Evidence admission

### PDF page 15 Daniel J. Murray Revised September 2026 • The reference verifier and R1 parser are tested, not formally verified; both are in the TCB. • R1 is intentionally small. Useful controlled English with a still-auditable parser remains an open engineering problem. • H1 and H2 are predictions for future comparative experiments, not results of the present implementation. • Alias/entity binding, richer units, reconciliation, probabilistic inference, and abductive reason- ing require additional typed operators and witnesses. • Probabilistic or abductive results should be certified as model-relative or ranked objects unless an additional rule introduces a stronger type. • The architecture addresses epistemic assertion and a narrow data/control boundary; it does not solve privacy, fairness, broader cybersecurity, or physical-action safety. • Jurisdictions do not federate automatically. Composition of independently trusted kernels requires its own compatibility and trust rules. 12. Conclusion The central proposal is not to make every neural computation formal. It is to formalize the boundary at which generated content acquires authority. A proposal can remain stochastic and creative. A retrieved string can remain untrusted data. A free-form explanation can remain useful. What changes is that stronger epistemic and operational types require explicit introduction rules. This one decision unifies several problems that are usually treated separately. Evidence needs binding and provenance. State needs predictive sufficiency. Warrant needs a policy over source quality and time. Certified text needs a controlled meaning boundary. Control needs authorization. An LLM judgment remains a proposal until a jurisdiction supplies a rule for Verdict. The fail-closed channel invariant is then simple because type soundness is supposed to be simple after the types and their interpretation are specified. The revised finite implementation checks that these joints can be made executable within the spec- ified tests: ambiguity produces ASK, incompatible versions do not silently reconcile, stale support loses warrant without losing its derivation, a specific lossy memory fails its future-query test, and semantic strengthening is rejected at the text boundary. The broader claims remain appropriately open. A small TCB may or may not cover useful workloads; a small proposer may or may not saturate early. Those are experiments, not assumptions. Fluency does not confer authority. Authority is a typed transition, and every certified transition must carry its witness.

An elementary counting bound shows why external stores can remove the factual-payload storage burden from model parameters without implying that language competence is free. Useful coverage and early saturation of proposing remain empirical hypotheses, not conclusions. The proposal does not solve truth; it formalizes when generated content acquires authority. Keywords: epistemic type safety; neurosymbolic AI; large language models; hallucination; trusted computing base; fail-closed verification; provenance; binding; predictive state 1. Introduction: from hallucination to illegal coercion A language model maps a context x to a distribution 𝑝𝜃(𝑦 ∣ 𝑥) . A certified assertion asks a different question: whether evidence E licenses a claim c under declared rules. The two relations can correlate, but neither definition entails the other. The central diagnosis of this paper is that contemporary

performs a promotion without an introduction rule. This paper calls such a promotion an illegal epistemic coercion. This reframing does not deny the value of retrieval, tools, uncertainty estimation, selective prediction, constrained decoding, or post-hoc evaluation. Those methods reduce particular failure rates and often improve utility (Lewis et al., 2020; Farquhar et al., 2024; Huang et al., 2025; Mohri & Hashimoto, 2024). The claim is narrower: none of them, by itself, defines which objects are entitled to inhabit a certified factual channel. Kalai et al. (2026) further show that common accuracy- poses binding, version selection, warrant, and state compression as independently testable witnesses. Fifth, it derives an elementary information-storage bound that motivates - but does not prove - the hypothesis that a proposer can be smaller when factual payload is externalized. Accordingly, this is a theory-and-design paper with an executable proof of concept. The finite- jurisdiction experiments check specified software behaviors. They do not establish the universal invariant for an unverified implementation. They do not test the two broader engineering hypotheses introduced later: that a useful small TCB can achieve competitive coverage (H1), or that competent proposing saturates at smaller model scale than closed-book factual recall (H2). Those remain explicit targets for future comparative experiments. 2. Epistemic types and introduction rules 2.1 Authority is introduced, not inferred from fluency Fix a jurisdiction-specific collection of types. A practical system may include Proposal, String, EvidenceData, Evidence, Query, BoundQuery, Supported, Warranted, ModelRelative, Categorical, Hypothesis, History, State, Meaning, CertifiedText, Control, and Verdict. The inventory is not claimed to be universal. Its purpose is to make promotions inspectable. 𝜏𝑖 𝑤𝑖𝑗 − − − → 𝜏𝑗. (1)

Snapshots → Reconciled fact Domain-specific reconciliation Incompatible snapshots are combined. History → State Predictive sufficiency in the declared repertoire Summary loses a future-relevant distinction. Meaning → CertifiedText Sound R0 or contextual R1

queries. The representation is entitled to type State only if equal representations imply identical future certified-response laws for every T. Otherwise it is merely CompressedHistory. This is the same quotient idea used in predictive-state representations and computational mechanics: histories can be merged only when the declared future cannot distinguish them (Littman et al., 2001; Shalizi & Crutchfield, 2001). 𝜎(ℎ1) = 𝜎(ℎ 2) ⟹ Law(𝑍𝑇 ∣ ℎ 1) = Law(𝑍𝑇 ∣ ℎ 2) ∀𝑇 ∈ 𝒯. (4) The role of Eq. 4 here is diagnostic, not foundational. If one history retrieved version v1=10.2 not State for that jurisdiction. Dropping a needed source version from memory and dropping a leaf digest from a certificate are related examples of unwitnessed promotion. The supplied two- history example falsifies one lossy summary. Distinguishing that pair after adding the version does not prove global sufficiency for all future queries. A recursive State implementation additionally requires the declared future repertoire to support a well-defined update under admissible extensions. A code sufficient only for ASSERT/ASK/ABSTAIN decisions may be coarser, but if ABSTAIN is acceptable everywhere, safety alone can admit a one-codeword controller; useful coverage must be

in-tool learning derives parameter-count limitations for memorized facts and scalable recall through external tools (Houliston et al., 2025). These results motivate, but do not establish, the broader hypothesis below. H2 - early saturation of proposing. For a fixed typed jurisdiction with external evidence, the proposer model size required to reach a target certificate-proposal coverage will saturate substantially below the size required to reach the same task coverage by closed-book factual recall. H2 is an empirical bet about realistic models, not a corollary of Proposition 1. It can fail if language understanding, binding, or planning - rather than factual storage - dominates the required capacity. 7. Finite jurisdiction and executable witnesses 7.1 Jurisdiction A kernel is specified here by a meaning language M, operator library Ω, admission policy Π, warrant

process/code integrity, input parsing, store admission, and certified-output access control. Likewise, checking that a note is not executed in a program with no execution interface does not prove prompt-injection resistance in a browser or agent stack. H1 and H2 remain untested. 9. Open engineering hypotheses and the experiment that can kill them H1 - useful small-kernel hypothesis. There exist practically useful jurisdictions in which an auditable TCB can maintain zero unsupported certified assertions while achieving useful certified coverage competitive with realistic fail-closed alternatives. H1 is a safety-coverage-TCB claim. A trivial kernel can achieve zero unsupported certified assertions by certifying nothing. The engineering objective is therefore not to minimize unsupported output alone, but to locate a useful point on a Pareto surface involving certified coverage and TCB cost. max CC subject to UAR = 0, TCB_cost ≤ 𝜅. (5) A direct benchmark would use one versioned numerical table and five systems: a base model,

When no certified assertion is emitted, UAR is undefined; report its zero denominator and CC rather than declaring empirical UAR zero. A structural no-write safety property can still hold. Population zero error is not established by a finite benchmark. Table 4. Metrics required to test H1 and H2 without conflating safety with silence. A preregistered instance of H1 is not supported if its certified coverage is inferior to the chosen realistic abstaining baseline at comparable TCB cost. One failed implementation cannot refute the existential claim for every useful jurisdiction. A preregistered instance of H2 fails its predicted saturation criterion if certificate-proposal coverage continues to improve materially over the specified model-size range after the declared prerequisites are met. “Useful”, “competitive”, “substantially below”, workload, cost budget, and model-size range must be quantified before the comparison. Either failure would leave C1 intact while shrinking the engineering claim. If bind-error dominates after UAR approaches zero, the architecture predicts a useful change of research frontier: reliability work should move from generation toward binding and jurisdiction design. 10. Related work as a witness inventory The synthesis claim is not that the constituent methods are new. The proposed type system instead asks what each method authorizes and where its guarantee stops. Proof-carrying code is a precedent Database provenance makes source lineage structural (Green et al., 2007). Controlled language, incremental parsing, and grammar-constrained decoding constrain the form-to-meaning boundary (Fuchs et al., 2005; Scholak et al., 2021; Park et al., 2025; Raspanti et al., 2025). Predictive- state work supplies the History→State criterion (Littman et al., 2001; Shalizi & Crutchfield, 2001). Semantic entropy is an uncertainty/control signal (Farquhar et al., 2024), while conformal factuality supplies high-probability correctness through output backoff rather than proof-carrying provenance (Mohri & Hashimoto, 2024). RAG and tool-using agents externalize information or execution but

• R1 is intentionally small. Useful controlled English with a still-auditable parser remains an open engineering problem. • H1 and H2 are predictions for future comparative experiments, not results of the present implementation. • Alias/entity binding, richer units, reconciliation, probabilistic inference, and abductive reason- ing require additional typed operators and witnesses. • Probabilistic or abductive results should be certified as model-relative or ranked objects unless changes is that stronger epistemic and operational types require explicit introduction rules. This one decision unifies several problems that are usually treated separately. Evidence needs binding and provenance. State needs predictive sufficiency. Warrant needs a policy over source quality and time. Certified text needs a controlled meaning boundary. Control needs authorization. An LLM judgment remains a proposal until a jurisdiction supplies a rule for Verdict. The fail-closed channel invariant is then simple because type soundness is supposed to be simple after the types and their interpretation are specified.