Home / Projects / Orchestrata Ultimate / Decisions / ADR index / ADR-0016
ADR-0016: Anchor classes are ranked; differential oracles are mandatory for amendments
| field | value |
|---|---|
| Status | Accepted |
| Date | 2026-07-24 |
| Register | factory (docs/adr, 4-digit ids) |
| Source | docs/adr/0016-anchor-class-ranking-oracles-for-amendments.md — permalink at bdafa201a (unchanged on master since that commit) |
| Wiki register entry | ADR-0016 (wiki status: Accepted) |
The record
- Status: Accepted
- Date: 2026-07-24
- Spec: SPEC-033 §2
Context
v0.3.0 treats the three anchor classes — examples, properties/metamorphic invariants, differential oracles — as one interchangeable bag, and presents the resulting semantic coverage as a free "dial".
Both are wrong in the same way. Independence from the design author is not uniform across the classes:
- Examples and properties are authored, typically by the same model that authored the design, from the same reading. If the reading is wrong, the anchor is co-conspired — it pins the wrong behaviour more precisely, making the error crisper and harder to notice.
- Differential oracles are observed: prior behaviour is a fact about the running system, not a restatement of someone's interpretation. This class is genuinely independent of Fable.
And the dial has a price. The only thing that converts an authored anchor from co-conspired to independent is a human reading its expected value. So semantic coverage is proportional to human ratification minutes — denominated in exactly the currency autonomy is supposed to save. Stating the dial without the price invites planning against a benefit that has an unbudgeted cost.
Decision
- Rank the classes by independence: differential oracle > property/metamorphic > example.
- Where an independent class exists, it is required. In particular all amendments must carry a differential oracle (prior behaviour), since one is always available for a change to existing code.
- Properties/metamorphic invariants are preferred over examples where expressible, because they quantify over the domain rather than asserting single points.
- State the price explicitly in the spec: authored anchors are only independent to the extent a human ratifies their expected values.
- Extend the cost trace (B12) to human minutes, not just tokens — otherwise the ROI case measures the wrong resource.
Alternatives rejected
- Treat all anchor classes as equivalent — hides that two of three are co-conspired by default.
- Require human ratification of every anchor — maximally independent, but the load makes the approach unusable; ranking plus mandatory oracles concentrates scarce human attention where no independent substitute exists.
- Drop authored anchors entirely — greenfield work has no prior behaviour to difference against, so examples and properties remain the only available anchors there.
Consequences
- Amendment work (the majority of real changes) gets a genuinely independent semantic check, cheaply.
- Greenfield work remains the weakest case — its anchors are authored, so its semantic assurance rests most heavily on human ratification. Worth stating rather than averaging away.
- Ratification budgeting becomes a planning input: the number of authored anchors needing human reading is a forecastable quantity per change.
Provenance
Round-3 Opus: the "dial, not ceiling" claim is half-true — anchors dial under-determination, not misinterpretation; only the differential oracle is genuinely independent of the design author; the dial's price is denominated in human minutes.
Related ADRs
No other ADR is named in this record.
Rulings cited
None.