Authored design — 2026-09-15. Section 3. This cascade elaborates the existing checklist item. It is not a dispatch, implementation receipt or completion verdict. Work outside WM-01–14 still requires Joe’s explicit greenlight; having a cascade is necessary but not permission.
Section 3/4 index · Exact TODO · Cascade JSON
Construction can copy a selected cascade perfectly without enacting its response. R16 requires an independent account of what was actually done and what subsequently changed.
R16 actuation, including realised cascade witness. PARTIAL: exact independently witnessed execution of the selected cascade, retained guarded interpretation, re-observed outcome and continuation. Comparing the selected input to itself at construction does not prove enactment. Built evidence: Grounded machinery attempts, author/reviewer/close records and construction validation
This is the checklist’s dated evidence account, not a new deployment census. Existing source/test evidence keeps its bounded credit. The acceptance obligation above governs this design.
Pattern: wm-connected-learning/same-interpretation-predicted-and-enacted
Retain full policy, state, guards, execution history and source/model revision from selection. Produce the enactment contract; a pattern vector alone omits the semantics that determine behavior.
Pattern: aif/grounded-actuation-not-reobservation
Execute only the selected task-specific interpretation under actual available information. Retain attempts, guard decisions and partial failures. A code commit is not required when the authorized work is a data or specification artifact.
Pattern: aif/grounded-actuation-not-reobservation
Query the appropriate external substrate using criteria derived from the authored task bindings. Produce a shape-appropriate witness of the actual effect, not the builder’s copied input or its own success field.
Pattern: wm-connected-learning/same-interpretation-predicted-and-enacted
Compare selected and enacted semantics, re-observe the outcome independently and bind it to the next belief/choice. Keep re-observation distinct from proof that the act occurred; preserve mismatches for interpretation revision.
Each node’s stated artifact is the input or constraint for the related node below. These are design dependencies, not a claim that a runtime scheduler automatically fires patterns. Existing WM producers are reused through the linked contracts; no second implementation is implied.
| From | To | Relation | Reason |
|---|---|---|---|
| R16-1 | R16-2 | requires-result | The selected semantics constrain which act is authorized. |
| R16-2 | R16-3 | requires-result | Actual execution supplies the subject for independent witnessing. |
| R16-3 | R16-4 | requires-result | The witness and independent outcome make correspondence and continuation testable. |
| R16-4 | R16-1 | revision-feedback | A failed distinguishing control or consumer mismatch reopens the original scope/meaning; retain the failed claim rather than weakening it. Relevant controls: Reject input-compared-to-itself, wrong operation shape, invented code change, altered guard history and outcome from another occurrence. Include partial actuation and truthful failure. |
Retain the actual subject, source/model revision, task/occurrence, cutoff, producer and consumer for each interface. A missing field is a named gap; a default that changes the meaning is not an adapter. Reuse existing records where they satisfy these obligations. If a new component is indispensable, identify its exact TODO/cascade clause before seeking a separately bounded implementation instruction.
A handoff specification is the requested deliverable. Forcing a code change would create fake work. The proper witness checks the specified handoff artifact and the recipient-facing criterion; copying its predicted contents into a receipt does not qualify.
This is a distinguishing design example, not a claimed production experiment.
Distinguishing controls: Reject input-compared-to-itself, wrong operation shape, invented code change, altered guard history and outcome from another occurrence. Include partial actuation and truthful failure.
Closure rule: every part of the quoted obligation must be supported by the indicated artifacts and actual connections. A useful rejection proves the rejecting boundary only. One accepted subclause does not tick the whole item. A bellback must supply the exact reviewed subject, executed checks, independent verdict and remaining clauses.
WM-03 · WM-09 · WM-11 · WM-12 · R2 · R3
Any new live execution remains explicitly commissioned. No actuation is authorized by publishing this design.
Dependency links describe required interfaces; they do not authorize work on those items. No implementation outside the existing TODO list is approved. Publication does not select a numerical law, settle an unresolved operator ruling or authorize a run.
All seeded patterns are applied above. The JSON pins their source bytes and the governing checklist/rulings. Historical formulas, thresholds and examples in a pattern remain scoped examples unless the governing contract adopts them. This draft adds no pattern-library entries and claims no independent semantic ratification.
Reference text; historical examples and prescriptions retain the scope stated above.
@flexiarg aif/grounded-actuation-not-reobservation
@title Grounded Actuation, Not Re-Observation (the loop closes outside the model)
@sigils [🐜/专]
@audience fulab agents, aif implementers
@tone technical
@style pattern
@holds-at R16 ;; pegged 2026-08-30 (claude-15): the catalogue paragraph numbered R16 in p4ng/sec-catalog.tex; see PREREG-war-machine §1b
@why aif/no-self-certification
@see-also aif/scheduled-observer-entrypoint
@why R16 dossier problem: R16 solves what makes a selected action an intervention rather than another internal calculation: the roster places **“Grounded actuation”** in ACT (`p4ng/empirics-futon/control-stages.edn:28-31`; control-stage numbering). (source: futon2 holes labs wm-contract PROBLEMS-r16-r13-r14-batch4.md, R16, The problem it solves; L3 rationale-backfill pilot, zai-1, 2026-09-05)
@how own mechanism: A closed action–perception loop (R16) requires the act to write an ungameable witness to a substrate OUTSIDE the generative model, and that witness to feed the next decision. Re-running your own constructor and scoring how faithfully it reproduced its own diagram is a mirror, not an act. (source: this pattern's ! conclusion line; L3 rationale-backfill pilot, zai-1, 2026-09-05)
@why problems/r16-grounded-actuation (L14 edge-resolution; basis: holds -- the problem node's own holds-at token covers this pattern; source: receipt runs/L14-edge-resolution.edn; zai-1, 2026-09-05)
! conclusion: A closed action–perception loop (R16) requires the act to write an ungameable witness to a substrate OUTSIDE the generative model, and that witness to feed the next decision. Re-running your own constructor and scoring how faithfully it reproduced its own diagram is a mirror, not an act.
+ context: R16 asks the loop to close — action feeds back, changes the world, and the changed world changes the next belief/decision ("act → world → observe → act"). The enactment seam is where a deliberating agent becomes an acting one.
+ IF:
You want a genuinely closed action–perception loop: the agent selects a policy, acts on it, and the world it observes on the next tick is materially different because it acted.
+ HOWEVER:
This is seductively easy to fake. An "enactor" that re-runs the fold/construction engine and measures coverage-ΔG over how faithfully the builder reproduced the diagram produces a perfectly honest number over a quantity that CANNOT MOVE — the mission's open-hole-count never changes, so the recommendation repeats forever and the loop reports green. Honesty about a quantity that cannot move is still inertia. The tell: `:realized-G` is computed by re-observing the construction the executor itself just built (the anti-tautology cross-check can be present and the loop still be causally sealed from the world).
+ THEN:
Close the loop only when BOTH hold. (1) The act writes a TYPED, UNGAMEABLE witness to a substrate outside the model: the sorry's endpoints proven inhabited by a query DERIVED FROM the authored bindings, not from builder claims (you cannot `touch` a typed `:capability/*` hyperedge over real `:capability`×`:mission/doc` nodes into existence — producing the structure IS the work); AND the built structure matching its CLean wiring spec box-for-box (build-match: every box's `:produces` inhabited, not just the terminal boundary). (2) That witness feeds the next decision — the deliberator re-ranks on the substrate dial. Gate "closed = ✓" on a real dial move (1/2 → 2/2), NEVER on the enactor merely firing.
+ BECAUSE:
The entire point of a perception–action loop is that action changes the world and the changed world changes the next belief. If "realized" is coverage-over-reproduction, the world never changes and the belief never updates — you have built a machine that dreams it acted. The witness must be (a) outside the model (so the model cannot author its own success) and (b) ungameable (so a builder cannot claim it), or the closure is a reflection.
+ NEXT-STEPS:
- DONE (2026-07-07, c9e1dbc): provable substrate witness — the sorry's endpoints proven inhabited via authed Drawbridge `xtdb.api/q`, derived from authored `:endpoint-bindings`, ungameable. Verified: a written `:capability/*` hyperedge is matched, an absent one is not. Evidence: futon2/src/futon2/aif/actuator_a3.clj.
- DONE (2026-07-08, 8bdff65 / 4ecf5eb): the fold emits a `clean_argcheck`-gated CLean; the structure spec becomes contractual at deposit time — a fold cannot deposit a malformed CANALIZE. Evidence: futon2/aif/fold_escrow.clj.
- DONE (2026-07-08, fdbc527): build-match — every box's `:produces` checked against the CLean, not just the terminal. The discriminating case (terminal inhabited, an interior box missing) is caught. Evidence: box-match-snapshot / build-match.
- DONE (2026-07-08): build-match on the DONE mission autoclock-in reads 2/3 and surfaces genuine drift — the clock hyperedge exists but its agent endpoints are raw strings, not typed `:person` entities. The structure check found a real substrate-schema gap, not an invented one. Evidence: futon2/holes/bindings-autoclock-in-grounding.md.
- OPEN (the second half): the deliberator does not yet re-rank on the substrate dial — the witness lands but does not change the next decision. Needs R12 (accumulated learning) + R13 (policy discrimination; the G-ties false-floor). This is the deferred long-term-memory gap; until it lands, R16 is grounded-actuation (◐), not a closed loop.
- OPEN: the live durable discharge — the act firing end-to-end (builder writes the endpoint, executor proves the dial moved 1/2 → 2/2), operator-gated.
- Anti-pattern to name explicitly: `re-observe-your-own-construction` — measuring realized outcome by re-running the constructor. If `:realized` is a function of the executor's own output, the loop is a mirror.