Implementation: SHADOW (decision runtime) · DESIGN (automated eval pipeline) · Exposure: INTERNAL. See status labels. Agreement with another model is not evidence of correctness. A primitive gains authority only through measured calibration on held-out data.

​
Architecture contract

Initial gate per primitive:
  • A calibration artifact bound to the exact model, revision, runtime, question and candidate schema.
  • Expected calibration error at or below 0.05 on held-out data.
  • At most 5% observed error on the auto-act subset.
  • A statistically meaningful held-out sample reported with confidence bounds.
  • Reversible, low-consequence decisions only at first.
  • Hard policy and deterministic verification stay authoritative.
  • Abstain or escalate outside the calibrated coverage region.
Tracked metrics: accuracy, F1, Brier score, negative log-likelihood, coverage at risk, and flip and order sensitivity. Authority expands per primitive, only after that primitive passes its own eval.

​
Current implementation

The decision runtime is on main and S1 runs shadow-only: it records what it would have decided and takes no action. One primitive, judge.first_pass.tool, has passed the Q26 gate and runs in a budgeted canary when live mode is on; its audits feed the CUSUM rollback. See Calibration.

​
Availability

​
Developer relevance

Ship a decision backend with its calibration manifest. Expect it to stay in shadow until it clears the gate.