Authored design — 2026-09-15. Section 3. This cascade elaborates the existing checklist item. It is not a dispatch, implementation receipt or completion verdict. Work outside WM-01–14 still requires Joe’s explicit greenlight; having a cascade is necessary but not permission.
Section 3/4 index · Exact TODO · Cascade JSON
A trip report is only the beginning of self-monitoring. The node requires authentic detection, the appropriate response, applicable commitment composition and verified restoration.
R20 self-monitoring. PARTIAL: genuine-trip snapshot/history, applicable trip→R14 composition, discharge restoration and actual decision effect; catalogue-wide coverage not implied by narrow receipts. Built evidence: Live trips (including loaded-code drift), refusing checks and bounded Agency reliability receipts
This is the checklist’s dated evidence account, not a new deployment census. Existing source/test evidence keeps its bounded credit. The acceptance obligation above governs this design.
Pattern: aif/interoceptive-tripwires
Name the actual tripwires, observed runtime sources, detection windows and known limits. Produce a scoped coverage map rather than claim unknown-failure completeness. Historical seed response policies do not override current stop rules.
Pattern: aif/interoceptive-tripwires
Retain the triggering evidence, frozen snapshot, history and effective loaded/source identities. A synthetic control tests detection only; distinguish it from an independently observed live trip.
Pattern: wm-connected-learning/modulation-needs-an-applicable-consumer
Follow the ruled safety/stop response and applicable trip-to-R14 composition. Record active factors, modes and effective values. Do not invoke a seed’s nonblocking wording to bypass a required refusal.
Pattern: wm-connected-learning/modulation-needs-an-applicable-consumer
Retain independent evidence that the violated condition is resolved, restore through the authorized law and demonstrate the actual decision consumer. Narrow Agency reliability receipts cannot stand for catalogue-wide coverage.
Each node’s stated artifact is the input or constraint for the related node below. These are design dependencies, not a claim that a runtime scheduler automatically fires patterns. Existing WM producers are reused through the linked contracts; no second implementation is implied.
| From | To | Relation | Reason |
|---|---|---|---|
| R20-1 | R20-2 | requires-result | Defined invariants determine what constitutes a trip and its coverage limit. |
| R20-2 | R20-3 | requires-result | The captured trip is the input to the governed response, not a guessed multiplier. |
| R20-3 | R20-4 | requires-result | Restoration requires evidence of discharge and actual consumer state. |
| R20-4 | R20-1 | revision-feedback | A failed distinguishing control or consumer mismatch reopens the original scope/meaning; retain the failed claim rather than weakening it. Relevant controls: Test genuine/induced distinction, stale snapshot, missing discharge, ignored composition and mode saturation. Preserve detection blind spots and separate current recovery authorization. |
Retain the actual subject, source/model revision, task/occurrence, cutoff, producer and consumer for each interface. A missing field is a named gap; a default that changes the meaning is not an adapter. Reuse existing records where they satisfy these obligations. If a new component is indispensable, identify its exact TODO/cascade clause before seeking a separately bounded implementation instruction.
A source file changes while the loaded code remains old. The trip must bind both identities. Clearing a UI warning without resolving that discrepancy cannot restore the commitment state honestly.
This is a distinguishing design example, not a claimed production experiment.
Distinguishing controls: Test genuine/induced distinction, stale snapshot, missing discharge, ignored composition and mode saturation. Preserve detection blind spots and separate current recovery authorization.
Closure rule: every part of the quoted obligation must be supported by the indicated artifacts and actual connections. A useful rejection proves the rejecting boundary only. One accepted subclause does not tick the whole item. A bellback must supply the exact reviewed subject, executed checks, independent verdict and remaining clauses.
No recovery command, restart or activation is commissioned. Resolve conflicts between historical tripwire examples and current invariants before implementation.
Dependency links describe required interfaces; they do not authorize work on those items. No implementation outside the existing TODO list is approved. Publication does not select a numerical law, settle an unresolved operator ruling or authorize a run.
All seeded patterns are applied above. The JSON pins their source bytes and the governing checklist/rulings. Historical formulas, thresholds and examples in a pattern remain scoped examples unless the governing contract adopts them. This draft adds no pattern-library entries and claims no independent semantic ratification.
Reference text; historical examples and prescriptions retain the scope stated above.
@flexiarg aif/interoceptive-tripwires
@title Interoceptive Tripwires (Freeze, Record, Park, Summon)
@keywords tripwire, interoception, invariant, phase boundary, retro-trip, blind-spot map, stop-line, wedge, livelock, precision evidence
@audience anyone running a control loop live whose failures have so far been found by post-hoc archaeology
@tone technical
@style pattern
@provenance written 2026-08-30 (claude-15) from the catalogue paragraph numbered R20 in p4ng/sec-catalog.tex (PLoP 2026), so that every R-node on Figure 4 has a library pattern; wording follows the paragraph, which is the standard. The implementation on record (futon2/src/futon2/aif/tripwire.clj, 13 wires, 2026-07-16) watches the coding-cohort runner, not the AIF loop — see futon4/holes/delivery-lifecycle.v1.md §0
@see-also aif/no-self-certification aif/evidence-precision-registry
@holds-at R20 ;; pegged 2026-08-30 (claude-15): the catalogue paragraph numbered R20; see PREREG-war-machine §1b
@see-also aif/structured-observation-vector
@why R20 dossier problem: R20 solves observation of the machine's own failure trajectories: the roster places **“Interoceptive tripwires”** in EVALUATE's assurance band (`control-stages.edn:41`; control-stage/catalogue numbering). (source: futon2 holes labs wm-contract PROBLEMS-assurance-band-batch6.md, R20, The problem it solves; L3 rationale-backfill pilot, zai-1, 2026-09-05)
@how own mechanism: Weave a supplementary harness of invariant tripwires around the live run at its phase boundaries — each wire a near-infinite-precision prior over machine trajectories — so that a violation is noticed at the moment it happens, with the state still warm; a trip is surprisal that belief updating cannot explain away, and the mandated action is freeze, record, park, summon, on a ladder that degrades only toward recording. (source: this pattern's ! conclusion line; L3 rationale-backfill pilot, zai-1, 2026-09-05)
@why problems/r20-interoceptive-tripwires (L14 edge-resolution; basis: holds -- the problem node's own holds-at token covers this pattern; source: receipt runs/L14-edge-resolution.edn; zai-1, 2026-09-05)
! conclusion: Weave a supplementary harness of invariant tripwires around the live run at its phase boundaries — each wire a near-infinite-precision prior over machine trajectories — so that a violation is noticed at the moment it happens, with the state still warm; a trip is surprisal that belief updating cannot explain away, and the mandated action is freeze, record, park, summon, on a ladder that degrades only toward recording.
+ context: A loop whose constructed core (R1–R16) has been hardened and which now runs live,
where every pathology so far — wedges, livelocks, mixed code images, silently lost wakes — was
discovered afterwards, on a completed broken run.
+ IF:
You have hardened the loop's constructed core and want the machinery itself to be observable
while it runs live.
+ HOWEVER:
The loop's observation channel is task-level only: it observes the world it acts on (job
outcomes, verdicts, witnesses, QA), while its own machinery is a hidden state with no
likelihood mapping. And simulation tests of the known invariants pass by construction the
moment the known bugs are fixed, so neither channel can notice the failure modes nobody has
imagined yet.
+ THEN:
Weave a supplementary harness of invariant tripwires around the live run at its phase
boundaries. Each wire is a near-infinite-precision prior over machine trajectories — turn
conservation, ledger closure, review-commit provenance binding, append-only repair stores and
their status lattice, wedge and livelock detectors, wall-clock overrides, loaded-code/file-code
coherence, and an environment-alphabet wire on which any unknown job state trips rather than
defaulting. A trip is surprisal that belief updating cannot explain away, and the mandated
epistemic action is freeze, record, park, summon: write the frozen state as a durable report,
open a typed stop-line through the loop's own repair machinery, park an investigation join and
summon the outer reviewer, on a fail-safe ladder that only ever degrades toward recording,
never toward blocking the run. Calibrate before arming: the wires must retro-trip on the known
incident corpus (a wire that does not fire on the known past is a dud laser), and every closed
incident thereafter must deposit either a new wire or an entry on an explicit blind-spot map.
+ BECAUSE:
This is interoception, not vision. Like any sensorium it admits no completeness theorem — it
gets identifiability checks, a measured coverage number, and a blind-spot map instead. An
organism with only a hand (R16) and a preference model (C) learns of poison from the stomach
ache, and each hotfix repairs one meal; an organism with interoceptive nerves notices at the
moment of violation and every incident leaves it permanently more observant. The trip stream
is also precision evidence about the machine itself (R7): a wire whose trips keep being
blessed as model revisions demotes itself, and a genuine trip should lower the system's
confidence in its own machinery until the finding is discharged.
+ evidence: the operational witness of 2026-07-16: eleven wires specified from the loop's own
fix-ledgers, retro-tripping 4/4 on the reconstructed incident corpus; first live catch about
itself (fifteen shadow-mode trips from a baseline captured mid-load); 43 trips 07-16..07-27,
all but one :record.
+ COUNTERFACTUAL: a blind-spot map with one entry that does not name the loop the harness was
built for is the failure this pattern must refuse — recorded against the July harness, which
watched the coding runner while the AIF loop it was meant to observe had already gone
quiet (futon4/holes/delivery-lifecycle.v1.md §0).