Public Corpus Authority Series
Enforcement, not inference: what public-corpus testing showed.
We tested FieldHash on public data we did not author, then hid the authority metadata to see whether the claim would break. It did.
Supported claim
Governed Memory enforces configured authority evidence before model input. It does not claim autonomous authority inference from arbitrary prose; semantic binding is tested separately as a fail-closed check after a governing source is known.
Boundary found
222/300
With RFC authority metadata hidden, FieldHash matched semantic retrieval. Stale exposure returned to 285/300.
Enforcement proof
300/300
With RFC Obsoletes/Obsoleted-By metadata visible, the current RFC reached the governed answer path every time.
Do-no-harm signal
0/288
Coffee StackExchange no-conflict rows had zero false demotions under the stricter semantic proxy run.
Honest baseline
299/300
A deterministic RFC metadata-aware filter essentially tied on selection. This is distinct from the MemConflict strong labeled prompt baseline; different corpus, different method.
The negative ablation defines the product boundary.
In the RFC hidden-authority run, the same 300 conflicts and same ground truth were retained for scoring, but explicit Obsoletes/Obsoleted-By authority metadata was hidden from FieldHash. The governed path no longer separated from semantic retrieval: both scored 74.00%, with zero FieldHash-only wins and stale exposure returning to 285/300.
The hidden run still left record titles, status text, relation prose, dates, timestamps, and semantic relevance available. What it withheld was the structured canonical authority evidence used to govern the gate.
What we hid
Authority metadata.
The test removed explicit RFC supersession signals from the governed path while preserving ground truth for scoring.
What failed
Autonomous inference.
Content, dates, and retrieved text alone were not enough for the current governed path to infer which RFC should govern.
What survived
Deterministic enforcement.
When authority evidence is available, Governed Memory converts it into answer-path control and evidence reviewers can inspect.
Public data sequence
Three public diagnostics, one scoping question.
The series separates safety, enforcement, and inference. Coffee tests whether gating corrupts clean rows on messy public data. RFCs test supersession enforcement with ground-truth labels. The hidden-metadata RFC ablation tests whether FieldHash still wins when that authority evidence is removed.
1. Coffee StackExchange
Messy public data, proxy authority.
Accepted answers are treated as a proxy label, not certified truth. The headline is do-no-harm: on the stricter semantic run, FieldHash created zero false demotions across 288 no-conflict rows and reduced exposed context by 64.0%.
Proxy gain
64.67% vs 54.00%
False demotions
0/288
Context reduction
64.0%
Conflict slice
12/300
2. RFC visible authority
Ground-truth supersession, metadata visible.
RFC Obsoletes and Obsoleted-By fields provide public, machine-checkable authority labels. With those signals visible, FieldHash enforced the current RFC in every conflict and suppressed obsolete answer-path exposure.
Governed current
300/300
Semantic retrieval
222/300
Stale exposure
0/300
McNemar p
6.6e-24
3. RFC hidden authority
Same conflicts, metadata hidden.
This is the falsification run. When the authority signal was hidden from FieldHash and kept only for scoring, the governed path collapsed to retrieval-like behavior. That result bounds the public claim.
Governed current
222/300
Semantic retrieval
222/300
Stale exposure
285/300
McNemar p
1.0
The visible RFC result is an enforcement proof, not a claim that FieldHash uniquely selects current records whenever clean metadata exists. A metadata-aware deterministic baseline reached 299/300 on the same visible-authority task. That is a separate RFC filter baseline, not the MemConflict strong labeled prompt result reported on the MemConflict page.
Matched baselines · n=600
What actually reaches the model.
The selection results above ask which record wins. A separate question decides prompt load and audit burden: what does each context-assembly strategy put in front of the model? Same conflicts, same retrieval budget, three strategies measured side by side.
Plain top-k retrieval
593/600
Conflicts where at least one superseded record entered the model's context at k=3, averaging 1.3 stale records per prompt. The leak grows with retrieval budget: 598/600 at k=5 and 600/600 at k=10.
Status filter + top-k
0/600
A plain status filter ties on exposure: zero stale records at every budget, whenever the metadata exists and holds. Disclosed, as with selection. Exposure hygiene alone is not the differentiator.
FieldHash answer path
1.0 record
Zero stale records, and a mean answer path of one record whether retrieval fetches 3, 5, or 10 candidates. Blocked records are retained as reviewable evidence rather than dropped without evidence.
How to read this fairly: these are leak rates given a conflict exists. On messy public data (the Coffee diagnostic), freshness conflicts were roughly 4% of questions; how often your records supersede each other is workflow-specific. The filter's zero is real where clean, stable metadata exists. What the filter does not provide is rollback-state handling, an evidence packet for what was excluded, or a one-record review surface instead of three to five.
What this shows
FieldHash can enforce visible authority signals on public RFC conflicts with independently checkable ground truth.
Obsolete records can be withheld from the model packet while current records reach the governed answer path.
On messy public Coffee data, the stricter proxy run showed zero false demotions across no-conflict rows and meaningful context compression.
Publishing the negative ablation makes the product boundary inspectable rather than implied.
A reviewed proposal pass can recover enforcement when metadata is missing, with the partial-graph failure mode disclosed below.
What this does not show
Not third-party validation, customer-production proof, legal compliance evidence, or a named-competitor superiority claim.
Not autonomous authority inference from arbitrary prose when governance metadata is unavailable; semantic binding is a separate eligibility check after authority is resolved.
Not proof that Coffee StackExchange accepted answers are authoritative truth; they are proxy labels.
Not evidence that FieldHash should replace retrieval systems, memory stores, or customer systems of record.
Recovery diagnostic · n=600
The gap closes under review, not under autonomy.
The hidden-authority selection ablation above is the n=300 row: 222/300, or 74.00%. The recovery diagnostic below is a separate paired n=600 exposure-and-recovery follow-up over the same RFC authority problem. In that frame, hidden authority leaves a 159-row gap: 441/600 against the 600/600 visible ceiling. A proposal pass reads record prose and proposes supersession links into a review queue; approved links become governed state; enforcement stays deterministic.
Authority is still configured evidence. The proposal pass only changes who drafts it.
Field-style prose · rules proposer
600/600
When supersession is stated in structured prose, a deterministic rules pass recovered the full visible-authority result and zeroed stale answer-path exposure (563 rows to 0; p = 2.7e-48). No model is required for this case.
Narrative-only prose · LLM proposer, reviewed
535/600
With field-style statements removed, a reviewed LLM proposal pass closed 59% of the gap and cut stale exposure from 563 to 195 rows. It beat a same-budget rules proposer (+31/−7, p = 1.2e-04). Link recall of 0.51 is the binding constraint: the pass does not invent links the prose never states.
Review decides the outcome
+11/−1
Applying LLM proposals without review cost ten net selections (p = 0.0063) and doubled regressions from 13 to 23. Proposal precision ran 0.88–0.99, so the reviewer confirms a mostly-correct queue rather than triaging noise.
Disclosed failure mode
Partial graphs can promote a false local-current. When the true current record's links are not proposed but a stale record's are, the stale record can look like a chain root. Thirteen conflicts regressed even under perfect review. Enforcement should treat a record with no proposed successor as unknown, not current, until the approved graph covers the chain.
Reviewer simulation bounds: the reviewed arm approves only proposals matching ground truth (an upper bound); the unreviewed arm applies everything (a floor). A real review queue lands between them. RFC prose is unusually well-behaved, so the narrative-only condition is the closer proxy for messy enterprise records. The boundary above stands: this is reviewed signal creation, not autonomous inference.
Answer-path attribution · n=300
From which record reaches the model to which record licensed each claim.
The exposure results above end at the model's input. A follow-up diagnostic extends the evidence packet through the answer itself: claims are segmented with character offsets and mapped to governed records using deterministic methods only, with conflicts dominating and every relation method disclosed. The test ran on the same 300 public RFC conflicts as the exposure comparison, with three template answer variants per case.
Answers were templates we wrote, not live model outputs. This demonstrates the detection mechanism, not model behavior, and attribution records consistency relations with disclosed methods, not causal proof that a model used a record.
Stale substitution
300/300
Template answers asserting a superseded RFC were flagged every time: the asserted identifier traces to a record governance withheld, and the claim is unattributable to governed context. The leak signal is value-based and survives token collisions that can mask weaker overlap methods.
Faithful answers
300/300
Template answers asserting the current RFC attributed cleanly: supported by the governing record, no contradictions, no flags. The current record reached the answer path in all 300 conflicts.
Distractor answers
300/300
Answers asserting an unrelated RFC were caught every time, all as unattributable: distractors did not survive into the roughly one-record answer path, so the contradiction route never engaged. We report that split rather than asserting it.
Found by our own instruments
Three defects surfaced during this diagnostic's development and were fixed the same day, regression-pinned, and disclosed in the methods report: a protection-ordering edge in a disabled-gate path, scope-blind contradiction that let neighbor-scope authority falsely contradict faithful answers, and substring value matching that let a record identifier inside a longer project key falsely support every answer. One boundary remains open and disclosed: token collisions can earn weak lexical support on a synthetic case; the value-based leak signal is unaffected.
Continuation: this mechanism now has live-model evidence. Across 1,000 live answers from three model families, every answer received a disposition and no answer passed through unaccounted for. Read the live answer attribution diagnostic.
Continuation: the open problem this series ends on, authority inference without gold labels, now has a pre-registered answer on records nobody here wrote. We registered the condition under which our own architecture would lose on selection, ran it, and published the loss alongside what the loss bought. Read: the benchmark we were allowed to lose.
Pilot implication
The first buyer question is: where do your authority signals live?
Contract lifecycle systems, policy-management tools, SharePoint version history, approval workflows, amendment links, effective dates, rollback events, and systems of record already carry governance signals in many regulated environments.
FieldHash translates those signals into answer-path enforcement and reviewer evidence. If the signals do not exist, the right onboarding motion is propose-then-approve metadata creation before enforcement, not live autonomous gating. The recovery diagnostic above tests exactly that motion.
Propose-then-approve path
Propose
A model or rules pass proposes supersession, rollback, scope, or approval links on unstructured records.
Approve
A human reviewer, policy owner, or system-of-record signal approves or rejects the proposed authority metadata.
Enforce
FieldHash gates model input using approved metadata and emits an evidence packet for review.
Test the boundary on one workflow.
Bring the records, review states, rollback events, or systems-of-record signals your agent already touches. Shadow mode can show what would govern, what would be withheld, and what evidence reviewers would receive.