Compiling Organizational Intelligence: A Formal Mapping Between Governance Infrastructure and Compiler Theory

The Decision Lineage Protocol (DLP), a governance infrastructure for organizational intelligence, has been described using compiler-adjacent vocabulary throughout its development: type system, constraint satisfaction, state transitions, compilation. This paper evaluates whether that vocabulary is metaphorical or architecturally precise. We present a systematic formal mapping between DLP's architecture and compiler theory, demonstrate that every stage of the classical compilation pipeline has a structural analog in the protocol, and identify four points where the mapping breaks — each revealing a genuine architectural innovation rather than a flaw. We introduce lambda-DLP, a minimal formal calculus that captures the *truth-type isolation core* of the protocol's epistemic type system, and **mechanize its metatheory in Lean 4** — every proof kernel-checked, with no `sorry` and no introduced axioms beyond propositional extensionality. The headline result is **Isolation**: approximate (AI-generated) data cannot reach canonical (human-endorsed) status without traversing a human gate — at least two explicit human promotion steps through an observable intermediate state. Progress, monotonicity, subject reduction, Opaque exclusion, and orthogonality of the state-machine dimensions are established alongside it; the calculus carries truth types on the records themselves (there is no separate typing context), so the customary Pierce-style preservation statement has nothing left to preserve — it is discharged by the encoding rather than proved, and its content is carried by the subject-reduction and monotonicity theorems. The approximate computing literature — particularly EnerJ's type qualifiers for safe approximate computation — provides the key theoretical bridge: truth types are epistemic analogs of approximate data type qualifiers, and the Isolation property is the structural analog of EnerJ's central guarantee — promotion playing the role of explicit endorsement. The analogy is at the type-qualifier level: EnerJ's theorem is an information-flow noninterference result, including implicit flows; lambda-DLP's is a tag-transition discipline over records and recorded derivation edges. The guarantee's real-world reading rests on one deployment condition — actor-identity faithfulness (A1). We do not leave it a blanket assumption: a second mechanized layer **reduces A1 to a checkable per-event predicate** — the actor's label matches its attested kind — proves that an attested-AI actor cannot promote, and pins the residual trust to a named, governed attestation boundary — the oracle's soundness together with the binding of each event to the actor it attests. A provenance extension lifts the guarantee from records to derivation graphs: creation is typed by a weakest-link rule (no record more authoritative than its least authoritative cited input), and the mechanized **anti-collapse** theorem shows that no *recorded* derivation chain carries AI-created content to canonical status without human promotion events on the chain — at least as many as the promotable order requires. The aggregate guarantee ranges over recorded derivation edges: it presumes complete and faithful provenance capture, a deployment condition we name alongside A1. We name an emerging research direction — envelope-verified learned compilation — at the convergence of ML-guided compilation (MLGO, mLOOP) and compiler-guaranteed AI systems (DLP), and characterize epistemic preservation as a domain-appropriate correctness criterion — truth type, authority chain, and constraint satisfaction maintained across all state transformations — weaker than semantic equivalence but well-defined.