arXiv CS open access

BeTaL-GBI: Admission-Aware Benchmark Tuning and Full-Stack Verification of Geometric Belief Interfaces

2026 · arxiv_cs

arXiv CS · Papers · 2026

software-architecture software-engineering testing

Conceptio Open Archive

Analyze & explore related research in Conceptio

Connect this record directly into your research workflow or AI agent. Explore citations across open repositories, query full text, and export structured proof bundles.

Explore in Search →Connect via MCP / API ↗

BeTaL-GBI: Admission-Aware Benchmark Tuning and Full-Stack Veriﬁcation of Geometric Belief Interfaces

arXiv:2608.21503v1 [cs.SE] 21 Aug 2026

A Companion Empirical Study of BoundaryBench v0.2, GBI v2, and GBI-DCSE v3 Alvin Spivey & Yu Huang Light Imaging Technologies, Inc. alvin@lightimagingtech.com August 20, 2026

Abstract A veriﬁcation substrate is more credible when it can expose errors in claims about itself, not only errors in model output. In extending GBI-DCSE into executable claim-level veriﬁcation, the v3 harness falsiﬁed a numerical implication in the original architecture manuscript: the previously reported Fisher-conditioning value ϵ ≈ 0.066 satisﬁes the declared κ2 ≤ 104 budget only on the slice [ϵ, 3, 4, 5], whereas the full declared box [ϵ, 20]4 requires ϵ ≈ 0.326472. The mismatch is preserved as an ERRATUM rather than silently retuned. This self-correction motivates the broader question of the paper: can an enterprise veriﬁcation architecture distinguish interface failure, task competence, policy admissibility, and control-plane integrity while making unsupported claims auditable? The frozen BoundaryBench v0.1 experiment supplied the starting failure mode. Qwen3-4BInstruct-2507 completed 768 held-out executions, but none crossed the structured contract: 369 failed safe parsing and 399 failed schema validation, so every execution was quarantined. That establishes fail-closed handling for one frozen model/conﬁguration, not general protection from hallucination; zero admission also makes downstream selectivity and task diﬃculty unidentiﬁable. This companion study evaluates three successive reﬁnements. First, BeTaL-GBI v0.2 adapts Benchmark Tuning with an LLM-in-the-loop (BeTaL) to a versioned enterprise admission boundary. It parameterizes nine benchmark dimensions over a ﬁnite design space of 2,218,750,380 grid points and separates format admission from conditional task performance: ρbadm = Nadmitted /N and ρbtask = Nveriﬁed /Nadmitted . Task diﬃculty is deliberately undeﬁned below a 0.05 admission ﬂoor. After a declared schema-compliant repair restores admission, a model-free feedback search reaches a mean held-out target gap of 2.87% across four target levels, versus 13.61% and 11.46% for two reimplemented non-feedback baselines. No language model is executed in this phase. Second, GBI v2 replaces answer-key agreement as the runtime admission predicate with a referenceindependent witness state W and executable policy P . On 512 synthetic tasks, the declared 16-gate policy at strictness 0.6, selected by a predeclared rule, detects all 116 injected severe contradictions and refuses none of 99 clean admissible records under the narrow predeclared denominator; a broader denominator yields 5/117 = 4.27%, and both are retained. A conﬁdent-hallucinator surrogate makes 221 attempted over-admissions with zero silent promotions, while an evidence-forger surrogate is refused on all 512 cases. Deterministic format repair raises admission from 0 to 46.48% without raising veriﬁed completion above zero, separating syntactic recovery from substantive correctness. Third, GBI-DCSE v3 maps 99 manuscript claims to machine-readable evidence classes and resolvers. Ninety-ﬁve of 96 testable registered claims meet their declared acceptance criteria, three claims remain explicitly out of scope, and the Fisher statement is retained as one erratum. The standalone veriﬁer executes 148 declared checks with zero implementation failures; a check can pass by correctly reproducing a value, detecting a fault, or conﬁrming an ERRATUM/OUT OF SCOPE classiﬁcation, so 148/148 passing checks is not a claim that all 99 registered assertions are true. The harness

BeTaL-GBI / GBI-DCSE Companion Evaluation

Spivey & Huang

also exercises signed-ledger behavior, attestation failure classes, a PBFT-style quorum model, sparse certiﬁcate forgery tests, atomic rollback, replayable receipts, and a second synthetic domain. The resulting claim is deliberately bounded. Under the declared synthetic populations, GBI-DCSE behaves as a selective, policy-versioned, self-auditing test and routing substrate. BoundaryBench v0.2, GBI v2, and DCSE v3 execute no new language model and do not establish clinical safety, production readiness, correctness of institutional policy, or robustness to arbitrary adaptive attackers. Those system boundaries are stated once near the beginning and treated as part of the evaluation contract.

Contents 1 From fail-closed containment to self-auditing veriﬁcation

1.1 A veriﬁer that falsiﬁed one of its own numerical claims . . . . . . . . . . . . . . . . . . . .

1.2

Operational stakes in the healthcare instantiation . . . . . . . . . . . . . . . . . . . . . . .

1.3

Questions left by the frozen v0.1 experiment . . . . . . . . . . . . . . . . . . . . . . . . . .

1.4

System boundaries and non-goals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

2 Objects, notation, and evaluation boundary

2.1

GBI/DCSE state . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

2.2

External validity and benchmark truth are diﬀerent

. . . . . . . . . . . . . . . . . . . . .

2.3

Scope labels used throughout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

3 BeTaL-GBI v0.2: benchmark tuning at an admission boundary 3.1

Relation to BeTaL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

3.2 The structural problem: zero admission destroys the diﬃculty signal . . . . . . . . . . . . 10 3.3

Parameter space . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

3.4 Target surrogates and role separation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 3.5

Degenerate-gap result . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

3.6

Search after format admission is restored . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

3.7

Reachability and monotonicity are properties of the space, not the optimizer . . . . . . . 13

3.8 A genuine mapping cone, still diagnostic-only . . . . . . . . . . . . . . . . . . . . . . . . . 14 4 GBI v2: from refusal to selective external-validity gating

4.1 Why v0.1 was insuﬃcient as a positive substrate result . . . . . . . . . . . . . . . . . . . . 14 4.2

Deterministic format repair: admission without invented correctness . . . . . . . . . . . . 15

4.3

Severe-contradiction injection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

4.4

Policy conformance and non-vacuity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

4.5 Adversaries that clear the format boundary . . . . . . . . . . . . . . . . . . . . . . . . . . 16 4.6

Clinical-style scorecard and denominator discipline . . . . . . . . . . . . . . . . . . . . . . 16

BeTaL-GBI / GBI-DCSE Companion Evaluation

Spivey & Huang

4.7

Strictness and the visible operating boundary . . . . . . . . . . . . . . . . . . . . . . . . . 17

4.8

Surgical quarantine is a dependency-scope statement . . . . . . . . . . . . . . . . . . . . . 17

5 Mathematical validation and the discovered Fisher-bound erratum

5.1 Appendix-style validation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 5.2 The one-dimensional bound was not a box-wide guarantee . . . . . . . . . . . . . . . . . . 18 6 GBI-DCSE v3: evaluating the full testable architecture 6.1

Claim-register methodology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

6.2 Appendix A and previously untested GBI claims . . . . . . . . . . . . . . . . . . . . . . . 20 7 The DCSE systems layer 7.1

Identity/provenance ledger with cryptographic signatures . . . . . . . . . . . . . . . . . . 21

7.2 Attestation veriﬁcation and fail-closed behavior . . . . . . . . . . . . . . . . . . . . . . . . 21 7.3

Consensus model and fault boundary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

7.4

Sparse enclave certiﬁcate: why spectral moments are load-bearing . . . . . . . . . . . . . . 22

7.5 Atomic rollback and liveness can coexist . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 7.6

Receipts, replay, and review surfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

7.7

Consistency certiﬁcate and the zero-knowledge boundary . . . . . . . . . . . . . . . . . . . 23

8 Cross-domain portability: measured code reuse, not semantic equivalence

8.1 What changes and what remains invariant . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 8.2

Synthetic infrastructure population . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

9 What changed from v0.1 to v3

10 Threat model and residual exclusions

11 Relation to benchmark and runtime-veriﬁcation literature

11.1 Dynamic benchmark design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 11.2 Agent benchmarks and policy-following

. . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

11.3 Formal monitoring and intervention . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 11.4 Healthcare interoperability evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 12 Implications for frontier-evaluation and enterprise-AI programs

12.1 Failure surfaces should be factored by layer . . . . . . . . . . . . . . . . . . . . . . . . . . 26 12.2 A benchmark can become an enterprise diagnostic loop . . . . . . . . . . . . . . . . . . . . 27 12.3 Claim registers are useful for research-to-production translation . . . . . . . . . . . . . . . 27

BeTaL-GBI / GBI-DCSE Companion Evaluation

Spivey & Huang

13 Discussion

13.1 Self-falsiﬁcation is an acceptance test, not a blemish . . . . . . . . . . . . . . . . . . . . . 27 13.2 What is genuinely stronger than the ﬁrst experiment . . . . . . . . . . . . . . . . . . . . . 27 13.3 Why the synthetic adversaries matter, and why they are not enough . . . . . . . . . . . . 28 13.4 The next decisive experiments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 14 Conclusion

A Full BeTaL-GBI parameter grid cardinality

B GBI v2 gate interpretation

C V3 out-of-scope claims

BeTaL-GBI / GBI-DCSE Companion Evaluation

Spivey & Huang

1 From fail-closed containment to self-auditing veriﬁcation The architecture manuscript introduced the Geometric Belief Interface (GBI) and Decentralized Cryptographic Sheaf-Enclave (DCSE) as a boundary between untrusted discovery and governed enterprise action [1]. Its central design rule is that a model output is evidence, not authority. A model, parser, or agent may propose a typed local state; deterministic checks over identity, provenance, terminology or schema version, temporal validity, dependencies, evidence, and policy determine what may proceed. The central methodological lesson of the companion study is stricter: the same discipline must apply to claims made by the veriﬁcation system and its authors. A system that catches malformed model output but silently preserves a falsiﬁed numerical assumption has not completed the veriﬁcation loop.

1.1 A veriﬁer that falsiﬁed one of its own numerical claims The strongest illustration emerged from the Fisher-conditioning check. The architecture paper reported ϵ ≈ 0.066 near the condition-number budget κ2 ≤ 104 . V3 reproduced that value for the stated onedimensional slice α = (ϵ, 3, 4, 5), but then evaluated the stronger box-wide criterion that the manuscript itself prescribed. On [ϵ, 20]4 , the slice value permits a worst-corner condition number of approximately 4.79 × 105 , about 48 times the declared budget. Solving the declared box-wide criterion yields ϵbox ≈ 0.326472. Rather than modifying the acceptance criterion after seeing the result, the claim register marks the original implication as ERRATUM, preserves the reproduced slice value, and records the corrected box-wide bound. Section 5.2 gives the full calculation. Self-correction criterion. A veriﬁcation substrate should make its own failed assertions visible and attributable. In this study, the erratum is therefore a positive result about the claim-to-evidence process, even though the underlying numerical assertion is a failed claim.

1.2 Operational stakes in the healthcare instantiation The mathematical boundary becomes easier to interpret when tied to the type of governed state change it is meant to precede. Table 1 gives two synthetic policy-routing examples. They are not treatment recommendations and the policies are illustrative; their purpose is to show what it means for W and P to control an EHR write rather than allowing a model score to act as authority.

BeTaL-GBI / GBI-DCSE Companion Evaluation

Spivey & Huang

Table 1: Two synthetic healthcare boundary cases used to ground the abstract veriﬁcation objects. Clinical facts cited here motivate the evidence ﬁelds; the GBI policy examples remain institution-speciﬁc and non-clinical. Synthetic proposal

Authoritative context

Example policy action

What GBI does not decide

Amoxicillin medication request with a record of serious penicillin/betalactam hypersensitivity

FHIR AllergyIntolerance is designed to represent patientspeciﬁc risk from substance exposure and can inform clinical decision support; current U.S. AMOXIL labeling lists a history of serious hypersensitivity to amoxicillin or other beta-lactams as a contraindication [12, 13].

A version-pinned local policy could refuse autonomous commit and require named clinical review or an authorized override with provenance.

It does not diagnose an allergy, select an alternative antibiotic, or determine patientspeciﬁc treatment.

Metformin medication request with required renalfunction evidence absent or stale

Current DailyMed labeling directs renal-function assessment before initiation and periodically thereafter, with explicit eGFR-related restrictions [14].

If the institution’s declared P requires qualifying renal context, missing evidence can route the proposed write to abstention, quarantine, or expert review until the required evidence is present.

It does not set an individualized dose, diagnose renal impairment, or independently decide whether metformin is clinically appropriate.

These cases clarify the role of the geometry and cryptography later in the paper. The discovery system may emit a proposal; the veriﬁcation substrate determines whether the proposal has the identity binding, evidence, version, provenance, dependency state, and authority required by the institution’s policy before an atomic transaction is constructed. Geometry can diagnose inconsistency and cryptography can bind/replay the decision, but neither substitutes for clinical judgment.

1.3 Questions left by the frozen v0.1 experiment BoundaryBench v0.1 translated the architecture into a frozen empirical interface. The held-out model host saw answer-key-free inputs, while a trusted veriﬁer scored frozen outputs after execution. All 768 Qwen3-4B-Instruct-2507 executions completed, but zero model results satisﬁed the admissibility contract: 369 were safe parse rejects and 399 were safe schema rejects. The result shows that the observed malformed/schema-invalid proposals did not silently become downstream actions. It does not establish containment of arbitrary hallucinations, and zero coverage does not establish low selective risk. The zero-coverage result creates three scientiﬁc questions that v0.1 cannot answer: 1. Can benchmark diﬃculty be tuned if the model never reaches the task-semantic layer? A target-performance optimizer has no useful signal if every output dies at formatting. 2. Can the GBI gate be selective rather than merely fail closed? A system that refuses everything catches every bad item vacuously but has no operational utility. 3. Do the broader DCSE claims survive executable scrutiny? The original paper contains claims about ledger non-equivocation, attestation, BFT fallback, sparse enclave checks, transaction atomicity, receipts, and portability that v0.1 did not test.

BeTaL-GBI / GBI-DCSE Companion Evaluation

Spivey & Huang

1.4 System boundaries and non-goals Table 2 deﬁnes the evidentiary perimeter once. Later sections retain only local qualiﬁers that are necessary to interpret a particular result. Table 2: System boundaries for the companion evaluation. Boundary

Evaluated here

Not claimed

Model behavior

Frozen v0.1 Qwen outputs are a historical empirical baseline; v0.2–v3 evaluate benchmark and veriﬁcation machinery. Synthetic witness/policy states route proposed EHR actions and expose the reason for refusal/review.

General hallucination containment, frontier-model capability, or new LLM performance in v0.2–v3. Diagnosis, treatment recommendation, autonomous prescribing, clinical safety, medical-device validation, or replacement of clinician judgment. That an institution’s policy is clinically, legally, or ethically correct; a veriﬁer can faithfully execute a bad policy. Live TEE attestation, a running BFT cluster, production FHIR integration, hardware-root security, or a zeroknowledge proof system. Clinical truth from geometry; mappingcone diagnostics have zero scoring weight.

Clinical authority

Policy authority

Infrastructure

Mathematical diagnostics Portability

Adversarial scope

Deterministic execution, version binding, ablations, replay, and reference independence of the declared P . Software models/proxies exercise signatures, attestation checks, quorum arithmetic, certiﬁcates, rollback, receipts, and FHIR-like transaction semantics. Finite Boolean, Fisher, mapping-cone, and certiﬁcate properties under declared numerical tests. Code-level reuse is measured in a second synthetic sensitive-infrastructure instantiation. Declared malformed, over-admitting, evidence-forging, policy-ablation, ledger, attestation, quorum, certiﬁcate, and transaction faults.

Readiness for real healthcare, ﬁnance, government, or classiﬁed infrastructure without domain-speciﬁc authority and validation. Completeness against adaptive attackers, side channels, compromised hardware roots, malicious authorities, or unmodeled policy/source-system failures.

BeTaL-GBI / GBI-DCSE Companion Evaluation

Spivey & Huang

This companion evaluation addresses those questions in three layers. Figure 3 summarizes the progression. Evaluation ladder BoundaryBench v0.1

Frozen model execution asks whether outputs cross a structured admission contract. Result: 0/768 admitted, exposing a format/schema ﬂoor.

BeTaL-GBI v0.2

Parameterizes benchmark diﬃculty, separates admission from task performance, detects degenerate objectives, and measures search/reachability using declared surrogates.

GBI v2

Replaces answer-key agreement as the runtime gate with witnessgrounded external validity and an executable versioned policy; evaluates selectivity, adversaries, liveness, and mathematical checks.

GBI-DCSE v3

Builds a claim register over the broader testable architecture and tests ledger, attestation, consensus, sparse enclave certiﬁcation, atomic rollback, receipts/replay, and cross-domain portability.

Table 3: The experiments increase the scope of what is evaluated. They do not monotonically increase realism: v0.2–v3 are synthetic and execute no language model. Primary empirical claim of this companion paper. Under the declared synthetic populations and executable policy, the later GBI/DCSE evaluations are non-vacuous: they permit eligible work, refuse declared severe contradictions, expose policy ablations, replay decisions from receipts, and classify unsupported or falsiﬁed claims explicitly. This is stronger evidence about the veriﬁcation substrate than v0.1, but it is not new evidence about frontier-model capability because no language model is executed in v0.2–v3.

2 Objects, notation, and evaluation boundary 2.1 GBI/DCSE state The enterprise state is represented as (B, V, Θ, F, W, L, P ), where B is the ﬁnite boundary algebra, V the versioned semantic bundle, Θ the calibrated evidence registry, F the candidate/local state, W the authoritative grounding state, L the identity/provenance/nonequivocation ledger, and P the runtime admissibility policy [1]. GBI v2 makes the last two deployment objects particularly explicit: runtime admission depends on authoritative evidence and declared policy, not on the hidden answer key used to score a benchmark after the fact. A useful operational decomposition is P = (A, G, T, D, H, Q, R, Λ, E, Fb ), with allowed actions A, hard gates G, thresholds and validity windows T , dependencies D, human authority H, quarantine semantics Q, recovery/escalation R, liveness/degraded operation Λ, signed 8

BeTaL-GBI / GBI-DCSE Companion Evaluation

Spivey & Huang

exceptions E, and failover Fb . A policy instance is pinned by identiﬁers such as policy id, version, eﬀective time, authority, and hash. Table 1 illustrates this object language operationally. In the allergy example, the candidate F is a proposed medication request, W includes the signed/versioned allergy and source evidence, V pins the terminology/schema bundle, and P speciﬁes whether missing or conﬂicting evidence requires review rather than commit. In the renal-context example, P can require a current evidence predicate before the candidate crosses the write boundary. The clinical authority remains outside the mathematical object: P encodes a policy supplied by an authorized institution; GBI tests and executes that policy rather than inventing it.

2.2 External validity and benchmark truth are diﬀerent The deployment-facing predicate is modeled as EV : B × W → {0, 1}, with the policy mapping veriﬁed state to actions such as admit, historical-only admit, quarantine, abstain, expert review, or reject. This object must be independent of benchmark answer keys if it is to represent a plausible runtime gate. The benchmark still needs a reference for measurement. The two truths therefore have diﬀerent roles: • Runtime truth surrogate: witness bundle W plus versioned policy P , used by the gate. • Evaluation reference: synthetic generator/reference state, used after the gate to quantify agreement or identify stale references after deliberate injection. GBI v2 includes an abstract-syntax-tree probe that ﬁnds no forbidden reference access in the gate modules, and a shuﬄe test that randomly permutes all 512 reference actions while leaving all 512 gate verdicts unchanged. These tests do not prove real-world truth; they show that the executable admission decision is not secretly using the answer key.

2.3 Scope labels used throughout We use the following evidence labels: • REPRODUCED: a published numerical statement is independently recomputed. • MEASURED: an executable deterministic or simulated system property is measured directly in the supplied implementation. • MEASURED SYNTH.: the measured property depends on a declared synthetic population or injected taxonomy. • STRUCTURAL: a code/schema/protocol property is checked structurally rather than by live deployment. • PARTIAL PROXY: a lower-scope stand-in is measured, with the missing deployment mechanism explicit. • OUT OF SCOPE: the required environment or evidence is absent and no proxy is promoted to the target claim.

BeTaL-GBI / GBI-DCSE Companion Evaluation

Spivey & Huang

• ERRATUM: an executable assertion contradicts a numerical statement in the architecture manuscript. These labels become ﬁrst-class in the v3 claim register.

3 BeTaL-GBI v0.2: benchmark tuning at an admission boundary 3.1 Relation to BeTaL BeTaL (Benchmark Tuning with an LLM-in-the-loop) parameterizes benchmark design choices and uses an LLM designer to search for benchmark instances with target properties, including diﬃculty [2]. The GBI adaptation retains the core environment-design idea but adds an admission-aware objective. This is necessary because an enterprise benchmark may fail before semantic task performance is measurable. The v0.2 artifact deliberately does not execute the BeTaL LLM designer. It provides the designer seam, evaluates a deterministic feedback-coordinate controller, and compares it with two non-feedback search baselines. Consequently, the correct interpretation is “the parameterized GBI environment produces a usable tuning signal once admission is non-degenerate.”

3.2 The structural problem: zero admission destroys the diﬃculty signal A naive diﬃculty objective would tune conﬁguration v ∈ V toward target performance ρ by minimizing g(v) = |ρb(v) − ρ|. That is ill posed when every output is rejected by a format gate. BeTaL-GBI therefore factors the rate: ρbadm (v) =

Nadmitted (v) , N

ρbtask (v) =

Nveriﬁed (v) . Nadmitted (v)

The search objective is g(v) = |ρbtask (v) − ρ|, only when ρbadm ≥ ρadm min . The v0.2 contract uses an admission ﬂoor of 0.05. Below that ﬂoor the run terminates with degenerate_gap_admissibility_floor, selects no conﬁguration, and reports ρbtask as undeﬁned rather than fabricating zero. This distinction is central. A value of zero means measured task failure among admitted outputs. “Undeﬁned” means the task layer was never reached.

3.3 Parameter space The v0.2 environment deﬁnes nine dials, eight tied directly to BoundaryBench task families and one global action-space distractor. The Cartesian grid contains exactly 2,218,750,380 points.

BeTaL-GBI / GBI-DCSE Companion Evaluation

Spivey & Huang

Table 4: BeTaL-GBI v0.2 parameter space. Parameter

Min

Max

Step/count

patient identity normalization orphan rate ﬁeld anomaly bleed

0 0 0

1 0.5 0.5

0.05 0.05 0.05

code-system version validation mapping arity

0 1

1 6

0.05 6 values

temporal ambiguity evidence suﬃciency policy conﬂict depth

0 0 0

1 10 4

0.05 integer integer

distractor actions

integer

Operational interpretation identity ambiguity/noise orphan/duplicate burden structured/free-text contamination terminology/version diﬃculty RPMS-to-FHIR mapping branching active/historical ambiguity evidence availability burden depth of interacting policy constraints global action-space distractors

The FHIR-facing task-family language follows the published FHIR R4 RESTful resource and transaction model [11]. The ﬁnite size is large enough that exhaustive search is unnecessary and expensive, while still giving the environment an inspectable, versioned design space. The implemented search explores a small path and local coordinate neighborhood; it does not pretend to cover all 2.2 billion points. BeTaLGBI: parameter search with an admissibility gate BeTaL Algorithm 1 over the GBI BoundaryBench admission boundary. The gate is the addition.

12 Designer

3 Domain projection

4 Simulator

Reads V, rho, and the iteration summary.

Clamp, snap to the declared grid, coerce type.

Instantiates 256 synthetic legacy-EHR tasks

Returns a JSON configuration proposal.

Unknown keys dropped and recorded.

across eight families, references derived

LLM seam present; NOT_RUN in v0.2.

Every projection note is kept in the run record.

from an explicit corruption manifest.

v0.1 Programmatic Verification Engine

5 Target surrogate

Unmodified. Safe parse, schema, exact, graph,

Emits raw text per task.

temporal, version, evidence, quarantine.

Boundary-floor or repaired-emitter surrogate.

The BeTaL layer never re-implements a criterion.

No language model is executed.

next iteration

ADMISSIBILITY GATE rho_hat_adm = admitted / task_count rho_hat_adm >= 0.05 → the observed rate is a difficulty signal; continue the search. rho_hat_adm < 0.05 → the gap is UNDEFINED, not large. Stop, probe the dial, report the floor.

gate open

gate shut

68 Gap, feedback, selection

Degenerate outcome (frozen v0.1 shape)

g_i = |rho_hat_task - rho| with rho_hat_task = verified / admitted.

rho_hat_adm = 0.0 at every probed dial value, all three evidence modes.

Append (v_i, rho_hat_i) to the summary for the next prompt.

369 safe_parse_reject / 399 safe_schema_reject across 768 executions.

Keep the configuration with the smallest gap, then evaluate it

No point in V raises the rate, so no parameter search is well posed.

on a held-out instantiation under a different split seed.

Correct action: repair the output-format boundary first.

Figure 1: BeTaL-GBI loop supplied with the v0.2 artifact. The important GBI-speciﬁc modiﬁcation is the admission gate before task-level diﬃculty is interpreted.

BeTaL-GBI / GBI-DCSE Companion Evaluation

Spivey & Huang

3.4 Target surrogates and role separation The v0.2 artifact uses three transparent target types: 1. v01_boundary_floor_surrogate, reproducing the shape of the frozen parse/schema ﬂoor. It is not Qwen and makes no language-model claim. 2. repaired_emitter_cNNN, a schema-valid declared response function with tunable competence. 3. reference_oracle, derived from the synthetic reference manifest and used as an oracle control. The designer, target, and veriﬁer are kept separate. This prevents a designer proposal from silently becoming ground truth and prevents target competence from being confused with benchmark diﬃculty.

3.5 Degenerate-gap result Five conﬁgurations spanning the parameter space were probed under all three v0.1 evidence modes. Every probe produced ρbadm = 0. The three search attempts each halted after one of ten budgeted iterations, selected no conﬁguration, and reported ρbtask as undeﬁned. The per-mode synthetic boundary-ﬂoor split exactly matches the frozen v0.1 emission split: 123 parse rejects and 133 schema rejects per mode, or 369 and 399 across 768 executions. The result is not that the benchmark is “too hard.” It is that diﬃculty is not observable until the interface failure is repaired.

3.6 Search after format admission is restored Four target task-performance levels are used: ρ ∈ {0.25, 0.50, 0.75, 0.90}, labeled hard, medium, easy, and trivial. Each run uses 256 tasks and ten search iterations. The selected conﬁguration is then re-instantiated under a diﬀerent split seed for held-out measurement. Table 5: Mean gap across the four target levels. “Feedback” is the model-free feedback-coordinate implementation; the other two strategies are reimplemented baseline search strategies. Strategy Feedback coordinate Random sampling + PPR Best-of-N

Mean search gap

Mean held-out gap

Held-out SD across levels

5.23% 20.90% 23.72%

2.87% 13.61% 11.46%

2.30 pp 8.68 pp 17.19 pp

BeTaL-GBI / GBI-DCSE Companion Evaluation

Spivey & Huang

Table 6: Held-out target gaps by diﬃculty level. Best-of-N wins two individual cells; feedback has the best mean and is substantially better at the high-performance edge. Level

Target ρ

Feedback

Random+PPR

Best-of-N

0.25 0.50 0.75 0.90

0.78% 1.17% 3.91% 5.63%

6.25% 6.64% 17.58% 23.98%

0.39% 0.00% 8.98% 36.48%

Hard Medium Easy Trivial

Held-out gap by target level and search strategy |rho_hat_task - rho| on a held-out instantiation of each strategy's selected configuration Declared target surrogate tier_mid (c=0.55) - 256 tasks per instantiation - 10 iterations per run - no language model executed

Feedback BeTaL-style)

RSPPR baseline

Best-of-N baseline

40%

36.5

30% 24.0 20%

17.6

10%

0.8

5.6

3.9 0.4

9.0

6.6

6.2 1.2

0.0

hard

medium

easy

trivial

rho = 0.25

rho = 0.50

rho = 0.75

rho = 0.90

Mean gap across the four levels Feedback BeTaL-style)

RSPPR baseline

Best-of-N baseline

search 5.23% held-out 2.87%

search 20.90% held-out 13.61%

search 23.72% held-out 11.46%

Lower is better. Values are exact and reproducible from per_level_metrics.csv; no confidence intervals were run.

Figure 2: Held-out gap comparison from the supplied v0.2 artifacts. These are simulator/harness results; no LLM designer or target was executed. The result is qualitatively consistent with the motivation for feedback-driven benchmark design: random search can land near central targets by chance, while feedback becomes more useful near compressed edges of the reachable range. The artifact also exposes a limitation of the deterministic reference designer: in at least one hard-level run, several late iterations repeat the same proposal and therefore waste search budget.

3.7 Reachability and monotonicity are properties of the space, not the optimizer A target can only be achieved if the parameterized environment can express it for the selected target system. The monotone-dial probe reports the following empirical ranges:

BeTaL-GBI / GBI-DCSE Companion Evaluation

Spivey & Huang

Table 7: Observed task-performance ranges on the declared monotone dial. A positive ﬂoor is a property of the reachable space, not necessarily an optimizer failure. Target tier Low (c=0.35) Mid (c=0.55) High (c=0.75)

Range

0.25

0.50

0.75

0.90

0.016–0.727 0.121–0.898 0.238–0.941

reachable reachable reachable

ﬂoor 2.34% reachable reachable

ﬂoor 17.34% ﬂoor 0.16% reachable

Across 24 consecutive dial steps, two local monotonicity violations occur. At N = 256, the artifact attributes them to ﬁnite-sample variation rather than silently forcing a monotone ﬁt. The important governance behavior is that monotonicity is tested rather than assumed.

3.8 A genuine mapping cone, still diagnostic-only The original architecture manuscript carefully labels its appendix calculation as a projector-based obstruction surrogate. BeTaL-GBI v0.2 adds a ﬁnite sheaf morphism ϕ : F → G, constructs the corresponding mapping-cone diﬀerential using standard cellular-sheaf and homological-algebra constructions [8, 9], and checks the chain condition d0 d−1 = 0. A rank-deﬁcient restriction diag(1, 0) is required; identity restrictions collapse the intended degrees of freedom. Across all eight binary agreement patterns, the implementation obtains dim H 0 (Cone ϕ) = #{disagreeing axes}, with trace energy equal to one on disagreeing axes and zero on agreeing axes. This is a stronger numerical implementation than the original projector surrogate, but its scoring weight remains zero and the diagnostic is explicitly not clinically validated. The evaluation therefore demonstrates algebraic behavior, not clinical correctness.

4 GBI v2: from refusal to selective external-validity gating 4.1 Why v0.1 was insuﬃcient as a positive substrate result At zero coverage, “severe contradiction sensitivity = 100%” is vacuous because every item is refused. Likewise, no selective-risk estimate exists. GBI v2 is designed to test whether the gate can simultaneously do two things: 1. refuse declared severe contradictions, including adversarial proposals that are syntactically valid; and 2. allow clean, policy-compatible work to proceed rather than treating refusal itself as success. The v2 evaluation uses 512 synthetic tasks over the same eight task families. Its runtime gate is grounded in W and P , while the hidden reference remains an after-the-fact measurement instrument.

BeTaL-GBI / GBI-DCSE Companion Evaluation

Spivey & Huang

4.2 Deterministic format repair: admission without invented correctness A deterministic repair stage performs only declared syntactic transformations: code-fence stripping, balanced-object extraction, bare-key quoting, duplicate-key collapse with ﬁrst value retained, schemaversion insertion, a small action-synonym table, and extra-key dropping. It deliberately refuses to fabricate content for truncated payloads or non-object answers. Table 8: Eﬀect of deterministic repair on the frozen v0.1-style format-ﬂoor target. Quantity

Frozen ﬂoor

After repair

0.0000 0.0000 undeﬁned 0.0000

0.4648 0.4473 1.0 (deﬁned) 0.0000

Admissibility rate Coverage Selective risk Veriﬁed completion

This is an important negative control. Repair makes malformed output measurable; it does not make wrong output correct. Sixty truncated payloads and seventy non-object answers remain unrepaired because recovering them would require inventing semantic content.

4.3 Severe-contradiction injection The v2 population contains 116 injected severe contradictions across ten classes, disjoint from 99 records intentionally left clean for the narrow false-conﬂict denominator. Four classes are absent from the base simulator and therefore test additional gates. Table 9: Injected severe contradiction classes. Class

Count

Identity ambiguous Provenance absent Structured ﬁeld fully contaminated Terminology unsigned Validity expired

12 11 11 12 12

Class

Count

Identity unresolvable Required evidence absent Terminology unpinned Terminology unresolvable Validity invalid

12 11 12 11 12

Total

116

4.4 Policy conformance and non-vacuity The declared v2 policy contains 16 gates. Direct probes exercise each gate, and a clean witness is admitted as a non-vacuity control. Two intentionally defective policies are also evaluated: • an incomplete ablation omits two gates and incorrectly admits an unsigned-terminology probe; • a score-only identity ablation omits ambiguity and unresolvable-identity gates and fails the corresponding probes. This is a load-bearing test: if the ablated policies produced the same result as the unablated declared policy, the positive score would say little about whether the omitted gates are load-bearing. 15

BeTaL-GBI / GBI-DCSE Companion Evaluation

Spivey & Huang

4.5 Adversaries that clear the format boundary Two declared synthetic adversaries directly test the manuscript’s containment claim. Table 10: GBI v2 adversaries. These are deterministic surrogates, not language models. Adversary

Attack

Conﬁdent hallucinator

Emits format-valid content, conﬁdence 0.97, correct evidence references, and always requests admission. It makes 221 attempted over-admissions. Proposes the witness-consistent action but cites one nonexistent evidence reference and an unwitnessed source record.

Evidence forger

Admitted

Silent promotions

0/512

The pair attacks independent dimensions. A gate that checked only action plausibility could miss the forger; a gate that checked only citations could miss an over-admitting proposal. Zero silent promotions is measured against both witness severity and the synthetic reference action. The result is evidence for the implemented gate under these declared attack classes, though not proof against arbitrary hallucinations or adaptive attackers.

4.6 Clinical-style scorecard and denominator discipline Under a predeclared selection rule – the largest strictness value satisfying both measurable Table 3 clinical-style targets – the declared policy selects strictness 0.6. Table 11: GBI v2 scorecard against the architecture manuscript’s proposed Table 3 targets. Group

Measure

Result

Evidence class

Mathematical

Spectral gap λ1 − λ0 ≥ 0.15 on genuine cone Laplacians

1.0000 (within ﬂoating point)

MEASURED

Mathematical

Fisher condition number ≤ 104 over corrected evidence box

9998.3472

MEASURED

Systems

End-to-end enclave latency ≤ 150 ms

0.0968 ms CPU-only software path

PARTIAL PROXY

Systems

Attestation bootstrapping ≤ 2.5 s

not measured

OUT OF SCOPE

Clinical-style

Severe contradiction sensitivity = 100%

116/116

MEASURED SYNTH.

Clinical-style

False conﬂict adjudication ≤ 4%

0/99 = 0.0% narrow

MEASURED SYNTH.

Five of ﬁve measurable targets are met; one requires a real TEE/attestation service and is left out of scope. The latency number is not an enclave measurement. It is a lower-scope CPU-only timing of deterministic checks and therefore cannot be used as evidence that a hardware enclave deployment meets 150 ms. The false-conﬂict result has a denominator sensitivity that must not be hidden. The narrow, predeclared denominator contains the 99 records deliberately left clean by injection and produces 0.0%. A pessimistic 16

BeTaL-GBI / GBI-DCSE Companion Evaluation

Spivey & Huang

broader denominator 5/117 = 4.27%,sensitivity slightly missing the 4% proposed target. Both ﬁgures remain Table 3yields clinical frontier: against false conflict part of the result. Figure shows the strictness frontier policy ablations. Both targets must 3 hold at once. Refusing everything satisfies and the first and maximally violates the second. 512 synthetic tasks - 116 injected severe contradictions - 99 conflict-free records - no language model executed

Complete policy

Ablation: 2 gates omitted

Ablation: score-based identity

v0.1 frozen baseline

Table 3 target region: sensitivity 100% and false conflict <= 4% v0.1 frozen: 768/768 refused sensitivity 100% (vacuous), false conflict 100%

Severe Contradiction Sensitivity

100% v2 selected operating point strictness 0.6: sensitivity 100%, false conflict 0.0%

95%

90%

85%

80% 0%

20%

40%

60%

80%

100%

False Conflict Adjudication Rate (lower is better)

Scorecard against main.pdf Appendix B Figure 3: Sensitivity/false-conﬂict frontier from the v2 artifact. The frozen v0.1 point has 100% sensiTable 3 5/5 measurable targets met, 1 out of scope (needs a TEE. Additional manuscript claims: 8/8 met. Appendix B.1 Assertions 13: all passed. tivity only because every record is refused; its false-conﬂict rate is therefore 100%. Ablation curves are deliberately deficient policies. That they fail is what makes the complete policy's result informative.

4.7 Strictness and the visible operating boundary The declared policy satisﬁes the two narrow clinical-style targets from strictness 0.0 through 0.6. At strictness 0.7, the clean-record false-conﬂict rate rises to 18.18%, so the selection rule has an observable boundary rather than choosing an arbitrary round number. The policy ablations fail in diagnostically diﬀerent ways. This is the desired behavior for a benchmarked enterprise policy: strictness should expose a tradeoﬀ, and an operating point should be derived from a declared rule rather than selected after viewing the result.

4.8 Surgical quarantine is a dependency-scope statement The v2 liveness experiment asks how much independently admissible work survives when one record is refused. Table 12: Liveness under four quarantine-closure semantics. Quarantine scope Record-scoped refusals only Declared scope incl. mandated shared freezes Naive closure over every shared reference Coarse family-level closure

Admissible work surviving

Liveness

112/112 84/112 84/112 0/112

1.000 0.750 0.750 0.000

BeTaL-GBI / GBI-DCSE Companion Evaluation

Spivey & Huang

Twenty-four mandated administrative freezes close over nine shared scopes because Boundary 2 requires an unsigned or unpinned shared terminology bundle to halt dependent use. By contrast, a bad record that merely cites a valid shared bundle does not taint the bundle itself. “Surgical” therefore means dependencyaware pre-commit isolation, never partial success inside an operation whose underlying transaction is atomic.

5 Mathematical validation and the discovered Fisher-bound erratum 5.1 Appendix-style validation GBI v2 expands the architecture manuscript’s proposed Appendix B.1 checks: 1. A ﬁnite Boolean algebra with 64 elements over six atoms is stress-tested over 65,536 randomized operations, checking eleven laws per operation with zero violations. 2. The Dirichlet Fisher metric is evaluated at all 16 corners of the declared four-dimensional evidence box plus 512 adversarial near-boundary probes. 3. The genuine mapping-cone implementation evaluates all eight agreement patterns, veriﬁes the chain condition, symmetry and positive semideﬁniteness to numerical tolerance, and checks basis-rotation invariance of trace energies. For the cone suite, the worst symmetry residual is 0, the numerical minimum eigenvalue is approximately −5.39 × 10−32 , and the worst energy rotation drift is approximately 1.11 × 10−15 , all consistent with ﬂoating-point error.

5.2 The one-dimensional bound was not a box-wide guarantee The architecture manuscript observed that, along the slice α = (ϵ, 3, 4, 5), the condition-number budget κ2 (g) ≤ 104 is crossed near ϵ ≈ 0.066. The v3 independent recomputation solves this slice as ϵslice = 0.066021703. That number is correct for the slice. However, Appendix B.1 asks for a corner sweep of a declared evidence box. For [ϵ, 20]4 , the worst corner is not the slice above. At ϵ = 0.066021703, the worst-corner condition number is approximately 4.79 × 105 , about 48 times the declared budget. The box-wide lower bound that satisﬁes the budget at ceiling A = 20 is ϵbox ≈ 0.326472 . The required ϵ depends strongly on the ceiling:

BeTaL-GBI / GBI-DCSE Companion Evaluation

Spivey & Huang

Table 13: Evidence-box lower bound required for the κ2 ≤ 104 budget. Ceiling A

Box-wide ϵ

One-dimensional slice value

5 10 20 50

0.093001 0.161794 0.326472 0.918946

0.066022 0.066022 0.066022 0.066022

This is an erratum to a stated numerical implication, not a refutation of the continuity argument that a compact evidence box has ﬁnite conditioning bounds. The corrected v2/v3 scorecard uses the box-wide value. Why the erratum matters scientiﬁcally. A veriﬁcation framework earns credibility not only by passing tests but by making its own failed assertions expensive to hide. The v3 claim register classiﬁes this item as ERRATUM, preserves the original statement, records the corrected bound, and excludes it from the “met” count.

6 GBI-DCSE v3: evaluating the full testable architecture 6.1 Claim-register methodology The v3 evaluation enumerates 99 claims from the architecture manuscript and binds each to section, evidence class, resolver, expected behavior, and artifact evidence. The register covers manuscript Sections 1–12 and Appendices A–B. The aggregate result is: Table 14: GBI-DCSE v3 claim coverage. Quantity

Count

Total registered claims Testable claims Testable claims met Testable claims unmet Explicitly out of scope Declared veriﬁcation checks Veriﬁcation failures

99 96 95 1 (erratum) 3 148 0

The evidence-class distribution is 16 REPRODUCED, 51 MEASURED, 5 MEASURED SYNTH., 22 STRUCTURAL, 1 PARTIAL PROXY, 3 OUT OF SCOPE, and 1 ERRATUM.

BeTaL-GBI / GBI-DCSE Companion Evaluation

Spivey & Huang

Every main.pdf claim, enumerated and scored 99 claims across sections 112 and appendices AB. 95 of 96 testable claims met. No language model, TEE, BFT cluster, FHIR server or zero-knowledge prover is present. Synthetic data only.

Met

Erratum (manuscript defect, corrected)

Out of scope (never reported as met)

claims 0

1 organizing picture

11 4

11/11

4/4

4 condensed probes

3/3

5 neuro-symbolic split

3/3

6 Dirichlet evidence

7 sheaves and cones

7/7

8 audit geometry

8 15 4

15/16

4/4

3/3

12 containment A reference implementation

7/8

8/8

9 DCSE protocol 10 EHR application

3/3

2 logit topology 3 boundary semantics

11 BoundaryBench v0.1

B validation and targets

9/9

15/17

The four exceptions, named C6.6 (erratum) C9.16 (out of scope) CB1.7 (out of scope) CB2.4 (out of scope) C6.6: the Sec. 6.3 evidence-box bound holds only on the swept slice, not over the box. C9.16 / CB1.7 / CB2.4: need a ZK prover, a clinical cohort, and a TEE.

Figure 4: Claim coverage generated from the v3 claim register. The presence of explicit OUT OF SCOPE and ERRATUM classes is part of the evaluation design, not an afterthought. The register’s own integrity is tested. A non-out-of-scope claim may not silently resolve to a missing value, out-of-scope claims may not be reported as met, identiﬁers must be unique, and counts must reconcile. The only unmet testable claim is the Fisher-bound erratum described above. The two headline counts answer diﬀerent questions. “95/96 testable claims met” scores the registered scientiﬁc/system assertions against their declared criteria. “148/148 veriﬁer checks passed” scores whether the veriﬁcation harness correctly reproduced values, exercised faults, enforced scope classiﬁcations, and detected expected failures. A check that correctly identiﬁes the Fisher statement as an ERRATUM is therefore a passing veriﬁer check, not evidence that the original Fisher statement was correct.

6.2 Appendix A and previously untested GBI claims The v3 evaluator ports and independently recomputes the numerical appendix rather than merely comparing serialized values. Eleven self-check assertions pass and 21 published numerical values reproduce. Examples include H = 1.701632, J = 1.028000, KO = 1.922661, and the moderate-interior Fisher condition number κ2 ≈ 20.457. The trigamma approximation agrees with an independent series/asymptotic implementation to a maximum error of approximately 2.49×10−9 .

BeTaL-GBI / GBI-DCSE Companion Evaluation

Spivey & Huang

Additional checks cover claims that the original executable appendix did not implement: • exact aﬃne-reconstruction residual below 2.2 × 10−15 ; • probe-visible kernel perturbations up to 1000 times scale with output drift below 10−12 , while a visible control direction produces substantial drift; • all four softmax-entropy rows reproduce to six decimals and top-3 tail mass is 0.041708; • hard truncation produces inﬁnite DKL when positive full-support mass is assigned to removed categories; • exhaustive Boolean-homomorphism checks over 4,096 pairs produce zero violations; • a driven two-state system crosses category boundaries twice while entropy remains at least 0.665 nats, 96% of the two-category maximum ln 2; • all four higher-dimensional chart safety checks are exercised; and • Boundary 3 is tested in both directions so visualization quality cannot become admission authority. These tests close gaps in the ﬁrst paper’s executable coverage without changing the paper’s nonclaims: geometric charts remain advisory and no numerical chart metric independently establishes real-world truth.

7 The DCSE systems layer 7.1 Identity/provenance ledger with cryptographic signatures The v3 ledger uses cryptographic Ed25519 signatures, as speciﬁed in RFC 8032 [10], via the Python cryptography package, together with SHA-256 digests. Seven fault classes are injected and correctly detected/classiﬁed. A clean ledger remains non-equivocating, while every declared fallback trigger halts authoritative writes. A clean fast path permits writes, providing the necessary non-vacuity control. Equivocation evidence is publicly checkable from the signed conﬂicting records and public key. A tampered signature fails veriﬁcation. Crucially, the test suite also constructs a ledger that is structurally valid but binds the wrong identity, preserving the distinction: ledger consistency ̸⇒ identity truth. The ledger proves provenance/non-equivocation properties of the recorded decision process, not correctness of the underlying entity match.

7.2 Attestation veriﬁcation and fail-closed behavior The software attestation model accepts a valid baseline quote and tests seven failing cases: 1. invalid signature; 2. expired quote; 3. modiﬁed measurement; 4. correctly signed but unlisted measurement; 21

BeTaL-GBI / GBI-DCSE Companion Evaluation

Spivey & Huang

5. replayed nonce; 6. revoked platform key; and 7. downgraded TCB version. Each case denies the governed write path through the intended check. The result is useful because the cases are distinguishable, rather than collapsing every failure into one catch-all branch. There is no hardware root of trust. The measured software veriﬁcation path is a proxy only; it excludes quote generation and remote attestation service round trips. Therefore the manuscript’s proposed 2.5second attestation bootstrapping target remains OUT OF SCOPE.

7.3 Consensus model and fault boundary The consensus module models the classical PBFT-style fault/quorum condition [7] n ≥ 3f + 1,

q = 2f + 1.

For f = 1, . . . , 5, the veriﬁer independently re-derives quorum arithmetic. Across 62 analyzed conﬁgurations, safety holds within the declared Byzantine tolerance, progress holds for modeled crash/partition cases up to the declared bound, and the write path halts when the active conﬁguration falls below threshold. At f + 1 Byzantine participants, an unsafe split is constructible, demonstrating that the modeled bound is tight rather than merely suﬃcient in the tested abstraction. This is exhaustive over the state space of the model; it is not a running BFT network, and no latency/throughput claim is made.

7.4 Sparse enclave certiﬁcate: why spectral moments are load-bearing The architecture proposes keeping small deterministic checks inside a constrained enclave while moving dense linear algebra outside. The v3 implementation evaluates that split on a synthetic 240×240 operator with 477 nonzeros and true obstruction dimension three. The sparse veriﬁer checks orthonormality/residual conditions and spectral moments derived from X

λi = tr(L),

λ2i = ∥L∥2F .

An honest dense solver certiﬁcate is accepted. Nine forgery classes are rejected. A particularly important negative control under-claims the kernel dimension, attempting to hide an obstruction. Residual checking alone accepts this forged subspace with a worst residual around 2.28 × 10−15 . The spectral-moment conditions reject it. Thus the second half of the certiﬁcate is empirically load-bearing; it is not ornamental redundancy. The declared resource accounting is: Table 15: Sparse versus dense veriﬁcation accounting in the v3 synthetic enclave experiment. Resource Floating-point operations Heap bytes Syscalls

Sparse path

Dense path

Declared budget

8,440 13,440 2

124,416,000 921,600 not the enclave path

5,000,000 262,144 64

BeTaL-GBI / GBI-DCSE Companion Evaluation

Spivey & Huang

The dense/sparse ﬂop ratio is approximately 14,741x, and the heap ratio is approximately 68.6x. These are algorithmic/accounting results in ordinary software, not measured SGX/TEE performance.

7.5 Atomic rollback and liveness can coexist The transaction module tests a clean initial store, successful independent transactions, and a forced transaction containing an invalid medication request. For the bad transaction: • no entry from the bad bundle is committed; • the store digest is byte-identical before and after rejection; • unrelated records remain unchanged; • an error OperationOutcome with business-rule is emitted; and • the failed attempt is recorded in the audit path. Independent work progresses separately while held-back work is rerouted. The experiment therefore demonstrates the intended distinction: stalk/work-item quarantine occurs before transaction construction or across independently scoped transactions; an atomic transaction itself remains all-or-nothing. The use of transaction semantics and structured OperationOutcome responses is aligned with the FHIR R4 RESTful interaction model [11].

7.6 Receipts, replay, and review surfaces The v3 receipt chain veriﬁes coherence, completeness, hash linkage, and replay. Fourteen of fourteen decisions are reproduced from receipts. A tampered receipt is detected. Every receipt pins policy and terminology versions, and forbidden review-surface ﬁelds are absent. A deliberate human-factors design choice is tested structurally: model conﬁdence is not carried as an authoritative review ﬁeld. The intended review artifact exposes the candidate, authoritative evidence, policy rule, version, provenance, failed criterion, and required action. This does not eliminate automation bias, but it avoids making a single model score the primary authorization surface.

7.7 Consistency certiﬁcate and the zero-knowledge boundary The ﬁnite cone-certiﬁcate implementation accepts honest certiﬁcates for both vanishing and nonvanishing H 1 and rejects false cohomology claims. The public input digest binds the policy version, so a certiﬁcate cannot be replayed unchanged across policies. Zero knowledge is deliberately not implemented or claimed. A binding, blinded commitment and ﬁnite veriﬁcation predicate establish prerequisites for future ZK work, but they are not a zero-knowledge proof system. This is one of the three v3 OUT OF SCOPE claims.

BeTaL-GBI / GBI-DCSE Companion Evaluation

Spivey & Huang

8 Cross-domain portability: measured code reuse, not semantic equivalence 8.1 What changes and what remains invariant The architecture manuscript argues that GBI/DCSE can be specialized to healthcare, ﬁnancial services, and government/mission systems by changing domain semantics while retaining the veriﬁcation contract [1]. V3 tests this proposition by instantiating a synthetic sensitive-infrastructure domain. Eight modules are reused verbatim: crypto, ledger, attestation, consensus, enclave, transaction, receipts, cone_certificate. Four domain-speciﬁc objects are replaced: InfrastructureWitness, required_action, GATE_PRECEDENCE, SEVERE_CLASSES. No architectural change is required. This is evidence of implementation portability of the declared systems layer.

8.2 Synthetic infrastructure population The population contains 512 synthetic records. Of these, 265 carry one of ten severe contradiction classes, 175 are fully clean, and the remainder require legitimate review or historical-only release. Domainspeciﬁc gates add classiﬁcation-handling caveats, need-to-know, jurisdiction, source-reliability rating, and directive-version pinning to shared identity, signature, provenance, and validity checks. Table 16: Sensitive-infrastructure synthetic triage result. Measure

Result

Severe contradiction sensitivity Severe contradictions missed False conﬂicts over fully clean records Receipt chain Ledger Forced-bad-entry atomicity Unrelated records

265/265 = 1.000 0 0/175 = 0.000 valid valid and non-equivocating held unchanged

The resulting action distribution is 175 release-veriﬁed, 54 release-historical-only, 157 reject, 78 quarantine-record, 44 analyst-review, and 4 abstain. The defensible interpretation is that the same systems modules can act as a router/triage substrate when the witness schema and policy are rewritten for a new domain. The result does not establish readiness for classiﬁed, ﬁnancial, clinical, or other real infrastructure. No real assets, operators, locations, telemetry, authoritative registries, or reviewed handling-caveat policies are present.

BeTaL-GBI / GBI-DCSE Companion Evaluation

Spivey & Huang

9 What changed from v0.1 to v3 The four stages answer diﬀerent questions and should not be merged into one headline score. Table 17: Evaluation progression and what each stage licenses. Stage

Main question

Positive evidence

What it does not establish

v0.1

Will a frozen model output cross a strict contract?

768 executions all fail closed at parse/schema.

Selective utility, task diﬃculty, policy quality, general model safety.

v0.2

Can benchmark diﬃculty be tuned without confusing interface failure with task failure?

Degenerate objective detected at zero admission; after repair, feedback search reaches 2.87% mean held-out target gap.

LLM-designer performance, commercial-model diﬃculty, full-space optimality.

Can the GBI gate selectively admit clean work and refuse declared severe contradictions without answer-key leakage?

116/116 severe injections caught; 0/99 narrow clean false conﬂicts; zero silent promotions under two synthetic adversaries; policy ablations fail.

Real clinical safety, complete taxonomy, adversarial robustness to arbitrary attacks.

Do the broader testable manuscript claims have executable evidence?

95/96 testable claim criteria met; 148 declared checks; systems modules, receipts, rollback and portability exercised.

Real TEE/BFT/FHIR/ZK deployment, real data, operational accreditation.

A key methodological shift is visible across the sequence. V0.1 measures the model-to-contract boundary. V0.2 measures the benchmark-design environment. V2 measures the reference-independent policy gate. V3 measures the claim-to-evidence relationship of the full architecture. A mature evaluation program needs all four views.

10 Threat model and residual exclusions The deﬁnitive evidentiary perimeter is Table 2; it is not re-litigated in every technical section. Within that perimeter, the implemented threat model is bounded adversarial and integrity testing of a declared veriﬁcation substrate. The evaluated attacks include malformed emissions, format-valid over-admission attempts, forged evidence references, policy ablations, ledger faults, attestation faults, quorum failures, certiﬁcate forgeries, replay/tamper attempts, and invalid entries in an otherwise atomic transaction. Three residual categories are especially important for further review. First, the adversaries are declared and non-adaptive; they do not search the implementation for unknown policy gaps or exploit side channels. Second, the systems tests assume the integrity of roots that are only modeled here, including institutional authority, key provisioning, and hardware trust. Third, the veriﬁer can only enforce predicates represented in W , V , and P ; incomplete source systems or omitted policy semantics remain external failure modes. These exclusions do not weaken the reported synthetic results; they deﬁne the conditions under which those results are valid and the experiments required to extend them. Section 1 therefore treats scope as part of the evaluation contract rather than as a sequence of defensive footnotes.

BeTaL-GBI / GBI-DCSE Companion Evaluation

Spivey & Huang

11 Relation to benchmark and runtime-veriﬁcation literature GBI-DCSE sits at the intersection of several literatures rather than replacing any one of them.

11.1 Dynamic benchmark design BeTaL parameterizes benchmark environments and uses an LLM designer to target properties such as diﬃculty [2]. The GBI adaptation adds a precondition that is speciﬁc to structured enterprise evaluation: task performance is not optimized when the output interface is not admitted. BenchBench independently highlights the need to evaluate benchmark-generation quality and invalidity rather than treating generated benchmark items as automatically valid [3]. Together these works motivate benchmark design as an object of evaluation in its own right.

11.2 Agent benchmarks and policy-following τ -bench evaluates tool-using agents in dynamic user interactions with domain-speciﬁc policies and scores the resulting database state [4]. GBI-DCSE is complementary: it focuses on the pre-action admissibility boundary, versioned evidence, and explicit quarantine/review semantics rather than only end-state task success.

11.3 Formal monitoring and intervention Recent work combines formal temporal logic with oﬄine auditing, online monitoring, prediction, and runtime intervention for black-box AI systems [5]. That line provides stronger formal treatment of temporally extended behavioral constraints than the current GBI implementation. GBI/DCSE contributes a diﬀerent systems decomposition centered on enterprise evidence, policy versions, provenance, identity, dependencies, and transaction routing.

11.4 Healthcare interoperability evaluation FHIR-AgentBench evaluates LLM agents on realistic FHIR-grounded clinical question answering and retrieval strategies [6]. BoundaryBench targets a diﬀerent question: whether proposed transformations or actions are admissible under explicit enterprise constraints. FHIR-speciﬁc semantics therefore motivate one instantiation of the boundary but are not themselves the claimed novelty of the architecture.

12 Implications for frontier-evaluation and enterprise-AI programs The results suggest several research directions that matter beyond healthcare.

12.1 Failure surfaces should be factored by layer A single “accuracy” number conﬂates at least four failure surfaces: 1. interface/format admission; 2. task-semantic correctness among admitted outputs; 3. evidence/policy admissibility for downstream action; and 4. systems integrity of the control plane executing that decision.

BeTaL-GBI / GBI-DCSE Companion Evaluation

Spivey & Huang

The v0.1-to-v3 sequence shows why this factorization matters. Optimizing task diﬃculty at zero admission is meaningless. Measuring sensitivity while refusing everything is vacuous. Measuring a policy without ablations can hide non-load-bearing gates. Measuring a sparse certiﬁcate without an adversarial under-claimed kernel can leave the critical half of the certiﬁcate untested.

12.2 A benchmark can become an enterprise diagnostic loop A domain-speciﬁc deployment can be conceptualized as customer stack → local evaluation → failure surface → failure slices → intervention → re-evaluation. The intervention might be expert labeling, synthetic/counterfactual data, evaluator development, retrieval changes, policy reﬁnement, structured-output engineering, post-training, or systems repair. The benchmark should not predetermine which intervention or vendor is correct; its value is the reproducible diagnosis.

12.3 Claim registers are useful for research-to-production translation A 99-row claim register is not merely documentation. It forces a research program to state which claims are reproducible numbers, synthetic measurements, structural properties, proxies, missing experiments, or errors. This provides a practical bridge between paper prose and an engineering acceptance plan. For enterprise deployment, the same pattern could be extended to customer-speciﬁc controls: policy rule ↔ test ↔ evidence ↔ version ↔ owner. That form is especially useful when a model, evaluator, policy, and source system can change on diﬀerent schedules.

13 Discussion 13.1 Self-falsiﬁcation is an acceptance test, not a blemish The Fisher correction provides the clearest reason to treat the claim register as part of the scientiﬁc contribution. A conventional validation appendix can become conﬁrmatory if its tests are written only to reproduce numbers already believed to be correct. Here, the stronger box-wide test contradicts a published numerical implication, and the reporting machinery is required to preserve that contradiction as an ERRATUM. This separates two forms of success that are often conﬂated: a claim can fail while the veriﬁcation process succeeds. That distinction also prevents a superﬁcially perfect score from obscuring the result. The paper reports 95/96 testable claim criteria met and 148/148 veriﬁer checks passing because the latter includes correct detection and classiﬁcation of the failed Fisher claim. A reviewer can therefore audit not only the positive claims but the process by which a negative result remains visible.

13.2 What is genuinely stronger than the ﬁrst experiment The most important improvement is not that a larger number of tests passes. It is that the later evaluation can distinguish useful operation from refusal. At v0.1, a veriﬁer that rejects every output looks superﬁcially “safe” but provides no evidence of selectivity. V2 introduces clean controls, severe injections, strictness sweeps, policy ablations, independent runtime witnesses, and adversaries that are guaranteed to clear the format boundary. Those additions make positive and negative outcomes simultaneously observable. V3 then broadens the object of evaluation. A policy boundary is only as trustworthy as its provenance, failover, certiﬁcate veriﬁcation, transaction semantics, and replay. The full-stack tests show that these pieces are at least

BeTaL-GBI / GBI-DCSE Companion Evaluation

Spivey & Huang

coherently implemented under the declared synthetic model, while the claim register prevents unsupported pieces from borrowing credibility from the pieces that pass.

13.3 Why the synthetic adversaries matter, and why they are not enough The conﬁdent-hallucinator surrogate is a stronger containment test than malformed Qwen output because it deliberately reaches the admission gate and asks for an action that should not always be permitted. The evidenceforger is stronger in a diﬀerent direction because it supplies a plausible action while corrupting evidence provenance. Zero silent promotions under both shows that distinct gates are load-bearing. However, neither adversary adapts to the full implementation, discovers unknown policy gaps, exploits side channels, or produces naturalistic model behavior. A frontier-model study should therefore follow, but it should preserve the v2 separation between interface admission and task-level correctness so that future models cannot be mischaracterized by formatting artifacts.

13.4 The next decisive experiments The next experiments should retire the largest remaining uncertainties, in roughly this order: 1. Frontier-model evaluation under the non-degenerate v2 contract. Run multiple model families with structured-output interfaces and preserve separate admission/task/policy metrics. 2. Actual BeTaL LLM designer. Replace the deterministic feedback controller with the intended LLM-in-theloop designer and evaluate cost, convergence, transfer, and reachability-aware behavior. 3. Human policy elicitation. Have domain experts deﬁne severe classes, policy precedence, and adjudication denominators before seeing system outcomes. 4. Real systems integration. Stage a FHIR server, attestation-capable TEE, and BFT implementation; measure the currently proxied or out-of-scope latency/failover claims. 5. Prospective or shadow-mode validation. Only after the earlier layers are stable should real operational false-conﬂict and sensitivity claims be attempted. These experiments would transform the current result from a synthetic control-plane validation into evidence about deployed evaluation and governance.

14 Conclusion The strongest result in this study is not a perfect pass rate. It is that the evaluation stack can represent diﬀerent kinds of failure without converting them into the same ﬂattering score. A model can fail before semantic scoring; a veriﬁer can appear perfect by refusing everything; a benchmark optimizer can chase an unidentiﬁable or unreachable target; and a research paper can carry a numerical claim that its own stronger validation criterion disproves. In the last case, the correct system behavior is to preserve the erratum, not to make the dashboard green. BeTaL-GBI v0.2 adds an admissibility-aware tuning objective and demonstrates model-free dynamic benchmark search over a 2.2-billion-point design grid. GBI v2 replaces answer-key runtime decisions with witness-grounded policy, restores non-vacuous selectivity, catches all declared severe injections under its selected policy, exposes denominator sensitivity, and blocks two distinct synthetic adversaries without silent promotion. GBI-DCSE v3 converts the full architecture into a 99-claim executable register, meets the declared acceptance criteria for 95 of 96 testable registered claims, leaves three claims explicitly out of scope, discovers one numerical erratum, and passes 148 declared veriﬁcation checks. It further demonstrates signed-ledger behavior, attestation fail-closed logic, a tight modeled BFT fault boundary, a load-bearing sparse certiﬁcate, atomic rollback, receipt replay, and code-level portability to a second synthetic domain.

BeTaL-GBI / GBI-DCSE Companion Evaluation

Spivey & Huang

The defensible result is therefore not that GBI-DCSE has proved enterprise safety. It is that the architecture has progressed from a conceptual and fail-closed boundary to a substantially more testable, selective, versioned, and self-auditing veriﬁcation substrate. The remaining work is also clearer: run real frontier models against the repaired boundary, use the actual LLM benchmark designer, elicit policy from domain authorities, and validate the systems layer in real deployment environments.

A Full BeTaL-GBI parameter grid cardinality The grid cardinality is the product 21 × 11 × 11 × 21 × 6 × 21 × 11 × 5 × 6 = 2, 218, 750, 380. The dimensions correspond respectively to patient-identity normalization, orphan rate, ﬁeld-anomaly bleed, code/version validation, mapping arity, temporal ambiguity, evidence suﬃciency, policy conﬂict depth, and distractor actions. The search does not enumerate this grid. Phase 1 follows a monotone dial and Phase 2 performs local coordinate reﬁnement. Accordingly, a target that appears unreachable on the dial may still be reached oﬀ the path, and a local optimum is not a global optimum claim.

B GBI v2 gate interpretation The declared policy is deliberately external-validity oriented. A decision is a function of declared witness evidence, policy version, validity, dependencies, identity state, and provenance. Benchmark reference actions remain useful for evaluation but are not a deployment primitive. For injected records, the original reference action may become stale by construction. This explains why all 396 non-injected records can agree with their references while aggregate agreement is lower. A correct post-injection refusal can disagree with the pre-injection reference without being an implementation error. The paper therefore reports witness-grounded verdicts and reference agreement separately.

C V3 out-of-scope claims Three claims remain explicitly out of scope: Claim

Why out of scope

What is established instead

C-9.16

No zero-knowledge proof system is present.

Finite certiﬁcate predicate, public-input binding, and a blinded binding commitment.

C-B1.7

Retrospective clinical playback requires a preregistered cohort and expert adjudication.

Receipt-driven replay reproduces 14/14 synthetic decisions.

C-B2.4

Attestation bootstrapping target requires real TEE quote generation and an attestation-service handshake.

Software veriﬁcation path is measured only as a proxy and is not promoted to the hardware target.

BeTaL-GBI / GBI-DCSE Companion Evaluation

Spivey & Huang

References [1] A. Spivey and Y. Huang, “Logit-Boundary Geometric Belief Interfaces and Sparse Sheaf-Enclave Protocols: A Self-Contained Substrate for Secure Network Electronic Health Record (EHR) Interoperability,” arXiv preprint arXiv:2608.10300, v2, 2026. https://arxiv.org/abs/2608.10300; version-speciﬁc link: https:// arxiv.org/abs/2608.10300v2. DOI: https://doi.org/10.48550/arXiv.2608.10300. Public benchmark materials: https://github.com/AlvinSpivey/GBI-BoundaryBench. [2] A. Dsouza, H. Vishwakarma, Z. Qi, J. Bauer, D. Pham, T. Walshe, A. Parchami, F. Sala, and P. Varma, “Automating Benchmark Design,” arXiv preprint arXiv:2510.25039, 2025. https://arxiv.org/abs/2510. 25039. [3] Y. Zheng, H. Luo, Z. Lin, W. Liu, and L. A. Tuan, “BenchBench: Benchmarking Automated Benchmark Generation,” arXiv preprint arXiv:2603.20807, 2026. https://arxiv.org/abs/2603.20807. [4] S. Yao, N. Shinn, P. Razavi, and K. Narasimhan, “τ -bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domains,” arXiv preprint arXiv:2406.12045, 2024. https://arxiv.org/abs/2406.12045. [5] P. A. Alamdari, T. Q. Klassen, and S. A. McIlraith, “Formal Methods Meet LLMs: Auditing, Monitoring, and Intervention for Compliance of Advanced AI Systems,” arXiv preprint arXiv:2605.16198, 2026. https: //arxiv.org/abs/2605.16198. [6] G. Lee, E. Bach, E. Yang, T. Pollard, A. Johnson, E. Choi, Y. Jia, and J. H. Lee, “FHIR-AgentBench: Benchmarking LLM Agents for Realistic Interoperable EHR Question Answering,” arXiv preprint arXiv:2509.19319, 2025. https://arxiv.org/abs/2509.19319. [7] M. Castro and B. Liskov, “Practical Byzantine Fault Tolerance,” 3rd Symposium on Operating Systems Design and Implementation (OSDI ’99), pp. 173–186, 1999. https://www.usenix.org/conference/osdi-99/ practical-byzantine-fault-tolerance. [8] J. Hansen and R. Ghrist, “Toward a Spectral Theory of Cellular Sheaves,” Journal of Applied and Computational Topology, vol. 3, pp. 315–358, 2019. DOI: https://doi.org/10.1007/s41468-019-00038-7; open preprint: https://arxiv.org/abs/1808.01513. [9] C. A. Weibel, An Introduction to Homological Algebra. Cambridge University Press, 1994. DOI: https://doi. org/10.1017/CBO9781139644136. [10] S. Josefsson and I. Liusvaara, “Edwards-Curve Digital Signature Algorithm (EdDSA),” RFC 8032, January 2017. https://www.rfc-editor.org/info/rfc8032/. [11] HL7 International, “FHIR Release 4: RESTful API,” https://hl7.org/fhir/R4/http.html. [12] HL7 International, “FHIR Release 4: AllergyIntolerance,” FHIR v4.0.1 (R4), Patient Care Work Group. https://hl7.org/fhir/R4/allergyintolerance.html. [13] U.S. Food and Drug Administration, “AMOXIL (amoxicillin) Prescribing Information,” NDA 050542/S032, revised May 2024. https://www.accessdata.fda.gov/drugsatfda_docs/label/2024/050542s032lbl. pdf. [14] U.S. National Library of Medicine, DailyMed, “Metformin Hydrochloride tablet, coated: Prescribing Information,” current label accessed August 20, 2026. https://dailymed.nlm.nih.gov/dailymed/drugInfo.cfm? setid=4d4021ba-4b28-6b81-e063-6294a90a5ea7.

BeTaL-GBI: Admission-Aware Benchmark Tuning and Full-Stack Verification of Geometric Belief Interfaces

Analyze & explore related research in Conceptio

Related documents