Design & Artefact
11 entriesThe conceptual model and the reference implementation. The basis model is fixed; the inheritance and admissibility methods and the library are still to come.
- The Basis Model: What It Must Represent, Before Its Structure Is Fixed Published on: This is the first artefact in the project whose downstream is rigid against it: the inheritance method, the admissibility method, the evaluation, and the conclusion are all built on top of the basis model, so oversizing it here is not a trim to undo later but a demolition. That is why the model is built minimal, and why this spine names what it must represent and to what standard rather than fixing its structure. It sets the elements the typing chapter already gestured at, the guardrail the claims register recorded against a premature inheritance rule, and the stopping condition that keeps the model minimal. It fixes no structure, sketches no library, and lists no fields of any class, because the moment it does it stops being an attackable skeleton and becomes a design fixed before it was argued.
- The Structure of a Basis Record: Fixing the Model, and the Two Forks Settled Published on: Crosses the line the spine held: fixes what a basis record holds and resolves the two forks the spine handed the drafting. A basis record is a structured object, not a score, attached to one claim: means (observation/measurement/inference/generation/report), authority, establishment time paired with rate of change, established scope, and an origin set. Fork 1 (how independence is known) is settled by the boundary, not by size: the consumer does not hold the ancestors at the handover, so independence rides on an origin set of evidential origins, tested by intersection from the crossing records alone. The load-bearing qualifier: origin is the origin of the evidence, not of the subject, or the model becomes a corroboration-refuser. Fork 2: authority kept as its own field, since it varies independently of means. The act's demand stays out, because admissibility is a relation.
- The Admissibility Method: What It Takes, Weighs, and Returns, Before the Weighing Is Fixed Published on: The method the whole discipline exists to perform: it reads a basis record against an act's demand and returns a verdict on whether that basis suffices for that act. Spined before drafting because three deferred formalisms and two deferred judgements now rest on it, and the evaluation defines its error over its verdict. Fixes what it takes (record plus the act's demand, which the record excludes on category grounds), what it weighs, and what it returns. Corrects a published count: the record equips four comparisons, not three, since the SPKI reading added authority validity after that count was written. Leaves open, for the drafting, the internal structure of an act's demand, whether a verdict must carry its reason (contestability against minimality), and how the four comparisons combine.
- The Admissibility Method: The Demand, the Combination Rule, and the Verdict Published on: The method drafted against its spine, settling the three questions the spine left open. An act's demand is four requirements, one per axis, authored by whoever proposes the act and stated in the same terms as the record, with silence on an axis meaning permission rather than a hidden default. The four comparisons combine conjunctively: a basis is admissible when it satisfies the demand on every axis, because a trade-off rule would need an exchange rate between freshness and means that does not exist, and a scoring rule would rebuild the scalar the review ruled out. Decision theory licenses combining without a scalar by dropping completeness. A verdict carries the decision and, on refusal, the axis that failed with the values compared, which is a fact about the comparison rather than an explanation of the claim's history. Closes on what the method does not do, including that it does not decide what a demand should be.
- Incomplete Records: The Third Verdict, and What It Makes Possible Published on: Real plant data will not produce complete records, so the artefact has to say what happens then. Absence in a record is not silence in a demand: silence is permission, but a missing field read as permission would make an empty record admissible for everything, and read as failure would refuse every claim a plant can currently produce. So the verdict is three-valued, adding undetermined, which names the axis that could not be evaluated and what the record would need to carry. That is more information than a refusal, and it keeps an instrumentation gap distinct from an inadequate basis. The enforcement point decides how to treat undetermined, per act and recorded, not inside the library. This makes the artefact usable before record construction is solved: a run over real data maps which acts a plant can adjudicate today, and makes the value of instrumenting a missing field measurable in acts. Costs: the evaluation must report decided and undetermined cases separately, and admitting on undetermined is a way to appear to run the discipline while avoiding it.
- Record Construction: What a Plant Can Supply, and Who Asserted the Rest Published on: How a plant's existing signals become a basis record, which the instantiation section recorded as an open problem. Answerable now because a record need not be complete: an unsuppliable field leaves an axis undetermined rather than defeating the comparison. Means and establishment time come free from the source. Rate of change and authority need a convention a plant states once, known to its engineers and absent from its data. Established scope is sometimes in a diagram and often nowhere. Origin identity is the genuine gap: industrial systems do not identify readings as events, so an identifier can be minted for directly established claims from tag and timestamp, and claims arriving already derived carry an empty origin set and are undetermined on independence, which is correct rather than a workaround. Construction is a mapping and never an inference, because a wrongly inferred field produces a confident wrong verdict where an absent one produces a visible undetermined.
- Authoring Demands: What They Attach To, Who Writes Them, and What Goes Stale Published on: What a demand attaches to, who writes it, and what happens when the plant changes. Demands attach to classes of act rather than occurrences, which is what makes authoring finite: a plant performs unboundedly many acts and has boundedly many kinds, and only those it wants adjudicated need demands. Where a class is too coarse the remedy is a narrower class, not a variable requirement. The author is whoever is already accountable for the act, translating an existing judgement into the terms the record uses; the discipline supplies no view on what an act should require. Because silence on an axis does not constrain, the minimum viable demand is one axis, so a plant can start with the requirement it is confident about. Stale demands are an open problem: the artefact cannot detect a mismatch between a demand and a changed world, which is the strongest argument for treating the discipline as an addition to a plant's review processes rather than a substitute for them.
- Placement: Where the Enforcement Point Sits, and What It Does With a Verdict Published on: Where the enforcement point sits, what it is, and what a plant does with each verdict. The review already located it on the Purdue model, downstream of the perimeter and immediately before the act, and that location rules out putting it in the transport, which does not know what act is coming. It is not one thing: actuation, supervisory boundary and human interface are all enforcement points taking the same interface, differing in what a refusal can do, and at a human interface it can only present rather than block, which is still worth having because that is the case the human-factors literature documents. It wraps rather than replaces, so no transport changes and adoption proceeds one consumer at a time. Responses are configured per act and recorded: admit logs, refuse is blocking or alarming depending on whether not acting is itself dangerous, and the treatment of undetermined is what decides whether the discipline is run or performed. Placement cannot prevent bypass; it can make bypass a recorded change rather than an omission.
- The Inheritance Rule: What Survives a Derivation, and How a Claim's Basis May Change Published on: The last part of the discipline: what happens to a basis when claims derive from other claims. Means is the derivation's own and never inherited, which is the single most important thing the rule does, because the laundering path works by letting a derived claim present itself with the character of its inputs. Scope narrows to the intersection of the parents'; authority is the deriver's with the parents' retained; establishment time is the derivation's, carried alongside the oldest ancestral time; rate of change comes from the world rather than the parents. Weakest-ancestor is the default and not the rule: disjoint origin sets are necessary for elevation and not sufficient, so the record supplies a mechanical veto rather than a licence, and independence must be established rather than merely unrecorded; the strengthening lifts the standing of the source only, never means, freshness or scope. The test the rule must pass is Gettier's, where justification survives a valid deduction while severed from what makes the conclusion true; the rule passes by refusing to propagate means.
- The Means Field Fails Its Pressure Test: Acquisition, Transformation, and Typed Origins Published on: The record's means field was tested against ten derivation histories and every value collapsed materially different situations. Two collapses are fatal: a calculation over measurements and an extraction from a generated statement are both inference with untyped origins, so a demand cannot ask whether any ancestor was a generation, which is the laundering path occurring inside the discipline's own machinery; and a model summarising measured values is indistinguishable from one inferring a condition from them. The failure is structural rather than lexical, because the five kinds answer three different questions in one field. Means is replaced by acquisition and transformation, and origins are typed rather than opaque. A further distinction follows: causal history is not evidential ancestry, so a generated hypothesis later established by independent measurement does not carry the generation forever, which moves a laundering opportunity from an invisible place to a declared one.
- Formal Properties: What an Implementation Must Preserve Published on: The model stated formally enough to be tested and no further: domains, the admissibility function, and twelve properties an implementation must preserve. No ordering over bases is defined, because a recent generation and an older measurement are incomparable and no scale makes one stronger; every property is stated per axis or as a preservation obligation. Malformation is not epistemic uncertainty, so a corrupt or unrecognised record fails validation rather than returning undetermined. Attacking the list with twelve cases found two silences, both admitting rather than refusing: an empty demand constrains nothing and would admit everything, so it fails validation; and a field a reader cannot interpret must evaluate to unknown rather than unconstrained, or a demand refusing generated ancestry admits a generated claim through version skew.