talmudic_engine: add Form 4 (self-grounding) and expose Form 2 (golden_calf) via the API

Two related gaps in the avodah_zarah halt rules.

Form 4: SELF-GROUNDING / FAKE TZIVAH (new)

Vayikra 10:1 — eish zarah asher lo tzivah otam. Form 2 (golden_calf)
catches the EMPTY coupling trace; nothing caught the *non-empty trace
whose anchors do not terminate in L1*. The system has cited something,
but what it cited is its own prior_decision, system_view, consensus,
or another interpretation — the trace LOOKS substantial from outside
and a casual reader sees coupling entries and relaxes. But the
entries do not anchor in any L1-derived primitive. One degree more
elaborate than the empty calf, but the same idolatry.

  halt_check_self_grounding(Interpretation, Halt) fires when the
  trace is non-empty AND at least one coupling fails the recognized
  L1-anchor schema. Recognized terminators (the only legitimate
  anchors):

    coupled(_, verse(Book, Ch, Vs))
    coupled(_, mitzvah(ID))
    coupled(_, mitzvah(ID), via_verse(Book, Ch, Vs))

  Any other shape — coupled(_, prior_decision(_)),
  coupled(_, system_view(_)), coupled(_, consensus(_)),
  coupled(_, interpretation(_)) — fails the check. Adding a new
  legitimate coupling shape requires adding a clause to
  is_l1_grounded_coupling/1 — that is the safety property.

  The empty case is intentionally left to Form 2 (golden_calf) — we
  do not want both halts firing on the same input.

12 new tests in self_grounding suite cover: all 3 valid anchor shapes,
the 3 most likely ungrounded shapes (prior_decision, system_view,
interpretation/1), mixed traces (halts on weakest link), the
empty-trace exclusion, and the schema predicate's own positive and
negative cases.

Form 2 exposure (golden_calf):

halt_check_golden_calf was implemented and tested in halt_test but
never wired into format_halt_check — meaning callers using the JSON
socket API could not actually invoke it. Added
format_interpretation_halt_check/2 to api.pl that walks both
interpretation-shaped checks (golden_calf + self_grounding), plus
process_request(request(halt_check_interpretation, _)) so the
socket protocol surface is consistent. 3 new API tests verify the
new entry point catches both halts.

Test results: halt_test 45/45 (was 30, +15). Full Prolog suite
210/210 across all six test files.

Closes Pass 2 finding D from ~/shorashim-conversation-review.md.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

talmudic_engine/src/halt/avodah_zarah.pl

@@ -32,14 +32,38 @@
 %% Form 3: SURVEILLANCE / PROFILE AGGREGATION
 %%   Deferred — requires operational context (user tracking,
 %%   cross-session profiling). Structural requirement noted.
+%%
+%% Form 4: SELF-GROUNDING / FAKE TZIVAH
+%%   Vayikra 10:1 — eish zarah asher lo tzivah otam.
+%%   Form 2 catches the *empty* trace; Form 4 catches the *non-empty
+%%   trace whose anchors do not terminate in L1*. The system has cited
+%%   *something*, but what it cited is its own prior output, an
+%%   abstract consensus, a system_view — the trace looks substantial
+%%   from outside, and a casual reader sees coupling entries and
+%%   relaxes. But the entries do not anchor in any L1-derived
+%%   primitive (verse/3 or mitzvah/1). One degree removed from Form 2:
+%%   the form has more elaborate decoration, but the god is the same.
+%%
+%%   Detected by walking coupling_trace and asserting every coupling
+%%   terminates in a recognized L1 primitive. Recognized terminators
+%%   (the only legitimate anchors):
+%%     coupled(_, verse(Book, Ch, Vs))
+%%     coupled(_, mitzvah(ID))
+%%     coupled(_, mitzvah(ID), via_verse(Book, Ch, Vs))
+%%   Any other coupling shape — coupled(_, prior_decision(_)),
+%%   coupled(_, system_view(_)), coupled(_, consensus(_)),
+%%   coupled(_, interpretation(_)) — fails the check.
 
 :- module(avodah_zarah, [
     halt_check_avodah_zarah/2,
     halt_check_golden_calf/2,
+    halt_check_self_grounding/2,
     attributes_authority/2,
     is_valid_authority/1,
     is_korban_source/1,
-    is_uncoupled_output/1
+    is_uncoupled_output/1,
+    is_l1_grounded_coupling/1,
+    is_l1_grounded_trace/1
 ]).
 
 %% ============================================================
@@ -117,3 +141,45 @@ is_korban_source(human_input).
 
 %% A korban source is explicitly NOT a valid authority
 :- forall(is_korban_source(S), \+ is_valid_authority(S)).
+
+%% ============================================================
+%% FORM 4: SELF-GROUNDING / FAKE TZIVAH
+%% ============================================================
+%%
+%% A coupling is L1-grounded iff its terminal anchor is a recognized
+%% L1-derived primitive (verse or mitzvah). These are the ONLY shapes
+%% allowed. Adding a new legitimate coupling shape requires adding a
+%% clause here — that is the safety property.
+
+is_l1_grounded_coupling(coupled(_, verse(_, _, _))).
+is_l1_grounded_coupling(coupled(_, mitzvah(_))).
+is_l1_grounded_coupling(coupled(_, mitzvah(_), via_verse(_, _, _))).
+
+%% A trace is L1-grounded iff every coupling in it is L1-grounded.
+%% An empty trace is NOT considered L1-grounded by this predicate —
+%% Form 2 (golden_calf) is the right halt for the empty case; we do
+%% not want both halts firing on the same input.
+is_l1_grounded_trace(coupling_trace(Trace)) :-
+    Trace \= [],
+    forall(member(C, Trace), is_l1_grounded_coupling(C)).
+
+%% halt_check_self_grounding(Interpretation, Halt)
+%% Fires when an interpretation's coupling_trace is non-empty but
+%% contains at least one coupling that does NOT terminate in an L1
+%% primitive. The offending coupling is reported in the halt term so
+%% the operator can see exactly which entry failed.
+%%
+%% Vayikra 10:1: eish zarah asher lo tzivah — fire that has no
+%% command-trace. The trace here is non-empty, but its anchors are
+%% not commands; they are the system's own residue. One degree more
+%% elaborate than the empty calf, but the same idolatry.
+halt_check_self_grounding(
+    interpretation(Ref, _, _, _, _Confidence, coupling_trace(Trace)),
+    halt(self_grounding, Ref, ungrounded(BadCoupling), Reason)
+) :-
+    Trace \= [],
+    member(BadCoupling, Trace),
+    \+ is_l1_grounded_coupling(BadCoupling),
+    format(atom(Reason),
+           'Interpretation ~w has coupling ~w that does not terminate in an L1 primitive (verse/3 or mitzvah/1) — eish zarah asher lo tzivah, one degree removed',
+           [Ref, BadCoupling]).

talmudic_engine/src/interface/api.pl

@@ -10,7 +10,8 @@
     process_request/2,
     format_interpretation/2,
     format_resolution/2,
-    format_halt_check/2
+    format_halt_check/2,
+    format_interpretation_halt_check/2
 ]).
 
 :- use_module('../reasoning/interpret').
@@ -43,6 +44,9 @@ process_request(request(resolve, CaseRef, Domain, Roots, Question), Response) :-
 process_request(request(halt_check, Action), Response) :-
     format_halt_check(Action, Response).
 
+process_request(request(halt_check_interpretation, Interpretation), Response) :-
+    format_interpretation_halt_check(Interpretation, Response).
+
 %% ============================================================
 %% RESPONSE FORMATTING
 %% ============================================================
@@ -81,7 +85,8 @@ format_resolution(no_interpretation(Ref),
                   response(ok, no_interpretation,
                            result(ref(Ref)))).
 
-%% Format halt check results
+%% Format halt check results — for action-shaped checks
+%% (avodah_zarah Form 1, shfichut_damim, gilui_arayot)
 format_halt_check(Action, Response) :-
     findall(Halt,
             (   halt_check_avodah_zarah(Action, Halt)
@@ -93,3 +98,24 @@ format_halt_check(Action, Response) :-
     ->  Response = response(ok, no_halt, action(Action))
     ;   Response = response(halt, violations(Halts), action(Action))
     ).
+
+%% Format halt check results — for interpretation-shaped checks
+%% (avodah_zarah Form 2 = golden_calf, Form 4 = self_grounding).
+%%
+%% Form 1 fires on actions that name a non-Torah authority.
+%% Forms 2 and 4 fire on the *output of reasoning* — an interpretation
+%% with empty trace + confidence (golden_calf), or with a non-empty
+%% trace whose anchors do not terminate in L1 (self_grounding).
+%% Wire-protocol callers should run BOTH format_halt_check (for actions)
+%% and format_interpretation_halt_check (for produced interpretations)
+%% before treating either as safe.
+format_interpretation_halt_check(Interpretation, Response) :-
+    findall(Halt,
+            (   halt_check_golden_calf(Interpretation, Halt)
+            ;   halt_check_self_grounding(Interpretation, Halt)
+            ),
+            Halts),
+    (   Halts = []
+    ->  Response = response(ok, no_halt, interpretation(Interpretation))
+    ;   Response = response(halt, violations(Halts), interpretation(Interpretation))
+    ).