feat(settle): lab 18 — zero-inference partial-observation controller

[bigboateng]

What

New lab 18 — settle: a standalone, compiled Go binary that wraps any agent's command execution and intervenes with minimum, nonblocking force when the loop stops making observable progress. Zero model inference — all detection is hashing, counting, diffing, and regex.

This is a new architecture, not lab 17 (f-prime-governor) shipped. It keeps lab 17's defensible ideas (the EV inequality, minimum-force under partial observation, weak-sensor agreement) and drops F' = p(1−p), which was decorative.

Theory (docs/01)

settle is the same Ramadge–Wonham supervisor as Boatstack, operating in the regime where the spec is unobservable:

• Boatstack's spec is co-designed observable → no false-positive rate.
• settle's spec ("do not remain in a non-progressing cycle") is provably not observable — a futile loop and slow-but-genuine progress can share the same projection P(s). By the Existence theorem, no exact supervisor exists, so settle runs an approximate belief-state supervisor and pays for the unobservability with an irreducible FP rate (stated as a theorem, not a defect).

Design consequences, aligned to repo-root supervisory-control.md:

• minimum force = the minimally-restrictive supervisor (supC(K)), which is also the EV > 0 rule — two frames, one law.
• nonblocking: even a deny withholds one command and leaves read-only moves open (fixes lab 17's swe_breaker.py exit(1) hard-block, which violated this).
• fail-OPEN, inverting Boatstack's fail-closed: an optimizer must never block a healthy agent under sensor loss.

Detection (docs/02)

The real object is a non-marked recurrent class in the observation stream. One cycle detector subsumes the five sensors: state-repeat = period-1, oscillation = period-k, with edit-distance-floor and entropy-collapse as leading indicators. Recurrence keys on the joint (error signature, state hash), so a loop whose error repeats while the workspace keeps changing (hidden progress) is not flagged. Semantic-signature + command-normalization ported into a single Go source of truth (was duplicated across three drifting files in lab 17).

Surface

settle exec -- <command> [args...]   # supervise one command (atomic unit)
settle run  -- <agent> [args...]     # wrap an agent; shell shim routes through settle exec
settle doctor                        # self-check

Isolated — no runtime Pitot/Harbor dependency. Decision maps 1:1 to Pitot's control.response for a later bridge adapter.

Calibration (docs/04)

scripts/calibrate.py mines 1,890 Harbor trajectories for the recovery-probability curve. Finding: byte-identical repeated failing commands are rare (agents mutate commands) — which validates the joint/semantic sensors over lab 17's literal hash. Data hints k=2 on thin support (44 sequences); ships the conservative fallback k=5 transparently, with the derived hint recorded in calibration.json.

Claim discipline

Detection firing correctly on the golden fixtures = Observed. Net effect on task success = Being-evaluated until the pre-registered paired experiment (docs/04). No invented numbers, no cross-model uplift claims.

Verification

• GOWORK=off go test ./... green — golden fixtures (always-fail, syntax-mutating, oscillation, genuine-progress, near-miss, hidden-progress), a determinism property test, and the canonicalization audit.
• settle doctor passes; a live settle exec loop escalates inform → redirect → deny as designed.
• scripts/check_import_boundary.sh holds (detector never imports exec).
• Module added to go.work; go vet clean across all three workspace modules.

🤖 Generated with Claude Code