# ECB-1 — Epistemic Circuit Breaker

**Status:** OSOIX experimental policy protocol, version 1  
**Identifier:** `osoix.ecb.v1`  
**First profile:** `osoix.ecb.orbital-claim-promotion.v1`  
**Depends on:** RBP-1 (`osoix.rbp.v1`)

## Abstract

ECB-1 is a fail-closed policy protocol for controlling whether a machine claim may be promoted into a stronger decision context.

RBP-1 declares what relationship a claim has to reality. ECB-1 evaluates whether the evidence, uncertainty, freshness, contradictions and authority attached to that claim are sufficient for a requested use.

ECB-1 does not calculate truth probability, reliability probability, safety approval or command authority.

## 1. Circuit states

An ECB evaluation declares one circuit state:

| State | Meaning |
| --- | --- |
| `CLOSED` | The requested context is permitted within the declared RBP and ECB boundaries. |
| `GUARDED` | At least one claim may be used only with mandatory disclosures or restrictions. |
| `OPEN` | Promotion is blocked by a hard boundary or missing evidence. |

The electrical metaphor is intentional: an open circuit prevents decision flow.

## 2. Claim decisions

Each claim receives one decision:

| Decision | Meaning |
| --- | --- |
| `ALLOW` | The claim meets the policy predicates for the selected context. |
| `ALLOW_WITH_DISCLOSURE` | The claim is usable only with all listed disclosures and restrictions. |
| `DENY` | The claim may not be promoted into the selected context. |
| `NOT_APPLICABLE` | The claim may document an absence or boundary but cannot act as positive evidence. |

A decision applies only to the selected context and evaluation time.

## 3. Context ladder

ECB-1 defines five contexts:

1. `presentation` — displaying a claim while preserving its RBP class and limitations;
2. `research` — non-operational analysis and hypothesis work;
3. `advisory` — bounded human decision support that remains non-operational;
4. `safety-critical` — a strict evidence predicate for safety-relevant use;
5. `command` — separately authorised command or control use.

Contexts do not inherit permission. A lower-context allowance MUST NOT be interpreted as permission for any higher context.

## 4. Fail-closed rule

ECB-1 MUST return an open circuit when a required predicate cannot be evaluated.

Examples include:

- invalid RBP capsule integrity;
- missing source epoch where freshness is required;
- missing formal uncertainty where the context requires it;
- unresolved contradiction above a configured stop band;
- missing observation basis;
- missing operational authority;
- absent command architecture.

Unavailability is not treated as approval.

## 5. Presentation context

A valid claim may be displayed only when:

- its RBP reality class remains visible;
- source epoch and horizon are disclosed when applicable;
- transformations and uncertainty boundaries remain available;
- `UNKNOWN` and `SYNTHETIC` are not visually promoted into evidence classes.

Presentation permission does not imply analytical or advisory permission.

## 6. Research context

A valid `REPORTED`, `CALCULATED`, `PROJECTED`, `INFERRED` or `OBSERVED` claim may support research with provenance and uncertainty disclosures.

`SYNTHETIC` may be used only as labelled simulation or test material.

`UNKNOWN` may record absent evidence but MUST NOT act as positive evidence.

## 7. Advisory context

The first orbital profile blocks advisory promotion when any applicable condition is present:

- source age cannot be evaluated;
- source basis exceeds the configured freshness boundary;
- the claim is `UNKNOWN` or `SYNTHETIC`;
- a projected state lacks formal uncertainty;
- an inference lacks independently attributed evidence;
- cross-source state disagreement reaches the advisory stop band.

An advisory allowance remains non-operational and does not grant safety-of-flight authority.

## 8. Safety-critical context

The orbital profile requires, at minimum:

- a valid RBP capsule;
- direct observation in the dependency graph;
- formal covariance or equivalent validated uncertainty;
- reconciled cross-source evidence;
- suitable operational authority;
- a bounded evaluation horizon.

ECB-1 satisfying these predicates would still not constitute safety approval. External operational validation remains required.

## 9. Command context

The current OSOIX orbital profile always opens the command circuit.

Public data quality, source authority, model quality or formal uncertainty cannot create command rights.

Command use requires a separately governed, authorised, authenticated, audited and technically isolated control architecture. ECB-1 does not provide that architecture.

## 10. Decision integrity

An ECB evaluation contains:

- the RBP capsule digest;
- selected context;
- circuit state;
- per-claim decisions;
- reasons, disclosures and missing evidence;
- hard stops;
- the complete promotion ladder;
- next-evidence requirements;
- an SHA-256 digest over canonical evaluation content.

The digest proves content integrity. It does not prove policy correctness, factual truth or authority.

## 11. Relationship to RBP-1 and OTG/1

- **RBP-1** describes claim reality, provenance, derivation, uncertainty and authority boundaries.
- **ECB-1** evaluates whether those claims may cross into a requested decision context.
- **OTG/1** presents operator-facing evidence support and evidence debt.

The three instruments are complementary and non-equivalent.

## 12. Design principle

ECB-1 follows one rule:

> A claim must not cross into a stronger decision context unless every required evidence and authority boundary is explicitly satisfied.