Cascade now observes its own runtime state, decides which mitigations are needed, and dispatches them — end-to-end, without human intervention, with a receipt on every action. The causal chain from observation to mitigation is mechanically wired and empirically demonstrable.
The Q1/Q2/Q3 confounders identified in post-round analysis represented real architectural weaknesses. Round 5 ships the fixes — each verified by targeted test expansion.
| Gap | What Was Missing | What Was Shipped | Status |
|---|---|---|---|
| Q1 — Shared pattern memory across tenants | All tenants read/wrote the same global learned_patterns.jsonl — cross-tenant contamination invalidated comparative experiments |
Each tenant writes to tenants/<id>/learned_patterns.jsonl. Default tenant preserves back-compat at global path. Two-tenant isolation verified: acme and beta confirmed isolated. |
CLOSED |
| Q2 — Lifetime error rate masks burst failures | Layer quarantine used lifetime error rate. 200 successes followed by 7 straight errors = 3.24% lifetime → no quarantine. The burst was invisible. | Rolling-window quarantine (last 50 calls). Same scenario: rolling rate 14% → quarantine trips. Falls back to lifetime when fewer than 20 recent calls. JSON round-trip verified. | CLOSED |
| Q3 — No causal path from observation to mitigation | The runtime observed its own state but mitigations required manual intervention. The loop was open — observation without response. | Autonomic mitigation glue: meta_loop.on_task_completed() → observe() → decide() → autonomic.execute_actions(). Defaults to off (CASCADE_AUTONOMIC=0). Operator-controlled opt-in. |
CLOSED |
When a task completes, the runtime doesn't just record it. It observes its own state, decides what mitigations are warranted, and dispatches them — each action logged with a receipt.
observe() returning 1,500 clarification stubs → decide() emitted auto_resolve_clarifications → autonomic dispatched → clarification_resolver.resolve_batch(5) invoked → summary receipt written → chain remained valid. The causal pathway is not theoretical. It ran.
Lifetime error rates are structurally blind to burst degradation. A layer that succeeds 200 times then fails 7 in a row looks healthy by lifetime count. The rolling window sees the truth.
| Metric | Q2 Old (lifetime) | Q2 v2 (rolling window) |
|---|---|---|
| Setup | 200 successes, then 7 errors | Same |
| Lifetime error rate | 7 / 216 = 3.24% | 3.24% (unchanged) |
| Rolling window (last 50) | (not computed) | 14% — above threshold |
| Rolling window (last 16) | (not computed) | 43.75% — severe |
| Quarantine triggered? | NO — lifetime below 30% | YES — rolling above threshold |
| Evidence tag | n/a | "window": "rolling" |
to_dict/from_dict. test_layer_health.py grew from 10 to 18 tests — all green.
Pattern memory is the learner's long-term record of what worked. When that memory is shared across tenants, learned behavior from one deployment contaminates another. That's now fixed.
Writes to tenants/acme/learned_patterns.jsonl. Reads only from its own history. Cannot see beta's patterns.
Writes to tenants/beta/learned_patterns.jsonl. Confirmed isolated. Two-tenant contamination test passes.
Still writes to global ~/.whl/learned_patterns.jsonl. Existing deployments require no migration.
Each enterprise customer's pattern library is strictly isolated. Cross-customer pattern leakage is structurally impossible, not policy-enforced.
Start server. Run 5 governed tasks. Execute a CSL spec. Verify HMAC chain. Verify Ed25519 portable signature. Run SOC2 audit. Shut down cleanly. End-to-end in under 7 seconds. Self-contained. No mock data.
demo_run_<timestamp>.txt. Isolated demo tenant, archived after each run. Reproducible.
"Observation without response is just logging. When the runtime can observe, decide, and act — with receipts on every step — it becomes infrastructure."
Round 5 closes the loop. The autonomic chain is wired. Burst quarantine works. Tenant isolation is structural. The demo runs in 6.7 seconds and ends with HMAC valid, Ed25519 valid, SOC2 PASS. This is not a plan for a self-governing runtime. It is one.
Full Evidence Package Read the Whitepaper