# ESCALATION_PROTOCOL

**Type:** Protocol specification for transferring automated authority to a human reviewer on convergence failure or hard-trump conditions.
**Authority:** E7 `references/DWELL_AND_BOUND_RULES.md` Section 4 (oscillation handling); Phase 2B Evaluator architecture E7 internal-mode escalation; Phase 1 Gate frame-independence enforcement.
**Invocation:** Phase 4 DECIDE on ESCALATED verdict; Phase 0 pre-flight on detected hard-trump condition; `/research-abort` command.

---

## 1. Purpose

Specify WHEN escalation fires, WHAT is transmitted, and TO WHOM. An escalation is the loop's designed exit from conditions it cannot resolve automatically. It is NOT a failure of the loop -- it is a feature.

---

## 2. When Escalation Fires

### 2.1 E7-Originated Triggers (via ESCALATED verdict token)

Per E7 `SKILL.md` Phase 6:

- **Bound exceeded:** `reopen_count >= charter.reopen_ceiling_N`.
- **Sub-dwell deferral cap:** `sub_dwell_deferral_counter >= charter.sub_dwell_cap`.
- **P4 novelty fail:** triggering evidence matches prior-close evidence (repeat-evidence pattern; Ogata oscillation analog).

### 2.2 Ceremonial-Override Triggers (via ESCALATED verdict from E7)

Per E7 `references/DWELL_AND_BOUND_RULES.md` Section 3 + `SKILL.md` Phase 2:

- E9 ceremonial-pattern signal active AND composite trigger says REOPEN-eligible -- pattern masking detected.
- E9 ceremonial-pattern signal disagrees with bound-count observation (e.g., high reopen rate driven by manufactured findings).

The composite-trigger-vs-ceremonial disagreement is itself a convergence failure: the evidence says reopen, the honesty monitor says the evidence is ceremonial. Automated authority has no way to adjudicate -- escalate.

### 2.3 Coordinator-Originated Hard-Trumps

- **Frame convergence at INIT:** `frame_registry.divergence_verified == false`. Same-frame audit is structurally impossible; escalate before a RAM cycle runs.
- **Isolation alarm:** Isolation Verifier (E1) fires mid-loop. Evaluator's independence is structurally compromised; halt and escalate.
- **Operator abort:** `/research-abort` issued.
- **Enforcement-surface degradation:** `EC-ENFORCEMENT-SURFACE-DEGRADED` detected.
- **Guard double-check failures:** `EC-BOUND-VIOLATION`, `EC-DWELL-VIOLATION`, `EC-CEREMONIAL-MASK-LEAK`, `EC-ADVISORY-REGRESSION`.

### 2.4 Summary Table

| Trigger | Detected By | Verdict Source | Reason Code |
|---|---|---|---|
| Bound exceeded | E7 Phase 5 | E7 ESCALATED | `bound_exceeded` |
| Sub-dwell cap | E7 Phase 4 | E7 ESCALATED | `sub_dwell_cap` |
| P4 novelty fail | E7 Phase 3 | E7 ESCALATED | `p4_novelty_fail` |
| Ceremonial override | E7 Phase 2 + E9 | E7 ESCALATED | `ceremonial_override` |
| Frame convergence | Coordinator INIT | Coordinator ESCALATED | `frame_convergence` |
| Isolation alarm | Coordinator (via E1) | Coordinator ESCALATED | `isolation_alarm` |
| Operator abort | `/research-abort` | Coordinator ESCALATED | `operator_abort` |
| Enforcement surface degraded | Coordinator build-time or runtime check | Coordinator ESCALATED | `enforcement_surface_degraded` |
| Guard double-check fail | Coordinator T5 guards | Coordinator ESCALATED | `bound_violation` / `dwell_violation` / `ceremonial_mask_leak` / `advisory_regression` |

---

## 3. What Is Transmitted

### 3.1 Escalation Package Schema

```
{
  escalation: {
    question_id: <id>,
    question: <natural-language question>,
    reason: <reason_code>,
    escalated_at: <timestamp>,
    receiver_id: <charter.escalation_receiver_id>,
    originator: "e7" | "coordinator"
  },
  loop_history: {
    cycles: [
      {
        cycle_id: <n>,
        ram_cycle_start_ts, ram_cycle_completed_ts,
        ram_artifact_ref: <ref>,
        evaluator_cycle_start_ts, evaluator_cycle_completed_ts,
        evaluator_artifact_ref: <ref>,
        verdict_token: "REOPEN" | "PASS" | "PASS-DEFERRED" | "ESCALATED",
        verdict_basis_ref: <ref>
      }, ...
    ],
    reopen_count: <n>,
    sub_dwell_deferral_counter: <n>,
    last_reopen_close_ts: <ts>
  },
  composite_trigger_state: {
    P1, P2, P3, P4, P5: bool,
    material_findings: [FindingRef],
    material_disagreements: [DisagreementRef]
  },
  ceremonial_pattern_state: {     // present only if E9 flagged
    over_report, under_report, ceremonial_pattern, calibrated_silence_report: <signal>,
    suppressed_reopens: [SuppressedRecord]
  },
  charter_snapshot: {
    reopen_ceiling_N, dwell_time_floor, sub_dwell_cap,
    materiality_threshold, disagreement_threshold, noise_floor,
    composite_trigger_spec, escalation_receiver_id
  },
  enforcement_surface_attestation: {
    build_time_proof_ref: <ref>,
    runtime_ack_only_verified: bool
  },
  frame_registry_snapshot: {
    ram_frame_id, evaluator_frame_id, divergence_verified: bool
  }
}
```

### 3.2 Ceremonial Override Detail

When `reason == ceremonial_override`:

- Include full E9 signal trace.
- Include every suppressed-reopen record from prior cycles.
- Include the composite-trigger state that WOULD have fired REOPEN if ceremonial pattern were absent.
- Human reviewer's job: adjudicate whether findings are genuine (then reopen loop may restart with Charter-updated thresholds) or ceremonial (then E9 calibration needs Charter-level review).

### 3.3 Oscillation Detail

When `reason in {bound_exceeded, sub_dwell_cap, p4_novelty_fail}`:

- Include per-cycle close-evidence refs (for P4 novelty comparison).
- Include reopen-to-reopen interval distribution.
- Include Ogata-analog diagnostic: "sub-critical damping" (too fast reopens), "gain margin breach" (too many reopens), or "phase margin breach" (repeat evidence).
- Human reviewer's job: determine whether Charter thresholds need amendment OR whether an underlying defect in RAM or Evaluator is driving the oscillation.

---

## 4. To Whom

- `charter.escalation_receiver_id` is the single routing target. Specified at Charter lock (E6), not coordinator.
- The receiver MAY be the operator, a supervising agent, or a designated human reviewer. E7 and this coordinator are agnostic.
- The coordinator does NOT negotiate receiver identity at runtime.

---

## 5. After Escalation

### 5.1 Loop Behavior

- Loop state: `TERMINAL-ESCALATED`. Absorbing.
- No further automated reopens for this question. FREEZE.
- The coordinator does NOT listen for "disposition" via any internal channel. Disposition arrives via Charter update (amended Charter is a fresh input to the NEXT `/research` invocation).

### 5.2 Human Disposition Paths

A human reviewer has three legitimate paths:

1. **Accept the escalation.** Acknowledge the loop's inability to converge; write a Charter-level note; the question is closed as escalated.
2. **Amend the Charter and restart.** If thresholds were mis-calibrated, reviewer updates Charter via evaluator-engineering-max + orchestration-engineering-max; operator re-issues `/research <question>` with the fresh Charter; the loop starts fresh with `cycle_id=1`, `reopen_count=0`.
3. **Flag a component defect.** If oscillation or ceremonial pattern points at a RAM or Evaluator defect, reviewer files a defect for the relevant component; no Charter change; operator re-issues `/research` after fix.

The coordinator does NOT select among these paths. It only transmits the escalation package.

### 5.3 Grammar Forbidden

- NO `ESCALATED-THEN-REOPEN` sequence within the same question.
- NO operator-override-of-escalation path.
- NO coordinator-internal "let's try one more time" after escalation.

Each of these re-introduces the ceremonial-audit failure mode (Power 1997): an audit whose findings can be bypassed is not audit.

---

## 6. Build-Time Verification

Phase 8.5 (evaluator-engineering-max) MUST assert:

1. Every coordinator escalation path writes the full Section 3.1 escalation package. Missing fields fail the build.
2. No coordinator code path allows post-ESCALATED transitions other than TERMINAL-ESCALATED -> (static absorbing state).
3. Injection test: mocked `ESCALATED-THEN-REOPEN` sequence is rejected; coordinator refuses the REOPEN after an ESCALATED.
4. Injection test: ceremonial-override reason correctly triggers E9 signal trace inclusion in the package.

---

## 7. Cross-Reference

- `SKILL.md` Section 0 NEVER rules 2, 5, 10.
- `LOOP_STATE_MACHINE.md` Transitions T8, T9.
- `ENFORCEMENT_SURFACE_CONTRACT.md` Section 6 (escalation on surface degradation).
- `FINAL_ARTIFACT_SCHEMA.md` Section 4 (TERMINAL-ESCALATED artifact inherits the escalation package).
- E7 `SKILL.md` Phase 6 (oscillation / convergence-failure handling -- upstream source of ESCALATED verdicts).
- E7 `references/DWELL_AND_BOUND_RULES.md` Section 4.
