A framework for testing functional properties of the architecture
(Part C). None of it claims consciousness; every measure has an
operational definition in research.Measures.
- Ablations (attention, memory retrieval, affect, metacognition,
commitments, volition, global workspace, curiosity, association, goals,
narrative, notifications) and workspace overrides (force a matching
candidate in or out of admission) live in a fork's cognitive
configuration. Original minds refuse them on create and update; only
snapshot restores may carry them, so they are part of the configuration
digest. Excluded candidates are recorded with fate "excluded".
- Self-model experiments override a fork's self-model (capabilities,
identity, goals, knowledge gaps) without touching policy. When an
action's effective policy disagrees with the self-model, cognition
records a self_model_mismatch and corrects the entry; experiments report
self-model accuracy and correction latency.
- Counterfactual experiments replay a mind's recorded stimuli from a
snapshot with chosen events omitted; the report lists what differed in
beliefs, wants, intentions, memories, attention and capability
decisions, in a form introspection can cite.
- Experiments record a protocol (kind, independent variable, controlled
variables, measures), per-variant volition, plan, downstream-by-category
(events reachable from each stimulus through recorded links),
introspection and self-model measures and event ranges; comparisons add
want, intention and plan-capability overlap, measure ranges, a
descriptive architecture share and a downstream delta; reproducibility
is labelled against the previous run of the same definition.
- research.Agency computes want→intention, intention→action, abandonment,
commitment fulfilment and conflict, blocked intentions, replanning,
outcome success and introspection accuracy; MetacognitiveCalibration
relates confidence and expressed uncertainty in replies to later belief
revision, with Brier scores for each half of the period.
- The sandbox test harness gains volition, planning, agency and research
but not the motivation hook, whose wall-clock decay would make replay
comparisons timing-dependent.
Part H invariants, enforced and tested:
- Snapshots now carry wants, want conflicts, commitments, intentions,
plans, plan steps and the volition decision ledger.
- A fork no longer copies the source mind's policies unless the operator
asks for it explicitly (inherit_policies in the API, a checkbox in the
UI; audited), and the fork's history records the omission. Imports
never restore policies, as before. Replays and experiments never
inherit.
- Work inherited mid-flight by a fork or import is quiesced in the
restore transaction: open steps are blocked with their approval and
request ids cleared, open plans blocked and live intentions suspended,
each with the reason. Approvals, grants and executions stay with the
source mind.
- Dreams may leave a want to test a hypothesis they proposed; they never
request authority, and dream-origin plans never run.
- Snapshot column discovery now reads the current schema instead of
"public", which only worked in tests because the development database
happened to hold the same tables.
- Security tests: a static scan that only the capability service runs
executors and that no cognitive package can set or delete policy,
approve, deny, grant or revoke; forged wants, commitments, intentions,
model plans and model output end in refusal or a pending approval with
policy and grants unchanged; component names cannot decide requests or
approvals; no capability names an operator control; the registry cannot
grow at runtime; audit, event and decision history cannot be altered;
forks and dreams as above.
Rows in append-only history are never deleted; their content can now be
made irrecoverable through one audited path. A redaction replaces the
content columns of an event, memory, message, model call, belief or
assertion with a fixed marker, keeps identifiers, links, timestamps,
scores and breakdowns, writes an append-only ledger row with a SHA-256 of
the removed content, appends a redaction event, optionally cascades to
derived rows and to the events that quote them, and scrubs stored snapshot
archives before re-signing them. noema_redact() is the only write the
append-only trigger admits, for UPDATE only, under a transaction-local flag
the application never sets; plain updates and all deletes stay refused.
Replay labels redacted stimuli instead of inventing them.
Cryptographic erasure was considered and deferred with reasons (ADR-0009);
docs/privacy.md defines retained, redacted, irrecoverable and deleted and
states what backups and earlier exports are not covered. Migration 0023.
Snapshots, replays and experiments now record the runtime they ran under:
build (module version, VCS commit, modified tree, commit time, Go version,
platform), schema version, a digest of the non-secret configuration that
ignores secret and credential changes, personality version, policy digest,
model routing including per-mind overrides, prompt versions, deterministic
subsystem versions and timezone. A replay compares its identity with the
snapshot's and is an exact-candidate, a different-build (differences
listed) or incompatible (schema differs; the replay stops before running).
The first non-exact step is analysed into events only in the recording,
events only in the replay, and the components they belong to, labelled as
inferred; live model calls are named as their own source of difference.
Migration 0022 is additive; unrecorded identities are reported as such.
An archive is data about a mind, not a grant of permissions on this
instance. Import now skips the policies table (forks on the same instance
keep theirs), reports the omitted rows in the audit log and the mind's
history, and the snapshot test proves both paths.
- snapshots: checksummed JSON archive of every mind-scoped state table plus
identity/personality/config and the event position; stored, downloadable
- fork: restore into a new mind with all ids remapped; event references are
kept so history before the fork is shared by reference
- export/import: same archive; import is hostile-input validated (size,
allow-listed tables, row caps, column names, checksum, forced mind_id)
- compare: deterministic counts, belief diffs by proposition, personality
and config diffs, event mix
- replay: Runtime.Step for synchronous drivers; sandbox fork driven one
stimulus at a time under a forbidden capability context; recorded model
responses via a replaying router; steps labelled exact / approximate /
diverged with recorded-vs-replayed digests
- experiments: definition (overrides, stimuli, expectations, seed, duration),
background run in a disabled subject mind, stored and exportable results
- migration 0015, API, UI (Snapshots and Replay tabs, Experiments section,
compare page), noemactl snapshots/compare/replay/experiments, docs
Andy Dixon