0097: Keep semantic readings separate from V3 authority
Status: accepted (2026-08-22) · Scope: product tier (core/semantic, harn semantic, Codec)
Context
Section titled “Context”Event Ledger V3 can prove what an agent did, which generation owns an event, and whether coordination state is authoritative. Codec can project that evidence into deterministic activity cues. Neither layer should guess why the work matters or condense several related facts into a useful explanation.
A language model can supply that explanation, but its output is nondeterministic and may overstate weak evidence. Putting inferred prose in the ledger would make a derived interpretation look canonical. Letting Codec invoke models directly would mix recurring cost and failure with a read-only page.
Alternatives
Section titled “Alternatives”Append inferred events to V3. Rejected because a projection would become source evidence and could feed later inferences. The ledger must stay factual and replayable without a model.
Extend the existing Codec suggestion file. Rejected because that prototype stores presentation hints, uses one shared file, and allows interpreter fallback. It cannot carry field-level evidence or per-generation reader identity without becoming a second, incompatible contract.
Use one available harness for every generation. Rejected because reader availability would silently change the model and voice assigned to work from a different harness.
Keep the last accepted meaning during rate deferral. Rejected for version
- A deferred document represents a new evidence digest. Showing old prose beside it would invite the operator to treat a mismatched summary as current.
Decision
Section titled “Decision”Harnery adds SemanticEvidenceV1 and SemanticAgentReadModelV1 under the
product-tier harnery/core/semantic export. Deterministic code builds a bounded
evidence envelope from the canonical V3 reader, the authority-safe coordination
view, and controlled Codec operation labels. Raw prompts, transcripts, tool or
command bodies, paths, URLs, environment assignments, and secret-shaped text
are refused at this boundary.
Reader routing is fixed by the source adapter:
| Source adapter | Configured reader | Invocation identity | Attestation |
|---|---|---|---|
| Claude Code | Haiku 4.5 | claude-haiku-4-5-20251001 |
requested-only |
| Codex | GPT-5.6 Luna | gpt-5.6-luna |
requested-only |
| Cursor | Composer 2.5 | composer-2.5 |
requested-only |
All three installed CLIs expose an explicit model flag. Cursor also lists
composer-2.5 through its discovery surface. Their one-shot result envelopes
do not attest the executed model, so version 1 records requested-only. If a
future result exposes an executed identity, Harnery records verified when it
matches and fails closed with model_mismatch when it does not. No adapter may
fall sideways to another harness or model.
The persisted read model is a discriminated union. Accepted output requires a
resolved model identity, attestation, and meaning. A harness or authentication
failure may omit resolution fields because no adapter ran. Invalid output
requires a resolved reader. Deferral carries only rate_cap and
eligible_after; it replaces, rather than accompanies, older meaning.
Freshness is consumer-derived. Documents do not store current, stale, or an
expiry timestamp. Codec compares the evidence timestamp with current ledger
authority and its deterministic freshness policy at read time. Cache identity
includes the evidence digest, harness, configured and resolved model IDs, and
both evidence and prompt contract versions.
Result
Section titled “Result”The first contract slice exports strict schemas, stable evidence projection, field-level citation validation, and privacy guards. Replay tests prove that command-output traffic does not change the evidence digest while typed waits do. Contract tests reject unknown citations, unsupported completion and attention claims, stale model replies, path and command sentinels, unsafe reducer labels, percent estimates, and missing accepted-reader attestation. Empty or absent tags need no fabricated citation.
The Slice 5 dogfood reviewed 30 unique changed-evidence readings from each source harness. Every accepted field cited a known active or archived V3 event. Haiku improved comprehension over deterministic Codec in 2 of 30 readings, matched it once, and returned no meaning 27 times. GPT-5.6 Luna improved 18, matched 8, and returned no meaning 4 times. Composer 2.5 improved 6, matched 17, and returned no meaning 7 times.
The live run also found and fixed six failures: outbound private-text leakage,
an extra call after stop, urgent-queue starvation with three generations,
metric-log rotation from empty sweeps, rate-window reset across invalidation,
and failure to wake a deferred document when eligible_after arrived without
new ledger evidence. Focused regressions cover all six.
Semantic reading therefore remains explicit-start. Harnery does not add a checked-in opt-in and does not start the service with Codec. Deterministic Codec remained complete throughout invalid, unavailable, deferred, and stopped states, while the readers added 10 to 65 seconds of latency and exhausted the 60-call rolling cap during dogfood. A broader activation policy requires a new review with better Haiku contract adherence, measured operator comprehension, and per-call token or cash observability.
ADR 0102 supersedes only this activation policy. The evidence contract, privacy boundary, storage model, and deterministic fallback remain in force.