Home / Projects / Orchestrata Ultimate / Decisions / ADR index / ADR-0008
ADR-0008: The determinism boundary — gates check structure and transcription, not intent
| field | value |
|---|---|
| Status | Accepted |
| Date | 2026-07-23 |
| Register | factory (docs/adr, 4-digit ids) |
| Source | docs/adr/0008-determinism-boundary-structure-not-intent.md — permalink at bdafa201a (unchanged on master since that commit) |
| Wiki register entry | ADR-0008 (wiki status: Accepted) |
The record
- Status: Accepted
- Date: 2026-07-23
- Spec: SPEC-033 §3
Context
The design was originally sold as "code that is checked, not trusted" by a deterministic exoskeleton. Review established that claim was true only for a narrow class:
- Structural facts (component existence, signatures, dependency edges) are functions of the committed artifact and genuinely recomputable — those are checked.
- Semantic intent is not. A self-consistent wrong-code + wrong-test pair, both born of the same
misreading, passes
AST ≡ design, passes the tests, and achieves a 100% mutation score — because mutants are derived from the code, so mutation testing certifies test sensitivity, never correctness.
Leaving the overclaim in place would have made every downstream assurance statement unreliable, and invited exactly the rubber-stamp behaviour the design must avoid.
Decision
State the boundary explicitly in the spec, and design to it:
- Deterministic: existence, public signatures, cross-component dependency edges, complexity thresholds, test structure, coverage, trace validity (ADR-0007), anchor satisfaction (ADR-0012).
- Not deterministic: semantic intent beyond the anchors. Owned by human ratification of the design, plus independent (blind) review.
- Model-judged seams are labelled as such — triage's implementation-bug-vs-design-gap call, "patterns exhausted", "decision-complete" — and are human-sampled, never presented as deterministic.
Alternatives rejected
- Keep the stronger claim — unfalsifiable and actively harmful: it invites trusting green gates as evidence of correctness.
- Attempt deterministic semantic verification — undecidable in general; the tractable subset is precisely the anchors (ADR-0012), which this ADR makes explicit rather than implicit.
Consequences
- "Checked, not trusted" is scoped to structure; intent is human-ratified. The genuine prize is the elimination of approved-vs-built drift and the automation of structure and transcription — not a reduction in semantic review.
- The residual semantic hole is a dial, sized by how many requirement-derived anchors are written (ADR-0012, ADR-0016) — not a fixed ceiling, but also not free.
- Every assurance statement elsewhere in the spec must be readable against this section; if a claim cannot be located on one side of this line, it is an overclaim.
Provenance
Round-1 (all reviewers) flagged the overclaim; Round-2 Opus produced the mutation-score scenario. Round-3 Fable called this "the best section in the spec — a model of honest scoping", and Opus credited it as genuinely resolved.
Related ADRs
Rulings cited
None.