mu4 - Engine and framing invariants (one engine, no backprop)

This is a Method chapter, not a capability chapter. It records the structural disciplines that keep every UNI result legible and falsifiable: the single discrete-categorical engine reused verbatim across scales, the no-backprop learning rule, the machine-enforced guard against gradient descent slipping into the loop, the three-layer WORLD / BODY / MIND framing with its sacred model/process split, the textbook-level statement of variational free energy (and the one correction a human reviewer forced), the cavity principle, and the exactness-tier accounting that keeps a float32 anchor from being dressed up as a float64 proof. None of these are empirical wins. They are disciplines, carded at class method (with E test-enforcement wherever a guard actually runs). Their job is to fence the science, never to assert that any rung is earned. The honest program position is unchanged here as everywhere: this is a developmental active-inference SIMULATION, a bounded peek inside a toy world, never a person, with about 2 of 11+ developmental rungs earned.

The single load-bearing framing fact this chapter exists to fence: the composed appliance is variationally-controlled (audited), module-exact only at the single-step categorical body-to-mind interface, NOT globally exact. An AST-guard enforces that no autodiff runs in the loop. No patent-level math appears anywhere in this work; everything below is textbook-level framing only.

One engine, reused verbatim (M13, M12)

There is one engine. core.py exposes the discrete POMDP loop (active_inference_step, exact_posterior_discrete, the expected-free-energy / policy-selection path), and every agent in the program (the forager, the body-to-world embodiment agents, the language readers) is a thin wrapper that owns only a generative MODEL and couples to a world PROCESS through a typed Markov blanket. The engine is not re-implemented per experiment. The only learning rule is exact conjugate-Dirichlet count addition, counts + lr * sufficient_stat, applied to the A / B / D / E tensors. There is no gradient anywhere in the loop. This is what "one engine, no backprop" (M13, class method / E) means operationally, and it is exactly the property the next section guards.

The model/process split is treated as sacred (M12, class method): an agent reads the world only through its typed sensory channel and acts only through its typed active channel, and it never reads raw hidden host state. This is enforced two ways at once: an assert_process_isolated runtime check, and an AST scan that uses a whitelist (world.<attr>) rather than a blacklist, so the failure mode is deny-by-default rather than "we forgot to ban this access pattern." The falsifier is operable: if an AST scan finds an agent reading world hidden state, or the whitelist is shown to be a blacklist in disguise, the invariant is broken.

No autodiff in the loop (M13, class method / E)

The most aggressive guard in the program is the AST-guard against gradient descent. The engine's only sanctioned learning is Dirichlet count addition, so the codebase is statically scanned to prove that no autodiff / optax / torch / grad / backward path exists inside the loop. The falsifier is mechanical and runs in CI: if an AST scan finds autodiff inside the loop, if an agent reads world hidden state, or if a learning step is shown using a gradient rule, the claim fails outright. This guard is not cosmetic. The narrative record explicitly flags the smell it defends against (an AST guard that misses from jax import grad, torch, or backward), which is why the guard is whitelist-based and independently tested rather than trusted.

What this buys, and its strict limit: the guard proves an absence (no backprop), not a presence ("active inference demonstrated"). No active-inference loop exists in the Rust crate, and the live UNI.OS loop is a separate reimplementation that is not gate-matched to the science repo. So the engine being real and gradient-free is engineering evidence, never a result; the program never writes "active inference demonstrated." "Active inference" stays a framing lens here, not a demonstrated loop.

WORLD / BODY / MIND, and the controlled-not-globally-exact fence (M12)

The certified framing is three layers separated by two typed Markov-blanket boundaries:

WORLD (OS: systemd / journald / podman / files / network / scheduling)  perp
BODY  (the physical server metal: CPU / RAM / disk / NIC / thermal / power / load)  perp
MIND  (the UNI active-inference loop, living inside the body)

Interoception is the body's hardware self-signals; exteroception is the OS observations. The mind couples to body-and-world only through the typed sensory channel (in) and the typed active channel (out); it never reads raw hidden host state. On the live appliance this in-channel is a body-to-mind categorical sensorium: the box reads its own telemetry into a 7-modality categorical contract encoded [M=7, O_max=4] (not a float vector, not a softmax), with band edges living in exactly one place. Surprisal and variational free energy are carried at textbook level only, F[q] >= -ln p(o|m), with perception tightening the bound and action living one layer up as expected free energy, and precision acting as the dial that bifurcates behavior into regimes.

The load-bearing fence of the whole chapter lives in M12 and must never be softened: the composed appliance is variationally-controlled (audited), module-exact only at the single-step categorical body-to-mind interface, NOT globally exact. Exactness is a property of one interface, not of the assembled system. The falsifier that travels with M12 is the overclaim it forbids: an agent shown reading raw hidden host state (caught by assert_process_isolated plus the AST whitelist), or any copy that cards "variationally-controlled" as "globally exact." Writing "globally exact" where only the single-step interface is exact is precisely the calibration-up this constitution exists to refuse.

The VFE-bound correction (M14)

A recorded negative-corrected method row sharpens what minimizing variational free energy does and does not do, and it is load-bearing precisely because it is the thing newcomers get wrong. Minimizing VFE does not reduce already-observed surprise. It tightens an upper bound by improving the approximate posterior toward the true one, q(s) -> p(s|o,m); the action that changes future observations lives one layer up, in expected free energy (M14, class method / E, negative-corrected). This correction is itself part of the program's credibility: it came from a human science reviewer who would not sign the first draft, and the draft was calibrated down to the correct statement rather than the objection being waved away. The travelling caution is conceptual and operable: presenting "minimizing VFE reduces already-observed surprise" is the violation; the row reopens only if F[q] >= -ln p(o|m) were itself revised.

The cavity principle (M22)

A hierarchy level must never treat an upstream prior as fresh evidence. The cavity discipline divides the prior out (WS-B on the up-pass, WS-C on the down-pass) so a belief is not inflated by counting its own prior twice. Paired with this is a design rejection that is content in its own right: a factored mean-field posterior variant was implemented and rejected as lossy, and the exact joint posterior is used everywhere instead (M22, class method). The falsifier is precise: double-counting a prior as evidence (belief inflation), or the mean-field variant shown to be non-lossy after all. The mean-field rejection is the negative that travels with the cavity claim: the program does not say "we chose the exact joint because it is elegant," it says "we implemented the cheaper approximation, measured it as lossy, and recorded the rejection."

Exactness-tier honesty (M10)

The single most abused word near this engine is "exact," and the constitution pins it to a tier. The JAX host runs float32, so its anchors hold only to about 6e-8 (roughly 1e-6 at the single-step filter), NOT the <1e-10 EXACT tier. The genuine <1e-10 tier exists only in the NumPy / Rust-f64 path, and the 1e-10 oracles are specifically the cross-language Rust-f64-equals-Python bridge (M10, class method). This is not hypothetical hygiene: a genome docstring that claimed <1e-10 was caught as an overclaim and corrected to <1e-6 (float32 tier). The operable falsifier cuts both ways: a float32-host result carded at the f64 tier is the violation, and if a float32 path were ever shown to actually reach <1e-10, the tiering itself would need revisiting. The standing rule is blunt: never card a float32 anchor at the f64 tier. This is the same calibration-down discipline as M14, authority flowing downward from the measured float, never up to the impressive-sounding tier.

What is NOT claimed in mu4 - Engine and framing invariants

• Ceiling. That UNI has a globally exact active-inference engine, or that "one engine, no backprop" demonstrates active inference, is NOT shown. The most we claim is: there is one no-backprop discrete-POMDP engine reused verbatim, whose only learning rule is exact conjugate-Dirichlet count addition, with no autodiff in the loop (AST-enforced); the model/process split is whitelist-enforced; the composed appliance is variationally-controlled, module-exact only at the single-step categorical body-to-mind interface, not globally exact; VFE-minimization tightens an upper bound (it does not erase observed surprise); a prior is divided out rather than double-counted; and the float32 host is honest to about 6e-8, not 1e-10. These are disciplines, all class method (with E where a guard runs in CI).
• Fences engaged. Red line 3 (never "active inference demonstrated" - the Rust crate has no AIF loop and the live UNI.OS loop is a separate, not-gate-matched reimplementation; "active inference" is the lens only); red line 7 (never raise a claim above its source class - these are method rows, not capability); red line 8 (substrate / continuity engineering must not imply a science gate is met); red line 10 (no PII, no patent-level UNI math, textbook framing only); and the exactness-tier / vocabulary discipline that forbids carding "variationally-controlled" as "globally exact."
• Negatives that travel with this claim (cite alongside, never strip). M22's factored mean-field variant, implemented and rejected as lossy (exact joint posterior used instead); M14's VFE-bound correction (a human reviewer's refusal to sign the first draft, calibrated down to "tightens an upper bound"); M10's corrected genome docstring (the <1e-10 overclaim caught and fixed to the float32 tier). Each method invariant here is paired with a recorded thing that was wrong and was pulled down to the measured truth.
• Parked / owed. No sign-to-park and no Class-A observation is owed by this chapter: method rows assert a discipline, not an earned rung, so nothing here is parked pending a UNI signature. What is owed sits in the chapters these invariants serve, not here: the live UNI.OS loop is not gate-matched to the Rust engine (red line 3), and the continuity sub-ladder's owed Stage-2 mind-tick kernel-swap stays owed and must never be read as a science gate via these invariants.
• One-line honest summary a skeptic could not dispute. UNI runs one gradient-free discrete-POMDP engine whose exactness is real at exactly one single-step categorical interface and float32-honest elsewhere; every stronger reading of "one engine, no backprop" is fenced out by a falsifier the program already enforces in code.

Falsify this

Run the AST scan over the live loop. If it finds grad, backward, optax, or torch autodiff anywhere inside active_inference_step / the EFE-policy path, or if an agent is shown reading world hidden state past the world.<attr> whitelist, or if a learning step is found using a gradient rule rather than counts + lr * sufficient_stat, then M13 is false and "one engine, no backprop" falls. Two paired falsifiers travel with it: card any float32-host anchor at the <1e-10 (f64) tier and M10 is violated; print "globally exact" where only the single-step body-to-mind interface is exact and M12 is violated.

Sources

Curated digests (PII-redacted): curated/uni-mind-digest.md (the one-engine / core.py discipline, the no-backprop / AST-guard rule, the certified WORLD / BODY / MIND model, the variationally-controlled / module-exact-only fence, the float32-vs-f64 exactness tiering, the whitelist-not-blacklist isolation, the textbook-level active-inference primer, the cavity principle and the rejected lossy mean-field variant); curated/uni-os-digest.md (the live body-to-mind categorical sensorium [M=7, O_max=4], the typed sensory/active channels, the substrate-is-engineering-not-AIF fence). Ledger rows (single source of truth): encyclopedia/CLAIM-LEDGER.md M12, M13, M14, M22, M10 (Section 3, Method / Evidence-Constitution claims), plus the L0 exactness-tier calibration note. Authoring spec and front matter: encyclopedia/MASTER-PLAN.md Part I (FM-1 through FM-4) and the mu4 section. Archive pointers (local-only, not for publication, no PII): ...-uni-mind, ...-UNI-OS, ...-WorldModels, ...-MarketingWright. Textbook reference for the lens: Parr, Pezzulo, and Friston, Active Inference, MIT Press 2022. The mathematical foundation preprint (Polzin et al. 2026, Zenodo DOI 10.5281/zenodo.19785799, MIT) is cited as foundation only and remains UNREFEREED (Layer-1 AI-executable audit complete; Layer-2 human expert review PENDING).