33. Training

Decision

SoulforgeModel TrainerModel Trainer carries admitted material from corpus admission and dataset compilation into a training-job contract, candidate lineage, and handoff for independent evaluation/promotion. It must never harvest runtime traces by default or treat KarmaLessons LearnedLessons Learned, consent, repetition, or a positive DriftEvaluatorEvaluator verdict as corpus admission. It cannot mutate serving weights in place, use trainer telemetry as promotion evidence, select production routing, or turn Trial SuiteApp BundleApp Bundle feedback into gradients or automatic repair.

nominated evidence → admitted immutable corpus → compiled dataset + sealed holdout
→ isolated Training Run → frozen Candidate Bundle → independent Drift evaluation
→ explicit promotion decision → versioned serving observation

Every arrow is attributable and may refuse; there is no ambient online self-training.

Training discernment from work

The discernment training passage applies this law to nominated SDLC traces and human corrections. Preserve the distinction that changed a decision, its evidence and conditions, and a counterexample to the superficial rule. Preference, fact, authorization, measured result and evaluator judgment remain distinguishable. First test whether ContextBriefing PackBriefing Pack or a versioned procedural correction solves the limitation; changing weights requires a separate objective and transfer claim. Meeting capture, retained history, accepted work and evaluation consent do not imply training admission. The passage participates in Ouroboros through settled records, with no ambient harvesting or self-certified promotion.

Records

Names never replace digests. Every repeated execution receives a new Training RunJob Record identity and receipt. Reproducibility must be proved by the execution contract; matching inputs or candidate bytes cannot substitute for the later RunJob Record’s own lineage.

Corpus admission

DriftEvaluatorEvaluator Cases/Outcomes, MirrorPersona KeeperPersona Keeper attribution, HitLApproval StepApproval Step decisions, ArchiveLong-term MemoryLong-term Memory rows, success, refusal, repetition, storage consent, and database access may nominate material; none grants training rights. Before trainer access, admission proves:

• source, RunJob RecordJob Record, artifact, producer, time, and transform lineage;
• exact purpose, subject, derivative and retention use, and approving Principal;
• training-specific consent, license, or authority;
• privacy minimization and retained redaction limits;
• target relevance and label quality;
• lineage-aware grouping of duplicates, revisions, sibling trajectories, and generated variants;
• immutable train, development, and sealed-holdout splits;
• base target, learning signal, unacceptable change, expected lift, regression limits, and stops.

The sealed holdout is fixed before training-facing generation and withheld from trainer, augmentation, selection, and model judges used to tune. A negative ledger retains rejected, redacted, and duplicate ids so retry/compiler cannot restore them. Missing provenance, authority, privacy clearance/minimization, relevance, safe split, or uncontaminated holdout blocks admission. Runtime data is opt-in: completion is not quality, and a blocked/refused RunJob Record can be useful if objective and evidence support it. Redaction never erases source influence; privatization labels and lineage remain attached through any narrower disclosure separately admitted by Security.

Dataset compilation

Dataset compilation begins from one admitted corpus snapshot and produces an immutable Dataset Manifest. Every resulting field must trace to a source or versioned deterministic transform. The compiler preserves:

• role, tool, workflow and authority context;
• the distinction between observations, human labels, evaluator judgments and augmentations;
• truthful non-completion and split or lineage-group membership;
• filtering, redaction, truncation, normalization and sampling decisions; and
• audit statistics for balance, concentration, length, duplication and exclusion.

Schema-valid generation still requires evidence for its claims. Holdout answers, benchmark solutions, evaluator rationales and downstream targets must remain outside prompts, retrieval, augmentation, preference construction, trainer metadata and selection. A benchmark used to choose the corpus must be disclosed and needs an untouched control before it can support independent promotion. Only the admitted Manifest crosses to training.

Training execution

The execution boundary receives one immutable Manifest, the exact base-model, tokenizer and configuration digests, the Training IntentRequestRequest and Recipe, admitted secrets and network access, and fresh Run-owned output locations. Its resource request names exact accelerators, memory, storage, network and duration requirements together with the declared conflict domains it may affect. OrchestratorStage ManagerStage Manager resolves the affected set and owns readiness, affected-lease drain, conflict resolution and restoration. Corpus meaning and trainer success remain with their owners. Training has no universal priority: unused devices stay undisturbed, and policy may postpone or refuse the request.

Filesystem, credential, network, process and resource controls must enforce the execution boundary and leave receipts. A container or CovenModel GroupModel Group label alone establishes none of these controls. Local work has no privacy exemption. Remote work additionally records egress, provider custody and retention, secret and network handling, returned artifacts and receipts. The trainer receives no authority to enlarge its corpus with live traces, replace serving, widen resources or promote its own result.

LoRA, QLoRA, full tuning, preference optimization, distillation and later methods remain replaceable Recipe ports. Each adapter pins its base digest and runtime compatibility.

Failure or cancellation preserves terminal truth, logs, checkpoints and quarantined partials for diagnosis. A completed checkpoint may be evaluated only as pinned candidate material through the same independent handoff; it never becomes serving state by surviving the job. A partial is never a Candidate Bundle. Retrying creates a new Training RunJob RecordJob Record and receipt.

Independent evaluation

A frozen Bundle enters Drift as an exact, immutable subject. DriftEvaluatorEvaluator may neither alter the candidate nor change its corpus, Recipe or lineage. Its evidence must include:

• the sealed target holdout and matched Outcomes from the base or currently promoted baseline;
• named regression Trial SuitesApp BundlesApp Bundles and adversarial or authority-boundary Cases; and
• quality, latency, memory and cost measured in a compatible serving Environment.

Errors, exclusions, uncertainty and evaluator calibration accompany those results. Loss, development improvement, trainer-authored examples and self-grading remain diagnostics. A visible Trial SuiteApp Bundle establishes only the capability and safety claims its Environment can support.

Promotion, serving, and rollback

A passing DriftEvaluatorEvaluator result makes the candidate eligible for a promotion decision. Owning policy and MagusYou, the OperatorYou, the Operator/HitLApproval StepApproval Step still decide whether to promote. That decision binds the exact Bundle and Outcomes, admitted capabilities and denied uses, compatible engine and base relation, rollout observations and stops, fallback and rollback, and retention, quarantine, and retirement rules.

DispatcherTraffic ControllerTraffic Controller consumes a registered capability; files alone cannot create one. Revisions remain immutable, and supersession requires a new Bundle and decision. Rollback routes new work to an earlier digest and quarantines the suspect candidate while preserving completed effects.

A later privacy, authority, license, contamination or leakage failure must be traced through the exact Dataset, RunJob RecordJob Record, Bundle, claims and promotion descendants. Policy may block serving or reuse, quarantine or delete controlled artifacts, invalidate affected claims, and require clean admission and rebuilding. Source deletion cannot untrain produced weights.

Retrieval remains appropriate for current, mutable, attributable knowledge. Exporting all history to a provider, or allowing a trainer to select, evaluate and deploy itself, collapses the separate authority this contract requires.

Consequences

Acceptance evidence

SoulforgeModel TrainerModel Trainer remains Designed until one bounded recipe proves admissions/exclusions, lineage-safe splits, sealed holdout, isolated immutable-input execution, candidate custody, independent DriftEvaluatorEvaluator evaluation, explicit promotion, compatible serving, and rollback to a prior revision. State of WorkWhat Actually WorksWhat Actually Works records the transition.