Evidence and Stage Evaluation Flow

Permanent flow

hostile source material
  -> source-specific acquisition constructor
  -> acquisition witness
  -> source admission
  -> condition-specific evidence-use-policy satisfaction
  -> canonical admitted-evidence snapshot
  -> pure typed predicate and RET evaluation
  -> candidate semantic attempt/completion
  -> accepted-run exact-head admission

Each arrow has one owner and mints a value carrying the relation it proved. Pure evaluation performs no provider, clock, environment, filesystem, network, authorization, storage, or dispatch I/O.

Five separate questions

1. Is the scenario law structurally valid and canonically identified?
2. Did source-specific admission establish the exact acquisition facts?
3. Does the evidence set satisfy this condition’s exact use policy?
4. Does the typed predicate and stage RET evaluate True, False, or Unknown?
5. Did the accepted-run authority accept the candidate against the exact head and stable operation identity?

No answer substitutes for another.

Failure classification

• malformed, oversized, forged, wrong-scope, or incompatible material rejects admission and mints no evidence;
• source unavailability, denial, timeout, cancellation, or resource exhaustion is operational failure and mints no semantic proposal;
• a bound source violating its schema is contract/integrity failure;
• a valid admitted value failing its predicate is semantic False;
• unresolved admissible evidence is policy-derived semantic Unknown;
• complete admitted absence may satisfy ObservedAbsent;
• stale accepted-head admission mutates nothing and requires re-derivation.

Missing input is not observed absence. Caller-supplied semantic status is never authoritative.

Initial target acquisition

The initial target permits bounded caller submission, named time observation, an allowlisted immutable environment snapshot, and rooted JSON/YAML document observation. HTTP/REST, remote MCP, subprocess/MCP stdio, arbitrary executable providers, and remote evaluators are excluded.

Current implementation

The current runtime implements this separation. Conditions and acquisition bindings are independent, source construction occurs before evaluation, canonical admitted snapshots carry the use-policy relation, and the evaluator performs no I/O. Retention explicitly determines whether later semantic replay is available; digest-only retention never overclaims reconstruction. Candidate successors enter PF-04 receipt-first exact-head admission through nominal operation identities; nonaccepted outcomes do not mutate semantic authority.

Cross-scenario facts

A fact about another run enters only as admitted evidence bound to exact external law, RunKey, accepted head, record, freshness, and authorization relations. Evaluation never recursively starts or evaluates that run.

Precheck

Precheck may run the same pure predicate/RET semantics over identical admitted semantic inputs. It mutates nothing and proves neither live acquisition nor accepted progress.