The honesty doctrine

Ψ is computational intelligence that informs — never an oracle that decides. That sentence is not marketing; it is load-bearing architecture, enforced in code, in tests, and in the shape of every result the system is allowed to return. Three mechanisms carry it: the firewall, the honest decline, and the certainty cap.

1 · The firewall — Ψ never enters the engine

Every layer of the Ψ spine — derivation, calibration, the quantum sidecar, health direction, the question engine — is display-only and advisory. The boundary is not a convention but a construction rule, with tests that fail the build if it is crossed.

What Ψ may do

Compute vectors, scores, descriptors, posteriors and directions.
Display them with evidence labels, drivers and missing-data lists.
Propose corrections as cards the operator may adopt, adapt or ignore.
Decline — with the reason attached — whenever the data is not there.

What Ψ may never do

Write a recipe, move an actuator, or apply any change automatically.
Mutate the locked specification, the seed data, or the frozen literature priors.
Let the electronic sidecar or health direction enter the core vectors or posteriors.
Issue a verdict about what a substance does to a person.

The firewall has teeth: the seed file must remain byte-identical after any calibration write (posteriors live in a separate overlay), the bridge defaults to prior-only composition, and the derive and calibrate packages are pure — they import nothing from the GUI, the engines, or the adapters. A formulation decision at Panacea is made by a person, at a bench, with Ψ's cards on the screen beside them.

2 · The honest decline — never a number when the data isn't there

The system's most important outputs are sometimes refusals. Each refusal is typed — it names exactly what is missing — so a decline is information, not silence:

structure_required — a formula is not a structure; derivation refuses to guess
needs_operator_identity — the name is ambiguous; a human must say which substance this is
structure_unresolvable — the identifier maps to no resolvable structure
needs_qm_backend — frontier orbitals need a quantum backend; none, no numbers
needs_operator_reference_set — biological resemblance needs a curated reference set; not invented here

The same rule governs failure: a quantum run that errors, times out or returns unparseable output becomes an honest unavailable state, never an interpolated value. The electronic descriptors that are computed carry their tier with them — COMPUTED for real empirical values, PROXY for structural indicators that must never be mistaken for quantum quantities. Tier-3 declines contribute nothing downstream: an absent HOMO/LUMO cannot quietly become a zero.

3 · The certainty cap — distance deflates certainty

Even when Ψ can compute, it may not know. The known-space distance gate measures how far a query sits from the 27 curated anchors in descriptor space and hard-caps every downstream certainty: cap(d) = clamp(1 − d, 0.15, 1.0). A structurally alien substance wears a 0.15 ceiling no matter how good its features look. Health-direction readouts carry a second, explicit structural-only ceiling of 0.6 on top. The cap only ever lowers a certainty — nothing in the system can raise one past it.

The known-space certainty frontier — distant substances are certainty-capped — Panacea Bio Chem — Scientific illustration — not experimental imagery. Inside the boundary, certainty may rise with evidence; outside it, the cap holds it down.

Evidence, always labelled

Literature prior

Locked from published formulation science, with provenance. Frozen: the calibration loop never mutates it.

Derived from structure

Produced by the W6 Mendeleev engine — tagged DERIVED_MENDELEEV_v1, capped below curated-anchor certainty, with leave-one-out misses flagged rather than hidden.

Bench-calibrated

Updated from real Panacea runs through the W7 Bayesian loop. The 90% credible interval is the headline number; it tightens only as evidence accumulates.

This is the doctrine in one line: Ψ informs, the operator decides, and the system would rather say "I cannot know this" than be believed for the wrong reason.