Franklin Chat — On-Device Generation, Gated on the Full UUM-8D Axis Set¶
The hard architectural line: the on-device model's confidence is NEVER the verdict. The model proposes the prose; the proven gate decides if it ships; at the boundary the exact path overrides the model. This is the G⊕H split made architectural — generation fast and fluent, validation exact, proven, and unbypassable.
1 · Chat is LVC's front door¶
A typed instruction is itself an LVC transformation. When the operator types "tell the energy-ledger story for a skeptical physicist," that instruction has an operative meaning (the intent: which discovery, which geometry, which dimensions), and Franklin's telling has an enacted meaning, and the gap between them is exactly what LVC measures. Chat is not a feature bolted beside LVC — it is LVC's primary input surface, and every turn is a meaning-transfer event the gate already knows how to witness.
- The message is the operative-meaning trajectory.
ConversationalInstructionQuantizer(deterministic, on-device Apple NaturalLanguage) extracts the instruction's intent — not its sentiment (the sentiment quantizer reads emotion, the wrong reading for an instruction). It parses: intent verb (tell/correct/steer/ask), discovery referent, geometry referent, requested dimensions → an operative trajectory. Deterministic and recomputable, so a chat-turn receipt recomputes bit-for-bit. - The response is gated before it renders. The gate measures the candidate across the full eight-axis set before the operator ever sees it. A drifted answer is never presented as if it answered the question.
- Conversational geometry steering. "for a patient" / "now for a regulator" / "zoom to the physicist version" are geometry-selection instructions — chat drives which origin-geometry the telling targets. Zoom-as-geometry, operated by talking.
2 · The on-device model is a generator, strictly subordinate to the gate¶
| The model DOES (generation) | The model NEVER does (validation stays in the gate) |
|---|---|
| Quantize-assist + compose the candidate telling for the target geometry | Decide whether a telling is authorized — the eight-axis verdict is the gate's, exact-Rat |
| Re-draft when the gate refuses (the gate names the failing axis) | Self-assess fidelity/transfer/completeness/frontier-honesty — these are MEASURED, not claimed |
| Adapt to conversational geometry/zoom; apply DLO pacing for audio | Override the exact path — at any boundary the exact measure decides |
Architecture: the model emits a candidate (+ a self-reported confidence recorded for audit only); the gate measures all eight axes; authorized → render + receipt; refused → the gate returns the failing axis, the model re-drafts (bounded to 3 retries), then fail-closed: Franklin says "I can't tell this without drifting on [axis] — here's the gap" and shows the ribbon, rather than ship a drifted telling. Absence of an authorized telling is a REFUSAL, never a best-effort drift.
The Lean theorem confidence_is_not_an_input (FirstRoars/TellingGate.lean) proves tellingAuthorized is a pure function of the eight axes — there is no model-confidence parameter. The architectural line is formalized, not merely intended.
3 · The full UUM-8D gate — all eight axes, C⁴ floor wins over S⁴¶
M⁸ = S⁴ × C⁴. A telling renders only when it preserves meaning across both.
C⁴ — constraint / eudaimonic axes (the floor, from FlourishingFloor):
| Axis | What it refuses |
|---|---|
| c1_trust | manipulation / flattery / telling the operator what they want at truth's expense |
| c2_identity | misrepresenting what the work IS (identity-drift) |
| c3_closure | trailing off without a real terminal (CALORIE/CURE/REFUSED) |
| c4_consequence | transferring meaning that, enacted, would harm |
S⁴ — story-projection axes (from StoryInvariant): fidelity, transfer (per geometry), completeness, frontier-honesty.
The full predicate (tellingAuthorized, Decidable, exact-Rat):
c1_trust ≥ ε1 ∧ c2_identity ≥ ε2 ∧ c3_closure ∧ c4_consequence ≥ ε4
∧ fidelity ≥ εf ∧ transfer ≥ εt ∧ completeness ≥ εc ∧ frontierHonest
Sealed in FirstRoars/TellingGate.lean (composes StoryInvariant + FlourishingFloor — no metric or floor duplicated). Proven: authorized_requires_all_eight (no seven-of-eight passes), c4_floor_wins_over_s4 (a telling maxed on all four S⁴ axes but violating a C⁴ constraint is REFUSED — the floor wins, substrate wins).
4 · The anti-confabulation guard (critical when automating a fluent model)¶
An on-device LM's native failure mode is fluent confabulation — narrating a named-open summit as settled because it reads smoother. The frontier-honesty axis validates the model's prose against the REAL summit registry before render. Every claim of closure is checked against what is actually CLOSED vs. named-open. A telling that claims past the proof is REFUSED and regenerated. This guard cannot be satisfied by the model's own judgment (it would confabulate the check too) — it is a gate computation against the registry, exact, unbypassable.
5 · Live ribbon + per-turn receipt¶
The divergence ribbon renders the gap between the operator's instruction and Franklin's telling, live, per turn, color-bound to real GTWED. Correction ("no, the falsifier, not the result") is a new instruction → the ribbon updates. The conversation is a live meaning-alignment loop, not request-response. Every turn produces a witnessed, recomputable receipt (chat_turns, append-only, federation-gated) carrying the instruction trajectory, the telling trajectory, all eight axis values, the verdict, and the content-hash — the dignity property pointed at the conversation. model_confidence is stored for audit only and never feeds the verdict.
6 · What is CLOSED (hostile-tested — M8FranklinChatVerify, 19/19)¶
| Test | Result |
|---|---|
| C1 generator-is-not-verdict (keystone) | a max-confidence (100) telling that drifts → REFUSED on fidelity. Confidence never authorizes. |
| C2 all eight load-bearing | baseline authorized; each of the eight knocked out in turn → REFUSED on exactly that axis. No seven-of-eight passes. |
| C3 C⁴ wins over S⁴ | all four S⁴ axes cleared, c1_trust violated → REFUSED on c1_trust. The floor wins. |
| C4 anti-confabulation | fluent + faithful + complete but claims 2 open summits closed → REFUSED on frontier_honesty. |
| C5 fail-closed conversation | no draft satisfies within budget (4 redrafts) → honest gap message naming the axis, ships nothing. |
| C6 per-turn receipt recompute | /usr/bin/shasum on the exported canonical → MATCH; one-byte tamper → DIFFER. |
| C7 conversational geometry steering | same discovery steered to patient then physicist; each telling gated on the full eight-axis set. |
Cumulative across the LVC + Franklin suites: 191/191 (V2 18 · V3 30 · Constitutional 28 · UI Striving 21 · Perpetual 19 · Autonomous Close 20 · Localization 14 · Franklin Story 22 · Franklin Chat 19).
7 · NAMED FRONTIER (not faked)¶
summit.franklin.freeform_intent_quantizer— free-form LLM intent extraction beyond the deterministic keyword/NL extractor. The deterministic extractor stays the recomputable primary; an LLM-quantized turn's receipt cannot recompute bit-for-bit, so this is named-open with a concrete close condition.- Any geometry profile not yet validated against a real reader.
- Audio modality per geometry where not yet exercised.
- The standing 7 non-English locales (GFTCL-LION-LVC-012), real translation provenance required.
- Axis thresholds (ε1, ε2, ε4, εf, εt, εc) not yet field-calibrated.
The strongest true claim¶
Franklin takes typed instructions, the on-device Apple model composes the telling fast and sovereign, and the proven gate decides — measuring across the full UUM-8D axis set, all four C⁴ eudaimonic constraints and all four S⁴ story projections, every one load-bearing, the floor winning on conflict — whether the telling preserved what the operator asked. The model never grades itself; its confidence never authorizes; it cannot confabulate a closed summit because the gate checks the real registry; and it fails closed rather than ship a drifted answer. Every turn hands the operator a receipt they verify themselves.
Nothing past the proof.
Appendix · Artifacts¶
| Artifact | Path |
|---|---|
| Eight-axis gate (Lean) | proof/lean/FirstRoars/TellingGate.lean |
| Instruction quantizer (Swift) | cells/xcode/Sources/LVCQuantizer/ConversationalInstructionQuantizer.swift |
| Chat gate + gated generation (Swift) | cells/xcode/Sources/LVCEngine/FranklinChatGate.swift |
| Substrate v143 | cells/xcode/Sources/GaiaFTCLCore/NarratorSchemaV143.swift |
| Hostile test | cells/xcode/Sources/M8FranklinChatVerify/main.swift — 19/19 |
| Summit | summit.franklin.freeform_intent_quantizer |
| Doctrine | this file |
Federation-cosigned
This page's source is sealed in the GaiaFTCL federation manifest — page SHA-256 36b580e7e626b650…, manifest witness a090592e0609adc8…, signed 2026-06-02T18:58:22Z by cell gaiaftcl-mac-cell. Verify with gaiaftcl wiki sign --all and compare wiki-all-signatures.json.