Assumptions & Invariants Ledger

Assumptions & Invariants Ledger

Version: 1.0.0
Last Updated: 2026-01-03

---

Assumptions

Assumptions are things the project relies on that could be false. If violated, specific parts break.

### A-INS-001: DELL provides z-trajectory
Assumption: The DELL latent engine streams z(t) embeddings at consistent intervals.
What breaks if false: Claim detectors have no input, inscriptions cannot be generated.
Detection: Monitor DELL stream health, alert on gaps > 10s.
Mitigation: Buffer last-known z(t) and emit degraded-confidence claims.

### A-INS-002: Graph Kernel enforces admissibility
Assumption: All evidence retrieval for Echo claims goes through the Graph Kernel.
What breaks if false: Echo claims could reference non-admissible evidence, provenance is broken.
Detection: Audit Echo claims for valid slice_id references.
Mitigation: Reject Echo claims without verified admissibility tokens.

### A-INS-003: Basins are rare relative to samples
Assumption: The number of graduated basins is << number of z-trajectory samples.
What breaks if false: Lexicon becomes unmanageably large, phrase compression fails.
Detection: Monitor basin count, alert if > 100 basins per user per month.
Mitigation: Increase graduation threshold, retire low-dwell basins.

### A-INS-004: N'Ko sigils are Unicode-stable
Assumption: The 10 N'Ko characters (ߛ, ߜ, ߕ, ߙ, ߡ, ߚ, ߞ, ߣ, ߠ, ߥ) have stable Unicode codepoints.
What breaks if false: Rendering breaks across systems, corpus becomes unreadable.
Detection: N/A (Unicode codepoints are standardized).
Mitigation: Store codepoints (e.g., U+07DB) alongside rendered characters.

### A-INS-005: Lexicon versions are append-only
Assumption: New lexicon versions only add or rename tokens, never delete.
What breaks if false: Old inscriptions reference undefined tokens.
Detection: Schema validation rejects lexicon versions that remove tokens.
Mitigation: Mark tokens as deprecated rather than deleted.

### A-INS-006: Claim types are exhaustive for z-dynamics
Assumption: The 10 claim types cover all meaningful z-trajectory patterns.
What breaks if false: Undetected patterns go unrecorded, corpus is incomplete.
Detection: Monitor "unknown event" rate in detector output.
Mitigation: Add claim type 11+ via lexicon extension (requires charter amendment).

---

Invariants

Invariants must NEVER be violated. Violations trigger immediate alerts and investigation.

### INV-INS-001: Sigil Immutability
Invariant: The 10 operator sigils MUST never change assignment.
Why it exists: Ensures all inscriptions are readable across all lexicon versions.
What breaks: Historical corpus becomes ambiguous, parsing fails.
Canary: Lexicon schema validation rejects sigil changes.

### INV-INS-002: IR Primacy
Invariant: The typed IR is the source of truth; N'Ko surface is a derived view.
Why it exists: Enables re-rendering with new lexicons without data loss.
What breaks: N'Ko-only storage loses structured data, provenance is incomplete.
Canary: Every Inscription struct contains both `claim: Claim` and `surface: NKoLine`.

### INV-INS-003: Non-Retroactive Lexicon
Invariant: Old inscriptions MUST never be rewritten; reinterpretation is a separate view.
Why it exists: Preserves historical corpus integrity and auditability.
What breaks: Provenance chain is invalidated, trust in historical claims is lost.
Canary: Inscription storage is append-only; no UPDATE on corpus tables.

### INV-INS-004: Claim-Evidence Binding
Invariant: Every claim MUST reference its source evidence (z-window, slice_id, or none).
Why it exists: Enables tracing claims back to measurements.
What breaks: Claims become unverifiable assertions (hallucinations).
Canary: `Claim::evidence_ref()` method returns `EvidenceRef`, never `None` for non-Novel claims.

### INV-INS-005: Basin Identity Stability
Invariant: A BasinId MUST never change once assigned to a graduated basin.
Why it exists: Enables cross-session tracking and phrase detection.
What breaks: Return claims can't detect re-entry, basin lifecycle breaks.
Canary: Basin table has unique constraint on id; no UPDATE on id column.

### INV-INS-006: Proto-Basin Expiry
Invariant: Proto-basins MUST expire if graduation criteria aren't met within threshold.
Why it exists: Prevents infinite accumulation of spurious proto-basins.
What breaks: Ontology bloats, novelty detection becomes meaningless.
Canary: Cron job marks expired proto-basins as RetirementType::Spurious.

### INV-INS-007: Confidence Bounds
Invariant: Confidence values MUST be in [0, 1].
Why it exists: Enables meaningful comparison and aggregation.
What breaks: Confidence loses semantic meaning, ranking breaks.
Canary: `Confidence::new()` clamps input to [0, 1].

### INV-INS-008: TimeWindow Validity
Invariant: TimeWindow MUST satisfy t0 <= t1.
Why it exists: Duration calculations and ordering depend on valid windows.
What breaks: Negative durations, invalid queries, panics.
Canary: `TimeWindow::new()` asserts t0 <= t1.

---

Canary Implementation Checklist

---

Incident Response Triggers