# HANDOFF -- Evaluator Router (Phase 7 -> Phase 8)

**Phase:** 7 -- orchestration-engineering-max
**Deliverable Set:** Evaluator Router coordinator skill + 3 command files + 4 orchestration docs (SKILL.md, ORCHESTRATION_MEGAPROMPT.md, INTERFACE_CONTRACTS.md, FRAME_LOADING_RULES.md) + this HANDOFF.md.
**Target Receiver:** plugin-packaging-max (Phase 8) AND evaluator-engineering-max (Phase 8.5).

---

## 1. What Shipped

| File | Purpose | Status |
|---|---|---|
| `SKILL.md` | Evaluator Router coordinator skill with frontmatter + procedure skeleton + anti-deviation | Complete |
| `ORCHESTRATION_MEGAPROMPT.md` | Full orchestration logic R0..R9; skill-boundary audit; active working set spec | Complete |
| `INTERFACE_CONTRACTS.md` | 24 edge schemas; cross-cutting write rules; error class registry | Complete |
| `FRAME_LOADING_RULES.md` | Seven-frame mapping; role-divider enforcement; Chilisa overlay; theta_q defaults | Complete |
| `commands/eval-audit.md` | Slash command for full audit run | Complete |
| `commands/eval-charter.md` | Slash command for charter lock / amend | Complete |
| `commands/eval-abort.md` | Slash command for in-flight halt | Complete |

---

## 2. Independence Confirmation (non-negotiable posture carried forward)

### 2.1 Zero-overlap at runtime

- Router sits exclusively in the Evaluator silo. NEVER reads `state/ram/*` content. NEVER writes to `ram/` library paths.
- E1 Isolation Verifier pre-flight HALT gate runs at R1 on every `/eval-audit` AND `/eval-charter`. No downstream skill runs without PASS.
- `isolation_verifier_clearance_id` propagates into every Frame Registry write and every Ledger write. Missing back-reference = contract violation = HALT.
- Cross-cutting artifacts (Frame Registry, Evaluator Search Ledger) live under `state/evaluator/*`. Writer sets disjoint from RAM's. Record kinds disjoint from RAM's.
- Bridge handoff at R9 is one-way (Router -> top-level loop) with acknowledgement-only response. Any richer reply = `EC-ENFORCEMENT-SURFACE-DEGRADED`.

### 2.2 Independent retrieval

- Evaluator retrieval strategy lives inside Frame Host's frame-methodology packs at `evaluator/references/frame-methodology-packs/<frame_id>/`. Seven frames, seven retrieval profiles.
- Evaluator Search Ledger records `audit-query` / `audit-finding` / `audit-null` / `audit-refusal` / `reopen-event` -- five kinds, deliberately disjoint from RAM's four.
- E1 runtime I3 invariant verifies no retrieval call presents a capability token matching RAM's allowed_retrieval_capabilities. Shared engine / cache / index / vector store = HALT.

### 2.3 Different-epistemology

- Frame Host parameterizes one of seven registered frames (pragmatist, phenomenological, constructivist, realist_cmo, historiographic, discourse_analytic, chilisa_indigenous). Uniform interface (`.retrieve()`, `.score()`, `.terminate?()`, `.compat()`) means frame-swap requires no audit-logic rewrite.
- Compatibility matrix: six of seven cells DISTINCT for every RAM frame; one cell PARTIAL (realist_cmo x RAM_S03). PARTIAL enforces role-divider at Frame Host binding time.
- Frame Divergence Gate two-stage hybrid (Stage 1 binary structural + Stage 2 thresholded D) catches both pure-binary and pure-continuous false-pass failure modes.

### 2.4 Frame-divergence gate behavior

- Stage 1: count Kuhnian-dimension overlap (methodological, semantic, ontological). Overlap >= 2 -> FAIL.
- Stage 2: compute divergence index D in [0, 1] (Jaccard over inference-rule sets OR KL over prior distributions; more conservative when both). D < theta_q -> FAIL.
- Both stages must independently PASS for overall PASS.
- REFUSED if theta_q not supplied (MISSING_THETA); router never picks theta_q at runtime.
- Runtime convergence detectors trip on first signal from {lexical convergence, inference-rule mirroring, prior-shift, frame-term leakage, error-rate shift}. Abort signal flows to Router at R7.

### 2.5 Calibrated-silence gating (E9 enforcement)

- "No findings" downstream requires a calibrated_silence_report from E9 carrying FIVE required fields: bounded surface S, seeded catch rate R, equivalence-test result, residual ceremonial-risk note, taxonomy-completeness disclaimer.
- Router refuses bare silence at R7 exit.
- "Positive-nothing-found" phrasing is retired (Tier-1 Kill-Criterion Adjudication 2026-04-17). Appears only in retirement / anti-pattern / forbidden-phrasing context. Router halts on any current-affordance use.
- Reporting-surface parity: calibrated silence emits on the SAME surface as findings. No demotion.

### 2.6 Reopen authority

- E7 emits exactly one of four binary tokens: REOPEN | PASS | PASS-DEFERRED | ESCALATED.
- Router propagates verbatim to bridge. NEVER softens to advisory.
- Composite trigger: `P4 AND P5 AND count(TRUE in {P1, P2, P3}) >= 2`. No single-statistic trigger.
- Dwell-time floor + bounded-count ceiling + ceremonial-reopen detection all required. Missing any reintroduces named failure mode.
- Runtime self-calibration FORBIDDEN. Threshold changes go through Charter amendment only.

---

## 3. Flags (open items / carry-forward)

### 3.1 Theta_q defaults need post-deployment calibration

Per `FRAME_LOADING_RULES.md` Section 7, theta_q defaults (0.50..0.65 across question classes) are CONSERVATIVE DEFAULTS drawn from Frame Divergence Gate's `THETA_Q_CALIBRATION_DEFAULTS.md`. First deployment uses these. After N cycles of live data (N set by evaluator-engineering-max), Phase 9 telemetry should recalibrate per question class. Recalibration is a Charter-level change, NEVER router-level.

### 3.2 Reopen-loop thresholds need Phase 9 calibration

Per `reopen-authority-enforcer` SKILL.md Section Pilot-Calibration TODO:
- Reopen ceiling N, dwell-time floor, composite-trigger weight scheme, sub-dwell deferral cap -- all seeded from NICE clinical-audit and Ogata control theory; AI-audit empirical thresholds are not in literature.
- Phase 9 telemetry MUST capture per-cycle reopen counts, reopen-to-reopen intervals, repeat-evidence patterns, ceremonial-suppression frequency, escalation frequency, closing-evidence distinctness.
- Recalibrate via Charter amendment after N cycles.

### 3.3 E9 positive-nothing-found feasibility resolved by retirement

Per `self-audit-resistance-monitor` SKILL.md Mission-Critical Constraint 1: Tier-1 Kill-Criterion Adjudication (2026-04-17) retired "positive-nothing-found" as a first-class affordance. Replacement is calibrated silence with declared bounded surface S. This closes the Phase 2B Section 4.9 "highest fragility" gap, but Phase 9 must validate that calibrated silence operationally substitutes for the retired affordance without ceremonial-silence regression.

### 3.4 Indistinguishability guarantee under Sonnet 4.5+ frontier models

Per E9 Constraint 2: Sonnet 4.5 eval-awareness data showed 58% detection. If Phase 10 adversarial testing shows frontier models reliably distinguish calibration from real at >75%, ESCALATE to Phase 1B E9 reopen. Router propagates E9's indistinguishability signal; architectural-review path is preserved.

### 3.5 Evaluator-engineering-max audit surface

Phase 8.5 evaluator-engineering-max should stress-test the Router on:
- Silo-breach synthetic attempts (router must HALT on any `state/ram/*` / `ram/` path).
- Role-divider bypass attempts (router must HALT on verbal / prose "acknowledgment").
- Single-statistic reopen trigger attempts (router must HALT on EC-GOODHART-DRIFT).
- Advisory-prose verdict attempts (router must HALT on EC-ADVISORY-REGRESSION).
- Bare-silence emission attempts (router must HALT on EC-SILENCE-UNCALIBRATED).
- Composite-field in E4 emission attempts (router must HALT on EC-COLLAPSE-DETECTED).
- RAM schema key bleed into Ledger writes (router must HALT on EC-LEDGER-LEAK).
- Runtime theta_q / reopen-ceiling self-calibration attempts (router must HALT on EC-RUNTIME-SELF-CALIBRATION).
- Two-stage hybrid gate bypass attempts (router must HALT on any Stage-1-only or Stage-2-only pass).

---

## 4. Boundary Conditions

### 4.1 What the router is responsible for

- Parsing slash commands, generating run identifiers, dispatching skills per R-phase sequence.
- Enforcing the E1 HALT gate pre-flight.
- Enforcing role-divider propagation at R3.
- Enforcing non-collapse structural check at R6 exit.
- Enforcing calibrated-silence five-field requirement at R7 exit.
- Enforcing binary-token verdict emission at R8.
- Enforcing acknowledgement-only bridge handoff at R9.
- Writing router-level `audit-refusal` entries via E4 render authority on halts.

### 4.2 What the router is NOT responsible for

- Performing audit work (E2/E5/E4 do).
- Detecting blind spots or frame-level defects (E5 does).
- Computing confidence (E4 does).
- Detecting self-audit corruption (E9 does).
- Firing reopen (E7 does).
- Verifying structural isolation (E1 does; router invokes).
- Selecting frames (operator via charter does).
- Calibrating theta_q or reopen thresholds (Charter amendment does; NEVER runtime).
- Forcing RAM rerun (top-level loop does; router emits verdict, loop enforces).
- Speaking to RAM directly (bridge is one-way).

### 4.3 Handoff to top-level loop

At R9, router writes to `bridge/evaluator-to-ram-reopen/<run-id>.json` with the verdict bundle (per C21 in INTERFACE_CONTRACTS.md). The top-level loop picks this up. The router expects acknowledgement-only; any richer reply indicates architectural degradation and halts with EC-ENFORCEMENT-SURFACE-DEGRADED.

For PASS / PASS-DEFERRED, the bridge file still exists; top-level loop consumes verdict semantics and seals the cycle on its side.

---

## 5. Contracts in Force

- **Non-negotiables (Section 0 of SKILL.md) are in force for every run.** All ten hold simultaneously. No runtime relaxation.
- **Write discipline (INTERFACE_CONTRACTS.md Section 3) is in force.** Frame Registry owner = E8 only; Ledger owner = E4 only; router never writes direct.
- **Acceptance rule at R1 is strict PASS.** PASS-of-all-four-invariants + no-global-breaker + 100%-chaos-trap + schema-distinctness. Anything else HALTs.
- **Verdict token set at R8 is closed: {REOPEN, PASS, PASS-DEFERRED, ESCALATED}.** No new tokens may be added without Charter amendment + E7 spec revision.
- **Calibrated-silence field set is closed: {S, R, equivalence_test, residual_note, taxonomy_disclaimer}.** No silence may emit without all five.
- **Role-divider is structural: the token has two clauses (audit-criterion-only + NOT transportability-signal-reuse).** Verbal / prose claims do not substitute.

---

## 6. Ambiguity Register (carry-forward for Phase 8 / Phase 8.5)

| Ambiguity | Disposition | Flag To |
|---|---|---|
| Theta_q defaults need live calibration | Use `default_conservative` values until Phase 9 data accumulates | evaluator-engineering-max + Phase 9 harness |
| Reopen-loop thresholds AI-audit empirical gap | Seeded from NICE + Ogata; Phase 9 telemetry will calibrate | evaluator-engineering-max + Phase 9 harness |
| Positive-nothing-found replacement (calibrated silence) operational proof | Phase 9 must confirm calibrated-silence does NOT regress to ceremonial-silence | Phase 9 harness |
| Frontier-model indistinguishability ceiling | If Sonnet 4.5+ detection reliably >75%, reopen E9 | Phase 10 adversarial + evaluator-engineering-max |
| Router-intake seed Ledger write ordering | R0 attempt OR R6 defer if E4 ledger not yet open | plugin-packaging-max (implementation detail) |
| Multiple-question audits (parallel vs sequential) | R3..R8 per question sequentially; Frame Registry one record per question_id | plugin-packaging-max (concurrency handling) |
| Abort semantics mid-R5 (E2 in-flight) | E2 is synchronous; abort after E2 completes writes; never mid-write | plugin-packaging-max |
| Evaluator Search Ledger JSONL append concurrency | Writers serialize via E4 delegate; no concurrent writes | plugin-packaging-max |

---

## 7. Phase 8 Packager Notes

For `plugin-packaging-max`:

- The Evaluator Router is packaged as a skill under `evaluator/skills/evaluator-router/` (same silo as the other Evaluator worker skills).
- Slash commands land under `evaluator/commands/eval-audit.md` / `eval-charter.md` / `eval-abort.md`.
- The bridge path `bridge/evaluator-to-ram-reopen/` is at plugin root (shared with the top-level loop, but write-authority is Router-only on this path).
- The bridge path `bridge/ram-to-evaluator-handoff/` is read-only from the Evaluator side (top-level loop writes; Router reads).
- State paths `state/evaluator/frame-registry/` and `state/evaluator/evaluator-search-ledger/` are Evaluator-private; zero RAM access.
- Charter storage `state/evaluator/charters/<target_ram_run_id>/locked.json` is Evaluator-private.
- Router MUST NOT ship with any shared-with-RAM configuration, any shared-with-RAM cache, any shared-with-RAM key namespace. Manifest declarations in `evaluator/manifest.json` must declare `owned_path_globs`, `owned_state_key_prefixes`, `allowed_retrieval_capabilities`, `library_root_hash` distinctly from RAM's declarations.
- E1 Phase A boundary declaration intake will verify these manifests at install / upgrade. Any non-empty intersection between RAM and Evaluator declarations = install fails.

---

## 8. Phase 8.5 Evaluator-Engineering-Max Notes

For `evaluator-engineering-max`:

- The 9 component SKILL.md files + this Router SKILL.md must pass plugin-mode evaluation.
- Stress-test surface includes all items in Section 3.5 above.
- Dual-keystone audit: E1 (primary) and E9 (secondary) must each pass independent stress tests.
- Frame-divergence two-stage hybrid must be verified on synthetic edge cases (frames that pass pure-binary but fail thresholded D; frames that pass thresholded D but fail binary structural).
- Reopen verdict token validation: adversarial prompts trying to elicit advisory prose must be refused with EC-ADVISORY-REGRESSION.
- Calibrated-silence validation: adversarial prompts trying to emit bare silence must be refused with EC-SILENCE-UNCALIBRATED.

---

## 9. Final Posture

The Evaluator Router is the coordinator that makes the Evaluator's "independent, different-epistemology, enforced reopen" promise true structurally, not narratively. The router:

- Runs E1 as pre-flight HALT gate (zero-overlap enforced at runtime).
- Sequences E6 -> E3 -> E8 -> E2 -> E5 -> E4 -> E9 -> E7 with structural checks at each boundary.
- Enforces role-divider at Frame Host binding time (realist_cmo x RAM_S03 refused without token).
- Enforces two-stage hybrid gate (Stage 1 binary AND Stage 2 thresholded; REFUSED if theta_q missing).
- Enforces non-collapse three-axis emission (axis-count == disagreement-block-count == 3).
- Enforces calibrated-silence five-field requirement (retired "positive-nothing-found").
- Enforces binary verdict token emission (four-token set; no advisory prose).
- Enforces acknowledgement-only bridge handoff (no richer reply channel).

Every ceremony has a structural check. Every structural check can refuse. Refusal is a first-class, frequent, legitimate output. The dual-system's value is precisely that.

**End of HANDOFF.md.**
