ECHO-5 representation, concepts and hierarchy closure

Execution update, 10 October 2026: the implementation below describes V1. Its development result and independent audit are retained in artifacts/closure-development-20261010-r1/. The active measurement contract is V2 in TRANSFER-CONTRACT.json, frozen before any confirmation evaluation. V2 requires memory efficiency against empty and size-matched irrelevant libraries, including acquisition and semantic work; the manual fixed library is an oracle reference with accuracy and total-cost noninferiority requirements. Strict superiority against that oracle remains reported, including when false. This amendment does not change the solver, cases or seeds and does not make the V1 negative result green.

The revised development run is in artifacts/closure-development-20261010-r2/. The later 72-case development expansion and independent replay are retained in artifacts/development-scale-20261010-r1/, with a concise Spanish report in DEVELOPMENT-SCALE-20261010.md. It passes the numerical V2 development criteria; confirmation and its independent audit remain necessary for closure.

Implementation target: CLOSURE-IMPLEMENTATION-20261010.md. The initial handoff was limited to programming and static checks. Background tests, measurement and independent development replay have since been completed. The exact32 bank in RESULTS-20261010.md is now development evidence only; its historical sources and receipts are untouched.

The interface is echo5.transfer.run_benchmark(config, journal=None), returning schema, config, rows, summary, gates plus acquisition, library, contract and source receipts. audit_benchmark(report, replay=False) is the public recomputation entry point. audit_report(report) always requests full replay and is compatible with the parent's closure.audit_worker dispatch. The existing Recorder remains the passive journal; no new thought bus or model is introduced.

Implementation order (execution of every test remains deferred to the parent):

• Extend canonical object grounding with containment, morphology and packing.
• Add an opt-in bounded synthesis frontier and integer-key prefix reuse; preserve the original solver defaults and closed executable program format.
• Freeze demonstration-backed library views per solve, without granting authority to checksums or dropping revalidation costs.
• Build independent structural generators, four library controls and explicit ambiguity/unsupported controls; retain acquisition and all costs.
• Add independent audit/replay, executable evidence, tests and invocation.
• Full checks and CPU development evaluation, in the background after programming.
• Parent: archive sources, confirm, replay in a fresh process, publish outcomes.

TRANSFER-CONTRACT.json freezes seeds, grammar, limits and numerical gates before any confirmation evaluation. Confirmation must reject overrides; development may use smaller configurations and must remain labeled development. The parent owns source archival, background execution and the final audit.

Interface and invocation

The runner takes a JSON configuration, not the whole contract:

from echo5.transfer import default_config, run_benchmark, audit_benchmark, audit_report

config = default_config('development')  # or 'confirmation'
report = run_benchmark(config, journal=recorder)
# Equivalent frozen confirmation config: {'phase': 'confirmation'}.
# Write report as JSON; invoke auditing later from a fresh frozen-source process.
audit = audit_benchmark(report, replay=True)
# audit_report(report) is exactly the full-replay orchestration hook.

normalize_config validates without executing the solver. Development permits subsets of families, conditions and seeds, reduced work budgets and a different bounded synthesis config. Confirmation must match every frozen value. Training seeds and any derived confirmation seeds are unavailable to development. Changes to the numerical contract after seeing confirmation require a new version, new seeds, and preservation of the previous artifacts. This instrument cannot prevent a caller from manually invoking a generator; run custody is the parent's responsibility.

After all components are programmed, the parent can use the existing orchestrator with a new output directory (these commands were not executed here):

cd /home/roger/REALRXOS/RXos/echoai/ECHO-5
nohup .venv/bin/python -I scripts/closure.py worker transfer --phase development \
  --output artifacts/transfer-development-v1 > artifacts/transfer-development-v1.log 2>&1 &

After that process exits, run the audit separately, also in the background:

nohup .venv/bin/python -I scripts/closure.py audit-worker transfer \
  --output artifacts/transfer-development-v1 > artifacts/transfer-development-v1-audit.log 2>&1 &

For confirmation, use the parent campaign freeze/archive workflow before starting the worker; a standalone worker does not archive sources. The runner starts no process, viewer or model. A supplied Recorder.write(kind=..., **facts) receives actual observations, verified training hypotheses, retained-frontier counts, library freezes and externally scored outcomes. Its text never enters search.

Each row retains case and source identity, condition, public task, expected queries (evaluator only), a Boolean external success, complete work ledgers, wall/process durations and the actor result. program is the flattened executable form; hypothesis preserves actual concept calls. test_verified is always false. The top-level cases and training entries contain the frozen original inputs, oracles, witness programs, seeds and generator receipts. libraries contain full demonstrations, dependencies, checksums and provenance, not just names or hashes.

What changed

The original solve(task, ...) path still uses its original two-tier grammar and legacy prefix policy. No default candidate set, budget or historical benchmark was changed. New use is explicit:

result = solve(task, library=library, budget=16_000_000,
               synthesis=config['synthesis'], cache_policy='interned')

The opt-in search composes retained prefixes with primitives or verified named chunks up to four search levels in this contract. Expanded programs still obey the existing 16-primitive, eight-level named-expansion and 128-node limits. The public synthesis API accepts depths 1–8, beam widths 1–128 and up to 100,000 candidate attempts; the contract fixes width 24 and 12,000 attempts. Ranking uses only demonstration error. State reduction includes all query executions, including undefined outcomes, so training-equivalent prefixes with different query behavior are not collapsed. It does not use hidden query outputs.

Every hypothesis in the first matching retained tier must agree before a prediction is emitted. Query-undefined consistent hypotheses force ambiguity. Candidate/work exhaustion clears predictions; no partially checked tier can solve. Beam pruning is reported explicitly. Agreement is over the retained frontier and the library prior, not every possible program in the DSL.

Integer prefix/input keys replace repeated whole-grid hashing in the new policy. Input references remain alive, preventing object-id reuse. The implementation interns bounded prefix nodes, starts execution at the deepest available prefix, and charges identity reads, key construction, lookups, writes, failed entries and all residual execution. Both cached and uncached arms use the same candidates, ranking and reduction. The compiled library view replays original support once per solve, then shares immutable primitive tuples; a later solve revalidates again. Source library changes cannot mutate an existing task-local view.

The new operations reuse canonical SEED Object, Scene, segmentation and rendering. inside means strict bounding-box containment, not topological enclosure. same_size compares area. outline removes four-neighbour interiors; fill_box refuses to overwrite a foreign object. pack orders by descending area with one-cell gaps and refuses equal-area ties. These are deliberate bounded representation choices, not learned universal visual concepts.

Families and controls

Evaluation family	Independent expected transformation	Witness depth
outline_extract_scale	Hollow a rectangle/clipped polyomino, isolate its boundary, double resolution	3
fill_extract_tile	Fill a U-shaped object's rectangle, isolate it, repeat horizontally	3
pack_rotate_scale	Order three distinct-area shapes, pack, turn, double resolution	3
inside_erase_crop	Remove an internal marker, crop surviving objects, reflect	3
ambiguous_rotation	Symmetric demonstrations with asymmetric queries; no witness claimed	—
unsupported_color	Introduce a color absent from every input; outside this palette-preserving language	—

Witness depth is a declared construction, not a proof of minimal description. The shallow comparison measures whether the search actually needs additional levels on the sampled tasks. Oracles are rendered from generated shape data and small independent geometric routines; they do not call the actor DSL. Witnesses are then executed against those oracles; disagreement is an instrument error. Witnesses, family/seed metadata and query labels are removed from solver inputs. Controls are retained in costs and statuses; their safe behavior is abstention, even if a guess would happen to equal an oracle.

Six acquisition tasks teach four base transformations and two parent concepts. All acquisition attempts, including failures, are retained. The fixed library uses six declared witness definitions and pays construction/verification costs. The learned library must find its programs from demonstrations. The irrelevant library performs identity and matches both the learned record count and expanded primitive count, with acquisition-only support. It is not byte-size matched; serialized sizes are reported. Its accounting also includes the acquisition needed to determine the matched size. Empty, empty-uncached, empty-depth-two and old-representation controls complete the seven conditions. The last is an ablation in the new instrument, not a new historical ECHO-4.5 score.

There are 12 preregistered confirmation base seeds per family, offset by 100000 times the fixed family index: 72 cases / 504 condition rows. Development has two base seeds. Six separate acquisition seeds precede all evaluation. The 16-million work ceiling bounds each solve, but runtime has not been measured. Shared grammar, hand-designed primitives and generators limit all conclusions; these are neither 504 independent capabilities nor an estimate of general intelligence.

Costs, gates and audit

Per-arm totals include search, every failed attempt, acquisition, generation, witness validation, library construction/freezing/revalidation and evidence/key handling. Shared evaluation generation and source custody are charged in full to each arm; physical_run_work counts shared work once. Logical units are explicit instrumented operations, not a count of all CPython instructions or FLOPs. Whole-run and per-row wall/process durations are measured independently, including journaling when enabled. No logical saving implies a latency or energy benefit.

The contract requires 75% supported success for the learner, zero predictions on controls, positive matched library size, positive hierarchy and representation gains without paired losses, identical cached/uncached search results and at least 1% prefix work saving. Each learned-library comparison requires at least 5% total work saving and no paired accuracy regression, including comparison with the fixed library. Full closure requires every gate on the frozen confirmation config. These strict criteria may produce negative findings. Neither a verified replay nor a development success changes a false scientific gate into a pass. Summary denominators include failed/budget-limited cases.

recompute_summary(config, rows, training, libraries, preparation, cases, custody_work) exposes the accounting primitive to the parent. The safer complete entry point is audit_benchmark: it checks the frozen contract and source closure, regenerates and compares every original case/oracle, rejects missing/duplicate rows, checks ledger sums, rebuilds libraries from acquisition evidence, executes all claimed solved programs, and recalculates exact success and gates. Hashes alone do not establish evidence. Without replay it returns arithmetic_valid: true only after those checks, and valid: false.

With replay=True, acquisition is rerun from recorded inputs, all libraries and preparation costs must match, and every scored row is rerun against its original inputs with its original condition. Programs, predictions, statuses and logical costs must match exactly. Timings are not compared for equality. Replay and regeneration costs are reported separately as audit work. The parent must run this in a fresh process from the archived source bytes. Mismatches raise ValueError rather than silently rewriting a receipt. A valid audit can certify an honestly negative experiment.

tests/test_transfer.py covers independent hand outputs, ties and overwrite rejection, three-primitive discovery, parent/child acquisition, cache/control equivalence, ambiguity, search/work exhaustion, poisoned query mappings, contract separation, generator/witness agreement, full replay and forged success/cost/oracle/source/gate receipts. These tests are written, not run.