Sufficient Verification over Complete Knowledge — Accredited, Not Generated, as the Basis of Trust
Accepted
Context
The protocol's trust model has, until now, been distributed across four decisions without ever being named as one: the verifiable substrate and its Merkle/witness commitments (ADR-023), the operations layer that binds every authoritative mutation to a signed acting-binding (ADR-024), the three validation planes (ADR-026), and the ontology/project layer separation that lets one project verify another by witness rather than by cloning it (ADR-028). Each of these embodies the same underlying stance, but the stance itself was implicit, citable only by reading four ADRs and inferring the common thread.
The thread is this: a project's knowledge can never be complete, and even if it could, total context overflows — recording everything produces more confusion than clarity, and no single actor (human or AI) ever holds the whole. A trust model that depends on completeness therefore fails twice: it is unreachable, and it is self-defeating. The only viable basis is local, partial verification of sufficient knowledge — but "sufficient" is dangerous if it means "approximately enough", because a well-typed-but-stale graph manufactures false certainty worse than stale prose (the tier-0-false-certainty anti-pattern, ADR-029).
The sharpening that makes sufficiency safe is accreditation. What makes a partial slice usable is not that it roughly suffices but that it is signed and checkable. This becomes load-bearing in the AI moment: an agent's GENERATED output, and any DEDUCED conclusion, is not usable knowledge until it is accredited. Hallucination is exactly generated content entering the authoritative set unsigned. The stance needs to be explicit and citable because the difusión surface already sells it (differentiator diff-accredited-knowledge) and the agent-integration surface depends on it.
Decision
Name the stance as a constitutive axiom — `sufficient-verification`, "Sufficient Verification over Complete Knowledge" (pole 'Spiral, invariant=true in .ontoref/ontology/core.ncl) — and fix its operative consequences as typed constraints.
1. Verification is always LOCAL and PARTIAL. Any actor can verify that a slice (an op, a node, a change) is coherent with what is declared WITHOUT holding or loading global knowledge of the whole. Cross-project verification is by witness, not by clone (ADR-028).
2. The protocol NEVER requires complete or global knowledge as a precondition for a valid act. Any gate of the form "you may not change X until you understand the whole system" is forbidden by design.
3. Knowledge is ACCREDITED, not deduced or generated. Deduced or generated output — explicitly including an AI agent's — is NOT usable authoritative knowledge until it is signed/witnessed. At tier-2 this is enforced: the witness is the only mutation path and validators reject ill-typed state (internal-coherence-enforced). At tier-0, where no witness exists, such knowledge is unaccredited by construction and MUST NOT be treated as authoritative — it is a draft to be accredited, not a fact.
4. "Sufficient" means accredited-and-checkable, never "approximately enough". The floor is the signature, not a tolerance band.
This is a Spiral commitment, not a Yin concession: it does not give up certainty, it fixes the third thing between impossible-complete-certainty and dangerous-blind- trust — verification of the sufficient — as invariant law. The axiom is the substance-axis statement; the witness/validators (ADR-023/024/026) are the reflection-axis enforcement; tier coexistence (ADR-029) is what lets a project choose how much it commits to accredit, never how much it must know.
Constraints
- Hard Verification MUST operate on a slice (an op, a node, a change) without requiring the whole graph; cross-project verification MUST be by witness, never by clone (ADR-028). No verification path may demand global load.
- Hard The protocol MUST NOT introduce any gate that requires complete or global knowledge as a precondition for a valid act ('you may not change X until you understand the whole system' is forbidden).
- Hard Deduced or generated output — explicitly including an AI agent's — MUST NOT enter the authoritative set until signed/witnessed. At tier-2 the witness path enforces this (ADR-024); at tier-0, where no witness exists, such output MUST be treated as an unaccredited draft, never as authoritative fact.
- Soft 'Sufficient' MUST mean accredited-and-checkable (the floor is a signature), never 'approximately enough' (a tolerance band). No surface may relax sufficiency into laxity.
Alternatives considered
- Leave the stance implicit across ADR-023/024/026/028 — rejected: The stance is load-bearing for difusión and agent integration and was already being sold (diff-accredited-knowledge) without a citable decision behind it. Implicit-across-four-ADRs means no single thing to cite, constrain against, or defend — and the global-knowledge gate could creep in unchallenged.
- Model it as a differentiator only (diff-accredited-knowledge), not an axiom — rejected: A differentiator positions outward; it does not constrain inward. The principle is a constitutive renunciation that must bind all future design, not a competitive talking point. The repo precedent is both: witness-as-axis-seam is an axiom AND diff-witness-seam cites it. Accreditation gets the same two-layer treatment.
- Model it as a Yin axiom (a concession: we accept knowing less) — rejected: Yin frames incompleteness as the price of ontoref — an apology. The honest framing is Spiral: holding the third thing between impossible certainty and blind trust, fixed as law. Incompleteness is the FORM, not the price; that distinction sets the tone of the whole difusión surface (affirmation, not apology).
Anti-patterns
- Treating Generated or Deduced Output as Authoritative Without a Signature — An agent's generated output, or a deduced conclusion, is written into authoritative state (or trusted as fact) without being witnessed. Hallucination enters the set unmarked; the accredited/generated line is erased. This is the precise failure the axiom exists to forbid.
- Requiring Whole-System Understanding Before a Valid Act — A mode, validator, or adoption step demands that an actor understand or load the whole project before changing a part. This reinstates the unreachable, self-defeating completeness trust model and blocks the local partial action the axiom guarantees.
- Resting Trust on Completeness Instead of Verification — A project tries to earn trust by documenting/knowing everything and keeping it all current — the model that overflows context and drifts, producing more confusion than clarity. Trust should rest on accredited sufficient verification, not on an unreachable whole.