spec: six-layer fingerprint stack — classification that can abstain (SP-FPRINT-STACK-001)

[mdheller]

Lands the spine of the six-layer metadata fingerprint classifier from SP-FPRINT-STACK-001: the stance algebra, per-layer witnesses, the admissibility gate, the L5 drift detector, and DR-4 enforcement.

The one genuinely new thing

ZERO (ignorance) and INADMISSIBLE (conflict) are different values.

The 2018 source design already had the three-channel matcher, OntoDT, the mereotopological framing (its own term), and the routing of DQ inference into access enforcement. What it could not say was "I don't know" distinctly from "my evidence contradicts itself". A gap wants more data; a glut wants a human. Everything else here follows from separating them.

What lands

Schema	Role
ClassificationStance	FOUR-valued stance, reading tag (support vs plausibility) in the type — DR-5
FingerprintLayerEvidence	per-layer emission with discriminated witnesses for L1–L6
ColumnFingerprint	pool → guard → quantize, in that order
ColumnDriftObservation	L5-D1 / L5-D2, blocking for L5 admissibility
EstateAdmissibilityReport	the phase-0 deliverable — which layers this estate can trust, shipped before any classification
ClassificationEnforcementPolicy	DR-4 settled

Properties enforced, not documented

• Nothing manufactures confidence. Guards only lower stance in the knowledge order, so gated stances retain conformal coverage — policy costs efficiency (more abstention), never validity.
• Every stored verdict is recomputed from what produced it: stance from evidence, pooling from admissible layers, n_eff from the covariance spectrum, drift from the measured distance.
• Quorum is n_eff, not Herfindahl. H measures concentration of magnitude — two perfectly correlated layers contributing equally give H = 0.5, which looks healthy while supplying one layer's worth of information. H is demoted to a cheap precheck.
• Coverage does not compose. Depth and the honestly-loosened epsilon ride on the stance.
• Guards are measurable w.r.t. evidence and witness only — reading the outcome breaks exchangeability, so value.* cannot be named in a guard input path (enforced by pattern).
• Axiom X1 — parthood and subtyping are disjoint arrows, enforced as a CI invariant. This is the precondition for the source deck's own two questions (a count over the subtype closure; an enumeration of parts) being simultaneously answerable from one graph. Open-world counts are intervals, with INADMISSIBLE reported separately.

DR-4 settled

POS → allow and NEG → deny are not knobs. INADMISSIBLE → fail-closed is deliberately not configurable — a glut means two layers disagree about what the column is, and one reading may well be "personal data"; serving it lets a contradiction resolve itself in the requester's favour. ZERO is the knob, per resource class, requiring an attestation and unavailable at confidential/restricted sensitivity.

Dead-library pin retired

DataClass.classifier.kind was a const on tf-lattice-wide-and-deep. That repository was archived by its owner in April 2026 (read-only; last release July 2024). It migrated onto the Keras 3 era via a tf_keras compatibility shim and was then archived — it did not become part of Keras. The pin is now an enum over structurally-monotone constructions, with the dead name deprecated-but-accepted so existing documents stay valid, plus a new fingerprintStack binding.

Teeth

• 81 checks + 9 schema negative vectors
• 25 semantic gates proven to bite — tools/test_fingerprint_stack_teeth.py mutates each conformant example one invariant at a time and requires the validator to reject it for its stated reason. A gate that stays green under its own mutation is reported as a failure of the checker.
• The M5 monotonicity property test is run against a deliberately non-monotone aggregator and fails if it does not catch it.

That last one is not decorative. The closest precedent in this repo shipped exactly that defect: #264's monotone classifier had a fixture holding the monotone feature constant, so the constraint bound nothing and the test passed vacuously (fixed in #265). A green check is not evidence until you have watched it go red.

Not in this contract

Named so the gaps stay visible: WO-15 justification-scoped INADMISSIBLE (required before production — without it one bad axiom makes everything derivable; note this is classical inference over justified fragments with the bilattice for bookkeeping, not paraconsistent inference); cold-start phases 1–4 as executable pipeline; KKO cross-domain transfer, which remains a hypothesis with a test protocol and must not appear in customer-facing material until the held-out-domain measurement returns a number; DR-2, DR-7, DR-8, DR-9.

make validate green across all families.