Home / Projects / Orchestrata Ultimate / Decisions / ADR index / ADR-0012
ADR-0012: Semantic anchors are requirement-derived, not code-derived
| field | value |
|---|---|
| Status | Accepted |
| Date | 2026-07-23 |
| Register | factory (docs/adr, 4-digit ids) |
| Source | docs/adr/0012-semantic-anchors-are-requirement-derived.md — permalink at bdafa201a (unchanged on master since that commit) |
| Wiki register entry | ADR-0012 (wiki status: Accepted) |
The record
- Status: Accepted
- Date: 2026-07-23
- Spec: SPEC-033 §2, §5
Context
Every automated correctness check in the original design derived from the code: structural conformance, coverage, and — at the top of the anti-gaming stack — mutation testing.
Mutation testing generates mutants from the implementation and measures whether tests detect deviations from what the code currently does. It therefore certifies test sensitivity, never behavioural correctness. A self-consistent wrong-implementation + wrong-test pair, both produced from one misreading of a requirement, achieves a 100% mutation score while pinning the wrong behaviour. This is a structural ceiling, not a tooling gap: no amount of building raises it.
Decision
The ratified artefact carries requirement-derived semantic anchors — constraints on behaviour that do not derive from the implementation, and so cannot be co-authored by the code:
- Concrete input→output examples per acceptance criterion.
- Properties / metamorphic invariants where applicable (they quantify over the domain, which example- and code-derived checks structurally cannot).
- Differential oracles for amendments — the prior behaviour, which is observed, not authored.
Anchors are checked deterministically, and anchor satisfaction is a gate.
Alternatives rejected
- Rely on mutation testing for semantic strength — implementation-relative by construction (above).
- Model-reviewed correctness — substitutes one model's reading for another's; no independence.
- Formal specification of all behaviour — sound but disproportionate for the general case; anchors are the tractable subset that buys most of the benefit.
Consequences
- This is a categorical escape from the code-derived ceiling — a different kind of check, not a stronger version of the same one.
- The residual semantic hole becomes a dial, sized by how many anchors are written — but the dial is priced in human ratification minutes, because an anchor authored by the same model that authored the design (from the same reading) is co-conspired, not independent. Only a human reading an expected value makes it independent. See ADR-0016 for the ranking and the price.
- Anchors become a high-value attack surface — if they are agent-mutable they are the cheapest thing to change when code will not pass. Addressed by ADR-0013.
- Anchors are only a dial on under-determination, not on misinterpretation: given a wrong reading, they shrink the admissible behaviour set toward the wrong centre. Detecting the wrong reading is interpretation mutation's job (ADR-0022), not the anchors'.
Provenance
Round-2 Opus established the mutation ceiling; the anchor response was introduced in v0.3.0. Round-3 Opus credited it as "the substantive advance in v0.3.0 — a different kind of check", while insisting the dial's price and the misinterpretation limit be stated (ADR-0016).
Related ADRs
Rulings cited
None.