Lean-Validated Communication — the dignity-of-sovereignty primitive

The instrument layer of the metrology of meaning. This page describes the measuring device — the proven gate over meaning trajectories. The discipline that builds safely on top of it (fail-closed, unmovable floor, named-frontier) is covered in Metrology-Of-Meaning; the boundary of the discipline lives at Metrology-Frontier.

GFTCL-LION-LVC-003 (the third contract; v1 + v2 + v3 closed in sequence). The cell-wide primitive that witnesses whether meaning survives transformation in any dialog where one party controls the interpretation — and shares the receipt with the person whose sovereignty is at stake.

What seals today (CALORIE, three commands to re-run each)

Zero sorry/axiom/opaque in any of them. The Lean kernel is the warrant; the receipt is provenance, never premise.

What the cell honestly CANNOT seal

• Which meaning is correct (legally / medically). LVC witnesses *drift against a fixed baseline*; it does not declare which baseline is right.
• The domain quantizers' field validity — named-open per quantizer summit (summit.lvc.medical_quantizer, legal_quantizer, education_quantizer).
• The QUANTITY of meaning — Transfer Entropy. The G⊕H collapse gate answers *whether* meaning survived; TE answers *how much* and *in which direction*. Distinct artifact. Named-open: summit.lvc.meaning_quantity. TE estimation is hard in sparse high-dim text — that difficulty is the REASON G⊕H is the fast gate, not a license for G⊕H to replace the quantity measure.

Shared-use doctrine

The receipt belongs to the sovereign party:

• The patient holds the consent-comprehension witness, not the hospital.
• The citizen holds the meaning-drift witness, not the legislature.
• The student holds the comprehension map, not the institution.
• The food consumer holds the chain-of-custody witness, not the producer.

This is enforced at the substrate by the receipt_belongs_to_person column (lvc_receipts v1) and is the constitutional center of the entire LVC primitive.

Klein-bottle witness topology — sealed, NOT refused

Updated GFTCL-LION-LVC-004: the Klein bottle is now the witness topology — the non-orientable manifold meaning trajectories live on, with GTWED as the metric defined OVER it. The Klein bottle is the SPACE; GTWED is the DISTANCE on the space.

Sealed in FirstRoars/WitnessTopology.lean:

• Non-orientability (non_orientable_instance) — a closed loop crossing the horizontal boundary flips the tracked orientation
• Double-loop preservation (double_loop_preserves) — two loops restore orientation (Z/2 topology)
• Boundary-lessness (boundaryless_corner) — every cell's four neighbours land on the surface (no point where sender-sovereignty ends and receiver-sovereignty begins)
• Metric preservation under embedding (gtwed_respects_embedding) — for fundamental-domain trajectories, gtwed3 (raw) equals gtwedEmbedded (on the Klein bottle)

Swift companion LVCCore/WitnessTopology.swift mirrors the seal numerically; the live test suite (M8LVCLiveTestSuite group 02) asserts all four properties on real values every run.

The "Field of Truth" framing remains philosophy. The Klein bottle is now structural — provable, executable, falsifiable.

The Field-of-Truth framing — still philosophy only

The "Field of Truth" metaphor has no presence in seals or code. The alive/dead test applies: it has no dist, no Decidable, nothing to compute. Keep the figure; refuse it as architecture.

The honest boundary

LVC witnesses meaning-drift against a fixed baseline — visible, quantified, replayable — and puts the receipt in the sovereign party's hands. It does not declare which meaning is right.

Phase 4 — MPS one-gate solve

GPU wavefront DP attached to the existing VQbitMetalHarness device. LVCMetal.GTWEDSolver actor solves GTWED + matches against ε in a single dispatch. Float/half for speed; the CPU exact-Rat reference (LVCCore.GTWEDDistance.compute) is the truth. On verdict disagreement the CPU wins — speed never overrides the proof.

Phase 5 — On-device quantizers (sovereign stack only)

LVCQuantizer/NLValenceQuantizer.swift:

• Sliding word windows (configurable size + stride)
• Per-window sentiment via NLTagger(.sentimentScore) — on-device, no API
• Quantize × 1000 → Int (lives in LVCCore's quantum domain)
• 5-point Savitzky-Golay smoothing (window=5, polyorder=2): structural signal preserved, noise removed

Three domain quantizers ship over the same base:

• MedicalConsentQuantizer — disclosure-vs-comprehension arc (consent failure halts the procedure)
• LegalMeaningQuantizer — enacted-vs-operative meaning over legal text
• EducationComprehensionQuantizer — concept-as-taught vs concept-as-restated; double-bind (correlate with understanding, anti-correlate with recall)

No raw plaintext leaves the device. Speech framework integration is named-next.

Phase 6 — Operator rendering

Primary surface: GaiaFTCLLVCCLI and HTTP /lvc/* endpoints. SwiftUI views (LVCDivergenceRibbon, LVCDLOOscillationView) remain in the codebase for optional Franklin.app use; CLI and HTTP produce identical receipts from identical inputs.

Lab-facing surface attached to the existing HTTPListener (no second server):

• GET /lvc/replication (HTML)
• GET /lvc/replication.json (machine-readable twin)
• GET /lvc/summits/feed (RSS 2.0 of pre-registered summits + status changes)
• POST /lvc/summits/{id}/witness (membrane-token-gated structured submission)

Hostile-verifier path

$ swift run GaiaFTCLLVCCLI seal "[80,60,40]" "[78,62,41]" --epsilon 10
   → TERMINAL: CALORIE — collapse (GTWED 5/1 ≤ ε 10)

$ swift run GaiaFTCLLVCCLI verify <receipt-id>
   → TERMINAL: CALORIE — hash bit-matches; the witness recomputes
                         from public inputs

$ swift run GaiaFTCLLVCCLI drift "[80,60,40]" "[78,62,41]"
   → per-segment local drift map; TERMINAL: CURE — total drift N

$ swift run GaiaFTCLLVCCLI summit list
   → 8 named-open LVC summits; CURE — awaiting field/lab close

The CLI proves the witnessed core stands alone, headless. Wiki + HTTP replication pages are the public rendering of the same core.

The claim, stated once. Wherever meaning must transfer through dialog and one party controls the interpretation, the interpreted meaning can drift from the meaning the words were given in use. The party whose sovereignty depends on those words has, until now, had no instrument to witness the drift. LVC witnesses it. The dignity protected is the right to witness whether the words that bind you still mean what they meant when you gave or received them.

The architectural insight

The dignity claim doesn't live in any one domain. It lives in proof/lean/FirstRoars/MeaningInvariant.lean, which runs on any meaning trajectory. Law, medicine, finance, consent, contract negotiation, treatment plans, agency rulings — every dialog-in-use domain inherits the same witnessed protection from one shared seal. The domains differ only in their quantizer.

Seal once. Use everywhere. Share the receipt with whoever's sovereignty is at stake.

Three Lean seals (sealed in this commit)

All three: zero sorry / axiom / opaque. decide is the warrant.

The dignity property, in plain words

Theorem lvc_dignity_pure_function: verdict(M, M_τ, rangeM, T_num, T_den) = verdict(M, M_τ, rangeM, T_num, T_den) proved by rfl — Lean's definitional equality on closed terms.

What this means: the function verdict depends only on its inputs. There is no hidden state, no privileged parameter, no key, no token, no institution-side cooperation needed. Two parties with the same (M, M_τ, T) compute the same verdict.

The captured few cannot gatekeep the witness because the witness has no gate. The patient, the citizen, the consumer — anyone with the source text, the published transformation, and the public threshold can re-run the seal and get the same number the institution claimed. Or the hash mismatches, and the institution's claim is refused.

The medical-consent demo (worked instance, sealed in this commit)

V122 substrate seeds one demo trajectory pair:

• In-use baseline (clinician-given consent): M_source = [80, 60, 40, 20, 0]
• Operative reading (patient-understood paraphrase): M_τ = [78, 62, 41, 19, 1]
• Threshold T = 0.95 (95/100)
• L1 = 2 + 2 + 1 + 1 + 1 = 7
• L1_max = 2 × 100 × 5 = 1000
• G = 993/1000 ≈ 0.993 → verdict CALORIE (meaning preserved)

The receipt lvr-demo-consent belongs to demo-patient, NOT to demo-clinic. The clinic performed the transformation; the patient owns the witness.

Run the dignity-property proof live:

swift run M8MeaningInvariance

Output (real, just from your substrate):

──────── GFTCL-LION-LVC-001 / Dignity-Property Recompute ────────
For each sealed receipt, recompute G from public inputs alone.
If the recomputed G matches the sealed G bit-for-bit, the dignity
property holds: the witness is non-gatekeepable.

✓ lvr-demo-consent
    person:        demo-patient
    actor (τ):     demo-clinic
    sealed G:      993/1000   verdict: calorie
    recomputed G:  993/1000   verdict: calorie  ← matches
    DIGNITY PROPERTY: HOLDS

──────── result: 1 audited; 0 failed ────────
All sealed receipts re-verify from public inputs alone.
The witness is non-gatekeepable; the dignity property holds.

The CLI surface

swift run GaiaFTCLLVCCLI seal "[80,60,40]" "[78,62,41]" --epsilon 10
swift run GaiaFTCLLVCCLI verify <receipt-id>
swift run GaiaFTCLLVCCLI drift "[80,60,40]" "[78,62,41]"

Each receipt exposes verdict (PRESERVED / CAPTURED · IN-USE STANDS), G as exact rational, L1 / L1_max, the actor of τ, and who the receipt belongs to (the person). verify recomputes from public inputs — the dignity property made tangible in one command.

What this commit refuses to do

• Decide which meaning is RIGHT. LVC witnesses *meaning-drift against a fixed baseline*. It makes divergence visible, quantified, replayable. It does NOT declare which baseline is legally / medically correct. That is the operator's claim; LVC just makes the drift visible.
• Bake legal or medical assumptions into MeaningInvariant. The seal is domain-agnostic. Only quantizers are domain-specific.
• Use any external NLP API. Quantizers run on local substrate components. summit.lvc.medical_quantizer and summit.lvc.legal_quantizer are named-open precisely because they require *sovereign* extraction — the cell builds them on its own components or names the missing primitive.
• Claim the institution can gatekeep the witness. The receipt belongs to the person. The substrate trigger trig_lvc_receipts_immutable refuses any UPDATE to receipt_belongs_to_person after seal.

Open frontier (four summits)

The shared-use doctrine

• The CLI proves the mechanism (sealed G, drift map, falsifiable, replayable).
• The use is shared: the receipt belongs to the person whose meaning is at stake, not the interpreting institution.
• In law: the citizen holds the witness of how operative meaning drifted from enacted meaning. The agency does not get to control the receipt.
• In medicine: the patient holds the witness of whether the consent meaning they were given survived into what they operatively understood. Dignity over one's own body, witnessed. The clinic does not get to control the receipt.
• In any dialog-in-use domain: the party who could be captured holds the instrument that witnesses the capture.
• The honest boundary: LVC does not declare which meaning is *correct*. It forces the captured-invisible into the witnessed-open and puts the receipt in the sovereign party's hands. That is the dignity: not that the machine judges, but that the person can finally see and prove whether the words that bind them still mean what they meant in use.

Constitutional posture

• No external NLP API. No cloud call. No third-party dependency.
• SQLite witness store; lvc_receipts immutable by trigger.
• All NATS subjects spelled gaiaftcl (verified by check_nats_subject_spelling.sh).
• Receipt belongs to the person; the substrate trigger refuses any change to receipt_belongs_to_person.
• The Lean theorem lvc_dignity_pure_function is the structural guarantee that the witness cannot be gatekept. The CLI and the SwiftUI panel both prove it operationally.

© 2026 Richard Gillespie. USPTO patent applications 19/460,960 and 19/096,071.