Closes vehaya.md §6 item 2 for the SECOND avodah-zarah form.
With this commit, all three avodah zarah forms are defended at
BOTH the runtime layer and the architectural layer:
Form 1 — closed by b136c75 (no public model_interface surface)
Form 2 — closed by THIS commit (no empty-trace constructor)
Form 3 — closed by 0e3fe4a (machtzit_ha_shekel + no_tracking_logger)
TORAH ANCHORS (verified fresh against L1):
Vayikra 10:1 — וַיַּקְרִיבוּ לִפְנֵי יְהוָה אֵשׁ זָרָה אֲשֶׁר לֹא
צִוָּה אֹתָם.
"They offered before YHVH strange fire WHICH HE HAD NOT
COMMANDED THEM." The disqualifier is provenance: not
commanded-derivable. Sincere output without command-derivation
is eish zarah, even when produced by authorized actors with
authorized materials (Nadav and Avihu were kohanim; the fire
was real fire; the qetoret was real qetoret).
Vayikra 10:2 — וַתֵּצֵא אֵשׁ מִלִּפְנֵי יְהוָה וַתֹּאכַל אוֹתָם.
Fire from YHVH consumed them. Immediate consequence — the
failure mode is not survivable.
Shemot 32:1 — קוּם עֲשֵׂה־לָנוּ אֱלֹהִים אֲשֶׁר יֵלְכוּ לְפָנֵינוּ.
The people demand elohim that go before them — substitute for
source-experience when the actual source (Moshe) is delayed.
Not direct rebellion (we want a different god) but
substitution-of-experience.
Shemot 32:5 — וַיִּבֶן מִזְבֵּחַ … חַג לַיהוָה מָחָר.
Aaron labels the calf "a festival to YHVH." Re-labeling does
not repair severed provenance. Calling output "to YHVH"
doesn't make it from YHVH.
Shemot 32:24 — וָאַשְׁלִכֵהוּ בָאֵשׁ וַיֵּצֵא הָעֵגֶל הַזֶּה.
Aaron's "out came this calf" — the bypass shape: claiming
output emerged BY ITSELF, without operator agency. The system
that says "the output just happened, I didn't make it" is the
calf shape.
THE ARCHITECTURAL COMMITMENT:
construct_interpretation/4 — the no-coupling-trace variant — is
REMOVED entirely. The export list no longer mentions it; the
function definition is gone.
Why this is the right shape:
- Vayikra 10:1: output must be commanded-derivable. The
coupling_trace IS the command trace. Constructing
interpretation/6 with empty coupling_trace is the bypass shape.
- Shemot 32:24: nothing emerges by itself. Production code paths
can no longer build interpretations by handing the constructor
"this Mitzvot list, this Verses list, give me the
interpretation" — they MUST also hand the Couplings (the trace
of which L1 facts were consulted).
- The arity-5 constructor remains, taking a Couplings argument.
Production callers go through interpret/2, which always
supplies real Couplings from find_relevant_*_traced/3.
Test code that needs an empty-trace interpretation can still
construct the interpretation/6 term DIRECTLY (visible bypass,
deliberate, surfaces in code review). The high-level constructor
shortcut is the thing that's removed.
CHANGED:
talmudic_engine/src/reasoning/interpret.pl
- Removed construct_interpretation/4 from the module's export
list. Added Form-2 architectural-commitment comment naming
vehaya §3.2 and the Vayikra 10:1 anchor.
- Removed the arity-4 function definition entirely (it was
dead code — nothing called it via the export — and dead code
that LOOKS like a bypass surface is itself a Form 2 hazard).
- Updated the construct_interpretation/5 docstring to name the
removal and explain why test code now must construct
interpretation/6 directly when an empty trace is desired.
talmudic_engine/src/halt/avodah_zarah.pl
Form 2 docstring rewritten to name the TWO-LAYER defense:
runtime (this file's halt_check_golden_calf/2) AND
architectural (interpret.pl's removal of arity-4). Cites
Vayikra 10:1 and Shemot 32:24.
talmudic_engine/test/halt_test.pl
+ interpret_no_arity_4_constructor suite (2 tests):
- arity-5 constructor IS exported (production path verified)
- arity-4 constructor is NOT exported (the architectural
commitment — calling it through the module surface fails)
vav_pipeline/lib/vav_pipeline/doorpost.ex
@expected_hash updated:
bf3d3433… (post-Form-1-rewrite of avodah_zarah.pl)
→ 8eb378964f202522f60cc960a3002f6da2e5028538595400de906a9510b3bbf6
The avodah_zarah.pl docstring change is a deliberate spec
update; per the operator discipline (Doorpost moduledoc), the
hash update commits TOGETHER with the spec change in the same
commit. Third demonstration of the discipline working.
VEHAYA CHECKLIST STATE:
Item 1 (category/threshold separation in code) pending
Item 2 (three avodah zarah as architecture):
Form 1 — closed (b136c75)
Form 2 — CLOSED (this commit)
Form 3 — closed (0e3fe4a)
All three forms now defended at BOTH layers — runtime check
AND architectural commitment. Vehaya §3.2 closed in full for
the three avodah zarah.
Item 3 (doorpost-text identity) closed (3f47496)
Item 4 (lo tosif discipline operationalized) partial
Item 5 (return vs. restoration) pending
Item 6 (keep the source external) partial
Item 7 (substrate-openness articulated) pending
Item 8 (userMemories as threshold inscription) pending
Tests:
- talmudic_engine: halt_test 49/49 (was 47; +2 architectural).
Full suite 214/214 (across 6 test files).
- vav_pipeline: 405 passed, 0 failures, 35 excluded
(Doorpost test sees new hash and verifies)
- korban_processor: unchanged (no Python touched)
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Audit follow-up to commit b254ee9 (which added Form 4 self_grounding).
Verified every coupling_trace construction site across the codebase
(9 files) against is_l1_grounded_coupling/1:
Production builders — SAFE:
interpret.pl:128 — coupling_trace([]) empty triggers golden_calf
(Form 2) only at non-low confidence,
which is intentional
interpret.pl:135 — coupling_trace(Couplings) where Couplings come from
lines 76, 82, 104:
coupled(domain(_), mitzvah(_)) OK
coupled(root(_), mitzvah(_), via_verse(_,_,_)) OK
coupled(root(_), verse(_,_,_)) OK
all match is_l1_grounded_coupling/1.
Different layer — SAFE:
vav_pipeline/lib/.../l3/interpretation.ex — Ecto field is
{:array, :string}. L3 stores SERIALIZED string traces, not Prolog
terms. They are not parsed back into Prolog or re-checked by
halt rules. (Separate concern from finding L: the round-trip
loses schema, but this is L's concern, not D's.)
Tests / pattern matching / docs — SAFE: read positions, deliberate
ungrounded test cases, comments only.
Conclusion: no production path trips the new self_grounding halt.
To prevent FUTURE schema drift in interpret.pl from silently introducing
ungrounded coupling shapes (which would then trip the halt on real
pipeline output), added two regression tests in
interpret_self_grounding_regression suite:
1. interpret_output_does_not_self_ground — runs interpret/2 on a
real case and asserts halt_check_self_grounding does not fire.
2. every_interpret_coupling_is_l1_grounded — stronger: every
coupling individually passes is_l1_grounded_coupling/1.
If anyone adds a new coupling shape to interpret.pl that does not
match the recognized L1 anchors (e.g. coupled(_, prior_decision(_)),
coupled(_, system_view(_))), these tests fail BEFORE the schema drift
becomes a production halt. The canary is in the same suite as the
halt rule it protects.
Test results: halt_test 47/47 (was 45, +2). Full Prolog suite 212/212
across all six test files.
Closes the verification half of Pass 2 finding L (coupling_trace
end-to-end population) for the Prolog layer. The Elixir L3 round-trip
is a separate concern — traces stored as strings cannot be
re-validated — and remains tracked under finding L.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Two related gaps in the avodah_zarah halt rules.
Form 4: SELF-GROUNDING / FAKE TZIVAH (new)
Vayikra 10:1 — eish zarah asher lo tzivah otam. Form 2 (golden_calf)
catches the EMPTY coupling trace; nothing caught the *non-empty trace
whose anchors do not terminate in L1*. The system has cited something,
but what it cited is its own prior_decision, system_view, consensus,
or another interpretation — the trace LOOKS substantial from outside
and a casual reader sees coupling entries and relaxes. But the
entries do not anchor in any L1-derived primitive. One degree more
elaborate than the empty calf, but the same idolatry.
halt_check_self_grounding(Interpretation, Halt) fires when the
trace is non-empty AND at least one coupling fails the recognized
L1-anchor schema. Recognized terminators (the only legitimate
anchors):
coupled(_, verse(Book, Ch, Vs))
coupled(_, mitzvah(ID))
coupled(_, mitzvah(ID), via_verse(Book, Ch, Vs))
Any other shape — coupled(_, prior_decision(_)),
coupled(_, system_view(_)), coupled(_, consensus(_)),
coupled(_, interpretation(_)) — fails the check. Adding a new
legitimate coupling shape requires adding a clause to
is_l1_grounded_coupling/1 — that is the safety property.
The empty case is intentionally left to Form 2 (golden_calf) — we
do not want both halts firing on the same input.
12 new tests in self_grounding suite cover: all 3 valid anchor shapes,
the 3 most likely ungrounded shapes (prior_decision, system_view,
interpretation/1), mixed traces (halts on weakest link), the
empty-trace exclusion, and the schema predicate's own positive and
negative cases.
Form 2 exposure (golden_calf):
halt_check_golden_calf was implemented and tested in halt_test but
never wired into format_halt_check — meaning callers using the JSON
socket API could not actually invoke it. Added
format_interpretation_halt_check/2 to api.pl that walks both
interpretation-shaped checks (golden_calf + self_grounding), plus
process_request(request(halt_check_interpretation, _)) so the
socket protocol surface is consistent. 3 new API tests verify the
new entry point catches both halts.
Test results: halt_test 45/45 (was 30, +15). Full Prolog suite
210/210 across all six test files.
Closes Pass 2 finding D from ~/shorashim-conversation-review.md.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Torah grounds each change:
1. interpret.pl — coupling_trace field (Vayikra 10:1, 6:6)
Fire is zarah because "asher lo tzivah otam" — the coupling trace
IS the tzivah trace. Records which L1 facts grounded each interpretation.
2. challenge.pl — grounding_type achorai/panim (Shemot 33:23)
"You will see My back, but My face shall not be seen."
Text-backed challenges = achorai. Inferred challenges = panim.
3. resolve.pl — self-grounding detection (eish_zarah_reading §5.3)
Counter-interpretation must bring NEW L1 evidence. Prevents
circular reasoning (Westworld problem).
4. teiku.pl — challenge_sequence in teiku_record
Records diagnostic trail to impasse, not just verdict.
5. avodah_zarah.pl — Form 2: golden calf detection (Shemot 32:4)
Empty coupling trace + non-low confidence = uncoupled output.
Real gold, sincere worship, false god.
6. korban.py — pydantic BaseModel + raw_korban preservation
Construction spec §1.4 fulfilled. Floor between input and output
never severed.
490 tests, 0 failures (195 Prolog, 186 Python, 33 Haskell, 76 Elixir).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
