mesh/1: bind what taught the weights, not only which weights answered #612
Loading…
Reference in a new issue
No description provided.
Delete branch "mesh/decision-training-provenance"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
mesh/1can already prove that a decision's answer reproduces: §3.6 bindsweights_digestandprecision, so a verifier re-runs the forward pass and gets the same probabilities. What it cannot say is where those weights came from — and a decision model is ordinarily fitted to a corpus of earlier decisions, which is what decides which answer the probabilities favour before any request arrives. A receipt binding the weights and not the corpus proves the answer reproduces while leaving unanswerable what taught it to answer that way.§3.7 — two OPTIONAL fields, paired
training_digesttraining_authoritysigned,loggedoropaque.The three authorities are the point of the field, because a digest alone says which corpus, not whether anyone can check it:
signed— every record carries a signature over its own content by the principal that produced it, so a third party can check the corpus without trusting whoever trained on it. A corpus drawn from the accepted transitions of a signed op-log is this case.logged— append-only with an attested head: removal and reordering are detectable, individual records are not attributable to a principal.opaque— bytes and a digest. Substitution of the whole corpus is still detectable; nothing is established about the records in it.Paired and optional for the same reason §3.6's two fields are: the absence is the signal. A verifier distinguishes an unattributable model from an attributable one instead of having to assume.
It also forbids a claim
A fitted decision model is usually introduced because it is cheaper than the generation it displaces, and a receipt MUST NOT state that saving. Those joules were never metered, because that generation was never run.
uj_per_decisionis a measured figure; a difference against an unrun alternative is not, and a receipt carrying one would assert an estimate in a field a reader is entitled to read as measurement. An operator who wants the comparison runs both and keeps both receipts — the difference then lives between two sealed figures rather than inside one of them as a claim about the other.Scope and honesty
conformance/v1/is a generation; both fields are decision-only and OPTIONAL, soreference/signed_core.hexandreference/envelope.hexare unchanged and need no regeneration.training_digest. The spec says how such a model is bound; the fit that emits one is in INGEST.md's Adding list rather than claimed as shipped.INGEST.mdgains themesh/section it never had.Noted, not fixed here
INGEST.mdis dated 2026-05-23 and has drifted: 4 sections for 22 standards, aRust 1.95.0pin where the rootrust-toolchain.tomlsays1.98.0, and 12 links to github.com issues, which is not where this project's issues live any more. Reconciling it is a separate job and would bury this diff.Guards run locally, all clean: comparative prose (4104 files), vanity metrics (523 Markdown files), spec refs (1966 citations across 17 standards, all resolve), orphan sources.
🤖 Generated with Claude Code
§3.6 already makes a decision receipt verifiable **by re-execution**: with `weights_digest` and `precision`, a verifier runs the forward pass again and gets the same probabilities. That settles whether this answer came from these weights. It says nothing about where the weights came from — and a decision model is ordinarily fitted to a corpus of earlier decisions, which is what decides which answer the probabilities favour before any request arrives. §3.7 adds that binding as two OPTIONAL fields, paired the way `weights_digest` and `precision` are because neither carries the claim alone: training_digest BLAKE3 over the canonical encoding of the corpus records in the order the fit consumed them, each as its content id. The order is in the address because it is part of what the fit consumed. training_authority what a verifier can DO with that corpus: `signed` (every record signed by the principal that produced it, so a third party can check it without trusting whoever trained on it), `logged` (append-only, attested head, so removal and reordering are detectable, but records are not attributable), or `opaque` (bytes and a digest). As with `weights_digest`, the absence is the signal: a verifier distinguishes an unattributable model from an attributable one instead of assuming, which is the only reason these are optional rather than required. The section also forbids something. A fitted decision model is usually introduced because it is cheaper than the generation it displaces, and a receipt MUST NOT state that saving: those joules were never metered, because that generation was never run. `uj_per_decision` is a measured figure, and a difference against an unrun alternative is not — a receipt carrying one would assert an estimate in a field a reader is entitled to read as measurement. An operator who wants the comparison runs both and keeps both receipts, so the difference lives between two sealed figures rather than inside one of them. Conformance vectors do not move. The published reference serve in `conformance/v1/` is a generation, and both fields are decision-only and OPTIONAL, so `reference/signed_core.hex` and `reference/envelope.hex` are unchanged and need no regeneration. Nothing in this repository yet produces a `training_digest`. The spec now says how such a model is bound; the fit that emits one is in INGEST.md's Adding list, which is honest about the order these landed in. INGEST.md also gains the `mesh/` section it never had. Noted while there and NOT fixed here, because it is a separate job: that file is dated 2026-05-23, carries 4 sections for 22 standards, pins "Rust 1.95.0" where the root `rust-toolchain.toml` says 1.98.0, and routes 12 links to github.com issues, which is not where this project's issues live any more. Guards run locally, all clean: comparative prose (4104 files), vanity metrics (523 Markdown files), spec refs (1966 citations across 17 standards, all resolve), orphan sources. Co-Authored-By: Claude Opus 5 <[email protected]>