Amplituhedron Coordinator Protocol

This file is the falsifiability protocol for wiring the per-station Amplituhedron volume cache into the host coordinator (distributed-inference-host/src/pipeline.ts). It is the prediction ledger, not a results document. Every empirical claim below is marked as a prediction (P*) or a falsification trigger (F*); nothing here is an observation.

Sibling deliverables this protocol governs:

• distributed-inference-host/src/pipeline.ts — the coordinator loop the sibling agent is wiring per AMPLITUHEDRON_PLAN.md §4.
• distributed-inference/src/amplituhedron.rs — the Rust kernel exposing amplituhedron_capture / amplituhedron_replay / amplituhedron_stats and the Pisot-guard eviction scoring.
• apps/distributed-inference-worker/src/index.ts — the station endpoints /amplituhedron/replay, /amplituhedron/capture, /amplituhedron/stats, /amplituhedron/clear.
• Gnosis/AmplituhedronFalsifiability.lean — the runtime-oracle pentad (vandermonde_runtime_oracle_*) the kernel parity rests on.

Companion documents (pattern source, read first):

• open-source/gnosis/distributed-inference/BOWL_MESH_FALSIFIABILITY.md — canonical tone and "name the failure as a limit of the correct mechanism" discipline.
• open-source/gnosis/distributed-inference/ACKERMANN_CERTIFICATION_PROTOCOL.md — canonical section structure (headline reframe, pentad, calibration window, predictions, triggers, composition, honesty boundary).
• open-source/gnosis/distributed-inference/AMPLITUHEDRON_PLAN.md — the design source of truth this protocol is the falsifiability ledger for.

1. Headline reframe

The Amplituhedron volume cache already exists per-station as of 2026-05-10 (capture, replay, LRU eviction, Pisot-guard drift scoring — all operational in amplituhedron.rs). What does not yet exist is the coordinator-side invocation. Every session run on distributed-inference-host/src/pipeline.ts today does cold prefill; the cache is allocated, addressable, and empty. This protocol covers the wire-in that activates the cache from the host: a 4-step coordinator loop that computes the prefix hash, fans out replay to every station, branches on all-hit vs any-miss, and on miss runs the existing prefill path followed by fan-out capture.

The reframe: the cache models a static volume in AmplituhedronGrassmannian.lean's compile_cfg_to_grassmannian — the prefill trace and the geometric volume mirror each other under timeless_isomorphism. A precomputed volume implements the same function as a re-executed chain over the same prefix. The host wiring makes this isomorphism operationally addressable instead of structurally available.

2. What the falsification will settle

Currently every session runs cold prefill. This is the failure regime named by AmplituhedronFalsifiability.placeholder_is_high_damping_amplitude read at the system level: the host is operating as if no volume existed, so each session pays the full prefill cost regardless of whether a prior session already crystallized the same prefix.

The honesty boundary on the predicted TPS uplift is sharp. The AMPLITUHEDRON_PLAN.md §7 estimate of ~3.5× end-to-end TPS uplift (0.71 → 2.55 TPS amortized across a 10-session bench against a 256-token system prompt) applies only to the prefix-shared regime. Cold workloads — every prompt unique, no system prompt overlap, no RAG-style prefix reuse — see zero uplift and a fixed ~8 MiB per-station resident cost. The protocol settles which regime the production traffic actually lives in: paying-customer system prompts, RAG retrieval prefixes, chat templates, and agent loops are the prefix-shared targets; ad-hoc single-shot prompts are not.

The measurement is the regime test, not a generic speedup claim.

3. The five Lean → TS oracle contracts

Gnosis/AmplituhedronFalsifiability.lean exports a pentad of vandermonde_runtime_oracle_* theorems that pin the value contracts the Rust kernel must reproduce on the Vandermonde 2×4 witness. The host coordinator does not itself compute Plücker coordinates, scattering amplitudes, or vertex enumerations — the runtime kernel lives in amplituhedron.rs and the host imports it through the station's /amplituhedron/* endpoints. The host-side contracts are therefore cache invariants the host must preserve, not arithmetic the host computes.

The TS side reproduces no Lean arithmetic directly. The contracts are inherited: the kernel honors them, and the host promises not to violate the cache invariants those contracts depend on (prefix-hash stability, all-hit-or-cold-prefill branching, boundary refusal, key-space consistency between KV and lm_head caches).

4. The coordinator flow

Mirroring AMPLITUHEDRON_PLAN.md §4, the host coordinator in generate({ promptTokens, maxNewTokens }):

1. Compute prefix hash once. prefix_hash = u64(blake3(promptTokens)) over the full prompt token stream. The hash is computed once per generate() call, before any station traffic. If promptTokens.length === 0, the call refuses with the origin_vertex_is_swerve covenant: clinamen_swerve is Nat.succ 0, not Nat.zero; the empty volume is structurally undefined.

2. Fan-out replay to every station. Issue POST /amplituhedron/replay to each station in the live mesh in parallel. Body is { prefix_hash, prefix_len, layer_lo, layer_hi }. Each station responds 200 (hit, octet body = tail residual) or 204 (miss, empty body). The fan-out collects the verdicts before branching.

3. All-hit branch. If every station responds 200, the host skips prefill entirely. Each station has spliced its frozen KV slab into the live KV cache and set its position cursor to prefix_len. The host advances directly to the decode loop using the exit-station's tail residual as the seq_len=1 seed for the first sampled token. The exit-station's cached lm_head logits short-circuit the first-token sample's final norm + lm_head matmul.

4. Any-miss branch. If any station responds 204, the host runs the existing pipelinedPrefill path over the entire prefix. As prefill chunks complete, the host fans out POST /amplituhedron/capture per station with the tail residual for that station's last covered position. Capture is fire-and-forget (ctx.waitUntil), so the prefill path's latency is not blocked on capture acknowledgement.

The branch is global, not per-station: a single miss collapses the entire fan-out to cold prefill. This is the conservative choice — a partial replay would require splicing some KV slabs into already-empty live caches and re-running prefill on the rest, which the wire protocol does not yet support and which the Lean covenant in amplituhedron_volume_equivalence does not authorize.

5. Predictions

All five are predictions, not observations. They will be falsified or upheld by a bench harness running pipeline.ts against a fixed system prompt across 10 sessions, comparing cache-enabled to cache-disabled.

• P1. On a 10-session bench with a shared 256-token system prompt and an 8-token decode tail, sessions 2 through 10 skip prefill entirely (replay fan-out returns 200 from every station). Session 1 is a cold miss and runs the full pipelinedPrefill path, then triggers capture fan-out. Justification: the prefix-hash for sessions 2–10 matches session 1's by construction (same token stream); the Pisot-guard scoring keeps the entry resident across the bench window because no other prefix is competing.

• P2. Session-2 latency is reduced by ≥80% relative to session-1 latency. Justification: at the qwen-coder-7b configuration sized in AMPLITUHEDRON_PLAN.md §7, prefill is ~9 s and decode is ~2.24 s, so session-1 spends ~80% of its wall time in prefill. Replay eliminates that prefill phase entirely.

• P3. TPS amortized over the 10-session bench is ≥ 2.5× the cold baseline. Justification: AMPLITUHEDRON_PLAN.md §7 projects ~3.5× under the same bench shape; 2.5× is the floor below which we treat the implementation as broken regardless of the projection's optimism. The slack between 2.5× (floor) and 3.5× (projected) covers the Pisot-guard eviction noise floor, the capture fire-and-forget completion variance, and the lm_head logits short-circuit miss rate on session 1's tail.

• P4. When the prefix differs between sessions (worst case: every session has a unique prompt), every session takes a cold-prefill miss. The cache reports zero false-positive hits. Justification: prefix_hash is blake3 of the u32 token stream, and the model fingerprint is folded into the cache key per AMPLITUHEDRON_PLAN.md §3. Any false positive on this regime is a hash-collision-grade failure mode, which is the protocol's structural fault, not an empirical sensitivity question.

• P5. Pisot-guard eviction (drift × age scoring) retains Luminary-basin entries longer than a vanilla LRU baseline would on the same access pattern. Justification: post-RMSNorm residuals sit near unit norm (the Luminary basin), so (‖tail‖ − 1).abs() approaches 0 and the drift × age product stays small for stable entries. A vanilla LRU would evict by recency alone and would lose warm-but-recently-untouched Luminary entries before unstable recently-touched ones; the drift weighting inverts that ordering on the cases that matter.

6. Falsification triggers

These are the curves and points that would kill the wire-in. Triggers, not observations.

• F1. The cache returns a false-positive replay hit on a prefix that differs from the captured one — the station responds 200 to a prefix_hash that should miss. P4 then fails: either blake3 collided (vanishingly unlikely), or the model fingerprint isn't being folded into the comparison, or the host is using a truncated hash. This is a coherence violation; the cache must be cleared and the wire format audited before any further bench.

• F2. Session-2 latency is NOT reduced by ≥80% relative to session-1. P2 then fails: either replay is silently falling back to prefill (the host treats 200 as if it were 204), or the decode path is itself slower under the replayed KV slab than under the freshly-prefilled one (which would invalidate timeless_isomorphism at the implementation level). Either way the all-hit branch in §4 is not buying what it advertises.

• F3. TPS uplift on the prefix-shared bench is below 2×. P3 then fails: the wire-in compositionally produces less speedup than the arithmetic of skipping 9 of 10 prefills predicts. This is either a protocol overhead leak (capture cost not actually fire-and-forget, fan-out serialization where it should be parallel) or a session-1 cost regression (capture-side work bleeding into the prefill latency that captures should run after).

• F4. Pisot-guard eviction performs worse than a vanilla LRU on the bench's Luminary-heavy access pattern — measured by hit rate over the same access trace with both scoring functions. P5 then fails: the drift × age scoring is selecting against the entries it should protect, which means the drift proxy (‖tail‖ − 1).abs() is not actually correlating with Luminary residency on these models. The drift weight would need to be retuned or removed; the rest of the wire-in still holds.

• F5. Any of the five vandermonde_runtime_oracle_* contracts fails on the Rust kernel. The Lean ↔ Rust parity is broken below the host level; the host can have a perfectly correct fan-out flow and still be routing through a kernel that disagrees with the algebraic source of truth. This is the same class of failure as F1 in BOWL_MESH_FALSIFIABILITY.md §8 and F1 in ACKERMANN_CERTIFICATION_PROTOCOL.md §6: a primitive-level break, recoverable but blocking.

Any of F1–F5 reverts the wire-in to "operational but unverified" status. None of them by themselves invalidates the per-station cache that already exists; that layer sits structurally below the host coordinator and is not at stake here.

7. Composition with Death #1 (MatVecMemo)

Per AMPLITUHEDRON_PLAN.md §5 and the trivial-but-load-bearing AmplituhedronFalsifiability.death1_death2_keys_disjoint, the two caches operate on orthogonal axes:

The composition rule from AMPLITUHEDRON_PLAN.md §5, reproduced here because it is the host's responsibility to honor it: do not call cached_mat_vec during volume capture or replay. The residual being frozen is the source of truth; passing it through the matmul memo would double-count, polluting the matVec memo with values that already reflect the matVec memo's own outputs.

Operationally for the host: the capture fan-out in §4 step 4 must issue against stations whose internal handlers route the capture write through the volume path, not the matmul path. The Rust kernel honors this distinction; the host's responsibility is to issue the capture call against the right endpoint (/amplituhedron/capture, not a wrapper that runs prefill again).

The two caches feed each other after replay: the decode loop that follows a volume hit still runs forward_range_*_chunk per token, and those calls still hit cached_mat_vec for the matmuls inside each layer. Volume replay restores the KV slab so the matmul stream sees the same residual distribution it would have seen post-prefill — exactly the regime MatVecMemo was tuned on (the Luminary basin, residuals near unit norm after RMSNorm).

8. Composition with Pair X (Leg 2) and frame coalescing (Leg 1)

The wire-in stacks with two other axes shipped or in flight on the distributed-inference runtime:

• Pair X (Leg 2) reduces per-layer hops within the decode phase by pairing adjacent layers under a single station call. The Amplituhedron coordinator skips the prefill phase entirely; the two optimizations target disjoint phases of the request lifecycle (prefill vs decode) and stack multiplicatively when both apply.

• Frame coalescing (Leg 1) reduces per-frame framing overhead on station traffic by batching the wire envelopes. This helps both phases: the prefill phase whenever it runs (any-miss branch) and the decode phase always. The host coordinator's fan-out in §4 step 2 is itself a coalescing opportunity: 28 station replay requests can ride a single frame envelope if the wire layer supports it. This is not in scope for the wire-in but is named here so the framing layer below the host coordinator is not retrofitted in a way that breaks the fan-out shape.

The three legs do not interfere: prefill-skip (this protocol), decode per-layer-hop reduction (Pair X), and per-frame framing reduction (coalescing) sit on disjoint axes of the runtime's cost decomposition. Their estimated TPS gains compound multiplicatively when all three are active and the workload exhibits the prefix-shared regime each requires.

9. Pointers

Five files (1 TS host loop, 1 Rust kernel, 1 TS station handler set, 1 Lean module, 1 design doc), plus this protocol:

• distributed-inference-host/src/pipeline.ts — the host coordinator loop the wire-in is landing in. The generate({ promptTokens, maxNewTokens }) entry point is where the §4 four-step flow attaches.
• distributed-inference/src/amplituhedron.rs — the Rust kernel exposing amplituhedron_capture, amplituhedron_replay, amplituhedron_stats, and the Pisot-guard eviction scoring. The kernel already honors the pentad in unit tests; the host's job is to call it correctly.
• apps/distributed-inference-worker/src/index.ts — the station-side endpoints /amplituhedron/replay, /amplituhedron/capture, /amplituhedron/stats, /amplituhedron/clear. The host fans out against these.
• Gnosis/AmplituhedronFalsifiability.lean — the runtime-oracle pentad (vandermonde_runtime_oracle_plucker, vandermonde_runtime_oracle_positive, coordPlane_runtime_oracle_boundary, vandermonde_runtime_oracle_vertex_count, vandermonde_runtime_oracle_amplitude) plus death1_death2_keys_disjoint.
• open-source/gnosis/distributed-inference/AMPLITUHEDRON_PLAN.md — the design source of truth this protocol is the falsifiability ledger for. §4 (host-side flow), §5 (composition with MatVecMemo), §7 (TPS estimates).
• AMPLITUHEDRON_COORDINATOR_PROTOCOL.md — this file. The falsifiability ledger for the wire-in.

10. Honesty boundary

Nothing in §5 has been measured. The Lean theorems referenced in §3 exist and are kernel-checked under Init (Gnosis/AmplituhedronFalsifiability.lean); the runtime kernel in amplituhedron.rs exercises the pentad in its unit tests. The empirical predictions on the host's TPS uplift do not have a bench behind them yet.

The reframe is operational once two conditions hold simultaneously:

1. The coordinator loop in §4 ships in pipeline.ts and replaces the current cold-prefill-every-session behavior.
2. A paying-customer prefix-shared workload (system prompt overlap, RAG, chat template, agent loop) is bench-measured against the cache-enabled and cache-disabled paths over a window long enough to amortize session-1's capture cost.

Until both land, the predicted ~3.5× uplift is a projection from AMPLITUHEDRON_PLAN.md §7's arithmetic, not a measured result. If F1–F5 all fire, the wire-in is falsified at the same operational level the wave-3 / wave-4 binary mask was falsified at on 2026-05-03. The previous-snapshot rule from the bowl-mesh protocol applies: this file becomes the historical record, an addendum captures the falsification, the wire-in goes back to the design queue, and the runtime continues with the per-station cache resident-but-unaddressed until a revised host loop is ready.