RippleLogic RLS Validation Protocol

Status: protocol design, rater-study template, and validation sprint package. This document is not a governing core document, not empirical validation, not legal certification, and not deployment authorization.

Source binding: MathGov is the umbrella framework. RippleLogic is the decision architecture inside MathGov. The public cascade is RG -> RF -> TRC -> CSV -> RLS. The formal shorthand is RG/RSG -> RF/NCRC -> TRC -> CSV -> RLS. RLS ranks only selectable options after Reality Grounding, the Rights Floor, the Tail-Risk Constraint, and Containment and Structural Viability have been satisfied.

Executive purpose

This protocol converts the next scientific need for RLS into a concrete study package. The goal is to test whether the 49-cell RLS welfare field is more than detailed. It must become defensible as structured, non-redundant, teachable, repeatable, and useful for better-justified decisions.

• Dimensional non-overlap question: do the 49 Scope x Dimension cells capture distinct decision-relevant information, or do some cells collapse into redundant clusters?

• Inter-rater reliability question: can trained analysts independently score the same cases with acceptable agreement?

• Decision-value question: does the RLS matrix reveal material harms, benefits, near-misses, or trade-patterns that a simpler single metric would hide?

• Revision question: which cells, anchors, instructions, or workbook fields need refinement before stronger operational-readiness claims are made?

Claim boundary

A successful validation sprint does not prove universal superiority. It can support narrower claims such as: trained raters can apply the RLS scoring manual with measurable agreement on a representative case set; some cells provide distinct information not captured by a scalar score; and identified scoring ambiguities have been logged for Canon or companion refinement. Until evidence is published or registered, the correct status is: RLS is architecturally specified and audit-ready as a structured residual welfare-ranking layer, but empirical validation of dimensional independence and rater reliability remains in progress.

The protocol does not assume that cell anchors are validated interval measurements. Reliability statistics test the repeatability and decision usefulness of bounded scoring categories under the declared method; they do not convert ordinal or bounded judgment anchors into natural units of welfare.

Canonical architecture under test

Core normalized RLS formula: q(u,d)=w_u*v_d*m(u,d)*kappa(u,d), Q=sum_u sum_d q(u,d), and RLS(a)=[sum_u sum_d q(u,d)*I_prop_welfare(u,d,a)]/Q, with Q>0. If a worked example has Q=1, the numerator equals the normalized score; the denominator remains part of the canonical definition and MUST NOT be omitted from general formula surfaces.

Canonical welfare impact scale: I(u,d,a) in [-1,+1], where 0 means no material change from the declared baseline, not unknown. Unknown active cells must be marked and handled under the missing-data and gate-critical unknown rules.

Configuration Sensitivity and Profile-First Validation

Validation cases MUST freeze the evaluated configuration before first-pass scoring. Where a materially changed configuration alters capability, evidence, controls, permissions, operating envelope, or post-state effects, it is a distinct case condition rather than an unmarked repeat.

Primary reporting remains profile-first: the 7x7 field, subgroup and worst-affected slices, uncertainty, configuration sensitivity, dominance/incomparability, and rank reversals are reported before any scalar summary. Observed successful processes are partial capability evidence and do not establish untested boundaries or transfer across configurations.

study-integrity correction (Lineage)

The initial sprint is a burden, comprehension, boundary-classification, missingness, disagreement, and preliminary reliability study. It is not adequately powered for a defensible 49-variable factor structure merely because every cell is present. PCA, EFA, CFA, or related structure claims require a preregistered simulation-based sample justification at a later validation level.

Rater work SHALL be divided into randomized or counterbalanced blocks with recorded timing, breaks, order, and fatigue measures. Repeated quality-control cases and frozen case-packet hashes are required. First-pass welfare scoring SHALL be completed and locked before gate cues are shown; gate-cue review and adjudication occur afterward to reduce priming.

The v0.3 workbook SHALL use UNASSESSED or blank review-dependent defaults, extend validation across the entire structured range, and prevent untouched rows from appearing complete. Level 1 reporting is limited to descriptive disagreement maps, missingness, cell comprehension, preliminary reliability, boundary confusion, burden, and fatigue unless a separately preregistered design supports a stronger claim.

Additional Falsification Modules (Normative for the claims they test)

Taxonomy module: preregister plausible merges, splits and simpler alternatives; test boundary confusion, duplicated effects, omission, independent coding, subgroup visibility, explanatory value, burden and decision reversals. Do not infer statistical independence from low duplicate-effect coding, or mathematical irreducibility from a convenient seven-by-seven layout. Any combined criterion requires a disclosed measurement scale and weights.

Representation module: repeated observations, reordered keys, duplicate deliveries, alternative primary homes, conserved allocations and direct-versus-propagated endpoint estimates must be challenged. Exact duplicate transport must not change RLS. Repartitioning under nonlinear aggregation need not be invariant; detect and disclose any material reversal rather than promise invariance.

Control module: test grounded versus ungrounded effectiveness, latency on both sides of the harm deadline, ex-ante protection, late mitigation, depletion, common-cause failure, emergency authority, repeated commands, failover, stale evidence and unknown execution outcomes. Correct behavior includes refusal or restricted operation, not only successful recovery.

Privacy and security module: test proof-of-structure versus truth claims, invalid commitments, missing freshness/replay evidence, cross-domain signatures and identity disclosure. A mock signature, multiplication-based identity relation or unexecuted circuit is not a privacy/security result.

The supplied numerical and semantic fixture results are scoped implementation evidence. Hyperinflation, infrastructure loss, supply-chain conflict and offline-operation examples are synthetic unless independently sourced and identified otherwise. Do not report invented percentages, dates, prices, geographic replication latencies or control effectiveness as observations.

Study ladder

Validation sprint

This package implements the recommended first sprint. It is intentionally small enough to run quickly and rigorous enough to reveal the main weaknesses.

• Case set: 10 realistic synthetic cases across AI governance, education, health, environment, public policy, and local infrastructure.

• Options: 3 candidate options per case.

• Raters: minimum 3, preferred 5. Include at least one non-authorial reviewer when possible.

• Scoring surface: 49 RLS cells per option, with score, confidence, rationale, anchor method, evidence basis, and uncertainty flag.

• Blind posture: raters should score independently before discussion.

• Adjudication: after independent scoring, record disagreements and produce an adjudicated reference score only after preserving raw rater scores.

• Analysis: compute IRR, disagreement heatmaps, descriptive cell correlations, missingness patterns, burden, boundary confusion, and comparison to a simpler scalar or 7-dimension summary. Do not estimate or interpret PCA, EFA, CFA, or a 49-cell latent structure at Level 1; those analyses require a later preregistered study with simulation-based sample justification.

Additional experimental arms. Where resources permit, randomize or counterbalance access to the OptionClosureRecord prompt before first ranking and measure option diversity, dominance, gate passage, residual harm, and burden. Report utilitarian, leximin/prioritarian, and capability-oriented outputs as transparent comparators only; they do not override the Canon or establish moral truth.

Rater instructions

• Score the change from the declared baseline, not the absolute goodness of the option.

• Do not treat 0 as unknown. Use 0 only for no material baseline-relative change.

• If evidence is insufficient for an active cell, mark UNKNOWN_IMPACT and explain what evidence is missing.

• Do not average away subgroup harms in rights-relevant cells. Flag rights concerns separately from residual welfare scoring.

• Do not let RLS repair an option that fails RF/NCRC, TRC, or CSV.

• Record confidence independently from magnitude. A large impact with weak evidence is not the same as a small impact with strong evidence.

• Use the cell dictionary. When two cells seem similar, explain why the impact belongs in one cell, the other, or both with redundancy handling.

• When unsure, score conservatively, mark the uncertainty, and write the reviewer challenge question.

Scoring anchors

Study hypotheses

Statistics plan

• Inter-rater reliability: use ICC(2,1) for single-rater cell scores and ICC(2,k) for averaged panel scores when the same raters score the same case-option-cell units and the declared scale and design warrant that estimator. Use a preregistered Krippendorff alpha variant when missingness or measurement level warrants it; do not switch estimators after seeing which passes. Every component requires a frozen mapping of measurement level, coding unit, rater/sample design, primary estimator and variant, provisional threshold, point-estimate or confidence-bound decision rule, missingness and undefined-statistic handling. Record the rationale for applying that threshold to that estimator; an unmapped or unsupported target cannot establish readiness.

• Gate and classification reliability: report percent agreement and the preregistered primary categorical estimator, such as Cohen or Fleiss kappa, or weighted kappa with stated weights for ordinal fields. For rare failures or imbalanced states, percent agreement MUST NOT stand alone; report prevalence, the underlying contingency counts, class-specific errors and uncertainty. An undefined primary statistic is not a pass. Diagnostic alternatives may be reported without replacing the locked primary result.

• Ranking reliability: preregister Kendall W for the declared multi-rater design or a specified Spearman comparison for the declared paired design, including tie and missing-option handling. A rank correlation is not interchangeable with categorical agreement or ICC; map the provisional threshold before confirmatory evaluation.

• Correlation analysis: build a case-option by 49-cell matrix using adjudicated or mean rater scores. Report Pearson and Spearman correlations, clustered heatmaps, and high-correlation pairs.

• Factor/PCA analysis: not part of Level 1. At later validation levels, PCA, EFA, CFA, or related latent-structure analyses MAY be run only under a separate preregistration with simulation-based sample justification, held-out checks where feasible, and explicit exploratory-versus-confirmatory labeling.

• Decision-value analysis: compare final RLS ranking and narrative justification against a simpler scalar score, a 7-dimension-only score, and a 7-scope-only score.

Provisional protocol reliability targets (each numerical target applies only to its frozen primary preregistered reliability statistic under Canon Section 17.4A; no universal validated cutoff is implied)

Correlation and factor-analysis revision rules

• If two cells correlate above 0.85 across most domains and raters cannot explain distinct causal meanings, mark the pair for overlap review.

• If a cell has persistently low variance across diverse cases, check whether it is genuinely rare, poorly defined, over-masked, or under-evidenced.

• If a dimension shows repeated cross-loading with another dimension, add boundary examples to the scoring manual before considering structural revision.

• If a cell has low reliability but high decision relevance, do not remove it prematurely. Strengthen anchors, examples, evidence requirements, and reviewer checks first.

• If simplified models produce the same winner but lose key localized risk signals, preserve RLS and report the extra legibility as decision-relevant detail.

• If simplified models produce the same winner and same explanation with no material information loss across a larger case set, consider a reduced mode or domain-specific profile.

Disagreement taxonomy

Case packet standard

• Decision boundary and baseline.

• Option set with 2-5 options.

• Stakeholder-instance map and active Union Scopes.

• Evidence packet, including what is known, unknown, contested, and assumed.

• Rights Floor, TRC, and CSV pre-screen notes.

• RLS scoring sheet for every option.

• Rater confidence and rationale fields.

• Adjudication sheet that preserves raw scores before consensus.

• Post-analysis revision notes.

Synthetic case roster

49-cell welfare dictionary - compact validation version

This compact dictionary is extracted against the Canon Appendix AD role: it supports scoring interpretation and reviewer literacy. It does not modify gates, thresholds, equations, or claim boundaries.

Recommended additions to the release ecosystem

Add the following as companion, non-governing materials. They should be versioned separately from the core canon unless a future release explicitly promotes part of them into normative core.

Proposed README wording

Current status: RLS is specification-ready and audit-ready as a structured residual welfare-ranking specification and audit method. Empirical validation of dimensional independence, inter-rater reliability, and decision-performance advantage is a next-stage research priority. The RLS Validation Protocol provides the study design for testing these claims through scored cases, independent raters, reliability statistics, and correlation/factor analysis of the 49-cell welfare field.

Completion definition for the first sprint

• At least 10 cases scored independently by at least 3 raters.

• All raw rater scores preserved.

• Completion, missingness, and disagreement statistics produced.

• IRR reported for score, ranking, and key classifications where applicable.

• Correlation or redundancy heatmap produced over the 49 cells.

• At least one scalar or reduced-matrix comparator run.

• Revision log produced with exact cells, anchors, or instructions needing repair.

• Public claim boundary updated: exploratory, preliminary, validated for limited domain, or not validated.

Physical-admissibility validation extension

The v12-line research ladder, introduced at v12.0 and retained in the current v13.0 candidate, treats physical admissibility claims as a separate validation surface from governance mandate and authorization. Future validation runs should measure whether reviewers can reliably distinguish: governance authorization only, physical admissibility supported within the declared validity domain, physical admissibility not established, and physical admissibility contraindicated.

This extension does not test whether MathGov computes physics. It tests whether MathGov records the correct evidence boundary and refuses to overclaim physical safety when the domain evidence is missing or insufficient.

Minimum successful first validation report

A first RLS validation report should publish, at minimum:

mandatory conformance vectors

Single-source and vector mapping rule (Normative for protocol conformance).

Canon §17.4A controls IRR targets and Canon Appendix R controls framework conformance vectors. This protocol operationalizes those targets. Protocol-specific extensions use the RLSV- prefix and MUST state the Appendix R vector or invariant they extend; they do not create an independent framework-conformance authority.

The validation suite must include at least the following deterministic conformance cases before empirical claims are considered:

• one-month categorical bodily-integrity violation: RF/NCRC must fail regardless of short duration;

• one-year arbitrary detention: RF/NCRC must fail or return unknown/escalate if the categorical profile is unresolved;

• low-probability lethal exposure: a severe-hazard probability bound and governed tolerance are required; missing fields cannot pass;

• every option fails TRC while safe delay is available: Tail Emergency Mode must not activate;

• every option fails TRC in a demonstrated emergency: only a below-absolute-cap provisional least-CVaR option may proceed, with no ordinary RLS;

• non-default κ values that would produce an unnormalized raw score above 1: normalized RLS must remain within [-1,+1];

• active masks that change effective weight mass: score scale must remain invariant under normalization;

• uncertain equal-and-opposite impact instances: Method B uncertainty must remain positive through pre-cancellation contribution mass; a leader that clears the second-ranked option but fails discrimination against another selectable contender must not receive a unique-selection claim.

Current-package Tier-Integrity Conformance Vectors (Normative for protocol conformance)

The validation package MUST include the following cases:

• TIER2_CSV_REQUIRED_BEFORE_RLS: an option passes NCRC and TRC but has no CSV status. Expected: no ordinary RLS selection claim; route to CSV review or refusal.

• TIER2_CSV_NOT_MATERIAL_WITH_RATIONALE: a low-structural-materiality option records the rationale and may enter RLS.

• TIER2_CSV_REDESIGN_REQUIRED_BLOCKS_RLS: an option with CSV_REDESIGN_REQUIRED is excluded before scoring.

• TRC_ALL_FAIL_SAFE_DELAY: expected redesign/delay/refusal; minimum CVaR does not create selection.

• TAIL_EMERGENCY_PREREQUISITE_MISSING: expected TAIL_EMERGENCY_REFUSED or escalation.

• TAIL_EMERGENCY_FULL_PREREQUISITES: minimum-CVaR provisional action is allowed only inside Tail Emergency Mode, with ordinary RLS disabled.

• RIGHTS_UNKNOWN_NOT_ZERO: missing material rights evidence returns an unknown/refusal posture rather than a zero impact.

• RLS_ZERO_ACTIVE_MASS: returns RLS_NO_ACTIVE_MASS, not zero.

Formal-Integrity and Selection-Claim Validation Programme

Supplemental synthetic regression: adverse-confidence reversal (implements Canon R.25). Stipulate all qualification and evidence conditions separately; use one active ordinary-welfare cell, q/Q=1, NONE, beta=2. Option A has pre-confidence contributions +0.20 at c=1 and -0.18 at c=0.1; option B has +0.10 at c=1. Other instance multipliers are 1. Declared scores are tanh(0.364)=0.3487324660 for A and tanh(0.2)=0.1973753202 for B. The required adverse-confidence counterfactual yields tanh(0.04)=0.0399786803 for A; B is unchanged. The leader reverses. Expected: CONFIDENCE_RANK_SENSITIVE and no unique framework selection. NOT_TRIGGERED_WITH_RATIONALE is not valid merely because the run is Tier 2 or the nominal leader is convenient. This fixture is a test of the existing trigger/refusal rule, not measured welfare or an assertion of a real gate pass.

Supplemental synthetic regression: cross-option adverse dependence (implements the existing dependence module). Hold scores at A=0.032, B=0, final-score sigma_A=sigma_B=0.010, epsilon=0.000001 and delta=2. Nominal SignedGap is 0.032/sqrt(0.000201), above 2. With a supported pairwise rho=-1, SignedGap is 0.032/sqrt(0.000401), below 2. Expected: RLS_DEPENDENCE_SENSITIVE, non-decisive framework result and full disclosure of the nominal and adverse variants. An independent-error fixture with non-material cross-option dependence retains the nominal calculation. Test zero-sigma covariance handling, invalid rho, non-finite input, inconsistent joint covariance and unsupported proxy interpretation separately. These are stipulated regression inputs, not empirical error estimates.

This candidate retains the v2.7 specification tests for RightsEffectToken non-dilution; token and temporal partitioning; probability operator order; adverse confidence; distributional/subgroup washout; reference and baseline families; comparison-mask symmetry; uncertainty dependence and numerical guards; weight-profile disagreement; option-set closure; and robustness completeness.

Formal vectors establish whether an implementation follows the Canon. They do not establish construct validity, inter-rater reliability, predictive validity, external validity, decision superiority, legal authority, physical safety, deployment readiness, or moral truth.

The reliability programme SHALL separately measure effect-token individuation, primary dimension assignment, subgroup discovery, likelihood-semantics classification, reference/baseline selection, robustness-trigger status, and final ranking. Agreement on a final score without agreement on these upstream constructions is insufficient.

Comparative pilots SHOULD test the full Core against a qualify-first equal-weight matrix and a qualify-first profile-only comparator, plus a documented constrained MCDA method where a claim about MCDA is made. Match the information, option set, noncompensatory constraints and analyst resources fairly. Incremental decision value must be earned rather than presumed. A causal superiority claim additionally requires the claim-specific identification plan specified by MFDI and PC-AEP; pre/post change alone is not a treatment-effect estimate.

Also reproduce Canon R.38A alongside the retained R.38, including its cell-level interval and dependence construction, correct conditional decisive outcome, and blocked variants. This is a synthetic conformance test, not evidence of empirical uncertainty calibration, improved real-world decisions or execution authorization. Method B selection claims must additionally satisfy the Canon Section 10.3.2 transformation-consistency rule.

Appendix: Current-package source-integrity vectors

APPENDIX RELEASE: Identity, Source Authority and Revision Record

Framework release: MathGov/RippleLogic v13.0. Component: RLS Validation Protocol v2.9. Edition-origin preparation: 10 September 2026; the separately identified correction build is dated below. Two-part major.minor component versions are used; preserved historic identifiers are not renumbered.

Status: integrated research and teaching specification with a bounded worked-example and scoped reference implementation. Readiness is limited to the checks in Reports/Verification_and_Readiness.md. No empirical validation, independent human validation, full production runtime, physical-safety certification, legal authority, deployment authorization or Tier-4 ProofPack status is implied by the edition number.

Delivery identity: MathGov/RippleLogic v13.0, build MG-RL-13.0-20260923-RELEASE-G. Prepared 23 September 2026 from the supplied frozen publication archive. Only reproduced defects and approved clarifications were patched; component editions are unchanged. The manifest identifies the exact current bytes and the preserved baseline. This is a new correction build, not a silent replacement of the earlier frozen artifact. Live publication is not asserted.

Component/build identity. Aligners Sheet v5.9 retains its component edition but carries this correction build’s identifier. Its numerical inputs, calculation formulas and worked verdict are unchanged; label, runtime-token and integrity-snapshot corrections are itemized in Verification/Exact_Workbook_Changes.json. Exact hashes, rather than filenames or edition labels alone, distinguish the new bytes from Release D and the previous frozen publication.

Verification boundary: Reports/Verification_and_Readiness.md and Verification/Final_G/ contain the current build’s executed checks and limitations. Earlier verification and the rejected compatibility experiment belong to the preserved baseline and do not certify changed bytes. Cache-independent replay, stored-formula and native-engine results are separate evidence surfaces. Microsoft Excel parity, full external-registry conformance, empirical validation and production authorization are not asserted.

Package source authority: Core_15 contains 14 DOCX specification masters and one XLSX Aligners frozen worked-run workbook. DOCX files control prose, equations and tables subject to Canon and SGP ownership. The workbook controls only its disclosed exemplar surfaces. Sources, Reading_HTML and Reading_PDFs are generated reading projections, not competing normative masters. The manifest and hashes identify exact bytes; supplemental code and schemas govern only their documented subset. Conflicts require recorded correction against the controlling source.

License and reuse: consult the package-level LICENSE and NOTICE and retain applicable component-specific and third-party notices. This pointer does not override a valid exception or grant rights over separately supplied private or third-party review material.

External repository publication and any absent legacy schema/validator/registry are separate authorities/evidence surfaces. The local package does not claim to update a remote repository or reproduce unavailable implementations. Current source pointers in this appendix replace prior front-matter edition pointers for this package; accurate historical source references below are retained as lineage only.

Preserved invariants: RG -> RF/NCRC -> TRC -> CSV -> RLS; rights non-compensation and unallocated rights effects; existing seven rows and seven dimensions; existing SGP MPS/FPP/GPR/SPR/ICP/RMCP separation; probability ownership, uncertainty, stability and every-contender rules; selection, authority and execution separation.

Change locations and rationales: Reports/Audit_Adjudication_and_Changes.md; exact edits: Verification/Exact_Document_Changes.json and Exact_Workbook_Changes.json. Navigation and metadata records are separate. Prior releases and feedback are preserved in the complete provenance archive.

Current proposals are not universal truths. Taxonomy maximality, continuous-time propagation, cross-substrate cardinal welfare, generic susceptibility/shield formulas, autonomous recovery, vendor infrastructure, zero-knowledge circuits and hardware meshes remain unvalidated unless independently demonstrated under a scoped implementation profile.