Elnor Repo Reader

# E1/E2 (DOC81) — R3 Application-Fidelity Audit (Cowork orchestrator)

**Date:** 2026-06-08 · **Auditor:** Cowork orchestrator (Opus), architect-supervised. **Independence note:** the intended independent CODEX run repeatedly died on sandbox idle/restart (a rig limitation, not a content issue — logged in the capability note); this audit substitutes a direct verification by the orchestrator against the actual file text. The R3 application was performed by a *separate* agent (Claude Code), so applier≠auditor separation holds; a CODEX cross-check remains available for an active-session window.

**Target:** `DOC81_Scope_Policy_Charter_Draft.md` (R3; 2,682 lines). **Authority:** `E1_E2_R2_Adjudication_Card.md` (V1–V24, declines D-R1…D-R6, seeds) + R1 card §1-bis.

## VERDICT: `READY_FOR_DELTA_REVIEW`

The R3 application landed faithfully. The headline unified-state refactor is real (not asserted), the four R-1/R-2 walked cases all pass against the actual pipeline text, all six declines are honored in context, the R2 self-report falsification class (bare primary IDs) is genuinely fixed, and structure/reference integrity are clean. Residual items are substantive-completeness confirmations for the delta review, none blocking.

## What was verified (method: greps + region reads against the file, not the self-report)

**Structure — CLEAN.** 2,682 lines (matches report); 82 fences, balanced; `§`-numbering monotonic; the `meet_v2` algorithm correctly fenced as `text` pseudocode (L883–970).

**V1 unified-state refactor — CONFIRMED REAL (the leak-class cure).** `interface PolicyPoint` carries exactly the **four** capability axes — `disclosure_class` removed (verified: absent from the interface body). Disclosure travels only in `DisclosurePermissionVector`; the scalar is derived **once** at `finalizeDisclosureAndCoherence` (step 6, L960–961), `makeCoherent` last. Spine functions all defined: `meetPolicyState`, `meetAllStates`, `finalizeDisclosureAndCoherence`, `disclosureVectorCeilingFor`, `evaluateActionPredicate`, `domainContribution`. No step meets disclosure as a bare scalar.

**The four walked cases (2.C) — ALL PASS (read against the pipeline, L883–969):**
- **(a) cross-matter INTERNAL retrieve → full content.** Step 3 (L935–940): internal actions floor ONLY on an R-1 basis; "else INTERNAL non-R-1 action: NO floor raise (R-1, §4.0) — cross-matter relevance handled by DAMS contamination ranking, never a floor." ✓ R-1 honored — you can read your own cross-matter material.
- **(b) empty-applicable internal retrieve → domain baseline, not block.** Step 1c (L915–921): empty + same-principal internal + no R-1 basis ⇒ `domainBaselineDecision` (reason `policy.domain_profile_only_internal_baseline`); hard block retained only for egress/write/learn/delegate/carryover/cross-principal. ✓ No fifth block basis.
- **(c) autonomous restamp restore reachable.** Step 4 (L942–948): `mode=='ordinary'` applies sticky; `mode=='restamp_reeval'` skips sticky and clamps to `MIN(root ceiling, current scope floor)` ⇒ restore-up-to-ceiling reachable. ✓ R-2 implementable.
- **(d) scope-floor disclosure ceiling survives to final scalar (the A-B1 leak).** Domain carries its own vector (step 2, L929); floor meets `floorEff.max_disclosure_vector` into the vector (step 3, L939, "A-B1: floor vector meets in"); scalar derived from the final vector once (step 6). ✓ Leak class structurally closed.

**Pipeline integrity extras (CONFIRMED):** V10 lattice-error `try/catch` wraps the whole meet, fail-closed on any `PolicyLatticeError` (L886/L969) + the scalar/vector-mismatch guard (L912); V8 egress split (structural 0b L892 + applicable 1b L923); V6 crosswalk consumed at the single point 0c (L897–904); V22 action/exposure/relation paragraph present and correct (L974) — protects the cross-task injection feature from the egress tax; V14 capability-obligation is emission-lint-only (L956–958, D-R4 honored).

**Declines (2.D) — ALL HONORED (verified in context):** D-R1 zero `PolicyStampRestampIssuance` interfaces (optional `issued_memory_flow_certificate_ref?` used instead, 3 occ); D-R2 `E0DerivedProjection` appears only in decline-notes (the `persistence_kind: 'derived_projection'` marker is the mechanism, on 6 derived objects); D-R3 `MAX_SCOPE_TRAVERSAL_DEPTH = 16`; D-R4 emission-lint only; D-R5 V21 wall items non-gating; D-R6 V1 is the headline. R1 declines D1–D12 untouched (spot: no `risk_level: unknown`).

**S-1 / R2 falsification class — GENUINELY FIXED.** Every remaining `_id: string;` (12) is non-primary: `registry_id`/`value_id` (ExternalVocabularyValueRef coordinates) + ten `*_generation_id` counters. Zero bare-string primary IDs on owned schemas.

**Meta-checklist signals (2.E #11) — present:** action predicate called in the meet (not just defined); `CanonicalHashSpec` for cache hashes; `evaluateCollectionDisposition` (the two-empties fix); `maximum_bottleneck_spanning_tree` (deterministic cluster confidence); `UnitInterval` (30 uses — range guards); `ThresholdPolarity`; `sticky_prior_effective_policy` in cache key (9); `conservatism_floor_basis` (the R-1 carrier, 6); `notice_disposition`; `principal_scope` sentinel.

**All 24 V-clusters present** by provenance tag + content spot-checks.

## Residual items for the delta review (NON-blocking — confirm, don't gate)

1. **V13 tension (disclosed, deliberate).** The six derived objects carry `persistence_kind: 'derived_projection'` yet still `extends E0DurableRecord` — the D-R2-forced compromise (no E0-named base). Sound, but the delta review should confirm the EC consumption side treats them as rebuildable, not durable-truth.
2. **`principal_scope` placement.** Confirmed on `ScopeResolutionResult` (L385); the card V20 also named the cache keys — delta review should confirm `ScopeResolutionCacheKey`/`EffectivePolicyCacheKey` carry it too (R-5 bleed guard), not just the result object.
3. **QF helper formula completeness.** Signals present for the pack (coverage, thresholds, contamination confidence, topic ambiguity, quota math, lawful-edge predicate); a Stage-7-eyes pass should confirm each has a concrete formula (the meta-rule), not just a schema — this is exactly what the narrow §3.2/§4.6 + QF delta re-review covers.
4. **Pseudocode convention.** `meet_v2` uses named operations (`toPolicyPoint`, `priorState`, `meetFloors`, `FLOOR_EFFECT`) that are pseudocode, not separately-defined TS — the charter's established convention (fenced as `text`); the compilable helpers (lattice, disclosure, predicate, QF) all resolve. Not a defect.

## Bottom line
R3 is fidelity-clean: the unified-state pipeline that was the whole point of this round is genuinely in place, the two architect rulings it was meant to make executable (R-1 internal-use, R-2 silent restore) now pass their walked cases in the actual code, and the prior round's self-report failure class is fixed. Proceed to the narrow delta re-review (§3.0/§3.2/§4.6 + the QF formulas + the 4 residual confirms) and the architect seed-confirms, then ratify.