Authored design — 2026-09-15. Section 3. This cascade elaborates the existing checklist item. It is not a dispatch, implementation receipt or completion verdict. Work outside WM-01–14 still requires Joe’s explicit greenlight; having a cascade is necessary but not permission.
Section 3/4 index · Exact TODO · Cascade JSON
A checker cannot establish its own authority from records it staged. Independent certification needs authentic commissions and an admitted trust origin as well as a correct predicate.
R9 independent certification. OPEN: authenticated genesis, retained exact review commissions, independent producer/reviewer binding and production consumer. Parking deployment does not satisfy this node. Built evidence: Refusing join checker, real-pair partial joins, typed anchor refusal
This is the checklist’s dated evidence account, not a new deployment census. Existing source/test evidence keeps its bounded credit. The acceptance obligation above governs this design.
Pattern: aif/no-self-certification
Identify the ruled genesis/admission procedure and distinct producer/reviewer roles. Produce an authority chain with original commissions. If the anchor remains unruled or absent, retain that refusal; do not manufacture a convenient self-issued anchor.
Pattern: wm-qualifying-run/certificate-and-world-must-meet
Join reviewed source/model/run identities to original commission bytes, reviewer identity and verdict. Produce an authenticated subject envelope; a quoted summary or historical filename is not the commissioned preimage.
Pattern: aif/no-self-certification
Check the reviewer acted independently on this subject and that evidence was not manufactured by the verdict-maker. Evaluate actual semantic predicates; tags alone do not establish origin.
Pattern: wm-qualifying-run/certificate-and-world-must-meet
Retain the checker’s result at the consumer that permits or refuses advancement. Exercise a valid independently admitted chain as well as negative cases. A correctly refusing unanchored checker remains incomplete for positive certification.
Each node’s stated artifact is the input or constraint for the related node below. These are design dependencies, not a claim that a runtime scheduler automatically fires patterns. Existing WM producers are reused through the linked contracts; no second implementation is implied.
| From | To | Relation | Reason |
|---|---|---|---|
| R9-1 | R9-2 | requires-result | The authority chain determines whose subject review can count. |
| R9-2 | R9-3 | requires-result | Exact binding makes the independence check about the actual claim. |
| R9-3 | R9-4 | requires-result | An independent result must govern the real certification consumer. |
| R9-4 | R9-1 | revision-feedback | A failed distinguishing control or consumer mismatch reopens the original scope/meaning; retain the failed claim rather than weakening it. Relevant controls: Reject self-review, wrong commission preimage, stale source, unanchored genesis and verdict/subject substitution. Keep the missing historical commission 20588 explicitly unavailable. |
Retain the actual subject, source/model revision, task/occurrence, cutoff, producer and consumer for each interface. A missing field is a named gap; a default that changes the meaning is not an adapter. Reuse existing records where they satisfy these obligations. If a new component is indispensable, identify its exact TODO/cascade clause before seeking a separately bounded implementation instruction.
A producer copies its own staged evidence into a reviewer-shaped record. All hashes match, but no independent reviewer acted. The checker must reject this even though a constructed table certificate succeeds.
This is a distinguishing design example, not a claimed production experiment.
Distinguishing controls: Reject self-review, wrong commission preimage, stale source, unanchored genesis and verdict/subject substitution. Keep the missing historical commission 20588 explicitly unavailable.
Closure rule: every part of the quoted obligation must be supported by the indicated artifacts and actual connections. A useful rejection proves the rejecting boundary only. One accepted subclause does not tick the whole item. A bellback must supply the exact reviewed subject, executed checks, independent verdict and remaining clauses.
Genesis choices require their recorded authority; this design does not select one or authorize a new persistence project.
Dependency links describe required interfaces; they do not authorize work on those items. No implementation outside the existing TODO list is approved. Publication does not select a numerical law, settle an unresolved operator ruling or authorize a run.
All seeded patterns are applied above. The JSON pins their source bytes and the governing checklist/rulings. Historical formulas, thresholds and examples in a pattern remain scoped examples unless the governing contract adopts them. This draft adds no pattern-library entries and claims no independent semantic ratification.
Reference text; historical examples and prescriptions retain the scope stated above.
@flexiarg aif/no-self-certification
@title No Self-Certification (A Verdict Moves Only on Evidence Its Maker Did Not Manufacture)
@sigils [⊘/⟲]
@keywords self-certification, circular evidence, prior-equals-value, independence tag, censored observation, calibration, verdict, structural enforcement, untagged-never-counts
@audience anyone building a measurement, calibration, gate, certifier, or reward channel
@tone foundational
@style pattern
@why war-room/wr-25-good-news-gets-the-same-evidence-discipline-as-bad ;; editorial, claude-13 2026-08-23: retrospective sense-making, NOT a causal
;; claim -- WR-19 did not produce this pattern. See README-flexiarg 5a.
@holds-at R9 ;; pegged 2026-08-30 (claude-15): the catalogue paragraph numbered R9 in p4ng/sec-catalog.tex; see PREREG-war-machine §1b
@how aif/measurement-window-hygiene
@see-also aif/interoceptive-tripwires
@why R9 dossier problem: Control-stage R9 solves who may certify a result: the roster places **“No self-certification”** in ACT's assurance band (`p4ng/empirics-futon/control-stages.edn:43`; control-stage/catalogue numbering). (source: futon2 holes labs wm-contract PROBLEMS-assurance-band-batch6.md, R9, The problem it solves; L3 rationale-backfill pilot, zai-1, 2026-09-05)
@how own mechanism: A measurement / verdict apparatus must never be moveable by evidence it manufactured itself. Enforce this STRUCTURALLY — with tags the apparatus cannot fake (independence, measured-vs-fallback, settled-vs-transient) and a verdict that counts only those tags — not by vigilance. (source: this pattern's ! conclusion line; L3 rationale-backfill pilot, zai-1, 2026-09-05)
@why problems/r9-no-self-certification (L14 edge-resolution; basis: holds -- the problem node's own holds-at token covers this pattern; source: receipt runs/L14-edge-resolution.edn; zai-1, 2026-09-05)
! conclusion: A measurement / verdict apparatus must never be moveable by evidence it manufactured itself. Enforce this STRUCTURALLY — with tags the apparatus cannot fake (independence, measured-vs-fallback, settled-vs-transient) and a verdict that counts only those tags — not by vigilance.
+ context: You are building an instrument that issues a verdict — "calibrated", "passed",
"admissible", "rewardable" — from evidence that the same system also produces, stages, or
scores. The verdict will look earned long before it is.
+ IF:
An instrument issues a verdict from evidence it also produces or stages (a calibrator over
its own predictions, a gate over its own outputs, a reward channel over its own scores).
+ HOWEVER:
On first contact with reality, every layer tries to certify ITSELF, and each attempt looks
rigorous: the forward model scores its own constants (`prior == value`); the evidence reader
eats its own staging files; the realised channel copies predicted on success (a censored
0.0); the calibration clears on degenerate volume. Vigilance cannot catch these — an
instrument's *first* catches are about itself, and no human watches every path.
+ THEN:
Require that a verdict may be moved ONLY by evidence the verdict-maker did not manufacture.
Tag every evidence record at birth with the properties the apparatus cannot fake —
`:independent?` (was there an out-of-band witness?), source (`:measured` vs
`:target-absent-fallback`), settledness (`:settled` vs `:transient`) — and have the verdict
count ONLY the records whose tags clear. Strictness default: **untagged never counts**.
+ BECAUSE:
Circularity is invisible from inside the loop precisely because every internal reading is
consistent with every other — that is what `prior == value` means. The only thing that breaks
it is a referent the maker had no hand in: an external witness, a settled re-read of a world
it does not control, a tag it cannot forge. Structure survives where vigilance fails, and it
converts "be careful" (unauditable) into "the tag is absent, so it does not count" (checkable).
+ canonical-instance:
The FutonZero G-SIM calibration arc (WM-pilot, 2026-06-11): four distinct self-certification
attempts surfaced live — censored fallback, transient spike, `prior == value`, and
operator-gate-as-fruit — each caught only because an independence/source/settled tag existed
to exclude it, and each then encoded as a permanent structural guard. See
`[[M-the-perfect-crime]]` (the forensic framing: the crime relocates to a scarcer witness;
this pattern is the structural half of that ladder) and the reward-red-team fixture
(the executable suite of the shapes).
+ how-to-apply:
Before trusting any "it passed", ask: did this verdict move on evidence the system made?
If yes, find the un-manufactured referent (external witness / settled read / out-of-band
tag) and gate the verdict on it. If there is none, the verdict is decoration. Minted from the
arc that learned it, WM-pilot 2026-06-11 (arc-2 cycle 13).