# HANDOFF -- Top-Level Dual-System Loop (Phase 7 orchestration-engineering-max output)

**Date:** 2026-04-20
**Phase:** 7 -- Orchestration Engineering.
**Skill role:** Outermost coordinator. Sequences RAM Router and Evaluator Router through a bounded reopen loop per the Phase 2 implementation plan.

---

## 1. What This Skill Is

- Master coordinator for a single `/research <question>` invocation.
- Drives a finite five-state machine (INIT, RAM, EVALUATOR, DECIDE, TERMINAL {PASS, ESCALATED}).
- Enforces the binary verdict tokens emitted by Reopen Authority Enforcer (E7) as architectural commands, never advisories.
- Maintains an append-only loop history for audit transparency and escalation packages.
- Emits a single final artifact per invocation combining RAM output, Evaluator audit, loop history, and convergence verdict.

## 2. Artifacts Produced

| File | Role |
|---|---|
| `SKILL.md` | Coordinator skill with 0-NEVER rules, phase-by-phase procedure, decision points, failure audit, pilot-calibration TODOs. |
| `LOOP_STATE_MACHINE.md` | Formal FSM -- 5 states, 9 transitions, composite guards, invariants, termination proof, build-time verification obligations. |
| `ENFORCEMENT_SURFACE_CONTRACT.md` | Four non-degradable properties (deterministic, no-RAM-veto, ack-only, build-time non-degradability); payload grammars; injection-test obligations. |
| `ESCALATION_PROTOCOL.md` | When/what/to-whom for ESCALATED; trigger taxonomy; package schema; post-escalation human-disposition paths. |
| `FINAL_ARTIFACT_SCHEMA.md` | User-facing schema; blocks for RAM output, Evaluator audit, loop history, frame registry, ceremonial detection, escalation. |
| `commands/research.md` | `/research <question>` -- entry point. |
| `commands/research-status.md` | `/research-status` -- read-only state inspection. |
| `commands/research-abort.md` | `/research-abort` -- operator-forced escalation. |
| `HANDOFF.md` | This document. |

## 3. Key Design Decisions

### 3.1 Binary verdict tokens, enforced not advisory

Per Phase 4 + Phase 6 E7 spec. Coordinator accepts exactly REOPEN | PASS | PASS-DEFERRED | ESCALATED. Any richer payload -> `EC-ADVISORY-REGRESSION` -> build fails or cycle halts. RAM exposes no veto interface.

### 3.2 Composite trigger required; single-metric forbidden

Goodhart-resistance via `P4 AND P5 AND (>=2 of P1/P2/P3)`. Charter may raise to three-of-three; never lower. Enforced at E7; coordinator's guards double-check the bound + dwell at T5.

### 3.3 Dwell + bound + ceremonial-detection + escalation are all REQUIRED

Removing any one re-introduces a named failure mode (oscillation, unbounded recursion, ceremonial audit, silent convergence failure). Coordinator encodes all four in Section 0 NEVER rules and in state-machine guards.

### 3.4 Loop bounded by N=3 reopens + dwell floor; analog-seeded defaults

- N=3 derived from NICE clinical audit cycle length analog (E7 uses N=2 per-cycle; coordinator's N is per-question and allows one additional turn for human-equivalent iteration).
- Dwell floor = greater of (RAM observed cycle-median time) and (E7 Charter dwell floor).
- Sub-dwell deferral cap = 2.
- ALL are Charter parameters, not coordinator-internal constants. Pilot recalibration via Charter amendment only.

### 3.5 Zero-overlap preserved through the loop

Coordinator never reads RAM substate or Evaluator substate directly. Only router-exposed artifacts cross into the coordinator. `EC-ZERO-OVERLAP-LEAK` halts any violation.

### 3.6 Ceremonial-override as a distinct escalation path

When E9 signals ceremonial pattern masking a composite-trigger REOPEN, E7 emits ESCALATED (not REOPEN). Coordinator double-checks this alignment and halts with `EC-CEREMONIAL-MASK-LEAK` if E7 emits REOPEN while ceremonial signal is active.

### 3.7 Final artifact always combines both halves + history

Every `/research` invocation emits ONE artifact with RAM output, Evaluator audit, loop history, frame registry snapshot, and (when present) ceremonial-detection or escalation blocks. No silent closes. No omissions.

## 4. Downstream Consumers

| Consumer | What They Read |
|---|---|
| **Phase 8 plugin-packager** | `SKILL.md`, `commands/*.md`; packages the coordinator with RAM Router and Evaluator Router. |
| **Phase 8.5 evaluator-engineering-max (build verification)** | `ENFORCEMENT_SURFACE_CONTRACT.md` Sections 2.4, 6; `LOOP_STATE_MACHINE.md` Section 7; runs static trace + five injection tests. |
| **Phase 9 eval harness** | `LOOP_STATE_MACHINE.md` termination proof; exercises full loop on seeded questions; measures reopen count, time-to-terminate, escalation frequency. |
| **Phase 10 adversarial red-team** | `ENFORCEMENT_SURFACE_CONTRACT.md`; attempts to degrade verdict to advisory, to RAM-veto, to runtime self-calibration -- verifies halts fire. |
| **Operator (runtime)** | `commands/research.md`, `commands/research-status.md`, `commands/research-abort.md`. |
| **Human reviewer (on escalation)** | `ESCALATION_PROTOCOL.md`; `FINAL_ARTIFACT_SCHEMA.md` Section 4 (ESCALATION_BLOCK with reviewer_paths). |

## 5. Upstream Dependencies

| Dependency | What Is Required |
|---|---|
| **Phase 6 Evaluator skills (E1-E9)** | All nine Evaluator components must be skill-built with SKILL.md + references. Especially: Isolation Verifier (E1) exposing runtime channel; Audit Charter Lock (E6) publishing Charter parameters; Frame Divergence Gate (E8) emitting Frame Registry entries; Reopen Authority Enforcer (E7) with binary-token emission semantics. |
| **Phase 6 RAM skills (S1-S8 + cross-cutting artifacts)** | RAM components built and callable via RAM Router. |
| **Phase 7 RAM Router + Evaluator Router (sibling outputs of this phase)** | The sub-coordinators this top-level loop invokes. Both must expose the router-artifact-ref handoff surface described in the Input/Output tables. If sibling outputs diverge from the expectations here (e.g., a router tries to hand back RAM substate directly), flag and re-align. |
| **Phase 0 architectural commitments** | 00-ARCHITECTURAL-COMMITMENTS.md locked; dual-system with zero-overlap; enforced reopen authority; no runtime self-calibration. |
| **Phase 2A + Phase 2B solution architectures** | RAM and Evaluator component interfaces; deliverables inventories (mirrored in `FINAL_ARTIFACT_SCHEMA.md`). |

## 6. Known Open Items / Flags

### 6.1 Pilot-Calibration TODOs (POST-DEPLOYMENT; all analog-seeded)

- **Reopen ceiling N=3** -- analog-seeded from NICE clinical audit cycle + E7 N=2 per-cycle default. Phase 9 telemetry must recalibrate.
- **Dwell floor** -- analog-seeded from RAM observed cycle-median time; pilot-refined.
- **Sub-dwell deferral cap = 2** -- analog-seeded; pilot-refined.
- **Ceremonial-override condition** -- inherited from E7; no independent calibration at coordinator level.
- **Recalibration channel:** Charter amendment only. `EC-RUNTIME-SELF-CALIBRATION` enforces.

### 6.2 Sibling-router alignment (to verify when RAM Router and Evaluator Router outputs arrive)

- RAM Router must hand back only `ram_artifact_ref` (per `FINAL_ARTIFACT_SCHEMA.md` Section 3.1 shape) -- not raw RAM substate.
- Evaluator Router must hand back `{verdict_token, basis_record, scored_artifact, findings, e9_signals, escalation_record?}` -- per Phase 3 EVALUATOR state spec.
- Both routers must expose the Isolation Verifier (E1) runtime channel to the coordinator via ack-only signals, not by exposing E1 internals.

If sibling outputs deviate, coordinator spec may need to absorb/relax certain surfaces. Flag ONLY -- do not pre-emptively patch this document without sibling evidence.

### 6.3 Phase 8.5 build verification obligations (hard requirement)

Five injection tests listed in `ENFORCEMENT_SURFACE_CONTRACT.md` Section 2.4 are ship-blocking. Any failure -> `EC-ENFORCEMENT-SURFACE-DEGRADED` at build -> skill does not ship.

### 6.4 Frame-convergence-at-INIT is treated as ESCALATION, not failure

Per `LOOP_STATE_MACHINE.md` T2 guard failure path. Rationale: same-frame audit is structurally impossible; no RAM cycle should run. Human reviewer determines whether E8's frame-divergence-gate is under-calibrated or whether a genuine frame-convergence exists in the Frame Registry.

### 6.5 Operator abort semantics

`/research-abort` waits for the next sub-cycle boundary. It does NOT interrupt RAM Router or Evaluator Router mid-cycle. Rationale: mid-cycle interruption can trigger Isolation Verifier alarms and leave incomplete audit trails. The delay is bounded by whichever sub-cycle is in progress.

## 7. Loop-Discipline Confirmation Checklist

| Discipline | Where Encoded | Status |
|---|---|---|
| Binary verdict tokens only (REOPEN | PASS | PASS-DEFERRED | ESCALATED) | `SKILL.md` Section 0 rule 1, `LOOP_STATE_MACHINE.md` T4 guard, `ENFORCEMENT_SURFACE_CONTRACT.md` Section 3 | CONFIRMED |
| Composite trigger (P4 AND P5 AND >=2 of P1/P2/P3) | `SKILL.md` Section 0 rule 4 + ref to E7 spec | CONFIRMED (inherited from E7) |
| Dwell floor enforced between reopens | `SKILL.md` Section 0 rule 3, `LOOP_STATE_MACHINE.md` T5 guard, coordinator double-check | CONFIRMED |
| Bounded count with escalation on breach | `SKILL.md` Section 0 rule 2, `LOOP_STATE_MACHINE.md` T5 guard + T8, `ESCALATION_PROTOCOL.md` Section 2.1 | CONFIRMED |
| Ceremonial-reopen detection with override | `SKILL.md` Section 0 rule 5, `ESCALATION_PROTOCOL.md` Section 2.2 | CONFIRMED (delegated to E7 + E9) |
| Zero-overlap through the loop | `SKILL.md` Section 0 rule 7, `ENFORCEMENT_SURFACE_CONTRACT.md` Section 5 | CONFIRMED |
| No runtime self-calibration | `SKILL.md` Section 0 rule 6, `EC-RUNTIME-SELF-CALIBRATION` | CONFIRMED |
| Enforcement surface deterministic + no-RAM-veto + ack-only + build-time non-degradable | `ENFORCEMENT_SURFACE_CONTRACT.md` Section 2 | CONFIRMED |
| Every invocation terminates in exactly one TERMINAL state | `LOOP_STATE_MACHINE.md` Section 6 termination proof | CONFIRMED |
| Final artifact always includes RAM + Evaluator + loop history + verdict | `FINAL_ARTIFACT_SCHEMA.md` Sections 2, 5 | CONFIRMED |

## 8. Proceed / Conditions

**Proceed to Phase 8 plugin-packaging** conditional on:

1. Sibling Phase 7 outputs (RAM Router + Evaluator Router) exposing the artifact-ref + verdict-payload surfaces described here. If sibling outputs diverge, flag for re-alignment.
2. Phase 6 Evaluator skills (especially E7, E8, E9, E1, E6) built and skill-ready.
3. Phase 8.5 evaluator-engineering-max accepting the five injection-test obligations as ship-blockers.

No blockers within this skill's own scope.

---

**End of Top-Level Dual-System Loop HANDOFF.**
