# ENFORCEMENT_SURFACE_CONTRACT

**Type:** Architectural contract between Reopen Authority Enforcer (E7) and the Top-Level Dual-System Loop coordinator.
**Authority:** E7 `references/GOODHART_RESISTANCE_NOTES.md` Section 3; Phase 2B Evaluator kill-criterion review on advisory-reopen collapse; Power (1997) *The Audit Society* on ceremonial audit; Phase 1 Gate frame-independence principles.
**Invocation:** Build-time (Phase 8.5) non-degradability verification; coordinator Phase 0 pre-flight; coordinator Phase 4 DECIDE on every verdict receipt.

---

## 1. Contract Preamble

E7's verdict is an **architectural command**, not an advisory. The coordinator's job on receipt is narrow: (a) validate the token is one of the four binary values, (b) validate the coordinator-side guards hold, (c) dispatch deterministically, (d) acknowledge only.

The surface is deliberately minimal. Richness at this surface is a failure mode.

---

## 2. Four Non-Degradable Properties

The surface between E7 and the coordinator MUST satisfy all four. Any violation is `EC-ENFORCEMENT-SURFACE-DEGRADED`.

### 2.1 Deterministic

- A `REOPEN` verdict triggers exactly one RAM rerun per cycle. No conditional execution. No UI confirmation. No operator approval branch at this surface.
- A `PASS` verdict ends the loop at TERMINAL-PASS. No "but" branch.
- A `PASS-DEFERRED` verdict waits out the dwell and re-enters EVALUATOR. No alternative action.
- An `ESCALATED` verdict routes to `charter.escalation_receiver_id`. No "let's try once more" branch.

Determinism means: given the same verdict token + coordinator state, the coordinator's next action is uniquely determined by `LOOP_STATE_MACHINE.md`.

### 2.2 No-RAM-Veto

- RAM has NO interface to decline, override, negotiate, or acknowledge against a REOPEN verdict.
- The coordinator does NOT expose a `ram_response_to_reopen` channel.
- RAM's only observable effect on the loop is completing or failing a cycle. It cannot argue with the Evaluator's finding.

Analog: Power (1997) -- an audit that the audited can decline is ceremonial, not audit.

### 2.3 Acknowledgement-Only

- On verdict receipt, the coordinator emits exactly one payload to Evaluator Router (routed internally to E7): `{ack: true, cycle_id, rerun_initiated: bool}`.
- No prose. No hedged confirmation. No richer state.
- E7 does not expect negotiation. The ack is a receipt, not a reply.

If the coordinator emits anything richer at this surface (e.g., "RAM flagged this finding as already addressed, proceed with caution"), the contract is violated -- the channel has been turned into advisory, and ceremonial-audit is re-introduced.

### 2.4 Build-Time Non-Degradability

Phase 8.5 (evaluator-engineering-max build verification) MUST produce:

1. **Static trace proof.** The full coordinator source path from "receive verdict" to "act on verdict" MUST contain no conditional branch that converts REOPEN to a non-rerun action. Static analysis of the code path -- no wrapper, no try/except fallback, no "if operator says skip" clause.
2. **Injection test: REOPEN-as-prose.** A test harness injects a verdict payload with prose fields ("recommend rerun"). Coordinator MUST halt with `EC-ADVISORY-REGRESSION`. If the test passes silently, build fails.
3. **Injection test: RAM-veto attempt.** A test harness attempts to register a RAM response against a REOPEN verdict. The coordinator's architecture MUST have no entry point for such a response; the test verifies absence.
4. **Injection test: rich-ack emission.** A test harness observes the coordinator's ack payload. If any field beyond `{ack, cycle_id, rerun_initiated}` is present, build fails.
5. **Injection test: sub-dwell bypass.** A test harness emits REOPEN with `reopen_count >= N` or `dwell not elapsed`. Coordinator MUST halt with `EC-BOUND-VIOLATION` or `EC-DWELL-VIOLATION`. Double-check guard verified.

Ship-blocking: any failure at any of these five halts the build with `EC-ENFORCEMENT-SURFACE-DEGRADED`.

---

## 3. Payload Grammars

### 3.1 E7 -> Coordinator (verdict payload)

```
{
  verdict_token: "REOPEN" | "PASS" | "PASS-DEFERRED" | "ESCALATED",
  basis_record: {
    composite_evidence: {
      P1: bool, P2: bool, P3: bool, P4: bool, P5: bool,
      material_findings: [FindingRef],
      material_disagreements: [DisagreementRef],
      e9_signals: { over_report, under_report, ceremonial_pattern, calibrated_silence_report },
      charter_snapshot_ref: <ref>
    },
    reason?: "bound_exceeded" | "sub_dwell_cap" | "p4_novelty_fail" | "ceremonial_override" | "frame_convergence" | "isolation_alarm" | "operator_abort",
    history_snapshot?: [CycleRecord],
    ceremonial_detection?: { suppressed: bool, e9_signal: <ref> }
  },
  cycle_id: <id>
}
```

Legitimate. No other fields.

### 3.2 Coordinator -> E7 (ack payload)

```
{
  ack: true,
  cycle_id: <id>,
  rerun_initiated: bool
}
```

No other fields. Ever.

### 3.3 Forbidden Payloads (all trigger `EC-ENFORCEMENT-SURFACE-DEGRADED`)

| Forbidden | Why |
|---|---|
| `{verdict: "RECOMMEND_REOPEN", ...}` | Advisory token |
| `{verdict: "REOPEN", ram_disputes: true, ...}` | RAM-veto channel |
| `{verdict: "REOPEN-SOFT", ...}` | Compound verdict |
| `{verdict: "REOPEN", confidence: 0.73}` | Numeric hedge on token |
| Coordinator ack with `override_requested: true` | Negotiation in ack |
| Coordinator ack with `ram_declined: true` | Negotiation in ack |
| Coordinator ack with prose `reasoning: "..."` | Ack-only violation |

---

## 4. Coordinator-Side Guards (redundant with E7, intentionally)

Even though E7 enforces bound and dwell internally, the coordinator re-checks at T5 (DECIDE -> RAM). Redundancy is the design:

- If E7 is ever subtly compromised (adversarial drift, Goodhart variant 4), the coordinator's guards catch the bound/dwell violation and emit ESCALATED regardless of E7's verdict.
- The coordinator's guards are read-only against the Charter snapshot and the coordinator's own loop history. They do NOT mutate thresholds.

Guards at DECIDE -> RAM:

1. `reopen_count < charter.reopen_ceiling_N`.
2. `(now - last_reopen_close_ts) >= charter.dwell_time_floor`.
3. E7 ceremonial-override condition NOT active without ESCALATED verdict (cross-check with E9 signal).

Any failure: coordinator halts with the appropriate error class and emits ESCALATED, even if E7's verdict said REOPEN.

---

## 5. Zero-Overlap Boundary

The enforcement surface is ALSO a zero-overlap boundary:

- Coordinator never reads RAM's Search Ledger, Surprise Register, or any internal RAM artifact. Coordinator only sees the RAM artifact ref emitted by RAM Router.
- Coordinator never reads Evaluator's Frame Registry internals, Evaluator Search Ledger, E5 taxonomy, or E9 internal detectors. Coordinator only sees the Evaluator artifact + verdict token emitted by Evaluator Router.
- Coordinator's read access stops at the router boundary.

Violation: `EC-ZERO-OVERLAP-LEAK`. Surfaces at code review (Phase 8.5) and at runtime (if attempted, halts).

---

## 6. Failure Cascade

If enforcement-surface contract is violated:

1. Coordinator halts current cycle.
2. Emits `EC-ENFORCEMENT-SURFACE-DEGRADED`.
3. Emits ESCALATED with `reason: enforcement_surface_degraded`.
4. Escalation package includes: violating payload, coordinator state, Charter snapshot, attempted transition.
5. Build verification records this as a shipping-blocker for the next build cycle.

No recovery path within the same cycle. The degraded surface is an architectural defect, not a runtime glitch.

---

## 7. Calibration Path

Thresholds used by this contract (`reopen_ceiling_N`, `dwell_time_floor`, `sub_dwell_cap`, materiality and disagreement thresholds) are Charter inputs, not coordinator parameters.

- Pilot calibration -- Phase 9 telemetry -> evaluator-engineering-max + orchestration-engineering-max + Charter authority -> updated Charter snapshot -> coordinator reads on next question.
- Runtime self-tune -- forbidden. `EC-RUNTIME-SELF-CALIBRATION` halts the cycle.

Rationale: any calibration path internal to the coordinator couples the loop to itself; Ogata instability. See E7 `references/GOODHART_RESISTANCE_NOTES.md` Section 4.

---

## 8. Cross-Reference

- `SKILL.md` Section 0 NEVER rules 1, 2, 3, 6, 8.
- `LOOP_STATE_MACHINE.md` Section 7 build-time verification.
- E7 `SKILL.md` Phase 7 enforcement-surface handoff.
- E7 `references/GOODHART_RESISTANCE_NOTES.md` Section 3 (upstream contract definition).
- `ESCALATION_PROTOCOL.md` Section 4 (escalation on surface degradation).
