§02e Appendix — AIGP↔Mars Bridge — Normative closure rules

Mars® Spec › §02e Appendix — AIGP↔Mars Bridge › Normative closure rules

← Cross-references · Section index · Certificate class over AIGP data (documents G-5) →

8. Normative closure rules

These rules were validated in the reference example (examples/aigp-mars-bridge/) before being promoted here; spec and running code are in lockstep. Each closes a gap recorded in AIGP-BRIDGE-GAP-ANALYSIS.md.

8.1 Cross-phase linkage (closes G-11)

Cross-phase corroboration (§6) is computed only over declared linked pairs. A Mars battery predicate that is to be corroborated against an AIGP criterion MUST declare a linkage: the aigp_criterion_id of the AIGP anticipation criterion that evaluates the same order-typed conformance question (same order, same aspect, same governing-specification version). The linkage is the join key; without it, “the same conformance question” is undefined and corroboration MUST NOT be asserted.

For each linked pair, Mars records a pre-invocation-cross-phase entry carrying both attributed results and an agreement flag.
Predicates with no linkage are evaluated by Mars alone; their absence of corroboration is recorded, not treated as agreement.
A linkage whose two sides declare different order/aspect/spec-version is malformed and is rejected (it is not the same question).

8.2 Divergence precedence (closes G-13)

When a linked pair disagrees (Mars battery verdict ≠ AIGP criterion verdict):

The Mars-derived verdict governs Field 4. Mars is the post-invocation authority; AIGP’s verdict is a corroborating source, not an override.
The divergence is recorded, never suppressed — as a pre-invocation-cross-phase signal and as an Open gap (locus cross-phase) in Field 5.
The AIGP verdict is retained in Field 4 as an annotation (aigp_verdict) so the disagreement is inspectable.

This is the enforcement of BR1. A gate implementation that lets AIGP’s verdict silently override the battery, or that drops the divergence, is non-conforming.

8.3 Procedural-confidence derivation (closes G-14)

The procedural-confidence value consumed by the downstream actuation gate (actuation gate condition 7, §02c §4.3) is derived structurally and MUST NOT incorporate any model-self-reported score. The canonical derivation is:

coverage       = (predicates with a decided verdict) / (total predicates in scope)
corroboration  = (aspects whose methods agree) / (total aspects in scope)
procedural_confidence = 0.5 * coverage + 0.5 * corroboration        (range 0..1)

Both inputs are functions of the governed analysis record (which predicates were decided; whether independent methods over the same aspect agreed). Neither is a model’s confidence in its own output. An implementation MAY declare a different weighting, but MUST declare it in the certificate and MUST derive both terms structurally; a confidence value that reads a model score at any step is a violation of actuation gate condition 7.

8.4 Probabilistic-method re-derivation standard (closes G-15)

A probabilistic battery method (model-as-judge, or an AIGP MODEL/HUMAN grade) is a W2 link by default: it produces an audit record, not a re-derivation. It qualifies as W1 only if it additionally emits a declared re-derivation procedure — a procedure reference plus all parameters sufficient for independent re-execution (seed, model identity + version, decoding parameters, and the exact recorded inputs) — per the §02e recomputation-witness definition. Absent that, the method’s contribution to the verdict is auditable but not recomputable, and the witness-class annotation says so.

8.5 Order-typing disambiguation of order-agnostic signals (closes G-2)

Signals AIGP emits under the Order-Typed Recomputation Witness Profile carry an order/aspect and are IR-ready. Every other AIGP signal (base REQUEST/RECORD/TRACE, or any source declared order-agnostic in its registration) enters the IR as an untyped-pending element and MUST be disambiguated before any IR-level method consumes it:

Declared mapping. The deployment registers a source-to-order mapping that assigns an untyped-pending element to one or more orders based on its source class and evaluation scope (e.g., an admissibility-gate attack finding → prescriptive; a quality finding → descriptive). The mapping is a registered artifact under §02b §3 and is itself versioned.
Disambiguation act. Applying the mapping is recorded as a §02a §5a.1 disambiguation step; the resulting order assignment is carried on the signal element with a reference to the mapping version used.
Irreducibility fallback. If no mapping assignment can be made, the element is carried as a §02a §5a.4 declared-irreducible entry with basis authority-unavailable (the source cannot provide order context) or formally-undecidable (the content maps to no declared order). A declared-irreducible element MUST NOT contribute to the grounded verdict; it may appear in Field 6 as an out-of-scope observation.

No untyped-pending element may contribute to Field 4. This is what prevents an un-order-typed AIGP signal from silently influencing a conformance verdict.

8.6 Causal binding for AIGP-sourced actuation (closes G-6)

The downstream actuation gate condition 6 (§02c §4.3) requires that an emitted effect be re-derivable from the certificate predicate under a named actuation-interpretation specification. For effects driven from AIGP-sourced certificates:

Named actuation-interpretation spec. The effect MUST be bound to a registered actuation-interpretation specification that maps a specific Field 4 predicate/verdict to the effect. The binding record identifies the predicate, the interpretation spec version, and the effect class.
Re-derivability tier follows witness class. Actuation gate condition 6 is satisfiable to the tier of the backing witness:
- If the governing predicate is backed by a W1 link (profile §3), the effect is fully re-derivable from the predicate — condition 6 is met at the recomputable tier.
- If the predicate is backed only by W2/W3, condition 6 is met only to the attestation tier: the binding is auditable but the effect is not independently re-derivable. A gate configured to require recomputable condition 6 MUST refuse such an effect (condition causal-binding-below-required-tier).
Pairing with condition 7. Actuation gate condition 6 (this rule) and condition 7 (procedural-confidence, §8.3) are independent conditions; both must pass. Condition 7 is derived structurally (never a model score); condition 6 is a binding-plus-witness-tier test. An AIGP-sourced effect that requires autonomous actuation therefore requires both a sufficient procedural-confidence floor and a predicate backed at the required witness tier — which, for recomputable actuation, means the AIGP W1 profile.

← Cross-references · Section index · Certificate class over AIGP data (documents G-5) →