WSP typed-policy networks (100 rules): compiled, verified, illustrative

These are two small CPU neural networks that execute a typed 100-rule decision policy exactly. Given a raw record, each returns the decision and the identifier of the rule that produced it. The weights were constructed by a deterministic compiler, not trained. They come from the Weight-Space Programming study v3.

Illustrative only. Both policies were synthetically generated for research. They are not company-approved business policies, and these models must not be used to make real invoice-approval or access-control decisions.

The policies are included in readable form (*.policy.txt) and in their formal DSL (*.policy.json).

Usage

You need only numpy and safetensors:

pip install numpy safetensors

from wsp_runtime import WSPModel, SchemaError

m = WSPModel.load("invoice_R100.safetensors")

invoice = {
    "amount_inr": 2_500_000, "po_ratio_bps": 10_400, "vendor_age_days": 45, "invoice_age_days": 12,
    "missing_fields": 0, "line_items": 18, "payment_terms_days": 30, "has_po": True,
    "duplicate_flag": False, "vendor_watchlist": False, "tax_id_verified": None,   # nullable: not yet checked
    "vendor_risk": "high", "category": "services", "currency": "INR", "region": "west",
}
print(m.predict(invoice))
# {'action': 'hold', 'rule_id': 'INV-008', 'policy_version': '1.0',
#  'model_hash': '105a302d29987ea7afeb33259e8dd301024d014a2f6669a54f967283d858256e'}

m.predict_many([invoice, invoice])     # batch

try:
    m.predict(dict(invoice, amount_inr=250_000_000))
except SchemaError as e:
    print("rejected:", e)              # amount_inr: 250000000 outside [1, 100000000]

Rule INV-008 in invoice_R100.policy.txt is: has_po is true and currency is INR and duplicate_flag is false → hold. It is the first rule, in priority order, that matches this record.

example.py runs the snippet above, the access-control model and the shipped example records. Its output:

policy lock-invoice-R100-00 version 1.0 | 125 rule slots
{'action': 'hold', 'rule_id': 'INV-008', 'policy_version': '1.0', 'model_hash': '105a302d…'}
expected INV-001  -> hold     INV-001
expected INV-002  -> escalate INV-002
expected INV-003  -> hold     INV-003
expected DEFAULT  -> approve  DEFAULT
rejected: amount_inr: 250000000 outside [1, 100000000]
{'action': 'deny', 'rule_id': 'ACC-032', 'policy_version': '1.0', 'model_hash': '6710c20c…'}

Using it as a "System One" decision component

system1_example.py wraps the model as a decision gate. The model makes the fast, exact, auditable policy decision. Slower reasoning, by a human or an LLM agent, gets only the cases that are routed to it:

INV-0001  hold     INV-008  -> hold_queue          241.8 us   if has_po is true and currency is INR and duplicate_flag is false, then hold.
INV-0003  escalate INV-002  -> system2_review       49.8 us   if payment_terms_days is greater than 135 days and amount_inr is greater than 50…
INV-0005  approve  DEFAULT  -> auto_pay             44.1 us   no rule applied (policy default)
INV-0099  None     None     -> data_quality_queue    8.3 us   invalid record: amount_inr: -5 outside [1, 100000000]
batch: 10,000 decisions in 0.21 s (47,439/s, incl. validation + encoding)

Design rules the example follows:

• Routing: approve goes straight through, hold and escalate go to queues, and reject triggers a notification.
• Invalid records: they are never guessed. They go to a data-quality queue.
• Explanations: the rule text shown with a decision is looked up from *.policy.txt after the network has decided. It is an explanation for people, not part of the decision.
• System Two's role: it handles only the routed cases. Any change it makes to a System One decision must be logged as an explicit override.
• Audit trail: every decision is written to audit_log.jsonl with its model_hash and policy_version, so an audit can show exactly which policy version decided each case.

The timings shown are single-thread CPU measurements from one machine and are illustrative only.

Testing

test_system1.py is an acceptance test. It downloads this repository (or reads a local copy given with --local <folder>) and checks both models:

1. Integrity: the weight hash matches the tensors.
2. Examples: each shipped example gets its expected rule.
3. Agreement: on 20,000 random schema-valid records, the network matches an independent first-match interpreter that reads *.policy.json.
4. Boundaries: records at threshold −1, threshold and +1 agree with the interpreter.
5. Rejection: invalid inputs (out of range, wrong type, unknown category, extra field, missing field) are rejected.
6. Determinism: predicting the same records twice gives identical results.
7. Latency: single-record and batch speed are reported for information.
8. Routing: System One routing is consistent, and invalid records never get an action.

pip install numpy safetensors huggingface_hub
python test_system1.py

The script exits with status 1 if any check fails.

What is in the file

• Tensors. There are 10 float64 tensors for a plain affine/ReLU network: h1 = ReLU(W1 x + b1), h2 = ReLU(W2 h1 + b2), h3 = ReLU(W3 h2 + b3), decision = argmax(Wd h3 + bd), rule = slot_table[argmax(Wa h3 + ba)].
  • Shapes for R = 100: D → 750 → 125 → 126, with heads of size 4 and 126.
  • Capacity includes 25 spare rule slots for future rule insertions.
• String metadata. This holds the typed schema (field types, ranges, missing-value rules and power-of-two input scales), the action names, the slot table, the policy id/version and semantic hash, and the model and weight hashes. wsp_runtime.py checks the weight hash every time it loads a file.
• No code. The file contains no pickle and no executable code, and no rule interpreter is used at prediction time.

How it was built and what is verified

The compiler turns each condition into a pair of ReLUs that give an exact 0/1 test on integer inputs. For example, q > T becomes ReLU(q−T) − ReLU(q−T−1). A third layer computes the AND of each rule's conditions, and a fourth enforces first-match priority. For both shipped models:

1. Structural verification passed. A verifier reads only the weights and proves, in exact arithmetic, that the network's decision and rule ID match the policy's first-match outcome for every record in the declared schema domain.
2. The float64 certificate passed. Every input, product and partial sum is an exactly representable integer below 2^53 over the whole domain, so float64 evaluation is exact in any summation order.
3. Empirical check. Each model matched the independent reference interpreter on all 8,169 (invoice) and 8,115 (access) records of its locked evaluation suite. Those suites cover natural, boundary, rule-intersection, conflict, per-rule and shifted records. The safetensors round trip is bit-exact (release_check.json).

Limitations

• Domain. Correctness is proved only for the declared typed domain and this exact encoding (v3-pow2-1). Records outside the declared ranges are rejected, not extrapolated.
• dtype. Run the models in float64. The invoice model is not correct in float32: amounts up to 1e8 exceed float32's exact-integer range.
• Confidence. Logits do not express uncertainty. Softmax scores reflect a fixed scale (α = 10), not a probability that the decision is correct.
• Language. This is structured policy execution. It is not natural-language understanding, and it says nothing about how LLM-written or trained networks behave.
• Policy updates. Changing a policy means recompiling (or applying the compiler's incremental update) and releasing a new file with a new model_hash.

Provenance

• Source run: study_v3 run v3_27d0274c32.
• Policies: lock-invoice-R100-00 and lock-access-R100-00.
• Model hashes: listed in release_check.json.
• Reproduce: python tasks.py v3-local, then python study_v3/release/export.py, in the study repository.

License

Apache-2.0.