boundary

Files (2)

• SKILL.md
• boundary_procedure.ncl

SKILL.md (first lines)

# Boundary Protocol v1.0: IBC Sufficiency & Refinement

This skill defines what every Initial Boundary Condition (IBC) MUST possess
before an expensive walk is launched from it, and the cheap-tier refinement
loop that manufactures such boundaries.

The key words "MUST", "MUST NOT", "SHOULD", and "MAY" are to be interpreted
as described in BCP 14 (RFC 2119, RFC 8174).

---

## Philosophy: Optimize for Cheap Rejection

A good IBC is **not** one that maximizes the probability the walk succeeds.
It is one that makes the failure modes **cheap and early**. A wrong frame
can never be fully prevented at authoring time; what can be guaranteed is
that the walk detects and rejects it in its first few hundred tokens
instead of its last fifty thousand.

This follows from the cost asymmetry of cascade control: iterating in
boundary-space (cheap models + human revising a prompt document) costs
orders of magnitude less than iterating in trajectory-space (re-running an
architect-class walk). Error-correction iterations therefore belong in the
cheap outer loop. The expensive walk should launch from a fixed point
$\text{IBC}^*$ of the cheap refinement mapping and run as close to one-shot
as the task allows.

The most expensive failure mode of a high-capability walker is a
**confidently-wrong frame**: long-horizon coherence builds a large,
internally consistent structure on a false premise without the local error
signals that would trip a weaker model into visible incoherence. Premise
verification *before* the expensive call has the highest leverage-per-token
of any activity in the system.

### Trust as an Anti-Goodhart Mechanism

A micro-specified boundary induces a compliance posture: the walk optimizes
for letter-satisfaction of the rubric and produces rubric-satisfying,
goal-missing output. A boundary that grants explicit discretion over its
delegated questions ("these calls are yours; log your reasoning") shifts
the optimization target from *satisfy the spec* to *achieve the goal under
constraints*. The partnership dyad is structural, not sentimental:

- **Trust** = a non-empty delegated set with genuine discretion.
- **Focus** = a strictly bounded one, with halt predicates at the edges.

An IBC whose delegated set is empty wastes an architect on typist work. An
IBC whose delegated set is unbounded is a gamble, not a delegation.

---

## The Sufficiency Conditions

An IBC is **sufficient** when it satisfies all seven conditions below. Each
condition is independently checkable; adversarial reviewers in the
refinement loop MUST cite the violated condition by ID when raising an
objection.

### S1 — FALSIFIABILITY

Every premise the IBC asserts about the world MUST be stated so that the
receiving walker can verify or refute it against primary sources at low
token cost, and SHOULD name the exact check (command, file:line, document
section).

> ❌ "The auth module is well-tested."
> ✅ "`auth/session_test.go` covers token expiry; verify with
>   `go test ./auth/ -run TestExpiry`."

Rationale: what reliably triggers early fallback in a capable walker is a
*verifiable contradiction* between frame and world — vague unease does not.
A falsifiable premise is a manufactured tripwire.

The floor renders a premise as a CLOSED claim entry
(`ledger/contracts/entry.ncl`'s `Entry`, narrowed by `worker_ibc.ncl`'s
`PremiseChecked`): its `backing` names the evidence species (corroborated |
vouched | unclosed | residual), its `signer` designates who is asserting it,
and its `axes` records the author's own assessment of the claim's
coordinates (determined, certifiable, monotone) — required on every
premise, since an IBC author is obligated to assess the ground the dispatch
will stand on.

### S2 — REJECTION_GENRE

The IBC MUST state that rejecting the frame is a success condition, and
MUST define the rejection report format: which premise failed, the
refuting evidence, and what the boundary loop should reconsider. The
receiving walker's first obligation is a premise audit against S1's
tripwires; on failure it MUST emit the rejection report and freeze rather
than proceed.

Rationale: if halting has no genre, the walk invents continuation. An
explicit low-energy path to "no" is what makes early fallback reachable.

### S3 — DECISION_RIGHTS

Every question in scope MUST belong to exactly one of three sets:

| Set | Meaning | Obligation |
| :--- | :--- | :--- |
| **RESOLVED** | Answered during boundary refinement | Evidence attached (S1-grade) |
| **DELEGATED** | The walker's to answer — where the expensive tokens go | Discretion granted; reasoning logged |
| **RESERVED** | The human's to decide | Encountering one is a halt predicate, stated as a predicate |

A question that fits none of the sets is an unresolved unknown: the IBC is
not sufficient and MUST NOT be dispatched. Genuinely architectural
questions MUST NOT be fake-resolved at the cheap tier; ambiguities MUST NOT
be left for the expensive tier.

A question the refinement loop cannot yet resolve is carried forward in the
floor as an `unknowns` entry (`worker_ibc.ncl`'s `UnknownChecked`): a
question entry that MUST carry both a `discharge` condition (what would
close it) and a `closer` (who can) — a question missing either is not
routable, which is the same insufficiency this table already names.

### S4 — EVALUATOR_ATTACHMENT

Every constraint and every acceptance criterion MUST name the strongest
affordable deterministic evaluator that checks it, selected from the

From nrdxp/predicate, MIT.

More from nrdxp/predicate