Pseudocode cookbook

FUNCTION register_package(upload, actor)
    REQUIRE actor HAS_PERMISSION "package.register"
    REQUIRE SAFE_FORMAT(upload.model_files)

    package <- EXTRACT_TO_QUARANTINE(upload)
    VERIFY_CHECKSUMS(package)
    VERIFY_SIGNATURES(package)
    SCAN_DEPENDENCIES(package)
    VALIDATE_MANIFEST_SCHEMA(package.manifest)

    digest <- CONTENT_HASH(package)
    REQUIRE NOT REGISTRY.CONTAINS_MUTABLE_CONFLICT(digest, package.manifest)

    record <- {
        digest: digest,
        created_at_utc: NOW_UTC(),
        created_by: actor.id,
        lifecycle: "candidate",
        manifest: package.manifest,
        provenance: package.provenance
    }

    REGISTRY.APPEND_IMMUTABLE(record)
    RETURN digest
END FUNCTION

PROCEDURE generate_population(parents, operator_catalog, budget, policy)
    population <- []

    WHILE budget.remaining > policy.minimum_candidate_cost
        operator <- SELECT_OPERATOR(operator_catalog, parents, budget, policy)
        proposal <- operator.PROPOSE(parents, policy.bounds)

        IF NOT POLICY_ADMITS(proposal)
            CONTINUE
        END IF

        result <- RUN_IN_DISPOSABLE_SANDBOX(proposal)
        budget.CHARGE(result.measured_cost)

        IF result.completed AND CHEAP_GATES_PASS(result)
            candidate <- PACKAGE_WITH_FULL_LINEAGE(result, proposal)
            APPEND population, candidate
        ELSE
            RECORD_FAILED_PROPOSAL(result, proposal)
        END IF
    END WHILE

    RETURN population
END PROCEDURE

FUNCTION evaluate_candidate(candidate, evaluation_contract)
    REQUIRE candidate.digest IS_IMMUTABLE
    REQUIRE evaluation_contract.version IS_FROZEN

    evidence <- NEW_EVIDENCE_RECORD(candidate.digest, evaluation_contract.version)

    evidence.integrity <- RUN_INTEGRITY_GATES(candidate)
    IF NOT evidence.integrity.pass
        RETURN FINALIZE_REJECTION(evidence)
    END IF

    evidence.behavior <- RUN_FROZEN_SUITES(candidate, evaluation_contract.suites)
    evidence.safety <- RUN_SAFETY_AND_ABUSE_SUITES(candidate)
    evidence.security <- RUN_ARTIFACT_AND_RUNTIME_TESTS(candidate)
    evidence.resources <- PROFILE_ON_TARGET_HARDWARE(candidate)
    evidence.robustness <- RUN_PERTURBATION_AND_FAILURE_TESTS(candidate)

    evidence.decision <- APPLY_VERSIONED_POLICY(evidence, evaluation_contract.policy)
    SIGN_AND_APPEND_EVIDENCE(evidence)
    RETURN evidence
END FUNCTION

FUNCTION select_candidate(evidence_set, deployment_context)
    eligible <- FILTER_HARD_GATES(evidence_set)
    IF eligible IS EMPTY
        RETURN NO_OP("no eligible candidate")
    END IF

    front <- PARETO_FRONT(
        eligible,
        maximize = [utility, robustness, coverage, calibration],
        minimize = [latency, memory, energy, risk, complexity]
    )

    ranked <- APPLY_CONTEXT_WEIGHTS(front, deployment_context)
    winner <- REQUIRE_MINIMUM_MARGIN_OVER_CHAMPION(ranked.first)

    IF winner IS NONE
        RETURN NO_OP("insufficient net improvement")
    END IF

    RETURN winner
END FUNCTION

FUNCTION route(request, catalog, runtime_state, policy)
    context <- CLASSIFY_CONTEXT(request)
    eligible <- FILTER_BY_CONTRACT_POLICY_AND_HEALTH(catalog, context, runtime_state)

    IF eligible IS EMPTY
        RETURN ABSTAIN("no eligible capability")
    END IF

    plan <- ROUTER.RANK(eligible, request, context)
    plan <- ENFORCE_COST_AND_LATENCY_BUDGET(plan, policy)

    result <- EXECUTE_PLAN_WITH_TIMEOUTS(plan)
    IF result.confidence < policy.acceptance_threshold
        RETURN ESCALATE_OR_ABSTAIN(result, context, policy)
    END IF

    RETURN result
END FUNCTION

PROCEDURE allocate_exploration_traffic(router, specialists, policy)
    FOR each specialist IN specialists
        minimum <- policy.minimum_evidence_traffic(specialist.risk_tier)
        IF specialist.recent_eligible_requests < minimum
            router.RESERVE_SHADOW_TRAFFIC(
                specialist,
                amount = minimum - specialist.recent_eligible_requests
            )
        END IF
    END FOR
END PROCEDURE

PROCEDURE release_candidate(candidate, champion, release_policy)
    REQUIRE RELEASE_BUNDLE_COMPLETE(candidate)

    shadow <- RUN_SHADOW(candidate, release_policy.shadow_window)
    IF NOT SHADOW_GATES_PASS(shadow)
        RETURN RETAIN_CHAMPION_AND_ARCHIVE(candidate, shadow)
    END IF

    FOR each stage IN release_policy.canary_stages
        canary <- ROUTE_BOUNDED_LIVE_TRAFFIC(candidate, stage.exposure)
        MONITOR_UNTIL(stage.minimum_duration)

        IF ANY_STOP_CONDITION(canary, stage)
            ROLLBACK_ATOMICALLY(champion)
            RETURN QUARANTINE_OR_ARCHIVE(candidate, canary)
        END IF
    END FOR

    PROMOTE_ALIAS_ATOMICALLY(candidate.digest)
    RETAIN_ROLLBACK(champion, release_policy.rollback_retention)
    RETURN PROMOTED(candidate.digest)
END PROCEDURE

PROCEDURE rollback(release, reason, actor)
    REQUIRE actor HAS_PERMISSION "release.rollback"
    target <- VERIFIED_ROLLBACK_TARGET(release)

    FREEZE_NEW_EXPOSURE(release)
    RESTORE_ATOMICALLY(
        model_aliases = target.model_aliases,
        router_policy = target.router_policy,
        schemas = target.schemas,
        feature_flags = target.feature_flags
    )

    VERIFY_HEALTH_AND_BEHAVIOR(target)
    APPEND_INCIDENT_EVENT(reason, actor, NOW_UTC())
    QUARANTINE(release.candidate_digest)
END PROCEDURE

PROCEDURE federated_round(contract)
    participants <- SELECT_ATTESTED_PARTICIPANTS(contract)
    signed_updates <- []

    FOR each participant IN participants IN PARALLEL
        update <- participant.TRAIN_LOCALLY(contract)
        local_evidence <- participant.EVALUATE_LOCALLY(update, contract.local_gates)

        IF local_evidence.pass
            APPEND signed_updates, SIGN_AND_CLIP(update, local_evidence)
        END IF
    END FOR

    valid <- VALIDATE_NORMS_SIGNATURES_STALENESS(signed_updates)
    aggregate <- ROBUST_SECURE_AGGREGATE(valid)
    candidate <- APPLY_TO_PARENT(contract.parent_digest, aggregate)

    RETURN CENTRAL_INDEPENDENT_EVALUATION(candidate, contract)
END PROCEDURE

PROCEDURE retire_package(package, reason, policy)
    REQUIRE package IS_NOT_CURRENT_ROLLBACK_TARGET
    REMOVE_FROM_ROUTER_ELIGIBILITY(package)
    WAIT_FOR_ACTIVE_LEASES_TO_DRAIN(package)
    UNLOAD_FROM_RUNTIME(package)

    REGISTRY.APPEND_STATE_CHANGE(
        digest = package.digest,
        state = "retired",
        reason = reason,
        retired_at_utc = NOW_UTC()
    )

    RETAIN_ARTIFACT_OR_TOMBSTONE(policy.retention_for(package))
    PRESERVE_LINEAGE_AND_EVIDENCE(package)
END PROCEDURE

PROCEDURE contain_suspected_lineage(root_digest, signal)
    affected <- LINEAGE.DESCENDANTS_INCLUDING(root_digest)
    FREEZE_PROMOTIONS(affected)
    REMOVE_FROM_NEW_TRAFFIC(affected)
    REVOKE_RELATED_CREDENTIALS(signal.scope)
    PRESERVE_FORENSIC_ARTIFACTS(affected)

    safe_target <- FIND_LAST_KNOWN_GOOD_UNAFFECTED_CHAMPION()
    ROLLBACK_ATOMICALLY(safe_target)
    START_INCIDENT_REVIEW(signal, affected)
END PROCEDURE