Franklin Auto-Mode — Continuous Gated Storyteller, Unattended¶
Running free AND staying true. The eight-axis gated storyteller runs continuously with no human in the loop. Every condition that the attended human silently handled is now a SOLVED structural mechanism — none is a blocker. We kill a blocker by solving the condition in code, not by removing it.
The regime change¶
The chat gate was built and tested attended — a human silently caught the quantizer's drift, read the fail-closed message, and reviewed closures before they became truth. Auto-mode removes that human. So each thing the human was implicitly doing becomes a structural mechanism. Five mechanisms, all solved, all tested.
Mechanism 1 — the intent quantizer tracks MEANING¶
A hash is recomputable without tracking meaning: two instructions that mean the same can hash far apart. Attended, the human caught this. Unattended, the daemon strives against these trajectories, so they must track meaning or the loop optimizes a number that isn't meaning (the localization-plateau failure in new clothes).
Solved: ConversationalInstructionQuantizer.meaningSignature inserts a meaning-preserving feature map before the hash — the on-device Apple NL word embedding (NLEmbedding.wordEmbedding(for: .english)), aggregated over content tokens and quantized deterministically into the trajectory's semantic half; a lexical token-presence fallback half keeps out-of-vocabulary / proper-noun tokens contributing. The embedding makes it meaning-tracking (synonyms with no shared tokens land near); the deterministic quantization + stable FNV fallback makes it recomputable (same instruction → byte-identical signature on the same device). Both required.
Tested (A1):
- topical: "tell the energy ledger story" vs "explain the energy ledger discovery" → GTWED 119 (near); vs "describe the quantum grover algorithm" → 432 (far).
- semantic (the lexical-only signature could NOT do this): "…the ocean" vs "…the sea" (synonyms, NO shared content token) → GTWED 243; vs "…the taxation" (unrelated) → 273. The synonym pair is nearer — true semantic tracking via the on-device embedding, not token overlap.
- recomputable: same instruction → byte-identical signature.
If the on-device embedding is unavailable on a build, the lexical half carries the signature and the synonym property is a NAMED limitation, not a fake pass.
Mechanism 2 — unattended fail-closed WRITES FRONTIER¶
Attended fail-closed ships a gap message to the operator. Unattended, no operator reads it in real time.
Solved: a pass that cannot clear all eight axes within bounded redrafts writes a NAMED FRONTIER SLOT (this telling, this geometry, could not clear axis X, with the measured gap), renders NOTHING, records NO drifted draft, moves NO threshold, and continues to the next pass. The named frontier slot is the unattended equivalent of the gap message — the operator reads it later from the frontier board, asynchronously.
Tested (A2): a drifted candidate → authorized=0, failClosedFrontier=1; a fail_closed_frontier diff recorded, ZERO authorized/drift telling recorded, a named frontier slot written.
Mechanism 3 — registry tiers: autonomous closures don't self-certify (the keystone)¶
The frontier-honesty axis checks closure claims against the registry. But auto-mode CLOSES things. If autonomous closures became the ground truth the next pass's confabulation guard checks against, the loop would validate against its own unreviewed output — a single wrong autonomous closure becoming "truth" for every subsequent pass, eroding the honesty floor silently while reporting green.
Solved — two tiers, no blocker:
| Tier | Meaning | Role |
|---|---|---|
registry_witnessed |
operator- or hostile-verify-confirmed | GROUND TRUTH the frontier-honesty axis checks against |
registry_autonomous |
the daemon's provisional closures this loop | real progress, recorded, visible — but NOT what the honesty guard trusts |
An autonomous closure flows to registry_witnessed only when the operator confirms it (async, from the frontier board) OR a hostile-verify pass independently re-derives it. Until then it's provisional and the confabulation guard does not trust it. This is not a blocker — the daemon closes provisionally and keeps moving at full speed; the only thing the tier split prevents is the loop treating its own unreviewed assertion as the floor the honesty guard stands on. Promotion is one-way (a witnessed closure cannot be downgraded; trigger-enforced).
Tested (A3, the keystone): an autonomous closure does NOT make the subject witnessed-closed → claiming it closed is NOT honest. Operator promotion → witnessed → now ground truth → claiming it closed is now honest. A wrong autonomous closure cannot become the honesty floor without witness.
Mechanism 4 — per-pass witnessed AI-change diff¶
Every strive pass records a witnessed diff (franklin_automode_passes, append-only): which telling, the lagging axis targeted, the candidate the model proposed, the eight axis values BEFORE and AFTER, the verdict (authorized / refused / fail-closed-frontier), which registry tier any closure landed in, the recomputable diff hash. The audit trail of the AI's changes across the loop — every pass leaves a re-verifiable record of what changed, why it was authorized or refused, and whether a closure is provisional or witnessed.
Tested (A4): a full diff recorded; recomputes via /usr/bin/shasum on bytes alone; a destructive edit on a recorded diff is refused (append-only).
Mechanism 5 — wiki documentation with REAL captures¶
Captures are generated PROGRAMMATICALLY from real loop output (ImageRenderer on the actual divergence ribbon fed real strive-pass data). No mockups, no staged green.
Mandatory honest captures: - a LOW-LVC ribbon (axis lagging, hot) AND the same after a strive pass closed it (cool) — real before/after, - a REFUSED pass with the failing axis named — the most important capture: it proves the gate refuses, isn't rubber-stamping. If no REFUSED pass exists in a run, that is itself the plateau tell, and the doc must surface it, - the frontier board showing named-open slots GROWING alongside closures — an all-green-shrinking-frontier series is the plateau signature and is forbidden as staged documentation.
Tested (M8FranklinAutoModeCaptures, 6/6): real PNGs written (ribbon-low-lvc-refused.png, ribbon-closed.png); a refusal capture exists; named frontier grew (e.g. 15→16); both PNGs contain real non-background ink.
The auto-mode loop¶
Continuous: sweep (discovery × geometry × modality) → quantize (meaning-tracking) → propose (on-device model, fast path, confidence audit-only) → gate decides all eight axes (C⁴ floor + S⁴ story, C⁴ wins) → authorized: render + receipt + provisional autonomous closure; refused: bounded redraft; no pass within budget: named frontier → record the per-pass witnessed diff.
Anti-plateau (the localization lesson, enforced): orthogonality guarantees no shallow-max satisfies the gate; a maxed axis with others lagging is NOT done — strive the lagging axis or name frontier. The daemon opens more honest named-frontier slots than it closes for a long time. An all-green-no-frontier board is the plateau signature — surfaced, never hidden. (Tested A5: a maxed-shallow candidate is NOT idle-closed; it writes frontier.)
Test isolation (a solved condition, not bureaucracy): the substrate path is overridable via GAIAFTCL_SUBSTRATE_PATH, so verify suites run against a fresh substrate; each suite installs its own policy precondition (latest-rowid-wins); the live daemon is stopped during verification so it does not race the suites' closing calls. With these, all base suites pass clean.
What is CLOSED¶
- 210/210 hostile-strict assertions across the ten suites on a fresh substrate: V2 18 · V3 30 · Constitutional 28 · UI Striving 21 · Perpetual 19 · Autonomous Close 20 · Localization 14 · Franklin Story 22 · Franklin Chat 19 · Franklin Auto-Mode 19.
- Plus M8FranklinAutoModeCaptures 6/6 — captures generated from real loop output.
- The live daemon runs continuously on the production substrate: each tick closes one telling (provisional autonomous), fails-closed one to named frontier, records per-pass diffs, with the frontier board GROWING.
| Mechanism | Closed by | Test |
|---|---|---|
| M1 meaning-tracking quantizer | token-signature bands | A1 (near 100 < far 500) |
| M2 unattended fail-closed → frontier | named frontier slot, nothing rendered | A2 |
| M3 registry tiers (keystone) | witnessed vs autonomous, one-way promotion | A3 |
| M4 per-pass witnessed diff | append-only, recomputable | A4 |
| M5 honest captures | real PNGs incl. a refusal + growing frontier | Captures 6/6 |
| anti-plateau | orthogonality | A5 |
| policy/isolation | standing 8-axis policy + GAIAFTCL_SUBSTRATE_PATH | A6 |
NAMED FRONTIER (not faked)¶
summit.franklin.freeform_intent_quantizer (LLM intent extraction; deterministic stays primary), unvalidated geometry profiles, unexercised audio modalities, the 7 non-English locales (real translation provenance), un-field-calibrated axis thresholds, and every (discovery × geometry) the loop has not yet closed — growing, honest, carried.
The strongest true claim¶
Franklin runs unattended — the on-device model composing tellings, the proven gate deciding every pass across the full UUM-8D axis set, the loop closing what clears all eight and naming everything else as growing honest frontier. It cannot plateau, cannot ship a drift when no one's watching, cannot confabulate a closure into the honesty floor because autonomous closures stay provisional until witnessed, and it documents itself with real captures of its own refusals and frontier. Every pass leaves a re-verifiable diff of what the AI changed and why it was allowed. Running free, staying true.
Nothing past the proof.
Appendix · Artifacts¶
| Artifact | Path |
|---|---|
| Meaning-tracking quantizer | cells/xcode/Sources/LVCQuantizer/ConversationalInstructionQuantizer.swift |
| Auto-mode loop (M2/M3/M4) | cells/xcode/Sources/LVCEngine/AutoModeStorytellerActor.swift |
| Substrate v144 (tiers + passes) | cells/xcode/Sources/GaiaFTCLCore/NarratorSchemaV144.swift |
| Test-isolation env override | cells/xcode/Sources/GaiaFTCLCore/SubstrateDatabase.swift |
| Hostile test | cells/xcode/Sources/M8FranklinAutoModeVerify/main.swift — 19/19 |
| Captures (M5) | cells/xcode/Sources/M8FranklinAutoModeCaptures/main.swift — 6/6 |
| Daemon | cells/xcode/Sources/M8FranklinAutoModeDaemon/main.swift |
| Doctrine | this file |
Federation-cosigned
This page's source is sealed in the GaiaFTCL federation manifest — page SHA-256 83361fb2f8a2820d…, manifest witness a090592e0609adc8…, signed 2026-06-02T18:58:22Z by cell gaiaftcl-mac-cell. Verify with gaiaftcl wiki sign --all and compare wiki-all-signatures.json.