Numbers, limits, how-to — per feature

• Attribution is first-class: every write carries agent, stamped on every fact at the door; a write without one is a typed refusal. instances_revisions reads the authors back per revision.
• One .sgp pack per instance — a plain zip; the file on disk, the HTTP download and the import payload are the same artifact, byte-identical across runs and placements. Corrupt pack → typed refusal, nothing written.
• Managed residency: one hot instance = one worker thread (the MCP/LLM process is never saturated — proven by a saturation control pair); idle-TTL eviction; a crashed worker is just cold (the next open resumes from the last persisted pack).
• Typed refusals as data: unknown action, missing agent, a plan batch whose needs nobody produces — each refusal is named, for the agent to act on.

• No at-scale multi-agent campaign yet — rung 3/6 is the honest bar.
• A hard kill loses writes since the last persist point (create · sync · eviction · close): crash = cold, never a corrupt pack — by design.
• The instances directory is owned by one process (catalogue and id minting scan it): mcp owns it by default; serve --instances attaches opt-in for sharing.

• SQL covered queries, low-quant: 8→63 % (the same model high-quant as reference: 46→92 %), N=201.
• Finance-table traffic: 7→62 % (reference 20→78 %), N=120.
• Zero big-model calls at runtime on the covered slice.
• Forge: 0 false admissions across 3 datasets × 2 forge models; a sha256 validation dossier per stock.

• The guarantee is at admission, not at execution: runtime steering is not a correctness proof. A runtime "trusted answers" cross-agreement tier was tested and refuted — it was removed (kept on the honesty page).
• Forge yield is per-domain; amortization is a property of the domain's stereotypy. The win lives on the typed, recurrent slice of your traffic — coverage depends on your stocks.
• Streaming is simulated; no per-tier timeout yet.

FRONTIER_MODEL=/path/model.gguf mindsmith serve --room ./sgc
# → http://127.0.0.1:4747/v1 — POST /v1/chat/completions · GET /v1/models · GET /healthz
# optional: LOCAL_MODEL=/path/small.gguf   (semantic coverage: paraphrases hit the stock)

Every completion carries provenance headers: x-sg-served-from: local|frontier · x-sg-arm (match, recall-full, recall-partial, escalate) · x-sg-cost · x-sg-coverage · x-sg-saved (frontier calls avoided so far) · x-sg-sgc-version (the loaded stock's name@version).

GET /healthz is the ops readout — GET, no key, no query content:

{ "status": "ok", "policy": "no-egress",
  "tiers": { "configured": ["local", "mid", "frontier"], "reachable": ["local"] },
  "sgc": ["fin-tables-stock@1.0.0"], "stock": 128 }        // illustrative values

Escalation is either a single frontier (FRONTIER_MODEL embedded gguf, or LLM_BASE any OpenAI-compatible endpoint) or N-tier routing:

// routing.json — tiers are ordered; each has an egress class; the policy is the ceiling
{ "tiers": [
    { "name": "local",    "egressClass": "none",     "backend": { "preset": "local", "modelPath": "…" } },
    { "name": "mid",      "egressClass": "mid",      "backend": { "preset": "custom", "base": "…" } },
    { "name": "frontier", "egressClass": "frontier", "backend": { "preset": "…" } } ],
  "policy": { "dataPolicy": "no-egress" } }   // no-egress (default) | allow-mid | allow-all

A query is never silently sent to a forbidden tier: if the policy leaves nothing reachable, the refusal is typed (NO_REACHABLE_TIER). The no-egress guarantee is enforced fail-closed on real sockets in the test suite, with a negative control proving the guard has teeth.

• One dialogue round lifts 17/24 → 24/24 at zero false admissions.
• A forced write (force: true) is recorded as untrusted provenance — traced, auditable, outside the certified layer. It is never admitted. The gate never yields.
• Honest refusal on over-constrained input (no fabricated compromise).

• hint is orientation only: it lifts the score, but admission is a separate, gated step — the menu is not a promise the model will use it correctly.
• The gate checks proposals against the certified referential of the loaded stock; an empty room means no lanes (the mcp boot says so on stderr).

claude mcp add skynet -- mindsmith mcp --routing routing.json
# tools: ask · drift · metrics · lattice_load · hint · propose · critique

# propose → refusal carries blame + gate-tested options (illustrative):
{ "status": "refused",
  "blame": "shape \"join-4-tables\" ∉ certified referential (12 shapes)",
  "options": [ { "shape": "join-2-tables" }, { "shape": "aggregate-groupby" }, … ] }

# propose with force → recorded, never admitted:
{ "status": "recorded-untrusted", "certified": false, "blame": "…" }

• Disciplined piece-by-piece argument coverage 77 % vs 58 % whole-context (48 arguments).
• Anchored generation of missing theses: 0 fabrication across all negative controls; anti-injection ledger 8/8 retracted; JTMS cascade on retraction.
• Without a declared frame the tool refuses honestly — 0 false verdicts in the controls — instead of guessing a winner.
• The margin is a stop signal, not a proof: below the measured count margin the output is counts + coverage + UNDECIDED — never a fake weighing. Above it, what ships is the judgment brief (theses, verbatim witnesses, attacks and standing, open points) plus a self-contained judgePrompt your model runs to render the decision: the graph guarantees the arguments; the weighing is the model's job.
• Retired: an earlier head-to-head (naive 13/24 vs mechanical 24/24) was withdrawn when we found the arms unequal — the honesty page documents it. What survived every control is what this section claims, nothing more.

• 1 — call critique {"topic": …}; read verdict, margin, threshold, and the ledger entries with status: "open";
• 2 — the host gathers real statements that bear on the OPEN points (web, docs, its own context);
• 3 — call again with statements: ["PRO: …", "CON: …"] — the frame upgrades to MATERIAL and the margin can move honestly;
• 4 — bounded rounds are the host's discipline; the advice field of the payload restates this contract on every UNDECIDED.

• Campaign numbers are at rung 4/6 — measured, with the MCP surface promoted to the product this week; treat the surface as fresh.
• Entry templates (pool brainstorm, viewpoint naming) are not yet form-robustness-tested.
• On FREE frames, coverage is relative to the generated pool, not the world — announced in the payload.
• Refuted along the way and kept on the page: graded/prevalence weighting, goal-criteria weighting, low-quant self-audit — the list.

critique { "topic": "…" }                                   → frame FREE
critique { "topic": "…", "statements": ["PRO: …", "CON: …"] } → frame MATERIAL
critique { "topic": "…", "viewpoints": ["…", "…"] }           → frame DECLARED

• A malformed or empty bundle is refused at the gate, never written into the room.
• freeze writes the companion dossier (sha256 + inventory) — the fixed, auditable reference. A bundle whose bytes no longer match its dossier is not the frozen reference anymore.
• Lattice bundles load version-gated and confluence-checked: a conflicting ring is rejected, never merged (lattice_load is the only registry write path).

$ mindsmith rooms list
· fin-tables-stock@1.0.0  [methods, 12 classes]  sha256 9f31c2ab55e0d1c4…  (fin-tables-stock.sgc)
❄ sql-lattice@1.2.0       [lattice, 31 classes]  sha256 4c7a90de12bb08e6…  (sql-lattice.sgc + sql-lattice.dossier.md)

$ mindsmith rooms import ./someone-elses-stock.sgc   # gate-checked first, fail-closed
$ mindsmith rooms freeze fin-tables-stock            # writes the sha256 dossier
$ mindsmith rooms export fin-tables-stock ./shipped  # bundle + dossier, ready to share

(Illustrative listing — the format is the real CLI output.) Forge new stocks from any dataset with an executable oracle: sg forge in the engine repo — every admitted method passed a zero-false-admission gate, and the dossier proves it.

• Cross-domain at N=200 per domain — 560 tasks total across the N=40/80/200 campaigns: math word problems 16→52 % (×3.25 [2.4–4.8]), financial-table QA 20→50 % (×2.54 [1.96–3.5]) — bootstrap CIs.
• Where the lone model collapses, the pieces hold: deep tasks 0/33 whole vs 10/33 decomposed.
• Compound ~20-operation tasks: whole-task floors at 0/20 across 3 configs; a hierarchical 2-level split reaches 73 % of sections.
• Robustness to form proven: the scaffold gain holds across 4 wordings (K-paraphrase harness).

• The zoom pays iff the task exceeds whole-task capacity — neutral inside it (measured on simple lookups).
• The small model is not the task cutter (measured) — the host declares the plan; the givens plumbing is per-domain.