hypgraph 0.7.28__tar.gz → 0.8.1__tar.gz

{hypgraph-0.7.28 → hypgraph-0.8.1}/CHANGELOG.md

@@ -1,5 +1,64 @@
 # Changelog
 
+## 0.8.1 — 2026-11-01: exact figures, units within their kind
+
+An independent audit of 0.8.0 found two defects in the typed checks, both confirmed on the published wheel.
+
+- **Exact figures (HG-080-01).** Containment of two conditions was decided by probing at each figure ± 1 and the
+  midpoints, in floats. Above 2**53 a figure + 1 is the figure, so x > 1e18 looked inside x <= 1e18, and a count of 0
+  above 1e18 supported "none below 1e18". Containment is now decided on the pieces the two figures cut the line into,
+  with no arithmetic on them, and figures keep their exact value (10**18 + 1 is not 1e18; it renders as itself).
+- **Units within their kind (HG-080-02).** The unit table's kind was dropped, so `lb` (mass) matched `GBP` and
+  `sterling` (currency) through the shared name "pound". A unit is now its (kind, unit) readings: `lb` = `lbs` and
+  `GBP` = `sterling` still, never across kinds, and an ambiguous `pound` matches only another `pound`; the refusal says
+  what it could be and asks for `lb` or `GBP`.
+- **`exactly` decided from bounds.** It was left unresolved unless its set was the counted one or its complement:
+  4 of 4 above F now contradicts "exactly 4 below F". Over one population every verdict now equals enumeration of the
+  consistent worlds (sound and complete), and the test checks that.
+- **An extreme stated as a value is two atoms.** In a typed investigation "the longest of the 4 routes is 26 km"
+  needs both "none above 26" and "some at 26 or more"; one of them is refused (`ASSERTION_MISSING`). An extreme stated
+  as a bound ("the slowest took at least 40 minutes") needs one.
+- Tests: containment against exact rational probes over large, adjacent, subnormal and signed-zero figures; the audit's
+  cases through `_decide` and the write gate; units; extremes. The audit's own test file passes (13 of 13).
+
+## 0.8.0 — 2026-11-01: typed claim assertions
+
+Eight independent audits (HG-020 → HG-028) found the same class of failure, each time in a new wording: to decide
+whether a count backs or contradicts a claim, the checks read words — the result's key and the claimant's
+measurement name for what was counted, the statement for what is asserted and which clause a count belongs to — and
+the claimant writes most of those words. Each fix narrowed one wording; the next audit found another. 0.8.0 stops
+inferring that structure from words.
+
+- **Typed counts.** A count may say what it counted: `population` (a path, `route/passenger` lies within `route`),
+  `property` and `unit`, beside `k`, `n`, `figure` and `op`. The result's author writes them; the instrument, on its
+  own results.
+- **Typed assertions.** A claim may carry `asserts`, atoms `{quantifier none | all | some | exactly, population,
+  property, op, figure, unit, n, k, measurement}`. Each is decided against its bound count by sets on the number line
+  and population paths (`src/hypgraph/assertions.py`): supported, contradicted, or unresolved with the field that
+  blocked it. No words are read, so a true atom can't lend anything to a false one (HG-028-01) and "all 4 routes"
+  meets its counterexample however the set is enumerated (HG-028-02). New codes `ASSERTION_CONTRADICTED` (tracked in
+  conduct like `COUNT_CONTRADICTS`, `by_assertion`) and `ASSERTION_UNRESOLVED`.
+- **Typed investigations.** `typed_claims: true` on an investigation (or a profile's `typed_claims`) makes atoms the
+  check: a statement that asserts an absolute, an extreme or a count needs an atom for each part that does
+  (`ASSERTION_MISSING`, with atoms drafted from the statement and its typed counts — never trusted, checked once
+  written), and the word interpretation stands down there: measurement names and keys aren't read for what was
+  counted, and the absolute / counterexample / extreme checks don't run. Numbers in the statement must still be bound;
+  every other check runs as before.
+- **Standing.** A claim's state carries `assertions` (each atom rendered as the sentence it asserts, with its verdict
+  against the count as it stands now), `assertion_contradicted` when a count revised later makes an atom false (the
+  claim joins the revalidation queue), and `checked_by`: `typed`, `wording` or `none`. Bundles carry the verdicts, and
+  the verifier checks them against the rows. The Atlas claim drawer shows the atoms as the headline and the author's
+  sentence beneath, labelled as prose.
+- **A count is whole, for everyone** (HG-028-03). `k` and `n` must be whole numbers (an int or an integral float),
+  finite, `0 ≤ k ≤ n`, `n ≥ 1`, on creation and on revision (`VALUE_NOT_A_COUNT`); counts used to be truncated, so 0.9
+  of 4 read as 0 of 4 and backed "none". A typed count must be complete (`VALUE_TYPE_INVALID`).
+- **The word checks are frozen.** Outside a typed investigation they run as in 0.7.28 and are documented as heuristics;
+  HG-028-01 and -02 remain limits of untyped mode. Replaying the 1,900 recorded adversarial entries changes none, and
+  every trial's standing is the same.
+- Tests: `tests/test_assertions.py` (the interval logic checked against enumeration over every op and quantifier, paths,
+  units, the gate, standing, bundles, the draft) and `tests/test_typed_audits.py` (92 attack sentences from the audits
+  and their holdouts, around fixed atoms: none changes a verdict).
+
 ## 0.7.28 — 2026-11-01: a figure said twice, a comparison in another tense
 
 Fixes from an independent audit of 0.7.27 (HG-027-01, -02) and from paraphrases written after the first fix; each case

{hypgraph-0.7.28 → hypgraph-0.8.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: hypgraph
-Version: 0.7.28
+Version: 0.8.1
 Summary: The evidence layer for AI research agents: a hash-chained research record that checks every claim as it is written and derives how well each is known.
 Project-URL: Homepage, https://hypgraph.com
 Project-URL: Documentation, https://hypgraph.com/engineers/

{hypgraph-0.7.28 → hypgraph-0.8.1}/docs/PLAN.md

@@ -109,7 +109,7 @@ claim's derived standing.
 Multi-writer sync between graphs (bundles cover sharing), authentication (the host's job; the HTTP server binds to
 loopback and is read-only unless started with `--writable`), and a hosted service.
 
-## Status at 0.7.28 (2026-11-01)
+## Status at 0.8.1 (2026-11-01)
 
 All seven phases are done: the library, bundles, the server and UI, the MCP server, the website, Pegasus running on
 the package, and releases to PyPI from tags with trusted publishing. What came after the plan, by release, is in

{hypgraph-0.7.28 → hypgraph-0.8.1}/docs/RELEASE-READINESS.md

@@ -213,6 +213,42 @@ was taken from a changelog without being checked against the code.*
 > checked against a counterexample. This is still word matching; the typed claim layer the audits recommend is not
 > built. Released as 0.7.28.
 
+> **Audit of 0.7.28 (2026-11-01): the class, not the symptom.** A ninth independent audit named three defects, all
+> reproduced on the PyPI 0.7.28 wheel (9 of 12 reproducer cases failed, the 3 controls passed): a true absolute about
+> one thing still lent its words to a false one about another in the same statement (HG-028-01); an enumerated "all 4
+> routes" skipped the counterexample check (HG-028-02); and fractional counts were truncated, so 0.9 of 4 read as 0 of
+> 4 (HG-028-03). The first two are the class every audit since HG-020 found: the checks infer from the claimant's
+> words what a count measured, what a claim asserts and which clause a count belongs to. That is now addressed
+> structurally rather than per wording: counts carry types (population, property, unit), claims carry typed atoms, and
+> an atom is decided against its count by interval logic and population paths, reading no words
+> (`src/hypgraph/assertions.py`). The audit's typed-predicate recommendation is the design. Fractional and impossible
+> counts are refused for everyone (`VALUE_NOT_A_COUNT`).
+>
+> **Where that stands.** Typed checking is opt-in per investigation (`typed_claims`), additive to `hypgraph/1`.
+> Inside it, the audits' 92 attack sentences around fixed atoms change no verdict, and the interval logic is checked
+> against enumeration for every op and quantifier. Outside it the word checks are frozen at 0.7.28 and labelled
+> heuristic: HG-028-01 and -02 are known limits of untyped mode, closed only by typed mode. Typed checking covers
+> count-based assertions (none / all / some / exactly, and extremes as pairs); comparisons between two measured arms
+> and significance are still word-checked. In typed mode the prose remains the author's: a sentence that asserts
+> more than its atoms is refused (`ASSERTION_MISSING`), but a detection miss leaves prose unverified rather than
+> verified, and the record shows the atoms, not the sentence, as what it checked. Replaying the 1,900 recorded
+> adversarial entries changes none. #102 is merged with green CI (17 of 17 checks). Released as 0.8.0.
+
+> **Audit of 0.8.0 (2026-11-01).** The first audit of the typed layer found its architecture sound (GO for a
+> controlled typed-claims pilot) and two narrow defects in its helpers, both reproduced on the published wheel (its
+> test file: 9 failed, the 4 controls passed; the wheel's SHA-256 matched the audit's). Containment was probed in
+> floats at figure ± 1, which above 2**53 is the figure itself, so opposite conditions at 1e18 looked equal and an
+> unsupported "none below 1e18" was supported (HG-080-01). And units dropped their kind, so `lb` matched `GBP` through
+> the shared name "pound" (HG-080-02). Containment is now decided exactly on the pieces of the line, with figures kept
+> as given; a unit is its (kind, unit) readings. Two related gaps closed with them: `exactly` was left open unless its
+> set was the counted one (now decided from bounds, and every verdict equals enumeration over one population), and an
+> extreme stated as a value now needs both its atoms.
+>
+> **Where that stands.** The boundary the audit names stays: prose is matched to atoms by reading words, so a missed
+> part leaves prose unverified, never an atom verified; integrations should consume `asserts` and their verdicts, not
+> the statement. Untyped mode keeps its documented limits. #104 is merged with green CI (17 of 17 checks). Released as
+> 0.8.1.
+
 ## Recommendation: CONDITIONAL GO
 
 HypGraph is ready for a public developer preview once #59, #60 and #61 are merged with green CI and released as one

{hypgraph-0.7.28 → hypgraph-0.8.1}/docs/spec.md

@@ -20,10 +20,10 @@ correction is a new row, never an edited one.
 
 | type | code | fields (\* required) | what it is |
 |---|---|---|---|
-| `investigation` | INV | **title**\*, **objective**\*, success_criteria, scope, state, reviewers, constants, strict_claims, keywords, projects, doi, note, legacy_case | The study: an objective, its scope, who reviews it. Every other node belongs to one. |
+| `investigation` | INV | **title**\*, **objective**\*, success_criteria, scope, state, reviewers, constants, strict_claims, typed_claims, keywords, projects, doi, note, legacy_case | The study: an objective, its scope, who reviews it. Every other node belongs to one. |
 | `question` | Q | **text**\*, why | Something you want to know. |
 | `hypothesis` | H | **statement**\*, assumptions, **predictions**\*, distinguishing, open_questions | A possible answer, with the predictions that would show it wrong. |
-| `claim` | CL | **statement**\*, scope, limitations, kind, measurements, evidence_note, exposure, exposure_unit, legacy | What you assert is known, with its scope and its numbers bound to results. |
+| `claim` | CL | **statement**\*, scope, limitations, kind, measurements, asserts, evidence_note, exposure, exposure_unit, legacy | What you assert is known, with its scope and its numbers bound to results. |
 | `experiment` | X | **aim**\*, **protocol**\*, controls, **success_criteria**\*, method, budget, power_check, cost_minutes, seed | A planned test: aim, protocol, controls, success criteria, and what each hypothesis expects. |
 | `run` | RUN | **kind**\*, job_id, name, state, code, inputs, outputs, args, config, seed, env, started, finished, exit_code, log_sha256, note | One execution: code, inputs and outputs hashed, seed, state. `kind=lab` only from an instrument. |
 | `result` | RS | **summary**\*, kind, outcome, values, expected, limitations, power, evidence_note, legacy | What a run (or an observation, or a citation) found: values, outcome, power. |
@@ -59,6 +59,21 @@ correction is a new row, never an edited one.
 Field kinds and lengths: `hypgraph schema --json` (or `/schema/hypgraph-1.json` on the site). A claim's
 `measurements` are `{name, value | k & n | lo & hi, result: <result id>, key: <field of that result's values>}`.
 
+**Counts and typed counts.** A result value with `k` or `n` is a count: `k` of `n`, both whole numbers (an int, or a
+float with no fraction), finite, `0 ≤ k ≤ n`, `n ≥ 1`. It may say what it compared: `figure` and `op` (one of `<` `<=`
+`=` `!=` `>=` `>`). A **typed count** also says what it counted: `population`, a path such as `route/passenger` (lower
+case; `a/b` lies within `a`), `property`, an id (`length`), and optionally `unit`. `{"k": 1, "n": 4, "figure": 26,
+"op": ">", "population": "route", "property": "length", "unit": "km"}` is 1 of 4 routes with length > 26 km. The
+types are the result's author's; on an instrument-filed result they are the instrument's.
+
+**Typed assertions (`asserts`).** A claim may state what it asserts as atoms, each checked against a typed count
+(§7): `{quantifier, population, property, op, figure, unit?, n?, k?, measurement}`, where `quantifier` is `none`
+(nothing in the population meets `property op figure`), `all` (everything does), `some` (at least one does) or
+`exactly` (`k` of them do; `k` required), `n` is the population's size as the claim states it, and `measurement` is the
+0-based index of the claim's measurement whose count decides it. An extreme is two atoms: "the longest route is 26 km"
+is `none` `>` 26 and `some` `>=` 26. An investigation with `typed_claims: true` (or a profile that sets it) checks its
+claims this way.
+
 Verdicts: positive `checked`, `pass`, `reproduced`, `replicated`, `separate_implementation`, `generalizes`; negative
 `fail`, `not_reproduced`, `not_replicated`, `does_not_generalize`; and `objection`, `resolved`, `inconclusive`,
 `comment`.
@@ -169,7 +184,8 @@ published and signed, and what each check does and doesn't show: [verification.m
 verifier must check every fact in it that the rows fix: which investigations it covers (the scope's, or every
 investigation node), which investigations the list shows (each once), which nodes each investigation's graph shows
 (all of them, unless capped at 5,000) and which live (unretracted) links among them, each node's `type`, `code`, `inv`,
-`by`, `at`, `v`, `title`, `kind` and `state.lifecycle`, and each link's `id`, ends, versions, `rel`, `data`, `at`,
+`by`, `at`, `v`, `title`, `kind` and `state.lifecycle`, each typed assertion's verdict (`state.assertions`, a function
+of the claim's and its results' latest rows), and each link's `id`, ends, versions, `rel`, `data`, `at`,
 `by` and `why`. Every one of these must be **present**, not only equal where present: a viewer fills a missing fact
 with a default, and a withdrawn claim without its lifecycle would read as active. The lifecycle is derived from the
 verified rows (withdrawn when a withdrawal exists; superseded when a live `supersedes` or `corrects` replacement is
@@ -212,6 +228,11 @@ Implementations must derive these, never store them:
   - A replication edge on the run raises the profile according to its `differs`.
   - A result of `kind=cited` is external only if it `cites` a source node.
 - **basis_changed** (decisions): a `based_on` edge whose target's version has moved past the pinned `dst_v`.
+- **assertions** (claims with `asserts`): each atom with its verdict against its count as the record holds it now
+  (§7, *Typed claims*) and its rendered sentence ("no route/passenger (of 4) has length > 26 km"). The rendered atoms
+  are what the record verified; the statement is the author's prose. **assertion_contradicted**: the atoms a count
+  revised since the claim was written now makes false. **checked_by**: `typed` when the claim's investigation checks
+  typed atoms, `wording` when the word checks applied, `none` with `strict_claims: false`.
 - **written blind** (results): a work order with `blind: true` opens a window at its creation event and closes it at
   the first release (return or cancel) or withdrawal of any order in its rework chain. A result its assignee
   created inside the window, and has not revised since it closed, is written blind under that order, provided the
@@ -227,6 +248,9 @@ Implementations must derive these, never store them:
 - Only the instrument files a `kind=lab` run, and only the instrument records what that run `produced`.
 - Claims must pass the checks in §7, unless written by the operator or importer, or in an investigation with
   `strict_claims: false`.
+- A result's counts must be counts (`VALUE_NOT_A_NUMBER`, `VALUE_NOT_A_COUNT`), and a typed count must be complete
+  (`VALUE_TYPE_INVALID`: `population` a path, `property` an id, `op` one of the six, `figure` a number) — on creation
+  and on revision.
 - Nobody officially reviews their own node.
 - Writes into an `archived` or `published` investigation are refused (reserved authors excepted).
 - Only the importer may set a write's time. Everyone else's comes from the writer's clock.
@@ -264,6 +288,38 @@ smallest detectable difference uses 80% power at two-sided α = 0.05.
 | 10 | `EXCLUSION_WITHOUT_POWER` | `kind: exclusion`, or wording that says an effect is absent (no effect, no difference, makes no difference, does not affect, rules out, ineffective, …) in a finding, without a supporting result with `power: demonstrated` or one produced by a run of an experiment with a `power_check`. With two counts, the message gives the smallest detectable difference. |
 | 11 | `UNCORRECTED_EFFECT` | a finding asserts an effect (changes, lowers, differs, affects, significant, …) on an outcome, while a live result in the investigation holds that outcome's corrected p-value (a field named with holm / bonferroni / fdr / adjusted / corrected …) at or above 0.05, or a count of 0 outcomes surviving correction (`n_holm_sig`), and the effect word is neither qualified within 20 words as uncorrected (uncorrected, unadjusted, nominally, without correction, …) nor names the correction with a corrected value bound as a measurement. A family-wide value (`min_adjusted_p`) applies when the claim binds a nominal p < 0.05. Thresholds (`bonferroni_alpha_threshold`) are not evidence. Honest forms: bind the corrected p and say "not significant after correction", or file `kind: lead`. |
 
+**Typed claims.** An atom (§2) is decided by its bound count alone; no words are read. Let S_e = {x : x op_e f_e} (what
+was counted, k of n inside it, n − k outside) and S_a = {x : x op_a f_a} (what is asserted); P_e and P_a the
+populations. The property must equal the count's and the unit match it: spellings of one unit are one unit within one
+kind of unit (`lb` = `lbs`, `GBP` = `sterling`, never `lb` = `GBP`), a spelling that could be two kinds (`pound`:
+mass or currency) matches only another that could be the same two, and nothing is converted. A stated `n` must equal
+the count's. Figures are compared exactly, as given (an int or a float, at any magnitude), on the pieces of the line
+the two figures cut it into — never by arithmetic on them.
+
+- `none` S_a: **supported** when a side of the count with 0 inside it contains S_a and P_a lies within P_e;
+  **contradicted** when a side with more than 0 lies inside S_a and P_e lies within P_a.
+- `some` S_a: supported when a side with more than 0 lies inside S_a and P_e within P_a; contradicted when a side with
+  0 contains S_a and P_a lies within P_e.
+- `all` S_a is `none` of the complement of S_a.
+- `exactly` k needs the same population. A side of the count lying inside S_a puts at least its count in S_a; a side
+  containing S_a, at most its count. k at both bounds is **supported**, k outside them **contradicted**.
+
+Over one population these verdicts are complete as well as sound: supported or contradicted exactly when every set of
+values consistent with the count agrees.
+- Anything else is **unresolved**, and names the field that blocked it.
+
+| Code | Refused when |
+|---|---|
+| `ASSERTION_CONTRADICTED` | an atom is false by its count. The refusal log tracks it like a count contradiction (§8). |
+| `ASSERTION_UNRESOLVED` | an atom its count can't settle: another property or unit, a population neither within nor containing the count's, a condition the count's doesn't decide, an untyped count, a malformed atom. |
+| `ASSERTION_MISSING` | in a `typed_claims` investigation, the statement's parts that assert an absolute, an extreme or a count need more atoms than the claim has: one each, and two for an extreme stated as a value ("the longest is 26 km": none above, some at or above). Detection reads words only to ask for atoms; a missed word leaves prose unverified, never an atom verified. The refusal proposes atoms drafted from the statement and the claim's typed counts, which are checked like any other once written. |
+
+Atoms are checked in every investigation that has them. In a `typed_claims` investigation the word interpretation
+stands down: a measurement's name and key are not read for what was counted, and rule 5 (absolutes, with the
+counterexample, extreme and unreached-figure checks behind it) does not run. Every other rule runs as before. Outside
+one, rule 5 and those checks are heuristics, frozen as of 0.7.28: they read a claim's words for what a count measured,
+what the claim asserts and which clause a count belongs to, and the claimant writes those words.
+
 **Exposure.** A claim may set `exposure` (how many uses, users or units it will be applied to) and `exposure_unit`.
 Absolute refusals then state how many failures the bound leaves unruled out at that scale. An accepted claim's
 standing carries `bounds` (per count: k, n, rate, lo, hi and, with exposure, `unruled_out`), its sentence reads

{hypgraph-0.7.28 → hypgraph-0.8.1}/src/hypgraph/__init__.py

@@ -16,7 +16,7 @@ Standing is derived on every read, never stored; every write is an event in a SH
 their numbers; reviews pin versions; independence is counted, not assumed. See https://hypgraph.com.
 """
 
-__version__ = "0.7.28"
+__version__ = "0.8.1"
 
 from .bundle import anchored, verify_bundle  # noqa: E402
 from .graph import Author, Graph, GraphError, file_sha256  # noqa: E402