JVNAUTOSCI-2600: thin adaptive ordinary-turn candidate

[witbrock]

Candidate boundary

This remains the frozen JVNAUTOSCI-2600 A3r2 candidate and evidence basis. Do
not merge, cut over, release, deactivate live represented-controller
artefacts, expand delegated effects in this branch, or start A4. Michael has
authorised a bounded successor A3 round; that work will remain isolated from
this exact commit.

The five A3r2 cases were revealed only after commit
c7e69a8c26c33b9f951612e5de620b28d77321ab, its tree, the active represented
prompt, and the relationship index were fixed. Each exact case was submitted
once in order, without retry, rephrasing, replacement, sixth case, state repair,
or post-reveal tuning.

Candidate architecture

• Routes ordinary /von/generate and von_chat_run through a direct adaptive
  read engine.
• Derives the delegated read envelope from trusted actor authority rather than
  request wording.
• Gives the model four generic mechanics: catalogue discovery, read invocation,
  evidence listing, and selective evidence hydration.
• Keeps trusted actor, organisation, namespace, and Gmail binding outside model
  arguments.
• Removes the automatic universal-turn workflow, selector/controller path,
  completion gate, context adjudication, gap recovery, controller-reporting
  contracts, and strategy-prescribing tests from ordinary turns.
• Retains explicit workflows and effect-specific controls outside the ordinary
  read route.

“Thin” describes the ordinary entry architecture relative to the removed
controller, not a claim that this is a small patch: the cumulative PR changes
195 files and adds substantial engine, evidence, transport, and test code.

A3r2 general repair

The final candidate repairs general affordances exposed by A3r1 without adding
case policies or deterministic semantic gates:

• preserves exact bounded evidence envelopes and hydrated slices across final
  synthesis and context-limit recovery;
• makes discovery ranking non-eliminating and catalogues delegated reads with
  truthful surface and argument metadata;
• paginates catalogue context by actual byte budget while keeping every
  capability and schema reachable;
• replaces the Tavily Node/MCP subprocess path with a same-loop Python SDK
  client per bounded operation;
• fixes same-loop OpenAI client construction, request, and closure;
• bounds generic stdio MCP operations by caller deadline, treats MCP isError
  as failure, and prevents private error bodies entering logs;
• uses the relationship-extent index only under explicit current-schema
  readiness;
• detects physical target-first Atlas index support by key sequence, adding
  missing support without dropping an existing index; and
• projects and batches high-cardinality extent and actor-visibility reads,
  removing an N+1 access-filter path without changing visibility semantics.

The revealed case IDs, people, and paper names do not occur in added candidate
lines. The five raw prompts contained no likely-tool hints or required-tool
flags, and the model selected 19 distinct delegated read capabilities.

A3r2 one-shot outcome

• One qualified success: adaptive represented paper–student match assessment.
• Two useful partial results: paper discovery/quality and paper–student
  comparison, both failing the explicitly requested persistent representation.
• One materially wrong result: “my students” was replaced by broad
  current-student type extents and hasDescription was treated as the semantic
  definition of represented research evidence.
• One dependency failure: a fresh session could not recover a unique prior
  paper/assessment/student/match and guessed a different premise.
• Persistent representation requests: 2; effects/read-backs: 0.
• Terminal server states: 5 ok, 0 timeout, 0 provider/schema failure.
  ok means an answer was returned, not that the user job or effect completed.
• Recorded latency: 64–133 seconds, 108 seconds mean; 13–17 model calls per
  case. Four of five exceeded 100 seconds.

The experiment supports opportunity-preserving adaptive discovery. It does not
yet support merge/cutover, effect competence, dependable actor-relative
semantics, or production latency. There is no matched baseline or ablation, so
value cannot be attributed to a single changed component.

Post-run schema-migration correction

The earlier “read-purity breach/proof of harm” conclusion was wrong and is
retracted. find_concepts_by_name was a pure search. A following main-branch
fetch_concept migrated two pre-existing legacy names[] values into
equivalent hasName relations and removed the legacy source field. This
happened after the five experimental runs. No evidence establishes a change to
effective represented-name closure or user-visible semantic harm; the derived
relations may have made later reads faster.

The audit then deleted those relations as “contamination” after the legacy
source had already gone. That cleanup was the demonstrated destructive step.
Both exact names have been restored through the canonical Vontology interface
and read back with their original en-NZ / name_type=NL metadata:

• 6a66e7aa0d5d79b23affb543
• 6a66e7b00d5d79b23affb545

The main migration still has a real partial-failure hazard: it loops over
individual writes and then unsets the whole legacy source. The frozen
candidate's union of modern and legacy names is the semantic oracle, but its
blanket removal of materialisation is not automatically an optimisation.

The revised boundary is semantic-effect fidelity, not physical storage-write
purity. Derived cache, index, relation, or schema-maintenance writes can be
compatible with a logical read when wholly derivable from authoritative state,
scoped, idempotent, semantics-preserving, recoverable or rebuildable, and safe
under partial failure. Materialisation should be implemented only if matched
measurements establish a useful benefit over pure projection.

Validation

• 247 focused and adjacent A3r2 tests passed before the live substrate
  correction.
• 151 integrated adaptive/tool/transport/relation/access tests passed after the
  final correction; 44 focused substrate/access tests also passed during
  diagnosis.
• Changed Python compiled; targeted Ruff F401/F811/F821 and
  git diff --check passed.
• Direct neutral Tavily search and search-plus-extract probes succeeded.
• A content-neutral production-bundle Responses probe used the represented
  gpt-5.6-luna profile, returned READY, and made no tool call.
• The same actor-scoped worst-cardinality relation probe preserved its
  12,892-hit result and access filtering while improving from 58.8s to 10.6s.
• GitHub Python/JavaScript CodeQL, minimum Python syntax, and secret scan passed
  on the exact final commit.
• Independent source reviews found no revealed-case routing or compulsory
  planner/critic replacement. The fresh cases subsequently exposed the
  semantic, effect, continuity, and latency limits above.

Net change against origin/main: 20,815 insertions, 100,319 deletions.

Live derived-index state

The pre-existing extent collection was degraded and canonical fallback timed
out. A rebuild first failed under the ordinary 10s socket timeout after a
partial derived-row deletion; readiness stayed failed and canonical concepts
were untouched. An operation-scoped 120s maintenance timeout then rebuilt
67,946 canonical source concepts into 226,155 derived edges and persisted
current-schema ready state. The successful pass took approximately 23
minutes. This long, non-atomic rebuild cost is an operational defect, not
acceptance evidence.

Authorised successor A3 round

1. Delete the replay sampler's mandatory retired
   completion-gate/typed-receipt and selector/decision-attribution assumptions;
   retain raw outcomes, evidence, explicit effects/read-backs, and telemetry.
2. Before encoding Case 2's semantic failure in Python, replay that disclosed
   failure with a stronger model. Compare a representative useful case with a
   faster model. Preserve the originals and record requested/effective model,
   total/model latency, call/tool counts, and outcome.
3. If the evidence still warrants it, revise the represented prompt with one
   general actor-relative/linked-evidence principle; do not add a
   my_students resolver or storage-predicate rule.
4. Expose the smallest generic actor-scoped aperture for existing
   additive/recoverable representation primitives, with trusted identity and
   scope outside model arguments, concrete effect IDs, partial-success evidence,
   and canonical read-back. Do not add an arXiv/student route or semantic
   intent classifier.
5. Treat schema materialisation as an optional derived optimisation. Retain the
   frozen union projection unless matched cold/warm measurements justify a
   small additive, tagged, reversible cache that never retires its source
   during a read.
6. Declare same-session versus cross-session continuity before the next frozen
   evidence set. Do not implement a continuity mechanism until a valid scoped
   trial fails.

Model escalation/downshift is an observable experiment and a potential
represented routing policy—not an automatic retry chain or a Python
model-name branch. Full-paper and latency repair must follow measured substrate
evidence. No successor merge/cutover or A4 is authorised.

The branch commit and version history remain the rollback boundary.

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of lines (20,000). Try reducing the number of changed lines and requesting a review from Copilot again.

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of lines (20,000). Try reducing the number of changed lines and requesting a review from Copilot again.

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of lines (20,000). Try reducing the number of changed lines and requesting a review from Copilot again.

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of lines (20,000). Try reducing the number of changed lines and requesting a review from Copilot again.