fix(query): #774 gate --save on the unverified-attribution fallback - #791
Merged
Conversation
Nothing verified the answer was entailed by its context: sufficiency (#760) checks the context COULD answer, attribution (#753) records what the model SAYS it used, and the field failure -- a fabricated treatise carrying five bundle citations -- passed both. evals/query_entailment/ measured three candidate mechanisms cost-first. Both chat-judge entailment formulations died on false flags (24 of 27 and 21 of 27 grounded answers flagged; evidence-first did not rescue entailment the way it rescued sufficiency). The winning signal is free and already computed: when qwen3:8b fabricates it also omits the USED line -- on the real bundle that produced the issue, 30 of 30 fabricated answers were 'absent' and 44 of 45 grounded answers were 'reported'. So --save now gates on that signal: an absent/unparsed answer's citations are the retrieval set, and filing them as permanent provenance asks its own stronger question on a TTY (replacing the ordinary prompt) and refuses off-TTY even under --auto or review: false. --allow-unattributed is the explicit opt-in that keeps never-attributing backends usable unattended. The preview discloses the state with an '! unverified grounding:' line. The harness (evals/query_entailment/) keeps both phases re-runnable: constructed corpus for the false-flag cost side (it never fabricated -- 30 of 30 compliant restatements across two corpus variants), gitignored field mode (--workspace) for real fabrications. Verdict and honest limits in results/report-774-verdict.md. Review round acted on: the R3 CRITICAL (docs misattributed the 63-of-63 constructed figure to the field bundle, omitting the measured false positive) was corrected in-lineage; R2's helper-default comment folded into the same correction. Declined as trade-off opinions: atomic checkpoint writes and a score-phase circuit breaker in the manual eval harness, and the flag-to-gate distance refactor. Closes #774
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
query --savenow gates on the measured fabrication signal: when the answer's citation attribution fell back (absent/unparsed), the citations about to become permanentprovenanceare the retrieval set, not the model's accounting — so the save asks its own stronger question on a TTY (replacing the ordinary prompt) and refuses off-TTY even under--autoorreview: false.--allow-unattributedis the explicit opt-in that keeps never-attributing backends usable unattended. The preview always disclosed the state first (! unverified grounding:).The measurement (evals/query_entailment/, new)
The third-guard gap #774 names — nothing verifies the answer is entailed by the context — was measured cost-first with three candidate mechanisms:
unsupportedjudge (evidence-first)binaryjudge (control)absentTwo constructed corpora never fabricated (30/30 compliant restatements — they measure the false-flag side); the fabrication reproduced only in field mode against the real bundle that produced the issue, including the issue's own specimen behaviors. When qwen3:8b fabricates it also omits the
USED:line — the same act of ignoring the system prompt produces both. Full verdict and honest limits:evals/query_entailment/results/report-774-verdict.md. Field runs are gitignored (they quote a private bundle verbatim).Review
Gentle AI lineage
review-d9376c20675f9cf8, high risk, canonical 4R, approved after one bounded correction: the R3 deterministic CRITICAL (docs attributed the 63-of-63 constructed-corpus figure to the field bundle, omitting the measured 1-of-45 false positive) was fixed in-lineage with a targeted validator PASS; R2's helper-default comment folded into the same correction. Declined as trade-off opinions: atomic checkpoint writes and a score-phase circuit breaker in the manual harness, and the flag-to-gate distance refactor.ruffclean,mypyclean, 5182 passed / 1 skipped. Gate mutation-tested (disabling the predicate fails 4 tests).Closes #774