Predicate Invention: Creating new distinctions under constraint

Before the law stands a doorkeeper. A man from the country comes to this doorkeeper and asks to be admitted to the law. But the doorkeeper says he cannot grant him admission now.

This chapter formalizes predicate invention as governed signature extension, defining the anchor A17 (Predicate Invention) -- the three-obligation pipeline (local grounding, overlap agreement, invariant preservation) that any new predicate symbol must satisfy before it earns standing in the system. The chapter develops the standing gradient (Proposed, Witnessed, Certified), the typed agreement conditions for different codomains, the structure of the Predicate Dossier and Obstruction Witness artifacts, the promotion protocol for scope expansion, and the comparison with classical Inductive Logic Programming. The reader seeking the motivating narrative -- how a fashion catalog's inability to express "puffy" reveals the structural gap between the Two Empires -- should consult Vol I, Chapter 7 (The Witness Protocol) and Chapter 8 (Similes of Symmetry).

The Failure Mode We Are Fixing

A user wants to search for "puffy dresses." The schema has no column for puffiness. What happens next depends on which empire you inhabit.

In schema-land, the answer is: nothing happens. The vocabulary is fixed. To add "puffy," someone must propose a schema change, convene a review, schedule a migration, and deploy. The user's latent dimension is structurally inexpressible until the next migration window.

In embedding-land, the answer is: something happens, but nobody knows what. The system retrieves items whose vector representations are close to "puffy" in some high-dimensional space. It returns proximity, not standing. The user gets results; the system cannot certify them, version them, or reconcile them with another user who also searched for "puffy" but meant something different.

Neither empire supports what the user actually needs: the ability to propose a new predicate, have the system check whether that predicate is coherent with existing vocabulary, and if so, mint it as a first-class object that can be queried, versioned, and transported.

This is the capability gap Chapter 5 identified. Part III installed the machinery to address it: contexts as sites, coherence as sheaves, predicates as fibered, logic as indexed, transport as certificated. Part IV asks: how do we use this machinery to do the thing the Two Empires cannot do?

The answer is predicate invention.

The Third Mode's Central Operation

Predicate invention is governed signature extension. A new symbol is admissible only if it is grounded locally, glueable on overlaps, and conservative by default.

The word "governed" is doing real work. This is not creativity in the romantic sense. The system is not dreaming up concepts. It is evaluating a candidate against three obligations, and if the candidate passes, producing an artifact that makes the predicate auditable. If the candidate fails, the system produces a different artifact: a witness explaining why.

A predicate without an evaluation path is not a predicate; it is a caption. A predicate that cannot be tested is not a predicate; it is a wish. The Third Mode turns captions into predicates by requiring that every new symbol come with the structure needed to decide it. In the Third Mode, every new symbol is either admitted with a passport or rejected with a receipt.

The three obligations form a pipeline. A candidate enters; the system checks local grounding, then overlap agreement, then invariant preservation. At each stage, failure produces a witness explaining what went wrong. Success at all three stages produces a dossier.

Standing Is a Gradient

Predicate invention is not a gate but a gradient.

A term becomes a predicate the moment someone uses it as one. The question is not "is this term valid?" but "what is the evidence for treating this term as a predicate, and in what scope?" The system tracks three levels of standing:

Most predicates never reach CERTIFIED. They do not need to. A search system can run entirely on PROPOSED predicates. A recommendation system can run on WITNESSED predicates. CERTIFIED standing is reserved for predicates that must cross scope boundaries or bear organizational authority.

Witnesses are logs, not proofs. The system does not require a proof that "puffy" is a valid predicate before allowing its use. It records what happened: queries, signals, scope crossings, conflicts, resolutions. The record is append-only. If something goes wrong downstream, you can audit. If nothing goes wrong, you never examine it.

Cross-scope consistency is checked on demand. When a WITNESSED predicate in scope A tries to operate in scope B, the system checks overlap agreement. If agreement holds, scope extends. If agreement fails, the system surfaces the conflict and lets the human decide. But it never blocks local use. A predicate that works in internal search continues to work in internal search regardless of whether it agrees with supplier feeds.

This architecture matters because the alternative—blocking on completeness—fails twice. It is computationally intractable: O(n²) in concepts, requiring solved NLU. And it is organizationally paralyzing: teams cannot ship until predicates are globally validated, so they route around the system.

Obligation 1: Local Grounding

A predicate is grounded in view U if someone can decide it there, show their work, and explain what the decision means. A predicate's evaluation method is part of its intension.

The components are straightforward. First, a signature: what type of things does this predicate apply to, and what type of values does it return? For "puffy," the domain is Dress and the codomain is Score (a continuous value from 0 to 1). Not Bool. Making it Score forces us to think about what happens when two views have different scales.

Second, an evaluation method. How do you compute puffy(d) for a given dress d? Four options:

Measurement: a deterministic procedure. For puffy, this might be volume_ratio(d) / max_volume_in_reference_set, normalized to [0,1]. The reference set is pinned at creation time and recorded in provenance; otherwise the measurement drifts as the catalog changes. The procedure is traceable: given the same inputs and the same reference set, it returns the same output.

Rule: a logical formula in terms of existing predicates. If "voluminous" and "structured" already exist, puffy might be defined as voluminous(d) ∧ ¬structured(d). The formula is auditable: you can check whether the rule was applied correctly.

Oracle: human judgment. A stylist looks at a dress and assigns a puffiness score. The oracle must be declared, not hidden. The system records that this predicate's values come from human judgment, not computation.

Learned function: a classifier or regressor trained on exemplars. A model takes dress features and returns a score. The model must carry provenance (training data, architecture, version) and a declared error bound. It is not a black box; it is a function with known uncertainty.

Third, a witness set. Not a test suite in the QA sense, but a set of exemplars that ground the predicate's meaning. For puffy: five dresses labeled as high-puffy (score > 0.7), five labeled as low-puffy (score < 0.3), each with provenance (who labeled it, when, in what context). The witness set also includes boundary cases: items where the label is disputed or uncertain.

Fourth, an authority level. Who is allowed to assert this predicate? A user can invent a predicate in their own view; promoting it to org-wide or global requires higher authority. User-level predicates cannot claim system authority. This prevents adversarial escalation: someone cannot invent a predicate and immediately make it authoritative for everyone.

The key constraint: predicates start non-global. You can ground a predicate locally without proving it works everywhere. Globality is a promotion outcome, earned through overlap agreement and authority approval, not assumed at creation time.

PredicateSpec(puffy, user_session_view) = {
  signature: {
    domain: Dress,
    codomain: Score,
    codomain_agreement: Calibration
  },
  evaluation: Measurement(volume_ratio / max_volume),
  witness_set: {
    positive: [(dress_A, 0.9, user_session), (dress_B, 0.85, user_session), ...],
    negative: [(dress_X, 0.1, user_session), (dress_Y, 0.2, user_session), ...],
    boundary: []
  },
  authority: { level: "user", declaring_agent: user_42 },
  scope: { defining_view: user_session_view, global: false }
}

Obligation 2: Overlap Agreement (Typed)

If two views both define q, their definitions must be reconcilable on the overlap.

This is the sheaf condition from A13, applied to the new predicate. But "reconcilable" is not a single thing. It depends on what q returns.

For Bool predicates, reconcilable means literal equality: if Merchant A says sustainable(dress_X) = true and Merchant B says sustainable(dress_X) = false, that is a disagreement. The system cannot glue.

For Score predicates, reconcilable means calibration: two views can have different scales as long as there exists a monotone transform that aligns them. If Merchant A's puffy scores range from 0 to 1 and Merchant B's range from 0 to 10, that is fine if multiplying A's scores by 10 produces agreement on shared items. The calibration witness records the transform and the evidence that it works.

For learned predicates, reconcilable means agreement on a certified test set within a declared error bound. Two classifiers trained on different data can both be valid puffy predictors if they agree on a shared evaluation set within tolerance δ.

AgreementType(codomain) = {
  comparator: (V₁, V₂) → Bool,           // how to compare values
  evidence: EvidenceType,                 // what witness is required
  acceptance_rule: EvidenceType → Bool    // when agreement holds
}

where EvidenceType =
  | Equality                              // for Bool: values match after A15 translation
  | CalibrationWitness {                  // for Score
      transform: V → V,                   // monotone function aligning scales
      tolerance: ε,                       // max allowed deviation
      test_items: [(x, v₁, v₂, aligned)]  // alignment evidence
    }
  | ErrorBoundWitness {                   // for Learned
      test_set: [(x, expected, actual)],
      error_bound: δ,
      coverage: CoverageMetric
    }
  | RefinementWitness {                   // for versions
      direction: v2 ⪯ v1,
      implication_proof: ∀x. q_v2(x) ⇒ q_v1(x)
    }

Overlap agreement is evaluated after A15 status translation. If View A uses classical logic with OWA and View B uses classical logic with CWA, their outputs must first be translated into a common status space (true/false/unknown/conflict) before comparison. A "true" from A and a "false-from-absence" from B are not directly comparable; the adapter surfaces this as a policy conflict, not a value disagreement.

In practice, we check pairwise overlaps and attempt to synthesize a cover-level witness. When higher-order coherence fails (A-B agree, B-C agree, but the transitive A-C fails), the system emits a cover-level obstruction witness. The transitivity is attempted, not assumed.

sustainable\_A(d) := material(d) ∈ (organic\_cotton, recycled\_polyester, linen)

sustainable_B(d) := certified(d, [GOTS, OEKO-TEX, B-Corp])

OverlapDisagreement {
  predicate: sustainable,
  codomain_type: Bool,
  views: [Merchant_A, Merchant_B],
  overlap: catalog_intersection,
  witness_items: [(item_X, true, false, equality_failed)],
  resolution_options: [
    "Fork: maintain sustainable_A and sustainable_B as distinct predicates",
    "Negotiate: define sustainable_global := sustainable_A ∧ sustainable_B",
    "Escalate: authority decides canonical definition"
  ]
}

The same pattern applies outside fashion. Consider market_authorized(product, market) across FDA and CE regulatory views: FDA uses OWA (absence means unknown), EUDAMED uses CWA (absence means not marked). A product with FDA clearance but no EUDAMED record produces an overlap disagreement where the conflict is not just true vs false, but witnessed truth vs absence-derived falsity. The A15 adapter translates both into the common status space before the comparison, surfacing the policy mismatch as the root cause. (Interlude III-A develops this example in full.)

Obligation 3: Invariant Preservation

The new predicate must not break what already works.

This sounds obvious, but "break" has two meanings that must be kept distinct.

Tier 3a: Hard Invariant Conservativity

The new predicate must not force violations of existing hard invariants. Hard invariants come in two flavors:

Logical invariants: type constraints (puffy : Dress → Score, not puffy : String → Float), integrity constraints (¬(puffy_score > 0.8 ∧ fitted) if that's declared), mutual exclusions (a dress cannot be both minimalist and maximalist).

Operational invariants: units (if price is in USD, affordable thresholds must be unit-compatible), cardinalities (if primary_category is single-valued, puffy cannot force multiple), authority bounds (user-generated predicates cannot claim system authority).

If adding puffy would require some dress to be both puffy and fitted when an invariant prohibits that combination, the candidate is rejected. Note: a predicate can exist locally even if it would violate invariants elsewhere. What is forbidden is asserting it as authoritative in a scope where it breaks hard invariants.

Tier 3b: Non-Interference (Practical Conservativity)

Adding q must not change the truth of pre-existing statements in Σ. For all sentences expressible in Σ (excluding performance and ranking), their truth values in the authoritative scope are unchanged.

This is what "conservative extension" means in practice:

• Existing queries on Σ return the same answers after adding q
• If adding q would change existing truths (e.g., by triggering a derived invariant), the system must emit an explicit migration witness (A17b)

Predicate invention is conservative by default. It cannot change existing truth values without emitting an explicit migration witness. This is the brake pedal of vocabulary extension.

InvariantViolation {
  predicate: puffy,
  tier: "3a_hard",
  violated_invariant: "¬(puffy_score > 0.8 ∧ silhouette = fitted)",
  invariant_type: "logical",
  witness: (dress_Y, puffy_score=0.95, silhouette=fitted, rule_violated),
  resolution_options: [
    "Retract predicate candidate",
    "Weaken invariant (requires authority approval)",
    "Scope restriction: exclude fitted dresses from puffy's domain"
  ]
}

The Predicate Dossier

A predicate invention attempt outputs either a Predicate Dossier (success) or an Obstruction Witness (failure). Both are first-class artifacts.

The dossier is not documentation but the predicate's passport. Without it, the predicate cannot travel (transport along equivalences), cannot be promoted (scope expansion), cannot be versioned (evolution over time).

PredicateDossier {
  // Identity
  id: PredicateID,
  name: "puffy",
  version: 1.0.0,
  
  // Signature
  signature: {
    domain: Dress,
    codomain: Score,
    codomain_agreement: Calibration,
    arity: 1
  },
  
  // Authority
  authority: {
    level: "user",
    declaring_agent: user_42,
    allowed_promotions: ["local" → "org" → "global"],
    promotion_requirements: [org_admin_approval, calibration_witnesses]
  },
  
  // Intension
  intension: {
    natural_language: "Degree to which a dress has voluminous, rounded silhouette",
    formal_rule: volume_ratio / max_volume,
    learned_model: null,
    witness_set: { positive: [...], negative: [...], boundary: [...] }
  },
  
  // Tests (derived from witness set)
  test_suite: {
    cases: [(dress_A, expected=0.9, actual=0.9, Pass), ...],  // exact match for measurement
    acceptance_rule: "equality",   // "equality" for measurement, "|diff| ≤ ε" for learned
    coverage: "sampled",           // "exhaustive" | "sampled" | "user-provided"
    last_run: 2026-01-19T14:30:00Z
  },
  
  // Invariants
  invariants: {
    logical: ["puffy : Dress → Score"],
    operational: ["unit: dimensionless ratio"],
    verified: [("type_constraint", trivial)]
  },
  
  // Provenance
  provenance: {
    author: user_42,
    timestamp: 2026-01-19T14:00:00Z,
    source: "user",
    dependencies: [volume_ratio, max_volume]
  },
  
  // Scope
  scope: {
    defining_view: user_session_view,
    extended_views: [],
    global: false,
    calibration_witnesses: []
  },
  
  // Versioning
  versioning: {
    previous_version: null,
    compatibility_witness: null,
    breaking_changes: []
  },
  
  // Transport
  transport: {
    equivalence_classes: [dress_identity],
    transport_certificates: [],
    non_transportable_reason: null
  }
}

Every field serves a purpose. The signature enables type checking. The authority enables access control and prevents adversarial escalation. The intension enables auditing. The scope enables promotion. The transport enables movement along equivalences.

When a predicate invention attempt fails, the system produces an ObstructionWitness instead:

ObstructionWitness {
  predicate_candidate: PredicateSpec,
  failed_obligation: "local_grounding" | "overlap_agreement" | "invariant_preservation",
  failure_details: GroundingFailure | OverlapDisagreement | InvariantViolation,
  resolution_options: [ResolutionOption, ...]
}

Both artifacts are first-class. A dossier is a passport; an obstruction witness is a rejection letter with instructions.

The Promotion Protocol

Global is not a place but a successful glue.

A predicate starts local. To expand its scope, the predicate must pass additional gates.

Promotion rule: A predicate may be promoted from view U to cover $\{U_i\}$ iff:

1. Overlap agreement holds on all pairwise overlaps in the cover (or obstruction witnesses are explicitly accepted as forks)
2. Calibration witnesses exist where codomains differ (e.g., different scoring scales reconciled via monotone transform)
3. Authority witness approves the promotion scope (user → org requires org admin approval; org → global requires system/regulator approval)

PromotionRequest {
  predicate: puffy,
  from_scope: user_session_view,
  to_scope: [org_catalog_view],
  overlap_agreements: [
    // For Bool: equality witness
    // For Score: calibration witness (a specialized overlap agreement)
    (user_session, merchant_A, AgreementWitness { type: calibration, transform: identity })
  ],
  authority_approval: org_admin_approval_ref
}

PromotionResult = 
  | Promoted { new_scope: [org_catalog_view], dossier_updated: puffy_v1.1 }
  | Rejected { 
      overlap_failures: [(user_session, merchant_B, obstruction)],
      authority_denied: null
    }

Promotion is not automatic. The system checks the gates, and if any gate fails, it produces a rejection with a structured explanation. The user can then decide: fix the overlap disagreement, obtain the missing calibration, or request authority approval.

What Predicate Invention Is Not

It is easy to confuse predicate invention with superficially similar operations.

Not AI creativity. The system is not dreaming up concepts. It is evaluating a candidate proposed by a user, checking it against three obligations, and producing an artifact. Governed cognition, not unstructured generation.

Not schema-on-read. Schema-on-read defers typing to query time but provides no coherence guarantees. Two queries can interpret the same field differently with no reconciliation. Predicate invention is schema extension with receipts.

Not feature engineering. Feature engineering is typically offline, batch, and opaque. An ML engineer adds columns to a training set; the model learns to use them. Predicate invention is online, incremental, and auditable. The predicate exists as a first-class object with provenance, not as a hidden weight.

Not ontology construction. Ontologies are designed by committees, published as standards, and rarely modified. Predicate invention allows bottom-up, user-driven vocabulary extension under constraints. The committee is replaced by the three obligations.

Not embedding clustering. Embedding clusters are unlabeled and context-free. Predicate invention produces named, scoped, typed predicates with witness sets. "Cluster 47" becomes puffy : Dress → Score with a dossier.

What Makes This Different from ILP

Inductive Logic Programming (Muggleton, 1991) also "invents predicates." The Third Mode builds on that tradition but adds structure ILP doesn't have.

Classical ILP assumes a single background theory. The Third Mode works over a site of views with potentially different logics (A15). Two views can use different inference rules and different absence policies; overlap agreement must account for this.

Classical ILP has no notion of scope or authority. A predicate invented in ILP is immediately available everywhere. The Third Mode requires predicates to declare their scope and earn promotion through explicit gates.

Classical ILP produces Horn clauses. The Third Mode produces predicate dossiers with witness sets, invariants, provenance, and transport rules. The output is not just a formula; it is an operational artifact.

Classical ILP has no transport semantics. Once you have a predicate, you can use it anywhere. The Third Mode governs how predicates move along equivalences (A16). Transport requires certificates.

The Third Mode differentiator in three items:

1. Scope + authority: Every predicate has a declaring view, authority level, and explicit promotion path
2. Sheaf discipline: Overlap agreement is enforced; disagreement produces obstruction witnesses
3. Transport discipline: Once minted, the predicate's behavior under equivalence is governed by A16

ILP invents predicates inside a theory. The Third Mode invents predicates inside a jurisdiction.

Consequence

Predicate invention is the Third Mode's central capability. It closes the gap Chapter 5 identified: the ability to invent predicates locally while maintaining global coherence.

The three obligations are not bureaucracy but the price of vocabulary extension in a world where views disagree, logics vary, and transport is not free. Local grounding ensures the predicate has meaning somewhere. Overlap agreement ensures the predicate can participate in global coherence. Invariant preservation ensures the predicate doesn't break what already works.

The dossier is not paperwork but the artifact that makes everything else possible. Without it, predicates cannot be transported (you need to know what equivalences they respect), cannot be promoted (you need to know what overlaps have been checked), cannot be versioned (you need to know what compatibility witnesses exist).

Part IV continues by developing the surrounding constraints. Chapter 16 asks: what kinds of invariants exist, and how do they constrain predicate invention? Chapter 17 asks: what is the relationship between similarity (embeddings) and equivalence (witnesses)? Chapter 18 asks: how do you search the space of possible predicates? Chapter 19 asks: what does coherence cost, and when is the cost worth paying?

The machinery is operational. The vocabulary can grow. The question now is: under what discipline?

The companion paper Predicate Invention Under Sheaf Constraints (SCPI) formalizes the three obligations of A17 as a descent problem on a Grothendieck site and proves that the obstruction to global coherence of an invented predicate is classified by the first Čech cohomology group H^1 of the overlap nerve with coefficients in the equivalence group of the extension. The Extension Torsor Lemma established there shows that the space of globally coherent extensions forms a torsor over H^1 when the obstruction vanishes, and that predicate invention fails structurally — not merely by bad luck — when H^1 is nontrivial. This gives the three-obligation pipeline its mathematical backbone: Obligation 2 (overlap agreement) is the cocycle condition, and the obstruction witness produced on failure is a representative of a nontrivial cohomology class.