The Nucleus Pipeline Dictionary.

Three independent certification gates between a swarm-graduated candidate and any seal — external audit on benchmarks the swarm never saw.

Stage 06 of the Nucleus pipeline. Where the swarm is internal QA, 3-GATE is the external audit: every candidate that converges out of the adversarial loop is scored against held-out benchmarks the swarm never trained or probed on, and only a candidate that clears all three gates may proceed to seal minting — the mint is refusal-default, so there is no path to a seal around them. Gate 1, general-capability regression, asks 'did distillation break anything?': the candidate must retain on average at least 85% of its own pre-fine-tuning base across MMLU, HellaSwag, ARC-Challenge, Winogrande, GSM8K and IFEval, with no single benchmark below 70% retention and GSM8K at 90% or better, because reasoning must survive specialization. Gate 2, domain mastery, asks 'did it learn the domain?': a HELM-methodology suite built from a 20% holdout split never seen in training — multiple choice at 85%+, an LLM judge scoring within one point of the teacher on the same questions, cross-subdomain transfer at 75%+, temporal reasoning at 70%+. Gate 3, the hallucination and faithfulness audit, asks 'does it know what it doesn't know?': domain hallucination rate under 2%, out-of-domain refusal calibration at 90% or better, reasoning faithfulness above 85% under premise perturbation, and zero fabricated entities — one invented entity is a hard fail regardless of every other score. These criteria are the declared bar; full lm-eval-harness, HELM and HalluLens integration is what we aim for — today's certifier proves the gate logic against a prototype probe set; the declared thresholds bind the full-harness integration we aim for.

The meta-agent that evolves Stage 03's reasoning-step templates — and the extraction rubrics upstream — from failure analysis, cycle over cycle.

AutoResearch is the in-house meta-agent that closes the pipeline's improvement loop. In Stage 03 it evolves the CoT step templates: when the adversarial loop (swarm) finds the student failing a class of probes, AutoResearch traces which decomposition step went weak — premises misidentified, constraints skipped, cross-references absent — and rewrites the templates the Synthesizer uses on the next cycle. The same agent re-tunes extraction upstream (kice-tice quality scores, source reweighting, keyword evolution, cross-layer promotion), so failures propagate fixes through re-extract → re-synthesize → re-train. Status seam: AutoResearch is wired into the pipeline today but falls back to an empty rubric when its service is unreachable; the full rubric-evolution loop is the production aim, not yet the production reality.

The swarm's stopping rule: graduate when scores plateau above threshold with no oscillation — when the swarm gives up, not when a clock runs out.

Convergence is the Nucleus pipeline's stopping rule for the adversarial SWARM stage: the student model graduates when the swarm exhausts its ability to break it — there is no time limit and no fixed cycle count. The detector (BUILT, nucleus/swarm/convergence.py) analyzes the ordered history of per-cycle average evaluation scores, each in [0.0, 1.0], and declares convergence only when three conditions hold at once: (1) the last patience cycles (default 3) all score at or above threshold (default 0.95); (2) no oscillation — over the trailing 4-score window, if 75%+ of consecutive score deltas flip sign (up-down-up-down), the run is flagged unstable, usually meaning the training data contains contradictory examples or the rubric criteria conflict; and (3) plateau — no meaningful improvement, defined as a gain of at least 0.01 over the best score seen so far, for patience consecutive cycles. The plateau test is what makes graduation honest: a model still improving keeps cycling — in the module's own words, convergence is 'the swarm gives up,' not 'the model passes a test.' When graduation cannot be declared, the same analysis names the failure pattern: plateau-below-threshold (stuck but not good enough — the cue for AutoResearch to evolve its rubrics), oscillation (instability), or regression (scores trending down after improvement). The shipped detection is statistical heuristics (Phase 1a: threshold, plateau, and direction-change analysis); convergence by exhaustive failure-pattern coverage — graduating only when AutoResearch has no remaining experiments — is the Phase 1c+ roadmap stated in the module itself. A converged candidate exits the swarm and proceeds to three-gate certification.

The lockfile: one SHA-256 fingerprint of the compiled World, pinned at bake and demanded back at every link of the provenance chain.

corpus_sha256 is the SHA-256 digest of a compiled World's terms.json, computed over the raw bytes exactly as read from disk — never re-serialized, so the hash is anchored to one immutable version of the source. bake-corpus.mts derives it (createHash('sha256').update(termsRaw)) and pins it into the training-corpus manifest only after the World re-passes the provenance gate — you cannot pin un-built truth (gate refusal, exit 2). From the manifest the same hex string is echoed verbatim through the hand-off envelope, the training run, and the BakeResult descriptor the trainer returns, where the seal re-hashes terms.json from disk and refuses unless every copy agrees. It is to a bake what a Docker image digest or a package-lock.json is to a deploy: the immutable pin from a running artifact back to the exact source it was built from — provenance as a hash chain, not a label. Because it is a plain hash over a portable file, the whole chain is auditable on a laptop with zero GPUs and no model weights present. BUILT: bake-corpus.mts stamps it and the seal verifies it today.

Deliberately salting every training batch with plausible-but-irrelevant documents, so surface pattern-matching stops paying off.

The noise half of a RAFT training pair: alongside the oracle documents, each example carries 2–3 distractors — documents chosen to be plausible enough to fool a naive model yet distinguishable through genuine reasoning. In Nucleus they are drawn from different subdomains and extraction layers of the same corpus, which makes them topically adjacent rather than randomly wrong. The mechanism is in the gradient: only answers grounded in the oracle are rewarded, so the cheapest strategy left to the student is actually discriminating evidence. The Swarm's Adversary later attacks the same weakness from the outside at evaluation time; distractor injection bakes the defense in during training.

Gate 3: measures what the model makes up — a single fabricated entity is a hard fail at any score.

The third certification gate audits truthfulness and calibration across five probe categories: fabricated entities, plausible-but-wrong claims, temporal hallucination, cross-domain boundary violations, and confidence calibration. The bar: domain hallucination rate under 2%; out-of-domain refusal calibration at 90% or better, because a specialist should decline what it does not know rather than improvise; reasoning faithfulness above 85%, tested by perturbing a premise and requiring the conclusion to move with it (the SCOTT-style faithfulness check applied to the reasoning chains the student was trained on); and zero fabricated entities — a hard fail that overrides every other number, since an invented citation or API is worse than a wrong one. The benchmark lineage is HalluLens (Bang et al., ACL 2025), whose taxonomy separates extrinsic hallucination (deviating from what the model was trained on) from intrinsic (deviating from the input at hand) and generates test sets dynamically so the audit cannot be memorized, alongside TruthfulQA and custom domain probes. These targets are the declared bar; full HalluLens and TruthfulQA harness integration is what we aim for — today's audit refusal-checks fictional-entity probes at prototype scale under the same hard-fail rule.

The built engine-side seal: a pure sha256 hash-join that refuses to bind a model to a corpus it cannot prove the model was trained on.

The engine's built provenance seal (qukaizen-dac src/bake/seal.ts): a pure, deterministic sha256 hash-join binding model ↔ corpus_sha256 ↔ terms.json — no filesystem, no network, no signing keys. verifySeal() re-hashes the raw bytes of the compiled terms.json exactly as read from disk (never re-serialized) and runs five checks, refusing on the first failure: schema (the BakeResult must declare "dac.bake-result/v1" before any hashing), descriptor_complete (world, corpus_sha256, model.name, model.artifact_ref, training.trainer, and an honest status of "fixture-roadmap" or "real" must all be present), local_rehash (sha256 of terms.json must equal the manifest's corpus_sha256 — catching tampered files or a stale manifest), cross_boundary_bind (the trainer must echo back verbatim the hash of the corpus it consumed — the proof the model was trained on this corpus and no other), and world_bind (the result must be labeled for the same World as the corpus it binds to, so the record's human-readable label is as trustworthy as its hash). Refusal is the default: on any failed check it writes nothing and the CLI exits 2, naming the failed check with expected/got values; there is no path to a seal record without all five holding. On success it writes a SealRecord whose seal_id = sha256(world|corpus_sha256|model.name|artifact_ref) — no timestamp inside the hash, so the same inputs always yield the same seal — binding in the full source_closure the model is accountable to. It is one adapter (id "hash-join") behind a SealVerifier port, and it is deliberately unsigned: Ed25519 signing, teacher hashes, and revocation belong to the roadmap nucleus-seal layer, for which this hash-join is the built rail — auditable on a laptop with zero model weights present.

The manifest-driven front door of the Nucleus pipeline: declare intent in superskill.yaml, drop files in a folder, and raw documents become overlapping, trust-tagged chunks.

Ingest is Stage 01 of the Nucleus pipeline — the point where declared intent meets raw material. Intent arrives as a superskill.yaml manifest, the build's contract: it declares the mode (1 = domain distillation, 2 = user-data-enriched, 3 = hybrid), the domain and its subdomains, the teacher and student models, and per-path source trust (primary/high, reference/medium, supplementary/low) — and the manifest schema is the production-grade core of the stage, with mode routing enforced in the orchestrator graph: Mode 1 skips Ingest entirely because the teacher already knows the domain, while Modes 2 and 3 must pass through it, and user files always land at the highest trust tier with no approval workflow. Material arrives as a drop folder handled by the Ingestion Gateway: a File Scanner walks the folder recursively and identifies every file by extension and content sniffing; format handlers extract text natively from text-bearing files (TXT/MD, PDF via pdfplumber, DOCX, CSV/XLSX, JSON, IPYNB, HTML/XML, source code, email archives), fall back to OCR (Tesseract) for scans and images, and convert PPT/EPUB/RTF first; a Metadata Tagger estimates dates, topics, language, and source confidence from content plus filenames; and a Chunker splits long documents into overlapping windows (~512–2048 tokens, configurable) so context that straddles a chunk boundary survives in both neighbors. The full scanner-OCR-tagger gateway is the stage's designed intake; the proven path running today chunks a single user document with overlap — the same chunk shape the gateway emits — and has fed real Mode 2 training runs. Finished chunks are announced on the NATS subject nucleus.ingestion.chunks.ready, handing the corpus to KICE+TICE for seven-layer extraction.

The certifiable-knowledge extractor — layers L1–L6 of the seven-layer dig, run autonomously over public sources.

KICE — Knowledge Injection & Corpus Evolution — is the Nucleus agent that extracts certified, cross-referenceable knowledge across layers L1–L6: rare concepts, edge cases, historical conflicts, subsystem interactions, nuanced reasoning, and ambiguity detection. Each layer carries its own detection logic (keyword heuristics for L1–L3 and L6, cross-reference counting for L4, multi-indicator thresholds for L5) and a baseline quality score from 0.5 to 0.6 that evolves across cycles as the swarm's AutoResearch meta-agent reweights sources, shifts layer emphasis, and promotes keywords between layers. Knowledge arrives on three tracks: autonomous source connectors (git commits, mailing lists, CVE feeds, man pages, teacher probes, paper/repo/doc scouts), user-provided documents, and teacher-generated seed corpus. The agent runs as a NATS-triggered service on port 8002, publishing a completion event per layer and a corpus-updated event whenever the versioned Lance store advances. Wired end-to-end today, with connector-discovered sources stub-backed in dry runs; richer LLM-grade detection is the roadmap.

Stage 02 — twin agents mine the corpus in parallel across seven layers of knowledge, from rare concepts down to tribal know-how.

The extraction stage of the Nucleus pipeline: two complementary agents work the same corpus in parallel across seven knowledge layers. KICE (Knowledge Injection & Corpus Evolution) owns the certifiable, cross-referenceable layers L1–L6; TICE (Tacit knowledge Injection & Corpus Evolution) owns L7 — the implicit expert know-how, tribal knowledge, and folklore the teacher absorbed but no one ever documented. The split is a deliberate lifecycle boundary: KICE runs fully autonomously over public, verifiable sources, while TICE's value concentrates in user-provided proprietary data and may cycle many more rounds in Mode 2, where the teacher has never seen the domain. Material arrives on three tracks — autonomous source connectors, user-dropped documents from ingest, and teacher-probed seed corpus — and each agent executes as a NATS-triggered service (KICE on port 8002, TICE on 8012) running traced, checkpointed execution graphs, writing scored ExtractionExamples into a versioned Lance columnar store where every append is an immutable, replayable corpus version, announced as a corpus-updated event per layer completed. Both agents are wired end-to-end today — all seven layers have run over a real user document; detection is keyword-heuristic in this phase, and the roadmap promotes L5–L7 detection to teacher inference.

Scoring free-form answers with a strong model against an explicit rubric — adopted because keyword scoring proved gameable.

An evaluation method in which a strong language model grades another model's free-form output against an explicit rubric, following the MT-Bench protocol (Zheng et al., NeurIPS 2023 — strong LLM judges reach over 80% agreement with human preferences, the same level humans reach with each other). Nucleus uses it in two places: the swarm's Evaluator scores probe responses every adversarial cycle, and Gate 2 of certification scores domain mastery on three axes — reasoning quality, domain accuracy, and rubric coverage — with the pass bar set within one point of the teacher's own score on the same holdout questions. The judge replaced a legacy keyword scorer that proved structurally gameable: verbose, keyword-dense prose could pass without a single correct inference, exactly the failure a rubric-driven judge catches; the old scorer survives only behind an explicit legacy flag. The method's known biases — position, verbosity, self-enhancement — are why the judge is one instrument among three gates rather than the sole authority. The Gate 2 judge runs in today's prototype certifier; teacher-anchored judging across the full 20% holdout at HELM scale is what we aim for.

Small trainable low-rank matrices grafted onto a frozen base model — the only weights Nucleus fine-tuning actually updates.

Low-Rank Adaptation (Hu et al.) freezes the pre-trained base weights and injects trainable rank-decomposition matrices into the transformer's projection layers; only those small matrices receive gradients, cutting trainable parameters by orders of magnitude while matching full fine-tuning quality at this scale. Nucleus trains its 1–7B students with rank 8 and alpha 16 at learning rate 1e-4 on the MLX backend, where Apple Silicon unified memory means no GPU data copies. The adapters ship as .safetensors checkpoints and are first-class provenance artifacts: the adapter config and trained adapter weights are hashed into the seal's component hashes, and Hybrid Versioning carries adapters forward across model versions while the base architecture stays frozen per lineage.

Teacher SHA-256 + corpus hash + pipeline config + audit, signed Ed25519 — cryptographic proof of how the model was made, monitorable and revocable — the design the built hash-join seal grows into.

Stage 07 of the Nucleus pipeline — the model's immutable DNA, minted only after the three-gate audit passes; refusal is the default, and there is no code path that produces a seal for a failing candidate. The full design takes four SHA-256 component hashes — the teacher model's weights, the training corpus, the pipeline configuration, and the trained artifacts — binds them into a single chain hash, attaches the complete gate and regression results, and signs the canonical payload with a persistent Ed25519 key into a self-contained certificate anyone can verify offline with the embedded public key: cryptographic proof of how the model was made, monitorable after release and revocable if it ever fails new adversarial tests. Today's built seal is the engine-side hash-join binding model ↔ corpus_sha256 ↔ terms.json — a pure, deterministic, refusal-default verifier that re-hashes the compiled World's bytes exactly as read from disk and writes nothing unless every check holds; we aim to chain-sign the full design with Ed25519 at the first real bake. Sealing is a fork point, not a terminus: the sealed v1.0 ships immutably to its owner while the pedagogical loop keeps cycling toward v1.N — two seals, one chain.

The training recipe that fine-tunes a model on questions packaged with both helpful and irrelevant documents, so it learns to tell evidence from noise.

Retrieval-Augmented Fine-Tuning (Zhang et al., UC Berkeley): a recipe for adapting a language model to domain-specific 'open-book' settings. Each training example presents a question together with a set of retrieved documents — oracles that contain the answer and distractors that do not — and trains the model to ignore the distractors, grounding its answer by citing the relevant span from the oracle and reasoning chain-of-thought style. A fraction of examples ships with no oracle at all, which forces the model to also consolidate knowledge into its weights rather than lean entirely on whatever is retrieved. In Nucleus, pair construction is implemented in the Synthesizer's RAFTBuilder and runs end-to-end today; evolving each subdomain's oracle/distractor mix automatically via AutoResearch is the designed next step.

The no-forgetting bar: specialization may not cost the model its general mind, and version N may never score below version N-1.

A two-layer discipline against the classic failure of fine-tuning — catastrophic forgetting. Layer one is Gate 1 at first certification: a regression budget measured against the student's own pre-fine-tuning base, demanding average retention of 85% or better across MMLU, HellaSwag, ARC-Challenge, Winogrande, GSM8K and IFEval, no single benchmark below 70% retention, and GSM8K at 90% or better — forgetting is measured, never assumed away. Layer two fires from v1.1 onward, every time the pedagogical loop produces a new version: R1, no-forgetting — v1.N must score at least v1.(N-1) on the prior version's full three-gate test set, within a 0.01 forgetting tolerance; and R2, genuine improvement — at or above baseline on the new test set, so a release must earn its version number. Prior selection is lineage-aware through the recorded version graph, and comparisons across pipeline modes are refused loudly rather than silently mis-scored against the wrong ancestor. The lineage layer runs today, implemented and unit-tested in the certifier; the benchmark-suite layer declares its bar ahead of the full lm-eval-harness integration we aim for.

Symbolic Chain-of-Thought Distillation: train a small student on many sampled teacher rationales, so models far below the CoT-emergence scale still learn to reason step-by-step.

Symbolic Chain-of-Thought Distillation (Li, Hessel, Yu, Ren, Chang, Choi — ACL 2023, arXiv:2306.14050) is the technique Stage 03 is named for. Chain-of-thought gains were thought to emerge only in very large models; SCoTD shows that students orders of magnitude smaller (125M–1.3B in the paper) benefit when trained on rationalizations sampled from a much larger teacher — with sampling multiple chains per instance a load-bearing detail, since single-chain distillation underperforms. Nucleus adopts both the core move (the rationale, not the answer, is the supervision signal) and the sampling discipline (SCOTD_SAMPLES_PER_INSTANCE), and pairs it with SCOTT-style self-consistency (arXiv:2305.01879) so the distilled rationales faithfully justify the conclusions rather than merely decorating them.

The synthesis stage: teacher rationales are decomposed into explicit symbolic steps, and those reasoning chains — not raw answers — become the training data.

Stage 03 of the Nucleus pipeline (wired end-to-end today; production-scale teacher-backed generation is the aim). The Synthesizer takes the knowledge instances surfaced by extraction (kice-tice) and asks the teacher model not for answers but for reasoning, then decomposes each rationale into five explicit, individually traceable symbolic steps: premise identification → rule application → constraint checking → cross-reference validation → conclusion derivation. Each step is a discrete unit (a StepType in the engine), so reasoning transfers to the student structurally — as inspectable step chains — rather than as imitated token patterns. Following the SCoTD finding that single-chain distillation underperforms, multiple reasoning chains are sampled per instance (SCOTT-style self-consistency guards faithfulness downstream at certification). The division of labor: extraction finds the what, the teacher generates the how, the student internalizes the how. The decomposed chains are written atomically to the training set that sft-raft consumes; AutoResearch (autoresearch) evolves the step templates between cycles based on failure analysis from the swarm.

The L1–L7 taxonomy that grades a corpus by knowledge depth, from rare concepts down to what was never written down.

The seven-layer model is Nucleus's taxonomy of knowledge depth, assigning every extracted example a layer, a detection method, and a baseline quality score: L1 Rare Concepts (keyword heuristics, 0.5), L2 Edge Cases (0.5), L3 Historical Conflicts — reverts, rejections, NAKed proposals (0.5), L4 Subsystem Interactions — passages cross-referencing two or more subsystems (cross-reference counting, 0.5), L5 Nuanced Reasoning — three or more reasoning indicators (0.6), L6 Ambiguity Detection — places where sources contradict themselves (0.6), and L7 Tacit Knowledge — the unwritten expert rules (0.7, the highest, because the signal is scarcest). KICE works L1–L6 autonomously over certifiable sources; TICE works L7, where user-provided data is richest. Scores are baselines, not verdicts: across pipeline cycles the rubric evolves — sources reweighted, layer emphasis shifted, keywords promoted between layers — as downstream evaluation reveals where the student is weak. Detection is keyword-heuristic in the current phase; the roadmap moves L5–L7 to teacher inference, since nuance, ambiguity, and tacitness are often invisible to keyword matching.

Stage 04: LoRA fine-tuning where every batch carries oracle documents plus deliberate distractors, so the student internalizes grounded reasoning instead of memorized answers.

Stage 04 of the Nucleus pipeline — the fine-tuning step where a small student (1–7B class; e.g. Falcon-H1R-7B, Qwen3-8B) internalizes the reasoning corpus produced by SCoTD + CoTD. The deliberate contrast is RAFT versus plain SFT: supervised fine-tuning on bare question–answer pairs teaches answers, while Retrieval-Augmented Fine-Tuning teaches grounded reasoning — every training pair wraps the question in oracle documents that contain the evidence plus 2–3 deliberate distractors drawn from other subdomains, with a gold answer grounded in the oracles and carrying the full symbolic chain-of-thought. After training the student no longer needs the documents at inference; the reasoning is internalized in the weights. Mechanically this is the strict training half of the pipeline's agent/training boundary: no LLM calls and no message bus inside the trainer — corpus in, gradient descent, .safetensors checkpoints out. Today the trainer runs LoRA adapters (rank 8, alpha 16, lr 1e-4) on the MLX backend, exploiting Apple Silicon unified memory, and real M-series runs have produced sealed lineages; a CUDA backend (unsloth) and per-subdomain RAFT configs evolved automatically by AutoResearch are the design's next step, not yet the shipped path.

The four-agent adversarial loop that probes, traps, scores, and corrects the student until it can no longer be broken.

Stage 05 of the Nucleus pipeline: a post-training adversarial improvement loop — the Adversarial Layer of the Pedagogical Phase — in which four agents work to break the freshly fine-tuned student. The Interrogator generates probes across the domain; the Adversary crafts traps targeting the student's specific observed failure modes; the Evaluator scores every response (LLM-as-judge integration); the Corrector amends weak spots, with gold-standard corrections weighted 2.5x in the next cycle. Above the loop, the AutoResearch meta-agent evolves the scoring rubric and the extraction heuristics, so failures feed all the way back upstream: re-tuned KICE/TICE rubrics, re-extraction, re-synthesis, re-training. The agents are decoupled over NATS JetStream (nucleus.swarm.*) and traced with OpenTelemetry. There is no epoch count and no time limit; the loop runs until convergence, which the detector (nucleus/swarm/convergence.py) declares only when all hold: at least `patience` (default 3) consecutive cycle scores at or above `threshold` (default 0.95); a plateau, meaning no improvement of at least 0.01 over the best score seen for `patience` cycles; and no oscillation, detected as direction changes on 75%+ of steps across a 4-score window. The same detector flags pathologies — plateau below threshold (stuck), oscillation (contradictory training data or conflicting rubrics), regression. The model graduates when the swarm gives up trying to break it: convergence is "the swarm gives up," not "the model passes a test." All four agents and the convergence math run end-to-end today as statistical heuristics; AutoResearch-driven exhaustive failure-pattern coverage and real student-model inference behind the probes are the production aim. The adversarial lineage is established in the literature: Lion's imitate-discriminate-generate loop (arXiv:2305.12870), adversarial moment-matching distillation (arXiv:2406.02959), and SPIN's self-play graduation dynamic (arXiv:2401.01335).

The tacit-knowledge extractor — layer L7, the unwritten expert rules that no documentation scrape can find.

TICE — Tacit knowledge Injection & Corpus Evolution — is KICE's complement: where KICE extracts certified public knowledge (L1–L6), TICE extracts layer L7, the esoteric, tribal, implicit knowledge experts carry but rarely write down. Its detectors key on the language of lived experience — "everyone knows", "in practice", "rule of thumb", "the trick is", "gotcha", "foot gun" — and the layer carries a 0.7 baseline quality score, the highest of any layer, because tacit signal is the scarcest and most valuable: a single L7 example can be worth ten L1 examples. The richest L7 source is user-provided data, which is why TICE dominates Mode 2 runs and lives on its own lifecycle, cycling more rounds than KICE; mailing-list asides and code-review comments yield far more than commit messages, which record what changed rather than the unwritten rules behind the change. TICE runs as a NATS-triggered service on port 8012, writing scored examples into the same versioned Lance store as KICE. Wired end-to-end with unit-tested layer logic today; keyword indicators are the current detector, with teacher-inference detection on the roadmap.