MB9 — Grounding Certificate Soundness

A certified conservative abstraction is assumed to warrant grounding viability in the actual deployment domain.

What decision changes?

Before trusting a safety case's grounding claim, ask whether the checked abstraction actually moves when value-relevant reality changes, or whether it can stay silent while something important drifts.

The Guaranteed-Safe/Open Agency program names the same open problem this bridge inherits: a formal specification and world model cannot enumerate every safety-relevant phenomenon, and a system will game whatever the spec omits. The book’s answer is to demand conservativity instead of completeness — value-relevant change must move the checked abstraction or raise its uncertainty, rather than pass through silently.

MB9 is the assumption that a certificate of this conservative-abstraction property, in practice, actually warrants grounding viability in the deployment domain the system runs in. It is a coverage bet, not a coverage guarantee.

Its exact failure mode has a name in the experiment suite: the “silent gap.” Light correction instrumentation can look fine while value-relevant state drifts in ways the audit never touches — the diagnostic evidence shows this happening in every light-handle trial and closing only once bearer-welfare tracing is added.

What would count as evidence?

Evidence would include tests that inject value-relevant change into a deployment and confirm the checked abstraction either moves or its uncertainty rises — no silent gaps.