The Problem

A companion paper derives Boundary 2 from Tarski’s undefinability theorem¹ applied to the verification architecture as its proper target. The derivation proceeds as follows: a verification architecture sufficiently expressive to evaluate the assertions entering its decision chains must assign truth values to those assertions; if the architecture could define its own truth predicate from within its own language, Tarski’s theorem would be violated; therefore the truth predicate must be defined from a position outside the architecture’s own language; therefore verification must speak from a metalanguage.

The philosophical reviewer’s objection is the same as for Boundary 1: institutional verification architectures are not formal languages in the strict Tarski sense. This note answers the objection the same way: by grounding the derivation in the Lawvere-Yanofsky generalisation, which operates at a level of abstraction above the distinction between formal languages and institutional verification languages.

The companion paper on Boundary 1² established the Lawvere-Yanofsky scheme and the definition of a verification architecture $\mathcal{V =}(A,C)$. This paper inherits both. The scheme is restated for completeness; the definition is cited by reference.

The Lawvere-Yanofsky Scheme (Restated)

The following restates the scheme from the Boundary 1 paper.³

Theorem 1 (Lawvere-Yanofsky Diagonal Lemma). Let $A$ be a set, let $B$ be a set with at least two elements, and let $\varphi:A \rightarrow B^{A}$ be a surjection. Then every function $g:B \rightarrow B$ has a fixed point.

Corollary 2 (Universal Diagonal Argument). Let $g:B \rightarrow B$ have no fixed point. Then no $\varphi:A \rightarrow B^{A}$ is surjective.

Verification Architecture (Inherited)

The definition of a verification architecture $\mathcal{V =}(A,C)$ and its derived components ($R$, $V = C^{R}$) are as established in the Boundary 1 paper (Definition 1, Condition 2). The relevant properties are:

• $A$ is a set of assertions, closed under conjunction and disjunction.

• $C:A \times V \rightarrow \{ + , - \}$ is the certification function, well-defined, where $V \subseteq A$.

• $R$ is the record of evaluations $C$ has produced.

• $V = C^{R} = \pi_{2}(R)$ is the set of verification procedures.

• $\mathcal{V}$ is sufficiently expressive: for any $a \in A$ and $v \in V$, the statement “$a$ was verified by $v$ and admitted” is itself in $A$.

This paper requires one additional condition.

Condition 3 (Truth-Evaluative Capacity). $\mathcal{V}$ is truth-evaluative if it assigns truth values to the assertions it evaluates. That is, for any $a \in A$ that has been evaluated, the architecture produces a judgment in $T = \{ + , - \}$, where $+$ denotes “the assertion is accepted as true for the purposes of the decision chain” and $-$ denotes “the assertion is not accepted as true.”

Remark 4. This condition is not a philosophical commitment to a theory of truth. It is a structural property of the architecture: the architecture accepts or rejects assertions for the purposes of its decision chains. Any architecture that produces binding decisions satisfies this condition, because a binding decision requires that the assertions entering the decision have been evaluated and either accepted or rejected. The truth values are operational, not metaphysical.

Remark 5. Boundary 1 and Boundary 2 target different properties of the same architecture. Boundary 1 asks: can the architecture attest that its own verification operations are consistent? (No.) Boundary 2 asks: can the architecture define a truth predicate over its own assertions from within its own language? (No.) The two constraints are logically independent. An architecture could in principle resolve one without the other. The Lawvere-Yanofsky scheme shows that neither is resolvable from within.

The Truth-Predicate Bound

The bound applies to any verification architecture that claims to define, from within its own assertion language, a truth predicate over its own outputs. Architectures that already delegate truth-evaluation to an external layer are not the target of this proof; they have already conceded the metalanguage position.

Definition 6 (Truth Predicate). A truth predicate for a verification architecture $\mathcal{V =}(A,C)$ is a function $\tau:A \rightarrow T$ where $T = \{ + , - \}$, such that $\tau(a)$ assigns to each assertion $a \in A$ its truth value within the architecture’s evaluation framework.

Definition 7 (Internal Truth Predicate). A truth predicate $\tau$ is internal to $\mathcal{V}$ if $\tau$ is expressible within $A$. That is, for every $a \in A$, the statement “$\tau(a) = +$” is itself an assertion in $A$, and the function $\tau$ is computed by the architecture’s own procedures without reference to any external evaluation.

Theorem 8 (Truth-Predicate Bound). Let $\mathcal{V =}(A,C)$ be a verification architecture satisfying Condition 3 and the expressiveness condition of the Boundary 1 paper. Then $\mathcal{V}$ admits no internal truth predicate. Specifically, there is no surjective $\psi:A \rightarrow T^{A}$ where $T = \{ + , - \}$.

Proof. The proof is a closed chain of four steps.

Step 1 (Structured domain). $A$ is closed under conjunction and disjunction (by definition of a verification architecture). The architecture can represent paired assertions, supplying the product-like structure the diagonal construction requires.

Step 2 (Self-referential encoding). By the expressiveness condition, for any $a \in A$, the truth-value assignment $\tau(a)$ is itself expressible as an assertion in $A$. The architecture can state, for any of its own assertions, whether that assertion has been accepted as true. Therefore a function $\psi:A \rightarrow T^{A}$ exists that encodes, for each assertion, the truth-value assignment the architecture would make over all other assertions. If $\psi$ were surjective, the architecture could internally define its own truth predicate: every possible truth-value assignment over $A$ would be encodable within $A$.

Step 3 (No fixed point). Let $g:T \rightarrow T$ be negation: $g( + ) = -$, $g( - ) = +$. Since $T$ has two elements and $g$ swaps them, $g(t) \neq t$ for all $t \in T$. No fixed point exists.

Step 4 (Diagonal argument). $A$ has product-like pairing capacity (Step 1), $\psi:A \rightarrow T^{A}$ exists (Step 2), $g$ has no fixed point (Step 3). By Corollary 2, $\psi$ is not surjective. There exist truth-value assignments over the architecture’s own assertions that $\psi$ does not encode. The architecture cannot define its own truth predicate from within. ◻

The Metalanguage Requirement

Corollary 9 (Verification Must Speak From a Metalanguage). For any verification architecture $\mathcal{V}$ satisfying the conditions of Theorem 8, the verification operation (the assignment of truth values to assertions) cannot be expressed within the language of $A$. The verification operation must speak from a metalanguage: a language $L_{M}$ that is not a sublanguage of the language in which the assertions of $A$ are formulated.

Proof. By Theorem 8, $\mathcal{V}$ admits no internal truth predicate. An internal truth predicate is precisely a truth-value assignment expressible within $A$. Since no such assignment is complete (the encoding $\psi$ is not surjective), any complete verification must employ a predicate defined outside $A$. The language in which this external predicate is defined is, by construction, a metalanguage with respect to $A$. ◻

Corollary 10 (Internal Ensembles Do Not Produce Verification). Let $\mathcal{V}_{1},\mathcal{V}_{2},\ldots,\mathcal{V}_{n}$ be verification architectures operating within the same language (i.e., sharing the same assertion set $A$ and expressiveness condition). Then the joint evaluation induced by $\mathcal{V}_{1},\ldots,\mathcal{V}_{n}$ does not produce an internal truth predicate for any $\mathcal{V}_{i}$.

Proof. Each $\mathcal{V}_{i}$ satisfies Theorem 8 individually. The joint evaluation operates within the same language $A$: the assertions produced by $\mathcal{V}_{i}$ as verification statements are themselves in $A$ (by the shared expressiveness condition). Therefore the aggregate function $\psi:A \rightarrow T^{A}$ induced by $\psi_{1},\ldots,\psi_{n}$ under any internal aggregation rule (majority, unanimity, weighted combination, or any other function definable within $A$) is itself a function from $A$ to $T^{A}$, and by Corollary 2 it is not surjective. The ensemble produces correlation (the same assertion evaluated multiple times within the same language), not independence (evaluation from a metalanguage position). Adding systems within the same language does not escape the bound. ◻

Remark 11. Corollary 10 is the formal ground for the companion paper’s claim that an ensemble of probabilistic systems operating within the same epistemic framework cannot produce independent validation. The term “epistemic framework” corresponds to the shared assertion set $A$ and expressiveness condition. The term “independent validation” corresponds to a surjective truth-value encoding. The Lawvere-Yanofsky scheme shows that surjectivity is unattainable within the shared framework regardless of how many systems are composed.

The Relationship Between Boundary 1 and Boundary 2

Boundaries 1 and 2 are both instances of the Lawvere-Yanofsky scheme applied to the same verification architecture $\mathcal{V =}(A,C)$. They differ in the target property:

Proposition 12. Boundary 1 and Boundary 2 are logically independent.

Proof. Boundary 1 follows from the non-surjectivity of $\varphi:A \rightarrow B^{A}$ where $B$ encodes verification-consistency. Boundary 2 follows from the non-surjectivity of $\psi:A \rightarrow T^{A}$ where $T$ encodes truth values. The two encodings are different functions (they assign different properties to the same assertion). The non-surjectivity of $\varphi$ does not entail the non-surjectivity of $\psi$, and conversely. Each requires its own application of Corollary 2. ◻

Remark 13. The two boundaries together establish that a verification architecture faces two distinct self-referential constraints: it cannot attest its own consistency (Boundary 1), and it cannot define its own truth predicate (Boundary 2). The architectural responses are complementary: an external record (Boundary 1) and a metalanguage verification position (Boundary 2). Neither substitutes for the other.

Institutional Architectures as an Instance

Proposition 14. Any institutional verification architecture satisfies Condition 3.

Proof. An institution that produces binding decisions evaluates assertions and accepts or rejects them for the purposes of its decision chains. Regulatory findings are accepted or rejected. Audit opinions are sustained or revised. Compliance certifications are granted or withheld. The truth-evaluative capacity is constitutive of institutional decision-making. The condition is not optional; it is a consequence of the institution’s function. 

Corollary 15. Institutional verification architectures admit no internal truth predicate. Institutional verification must speak from a metalanguage. An ensemble of institutional systems sharing the same assertion language does not produce independent verification.

Proof. By Proposition 14, institutional verification architectures satisfy Condition 3. The expressiveness condition was established in the Boundary 1 paper. The results follow from Theorem 8, Corollary 9, and Corollary 10. ◻

The Volume Condition

The companion paper argues that LLMs are the volume condition under which the metalanguage constraint became operationally binding. Before LLMs, the volume of assertions entering verification architectures was bounded by human production capacity. The constraint applied throughout, but architectures could proceed as if internal review (a second pair of eyes within the same epistemic framework) constituted verification, because the volume did not force confrontation with the distinction between correlation and independence.

LLMs collapsed the marginal cost of producing assertion-candidates. When an institution wraps tools around an LLM and treats the resulting self-inspection as verification, it is composing systems within the same language. By Corollary 10, this composition does not produce a truth predicate. It produces correlated evaluations within the bound. The constraint did not change. The condition under which the constraint became non-ignorable did.

Conclusion

The Lawvere-Yanofsky scheme, applied to truth-value assignment rather than consistency-attestation, shows that no verification architecture can define its own truth predicate from within its own language. The architectural conclusion is that verification must speak from a metalanguage. An ensemble of systems sharing the same assertion language multiplies correlation, not independence. The metalanguage position is not a design preference; it is the position the diagonal argument identifies as the one position from which verification can be complete.

References

Alfred Tarski, Pojecie prawdy w jezykach nauk dedukcyjnych (Warsaw: Nakladem Towarzystwa Naukowego Warszawskiego, 1933); German translation: “Der Wahrheitsbegriff in den formalisierten Sprachen,” Studia Philosophica 1 (1935): 261–405.

F. William Lawvere, “Diagonal Arguments and Cartesian Closed Categories,” in Category Theory, Homology Theory and their Applications II, Lecture Notes in Mathematics 92 (Berlin: Springer, 1969), 134–145; reprinted in Reprints in Theory and Applications of Categories 15 (2006), 1–13.

Noson S. Yanofsky, “A Universal Approach to Self-Referential Paradoxes, Incompleteness and Fixed Points,” Bulletin of Symbolic Logic 9, no. 3 (2003): 362–386.

Thorben Liebig, “On the Formal Foundation of Boundary 1: A Lawvere-Yanofsky Proof That Verification Architectures Cannot Attest Their Own Consistency” (2026).

Declaration on the use of AI tools. This paper was developed with the assistance of Claude (Anthropic, Claude Opus 4.6). The instrument was used for structural drafting, LaTeX formatting, editorial iteration, and bibliographic cross-referencing. All substantive claims, mathematical proofs, legal analysis, doctrinal positions, and architectural decisions are the author’s. The instrument produced no assertion that entered the final text without human verification at the gate. The verification architecture described in this paper was applied to its own production.