Epic: pluggable feasibility-model registry — falsify prescriptions per (sport, goal) instead of predicting outcomes

[bepcyc]

Derivative of #25. That issue establishes the type split (NUMBER vs PRESCRIPTION) and the near-term safety slice (decision-aware gate + no in-place rewrite of prescriptions). This issue is the research-gated epic: how we actually verify a prescription once we stop rewriting it.

The framing decided in #25 (discussion): falsify, don't predict. The science says a single point-prediction simulator is not achievable — the fitness-fatigue model is statistically ill-conditioned with poor parameter identifiability and overfitting fatigue terms (Sci Rep 2025), and Banister himself recommended re-fitting every 60–90 days. So the verifier's job is refutation against a typed feasibility envelope, with stated residual uncertainty — never a promise of outcome. This keeps the "model never self-certifies" invariant and breaks the recursion (a sound critic need not be as capable as the planner — LLM-Modulo, Kambhampati et al., ICML 2024).

Goals

1. Feasibility-model registry, keyed by (sport, goal_type), each model implementing one interface:

   check(prescription, canonical_state, goal) -> {feasible | infeasible | uncertain,
                                                  binding_critique, citation}
   

   • Declared default per domain + a rule-based floor when no fitted model applies.
   • Unknown / unsupported (sport, goal_type) → abstain/degrade honestly ("can't verify a plan for this yet"), never flatten to 7×CTL maintenance.
   • GoalType is a closed enum (EVENT, TARGET_METRIC, DISTANCE, PROCESS, OTHER, domain/enums.py:339); sport is the data-driven registry (persistence/models/athlete.py). The registry key is (sport, goal_type).

2. Banded endurance verifier (first concrete model). Reuse the existing deterministic, seedable AnalyticsService.pmc(...) (analytics/pmc.py, service.py:315) as the forward integrator. Simulate CTL/ATL/TSB across a plausible parameter band, not a point estimate; CONTRADICTED only when infeasible across the whole band; in-band ambiguity → DEGRADE with uncertainty stated.

3. Safety envelope as review flags, not injury predictions — and explicitly NOT ACWR. ACWR is discredited as a causal/predictive injury metric (Impellizzeri et al. 2020, PMID 32502973; 2024 review); the persisted daily_wellness.acwr column (persistence/models/wellness.py:126, read by nothing) stays orphaned. Use instead:

   • bounded weekly ramp rate (coaching guardrail);
   • Foster monotony & strain (Foster 1998, MSSE, PMID 9662690);
   • internal consistency (weekly total = Σ prescribed sessions — subsumes 7×CTL as one feasible point);
   • timeline coherence (room for a taper before target_date).

4. Intensity anchoring off canonical thresholds — we already have CRITICAL_POWER_W, W_PRIME_J, FitnessSignature.ftp_w. Verify per-session targets as deterministic functions of CP/FTP (zone derivations), extending the closed derivation table the 7×CTL precedent legitimized.

5. Strength / hypertrophy is a different verifier, not the same simulator. It is not an impulse-response phenomenon — model it as volume landmarks (MEV→MAV→MRV) + progressive overload per the ACSM progression-model position stand 2009 and the RP volume-landmark framework. This is the clearest reason the registry must support heterogeneous models behind one interface rather than one universal simulator.

6. Close the generate-test loop. Per-claim grounding critiques are computed in ground and discarded before compose (graph_state.py render_context), so REGENERATE is a blind re-roll that re-trips the same wall. Render machine-readable binding_critiques back into the redraft context — turns the existing loop into a real LLM-Modulo loop with no graph-topology change. A natural extension: deterministic optimal-control over the FF model proposes a feasible load scaffold the LLM only narrates (Busso & Thomas 2006 lineage).

7. New citation kind feasibility_envelope (preferred over simulated_trajectory) — records model_id, parameter_band, binding_critique; reproducible from (canonical_state, prescription, model_id, band). Add alongside existing kinds metric / user_request / name / url.

Coordination with #10

#10's entailment verifier makes prescriptions worse if applied naively — nothing future is entailed by a record of the past, so a stronger descriptive verifier scrubs progressive plans harder. #10 and this epic must share the PRESCRIPTION claim type as the seam so they compose. Prescriptions need different verification semantics, not more descriptive rigor.

Verification principle

Verify adherence to coaching principles (progressive overload, recovery/supercompensation, specificity, timeline) — not predicted outcomes. A taper week is feasible because the recovery principle demands it before an event, not "wrong because it is below 7×CTL."

Eval (plan goldens the current suites can't express)

• A build-plan case asserting simulation-feasible progressive targets survive grounding.
• A taper case asserting a prescribed load is never rewritten upward.
• A strength-goal case asserting the agent degrades honestly when no fitted model applies, rather than flattening to maintenance.
• An ambiguity case asserting in-band uncertainty yields DEGRADE (stated), not CONTRADICTED.

Spec-first

Define the PRESCRIPTION claim type, the registry interface, and the feasibility_envelope citation contract in the grounding + forward-model specs before code, so the new citation kind is normative and the agent can cite it.

Open research questions (carried from #25 debate)

• Which parameter priors/bands per sport, and how to narrow them from sparse individual history without overfitting (the identifiability trap).
• Minimum viable model set for v1 (proposal: endurance-event default + rule-based floor; strength = explicit "not yet verifiable").
• How to surface residual uncertainty to the athlete in the approval surface without eroding trust.

[bepcyc]

Starting spec-first — sequencing the epic so the debate-free parts ship before the contested science

The safety slice (#83) and the contract (ADR 0008) are in. The epic is large and genuinely research-gated, so the key move is to separate what needs debate from what doesn't and ship the latter first. Three of the four pieces below need almost no contested science.

Increment 1 — registry skeleton + feasibility_envelope citation (debate-free)

The pluggable interface and the new citation kind carry no modeling choices, only plumbing:

# new: agent/feasibility.py
class FeasibilityVerifier(Protocol):
    sport: str          # registry key part 1
    goal_type: str      # registry key part 2 (domain/enums.py GoalType)
    def check(self, prescription: Prescription, state: CanonicalState,
              goal: Goal | None) -> FeasibilityVerdict: ...

@dataclass(frozen=True)
class FeasibilityVerdict:
    status: Literal["feasible", "infeasible", "uncertain"]
    binding_critique: str            # machine-readable, fed back to compose (LLM-Modulo)
    citation: dict | None            # {"kind": "feasibility_envelope", "model_id", "parameter_band", ...}

Registry keyed by (sport, goal_type) with a declared default + rule-based floor; an unsupported pair returns uncertain (→ honest abstain), never flattens to maintenance. This wires into _verify_claim as the prescriptive branch — replacing today's "scrub all prescriptions" interim with "ask the registry."

Increment 2 — internal-consistency verifier (debate-free arithmetic)

The least contested check, pure arithmetic, no physiology: stated weekly total == Σ prescribed sessions, and maintenance (7xCTL) is one feasible point, not the whole space. This alone lets a maintenance/sum-consistent plan ground again without any impulse-response modeling — and gives the registry its first concrete member.

Increment 3 — banded endurance verifier (this is where the science lives)

Reuse the existing seedable AnalyticsService.pmc(...) as the forward model. Simulate across a parameter band, CONTRADICTED only if infeasible across the whole band; in-band ambiguity → uncertain/degrade. This is the piece that needs your debate — see open questions below.

Increment 4 — close the generate-test loop (debate-free)

Render the binding_critiques back into the compose context (today they're discarded before redraft). Turns the existing REGENERATE cycle into a real LLM-Modulo loop, no graph-topology change.

---

What I need your call on before Increment 3 (the contested science)

1. Parameter bands. Population priors per sport, and how much to narrow from sparse individual history without falling into the identifiability trap (Sci Rep 2025). Proposal: fixed conservative band in v1 (no per-athlete fitting yet), widen only when there's enough history.
2. Minimum viable model set for v1. Proposal: endurance-event default + internal-consistency floor; strength = explicit "not yet verifiable" (honest abstain). Agree?
3. Surfacing uncertainty. How an uncertain verdict reads to the athlete on the approval surface without eroding trust.
4. Coordination with Grounding gate verifies values against a verification target the drafting model itself chooses — claim *bindings* (metric, as_of) are self-certified, so "real" numbers can ship in false sentences #10. The PRESCRIPTION seam must be shared so its entailment verifier doesn't scrub progressive plans harder.

I can start Increments 1, 2, and 4 now (they don't depend on the contested modeling and each is independently shippable), and hold Increment 3 until you've weighed in on the four questions. Say the word and I'll open a branch for Increment 1 (registry + citation), keeping it behind the existing scrub-interim until a verifier is registered.

---

Generated by Claude Code