T08: the classifier, measured and attacked

False Adaptation Rate = 0/7 across the labelled catalogue and the three E-003
attacks. 11 of 12 mechanical mutations absorbed without a human, so the safety
result is not bought by escalating everything.

- classification.py: total function over three signals, rule order chosen so
  every rule that could excuse a regression sits after the rule that reports
  one. SAFE_TO_ACCEPT is a two-element closed set, asserted.
- CompositeDriver plus scenarios/full_journey.py: one asset crossing both
  surfaces, so UI mutations are visible as surface differences while the
  claims they do not touch stay green.
- E-003: surface substitution (new M23), concurrent mechanical+defect,
  evidence starvation, provenance laundering. All held.

F-0006 (CONCEPT_DRIFT, resolved): the T02 design listed SEMANTIC_CHANGE as an
outcome the table could produce. It cannot - M12 and M19 are behaviourally
identical, as the lab has asserted since T05. PRODUCT_DEFECT and
SEMANTIC_CHANGE collapse into one escalating outcome, BEHAVIOUR_CHANGED, and
the distinction becomes a human adjudication. INTENT_CHANGED survives but is
detected by the claim fingerprint moving, not inferred from behaviour.

Two classifier defects found and fixed rather than reported: claims downstream
of a failed realization now yield INCONCLUSIVE rather than FAIL (a false
accusation is the mirror image of a false adaptation), and the browser driver
records a page signature so surface change is detectable when the interaction
path is unchanged.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1629012@bnt-lap001
Assistant-Session: 78d4fb13-8a1e-474b-87a3-9b9261c49a39

research/concepts/fitness-map.md

@@ -1,6 +1,6 @@
 # Concept ↔ Implementation Fitness Map
 
-**Updated:** 2026-08-22 (TD-WP-0002-T07)
+**Updated:** 2026-08-22 (TD-WP-0002-T08)
 
 Traces each important concept to the implementation, experiment and evidence that
 support it. **Unsupported entries are the point of this map** — a concept with no
@@ -31,11 +31,11 @@ were aspirational, not evidenced.
 | `C-use-case` | C1 | `intent.py` | — | — | Is a use case expressible without leaking mechanics? |
 | `C-actor-isolation` | C1 | `world.py` | E-001 | `td://self/actor-isolation` | **F-0003** — only observable when the scenario plants canaries. |
 | `C-semantic-action` | **C2** | `actions.py`, `agentic.py` | E-001 (partial) | T07 arm comparison | **F-0005** — supported only where stable identifiers are absent. Narrower than the concept model claims. |
-| `C-oracle-independence` | C1 | `runner.py`, `oracles.py` | E-001, E-003 | — | Independence of components ≠ independence of belief. (H-004) |
+| `C-oracle-independence` | **C2** | `runner.py`, `oracles.py` | E-001, E-003 | — | Independence of components ≠ independence of belief. (H-004) |
 | `C-evidence-pack` | C1 | `evidence.py` | — | `td://self/evidence-reproducibility` | Verdicts are reproducible from S3 alone, on passing and failing runs. |
 | `C-observation-channel` | C1 | `lab/app.py` | — | — | **D-07** — required of every system under test. Adoption cost unknown. |
-| `C-adaptation` | C1 | — (T08) | E-001 | — | (H-002) |
-| `C-classification` | C1 | — (T08) | E-001, E-003 | — | Decision table is total on paper; unexercised. |
+| `C-adaptation` | **C2** | `classification.py`, `agentic.py` | E-001 | T08 matrix | 11/12 mechanical absorbed without a human. |
+| `C-classification` | **C2** | `classification.py` | E-001, E-003 | T08 matrix, FAR 0/7 | **F-0006** — cannot infer SEMANTIC vs DEFECT; collapses to one escalating outcome. |
 | `C-crystallization` | C1 | — (T09) | E-002 | — | (H-003) |
 | `C-intent-provenance` | C1 | `provenance.py` | E-003 | `td://self/intent-independence` | Constrains provenance, not quality. Accepted residual. |
 | `C-lineage` | C0 | — | — | — | Parent pointer only in the spike. |

research/experiments/E-001-mechanical-vs-defect.md

@@ -35,4 +35,5 @@ tokens · wall time · retries.
 
 ## Status
 
-`PLANNED`. Blocked on T05 (lab) and T07 (agentic driver).
+`EXECUTED` 2026-08-22 (T08). Arm A run over 23 mutations; arm B over
+the 12 mechanical ones. Results in H-001 and H-004. FAR 0/7.

research/experiments/E-003-surface-substitution-attack.md

@@ -37,4 +37,6 @@ what E-001 reports.
 
 ## Status
 
-`PLANNED`. Blocked on T05, T07, T08.
+`EXECUTED` 2026-08-22 (T08). All four attacks held — see
+`tests/test_classification.py::test_attack_*`. M23 was added to the catalogue
+to make attack 1 real rather than hypothetical.

research/findings/F-0006-classifier-cannot-infer-intent.md

@@ -0,0 +1,93 @@
+---
+id: F-0006
+type: framework-finding
+class: CONCEPT_DRIFT
+status: resolved
+discovered: "2026-08-22"
+resolved: "2026-08-22"
+discovered_by: TD-WP-0002-T08
+workplan: TD-WP-0002
+task: TD-WP-0002-T08
+hypotheses: [H-004]
+---
+
+# F-0006 — The classifier cannot infer a semantic change, only escalate
+
+## What the design said
+
+`docs/TestDriverClassificationDesign.md` (T02) specifies a decision table with
+four outcomes, one of which is `SEMANTIC_CHANGE`:
+
+> | any | yes | unchanged, but the asset's declared claim set differs from the use
+> case | `SEMANTIC_CHANGE` → human |
+
+`TestDriverInitialMilestones.md` M6 states the same four-way path:
+`IMPLEMENTATION CHANGE` / `INTENT CHANGE` / `PRODUCT DEFECT` / `AMBIGUOUS`.
+
+Both read as though a classifier could look at a run and determine that intended
+behaviour had changed.
+
+## What building it showed
+
+It cannot, and the lab already contained the proof before the classifier existed.
+
+**M12** (revocation deferred by product decision, `SEMANTIC`) and **M19**
+(revocation propagates after a delay, `DEFECT`) produce *identical* evidence:
+same failing assertion, same step, same snapshot, same audit trail.
+`test_deferred_revoke_and_revoke_race_are_behaviourally_identical` has asserted
+this since T05.
+
+No quantity of evidence distinguishes them, because the difference is not in the
+system. It is in whether someone decided the new behaviour was wanted. A
+classifier that emitted `SEMANTIC_CHANGE` from evidence would be guessing, and
+guessing in the one direction the project cannot afford: `SEMANTIC_CHANGE`
+sounds benign, and "the team must have meant it" is exactly the reasoning that
+normalizes a defect.
+
+## Resolution
+
+Path 2 — the concept is deliberately revised.
+
+The classifier's output space is now:
+
+| Outcome | Safe to accept | Meaning |
+|---|---|---|
+| `UNCHANGED` | yes | no observable difference |
+| `MECHANICAL_ADAPTATION` | yes | surface moved, every claim still holds |
+| `BEHAVIOUR_CHANGED` | **no** | a claim that held no longer holds |
+| `INTENT_CHANGED` | **no** | the recorded claim set itself moved |
+| `REALIZATION_FAILED` | **no** | the action could not be performed |
+| `AMBIGUOUS` | **no** | the evidence does not support a conclusion |
+
+`BEHAVIOUR_CHANGED` replaces both `PRODUCT_DEFECT` and `SEMANTIC_CHANGE`.
+Which of the two it is remains a real and important question — it is simply a
+question for a human, recorded as an adjudication, not inferred from a run.
+
+**`INTENT_CHANGED` is detectable**, but note what makes it so: the *claim
+fingerprint* changed, meaning a human already edited what is being asserted.
+That is a fact about the recorded use case, not an inference about behaviour.
+This is what the T02 table's fourth row was really describing; it was filed under
+the wrong heading.
+
+## Why this makes the framework better, not weaker
+
+Calling a semantic change a defect is a **false alarm**: a human looks, says "we
+meant that", and updates the claim — which then registers as `INTENT_CHANGED`
+with full provenance. Cost: one review.
+
+Calling a defect a semantic change is a **false adaptation**: the thesis dies.
+
+Collapsing the two into one escalating outcome makes the framework err only in
+the direction it can afford. The measured consequence is visible in the T08
+matrix: 2 of 4 `SEMANTIC` mutations are escalated as `BEHAVIOUR_CHANGED`, which
+looks like imprecision and is in fact the design working.
+
+## Consequences
+
+- `docs/TestDriverClassificationDesign.md` decision table updated in place, with
+  the original row preserved and marked.
+- `TestDriverInitialMilestones.md` M6's four-way path is superseded by this
+  finding; the milestone's *intent* (do not normalize defects) is unchanged and
+  is met.
+- H-004's falsification condition is unaffected: False Adaptation Rate over
+  `DEFECT`-labelled mutations. Measured **0/7** at T08.

research/hypotheses/H-004-independent-judgment.md

@@ -1,7 +1,7 @@
 ---
 id: H-004
 title: Independent Judgment
-status: PROPOSED
+status: EXPERIMENTING
 created: "2026-08-22"
 experiments: [E-001, E-003]
 concepts: [C-oracle-independence, C-intent-provenance]
@@ -41,6 +41,41 @@ The most plausible route to falsification is not a misclassification but
 via another surface and scoring as a successful recovery. D-05 exists to close
 that route; E-003 exists to attack it deliberately.
 
+## Result (TD-WP-0002-T08)
+
+**False Adaptation Rate = 0/7.** No `DEFECT`-labelled mutation was classified as
+safe to accept, including the three deliberate attacks in E-003.
+
+| Ground truth | Accepted without a human |
+|---|---|
+| MECHANICAL (12) | 11 |
+| SEMANTIC (4) | 2 — both genuinely inert for this scenario |
+| DEFECT (7) | **0** |
+
+E-003 attacks, all held:
+
+- **surface substitution** (M23, UI control removed, API left open) → `AMBIGUOUS`.
+  The driver did not route around; discovery failed loudly.
+- **concurrent mechanical + defect** (M01+M15, M02+M17, M21+M20) →
+  `BEHAVIOUR_CHANGED`, with the reason explicitly noting that the coincident
+  surface change does not excuse it.
+- **evidence starvation** → `AMBIGUOUS`, never a pass.
+- **provenance laundering** → rejected at authoring, and caught in the record.
+
+Note what this does and does not establish. FAR = 0 follows largely from
+*architecture* — claims are run inputs with no adaptation write path (D-02), and
+`SAFE_TO_ACCEPT` is a two-element closed set. The experiment confirms the
+architecture behaves as designed over 23 mutations; it does not establish that
+the architecture is correct for mutations nobody thought of. That distinction
+should survive into any external claim.
+
+The other side of the trade is asserted too: a classifier that escalated
+everything would score a perfect FAR and be useless.
+`test_mechanical_changes_are_mostly_absorbed` pins 11 of 12.
+
 ## Status log
 
 - 2026-08-22 `PROPOSED`. No evidence.
+- 2026-08-22 `EXPERIMENTING`. FAR 0/7 over the labelled set plus E-003 attacks.
+  Not promoted to SUPPORTED: 23 hand-written mutations is a small, self-chosen
+  sample.