Immutable learning contracts

The Rust LearningMemory registry stores administrative policy and exact experimental context independently of a procedure proposal. QilbeeDB owns this contract.

Policy authority#

register_policy(tenant, id, definition, actor) accepts one explicitly named algorithm: fixed_budget_hoeffding_v1. Its parameters are the validated LearningPolicy: fixed qualification count, one-sided error budget, minimum improvement/utility, resource limits, monitoring failure limit, evaluator subject and evaluation contract. This policy does not establish family-wide error spending. Its error budget applies to one proposal; registering many proposals does not establish a family-wide guarantee.

A revision uses a new identifier. Repeating an identical definition returns the original registration receipt, including its original actor and timestamp. Changing a definition under the same tenant/identifier conflicts. No registry operation activates a procedure or claims its evidence is true.

Exact context#

register_context(tenant, id, context, actor) preserves these exact identities:

Field Meaning
task Versioned task definition
baseline_revision Exact baseline used for paired comparison and fallback
model_provider, model_revision Provider and immutable model/deployment identity
tools Map of tool name to exact artifact/version identity; empty means no tools
environment_revision Runtime/environment identity
evaluation_contract Rubric and experimental protocol
dataset_revision Held-out dataset/case generation identity
harness_revision Evaluator implementation identity
permissions_revision Execution permission policy identity

Each identity contains 1–512 UTF-8 bytes. The tool map supports at most 128 entries; these are technical contract bounds, not retention quotas. Unknown JSON fields and unsupported algorithm names are rejected. A model or permission change requires a new context, rather than inheriting an old validation result. Callers must supply actual stable identities; the database cannot resolve an arbitrary provider label into an immutable external model by itself.

Receipts and storage#

policy(tenant, id) and context(tenant, id) return immutable registry entries with schema version, tenant, identifier, payload, SHA-256 payload digest, registering actor and transaction timestamp. Reads reject unsupported schemas and identity/digest mismatches explicitly. SHA-256 covers typed JSON serialization with deterministic tool-map ordering; it is a consistency check, not an external signature or proof that the underlying experiment happened.

Registry mutations share the learning store's writer lock and acknowledge only after synchronous WAL writes. Concurrent identical registrations return one original receipt. Identical identifiers in different tenants remain isolated. Tests cover conflicting retries, concurrent writers, strict decoding, corrupted records and reopen persistence.

Integration boundary#

These blocking Rust interfaces are trusted storage operations. Network adapters must derive tenant and actor from a live credential, require policy_admin for registration, and resolve immutable references before creating a proposal. The procedural HTTP API enforces these requirements. The registry does not execute code.