Methodology

Standing decisions

Four architectural decisions that constrain everything else.

These are recorded as accepted decisions in the repository, with their context and their consequences — including the costs they impose.

Start with a thin contract kernel

Foundation 0 is contracts, deterministic validators and small reference services with a single runtime dependency. Trainers, databases, queues and model SDKs stay outside as adapters. Choosing infrastructure before the domain boundaries are stable would couple the research claim to incidental platform choices. Consequence: the repository can validate topology and exchange semantics today, and cannot run an experiment.

Domain references are exact

Foundation, prerequisite, escalation, sender and recipient references all carry a stable domain ID and a semantic version. Floating names like medical:latest make replay and responsibility ambiguous. Consequence: upgrades become explicit registry operations, and a replay can address the original domain version.

Memory consolidation is not training

Experience is promoted through explicit states; consolidated means eligible for a future, separately authorised process. The memory service cannot call a trainer or mutate a domain artefact. Consequence: experience stays reviewable and reversible before any model changes, and write-back will need its own signed manifest, gates, new domain version and rollback path.

Raw data is immutable evidence

Every raw asset has a SHA-256 identity; paths are locations, not identities; any byte change creates a new artefact. Approval attaches to a digest and explicit permitted uses, and an evaluation asset cannot be permitted for training in the same experiment version. Consequence: storage grows because derivations never overwrite parents, and corrections require a new version rather than a silent edit.

Pre-registration

The hypothesis, the thresholds and the outcome table come first.

The proposed test is defined before a checkpoint, dataset, trainer or result is selected. Numeric thresholds are reviewable draft commitments; once frozen, any change requires a versioned amendment made before the affected results are inspected.

Pre-registration ID: experiment:genesis-biomed-split, protocol version 0.1.0.
Confirmatory comparison: Arm G (separated domains, structured protocol) versus arm D (merged model). Fixed in advance. Diagnostic ablations cannot be substituted for it.
Co-primary endpoints: All three must pass for a full-success conclusion: capability non-inferiority, update isolation, and provenance completeness. Missing any one prevents that conclusion.
Item selection: No evaluation item may be selected or removed after arm-level outputs have been inspected.
Freezing authority: Requires named research, model-factory, runtime and governance reviewers. Execution additionally requires approved dataset manifests, an authorised formation plan, and a run manifest with at least two approvers.

The specific hypotheses and their proposed numeric margins are set out on Experiment design.

Evidence standard

What has to be true before a claim counts as traceable.

Traceability is scored, not asserted. A claim qualifies only when every condition below holds — and natural-language fluency is not one of them.

Its evidence reference resolves to an immutable artefact.
The evidence actually supports the stated claim.
Assumptions and scope are present, not implied.
The evidence was valid at the stated time.
Known contradictions are not omitted.
The receiving domain does not silently broaden the claim.

The exchange protocol carries claim, evidence, scope, assumptions, confidence, uncertainty, contradictions and temporal validity as first-class fields, so a domain that wants to assert something beyond its evidence has to do it visibly. Where the domains disagree materially, both claims are recorded and review is requested; confidence alone does not resolve a conflict.

Contamination and data separation

Leakage invalidates a metric. It does not get explained.

Training, development, calibration and evaluation items require distinct immutable manifests, and their digests must be disjoint.
Exact, normalized and semantic duplicate checks run before approval; duplicate decisions retain cluster lineage rather than deleting it.
Evaluation items and close derivatives cannot appear in curriculum, retrieval or few-shot context.
Answer keys, teacher editions and alternate file conversions of the same material require explicit leakage handling.
Any discovered leakage is logged, the affected metric is invalidated, and the pre-registered replacement policy is applied without viewing arm comparisons.
Human graders are blinded to arm identity wherever feasible.

The same discipline applies upstream of training. The source snapshot was profiled from paths, sizes and hashes without opening a document; selection is not approval, classification is not extraction, and extraction is not permission to train. Each transition is a separate gate with named approvers, and raw bytes are never modified in place.

Statistical plan

Uncertainty is reported, not resolved by rounding.

Seeds: At least five frozen seeds unless an approved power analysis justifies another count. Every seed is reported alongside the aggregate; failed seeds are not discarded.
Intervals: Paired bootstrap confidence intervals over frozen evaluation items, with a seed-aware aggregate.
Multiplicity: Confirmatory secondary comparisons are corrected for multiplicity.
Effect sizes: Effect sizes and uncertainty are reported, not significance alone.
Missing outputs: Missing outputs, abstentions, router failures and protocol failures are pre-defined outcomes with their own accounting, never silently dropped rows.
Worst group: Worst-group results are reported alongside macro-averages. No aggregate may hide a blocking subgroup or a safety failure.

Outcome classification

What each possible result is allowed to be called.

Writing this table in advance is what stops a mixed result from being narrated as a win. The strongest conclusion permitted by the outcome table is the strongest conclusion that will be published.

Outcome	Required interpretation
Full success	All co-primary endpoints and every guardrail pass
Partial success	Capability non-inferiority passes and at least one systems benefit passes, but full-success criteria do not
Null	No reliable difference under the frozen design
Architectural failure	Capability margin, safety guardrail, or cross-domain composition fails
Invalid experiment	Leakage, budget mismatch, contract breach or unreproducible inputs invalidate inference

Partial success cannot be described as confirmation of the complete Cortex thesis.

Stop conditions

Conditions that halt a run rather than triggering a discussion.

Train/evaluation leakage is detected.
A data asset lacks its frozen digest or required approval.
Primary-arm compute budgets exceed the allowed mismatch.
A model, code or environment artefact differs from its run manifest.
Real patient data or unapproved personal information is discovered.
An external action, production route or memory write-back is enabled.
Audit evidence cannot be produced.
Loss becomes non-finite, or held-out quality or earlier-curriculum retention regresses past the declared tolerance.
Continuing would violate licence, privacy, safety or cost limits — or the named emergency-stop owner invokes the runbook.

A stopped run preserves its last valid checkpoint and publishes a terminal run-manifest revision recording the stop reason. Stopping is a documented outcome, not an incident to be tidied away.

Reporting

What the final report must contain, whatever it says.

All arms, seeds, items, failures, abstentions and stopped runs.
Confidence intervals and raw denominators.
Domain, router, protocol and whole-system results reported separately.
Budget reconciliation against the frozen run manifests.
Communication and active-compute costs, disclosed separately: total and active parameters, peak memory, accelerator-seconds, wall-clock, energy where available, router compute, inter-domain bytes, protocol tokens and end-to-end latency. No single resource measure is sufficient to claim efficiency.
Violations and amendments.
Negative and null results.

Why this is on a public page

A commitment that only exists internally can be revised quietly. Publishing the outcome table, the stop conditions and the reporting requirements before the run is the mechanism that makes them expensive to abandon — which is the entire point of adopting them.