---
title: Stage 6
type: reference
tags: :passepartout:roadmap:
created: 2026-05-24
---

← [[id:4a1f23b0-abc6-4def-9876-543210abcdef][Stage 5 — Weights]]  → [[id:4a1f23b0-abc8-4def-9876-543210abcdef][Stage 7 — Remaining]]

# Stage 6: Training

*Summary: Verified fine-tuning under the gate. Every example checked for consent.
Every gradient application is a verified state transition. The neural world model
runs in parallel with the LLM for sensory-physical prediction.*

## What is added

### Verified fine-tuning

The training loop is not a script. It is a verified function in the evaluator:

1. Read a training example from the [[id:1c95ce7d-a2db-506a-9608-df68f9ae211b][memory graph]]
2. Check the example's authorization tag against [[id:45ea493b-94ad-5885-aa65-0c846e5c3c1d][policy]]
3. Compute the gradient
4. Check gradient constraints (permitted weights, bounded LR, scope limits)
5. Apply the update
6. Record the state transition with a Merkle link to the input

### The neural world model (LeCun type)

A second neural network runs on the tensor unit alongside the LLM. It predicts
sensory and physical dynamics — object trajectories, scene evolution, low-level
sensor futures. It shares the same plist-native weight architecture and the
same verified training pipeline:

- **Domain:** physical world prediction (not social — that belongs to the
  accumulated knowledge DAG)
- **Training:** imported from conventional [[id:84a537b4-4256-50c8-91f5-dd5b4538418f][hardware]]. Pretrain elsewhere,
  verify import, fine-tune under gate
- **Gate interaction:** the world model proposes predictions to the gate
  ("the ball will land at position X"). The gate falsifies predictions against
  the accumulated observation DAG after the fact, tracking calibration over
  time. This is verification through falsification, not authorization

### The interaction at Stage 6

1. World model predicts sensory outcome: "user will press button in 2 seconds"
2. LLM reasons about the predicted outcome: "if user presses button, C follows"
3. LLM proposes action to gate: "preempt C"
4. Gate checks policy + accumulated knowledge for similar past scenarios
5. Gate authorizes or denies
6. After outcome occurs, gate falsifies world model's prediction against actual
   observation, updating calibration score

## What is eliminated

- **Data poisoning** — every training example is authorized before gradient
  application. Only data tagged with consent is trainable
- **Unauthorized fine-tuning** — training policy specifies scope (layers, LR,
  data tags) and the gate enforces all constraints at every step
- **Malicious checkpoint injection** — no checkpoints. Training is a verified
  sequence of continuous state transitions
- **Training-time backdoors** — the optimizer function is verified by hash.
  A Trojan optimizer fails the gate check because its identity doesn't match

## What does this cost?

- **~100x slower than conventional fine-tuning** — building on Stage 5's 100x
  overhead (GPU path) plus verified gate checks per example. A LoRA fine-tuning
  that takes 2 hours natively takes ~200 hours. Doable overnight, not for rapid
  iteration
- **Storage per training step** — every Merkle-tracked state transition adds
  to the memory graph. A fine-tuning run could produce hundreds of terabytes
  of deltas
- **Only fine-tuning is practical** — full pretraining on the Lisp machine never makes
  sense. The 100x overhead is structural. Practical workflow: pretrain on
  conventional GPU cluster → import as verified blob → convert to plist-native
  under gate → fine-tune on the Lisp machine
- **Data gate latency** — every training example passes through the
  authorization gate. For datasets with millions of examples, this pre-
  processing step can take days
- **Wrong-spec for training policy** — the training policy is the most
  security-critical spec. A compromised admin writing a policy that authorizes
  all layers and all data defeats the system through its own verification

## What does this enable?

You can train on private data with proof of consent per example. The fine-tuning
history is structural, not logged — every gradient step is Merkle-linked to its
input. The world model gives the system sensorimotor common sense: object
persistence, trajectory prediction, basic physics — grounded in this specific
environment's observations.

## When is this viable?

- **Fine-tuning (GPU path):** 3-5 years on server hardware
- **World model:** same timeline — shares the pipeline and tensor unit
- **ASIC native:** when tensor unit silicon arrives (5-10 years)

## In practice

Training integrity is guaranteed at every step. Data consent is verified per
example. The optimizer cannot be swapped. Checkpoints cannot be backdoored.
But this system is not for training frontier models — it is for auditing
training runs that happen elsewhere.

The practical workflow is: pretrain on a conventional GPU cluster, import the
weights into the Lisp machine as a verified blob (Stage 4), then fine-tune on the Lisp machine
under the verified training loop. The pretraining phase remains unverified,
but the fine-tuning phase — where the model gains knowledge of private data
and user preferences — is verified. This is the pragmatic sweet spot.

The world model learns your environment's physics — how your voice sounds,
how your face moves when confused, how quickly you respond to different
message types. The gate falsifies its predictions, so the world model
converges toward accurate beliefs about your world, not the statistical
average of the internet.

← [[id:4a1f23b0-abc6-4def-9876-543210abcdef][Stage 5 — Weights]]  → [[id:4a1f23b0-abc8-4def-9876-543210abcdef][Stage 7 — Remaining]]

:PROPERTIES:
:CREATED:  [2026-05-24 Sun]
:WEIGHT:  19
:ID:       4a1f23b0-abc7-4def-9876-543210abcdef
:END:
