TW-B — Authorized Hyperlink Runtime & Path Compilation Specification

英文名： Authorized Hyperlink Runtime & Path Compilation Specification
版本： v0.1
日期： 2026-09-07
文件類型： 技術白皮書／工程規格
對應系列： 具名 AI 對話圖、結晶記憶與超連結認知架構
主要依據： Paper 06、Paper 07、Paper 08，以及 TW-A
狀態： Draft for Implementation
Canonical Source： UTF-8 Markdown
數學原始碼規範： inline math 僅使用 $...$ ；display math 僅使用 $$...$$

0. 目的與範圍

本文件定義第一代 Authorized Hyperlink Runtime（AHR）與 Path Compilation Runtime（PCR）的工程契約。

本規格直接建立在 TW-A 所定義的：

ArtifactAddress
ObjectRef
revision
digest
scope
authority_revision
semantic_revision
resolver
dependency graph

之上，並新增：

QueryClass
MemoryNeedBinding
RouteReceipt
NavigationCrystal
CompiledRoute
CapabilityEnvelope
PermissionBinding
SafeReachableWorld
RouteSelector
PathCompiler
PerformanceGate
SecurityGate
FallbackPolicy
RevocationClosure
RouteLifecycle
RouteCache
AuditReceipt

本文件第一代只處理：

\widehat{\ell}_{memory}

即 read-oriented memory hyperlinks。

不處理：

unrestricted action hyperlinks；
irreversible external mutations；
credential export；
registrar mutation；
automatic declassification；
fully autonomous cross-resident action orchestration。

核心工程原則：

\boxed{ \text{Path Compilation} \neq \text{Permission Compilation} }

以及：

\boxed{ \text{Faster Path} \not\Rightarrow \text{Greater Authority}. }

1. Runtime 總覽

AHR/PCR runtime 處理：

\boxed{ \text{MemoryNeed} \rightarrow \text{QueryClass} \rightarrow \text{Safe Reachable World} \rightarrow \text{Route Selection} \rightarrow \text{Recall} \rightarrow \text{Route Receipt} \rightarrow \text{Compilation Candidate} \rightarrow \text{Performance/Security Gate} \rightarrow \text{Compiled Route} }

使用 hot path 時：

\boxed{ \text{Current Identity} \rightarrow \text{Current Capability} \rightarrow \text{Current Permission} \rightarrow \text{Revision Check} \rightarrow \text{Route Execute} \rightarrow \text{Validate} }

2. Runtime Components

第一代 AHR/PCR 至少包含：

QueryClassifier
SafeWorldBuilder
RouteSelector
ColdRecallAdapter
WarmRouteStore
RouteReceiptStore
NavigationCrystalAdapter
PathCompiler
PerformanceGate
SecurityGate
RouteRegistry
RouteExecutor
FallbackManager
RevocationEngine
RouteMetricsStore
AuditEmitter

3. QueryClass

QueryClass 是 route reuse 的 semantic key。

Schema ID：

ahr-query-class/0.1

建議欄位：

{
  "query_class_id": "route:query-class/01J...",
  "schema": "ahr-query-class/0.1",
  "topic": "SOACR",
  "purpose": "verify",
  "fidelity": "exact",
  "scope_kind": "project",
  "time_mode": "current",
  "result_kind": "decision",
  "status": "active"
}

4. QueryClass 維度

第一代至少：

topic
purpose
fidelity
scope_kind
time_mode
result_kind

其中 purpose：

recall
overview
verify
locate
compare
historical
current_state
open_loop
decision

fidelity：

overview
semantic
structured
exact

time_mode：

current
historical
bounded_interval
timeless

5. QueryClass 不等於自然語言句子

不同 query：

我們之前 SOACR 最後定案什麼？
現在 SOACR accepted architecture 是哪版？
找 SOACR current decision

可以 normalize 到同一：

topic=SOACR
purpose=current_state
fidelity=structured
scope_kind=project
result_kind=decision

因此：

\boxed{ \text{Query String} \neq \text{Query Class}. }

6. QueryClass 過度泛化禁止

如果：

purpose=overview

與：

purpose=verify

被合併，會導致錯誤 route reuse。

因此 query class compiler 不得只依 topic。

7. MemoryNeedBinding

Schema ID：

ahr-memory-need-binding/0.1

{
  "object_id": "route:memory-need/01J...",
  "schema": "ahr-memory-need-binding/0.1",
  "query_class_ref": "route:query-class/Q1",
  "resident_ref": "identity:resident/R",
  "line_ref": "rcg:line/L",
  "project_ref": "project:project/P",
  "purpose": "verify",
  "fidelity": "exact",
  "budget": {
    "max_latency_ms": 5000,
    "max_materialized_bytes": 1048576,
    "max_source_reads": 4
  },
  "stop_condition": "authoritative_current_decision_found",
  "created_at": "RFC3339"
}

8. CapabilityEnvelope

Schema ID：

ahr-capability-envelope/0.1

{
  "object_id": "authority:capability-envelope/01J...",
  "schema": "ahr-capability-envelope/0.1",
  "resident_ref": "identity:resident/R",
  "line_ref": "rcg:line/L",
  "task_ref": "project:task/T",
  "project_ref": "project:project/P",
  "capabilities": [
    "memory.read",
    "crystal.reveal",
    "source.expand"
  ],
  "forbidden_capabilities": [
    "memory.write",
    "external.action"
  ],
  "scope_refs": [
    "project:project/P"
  ],
  "capability_revision": 9,
  "valid_from": "RFC3339",
  "valid_to": "RFC3339",
  "status": "active"
}

9. Capability 與 Permission 分離

Capability：runtime 是否能做某類操作。

Permission：此 actor 是否能對某 object / scope 做。

因此：

\boxed{ Capability \neq Permission. }

10. PermissionBinding

Schema ID：

ahr-permission-binding/0.1

{
  "object_id": "authority:permission-binding/01J...",
  "schema": "ahr-permission-binding/0.1",
  "resident_ref": "identity:resident/R",
  "scope": {
    "kind": "project",
    "subject": "project:project/P"
  },
  "permissions": ["read"],
  "permission_revision": 12,
  "authority_basis_refs": ["project:membership/M1"],
  "valid_from": "RFC3339",
  "valid_to": null,
  "status": "active"
}

11. SafeReachableWorld

Safe Reachable World 不必 materialize 成完整 graph。

它可以是：

\boxed{ \mathcal W_t^{safe} = F( Identity, Capability, Permission, Policy, Risk, Revision ) }

實作可用：

predicate filter；
policy engine；
lazy edge guard；
scoped graph partition。

12. SafeWorldDescriptor

Schema ID：

ahr-safe-world/0.1

{
  "object_id": "route:safe-world/01J...",
  "schema": "ahr-safe-world/0.1",
  "resident_ref": "identity:resident/R",
  "line_ref": "rcg:line/L",
  "project_ref": "project:project/P",
  "capability_revision": 9,
  "permission_revision": 12,
  "allowed_scope_refs": [
    "project:project/P",
    "identity:resident/R"
  ],
  "denied_scope_refs": [],
  "policy_revision": 4,
  "risk_profile": "standard_read",
  "created_at": "RFC3339",
  "expires_at": "RFC3339"
}

13. Authorized Path Set

只允許：

\mathcal P_{\mathrm{authorized}}(t) = \{ \Gamma \mid \forall x\in\Gamma, Guard(x,S_t)=PASS \}.

path selector 只能在此集合中 optimization。

14. RouteNodeRef

route node 必須使用 TW-A ObjectRef。

禁止 physical path 作 canonical target。

例：

csg:crystal/C1
mneme:record/R2
source:artifact/S3
project:project/P

15. RouteEdge

每個 logical transition 可有：

from_ref
to_ref
edge_kind
required_capabilities[]
guard
validator
cost_estimate
dependency_refs[]

16. RouteEdgeKind

第一代：

reveal
expand
resolve
project
verify
follow_relation
follow_provenance
select_current
fallback

17. RouteReceipt

Schema ID：

ahr-route-receipt/0.1

{
  "object_id": "route:receipt/01J...",
  "schema": "ahr-route-receipt/0.1",
  "artifact_role": "validated_derived",
  "resident_ref": "identity:resident/R",
  "line_ref": "rcg:line/L",
  "task_ref": "project:task/T",
  "query_class_ref": "route:query-class/Q",
  "route_nodes": [
    "csg:crystal/C1",
    "csg:crystal/C2",
    "mneme:record/R3"
  ],
  "route_edges": [
    "reveal",
    "follow_relation",
    "expand"
  ],
  "used_compiled_route_ref": null,
  "fallback_used": false,
  "latency_ms": 1240,
  "materialized_bytes": 8042,
  "source_reads": 1,
  "validation_result": "pass",
  "result_quality": 0.96,
  "created_at": "RFC3339"
}

18. RouteReceipt 不保存 Hidden Chain-of-Thought

禁止把模型私有 reasoning transcript 當 route evidence。

只保存：

object refs；
externalized actions；
validation；
metrics；
outcome。

因此：

\boxed{ \text{Compiled Path} \neq \text{Stored Chain of Thought}. }

19. NavigationCrystal

Navigation Crystal 是 CSG object。

建議 crystal_kind = navigation_crystal。

內容：

{
  "query_class_ref": "route:query-class/Q",
  "preferred_route_refs": [
    "csg:crystal/C1",
    "csg:crystal/C2",
    "mneme:record/R3"
  ],
  "fallback_kind": "cold_recall",
  "historical_success_rate": 0.94,
  "historical_avg_latency_ms": 1430,
  "status": "candidate"
}

20. NavigationCrystal 與 CompiledRoute 分離

Navigation Crystal：derived semantic routing knowledge。

CompiledRoute：runtime executable optimization。

所以：

\boxed{ NavigationCrystal \neq CompiledRoute. }

21. CompiledRoute

Schema ID：

ahr-compiled-route/0.1

{
  "object_id": "route:compiled/01J...",
  "kind": "compiled_memory_route",
  "schema": "ahr-compiled-route/0.1",
  "artifact_role": "validated_derived",
  "revision": 1,
  "query_class_ref": "route:query-class/Q",
  "scope": {
    "kind": "project",
    "subject": "project:project/P"
  },
  "anchor_ref": "csg:crystal/C1",
  "target_ref": "mneme:record/R3",
  "route_kind": "verification",
  "required_capabilities": [
    "memory.read",
    "crystal.reveal",
    "source.expand"
  ],
  "permission_mode": "revalidate_on_use",
  "authority_basis_kinds": ["project_membership"],
  "source_revision_refs": [
    {"ref": "mneme:record/R3", "revision": 5}
  ],
  "semantic_revision_refs": [
    {"ref": "csg:crystal/C1", "revision": 2}
  ],
  "capability_revision": 9,
  "validator": {"kind": "current_revision_and_scope"},
  "fallback": {"kind": "cold_recall"},
  "risk_class": "low",
  "state": "hot",
  "created_at": "RFC3339",
  "last_validated": "RFC3339",
  "expires_at": "RFC3339"
}

22. Route State Machine

允許：

cold
warm
candidate
hot
stale
revoked
retired
invalid

轉移：

cold \rightarrow warm \rightarrow candidate \rightarrow hot.

失效：

hot \rightarrow stale/revoked/retired.

23. Cold Recall

Cold Recall 可以使用：

CSG reveal；
graph traversal；
FTS；
vector discovery；
source expansion；
canonical resolver；
verification。

Cold Recall 必須在 Safe Reachable World 中執行。

24. Warm Route

Warm Route 不一定是 persistent compiled object。

可以只保存 route statistics + navigation crystal。

25. Candidate Promotion

條件：

reuse_count >= reuse_min
success_rate >= success_min
validation_rate >= validation_min
scope_stability >= scope_min
fallback_available = true

26. PerformanceGate

Schema ID：

ahr-performance-gate/0.1

計算：

U(\ell) = B_{\mathrm{reuse}} + B_{\mathrm{latency}} + B_{\mathrm{context}} + B_{\mathrm{future}} - C_{\mathrm{compile}} - C_{\mathrm{verify}} - C_{\mathrm{maintain}} - C_{\mathrm{select}} - C_{\mathrm{risk}}.

要求：

U(\ell)>0.

27. Break-Even Reuse

若：

C_0

是 compile cost，

C_c

是 cold recall，

C_h

是 hot recall，

則：

n^* = \left\lceil \frac{C_0} {C_c-C_h} \right\rceil.

預期 reuse 小於 $n^*$ 時不 promotion。

28. SecurityGate

Schema ID：

ahr-security-gate/0.1

至少驗：

identity_binding
scope_check
capability_check
permission_check
source_revision_check
semantic_revision_check
guard_preservation
validator_preservation
fallback_safety
prompt_injection_boundary
revocation_dependencies
secret_exclusion

29. 雙 Gate Promotion

只有：

\boxed{ Promote(\ell) = PerformanceGate(\ell) \land SecurityGate(\ell) }

才：

candidate -> hot

30. RouteSelector

Selector input：

MemoryNeedBinding
SafeWorldDescriptor
RouteRegistry
RuntimeProfile
CurrentRevisions

output：

selected_route_ref
or
cold_recall

31. RouteSelector Scoring

可用：

Score(\ell) = \alpha Reliability + \beta Freshness + \gamma Provenance - \delta Latency - \epsilon Risk - \zeta RevocationBurden.

只在 authorized set 中比較。

32. Risk-Adjusted Cost

另一種表示：

C_t(\Gamma) = C_{\mathrm{latency}} + C_{\mathrm{token}} + C_{\mathrm{materialize}} + C_{\mathrm{verify}} + C_{\mathrm{security}} + C_{\mathrm{staleness}} + C_{\mathrm{risk}} + C_{\mathrm{revocation}} + C_{\mathrm{blast}}.

33. Path Optimization 目標

真正求：

\boxed{ \Gamma_t^* = \arg\min_{ \Gamma\in \mathcal P_{\mathrm{authorized}}(t) } C_t(\Gamma) }

不是 hop shortest。

34. Route Kind

第一代 enum：

overview
current_state
decision
exact_source
verification
historical
open_loop
project_state
navigation

35. Static Target

Static target：

historical exact source
specific crystal revision
specific memory record revision

route target 固定 revision。

36. Dynamic Target

Dynamic target：

current accepted decision
current project head
current responsibility

應指向 semantic alias / resolver。

37. SemanticAlias

Schema ID：

ahr-semantic-alias/0.1

例：

{
  "alias_id": "route:alias/soacr-current-architecture",
  "schema": "ahr-semantic-alias/0.1",
  "alias": "project:SOACR/current-architecture",
  "resolver_kind": "current_project_decision",
  "scope": {
    "kind": "project",
    "subject": "project:project/P"
  },
  "current_target_ref": "mneme:record/R9",
  "revision": 6
}

38. Alias 不等於 Filename Heuristic

alias 必須 registry-backed。

禁止：

find "current_final_latest.md"

當 semantic alias。

39. Route Composition

若：

\ell_1:A\rightarrow B

與：

\ell_2:B\rightarrow C,

可編：

\ell^*=A\Rightarrow C.

但必須保留 underlying guards / validators / provenance。

40. CompositeRoute Schema

增加：

underlying_route_refs[]
underlying_edge_refs[]

禁止因 compression 消失 guard。

41. Decompression

任何 composite route 必須：

Decompress(\ell^*) \rightarrow UnderlyingRoute.

42. Permission-Aware Edge

每個 edge 可帶：

{
  "required_capabilities": [],
  "required_permissions": [],
  "allowed_scope_kinds": [],
  "denied_scope_refs": [],
  "guard_kind": "scope_and_revision"
}

43. Edge Authorization

只有：

Guard(e,S_t)=PASS

才加入 actor-specific traversal graph。

44. Metadata ACL

edge existence 也可能敏感。

所以 unauthorized edge 不應參與 selector ranking。

45. Derived Crystal ACL

若：

C^* = K(C_1,\ldots,C_n),

第一代保守：

\boxed{ A(C^*) \subseteq \bigcap_i A(C_i). }

46. Route Scope

CompiledRoute 必須有：

line
project
resident
shared
relationship
public

scope promotion 需要重新 security gate。

47. Line-Scoped Route

只對：

line_ref

生效。

48. Project-Scoped Route

不同 lines 可共享 project route。

49. Resident-Scoped Route

只有長期穩定 recall pattern 才可 promotion。

50. Cross-Resident Route

第一代只允許：

shared
relationship
public

scope。

不得指向另一 resident private memory。

51. Cross-Resident Delegation Route

如果未來啟用：

delegation_ref
delegation_expiry
delegated_scope

全部綁 route。

52. Capability Attenuation

delegated route 所需 capability：

Req(\ell) \subseteq Cap_{\mathrm{delegated}}.

53. RouteExecutor

執行步驟：

load route；
check state；
resolve current identity；
check capability revision；
check permission revision；
check source revisions；
check semantic revisions；
evaluate guards；
resolve logical target；
materialize；
validate；
emit receipt。

54. Route Cache Key

第一代：

K_{\ell} = ( residentId, lineId, projectId, queryClass, capabilityRevision, permissionRevision, sourceRevisionDigest, semanticRevisionDigest ).

55. Route Cache

只 cache：

resolved ObjectRef；
representation；
bounded projection；
route metadata。

不得 cache raw credential。

56. Cache State

valid
stale
revoked
expired
invalid

57. Cache TTL

依 risk class：

public_long
project_medium
private_short
critical_none_or_very_short

58. Permission Cache

可以 cache decision，但 key 必須含：

permission_revision
scope
resident
task/project

59. TOCTOU Recheck

高風險 materialization 在 use 前需重新 authorize。

不能只在 session start 檢查。

60. FallbackPolicy

Schema ID：

ahr-fallback-policy/0.1

允許：

warm_route
semantic_reveal
project_search
source_search
cold_recall
deny

61. Failure Classification

technical：

not_found
resolver_error
cache_miss
route_stale
target_superseded
backend_unavailable

authority：

unauthorized
permission_revoked
resident_unresolved
scope_mismatch
capability_denied
delegation_expired

62. Technical Failure

可：

FallbackToSafeSlowPath.

63. Authority Failure

必須：

\boxed{ Deny. }

不能 broader search。

64. Unknown Schema

identity / authority / route security dependency unknown：

fail_closed

65. Unknown Target Revision

dynamic alias 可 resolve current。

static route 必須 fail / stale。

66. Target Superseded

static route：

stale

dynamic route：

resolve alias -> new target

67. RouteRepair

Schema ID：

ahr-route-repair/0.1

可更新：

target revision；
alias binding；
validator；
dependency refs。

repair 後需重新雙 gate。

68. RouteRegeneration

若 route structure 已失效：

retire old route
cold recall
learn new route

69. RouteMetrics

Schema ID：

ahr-route-metrics/0.1

{
  "route_ref": "route:compiled/X",
  "uses": 42,
  "successes": 40,
  "failures": 2,
  "fallbacks": 3,
  "avg_latency_ms": 340,
  "avg_materialized_bytes": 4200,
  "avg_source_reads": 0.2,
  "last_used": "RFC3339",
  "last_validated": "RFC3339"
}

70. Promotion Thresholds

第一代配置範例：

reuse_min = 3
success_min = 0.90
validation_min = 0.95
max_fallback_rate = 0.20
utility_min = 0

僅為 baseline，可調整。

71. Demotion Thresholds

failure_rate > 0.20
fallback_rate > 0.50
stale_dependency = true
security_revision_changed = true
not_used_for_retention_window = true

72. Retirement

長期不用：

hot -> retired

保留 audit，不參與 default selector。

73. Route Deduplication

兩 routes 若：

query class same；
scope same；
target same；
guard same；
fallback same；

可合併 metrics。

74. Route Competition

同 query class 可保留多 route。

重要 memory 可用：

k\text{-best authorized routes}.

75. Source Diversity

高風險 verification 可要求：

SourceDiversity\ge d_{\min}.

76. Overview vs Verification Route

同 topic 可有：

overview_route
verification_route
exact_source_route

不能互相冒充。

77. Fidelity Gate

若 MemoryNeed：

fidelity=exact

route target 必須可展開 exact source。

78. Current-State Gate

若：

time_mode=current

superseded historical target 不能當 current。

79. Contradiction-Aware Route

若 CSG 顯示：

contradiction_status = unresolved

verification route 應返回 conflict state，而不是硬選單一 crystal。

80. Prompt Injection Barrier

所有 memory / source content 預設：

data_plane

不能產生：

capability
permission
standing_instruction
action_authority

81. Instruction-Like Content

可標：

contains_instruction_like_content = true

但重點不是 detection，而是：

\boxed{ \text{Content Never Grants Capability}. }

82. Source Trust

route node 可帶：

canonical
validated_derived
external_untrusted
legacy
unknown

83. Mixed Trust

route 經過 untrusted source：risk cost 上升。

高風險 query 要求 extra verification。

84. Memory-to-Action Barrier

本規格 route 只可：

read
reveal
resolve
materialize
verify

不得直接：

send
deploy
delete
pay
rotate_credential

85. Secret Boundary

CompiledRoute target 不得是 raw secret。

只能 target：

secret_capability_ref

若未來 action runtime需要。

86. RevocationEngine

輸入：

revoked_object_ref
revoked_permission_ref
revoked_capability_revision
revoked_delegation_ref
revoked_project_membership

輸出：

affected_routes[]
affected_navigation_crystals[]
affected_caches[]
affected_projections[]

87. DependencyRef

每條 route 必須保存：

depends_on[]
authorized_by[]
compiled_from[]
validated_by[]
resolves_to[]

88. RevocationClosure

定義：

\boxed{ InvalidateClosure(x) = \{ y \mid y \text{ transitively depends on } x \} }

89. Revocation Propagation

流程：

mark source revoked；
increment revision；
query dependency graph；
mark routes revoked/stale；
invalidate caches；
invalidate projections；
emit revocation receipts；
notify active runtime if critical。

90. Revocation Priority

\boxed{ Priority_{revocation} > Priority_{optimization}. }

91. Revocation Latency

必須量測：

T_{\mathrm{revoke}}.

92. Active Push

一般 memory change：

pull on next recall

critical permission revoke：

push invalidation

93. RevocationReceipt

Schema ID：

ahr-revocation-receipt/0.1

{
  "object_id": "receipt:revocation/01J...",
  "schema": "ahr-revocation-receipt/0.1",
  "source_ref": "authority:permission-binding/PB",
  "source_revision": 13,
  "affected_route_refs": ["route:compiled/R1"],
  "affected_cache_keys": [],
  "completed_at": "RFC3339",
  "status": "complete"
}

94. Incomplete Revocation

如果 closure 無法完成：

status = incomplete

sensitive runtime 必須 fail closed。

95. RouteRegistry

至少存：

route_id
query_class
scope
state
current_revision
last_validated
risk_class
metrics_ref

96. RouteRegistry 不是 Authority Store

Registry 只是 route inventory。

permission 仍從 authority plane 取得。

97. Semantic Alias Registry

dynamic routes 可透過 alias registry 找 current target。

alias binding 需 versioned。

98. Alias Revocation

alias target 被移除：route stale。

99. RouteAuditReceipt

Schema ID：

ahr-route-audit/0.1

{
  "object_id": "receipt:route-audit/01J...",
  "schema": "ahr-route-audit/0.1",
  "route_ref": "route:compiled/R",
  "resident_ref": "identity:resident/A",
  "query_class_ref": "route:query-class/Q",
  "authorization_result": "pass",
  "execution_result": "pass",
  "target_ref": "mneme:record/M",
  "used_at": "RFC3339"
}

100. Sensitive Audit

audit log 也有 scope，不得 public-by-default。

101. Performance Receipt

promotion 時保存：

historical_cold_latency
historical_hot_latency
expected_reuse
break_even
utility

102. Security Receipt

promotion 時保存：

identity_gate
capability_gate
permission_gate
scope_gate
revision_gate
fallback_gate
prompt_injection_gate
revocation_dependency_gate
result

103. PromotionReceipt

只在 performance + security 都 pass 時生成。

104. PathCompiler Input

query_class
route_receipts[]
navigation_crystal_ref
runtime_profile
scope
current_revision_set

105. PathCompiler Output

candidate_route
performance_report
security_report
dependency_set
fallback_policy

106. Deterministic Core

PathCompiler 的以下部分應 deterministic：

schema；
route normalization；
revision binding；
scope；
dependency；
fallback；
capability checks；
permission checks；
digest；
state transition。

LLM 只可提出 candidate route / query class suggestion。

107. Semantic Proposal / Deterministic Commit

LLM \rightarrow RouteProposal \rightarrow DeterministicValidation \rightarrow Commit.

108. No Hidden Route Mutation

runtime 不得在 route execution 時偷偷改 compiled route。

route repair 需 explicit new revision。

109. Route Revision

每次 repair / promotion：

revision_{t+1} = revision_t+1.

110. Route History

舊 route revision 可 archive。

current registry 指 current revision。

111. Cross-Model Portability

CompiledRoute 不依賴特定 hidden reasoning。

只要另一 model / runtime 支援 schema 與 capability，即可執行。

112. Cross-Runtime Portability

Web / Agent：同 ObjectRef、QueryClass。

不同 capability profile 可能導致：

route executable
route unavailable
fallback required

113. Cross-Provider Portability

如果 route target 是 logical ObjectRef：provider change 不破壞。

provider-native target 需 adapter。

114. Provider-Native Route

如果 target：

opaque/provider-native

route 需：

provider_requirement
adapter_requirement

115. Offline Profile

offline route 不得需要：

network
remote_api
cloud_source

116. Online Profile

online 可有更多 route，但 permission 不自動擴張。

117. Web Profile

第一代 Web：

single resident
read-only memory routes
project/resident scopes
no cross-resident private routes
no action routes

118. Agent Profile

第一代 Agent：

multi-line
local filesystem route
local DB route
MCP resource route
delegated project read route

仍不開 unrestricted action hyperlinks。

119. Route Store Layout

建議：

routes/
├─ query-classes/
├─ receipts/
├─ navigation/
├─ candidates/
├─ compiled/
├─ metrics/
├─ revocations/
├─ aliases/
└─ archive/

120. Route File Format

第一代：

QueryClass：JSON
RouteReceipt：JSONL
CompiledRoute：JSON
Metrics：JSON
RevocationReceipt：JSONL
Alias：JSON
Dependency index：SQLite / JSONL source

121. Route Dependency Index

derived index：

source_ref -> route_refs[]
permission_ref -> route_refs[]
capability_revision -> route_refs[]
alias_ref -> route_refs[]

可重建。

122. Invalidation Lookup

優先使用 dependency index。

若 index stale：fallback scan canonical route metadata。

123. Route Cache Storage

cache derived，可丟。

不需進 Git / canonical snapshot，除非測試。

124. Snapshot

Compiled routes 可以放 snapshot derived/。

不能列為 canonical memory truth。

125. Restore

restore route store 後仍須 current revisions revalidate。

126. Migration

Route schema migration 需：

source version；
target version；
loss report；
security revalidation；
migration receipt。

127. Unknown Route Schema

不得執行。

可 archive opaque。

128. Route Security Levels

第一代：

public
project
resident_private
shared
relationship
critical

129. Critical Route

critical memory route 要求：

exact source capable；
short TTL；
strict permission recheck；
audit；
no silent fallback to lower fidelity。

130. Public Route

public route authority burden 低，但 trust / injection 仍檢查。

131. Shared Route

shared route 需要 explicit shared scope。

132. Relationship Route

relationship scope 可能 asymmetric。

route directional。

133. Asymmetric Permission

Share(A,B) \neq Share(B,A).

route direction 必須保存。

134. Time-Bounded Route

route 可有：

valid_from
valid_to

超過時間 stale。

135. One-Time Route

可加：

max_uses = 1

使用後 retired。

136. Rate-Limited Route

max_uses_per_hour

由 runtime guard enforcement。

137. Budget-Limited Route

max_source_reads
max_materialized_bytes
max_latency_ms

超過就 fallback / stop。

138. Stop Condition

route 可包含：

authoritative_source_found
confidence_threshold
current_head_resolved
budget_exhausted

139. Infinite Recall Loop 防止

每次 recall 必須有 stop condition。

route executor 需 max hops / max expansions。

140. Max Hop

設定：

max_route_hops

避免 graph cycle。

141. Cycle Detection

route traversal 需 visited set。

compiled route 不得含未標明 loop。

142. Retry Policy

technical retry 需：

max_retries
backoff
idempotent_only

memory read 通常可 retry。

143. Non-Idempotent Action 不在本規格

因此第一代避免 retry side-effect 問題。

144. Selection Congestion

若 route 數大，需要 hierarchical selector：

Resident \rightarrow Project \rightarrow QueryClass \rightarrow Route.

145. Route Partition

第一代 partition key：

resident_id
scope_kind
scope_subject
query_class_id

146. Route GC

retired route 可 archive。

physical delete 需：

no audit hold；
no active dependency；
retention 允許。

147. Route Drift

query class 語義改變時，route 需 reclassify / retire。

148. QueryClass Revision

QueryClass itself versioned。

route 綁 query class revision。

149. QueryClass Migration

若 query class ontology 調整，route 全部 re-evaluate。

150. MemoryNeed Drift

同一 query class 但 fidelity 要求提高，old route 可能不夠。

selector 需 compare requirement。

151. Validation Kinds

第一代 validator：

revision_match
scope_match
current_head
digest_match
source_exists
semantic_relation_valid
provenance_complete
exact_fidelity

152. Guard Kinds

第一代 guard：

identity_resolved
scope_allowed
capability_present
permission_current
not_revoked
source_trust_min
runtime_profile_supported

153. Composite Guard

AND composition：

Guard(\ell) = \bigwedge_i Guard_i.

第一代不支援模糊 OR bypass。

154. Deny Overrides

如果 allow / deny conflict：

\boxed{ Deny>Allow. }

第一代保守。

155. Policy Precedence

建議：

host policy
organization policy
runtime policy
resident authority
project delegation
task capability
memory data
external content

下層不能擴張上層限制。

156. No Authority Through Naming

route 名稱：

admin_route
approved_route

不影響 authorization。

157. No Authority Through Historical Use

上次 route 成功：

\not\Rightarrow

本次 permission 仍有效。

158. No Authority Through Cached Target

cache target 存在不代表可讀。

159. No Authority Through Familiarity

模型熟悉內容不代表有 current read permission。

160. No Authority Through Resident Label

display label 不是 resident binding。

161. No Authority Through Project Name

同名 project 不等於同 scope。

162. Security Error Classes

identity_unresolved
identity_conflicting
permission_denied
permission_revoked
capability_missing
scope_mismatch
delegation_expired
policy_denied
secret_boundary
unsafe_fallback
unknown_security_schema

163. Metadata Hiding

對 unauthorized object 是否回：

not_available

而不是：

exists_but_forbidden

依 profile。

164. Safe Error Message

錯誤不洩漏 private project name。

165. Acceptance Matrix：Path Compilation

P01 — Cold Recall Baseline

無 route store 仍可 recall。

P02 — Receipt Formation

成功 recall 產 route receipt。

P03 — Query Class Normalization

同義 query 可同 class。

P04 — Purpose Separation

overview / verify 不混。

P05 — Candidate Promotion

達 threshold 形成 candidate。

P06 — Performance Gate

utility 不正不得 hot。

P07 — Security Gate

security fail 不得 hot。

P08 — Hot Route

hot path 降低 latency / source reads。

P09 — Composite Decompression

route 可還原 underlying path。

P10 — Route Rebuildability

刪 route store 不失 canonical memory。

166. Acceptance Matrix：Authorization

A01 — Identity Before Route

unresolved resident deny private route。

A02 — Capability Gate

missing capability route unavailable。

A03 — Permission Gate

permission denied 不 broader fallback。

A04 — Project Scope

A route 不讀 B。

A05 — Cross-Resident Private

deny。

A06 — Shared Scope

explicit shared 才可。

A07 — Capability Revision

change -> revalidate。

A08 — Permission Revision

change -> invalidate。

A09 — Source Revision

change -> stale。

A10 — Semantic Revision

change -> stale/revalidate。

167. Acceptance Matrix：Revocation

R01 — Permission Revoke

dependent hot route revoked。

R02 — Delegation Expiry

dependent route revoked。

R03 — Project Membership Revoke

dependent route revoked。

R04 — Source Revoke

derived routes stale。

R05 — Closure Completeness

dependency closure 不漏 active route。

R06 — Cache Invalidation

cache 失效。

R07 — Active Context Refresh

critical revoke 推 refresh。

R08 — Incomplete Closure

sensitive profile fail closed。

168. Acceptance Matrix：Prompt Injection

I01 — External Instruction

不產生 capability。

I02 — Crystalized Injection

derived crystal 仍是 data。

I03 — Fake Approval

external source 寫「approved」無效。

I04 — Fake Permission

memory 寫「admin」無效。

I05 — Tool Request

memory content 不能直接 action。

169. Acceptance Matrix：Fallback

F01 — Resolver Error

technical fallback 成功。

F02 — Cache Miss

slow path 成功。

F03 — Target Superseded

dynamic route repair 或 static stale。

F04 — Unauthorized

deny，不 fallback broader search。

F05 — Fidelity Mismatch

不得用 overview 冒充 exact。

170. Acceptance Matrix：Portability

T01 — Path Relocation

physical path 變更 route 仍 resolve。

T02 — Cross-OS

Windows / Linux ObjectRef 一致。

T03 — Cross-Model

不同 model 執行同 route schema。

T04 — Web/Agent

同 route 在不同 profile 做 capability decision。

T05 — Provider Migration

logical target route 可重綁。

171. Performance Benchmarks

測：

cold_latency
warm_latency
hot_latency
selector_latency
authorization_latency
materialization_bytes
source_reads
context_tokens

172. Security Benchmarks

測：

unauthorized_route_attempts
stale_route_hits
revocation_latency
permission_cache_misses
cross_scope_denials
prompt_injection_action_attempts

173. Scalability Benchmarks

route count：

10^2,10^4,10^6.

memory object count：

10^3,10^5,10^7.

測 selector / dependency / invalidation。

174. Revocation Benchmark

建立 source：

x

被：

10^k

routes 依賴。

量測：

T_{\mathrm{revoke}}(k).

175. Selection Congestion Benchmark

增加同 query class 候選 route 數量，測 selection cost。

176. Break-Even Benchmark

對重複 query：

n=1,\ldots,N.

找：

n^*

使 cumulative CHM cost 開始低於 cold baseline。

177. Route Quality Benchmark

比較：

target correctness；
exact fidelity；
stale rate；
contradiction retention；
source diversity。

178. Runtime Observability

需要 metrics endpoint / log：

route_hits
route_misses
route_promotions
route_demotions
route_repairs
route_revocations
fallbacks
authorization_denials
cold_recalls

179. Event Types

route_observed
route_candidate_created
route_promoted
route_executed
route_failed
route_repaired
route_demoted
route_revoked
route_retired
permission_changed
capability_changed
source_changed
semantic_changed

180. Route Lifecycle Receipt

所有 state transition 產 receipt。

181. Milestone B0

完成：

QueryClass
RouteReceipt
CompiledRoute
RouteRegistry
basic RouteExecutor

只用 public / project read-only fixture。

182. Milestone B1

增加：

CapabilityEnvelope
PermissionBinding
SafeWorldBuilder
authorization guards
revision binding

183. Milestone B2

增加：

PerformanceGate
SecurityGate
route promotion
route demotion
route metrics

184. Milestone B3

增加：

RevocationEngine
DependencyIndex
Cache invalidation
critical push

185. Milestone B4

增加：

NavigationCrystal integration
query-class learning
route repair
semantic aliases
composite route

186. Milestone B5

跨 runtime：

Web profile
Agent profile
cross-model route execution
cross-provider logical target resolution

187. 首代不實作

action hyperlinks
credential routes
registrar writes
automatic declassification
irreversible external effects
cross-resident private writes
resident merge

188. Runtime Profiles

WebAHR/0.1

single_resident
read_only
project/resident memory
no cross-resident private
no action hyperlink

AgentAHR/0.1

multi-line
local source routes
MCP resource routes
delegated project reads
no unrestricted action hyperlink

189. Config Baseline

範例：

{
  "profile": "AgentAHR/0.1",
  "route_limits": {
    "max_hops": 12,
    "max_retries": 2,
    "max_candidates_per_query_class": 8
  },
  "promotion": {
    "reuse_min": 3,
    "success_min": 0.9,
    "validation_min": 0.95
  },
  "security": {
    "deny_overrides": true,
    "revalidate_permission_on_use": true,
    "revalidate_identity_on_private_route": true
  }
}

190. 參考 Route Execution Pseudocode

execute(memory_need):
    identity = resolve_identity()
    if identity != resolved:
        deny_private()

    capabilities = load_capability_envelope()
    permissions = load_permission_bindings()
    safe_world = build_safe_world(identity, capabilities, permissions)

    query_class = classify(memory_need)
    route = select_authorized_route(query_class, safe_world)

    if route is None:
        return cold_recall(memory_need, safe_world)

    if not revisions_match(route):
        route = revalidate_or_demote(route)

    if not authorize_route(route, safe_world):
        deny()

    try:
        result = execute_route(route)
    except TechnicalFailure:
        result = safe_fallback(route, memory_need, safe_world)

    validate(result)
    emit_route_receipt()
    return result

191. PathCompiler Pseudocode

compile(query_class, receipts):
    normalized = normalize_receipts(receipts)
    candidate = extract_stable_route(normalized)

    performance = performance_gate(candidate)
    security = security_gate(candidate)

    if not performance.pass:
        return warm_route

    if not security.pass:
        return rejected_candidate

    compiled = build_compiled_route(candidate)
    store(compiled)
    emit_promotion_receipt()
    return compiled

192. Revocation Pseudocode

revoke(source_ref):
    mark_source_revoked(source_ref)
    affected = dependency_closure(source_ref)

    for object in affected:
        if object.kind == compiled_route:
            mark_revoked(object)
        if object.kind == cache:
            delete(object)
        if object.kind == projection:
            mark_stale(object)

    emit_revocation_receipt()
    notify_active_runtime_if_critical()

193. 安全不變式

HR-1

\boxed{ Reachable \neq Authorized. }

HR-2

\boxed{ Authorized \neq Trusted. }

HR-3

\boxed{ Capability \neq Permission. }

HR-4

\boxed{ PathCompilation \neq PermissionCompilation. }

HR-5

\boxed{ MemoryData \neq ActionAuthority. }

HR-6

\boxed{ Summarization \neq Declassification. }

HR-7

\boxed{ TechnicalFail \Rightarrow SafeFallback. }

HR-8

\boxed{ AuthorityFail \Rightarrow Deny. }

HR-9

\boxed{ Revoke(x) \Rightarrow InvalidateClosure(x). }

HR-10

\boxed{ FasterPath \not\Rightarrow GreaterAuthority. }

194. Performance 不變式

HP-1

\boxed{ ObservedRoute \not\Rightarrow CompiledRoute. }

HP-2

\boxed{ U(\ell)>0 }

才值得 promotion。

HP-3

\boxed{ Delete(RouteStore) \not\Rightarrow Loss(CanonicalMemory). }

HP-4

\boxed{ HotPath \text{ must have fallback}. }

HP-5

\boxed{ CompiledPath \rightarrow AuditableProvenance. }

195. 與 TW-A 的接口

TW-B 不重新定義：

ArtifactAddress
ObjectRef
revision
digest
scope
resolver
schema registry
canonical source map

而是直接使用。

CompiledRoute target_ref 必須是 TW-A ObjectRef。

196. 與 LIMEN 的接口

LIMEN 提供：

resident_ref
line_ref
task_ref
identity_status
authority_revision

AHR 不自行 resolve identity。

197. 與 MNEME 的接口

MNEME 提供：

canonical memory objects
memory heads
provenance
exact source expansion

AHR 只加速定位。

198. 與 SOACR 的接口

SOACR 提供：

MemoryNeed
purpose
fidelity
scope
budget
stop_condition

AHR 由此選 query class / route。

199. 與 CSG 的接口

CSG 提供：

semantic crystals
relations
higher-order crystals
navigation crystals
semantic revisions

200. 與 MRMIC/NVCL 的接口

可用：

provider resource ref
runtime presence
principal binding
workspace/task mapping

但 resource projection 不改 resident authority。

201. 與 UNPNP 的接口

本規格將 UNPNP Path Compilation 具體化為 memory-domain runtime：

\boxed{ \text{Repeated Recall Computation} \rightarrow \text{Validated Route} \rightarrow \text{Compiled Hyperlink} }

並保留 complexity transfer：

\boxed{ \text{Complexity is transferred, not destroyed}. }

202. 第一代交付物

實作完成後至少應有：

schemas/
route-registry/
query-classes/
route-receipts/
compiled-routes/
metrics/
revocation/
fixtures/
tests/
acceptance/

203. 必要 Schema 清單

ahr-query-class/0.1
ahr-memory-need-binding/0.1
ahr-capability-envelope/0.1
ahr-permission-binding/0.1
ahr-safe-world/0.1
ahr-route-receipt/0.1
ahr-compiled-route/0.1
ahr-performance-gate/0.1
ahr-security-gate/0.1
ahr-fallback-policy/0.1
ahr-route-repair/0.1
ahr-route-metrics/0.1
ahr-revocation-receipt/0.1
ahr-route-audit/0.1
ahr-semantic-alias/0.1

204. 最終工程結論

AHR/PCR 的真正目的不是讓 AI「跳過更多步驟」，而是將反覆成功、可驗證、可授權、可失效的記憶路徑轉成 runtime primitive。

因此一條好的 compiled route 必須同時回答：

這條路針對哪類 MemoryNeed？
它從哪裡開始？
它到哪裡？
它需要哪些 capability？
它適用哪個 scope？
它依賴哪些 permission？
它綁哪些 source / semantic revisions？
它如何驗證？
它何時失效？
失效時 fallback 去哪？
哪些 revocation 會影響它？
它為什麼值得被編譯？
它能否被 audit / decompress？

因此最終 runtime 關係是：

\boxed{ \text{Memory Need} \rightarrow \text{Authorized Reachable World} \rightarrow \text{Best Valid Route} \rightarrow \text{Materialized Memory} }

而長期學習關係是：

\boxed{ \text{Repeated Valid Recall} \rightarrow \text{Navigation Knowledge} \rightarrow \text{Selective Path Compilation} }

最後的安全底線是：

\boxed{ \text{Path optimization may reduce computation, but it may never reduce authorization requirements}. }

以及：

\boxed{ \text{Revocation must remain stronger than cached acceleration}. }

這使 Named-AI Cognitive Runtime 可以隨長期記憶增長逐漸「學會怎麼回想」，而不是讓記憶規模越大，AI 每一次 recall 都重新進行一次全域搜尋。

Appendix A — 第一代 Route State

cold
warm
candidate
hot
stale
revoked
retired
invalid

Appendix B — 第一代 Route Kind

overview
current_state
decision
exact_source
verification
historical
open_loop
project_state
navigation

Appendix C — 第一代 Failure Classes

not_found
resolver_error
cache_miss
route_stale
target_superseded
backend_unavailable
unauthorized
permission_revoked
resident_unresolved
scope_mismatch
capability_missing
delegation_expired
unknown_schema
validation_failed

Appendix D — 與 TW-A 合併後的核心工程鏈

\boxed{ \text{ObjectRef} \rightarrow \text{Resolver} \rightarrow \text{Authorized Route} \rightarrow \text{Materialization} \rightarrow \text{Validation} \rightarrow \text{Receipt} }

這構成 Residence / CSG Storage 與 Authorized Hyperlink Runtime 的第一代共同工程基礎。