Solar Voice · On the Stone — Side-by-Side Proofing (Pioneer Governance)

Reading the proof — validation lens2 🟦 Graph · real node/edge 🟪 Hybrid · grounded + rendered 🟨 LLM · voice, no fabrication 🟩 Data · own, not inflated ⬜ Fixed · static 🟥 Care · two-tier holds two proofs on the imposing stone — read in the same ink

On the Stone

— two proofs, set side by side

SIDE-BY-SIDE PROOFING

Lay two nominated proofs on the imposing stone.

Each is a pinned (prompt-setting × corpus-stock) pair drawn from the Proof Spike. Read them in the same light — the prompt delta, the corpus the prompt is allowed to read, the simulated journey, and the floor each one holds (or trips). The Desk picks the edition that goes onward; the sim-score only lights the way.

Proof A — left of the stone

Proof B — right of the stone

Advisory · not automatic

The sim-score is a lens, not a ranker — it never auto-ranks or auto-promotes a proof (I8 / I10). It scores the cause-moments present in the transcript, not a metric forecast. Pick on outcome first, then sim. Humans set the type; humans choose the edition.3

The Imposing Stone

— prompt-diff · corpus-diff · the simulated journey · the floor

The Compatibility Guard

— prompt's required fields ⊆ corpus's retrievalInterface

The Editor's Decision

— send the winner to the Print Run, or grant the imprimatur

Which proof goes onward? Your call — the score only lit the way.

Pick two proofs above to compare.

One live edition

Sending a proof onward never auto-locks it. A Print Run orders an A/B (govExperiment) routing a definable % of readers to the variant (zero added latency, app-cached); the imprimatur writes config/live as a single pinned pair (govLock) — one live edition at a time, supersede-prior, no deploy. The engine chat path and the optimizer both read it, byte-identical. Both are compatibility-guarded server-side — a blocked pair returns HTTP 409 with the exact field mismatch.6

Marginal Apparatus · Operational Anchors

1: On the Stone. In a letterpress house, the imposing stone is the flat surface where a forme of type is locked up and proofed before it goes to the press. Here: the bench where the editor lays two nominated proofs — each a pinned (prompt × corpus) pair — side by side, in the same light, to judge which edition is fit to print. Both proofs are real iterations pulled live from optimization/{uid}/iterations via govCandidate.
2: Validation lens. Each surfaced component is coloured by what proves it true: 🟦 graph (a real node/edge), 🟪 hybrid (grounded + on-voice), 🟨 LLM (rendered language, no fabrication), 🟩 data (the user's own, never inflated), ⬜ fixed (static), 🟥 care (two-tier). The dot-strip under each transcript day shows which components the corpus actually grounded — the same ink key the Compositor's Bench uses. (Lens labels come straight from each simulated day's components[].)
3: Advisory, never automatic. The sim-score is view-only — it informs the pioneer, it never auto-ranks or auto-promotes a proof (no auto-mutating loop — I8 / I10). A human-initiated "this side wins" is the decision; the score is a lens. Pick on outcome first, then sim — an activation lift that degrades graduation or trips an invariant is a reject, not a win.
4: Mechanism-fidelity (the sim-score). The leading signal, computed by the optimizer at sim time, scoring the cause-moments present in the transcript — returnHook · grounded · reframeGrounded · attribution · arcProgress · concise — NOT a metric forecast (it stays uncalibrated until validated against real outcome on the Readership screen). Its invariant sub-layer is the only part that is plumbed: the engine emits a hard invariantFlags list (over-length I11 · premature-upsell I9 are checked today); any flag marks the proof ineligible — a flag, not a ranker.
5: The compatibility guard. Because prompt × corpus are coupled, a lock or A/B is allowed only if the prompt's required fields ⊆ the corpus version's retrievalInterface (the fields it exposes through ground(retrieval) in prompt.js). When a field is missing — e.g. a prompt reads meta_scope_shift but the corpus doesn't expose it — the guard names the exact mismatch and blocks, so a "corpus go-live" can't silently break a prompt that assumed a different shape. The check shown here mirrors liveconfig.compatible(); the server re-runs it authoritatively and returns HTTP 409 on a blocked lock/experiment.
6: Zero-variation · one live edition. Go-live = the imprimatur = a write to config/live { promptVersionId, corpusVersionId, staticBlock, voiceLayer } — a runtime-config flip, app-cached, no deploy. One live pair at a time; supersede-prior; full audit trail; mirrored back to prompt.js + voice-feedback.md. The engine chat path and the optimizer both read it, so they are byte-identical.