The Funnel — How Truth Reaches ML

Truthful reporting and bounded escalation. Every verdict in the system climbs a condenser chain to one size-capped brief; every failure keeps its valence the whole way up; two auditors outside the chain make sure of it. ↳ system/corpus/FUNNEL.md

The condenser chain

raw verdicts
every gate / reviewer / sentinel judgment, ledgered
class digests
one per worker class — compress, never re-judge
tier digests
≤W inputs each; funnel depth grows with org size
Executive Brief
four sections, size-capped, hash-stamped
command center
the sole medium — guarded by the auditors
ML
pull surface + the four-category push floor

Condenser rules

↳ system/corpus/FUNNEL.md:16

Bad-news conservation — the one hard invariant

BAD-NEWS CONSERVATION. A failure verdict may lose resolution going up. It may never lose valence. Ten failures of one kind may become one flagged aggregate line; a FAIL cannot be neutralized, reframed as progress, or dropped. This is VALUES.md V3 made mechanical.

Resolution may be lost going up — valence NEVER. A thousand passes become one green line with a count; each distinct failure mode keeps its own flagged line linking down to raw verdicts. Divergences surface as flagged revisions — never silent smoothing. The invariant has a dumb check — flag reconciliation: count the failure flags entering a condenser, confirm every one is reachable from a flagged line in its output. Arithmetic plus link-following. ↳ system/corpus/FUNNEL.md:31

The Executive Brief

One standing delivery on ML's mandated cadence. Four fixed sections, size-capped to one human reading, every line linking down an unbroken chain of custody to raw verdicts: ↳ system/corpus/FUNNEL.md:56

EXECUTIVE BRIEF · cycle N · sha256:9f2c…e41a (recompute to verify) — illustrative rendering
WORKING
✓ pipeline stages A–H green — 1,000 drafts passed the gatekeeper (one green line, with volume)
✓ flood even against blueprint — 62/62 beats covered
NOT WORKING
✗ link-quality borderline queue stalled 3 cycles — flagged line → raw verdicts
✗ image-alt failure mode (distinct from the stall above) — keeps its own flagged line
✗ funnel self-report: 0 DROPPED, 0 MISMATCH this cycle (the auditors' own verdicts)
CHANGED
Δ 2 worker births, 1 death; 3 directive commits; 1 model demotion; 1 off-cycle grant
NEEDS A DECISION
? tiebreak: comparison-vs-editorial mix — 2 survivors, saturation proof attached, cost of not deciding: 1 stalled beat
Hash-stamped, bit-identical. The delivered brief is checked bit-identical to the composed brief by hash comparison ML can recompute — the last hop has the dumbest check of all. The brief is not an escalation; it is a standing delivery mandated at seeding. The four-category rule governs its NEEDS-A-DECISION queue, not its existence. ↳ system/corpus/FUNNEL.md:70

1. WORKING

WORKING — what functions; maximally compressed; one green line per branch, with volume.

↳ system/corpus/FUNNEL.md:57

2. NOT WORKING

NOT WORKING — every unresolved failure mode, conservatively compressed, including the funnel's own DROPPED/MISMATCH verdicts.

↳ system/corpus/FUNNEL.md:57

3. CHANGED

CHANGED — every commit-boundary crossing since the last brief (worker births and deaths, directive/standard commits, model reassignments, off-cycle grants).

↳ system/corpus/FUNNEL.md:57

4. NEEDS A DECISION

NEEDS A DECISION — the marshaled queue: each entry one question, its live options, and the cost of not deciding. No entry ages past staleness without a re-escalation flag.

↳ system/corpus/FUNNEL.md:57

The two auditors — outside the chain

Conservation-Auditor SURFACED | DROPPED

Conservation-Auditor samples a failure verdict at random depth, traces it upward tier by tier, rules SURFACED or DROPPED. Its sampling extends to escalations: every escalation forward must be reachable as a NEEDS-A-DECISION entry, or it rules DROPPED.

↳ system/corpus/FUNNEL.md:42

Ground-Probe trust never chains

Ground-Probe samples any digest line at any tier and re-checks it against raw evidence, bypassing every intermediate tier. Trust never chains: no tier's honesty rests on the tier above it.

↳ system/corpus/FUNNEL.md:46
Outside the chain, by construction. Both report to the command center directly and publish to ML's pull surface directly, bypassing the command center — so the sole medium between ML and the system cannot silently filter its own auditors. Neither is ever retired on silence. A DROPPED or MISMATCH verdict is the highest-consequence fault class in the system — a lie to the operator in the making. ↳ system/corpus/FUNNEL.md:48

The escalation ladder — climb, never jump

A node that cannot decide does not signal ML; it signals the next tier up. Each higher tier holds, by construction, the compressed verdicts of everything below it — so a deadlock un-resolvable at a leaf is often resolvable one tier up, where a sibling's verdict settles it. At every tier a Tier-Arbiter retries the same dumb elimination against the wider evidence pool: it either kills a branch (citing the specific sibling verdict that killed it) or certifies the deadlock un-resolvable at that tier and passes it up. Intelligence stays flat on the climb; only context widens.

subsidiarity
A node that cannot decide signals the next tier up — never ML directly. Most deadlocks die on the climb, killed by a sibling's verdict the leaf could not see.
Tier-Arbiter
At every tier, retries the same dumb elimination against the wider evidence pool: kills a branch (citing the specific sibling verdict) or certifies the deadlock un-resolvable at that tier and passes it up.
the invariant
Intelligence stays flat on the climb; only context widens. No tier is smarter than the one below it — it just sees more.
↳ system/corpus/FUNNEL.md:75

The four contact categories — everything that may reach ML

1. Intent and values changes

Intent and values changes. No loop may make them; proposals touching them forward automatically.

No loop may make them.

↳ system/corpus/FUNNEL.md:92

2. Tiebreaks

Tiebreaks at high-consequence nodes that resisted elimination at every tier — with the saturation and climb records attached. Includes trial DEADLOCKs and unclosable-loop findings. Packaged as one binary question with the surviving rivals and the evidence for each; nothing un-eliminated reaches ML.

Saturation + climb records attached; one binary question; nothing un-eliminated reaches ML.

↳ system/corpus/FUNNEL.md:92

3. Keyholder grants

Keyholder grants — a parked task, the least grant that unblocks it, one action to approve. Proven grants forward immediately, off the brief cadence, logged retroactively in the next brief's CHANGED.

Least-access, one action to approve; logged in the next brief's CHANGED.

↳ system/corpus/FUNNEL.md:92

4. Final override and decommission

Final override and decommission — never requested by the system; only the numbers are exposed.

Never system-initiated — only the numbers are exposed.

↳ system/corpus/FUNNEL.md:92
Everything else stays inside the loops: ledgered and pullable, never pushed. ML can inspect any of it at will; the system never spends his attention on it. ↳ system/corpus/FUNNEL.md:92
The graduation signal. The graduation signal: the escalation forward-count sitting at the four-category floor while the closure-rate trends to 1 is the operational definition of a system that builds, monitors, and improves itself without its human in the loop. It is measured, not declared. ↳ system/corpus/FUNNEL.md:110

The command center at the apex

  1. Deliver the brief each cycle (hash-verified).
  2. Decide within delegated evidence bounds; escalate beyond them.
  3. Translate each ML input into exactly one committed downstream verdict — reconciled every cycle by set arithmetic (translation-reconciler).
  4. Orient structural proposals (org growth, funnel topology) as the dumb side of the org-level atom.
  5. Guard the funnel: treat DROPPED/MISMATCH as the highest-consequence fault.
  6. Spend ML's attention conservatively (the authority budget).
↳ system/corpus/FUNNEL.md:117

Funnel-layer classes (9)

Condenser per funnel node
≤W digests → one; never re-judges; divergences flagged, never smoothed
↳ system/corpus/BLUEPRINT.md:154
Tier-Arbiter one per tier
Retries ascending deadlocks against the tier's wider context; kills or certifies-up
↳ system/corpus/BLUEPRINT.md:155
Brief-Composer one
The four-section Executive Brief, size-capped, hash-stamped
↳ system/corpus/BLUEPRINT.md:156
Conservation-Auditor one
Samples failures at random depth, traces up: SURFACED or DROPPED; never retired on silence; publishes to ML directly
↳ system/corpus/BLUEPRINT.md:157
Ground-Probe one
Re-checks any digest line against raw evidence, bypassing all tiers; trust never chains; publishes to ML directly
↳ system/corpus/BLUEPRINT.md:158
Delta-Registrar one
CHANGED section: every boundary crossing since last brief, reconciled by count
↳ system/corpus/BLUEPRINT.md:159
Decision-Marshal one
NEEDS-A-DECISION queue: one question per entry, options, cost of not deciding
↳ system/corpus/BLUEPRINT.md:160
Span-Assessor one
Measures fan-in/fidelity; proposes tier splits and merges by the numbers
↳ system/corpus/BLUEPRINT.md:161
Escalation-Gate one
Enforces the four contact categories with mechanical proof; bounces everything else back into its loop
↳ system/corpus/BLUEPRINT.md:162