest / feature | Schema + dual-frame hashes | 1.50 and 2.10 named | Vendor clock skew; silent convention swap |
| Fit | Loss card | Penalizes midpoint peace | 1.80 as soft training target |
| Eval | Exam hash + search + MDE | ALLOW after Holm; hard slice present | Calm-only green; INCONCLUSIVE for stress rights |
| Promote | Coupling + scheme + lease | Hashes on ticket | Demo-only path; missing exam hash |
| Act | Clearance lease | Escalate-only size under named worlds | Gateway green, no lease |
| Monitor | Revoke hooks | Can burn lease | Pager without rights change |
Research proposes a challenger. Ingest and feature stages pass with dual-frame cards hashed. Fit binds a loss that penalizes midpoint peace and dual-frame lying. Eval on the frozen hard-plus-calm pack returns ALLOW after Holm on three siblings, MDE cleared, interval honest. Promote checks book coupling and scheme card. Lease issues escalate-only size for CEH-001 under named worlds. Serve filters still run. Monitor holds the right to burn the lease if coverage or dual-frame honesty breaks.
Unhappy paths that should die early:
- Demo agent proposes 1.80 as reconciliation. Frame stage or score stage refuses DUAL_MARK_MIDPOINT before any gateway filter sees a string.
- Calm eval green, hard slice missing: promote refuses for stress rights even though the demo looked flawless.
- Vendor clock skew at ingest: the path dies before fit burns GPU on illegal time.
CI promote as a state machine, in words: ticket accepted only with hashes; hard gates run; statistical three-way runs; if inconclusive, state is blocked, not half-open; if allow, coupling and scheme gates run; if those pass, lease mints with scope and expiry; act spends only under lease; monitor can burn lease into escalate-only without a change-advisory board. Any jump that skips a state is a demo path wearing production clothes.
CEH-001 anti-feedback detail: if Friday’s midpoint-denying refuse never happened and 1.80 entered labels, Monday’s train will learn peace. The pipeline must refuse re-ingest of unframed marks into training. That refuse edge is as important as the gateway deny that impressed the stakeholder.
What breaks in the trenches without the stage graph
- Model trench: evaluate as report that cannot block; promote treats eval allow as the only precondition.
- Agent loop trench: demo tools not subset of production graph; extra “reconcile to mid” tool.
- Harness trench: leases cached across scheme or vendor bumps; monitor tickets as the only revoke path.
- Pipeline trench: self-print labels re-enter train; dual-frame disagreement collapses overnight and looks like good news.
Harness-as-product ADR
| ADR field | Stage-graph decision |
|---|---|
| Context | Demo-first stacks bolt filters and skip harness rooms; midpoint dies in a content filter if at all. |
| Options | Demo wrap around a notebook; stage graph from ingest to monitor with refuse edges; promote as lease. |
| Decision | The harness is the product; demo path ⊆ production graph; each stage has owner, card, refuse code. |
| Consequences | CEH-001 midpoint dies at frame or score stage; only ALLOW + budgets + coupling + scheme + lease scope promotes. |
| Gate predicate | eval ALLOW; anti-feedback origin filters; DUAL_MARK_MIDPOINT hard fail; monitor revoke without meeting. |
| Hash | stage_graph_version + per-edge card hashes. |
Book Ch 18 (pipeline stages) and Ch 8 (three-way verdict) are the constitution behind this card. Eval without refuse / inconclusive is not a harness; a demo that cannot fail closed is unfinished software.
What to lock before automation
- Stage table with owner, card schema, and refuse code per edge.
- Demo path ⊆ production graph (enforced, not policy prose).
- Promote preconditions: eval ALLOW and budgets and coupling and scheme and lease scope.
- Anti-feedback origin filters on training labels.
- Monitor revoke without meeting for first-step degradation.
- CEH-001 dual-frame hashes mandatory; DUAL_MARK_MIDPOINT hard fail.
The flow in one breath
Problem: demo-first stacks bolt filters and skip harness rooms. Solution: one stage graph from ingest to monitor, each with a card and a refuse edge; powered eval and leases on the promote and act path; demo is a projection, not a bypass; anti-feedback refuses self-print. Example: CEH-001 midpoint dies at frame or score, not at a content filter; only a fully gated challenger earns a lease. Next: Ch 27, when a folder of single-name greens is still one joint bet.
CEH-001 week walked through the ship stack
| Move | Live evidence | Rights action |
|---|---|---|
| 1. Binding shadow | Dual-frame diverge; shadow drifts toward ~1.80 | Auto size freezes; escalate-only |
| 2. Hard-mix canary | Hard hours fail C vs champion; calm 1% green | Calm green insufficient for stress rights |
| 3. Live three-way | Inconclusive on calm superiority; refuse on midpoint behavior | No widen; deny 1.80 |
| 4. Ladder | Shadow delta + monitors trip | Step down; quiet hour does not auto-restore |
| 5. Inventory | Vendor bump, shadow deltas, canary hard fails | Book retirement hook if cousins rhyme |
| Honest marks | Humans mark near 1.50 and 2.10 | Dual clouds remain dual |
| Inventory toy | 40,000 units | 0.60 gap still money; rights stay escalate-only |
Walk a second challenger through the same ladder under pressure. Calm eval was plus two and underpowered. Old theater would shadow politely, canary calm flow, and widen anyway. Now: binding shadow freezes auto size when dual-frame marks diverge and shadow drifts toward midpoint peace. Hard-mix canary fails the challenger relative to champion; calm one percent green is not enough. Live verdict is inconclusive on calm superiority and refuse on midpoint behavior. Degradation ladder steps down; a quiet hour later does not silently restore full autonomy. Inventory records the vendor bump that tried to inherit old rights, the shadow deltas, and the canary hard fails; if cousins rhyme the same week, the book retirement hook can sunset the coupled set instead of opening three “watching it” tickets.
End state: you still roll out carefully. You still learn from live traffic. You just stop letting the words shadow and canary substitute for Clearance power.
E-process spirit in one paragraph. Continuous monitoring wants to look every day. Classical fixed-sample tests do not allow free peeking. An e-process accumulates evidence as a non-negative martingale betting against a null of adequacy; crossing a threshold is valid at any stopping time. Wire that threshold to ladder steps and you get statistically honest continuous refusal, not a chart that waits for a committee.
What operators get wrong after they name the ladder: they make the first step advisory; they let quiet hours auto-restore full autonomy; they canary only on calm; they treat inconclusive live disagreement as ship-with-watch; they never write vendor bumps as packets; they keep inventory in slides instead of retirement state. Soft ladders are cameras with extra rungs.
Book: Chapter 22 in Rulers Before Models.