§02a Jupiter — Base Analysis — The governing ground truth

Mars® Spec › §02a Jupiter — Base Analysis › The governing ground truth

← What this layer is · Section index · The analysis battery →

2. The governing ground truth

Analysis is performed against a governing ground truth — the typed artifact or combination of artifacts against which the target is analyzed. The governing ground truth is one or more of each of the following, in any combination, the mechanism being block-agnostic and count-agnostic:

a governing specification — a registered typed artifact
an order-decomposed formal domain model (§01)
a knowledge base
a characterized data source

There may be one or more of each member. Every member of the governing ground truth is subject to selection: active or inactive per context, condition, time, event, programmatic interface, or human or machine selection act — per the governing collection’s activation condition schema (§01 §12.2). No member is unconditionally required; the mechanism is block-agnostic and count-agnostic by design. A governing specification that is not present in a given operation does not indicate absence of governing ground truth — the remaining members constitute it, and where no governing specification is active the fallback hierarchy of §03-iii §2.2 and §03-iii §2.12 governs which artifact serves as the governing reference. The system may also reverse-compose a first-class governing specification from the available artifacts (§6).

All analysis is governed by the order-decomposition: the orders and perspectives of the domain model determine what is analyzed, how results are typed, and how the verdict is structured.

Generalized anchor-and-gate. The conformance certificate (§02b §2) is the realization of the generalized provenance anchor for typed linguistic artifacts of arbitrary origin: the certificate’s Field 1 (target identity) is the origin identity of the producer; Field 2 (governing-specification identity) is the registered specification against which the predicate is verified; and Field 7 (recomputation witness) is the verification reference from which an independent inspector re-derives the grounded verdict through the full pass sequence. The anchor-and-gate mechanism — refusing any typed linguistic predicate whose provenance anchor is absent, whose signature fails, or whose verification reference does not reproduce the verdict — applies to predicates regardless of whether their origin is a non-linguistic analysis program (the non-language-bridge specialization, §02c), another system, or a human. The non-linguistic-signal specialization is the pair; the generalized language case is co-equal. A deployment that claims this architecture but omits the anchor-and-gate for linguistic predicates of non-bridge origin is not a different architecture; it is a non-conforming implementation of this one.

2.1 Three-specification composition

Where the governing ground truth includes a governing specification, it may be composed from up to three independently-bootstrapped specifications whose typed interfaces align. Each specification is independently deployable and independently certifiable. The three are:

The analysis specification — governs how the input artifact is to be analyzed against the source authority: what evidence types are required, what sufficiency thresholds apply, what scope qualifiers govern admissibility, what citation chains anchor the rules. It is bootstrapped from a natural-language source authority (§2.2).
The interpretation-generation specification — governs how the analysis specification’s output (fired predicates with rule traces) maps into a typed linguistic predicate suitable for downstream consumption: the output classes, the target-authority tags, the rule-trace schema, the provenance-bundle schema. Co-attested by the engineering authority and the doctrine authority.
The interpretation-analysis specification — governs whether a generated linguistic predicate is faithful to the underlying state it purports to describe: the faithfulness conditions, the scope under which faithfulness holds, the empirical-measurement requirements where faithfulness must be benchmarked, and the invalidation conditions that revoke a prior faithfulness claim.

Composition by typed interface. The three specifications compose when their typed boundaries align: the analysis specification’s output type matches the interpretation-generation specification’s input type, and the interpretation-generation specification’s output type matches the interpretation-analysis specification’s input type. Composition is refused when boundaries do not align — the chain does not coerce mismatched types.

Composed chain invariants. Where all three specifications are present and composed:

The composed chain’s scope is the intersection of the three sub-scopes; no composition step may widen a constituent scope.
The composed chain’s rule trace is the concatenation of the three sub-traces; each trace segment identifies the specification that produced it.
The composed chain’s faithfulness anchor lineage references the bootstrap anchor of each constituent specification; the lineage is carried as a first-class field in the certificate.

Single-specification deployment. A deployment that operates only the analysis specification — without the interpretation-generation or interpretation-analysis specifications — is a valid embodiment. The composed-chain invariants apply only where the corresponding specifications are present. A deployment cannot claim the composed-chain scope, rule-trace, or faithfulness-anchor properties without having composed all three specifications through aligned typed interfaces.

2.2 Bootstrap binary-falsifiability

Every governing specification admitted into the system must pass a binary-falsifiable bootstrap gate before emission. The gate has three stages:

Compilation — the natural-language source authority is compiled into typed quantified predicates over the declared domain vocabulary in the decidable fragment. The compilation step is Role 1 of the LLM’s three roles; its output is a candidate formal specification.
Ground-discharge — the candidate specification is discharged by an SMT decision procedure (Z3, CVC5, or declared equivalent in QF_UFLIA with uninterpreted-function symbols) for three coherence properties: well-formedness (every predicate is syntactically valid over the declared vocabulary), internal consistency (the rule set is jointly satisfiable), and scope-of-applicability (the rules’ guard conditions cover the intended state space). The SMT solver operates on the formal predicates only — it never sees the natural-language source. Ground-discharge failure is a hard gate failure: the candidate specification is rejected and returned for re-encoding; no emission proceeds.
Reviewer-attested faithfulness — one or more named human reviewers with declared standing for the source authority domain attest, per predicate, whether the predicate faithfully encodes what the natural-language source says. A declared inter-rater agreement statistic fit for the measurement scale and rater count of the attestation act (satisfying the five agreement-statistic properties of §01 §8) is computed against a pre-declared threshold registered in the specification registry before the attestation act begins. A statistic value below the registered threshold is a hard gate failure: the bootstrap fails, the candidate specification is rejected, and no emission proceeds. A threshold breach produces no partial emission, no warning-with-proceed, and no operator override. The bootstrap is binary: either the full gate passes and the specification emits, or the gate fails and nothing emits.

Emitted specification bundle. A specification that passes all three stages emits as a bundle carrying: the compiled predicates, the SMT discharge record (including the decision procedure identity, version, and invocation record), the faithfulness anchor (reviewer identities, per-predicate attestation records, declared statistic identity, statistic value, threshold, and cryptographic signature), and the scope-of-applicability certificate. These four components are co-required: a bundle missing any component is not a valid emitted specification and is refused at registration. The co-presence of all four components is the anti-substitution property: a party who replaces one component without re-running the full gate produces a structurally non-conforming bundle regardless of what the replacement component contains.

Falsifiability. The bootstrap is falsifiable per event: presenting a statistic value below the registered threshold, or presenting a candidate specification that fails SMT ground-discharge, produces an observable gate failure with a typed rejection record. The rejection record carries: the stage at which failure occurred, the candidate specification identity, the measured value (statistic value or SMT result), the declared statistic identity, the declared threshold or required result, and the timestamp. An independent inspector can verify that no emitted specification exists in the registry whose bootstrap record shows a threshold breach or SMT failure — that is the externally-observable property of binary-falsifiability.

← What this layer is · Section index · The analysis battery →