terraphim_rlm: require a per-sub-result verification plan (recheck / control / independent route) #969

Proposal

Make a verification plan for each sub-result a design requirement for terraphim_rlm decompositions. Decomposition alone does not make a long recursive run trustworthy. Every sub-call that produces a result the parent relies on should declare how that result is checked, for example:

• an exact or deterministic re-check (a recomputation, test, schema or invariant);
• a known-answer control instance run through the same path;
• an independent second route, where it is cheap.

Why

The nine-loop computation (Anthropic, 2026-09-25) is a budget-bounded, decomposable, long-running job of exactly the kind RLM targets. The result was trusted because of its checks, not because of the run itself: an eight-loop control checked against the published value, exact arithmetic modulo several primes, and a cross-check between two representations. The open bugs #3405 (the Firecracker stub reports exit 0 when no VM ran) and #3406 (silent fallback to LocalExecutor) are the failure class this guards against. A sandbox that reports success when nothing ran passes every check except a known-answer control.

Acceptance

• The RLM design doc states the requirement.
• rlm_* sub-call results carry a verified_by field: none, recheck, control or independent. The parent can refuse results marked none for gated outputs.
• At least one control instance in the RLM test suite fails loudly when the executor does not actually run code (covers #3405 and #3406).

Mirror of Gitea terraphim/terraphim-ai# (source of truth).