The honesty doctrine
Ψ is computational intelligence that informs — never an oracle that decides. That sentence is not marketing; it is load-bearing architecture, enforced in code, in tests, and in the shape of every result the system is allowed to return. Three mechanisms carry it: the firewall, the honest decline, and the certainty cap.
1 · The firewall — Ψ never enters the engine
Every layer of the Ψ spine — derivation, calibration, the quantum sidecar, health direction, the question engine — is display-only and advisory. The boundary is not a convention but a construction rule, with tests that fail the build if it is crossed.
What Ψ may do
- Compute vectors, scores, descriptors, posteriors and directions.
- Display them with evidence labels, drivers and missing-data lists.
- Propose corrections as cards the operator may adopt, adapt or ignore.
- Decline — with the reason attached — whenever the data is not there.
What Ψ may never do
- Write a recipe, move an actuator, or apply any change automatically.
- Mutate the locked specification, the seed data, or the frozen literature priors.
- Let the electronic sidecar or health direction enter the core vectors or posteriors.
- Issue a verdict about what a substance does to a person.
The firewall has teeth: the seed file must remain byte-identical after any calibration write (posteriors live in a separate overlay), the bridge defaults to prior-only composition, and the derive and calibrate packages are pure — they import nothing from the GUI, the engines, or the adapters. A formulation decision at Panacea is made by a person, at a bench, with Ψ's cards on the screen beside them.
2 · The honest decline — never a number when the data isn't there
The system's most important outputs are sometimes refusals. Each refusal is typed — it names exactly what is missing — so a decline is information, not silence:
needs_operator_identity — the name is ambiguous; a human must say which substance this is
structure_unresolvable — the identifier maps to no resolvable structure
needs_qm_backend — frontier orbitals need a quantum backend; none, no numbers
needs_operator_reference_set — biological resemblance needs a curated reference set; not invented here
The same rule governs failure: a quantum run that errors, times out or returns unparseable output becomes an honest unavailable state, never an interpolated value. The electronic descriptors that are computed carry their tier with them — COMPUTED for real empirical values, PROXY for structural indicators that must never be mistaken for quantum quantities. Tier-3 declines contribute nothing downstream: an absent HOMO/LUMO cannot quietly become a zero.
3 · The certainty cap — distance deflates certainty
Even when Ψ can compute, it may not know. The known-space distance gate measures how far a query sits from the 27 curated anchors in descriptor space and hard-caps every downstream certainty: cap(d) = clamp(1 − d, 0.15, 1.0). A structurally alien substance wears a 0.15 ceiling no matter how good its features look. Health-direction readouts carry a second, explicit structural-only ceiling of 0.6 on top. The cap only ever lowers a certainty — nothing in the system can raise one past it.
Evidence, always labelled
Literature prior
Locked from published formulation science, with provenance. Frozen: the calibration loop never mutates it.
Derived from structure
Produced by the W6 Mendeleev engine — tagged DERIVED_MENDELEEV_v1, capped below curated-anchor certainty, with leave-one-out misses flagged rather than hidden.
Bench-calibrated
Updated from real Panacea runs through the W7 Bayesian loop. The 90% credible interval is the headline number; it tightens only as evidence accumulates.
This is the doctrine in one line: Ψ informs, the operator decides, and the system would rather say "I cannot know this" than be believed for the wrong reason.