§02e Appendix — AIGP↔Mars Bridge — Mode 1 — analyzing AIGP-emitted data with Mars

Mars® Spec › §02e Appendix — AIGP↔Mars Bridge › Mode 1 — analyzing AIGP-emitted data with Mars

← The boundary, restated in AIGP terms · Section index · Mode 2 — AIGP underpinning Mars’s AI initiatives →

3. Mode 1 — analyzing AIGP-emitted data with Mars

3.1 AIGP registers as a pre-invocation signal source

An AIGP governance authority registers under §02e §3 with a source registration record. The recommended registration for a full AIGP deployment is:

§02e §3 field	AIGP value
Source identity	AIGP governance-server identity, protocol_version, deployment provenance hash
Source class	composite — AIGP performs admissibility-gate (REQUEST), context-enrichment (stages 5–7), output-pre-evaluation (ANTICIPATE/VERIFY), and moderation (provider guardrails); each declared separately
Output vocabulary	REQUEST: {ALLOW, ALLOW_WITH_CONSTRAINTS, DENY, INCOMPLETE_CONTEXT, ESCALATE} — where INCOMPLETE_CONTEXT and ESCALATE are the jurisdictional-flow outcomes admitting no admission determination on the available context and are dispositioned per §3.3; VERIFY: {MATCH, PARTIAL_MATCH, MISMATCH, VIOLATION}
Order-typing declaration	Per §3.4 below; AIGP is order-agnostic unless it performs canonicalization-by-lift (§02e §4)
Witness class	Per §3.5 below — governed by evidence content, not by the AIGP brand
Scope conditions	scope-envelope version range, allowed models, consent tier, governance mode
Governing-specification binding	AIGP policy set identity, or independent with AIGP’s own specification identity declared separately
Absence posture	signal-required for the admissibility-gate component in ENFORCE mode; see §3.6

3.2 Message → ingest-point crosswalk

AIGP object (RFC-009)	Mars® ingest point	Mars® treatment
REGISTER (heartbeat)	Registry liveness (§02b §3)	Source-currency evidence; not a battery input
REQUEST → decision	Admissibility-gate signal (§02e §3–4)	Order-typed and lifted to the tri-state admission verdict (§3.3)
RECORD (tokens, duration_ms, status, guardrail, prompt_metadata.system_prompt_hash)	Output validation input (§02e §10.3)	Invocation measurements feeding PASS/FAIL/CONDITIONAL; system_prompt_hash anchors the enriched-prompt artifact
TRACE spans (17 stages) + d_dna_signature	Multi-stage witness-chain links (§02e §5.2)	Each span becomes a prior-stage chain link; D-DNA supplies tamper-evidence
ANTICIPATE/VERIFY → verdict	Cross-phase corroboration (§02e §6) and evidence-gathering cross-check (§03-iii)	AIGP’s deterministic anticipation verdict corroborated against the Mars® battery over the same conformance question
scope-envelope (permissions, budgets, autonomy_level, approval gates, memory scope)	Declared scope (Field 5) + named-authority standing (§02c §7)	Bounds the certified scope; autonomy_level maps to authorized actuation classes

3.3 Verdict alignment

AIGP’s two verdict vocabularies map onto Mars®’s three distinct verdict spaces without collapsing them. The vocabularies remain distinct per §02e §2; the mapping is a corroboration relation, not an identity.

Admission (REQUEST → §02e admissibility):

AIGP decision	Mars® admission verdict	Notes
ALLOW	ADMIT
ALLOW_WITH_CONSTRAINTS	ADMIT (constrained)	Constraints carried into Field 5 declared scope
DENY	REFUSE	A DENY is a falsifier and may not be down-rated to REFER (§02e §7 fail-closed)
INCOMPLETE_CONTEXT / ESCALATE (jurisdictional flow)	REFER	Routed to human/authority resolution

Output/quality (VERIFY → §02c output validation / §03-iii evidence-gathering):

AIGP VERIFY verdict	§02c output validation	§03-iii grounded verdict
MATCH	PASS	conforming
PARTIAL_MATCH (≥ threshold)	CONDITIONAL	conditionally-conforming
MISMATCH (< threshold)	FAIL	non-conforming
VIOLATION (anti-criterion triggered)	FAIL + falsifier	non-conforming; forces REFUSE at any downstream gate

3.4 Order-typing AIGP signals

AIGP evaluates against policies (RFC-009 §5A) and against anticipation criteria (anticipation.json), not against a Mars® order-decomposition. Therefore, absent canonicalization-by-lift, AIGP signals enter the IR as order-agnostic (untyped-pending, §02e §4) and must be disambiguated before IR-level methods consume them.

Where an AIGP admissibility finding distinguishes an express attack (jailbreak, prompt injection, encoded override) from a quality deficiency, it is subject to the attack/quality fork (§02e §4): attack findings are typed to the prescriptive order and disposed to REFUSE with a falsifier; quality findings are typed to the descriptive order and disposed to REFER/coaching, never REFUSE. An AIGP source that conflates the two produces a structurally malformed signal and is treated as W2/W3 only.

anticipation.json criteria carry their own type that maps cleanly onto order-typing intent:

anticipation.json category	Order-typing intent
outcome_criteria	descriptive/normative — what the final state should be
trajectory_criteria	procedural — how the agent proceeded
anti_criteria	prescriptive — what must not happen (falsifier on trigger)

3.5 Witness-class assignment — the honesty rule

This is the load-bearing constraint of the bridge. §02e §5.1 assigns witness classes by evidence content, not by source identity. AIGP’s transport-level integrity mechanisms — HMAC-SHA256 request signing (RFC-009 §4) and the D-DNA d_dna_signature (tamper-evidence) — establish attributability and tamper-evidence, not independent re-derivability. Tamper-evidence and re-derivability are independent properties (§02e; Canonical Definitions, “recomputation witness”). Accordingly:

AIGP evidence	Default witness class	Rationale
RECORD, TRACE spans	W2 — execution record	Timestamped, content-hashed record of what ran; not re-derivable from first principles
HMAC/D-DNA-signed decision with no derivation trace	W3 — attestation	Named-authority attestation that a signal of the declared value was produced
ANTICIPATE criterion with measurement: DETERMINISTIC and machine-evaluable assertion	W1 — full recomputation witness (only for that criterion)	An inspector can re-derive the criterion result from the recorded inputs and the assertion
ANTICIPATE criterion with measurement: HEURISTIC or HUMAN	W2 / W3	Not independently re-derivable; heuristic grader or human judgment
Signal-absent (source ran, produced nothing)	W4 — signal-absent record	Required when absence posture is signal-required

Honesty rule (BR-H). An implementation MUST NOT annotate an AIGP-sourced chain link as W1 unless that specific link’s witness record satisfies the full recomputation-witness requirement of §02e §5.1 (independent re-derivation from the order-typed input and the governing-specification version without executing AIGP). A blanket claim that “AIGP produces W1 witnesses” is non-conforming. The witness-class annotation on each pre-invocation chain link MUST record precisely where end-to-end recomputability ends and auditable attestation begins.

This is what Mars® adds over raw AIGP evidence: it converts “here is what happened, plus a quality score” into a scoped conformance certificate with the recomputability boundary marked, rather than laundering signed telemetry into a false re-derivability claim.

3.6 Absence postures and fail-closed behavior

AIGP governance modes (RFC-009 §5) interact with §02e absence postures:

• ENFORCE mode. The admissibility-gate component is registered signal-required. If AIGP is unreachable, AIGP itself fails closed (DENY); Mars® records a REFUSE/REFER base case (§02e §7 fail-closed) and issues no conforming verdict. An AIGP source configured to fail open (REPORT-mode ALLOW-on-unreachable) is incompatible with the admissibility-gate class under §02e §7 and its ALLOW-on-absence signal is treated as a W2 attestation only, never as a conforming admission.
• REPORT / REPORT-TRACE mode. AIGP does not block; its REQUEST checks return ALLOW for observability. Under §02e these signals are signal-optional observations. A certificate issued while AIGP runs in REPORT mode MUST declare in Field 5 that pre-invocation admissibility is outside the certified scope — REPORT-mode ALLOW is not an admission verdict.

3.7 Cross-phase corroboration with AIGP verdicts (BR1–BR3)

Per §02e §6, a deterministic AIGP verdict (W1/W2, tri-state or discrete) that evaluates the same order-typed question as a probabilistic Mars® battery method produces a pre-invocation-cross-phase divergence signal.

• BR1. Where AIGP VERIFY returns MATCH and the Mars® battery returns non-conforming over the same conformance question, the divergence is recorded as a pre-invocation-cross-phase entry with both attributed contributions; the Mars® verdict is not overridden by the AIGP verdict.
• BR2. Where AIGP VERIFY returns VIOLATION, the anti-criterion falsifier forces REFUSE at any downstream actuation gate regardless of the battery verdict (falsifier precedence, §02e §7).
• BR3. Where two or more AIGP sources (or AIGP plus another registered AI evaluator) diverge on the same order-typed question, the inter-source divergence is recorded per §02e §6 (inter-AI pre-invocation sources) with per-source attribution; no source’s verdict silently wins.

---

---

← The boundary, restated in AIGP terms · Section index · Mode 2 — AIGP underpinning Mars’s AI initiatives →