AGNN Co-Learning — Objectives ↔ Capabilities ↔ Floor (combined ground-truth map)

AGNN Co-Learning — Objectives ↔ Capabilities ↔ Floor (combined ground-truth map)

Date: 2026-07-04
Status: Concept-design map. NOT execution; closes nothing (CLAUDE.md §1).
Authorship: Combined document authored by Claude, merging two independent parallel iterations:

• the GPT iteration delivery/AGNN-CO-LEARNING-CAPABILITY-GROUND-TRUTH-2026-07-04.md (PR #1782) — the

actionable arena-contract spine, build sequence, and backlog;

• the Claude iteration delivery/AGNN-OBJECTIVES-CAPABILITIES-FLOOR-MAP-claude-2026-07-04.md — the

four-layer spine, the verified game-player brick data, and the honesty ledger.

Both iterations were reconciled against source. Where they agreed on a code-truth claim it is marked
[consensus]; every code claim below was verified this session (triage noted at the end).

§3b enrichment (2026-07-04 PM): the builder session (which trained the §3 bricks) added its
same-day measured results — four new bricks (AGNN-4A/4C/5/6), the first deployed consumer surface
(fold-gate), the forge principle (design rule 10), and backlog rows AGNN-14..16. §3b numbers are
locally measured, not quoted.

0. How to read this document

Four layers, one spine. For any capability, read top-to-bottom:

L0 OBJECTIVE      why the platform exists      (quality compounds with usage)
   │ requires
L1 CAPABILITY     an arena: graph + 2 players + a settleable outcome
   │ powered by
L2 GROUNDED CRITIC a brick (state graph + learning family) trained on real outcomes
   │ settled by
L3 FLOOR          a mechanical, non-LLM signal (test / telemetry / retrieval / exploitability)

The one law (both iterations, independently): a capability is real only where an L3 mechanical
settlement signal exists or can be created. No floor signal → it is theater, no matter how good the
model looks. Corollary: the substrate is the referee, never a player; the signed Guardian
GatePolicy is immutable-by-swarm.

1. L0 — Objective (the why)

From the operating ideology (delivery/OPERATING-IDEOLOGY.md, CLAUDE.md §0): no one already knows
what "good" is; decisions belong to collaboration + learning, informed by ground-truth signals; every
attempt — pass or fail — is captured for its lesson.

Operationalized as a single product north-star:

A platform whose quality curve slopes UP with its own usage — every unit of work makes the next

cheaper, safer, and better. Static systems have a flat quality curve; only paired learners settled

on ground truth produce a rising one. This is "living AI" made mechanical.

Adversarial co-learning is the engine that delivers this objective. The security red/blue wargame is
one instance of the engine, not the engine itself.

2. The reusable capability — the Arena Factory (L1/L2 abstraction)

The useful capability is not "a GNN that plays games." It is a repeatable arena:

state graph -> competing player policies -> isolated side-lane trial -> mechanical settlement
            -> OutcomeEvent / ObjectiveScore -> governed promotion or rejection

Every arena names: explicit players, an explicit state graph, isolated side-lane execution, a
mechanical settlement signal, canonical telemetry, a strong scripted baseline, and operator-controlled
promotion. Neural or LLM players may compete; *substrate, Guardian, operator policy, and mechanical
settlement decide.*

Terminology

3. L2 — The bricks (verified game-player ground truth)

Source: Confluence GNN Game-Players — Autonomous Build Showcase (Tic-Tac-Toe → Chess → Poker)
(space MD, page 1426128897, v1 2026-07-04), read via the Atlassian REST API. All results measured
against oracles and logged; 38 unit tests green; failures kept. (Note: the GPT iteration could not
read this page — WAF/login redirect — and worked from the operator excerpt; this section is the
Claude contribution that grounds it.)

One architecture, three learning families. State of each game = a graph; the player = a small
message-passing GNN; two agents learn by playing. What changes per game is the learning math:

The mortar (the proven method, ran 4×): iterate with failures kept → measure against an oracle →
swarm-review → fold → re-verify.

The load-bearing discipline — the ruler rule: the showcase's two most valuable findings were bugs
in the metrics, not the learners (a clairvoyant best-response metric with a ~0.5 exploitability
floor; a deterministic-replay eval that was one game played 200×). Rule adopted, and binding for every
arena below: *validate every new metric against a known fixed point (a known-optimal strategy must
score optimal; a known-bad one must score bad) before gating anything on it.*

Honest caveats carried from the showcase: "chess" = beats a random mover with real checkmates, not
club strength; Leduc is converging toward Nash (0.274), not at it; review panels were single-family
(Claude) — genuine cross-family verification was not run for that scratchpad project.

3b. Session additions — 2026-07-04 PM (verified this session, builder session)

Authored by the builder session (the one that trained the §3 bricks). Everything below was run and
measured today AFTER this document's first merge; log/weight paths are in the session scratchpad
(gnn-games/), which IS present on the builder-session host — the appendix note "not present" reflected the
authoring host of the first merge, not this one.

New bricks (each removes a crutch the §3 bricks leaned on)

§3b bricks → capability spine (mapping, added on reconciliation)

Each §3b brick is a mutation of a §3 learning family onto a new arena. Naming note: these are *brick
names (AGNN-4A/4C/5/6); the zero-padded AGNN-01..16 in §9 are backlog work-items* — related
but distinct labels, do not conflate.

First deployed consumer surface (demo-grade, stated plainly)

agnn-service on local-service (loopback-bound, scratchpad-hosted — *demo deployment, NOT
production*; promotion to services/ requires a ticket + supervisor): every response carries the
model's evidence metadata, so a consuming agent knows what guarantee it leans on. Endpoints for all
§3/§3b bricks plus the first operator-defined function:

• /v1/discussion/gate — the contribution fold-gate (operator use case, verbatim intent: "like

poker, agents without a valid card fold — a smooth discussion board, not chatter"). Mapping: private
card = point strength; public card = emerged consensus (pair = my evidence supports it); prior bets =
substantive contributions already made (raises the entry bar); fold / brief-ack / contribute.
Live 6-reviewer panel demo: 12 potential messages → 4 substantive + 4 brief acks. Equilibrium (not a
threshold) because thresholds are exploitable by self-score inflation and the Nash bluff rate is
built-in exploration — quiet voices are never hard-silenced. *v1 path: train the gate on real
swarm-run graphs labeled by contributions-that-survived-into-folded-verdicts (maps to AGNN-06
meta-review and AGNN-04 HITL-reward rows).*

The forge principle (operator, 2026-07-04 — binding for CAP-8 composition)

Not every element in a blueprint is an AGNN. Most components are simple deterministic functionality —

"a forge that makes body parts from metal." Existing Cortex/Conduir functions hold as-is.

Corollary to the one law: learning must earn its slot. A blueprint component is an AGNN only where
an L3 settlement signal exists AND a scripted/deterministic baseline measurably loses (AGNN-6 above is
the rule firing in practice — baseline won, no neural endpoint shipped). The CAP-8 composer treats
deterministic units and learned units uniformly through typed ports + attached evidence metadata; the
learned composer searches combinations, but the parts list stays mostly forged, not learned.

4. L3 — The floor: signals that already flow vs the gaps

The leverage: most settlement signals a critic needs already flow. The work is the learner over
them, plus turning on the two inert loops.

5. Capability Build Matrix (two-axis: leverage verdict × implementation status)

Leverage verdict = how much ceiling it raises. Implementation status = LIVE / INERT / STUB /
HYPOTHESIS / TRUE-ROOT / RESHAPE-DEFERRED. They are different axes; both shown.

Product capabilities

Cross-cutting arenas (the frame the CAP list never named)

6. Non-negotiable design rules (both iterations)

1. Mechanical settlement over LLM self-grading. LLMs may be players; reward is settled by code /
tests / sandbox / telemetry / operator decision / signed security evidence.
2. Validate every metric against a known fixed point before gating on it (the ruler rule, §3).
3. Substrate (CAP-9) is the referee, not a player. ActorContext, OutcomeEvent, tenant isolation,
audit chain, path maturity, policy gates stay outside self-mutation.
4. Guardian GatePolicy is immutable-by-swarm. Red/blue panels may learn; signed policy and
production enforcement are operator/substrate authority.
5. Side-lane isolation is mandatory. New/learned policies start as shadow or side-lane.
6. Strong scripted baselines required. CAGE-4 showed heuristics can beat MARL; neural players must
beat practical baselines, not weak opponents.
7. Adaptive attacks required for graph defenses. Homophily pruning and trimmed-mean aggregation
are not sufficient standalone (2024–2026 literature).
8. No capability claim without a settlement signal. Every claim names a metric and a replayable
evidence source.
9. Grounded critic ≠ LLM. The model that has run the ground truth feeds the LLM; the LLM presents
to the operator; the operator decides. The LLM is never the source of the verdict.
10. The forge principle (operator, 2026-07-04). Most blueprint components are deterministic
functionality, not learners; existing Cortex/Conduir functions hold as-is. A learned component
must beat its scripted baseline on an L3 signal to occupy a slot (§3b: AGNN-6's baseline won →
no neural endpoint shipped). Rule 6 applied at composition granularity.

7. Recommended base architecture — the Arena Contract Pack

Do not start with a new service. Start with shared contracts + adapters around existing stores.

Map onto existing stores: ExperimentStore (run records), SideLaneEnvelope (isolation),
OutcomeEvent (evidence), ObjectiveScoreV1 (scoring), MoveProposalV0 (self-evolution proposals),
Guardian signed verdicts (security settlement).

Arena lifecycle

1 register ArenaSpecV0 → 2 select players + baseline → 3 isolated side-lane trial
→ 4 mechanical settlement → 5 emit OutcomeEvent + ObjectiveScore
→ 6 compare vs scripted baseline + prior champion → 7 promote / continue-shadow / reject
→ 8 record replay+audit evidence

Promotion requires ALL of: side-lane isolation preserved; settlement mechanical + replayable; baseline
comparison included; cost+latency reported; tenant/ActorContext satisfied; operator/policy sign-off
where required; rollback path exists.

8. First build sequence

• Phase A — groundwork, no product claim. Author ArenaSpecV0/ArenaRunV0/ArenaSettlementV0/

RefutationRecordV0; adapters to ExperimentStore; canonical OutcomeEvent types for
start/settle/promote/reject; read-only arena dashboard; all players shadow/side-lane.

• Phase B — three MVP arenas. (1) CAP-5 proposer-vs-refuter (RefutationRecordV0; settle on later

regression/test-fail/operator-reject); (2) HITL reward miner (operator decisions → reward data);
(3) cost game (shadow, cost_utility_weight > 0 for reporting only).

• Phase C — product-adjacent. routing adversary (offline replay + ObjectiveScoreV1); meta-review

(score reviewers by later confirmed/rejected findings); memory keep/prune (retrieval + poison/
contradiction outcomes).

• Phase D — higher-leverage. blueprint tournament (needs real simulator); cross-service causal

fabric (needs mission-level OutcomeEvent replay); block marketplace (needs reuse/rollback telemetry).

The first real grounded critic should be Guardian red/blue — the direct home of the poker/CFR
brick — once an oracle is fixed-point-validated per §3.

9. Capability backlog (GPT iteration IDs carried verbatim)

| AGNN-14 | Convention/cross-play arena: measure coordination compatibility between independently trained agent populations (incl. cross-family swarm members) | Cross-cutting | AGNN-01 | cross-play matrix reported alongside self-play; alarm on gap (§3b AGNN-4C: gap 2.17, worst pair 0.0 — the measured failure mode) |

| AGNN-15 | Fold-gate v1: contribution gate trained on real swarm-run graphs (labels = contributions surviving into folded verdicts) | Cross-cutting | AGNN-04/06; demo gate live (§3b) | gated panels retain ≥95% of verdict-surviving findings at materially lower message count vs ungated baseline |

| AGNN-16 | Fragility critic v1: cold-start/file-age features + per-window normalization | CAP-5/Guardian-adjacent | AGNN-12/13; v0 dataset + honest FAIL (§3b) | beats past-fixes AND churn baselines on temporal AUC + P@20 before any endpoint ships |

(AGNN-01..12 are GPT's; AGNN-13 is the Claude-added ruler rule from the game-player showcase;
AGNN-14..16 are the builder session's additions, 2026-07-04 PM, each grounded in a §3b measurement.)

10. Explicit claim boundaries

Claimable now: the arena pattern is the correct Conduir abstraction; CAP-6 is the natural factory
(ExperimentStore/SideLaneEnvelope/ObjectiveScore/OutcomeEvent align); CAP-5 has a concrete Red-Queen
primitive that is intentionally shadow/off; the missing contradictor is a real CAP-5 opportunity;
meta-review and cost have code surfaces but are inert (not product-active); HITL is likely the fastest
useful signal; the game-player bricks are real and oracle-measured.

Not claimable yet: full autonomous self-evolution; GNN-robust security without adaptive-attack eval;
blueprint co-learning without a real simulator; routing co-learning without objective-score/path-maturity
evidence; memory keep/prune without downstream retrieval + poison/contradiction metrics; Guardian policy
mutation by swarm (forbidden). Grounded-critic status as of the §3b update: the bricks are proven on
games plus ONE demo-grade Conduir-shaped consumer (the fold-gate service, loopback/scratchpad — not
production) and ONE real-repo critic attempt that honestly failed its gate (fragility v0); nothing is
wired into a production arena yet.

11. Decision recommendation

Build the Arena Contract Pack first, then ship three shadow arenas — proposer-vs-refuter, HITL
reward miner, cost game — each with a §3 ruler-validated metric. This creates the reusable ground for
every later co-learning capability while staying honest to code truth, and avoids the highest-risk
mistake: making the neural player the authority. In Conduir, neural/LLM players compete; substrate,
Guardian, operator policy, and mechanical settlement decide — and a grounded critic that has actually
run the tests, not the LLM, is what feeds the operator's decision.

12. Critical Review & Adversarial Gap Audit (2026-07-04)

Following a joint multi-agent adversarial audit and extensive web/literature searches on Graph Neural Networks (GNNs), Counterfactual Regret Minimization (CFR), and Policy Space Response Oracles (PSRO), we have surfaced several structural vulnerabilities, design gaps, and mitigation paths. These notes form binding instructions for the wargaming loop and GNN co-learning implementations.

12.1. Structural & Adversarial GNN Vulnerabilities

GNN policies are vulnerable to topological perturbations where small additions, deletions, or rewirings of edges can trigger total policy degradation.

• Neighborhood Aggregation Exploitation: The standard message-passing mechanisms of GNNs assume node homophily. Adversaries can bypass CPG validations or Graphiti/HippoRAG memory retrieval systems by wrapping malicious activities in multiple indirection layers or injecting "link-farms" to trap Personalized PageRank (PPR) random walks.
• Mitigation: GNN architectures in L2 should include input-time feature homophily pruning (removing low-similarity edges) and trimmed-mean neighborhood aggregation to blunt high-leverage adversarial outlier nodes. Reconciliation with §6 rule 7 (do not read this as a standalone fix): homophily pruning and trimmed-mean are exactly the defenses the 2024–2026 literature broke under adaptive, defense-aware attack (NeurIPS "Are Defenses for GNNs Robust?"; RUNG shows trimmed-mean's estimation bias accumulates as the perturbation budget grows). Treat them as one layer of defense-in-depth, necessary but not sufficient — pair them with an unbiased/MCP-penalty aggregator (RUNG-style) + min-max adversarial training, and gate every configuration on an adaptive (not fixed Nettack/Metattack) attack evaluation before trusting it.

12.2. Deep-CFR Stability & Exploitability Convergence

By replacing exact regret tables with neural network estimators, Deep-CFR loses its theoretical convergence guarantees ($O(1/\sqrt{T})$ to Nash equilibrium).

• Error Cascades: Generalization errors propagate and compound exponentially backward through GNN message-passing channels, leading to severe policy drift and an exploitability plateau (evidenced by the 0.274 exploitability plateau in Leduc Poker).
• Mitigation: Transition from standard Deep-CFR to Single Deep CFR (SD-CFR) to eliminate the average strategy network and its corresponding error propagation, and apply Discounted CFR (DCFR) to down-weight noisy early-stage regret estimates.

12.3. Non-Transitive Dynamics & Population Cycling (PSRO)

Asymmetric wargaming environments (e.g. Red mutator vs. Blue auditor) exhibit non-transitivity (Rock-Paper-Scissors dynamics).

• Strategy Chasing: Simple self-play RL training loops cause players to continuously overfit to the opponent's immediate strategy, resulting in policy cycles and high exploitability against out-of-distribution (OOD) opponents.
• Mitigation: Enforce population diversity by training agents against a Nash mixture of the entire historical strategy pool (using Policy Space Response Oracles with $\alpha$-rank meta-solvers) rather than just the latest model iteration, and maintain behavioral diversity via MAP-Elites quality-diversity archives.

12.4. Five Concrete Gaps in the L2 and L3 Definitions

We have identified five specific gaps in this document's L2/L3 architecture:
1. Missing GNN Adversarial Defenses (defense-in-depth, not a single fix): the L2 Chess R-GCN and Poker CFR bricks carry no adversarial-robustness layer at all. Adding feature pruning/trimmed-mean is necessary but not sufficient (§6 rule 7 + §12.1); the real gap is the absence of (a) an adaptive-attack evaluation harness and (b) a layered stack (pruning + unbiased aggregation + min-max training). A brick is not "defended" until it holds under a defense-aware attacker.
2. Unresolved exploitability Plateau: The Poker CFR brick accepts a 0.274 exploitability plateau as a given, rather than using SD-CFR or regret discounting to drive it toward 0.
3. Inert and Stubbed Floor Loops: The cost-utility weight ($0.0$), meta-reflection engine, and production GNN critic (gnn_stub.py) are inert or stubs. This allows agents to enter infinite training loops without billing/compute caps.
4. Simulation-to-Reality Gap in CAP-8: The blueprint tournament is scoped to run without a physically validated simulator (WhatIfResult is contract-only), which will cause players to exploit simulator bugs rather than real-world physics.
5. Unmined HITL Reward Signals: Operator approve/reject/correct decisions are logged but not actively mined to train grounded critics.

12.5. Architectural Recommendations for the Referee Plane

To secure wargame scoring (D5) and non-collusion (D6), the referee must be upgraded:

• Dynamic Multi-Canary Layering & Nonce-Keyed HMAC Check: Prevent token-splitting and transformational exfiltration (e.g. Base64/hex evasion) by generating randomized multi-canary configurations and requiring the runner to return a cryptographic attestation: $HMAC_K(Nonce \parallel Token)$, verified out-of-band.
• Steganographic Jittering & Workspace Format Sanitization: Break environmental timing channels by injecting random scheduling delays ($10\text{ms}$–$500\text{ms}$) into event delivery. Disrupt stylistic code smuggling (whitespace/import stylometry in self-evolution loops) by passing mutated code through an AST-level formatter before presenting it to the auditor.
• Mixed-Strategy NeuPL Tournaments & Out-of-Band Bounties: Train agents under a Neural Population Learning (NeuPL) framework across diverse, non-colluding model families. Pay Red agents an out-of-band bounty when they expose a referee blind spot (i.e. achieving a physical sandbox exit that the GNN auditor missed), preventing self-dealing reward hacking.

13. Coherence ledger — how the merged sections reconcile (2026-07-04 review)

This section is the doc's own self-audit after folding the §12 audit-notes and the §3b builder-session
enrichments. It records the tensions found on review and how they resolve, so nothing sits contradictory.

1. §12.1 / §12.4-gap-1 vs §6 rule 7 — reconciled. §12 recommends homophily pruning + trimmed-mean;
§6 rule 7 (and the CON-4464 research sweep) says those are not sufficient standalone. Resolution
folded into §12.1 and §12.4: they are one defense-in-depth layer, necessary but not sufficient,
to be paired with an unbiased aggregator + min-max training and gated on an adaptive attack eval.
2. §3b optimism vs §12 gaps — complementary, not contradictory. §3b reports what is measured
(including an honest failure: AGNN-6 lost to its baseline and shipped no endpoint); §12 reports what
breaks at scale and the fixes. §3b is "what holds today," §12 is "what to harden next." The
§3b→spine mapping now ties each brick to the arena it serves.
3. The 0.274 Leduc exploitability appears in three places, consistently: §3 (converging, not at
Nash), §12.2 (a plateau to fix via SD-CFR/DCFR), §3b/AGNN-5 (independently reproduced by OpenSpiel).
All three agree it is not Nash and is the number to drive down — no conflict.
4. Naming: AGNN-4A/4C/5/6 are §3b brick names; AGNN-01..16 in §9 are backlog items.
Clarifier added in §3b.
5. Residual (unreconciled, surfaced not hidden): §3b measured claims are attributed to the
builder-session host (not verifiable from the merge host); the fold-gate service is demo/loopback,
not production. Both are labeled in place; neither is upgraded to a production claim.

Appendix — verification triage (this session)

• Verified EXISTS (9/9): side_lane_envelope_v0.py, objective_score_v1.py, outcome_event_v1.py,

experiment_store.py, promotion_gate.py, hitlQueue.service.ts, feedback.service.ts,
smart_router.py; move_proposal_v0.py (proposer/tier/status/evidence_refs/rollback_path present,
no refuter/contradictor).

• Verified INERT: cost.py:10 (cost_utility_weight = 0.0); meta_swarm.py:7 ("applies NOTHING");

red_team.py + config.py:461 (red_team_enabled = False).

• Verified STUB: gnn_stub.py (Phase-1 seam; raises if torch_geometric extra absent).
• Confluence brick data: read via Atlassian REST API (page 1426128897, v1); results as quoted are

the page's own measured numbers. gnn-games/ scratchpad dir NOT present on the first-merge authoring
host — grounding was the page, not local code inspection. *§3b update (builder session): the
gnn-games/ code, weights, and all training logs ARE on the builder-session host (session scratchpad), and every §3b number was measured locally this session; OpenSpiel independently reproduced the §3 poker
baselines to 4 decimals (0.9167 / 4.7472).*

• Prior-verdict corrections folded: CAP-3 NOT-APPLICABLE → RESHAPE-DEFERRED; CAP-6 low-ROI →

highest-leverage (both from the cross-family why-ladder run analyse-dcc5ea43).