Module conformal 

Calibrated risk budgets via conformal risk control (PSP-8 System 7).

When autonomous commitment without per-effect approval is enabled, a validator’s acceptance threshold is not an asserted constant: it is calibrated from the deployment’s own ledger so the marginal accepted-unsafe rate is bounded by the declared budget rho. For a validator that accepts when s(p) > theta, the conformal threshold is

theta_hat = inf { theta in [0,1] : (n R_n(theta) + 1) / (n + 1) <= rho }

where R_n(theta) is the empirical accepted-unsafe rate on the calibration set. A drift monitor compares the live score distribution to the calibration distribution; on divergence the calibration is flagged stale. A stale flag does not assert the conformal bound during the stale window, because exchangeability is broken. Scores below the conservative back-off reject; scores above it route mutations to approval. Read-only or independently deterministic-safe effects are handled before this risk-calibration gate.

Structs

CalibrationSample

One calibration sample: a validator score and whether the accepted state was later found unsafe (from undo/redo boundary or regression residuals).

CalibrationStratum

The exchangeability stratum a calibration set is keyed by (PSP-9 system 16). (capability, model) alone is not enough: different models fail differently, and so do different verifier suites and score definitions. Changing any field marks the calibration stale.

Enums

AcceptOutcome

The outcome of an autonomous-commit acceptance decision.

CalibrationReadiness

Cold-start readiness (PSP-9 system 16): before Active, read-only work and deterministically contracted effects continue; other mutations route to approval while shadow decisions build the local set.

CalibrationState

Calibration state of the conformal threshold.

ThresholdOutcome

A threshold computation that names infeasibility instead of hiding it.

Functions

accepted_unsafe_rate

Empirical accepted-unsafe rate R_n(theta): the fraction of calibration samples that would be accepted (score > theta) and are unsafe.

conformal_threshold_checked

Compute the threshold, reporting the feasibility floor explicitly.

decide

Decide autonomous acceptance for a validator score under the current calibration state.

is_drifted

Whether the live distribution has drifted from the calibration distribution. Uses the KS statistic against the asymptotic critical value at level alpha (c(alpha) * sqrt((n+m)/(n*m)), with c(0.05) ≈ 1.36).

ks_statistic

Two-sample Kolmogorov–Smirnov statistic D = max |F_live(x) - F_calib(x)|.

readiness

Derive readiness from the sample count and stratum staleness.

sample_floor

The sample floor a declared budget implies: the feasible set of Theorem 5 is empty exactly when rho < 1/(n+1), so n >= 1/rho - 1 labeled samples are required before any proposal can be autonomously accepted at all. For the common rho = 0.05 this is 19.