Kill Web Doctrine Deep Dive 94 Rules, 13 Namespaces, 3 Classifiers, 0 Violations
The Kill Web Doctrine demo is the flagship demonstration of CLARA's constraint-objective separation architecture. It implements a complete military engagement authorization pipeline where learned ML classifiers compose with formal doctrine rules to produce verifiably safe targeting decisions. Every decision generates a formal proof certificate. Every constraint is SHA-256 verified. Every classifier -- from a high-accuracy CNN to a weak logistic regression -- produces zero safety violations.
Try the live demo: /clara/killweb-doctrine -- Load any of the 40 scenarios, select a classifier, run the pipeline, and inspect individual proof certificates.
Contents
1. The Engagement Pipeline
The doctrine engagement pipeline is a 7-stage process that takes raw scenario data and produces verified engagement authorizations. Each stage is independently auditable, and the pipeline generates a complete provenance chain from input to decision.
Scenario Loading
Load one of 40 pre-generated scenarios (4 types x 10 seeds). Each scenario defines a battlespace with 25-40 targets, each characterized by 40 features (threat level, proximity to protected sites, civilian density, radar signature, etc.). Total evaluation corpus: 1,179 targets.
ML Classification
Any of 3 classifiers produces target class predictions: CNN (96.8% accuracy), Logistic Regression (78.9% accuracy), or Composite (98.8% accuracy). The classifier is a black box to the composition engine -- it receives feature vectors and outputs class labels. The pipeline does not depend on which classifier is used.
Doctrine DAG Initialization
The assured reasoning DAG is initialized with 94 rules across 13 namespaces. The 70 constraint rules (levels 1-4) are write-protected and SHA-256 hashed. The 4 objective rules and 20 tactical rules (levels 5-6) are loaded based on the active mission profile. Namespace isolation is verified before composition begins.
BFS Composition
The composition engine performs a 10-hop breadth-first search through the rule DAG for each target. Each hop evaluates rule predicates against the target's 40-dimensional feature vector and the ML classification. Rules fire or block based on feature thresholds, producing an authorization chain with full provenance.
ROE Verification
Rules of Engagement constraints are enforced as hard gates. Any target that violates a constraint rule at levels 1-4 is blocked regardless of ML classification or triage priority. The verification step generates a formal proof for each target documenting which rules fired, which blocked, and the complete decision chain.
Triage Scoring
Authorized targets are scored using mission objective rules (levels 5-6). Different mission profiles weight threat imminence, collateral risk, and strategic value differently. This reorders the engagement queue without changing any authorization decision -- a target that is ENGAGE remains ENGAGE, but its priority changes.
Quality Gate
Final validation checks: constraint hash invariance (SHA-256), zero violations across all constraint namespaces, proof certificate completeness (one per target), and namespace isolation verification. Any failure at this stage halts the pipeline.
2. The Rule Architecture
CLARA's rule architecture implements a 6-level precedence hierarchy derived from actual military doctrine. The hierarchy is not a design choice -- it reflects the legal and operational precedence that governs real engagement decisions.
Precedence Hierarchy
Law of Armed Conflict (LOAC)
Immutable. Geneva Conventions, Hague Conventions, customary international humanitarian law. Rules: distinction (civilian vs. combatant), proportionality (military advantage vs. collateral), necessity. These rules cannot be overridden by any lower level. Doctrine: Geneva Conventions I-IV, Additional Protocols I-II.
No-Strike List (NSL)
Immutable. Protected sites: hospitals, schools, religious sites, cultural property, diplomatic facilities. Maintained per CJCSI 3160.01. Any target within the exclusion radius of a protected site is blocked regardless of classification. Doctrine: CJCSI 3160.01, Annex E (No-Strike Entity List).
Rules of Engagement (ROE)
Immutable per mission. Authorized weapons, engagement conditions, escalation thresholds. Set by the combatant commander and not modifiable at the tactical level. Three modes: weapons_free, weapons_tight, weapons_hold -- each with different authorization thresholds. Doctrine: JP 3-60, CJCSI 3121.01B.
Collateral Damage Estimation (CDE)
Immutable methodology. 5 sub-levels of collateral damage estimation from CDE-1 (no concern) through CDE-5 (significant concern requiring combatant commander approval). Each sub-level has specific feature thresholds for civilian density, proximity to protected sites, and blast radius. Doctrine: CJCSI 3160.01, NWP 1-14M.
Tactical Priority + Mission Objectives
Mutable per mission profile. Priority scoring based on threat imminence, strategic value, and mission-specific weights. SEAD missions prioritize air defense targets; urban protection missions prioritize collateral minimization. These rules affect triage ordering but cannot override any constraint at levels 1-4.
User Rules
Additive only. Operator-defined rules that further restrict (never relax) engagement criteria. A user rule can add conditions for engagement but cannot remove existing constraints. This ensures the operator can only make the system more conservative, never less.
Constraint vs. Objective Distinction
The architectural separation between constraints (levels 1-4) and objectives (levels 5-6) is enforced structurally:
- Constraint rules are stored in write-protected namespaces (
loac,nsl,roe,cde_*, and others -- 10 constraint namespaces total). They are hashed at initialization and verified at the quality gate. Any modification causes a hash mismatch and pipeline halt. - Objective rules are stored in separate namespaces (
mission_obj,tactical,user). They can be swapped between mission profiles without affecting constraint verification. - SHA-256 verification: The constraint hash
a326fadc...is computed over all 70 constraint rules. This hash is identical across all 5 mission profiles (default, SEAD, urban protection, time critical, defensive), proving that mission objectives never modify safety constraints.
3. ML-Agnostic Composition
The central insight of CLARA is that safety guarantees are architectural properties of the composition engine, not properties of the ML model. A bad classifier does not produce unsafe decisions -- it produces conservative decisions, because the composition engine holds uncertain targets for human review rather than authorizing them.
Results by Classifier
| Classifier | Classification Accuracy | Pipeline Accuracy | Constraint Violations | Proof Certificates |
|---|---|---|---|---|
| CNN | 96.8% | 94.7% | 0 | 1,179 |
| Logistic Regression | 78.9% | 58.4% | 0 | 1,179 |
| Composite | 98.8% | 87.6% | 0 | 1,179 |
Key result: The logistic regression classifier is 18 percentage points less accurate than the CNN (78.9% vs. 96.8%), yet it produces the same number of constraint violations: zero. A weaker classifier produces more HOLD decisions (targets held for human review) rather than unsafe ENGAGE decisions. The safety guarantee is a property of the architecture, not the model.
All three classifiers generate the same number of proof certificates (1,179 -- one per target) with the same constraint hash. The proof structure is identical; only the classification labels and resulting authorization decisions differ.
4. Mission Profiles (Objective AR Layer)
Mission profiles demonstrate the constraint-objective separation in action. Each profile changes the level 5-6 objective rules while leaving the level 1-4 constraint rules untouched. The result is operationally meaningful triage reordering without any change to safety guarantees.
Available Mission Profiles
| Profile | Operational Focus | Priority Weighting |
|---|---|---|
| Default | Balanced engagement | Equal weight across threat, value, and collateral factors |
| SEAD | Suppression of Enemy Air Defenses | Air defense targets prioritized; radar and SAM sites elevated |
| Urban Protection | Collateral minimization | Low-CDE targets prioritized; high civilian density deprioritized |
| Time Critical | Imminent threat response | Threat imminence weighted highest; time-sensitive targets elevated |
| Defensive | Force protection | Threats to friendly forces prioritized; offensive targets deprioritized |
Measured Effects
- Kendall's tau = -0.0962 between opposing mission profiles (e.g., SEAD vs. Urban Protection), confirming statistically significant reordering of the engagement queue.
- 20-26% of ENGAGE targets are reordered per profile change -- operationally meaningful triage differences.
- SHA-256 constraint hash identical across all 5 profiles:
a326fadc.... The constraint rules do not change. Only the objective-layer triage scoring changes.
What this proves: Mission commanders can change operational priorities on the fly without re-verifying safety constraints. The constraint verification from the default profile carries over to SEAD, urban protection, or any other profile because the constraint rules are structurally immutable.
5. AR-Governed Training
CLARA does not just wrap ML models at inference time -- it uses the same rules engine to govern ML training. The doctrine rules produce a cost matrix that replaces the standard cross-entropy loss function with a doctrine-aware loss function. This closes the loop: the same YAML rules that enforce constraints at inference time also penalize doctrine-violating classifications during training.
How It Works
- Cost matrix derivation: Each pair of (true class, predicted class) is assigned a cost based on the doctrine rules that would fire for that misclassification. Misclassifying a protected site as a valid target incurs the highest cost. Misclassifying a valid target as protected incurs a lower cost (conservative error). The cost matrix has 196 cells (14x14 class pairs).
- Training constraint rules: 7 explicit training constraints with doctrine citations govern what misclassifications are penalized and by how much. These are derived from the same level 1-4 rules used at inference time.
- Loss function replacement: Standard cross-entropy is replaced with a weighted cross-entropy where the weights come from the cost matrix row for the true class. This makes the ML model doctrine-aware during training, not just at inference.
Training Variants and Results
| Training Variant | Loss Function | Doctrine Error Score | Reduction |
|---|---|---|---|
| Standard CE (baseline) | Uniform cross-entropy | 3.2 | -- |
| Constraint-only | Level 1-4 cost matrix | 2.8 | 12.5% |
| SEAD emphasis | SEAD-weighted cost matrix | 2.6 | 18.8% |
| Collateral emphasis | CDE-weighted cost matrix | 2.4 | 25.0% |
Key result: AR-governed training reduces doctrine errors by 25% (3.2 to 2.4) compared to standard cross-entropy training. The cost matrix is derived directly from the doctrine YAML -- 196 cells, 0 mismatches between the inference rules and training weights. The same rules engine produces both inference decisions AND training loss.