AQ-UNC-001 — Uncertainty visibility model
PURPOSE AND STATUS
This document defines how uncertainty is resolved into a displayed band, how each band binds to a trust state in L4 (AQ-TSE-01) and to the outcomes L5 Command Authority may select, and how the band is written to the L6 Evidence & Provenance Fabric. It governs every surface that presents a trust-bearing value to a human: operator consoles, review packs, demonstration displays at any DM level, and every briefing derived from them.
Architecture tier CA, with the obligations marked Y1 falling due on the first AQ-NODE-01 article. Evidence level: Concept for the model as a whole, Theory for the band-precedence rules, no measurement for every threshold named below. Nothing described here has been built and no band boundary has yet been established from measurement.
Uncertainty is a value, not a fault. A band is rendered with the same visual weight as the quantity it qualifies, in the same place, at the same moment, for every audience. A surface that can display a value and cannot display its band must not display the value.
HOW A BAND IS DERIVED
Band assignment consumes tagged inputs, never bare numbers. Under DC-1 every input arrives tagged MEASURED, DERIVED or MODELLED; a DERIVED or MODELLED input may never carry a band higher than the band supported by its weakest MEASURED antecedent. Under DC-2 a missing input is not omitted from the computation: it enters as undetermined and caps every value downstream of it at band UB-4 or lower. There is no benign default, no last-known-good substitution, and no interpolation across a gap.
Figure 1 - Band derivation path through the trust boundaries
TB-2 deterministic acquisition (FPGA)
+------------------+ +---------------------+ +--------------------+
| L1 entropy | | L2 timing integrity | | L3 identity / |
| health observable| | observable | | attestation state |
| tag: MEASURED | | tag: MEASURED | | tag: MEASURED |
+--------+---------+ +----------+----------+ +---------+----------+
| | |
+-----------+-----------+-----------+-----------+
| |
v v
+-------------------------+ +----------------------+
| DC-2 gap test | | L4 AQ-TSE-01 |
| input absent -> value |->| trust state |
| 'undetermined', caps at | | NORMAL .. RECOVERING |
| UB-4; never -> benign | +----------+-----------+
+-------------------------+ |
TB-3 trust reasoning |
v
+-------------------------+
| band assignment UB-1..6 |
| worst input governs |
+-----+-------------+-----+
| |
TB-4 gated v v TB-5 runtime
+----------------------+ +----------------------+
| L5 Q4 authority gate | | L6 Evidence Fabric |
| narrows only | | band + basis + gaps |
+----------------------+ +----------------------+
THE SIX DISPLAYED BANDS
The ladder is ordered by permitted authority, not by a numeric confidence score. UB-5 sits below UB-4 because a named discrepancy that a defined check could settle is a stronger reason to withhold action than plain absence of information.
| ID | Displayed band | Evidence condition | Trust state | Outcomes L5 may select | Operational consequence |
|---|---|---|---|---|---|
| UB-1 | High confidence | All required inputs present and MEASURED; no observable outside its declared rule table | NORMAL | execute, execute-restricted, safe-hold, abstain, deny | Q4 does not narrow what Q1–Q3 allowed. Full command catalogue available. |
| UB-2 | Moderate | All required inputs present; at least one is DERIVED or MODELLED, or one observable sits in its declared margin region | NORMAL or RESTRICTED | execute-restricted, safe-hold, abstain, deny | execute is available only for command classes the L5 catalogue marks band-insensitive. All other classes degrade to execute-restricted. |
| UB-3 | Low | A required input is stale beyond its declared validity, or two or more inputs sit in margin regions | RESTRICTED | execute-restricted (declared subset), safe-hold, abstain, deny | Consequential classes are withheld. Operator is notified with the specific inputs that reduced the band. |
| UB-4 | Insufficient information | One or more required inputs are undetermined under DC-2 | RESTRICTED or CRITICAL | safe-hold, abstain, deny | abstain is the default output and is recorded (see §5). The enumerated missing inputs are displayed alongside the band, never summarised as "no data". |
| UB-5 | Verify required | Two inputs that should agree disagree, or an attestation is present but not re-confirmed within its window | CRITICAL | safe-hold, abstain, deny | No consequential execution. The named verification sequence is offered to an authorised operator; if it cannot be run, the outcome is abstain, not a retry loop. |
| UB-6 | Safe-hold | A failure mode in F-1–F-14 is asserted, or the recovery sequence is incomplete | CRITICAL or DENY | safe-hold, abstain, deny | Consequential classes return deny. Only non-consequential commands and the recovery sequence itself remain addressable at TB-4. |
Band UB-6 shares a name with the decision outcome safe-hold deliberately: at UB-6 the displayed band and the system's own answer are the same statement, and no surface may present them as different facts.
PRECEDENCE AND ASYMMETRIC TRANSITIONS
- Worst input governs. A composite view takes the lowest band of its contributing values. Bands are never averaged, weighted, blended or summarised into a score.
- Falling is immediate. Under DC-4 a single qualifying observation lowers the band. There is no confirmation requirement, no hysteresis and no dwell timer on the way down.
- Rising is procedural. A band rises only through the recovery sequence, during which the trust state is RECOVERING and the displayed band carries that annotation: R1 the originating observation is explained or superseded by a
MEASUREDinput; R2 the affected acquisition path re-attests at TB-2; R3 a full re-evaluation completes at TB-3 with noundeterminedinput; R4 an authorised human clears the hold at TB-4 and the clearance is written to L6 before any band above UB-3 may be displayed. - L8 is advisory only. AI-assisted analysis may annotate a record or propose a hypothesis for an operator. It may not set, raise, clear or suppress a band, and its annotations are tagged as its own output in the Evidence Fabric.
Figure 2 - Asymmetric band transitions (DC-4)
UB-1 HIGH CONFIDENCE
^ |
| | one qualifying observation
UB-2 MODERATE | lowers the band immediately,
^ | no confirmation, no hysteresis
| |
UB-3 LOW v
^
| R4 authorised clearance at TB-4, written to L6
| R3 full re-evaluation, zero 'undetermined' inputs
| R2 acquisition path re-attests at TB-2
| R1 originating observation explained or superseded
|
UB-4 INSUFFICIENT INFORMATION
UB-5 VERIFY REQUIRED
UB-6 SAFE-HOLD
state during R1..R4 = RECOVERING; band shown with that annotation
and capped at the highest band the completed rungs support
§5 ABSTENTION AS A RECORDED DECISION
Under DC-3, abstain is an output of the system, not the absence of one. It is written with the same record schema as execute, is countable in review, and is never rendered as a timeout, an error, a spinner or a blank field. "Insufficient confidence to authorize" is the answer.
| Field | Content | Tag rule |
|---|---|---|
| AB-01 | Record identity and the command or query that prompted evaluation | MEASURED |
| AB-02 | Outcome abstain, with the band and trust state at the instant of decision | DERIVED |
| AB-03 | Q1–Q3 results, recorded separately: an abstention never obscures whether identity, validity or authorisation had already failed | MEASURED |
| AB-04 | Enumerated inputs that were undetermined, each with the reason its value did not arrive | DC-2 required |
| AB-05 | The verification sequence that would settle the question, if one is defined | DERIVED |
| AB-06 | Reconstruction chain sufficient to re-derive AB-02 from AB-03 and AB-04 alone | DC-5 required |
| AB-07 | Notification issued, recipient role, and who is permitted to clear the condition | MEASURED |
DISPLAY RULES
- No colour-only encoding. The band label is present as text and in the accessible name of the element.
- No error styling for UB-4 or UB-5. Alert iconography is reserved for the
denyoutcome; uncertainty renders as information, at equal prominence to the value. - No audience-conditional suppression. A demonstration display, a review pack and an external briefing must each show the band the source record carried. Redaction may remove content; it may never remove a band, and a redacted field displays its band with the content elided.
- No derived summary may present a band better than its worst contributor, and no headline figure may appear without the band of the record it came from.
WHAT IS NOT YET DEFINED
No numeric boundary exists between any two bands, and none is asserted here. Boundaries will be established from measurement: at DM-1 and DM-2 on AQ-NODE-01, the distribution of each L1 and L2 observable will be recorded under declared bench conditions with run identities, and boundaries will then be chosen to hold a stated false-clear rate that is itself recorded as a design decision. Until that has been done, every band is assigned by the declared rule tables above with no numeric cut points, and every displayed band carries the tag THRESHOLD: UNDEFINED. Conflicts CF-2 and CF-5 bear directly on this section and are unresolved.