Skip to content

State of Work

LychD is pre-alpha. This page answers the practical question that follows the grimoire's promise: what can this revision actually support, and where is the evidence?

The supported runtime boundary is local, loopback-oriented, single-user, one control process, and a managed container Vessel. Host-native Core deployment and Core test deployment are retired. Core checks execute only in the explicit OCI test image. A fresh production-image and Ward PostgreSQL observation is recorded separately from the retained observations below. Start with an outcome below, then read the relevant record as a whole: its state, proved subset, limit, and evidence belong together. The Covenants own architectural decisions; this ledger owns their delivery interpretation.

Outcome matrix

Scenario Answer now Decisive limit
CLI bootstrap Partial: grammar, transactional initialization/binding and guarded lifecycle control have source contracts. Native installed-hybrid observations are frozen history. Full generated rootless deployment and managed-model lifecycle remain unqualified. See CLI and embodiment.
Local text chat Partial: retained source, browser and installed-hybrid receipts record structured replies and a bounded useful task under their dated profiles. General answer quality, wider browser acceptance and full generated installed deployment remain pending. See vLLM, Bridge and persistence.
Browser safety Loopback only: a dedicated local credential precedes the fixed Sigil; Host, Origin, CORS, CSRF, and generated bind policy are bounded locally. Remote IAM and hostile-browser acceptance remain unsupported.
PostgreSQL lifecycle Historical restart receipts: source TCP, source-browser and installed-hybrid profiles retained structured history across native boots before retirement. These frozen profiles do not qualify current OCI tests or a rebuilt Vessel; checkpoint-plus-consent recovery, crash and full generated deployment remain unqualified.
Major blockers Authenticated caller authority, privacy-safe egress, artifact custody, managed host/model lifecycle receipts, native Oculus, and resource-aware scheduling. Remote transport, federation, executable evolution, durable recall, and vision/audio bytes remain Partial or Designed.

How to read this page

Choose the part of the body you are trying to assess:

Concern Records
Configuration, CLI, generated units, host effects, release and restore Inscription and embodiment
Durable Runs, workers, Agent adapter, consent and delegated waits Persistence, execution, and consent
Model runtimes, grants, extensions and physical transitions Animation and orchestration
Atlas, Bridge, Nexus, Loom, Portfolio, Orb and diagnostics Altar and observability
Privacy, caller authority, web acquisition and media custody Authority and artifacts
Memory, identity, evaluation, training, creation and remote work Evolution and federation

Each state describes only its written boundary:

State Meaning
Available Repository evidence supports the written boundary; this is not a production or remote-safety claim.
Operator validation The software path exists, but the named real host, hardware, model, or engine receipt is missing.
Partial A useful verified subset exists; the explicit not-yet boundary remains binding.
Designed Law or design exists, but users cannot rely on the behavior.
Experimental A runnable LychD path intentionally carries an unstable support contract; no current record has this state.
External Another project owns the subject; this page records only LychD's interoperation boundary.

Project maturity and delivery state are different. An accepted ADR does not prove implementation.

Current evidence envelope

The 20 October 2026 container-only correction retires the former Core host-native runtime and its native stop, credential-source, server/TCP and host fixtures. Core pytest, lint, format checks and typing now enter the explicit Containerfile.tests image through the Makefile and bounded OCI harness. Domain/ASGI helpers may still construct the application inside that image. Those helpers do not create another supported deployment. The 21 October OCI recheck passed lint, formatting, strict typing and 6,447 tests, with 14 explicit optional skips and 525 container deselections. The PostgreSQL ledger module separately passed all 42 cases, including retained event fields, sequence, cursor and kind-filtered reads. Altar passed type checking, all 617 tests and its static build; generated API contracts and dependency locks stayed unchanged. The dated 20 October OCI occurrence passed all 23 Ward/candidate PostgreSQL cases. The rebuilt, unmodified production image completed all 20 migrations with system libpq, then two authenticated empty-workload boots and normal SIGTERM exits as UID 1001, with a read-only root filesystem. Host, Origin and CSRF refusals passed on both boots. Its fresh bridge, mounted synthetic credentials and empty owned Reactor directories do not qualify the generated managed body, real Reactor transitions or a model workload. All owned proof containers, volumes and networks were removed; no model request was sent. The current production recheck binds the 21 October production observation to its actual inputs. The unchanged 20 October OCI receipt retains its dated production observation and the separately bounded Ward inputs. Active public container start/stop completion remains unavailable; F2 hostile-constructor and F5 enrolled-peer qualification are not added.

The raw warm-model ASGI, sequential spawn, source-native TCP, trusted source-browser and installed-hybrid receipts are frozen dated history, retired on 2026-10-20 at source base 7057210a. Their historical validators preserve original receipt bytes, source maps, dependency lineage, oracles and limits; they do not compare those old profiles to current code or renew their observed facts. The former current-source TCP shared-chain join is historical as well.

The ASGI and spawned profiles recorded one real structured Bridge reply and identical turns/model history across two application lifespans or two sequential processes, without second-boot inference. The source-native TCP occurrence additionally recorded authenticated readiness, four security refusals, one complete SDK reply and normal process closure. Its 20 October renewal used 511 prompt and 143 generated tokens and passed the retained 18 terminal checks. Explicit Settings/Runes, lifespan wrappers, refusing host actuation and per-process limits bound those observations; none qualifies the current container or managed-model lifecycle.

The frozen trusted source-browser receipt recorded compiled Altar and sandbox-enabled Chrome against the retired source-native CLI/Granian fixture: authentication, four security refusals, controlled local503 with zero upstream POSTs, one useful reply, keyboard Bridge→Orb→exact Loom→Bridge navigation and retained reload after a second normal boot. Its historical validator preserves that profile and dated assets. Retained failed text does not imply every live badge survives. This is historical browser evidence, not current container-fixture, installed, hostile browser or general usability qualification.

The frozen trusted installed-hybrid receipt recorded source 3e30a84, 548 matching installed files, 91 dependency versions, 20 migrations and a matching migration image, one useful reply, two native boots/signed stops and normal private-manager exit. Its historical validator preserves the old package/profile facts. Plain Docker dependencies, inert model units and borrowed warm vLLM did not execute the full generated rootless body or qualify managed-model lifecycle. The separate installed-source 0cc0988 activation observation retains its own historical scope under vLLM.

The developer fixture remains a separate read-only memory composition with real controllers and security, synthetic failed Run/Pattern links and refusing execution. make developer-fixture runs it in the explicit OCI image at fixed internal 0.0.0.0:8000, published only at host 127.0.0.1:8000. Its current source and frontend guards remain; a new image/browser occurrence is pending. The fixture reads no operator configuration or credentials and grants no production authority. CONTRIBUTING owns the workflow.

All older ordinary-native Core startup/restart and browser observations elsewhere on this page retain only their dated profile, even where the report quotes an occurrence as successful. Domain uses of “native”—including the live checked Ward candidate-authority foundation—retain their own meaning and are not retired by this deployment correction.

Inscription and embodiment

Settings generations

State: Available

Proved now: Root Settings loads separate bootstrap, runtime and Phoenix database credentials, the local HTTP access credential, and web signing key once per construction as excluded SecretStr values. Cached consumers and in-memory snapshot restoration perform no credential I/O; JSON and generated TOML omit credentials. Explicit new Settings reads fresh inputs. Host bootstrap tolerates unprovisioned default mounts; runtime components reject missing credentials. Container bind preflight validates the declared secret references before compilation; application startup consumes only its narrowly mounted runtime secrets.

The former LYCHD_RUNTIME_SECRETS=podman-core@1 host-native source is retired. Explicit selection refuses before credential I/O; there is no automatic fallback, conversion, rotation or export. The host Podman adapter retains its separate bind/access role.

Boundary: This covers the declared DB/web credential contract, not every extension's handling, new image-mounted secret readability or live retained-role agreement. No automatic credential reload is delivered. Prior native source-control evidence is historical.

Evidence

Rune configuration loading

State: Available

Proved now: Typed TOML Runes load from their declared hierarchy with validated filesystem provenance and frozen root values; nested Animator Rune models and collections are immutable. The writer walks the same exact admitted schema generation as the loader instead of every imported subclass. Activation-marker detection and TOML parsing consume one file read, so replacement between separate reads cannot activate an inactive generated sample.

Boundary: Configuration parsing and topology do not prove a CLI rite, generated host unit, or running service.

Evidence

Core CLI rites

State: Partial

Proved now: The closed command grammar, dry-run planners, journaled init and bind, bounded status and logs, guarded lifecycle control, and receipt-gated deletion are tested. Direct start system now separately requires an exact quiescent opposite Vessel observation after owned-state revalidation; unknown or conflicting evidence refuses without adopting or controlling that counterpart. Focused tests cover both fixed identities, malformed replies, pending work and timeout. This is a start admission check, not continuous exclusion or an installed native graph qualification. Mutating paths use revalidation, no-follow identity checks, lifecycle locking, durable receipts, and explicit rollback or indeterminate outcomes. An unsafe shared binding site blocks initialization planning and the layout preflight; safe existing modes are preserved.

The host-native signed-stop profile and route are removed. Current active Vessel lifecycle operations refuse before effects until authenticated container admission and exact container/service settlement are implemented and qualified. Safe inactive bootstrap control retains its narrower source contract. Legacy native bindings remain observable but block mutation; retirement provides no stop, conversion or deletion authority.

The shared image launcher owns ordered startup, HTTP callback retirement and application closure; required failure propagates. A successful exit or manager reply alone cannot establish full container lifecycle completion. The old inert native TCP/private-manager stop trials, retained Scavenger readback/stops and installed-hybrid stops remain dated history under the current evidence envelope, with all original failures and limits.

Boundary — Not yet: Status omits full readiness and durable-run health; no run-operation command or authenticated Run submission route is delivered. Active container stop/start completion, active-work shutdown, rebuilt-image lifecycle and managed GPU/model operation remain unqualified. Unknown unit or mount truth blocks; deletion preserves objects without owned creation provenance. No direct-manager or native fallback is admitted.

Evidence

Public release artifact chain

State: Designed

Proved now: Distribution, container, archive-audit, source-preflight, and non-publishing candidate declarations exist and are tested without granting publish authority. Synthetic wheel archives exercise exact license-header validation, package identity, source revision, and bundled license and notice checks.

Do not expect yet: No maintained receipt pairs this revision as one anonymously installable PyPI package and immutable GHCR image, and no clean-host install/start/reply/stop promotion gate has run.

Evidence

Deployment-plan compilation and materialization

State: Available

Proved now: Soulstone and extension intent compile into validated Quadlet/systemd plans, including Animator targets, conflict topology, and compatible Coven aggregates, and Scribe materializes the declared files. A complete ownership manifest refuses distinct Quadlet/systemd runtime-bearing sources that systemd would resolve to one runtime unit. Returned extension containers are revalidated before admission. Raw Podman arguments are restricted to their supported complete values, rejecting alternate publication, network, host-mount, device, user, and secret controls. Bind includes external secret sources from every emitted container in its presence and drift checks; generated Core secrets retain their separate provisioning path.

Boundary: Generated unit intent does not prove that systemd or Podman started it on a real host.

Evidence

Runtime actuation and mediated Host Reactor protocol

State: Available

Proved now: The mediated Host Reactor validates and durably claims intent, attests the loaded Scribe graph, performs one bounded target transaction, observes settlement, attempts exact-prior-world compensation, resumes or contains interrupted journal work, and records outcomes under the lifecycle lock.

Claimed producer bytes pass through a separate acquisition state into a new host-owned snapshot and versioned digest companion before effects. Retained producer descriptors and hard links cannot mutate processing or completed authority; processing and compensation reject missing or mismatched custody, including legacy journal files without proof.

Boundary: Protocol tests and an isolated private-systemd receipt use inert services, not the operator's Quadlet/Podman/GPU host. .restored proves the prior world; .contained and unresolved .processing and .acquiring fence later admission. General repair and legacy-custody reconciliation remain the operator's responsibility.

Evidence

systemd user and rootless Podman embodiment

State: Operator validation

Proved now: LychD generates its declared Linux service shape and provides a mediated actuator; Soulstone and Phoenix retain separate identities while sharing validated embedded Quadlet configuration. An isolated Linux receipt also runs the generated conflict targets through systemd 261.2 and Quadlet/Podman 6.0.2 with real rootless containers: the first is observed running, then absent before the second starts; exact owned containers and processes are cleaned up. The fixture uses a private user manager and image store, a pinned offline image, and no host mounts, ports, GPUs, model or production configuration.

Compilation explicitly selects the PostgreSQL image account alongside Pod-level keep-id, confines :U ownership changes to its dedicated datastore, and rejects Soulstone mounts of known host credential/control roots or special files. Existing mapped PGDATA is preserved by init without entering or changing it. Fresh Btrfs preparation and deletion identity checks use a bounded descriptor helper to observe the exact subvolume UUID and ID without a privileged pathname lookup. Unknown identity remains unreceipted; existing datastores are never adopted or retroactively changed to No-COW. Vessel/migrator code is root-owned and their root filesystems are declared read-only. Their compiled manifests declare a fixed 1 MiB /run/secrets tmpfs parent for the separately mounted secret files; focused tests preserve hardening, configured secret identities, and the closed manifest policy.

The dated 0cc0988 installed startup/activation observation is scoped under vLLM. A changed compiler or loaded-graph attestor needs a new same-source installed profile; that observation contains no Coven and does not qualify the current checkout.

The frozen trusted installed-hybrid profile recorded its private manager, installed native CLI, plain Docker PostgreSQL/migrator dependencies and borrowed warm model with inert owned model units. It does not execute the full generated rootless graph or qualify managed-model lifecycle.

Receipt needed: Name the Linux, systemd and Podman versions, generated targets and conflicts, loaded-source attestation, forward switch, compensation, crash recovery, startup, and shutdown. GPU and model proof remains separate. Include image account, actual UID/GID maps, mounted secret readability, read-only code, writable scratch, initial database creation, and repeated init/start with existing mapped data; compilation and mocked ownership tests do not establish these facts.

Evidence

Whole-body snapshot and restore

State: Designed

Proved now: Filesystem preparation exists and the snapshot Covenant defines coordinated filesystem, database, code, and receipt identity.

Do not expect yet: LychD does not freeze, snapshot, restore, and reconcile the whole body as one ritual.

Evidence

Tomb untrusted execution

State: Designed

Proved now: Security law reserves Tomb as the lower-trust execution boundary.

Do not expect yet: There is no Tomb queue, executor, credential policy, Landlock, or nono integration.

The current operator trial's mandatory hostile-constructor enforcement is externally blocked under the operator's administrative-test deferral. Trusted candidate-byte custody is not that enforcement. Positive candidate adoption and fresh-generation activation remain separate undelivered implementation work; an external prerequisite does not complete them.

Evidence

Phylactery first-light persistence

State: Partial

Proved now: Run, delivery, step, session, consent, checkpoint, and delegated-wait shapes exist with sequence-fenced claim and settlement, terminal-evidence-fenced owner-specific resume gates, startup reconciliation, and PostgreSQL migration checks. A historical factory receipt completed and recovered a Bridge Run across two boots; a frozen warm-vLLM profile retained its actual structured reply and model history across two application lifespans and, in a separate trial, across clean shutdown into an independent application process. A further source-CLI/native Granian TCP trial retains the same settled state across two normal independent boots, with no second-boot model POST. Distinct production asyncpg codecs round-trip plain json and versioned JSONB, while memory Run, consent, and Bridge-session stores detach mutable values at the same public boundary as database reads.

The bootstrap gate separates the preserved administrator from the Vessel/SAQ runtime role and Phoenix's own database role. The maintained PostgreSQL receipt verifies credential-required TCP, runtime data and queue operations, denial of schema/role/version-table mutation and cross-database access, repeatable bootstrap, and preservation of unrelated existing ownership.

Boundary — Not yet: PostgreSQL and SAQ are not one transaction; Step events lack an outbox; memory-profile/PostgreSQL repository parity is incomplete; no general record-retention or compaction path, partition policy, tablespace lifecycle, automatic capacity expansion, or sharding path is delivered; persistent same-boot containment failure has no durable watchdog. The lifecycle test substitutes offline collaborators after startup. The source ASGI, spawned-process and TCP warm-model profiles use explicit test composition. Distinct trusted browser and installed-hybrid profiles record only their historical normal-restart/readback paths; none qualifies current container runtime or establishes checkpoint-plus-consent recovery, process crash or a full generated installed deployment.

Evidence

Topology-A local run execution

State: Available

Proved now: One Vessel process admits, claims, executes, cancels, settles, resumes, and projects Runs against immutable Pattern revisions. Durable publication intent, replay repair, external-wait relays with capped restart backoff, terminal-evidence repair, bounded identity fencing, bounded slow-reader resynchronization, and orderly shutdown are tested. Terminal checkpoint deletion is best-effort after durable terminal evidence. A disposable PostgreSQL receipt injects an actual deletion failure, verifies later Run evidence and cleanup, and removes retained debt through replacement adapters without duplicate Steps. It uses the startup helper and ORM-created tables, not a replacement application process or migrations. Per-Run claim and park coordination prevents stale failure cleanup from touching a successor or a committed wait. Consent and delegate recovery bound each owner's lookup and re-admission, preserving the wait or exact pending delivery on timeout while later owners progress. Early workflow/checkpoint refusal contains child effects before failure; post-park probes also have deadlines so they release their workers. Post-claim exception groups composed only of cancellation and ordinary failures preserve cancellation election, exact-generation containment, terminal cleanup, and propagation of the original group after successful handling. Unresolved child containment stays nonterminal rather than claiming false FAILED truth; a timed- out cancellation remains CANCELLING. Exact revision lookup validates the persisted v2 Pattern snapshot and digest against the registered manifest, including its reviewed implementation revision; retained inactive revisions remain executable through that same check. Registry assembly also freezes a private legacy_inline contract, placement and implementation binding for each executable station. Exact lookup compares the current local binding with its boot-derived internal-v0 lock; a mismatch refuses execution and active routing cannot fall back to the default. Terminal stations remain declarative. Public v2 snapshots and digests are unchanged. The retained-snapshot validator shares declarative station and score checks with construction; rehashed malformed nodes, edges, duplicates and undeclared endpoints refuse before Blockworld freezing or Orb exactness. This does not replace exact registered execution lookup.

Failed claim acknowledgements retain an immutable attempt outcome. Recovery waits for the original mutator to finish and keeps the same per-Run guard from the unclaimed prestate through exceptional observation. Only the exact RUNNING/CLAIMED generation proves ownership for existing interrupted settlement; that winner never enters Graph. Corrupt exact QUEUED delivery pairs refuse before mutation. In-process fault tests cover ownership, error precedence and these effect boundaries.

Boundary: This does not prove automatic source compatibility, a transactional event outbox, separate-worker truth, multi-process streaming, federation, or producer backpressure. The private binding lock is not persisted on Run or exposed by Loom/Orb; it proves neither Python source equivalence nor compatibility across boots. No portable Resolution Lock or public Spell or Scroll contribution store is delivered.

The exceptional native observer has a five-second cooperative acceptance budget and terminates acquired handles synchronously; its control flow is tested with substituted driver connections. The original claim operation has no new lifecycle bound. Real PostgreSQL transaction, authority, locking, cancellation and Linux startup/CancelRequest transport recovery remain unverified. Handle termination proves neither completed server rollback nor reclamation of library-owned transports, callbacks or DNS work.

Evidence

Configured Bridge casting

State: Partial

Proved now: Typed weaver.bridge settings select registered bridge_chat@2 and one exact capability key. Admission persists that key with Run intent before queue publication. Controlled queued and consent-resume workflows reconstruct JSON-decoded stores and keep the original selection after configuration changes or removal, including idempotent retries. Dispatcher applies the exact key together with family, modalities, tools, readiness, and drain constraints; duplicate model aliases cannot redirect the turn. Missing or mismatched checkpoint bindings refuse execution before a node runs. Revision 1 keeps its original manifest and remains executable after activation changes. The same selector also admits the bounded public-note and semantic-source-answer and Scout public-page revisions; their authority and evidence boundaries remain with those records. The explicitly boot-selected bridge_chat@5 retains its complete exact Archive generation manifest/reference, threshold and finite recall bounds with the local Chat key. Omitting configuration still selects revision 1 for new admissions.

Revision 2 also accepts a bounded two-route local Chat preference instead of an exact configured key. Strict integer weights rank only freshly observed warm routes with unchanged declarations and open, unchanged admission generations after one cooperative five-second probe batch. Zero disables eligibility and omits retained phase/time; a shared Animator's complete probe may still include that capability. Ties use literal key order. Admission retains the complete policy, digest, observations and selected exact key. Idempotent replay bypasses selection; controlled reconstructed records retain the decision, and malformed retained bindings refuse reconstruction. A safe 503 code reports probe failure or an empty eligible set before retaining a Run or user turn. Real PostgreSQL concurrent sessions retain one winning policy and exact key; a reconstructed adapter and idempotent lookup return that decision, while changed JSONB digests, selected keys or admitted bindings refuse reconstruction.

Boundary — Not yet: The Chat key pins capability identity, not a chat model artifact or runtime declaration generation for future execution. The preference batch reserves no future readiness; existing exact-key execution, tools, consent and retry rules still apply. There is no execution fallback, adaptive or multimodal route policy, portable Resolution Lock, or general Pattern/AgentSpec/Context selector. Settings loading does not contact an engine. Revision 2's exact-key configuration checks declaration at execution; revision 5 also validates exact local Chat and embedding declaration metadata at boot without readiness or model work. The preference mode checks both declarations at admission, including disabled routes. Live two-route preference remains unqualified; existing default-Bridge receipts do not establish it. The synthetic PostgreSQL controls use ORM metadata and do not claim migrations or a server restart.

Evidence

Pydantic AI 2.55.0 cognitive adapter

State: Available

Proved now: LychD constructs typed agents and runs Bridge through the exact pydantic-ai-slim==2.55.0 contract with serializable state and fail-closed provider profiles. The context window bounds each model request after output reservation, including tool follow-ups and validation retries, while cumulative Run usage remains intact. Supported pre-counts and completed streamed/non-streamed responses use the same request bound. The event-consumer scope closes Agent toolsets before releasing the model grant on failure. Explicit end_strategy="early" preserves the final-output boundary for streamed and ordinary responses; sibling function tools are not executed after a valid final output. Generic local profiles replace provider defaults and disable the optional Responses input-token-counting endpoint. Bridge skips that unsupported counter while preserving other counting implementations and reported response-usage checks. Named providers resolve their own model policy. Model transport tests use native HTTPX2 mocks, and the repository-wide model-request guard also applies when tests outside the agent package are selected alone. Portable agent and core checks exercise the locked Pydantic 2.14.0 stack on Python 3.14.8 and 3.15.0.

Boundary: This does not claim automatic child-Agent usage propagation, Pydantic's external durability harnesses, or a guaranteed token preflight fence for generic local models. The counting checks use inert transport; they do not qualify a live provider endpoint, PostgreSQL deployment, or Linux Vessel image, or admit Portal execution. The serial Graph adapter has its own evidence and limits.

Evidence

Native Pydantic Graph 2.55.0 adapter

State: Available

Proved now: Workflows use native GraphBuilder and public BaseNode execution through a serial adapter. LychD owns the typed checkpoint envelope, admitted node catalog, station execution status and declared-successor checks. State, node arguments and final output are checked against their declared types in JSON mode before replacing retained history and again on restore. Strict UUID and tuple values survive a JSON transfer into a replacement runner. Validation starts at the serialized JSON boundary; serializers can normalize in-memory values before these checks. Existing built-in Pattern digests stay unchanged. Captured v1 consent and delegation histories decode against the exact registered graph; captured consent approval and denial resume through the new runner, and hardware retry budgets survive decoding.

Boundary: Forks, joins, arbitrary function steps and transformed paths are refused because the delivered durable cursor represents one BaseNode station. Pending, running and failed snapshots are not automatically replayed. These offline compatibility receipts do not prove a production upgrade, process replacement, exactly-once host effects or external durability engines.

Evidence

State: Partial

Proved now: Logical parking, bounded approval rounds, exact Consent ownership, simulated restart, re-admission, idempotent settlement, and fail-closed substitution on resume are tested. Post-park probe failure preserves AWAITING_CONSENT; uncertain cancellation containment leaves the Run CANCELLING instead of manufacturing terminal truth. Composed native-worker cancellation releases its lease for broker acknowledgement while retaining the durable checkpoint until terminal commitment, including a lost acknowledgement followed by an idempotent cancellation retry. Consent policy stops preserve earlier completed tool results, close known refused calls as denied, and leave valid history for the next turn without replaying those effects.

Hardware convergence budgets are checkpoint-owned per Run and survive a durable park plus a replacement GraphRunner.

Combined offline cases reconstruct JSON-decoded stores across checkpoint-before-park, verdict-before-resume-publication, and terminal-commit-before-checkpoint-deletion windows, including approval and denial. Stale deliveries do not replay the inert tool; terminal cleanup and evidence repair are idempotent under these controlled collaborators.

Ordinary node-observer failures preserve successful execution, original failures, and consent, delegation, or hardware waits; cancellation remains observable to the caller.

Boundary — Not yet: There is no PostgreSQL Consent-plus-Checkpoint restart receipt. A legacy checkpoint from before the hardware-budget field cannot reconstruct attempts that already happened. Multiple approval calls in one model response are rejected, and no production toolset currently originates approval.

Evidence

Delegated agent execution

State: Partial

Proved now: Typed requests without credential or ambient-authority fields, artifact references, process-local job submission/adoption/cancellation serialized with runtime-start acceptance, exact wait ownership, terminal-evidenced Graph parking and re-admission, typed containment-profile intent, PostgreSQL shapes, and a no-effect reference adapter exist. Optional weaver.delegation selects delegated_rite@2 with one exact registered runtime/profile. Admission, persisted intent and checkpoint validation retain that binding across configuration changes; omission preserves reference-only revision 1. Refusal and uncertain start never select an alternate runtime.

Codex 0.159.2 and Claude Code 2.1.296 have bounded one-shot command/protocol adapters behind a refusing-by-default host port. Offline fixtures exercise complete JSONL outcomes, exact launch identity, persisted limits, malformed/truncated output, uncertain lookup and cancellation. The adapters are not registered by default and contain no subprocess launcher. These are protocol and correlation tests, not an executed Coffin or Provider Gate.

Poll and cancellation receive the store-retained request. Legacy lookup rejects substituted request metadata or UTF-8 stdin even with a consistently recomputed host receipt. The reference runtime checks its retained pure projection. Legacy request, nested job and launch goldens and retained score revisions 1 and 2 keep their meaning; fresh legacy CLI starts now refuse before calling a host.

A sibling V2 CLI request retains the exact compiler/version, executable/model, workspace roots, capture/wall limits and four qualified operator task/projection/custody/verification references. Explicit top-level, nested-job and database codecs refuse unknown tags/fields and malformed or bypassed model instances. V2 lookup/cancellation independently compiles the complete expected specification from retained intent, defeating consistent model, argv, environment, executable, root, limit and owner-binding substitutions. It never obtains fresh admission or launches.

A trusted injected owner-observation port denies by default. Its consumer checks exact occurrence, request/intent digests, bindings and bounded validity as UTC instants before host launch, including non-UTC offset/fold cases. The only positive producer is an inert test fixture: this is consumer conformance, not actual owner authorization, source-byte closure, custody or verifier reservation. A migrated-PostgreSQL receipt retains complete V2 JSON, rejects changed-content replay, reconstructs fresh engines/adapters under different defaults and refuses consistently recomputed substitutions, including cancellation before poll after admission expiry. Unknown stored versions remain unchanged and unavailable. This is adapter reconstruction, not a V2 independent-process or physical-host proof.

A separate mechanical host-disposition store retains exact canonical V2 preparation, one issuer-local dispatch opportunity and monotonic logical intake closure under the AgentJob lock. Replay and adapter replacement return history without recreating a fresh handle. A migrated PostgreSQL receipt covers concurrent preparation/close/consumption, lost acknowledgement, strict current-request identity, restrictive history and both downgrade/writer lock orders. Logical close remains possible for damaged intent. This precursor supplies no owner permit, runtime launch, physical closure or restore activation.

The reference adapter reconstructs its deterministic projection for refresh and cancellation after coordinator/runtime restart without replaying an external effect, retains it across failed durable adoption, and retires it after terminal settlement. Oversized reference echoes retain a successful effect-free result with an explicit truncation marker, including after reconstruction. This does not qualify truncated output from a foreign runtime. Oversized start-error diagnostics retain an explicit truncation marker without preventing LOST settlement.

An unclassified runtime-start exception now records LOST; inert lost-acknowledgement tests prove exact-request replay cannot start again, late success cannot replace that terminal, and cancellation still reaches the owning runtime.

After start returns, an ordinary acceptance-write failure triggers one conditional settlement. A committed RUNNING or terminal result is preserved; only PREPARING under the store's mutation lock becomes LOST. Repeated caller cancellation waits for that disposition, without repeating the write or runtime start. Reference-runtime, Graph, and worker tests prove that preserved RUNNING can resume once to completion, while newly LOST work is contained before Run failure. Portable DB-adapter tests model lock ordering and rollback with session doubles. Additional disposable PostgreSQL cases observe the exact challenger backend blocked on the winning job's locking SELECT, preserve RUNNING and terminal winners, fence late RUNNING after LOST, and retain one result event across duplicate settlement. A real event-INSERT constraint failure rolls back the preceding job/result change; removing the constraint permits one fresh settlement. These cases use independent sessions and ORM-created tables, not migrations, replacement processes, broker delivery, foreign-provider recovery, or application startup.

Separate Alembic receipts exercise terminal delegated-result enforcement on migrated PostgreSQL: upgrade refuses absent, non-object or mismatched retained evidence without changing the version or data; explicit correction permits the upgrade. At head, the database rejects equivalent invalid inserts and updates. An empty head-to-pre-delegation-and-back cycle verifies schema reversibility only; it does not qualify retained-history rollback.

A separate migrated-PostgreSQL receipt runs two sequential independent spawn processes. The first commits one delegated_rite@2 wait and exits; the second reconstructs all adapters, rehydrates the effect-free reference result and resumes the same request/job once. A changed current admission profile does not replace the retained binding. Exact replay, repeated reconciliation and stale/current deliveries leave one adoption, resume hop and settled turn. The queue is captured and neighboring capability/consent ports are inert; clean process replacement proves neither abrupt-crash recovery, broker delivery, application startup nor an external provider.

Boundary — Not yet: No declared external provider launches. There is no lower-trust executor, credential or egress isolation, process-tree containment, durable artifact custody, measured budgets, real external-provider recovery receipt, or live-browser proof. The actual operator-record producer, current authority/revocation, immutable source closure, full enforced resource envelope, custody service and reserved independent verification remain undelivered. Request prompts are persisted verbatim; callers must apply the Privacy Cut and egress policy before any future remote runtime receives them. Effectful runtimes still need durable provider identity, definite-rejection evidence, and reconciliation of ambiguous start outcomes.

Evidence

Additional source and verification for the exact selection and closed adapters: runtime protocols, runtime boundary, adapter tests, configured casting tests, PostgreSQL acceptance/rollback tests, migrated delegated-result enforcement, and clean-process delegated recovery, V2 codec/admission/recovery cases, and migrated V2 retention.

Durable in-app Attention

State: Designed

Proved now: Bridge consent cards and shared invalidation-aware counts establish a bounded projection that a future Attention inbox can consume.

Do not expect yet: There is no owned inbox, acknowledgement, retry, expiry, escalation, notification delivery, or external channel.

Evidence

Animation and orchestration

Animator dispatch spine

State: Available

Proved now: One-shot catalogue hydration, matching, probe publication, grant issue and settlement, and lease-aware dispatch are tested with duplicate attribution, snapshot isolation, cancellation invalidation, and strict endpoint-root policy. Grant scope closes model-provider clients before lease release, including failure, cancellation, and an admission race after hydration. A per-Animator admission generation rejects preparation that spans a completed drain and reopen, including asynchronous grant issue and provider entry. Inert hard-swap and soft-reload cases verify refusal without a lease or dispatch event, provider cleanup, and fresh redispatch; an unrelated Animator's drain does not invalidate the grant. OpenAI-shaped clients discard ambient SDK account, admin, webhook, and custom-header configuration; request tests prove that only the declared credential reaches the configured endpoint. Model, readiness, and local control-plane clients also ignore ambient HTTP proxies and refuse redirect following. Inert transport tests observe direct routing for local prompts and TabbyAPI admin credentials, including streaming load requests. Model clients preserve that policy after close and re-entry and make no implicit SDK retransmission after a server error or lost response. These checks do not implement anonymization, a Provider Gate, or remote fallback.

A non-empty Soulstone [[models]] catalogue is an ordered exact allowlist, capability concurrency must match its Rune, concrete runtime leaves cannot claim a foreign adapter, and only an exact registered Portal definition can create a Portal runtime or capability.

Every issue re-probes the exact chosen record rather than trusting cached warmth. Fixed OpenAI-compatible local and opt-in Portal probes validate /models inventory and warm only an exact returned model id; malformed or missing inventory fails closed, and inventory count and id length are bounded before retention.

A served_model_id Rune field pins the provider-facing identity when it differs from a path or Soulstone name.

The v1 grant exposes no Animator or Connector: chat admits a hydrated model and only declared agent-loop toolsets, tool_execution requires a non-empty toolset, and all metadata-only families fail closed. There is no public registry handle-binding bypass around grant issue. Registry and Dispatcher both quarantine Portal issue.

An explicitly configured local model.embed@1 compatibility path now leases the exact Qwen3-Embedding-0.6B Q8_0/llama.cpp b9445 profile. It accepts one bounded document or query, reauthorizes before each source-bearing request, validates canonical float32 vectors, and closes active requests before releasing the ordinary lease. Unsupported profile selectors refuse before readiness. A maintained opt-in CPU-only isolated runtime check exercised the real registry, Dispatcher and HTTPX driver for two documents and one query, plus byte/token/authority/scope refusals; leases and owned runtime processes were cleaned up. This was an externally started fixture, not an Orchestrator activation or Archive derivation test. The Linux harness requires an existing pinned image and public model fixture; it verifies artifact hashes and owned-process cleanup without downloading or relabeling inputs. Ordinary integration tests substitute HTTP.

Unregistered runtime aliases, including generic OpenAI-shaped labels, retain inert command planning but cannot create a capability-bearing runtime; Bind and registry load reject their missing capability coverage.

Boundary: This is the v1 {animator}:{family}:{model_id} catalogue with one chat-model/toolset compatibility grant plus the explicitly selected embedding path, not the general discriminated grant union. The catalogue has no in-process hot reload; lease expiry is recorded but not enforced; current Soulstone/Portal inheritance and raw Quadlet contribution remain. General interface/profile compilation, call/job/session grants, [[capabilities]], service-job attempts, general per-dialect OpenAI-compatible drivers, and secret-vault integration are not delivered. The fixed embedding profile is configured admission; health/inventory does not attest a replaced model file or process. Its laboratory resource and network limits are not general deployment guarantees, and its tiny cosine check is not a quality benchmark.

Evidence

General service capability substrate

State: Designed

Proved now: No general-service implementation is claimed. Accepted law separates semantic interfaces, immutable implementation profiles, typed demand, readiness, discriminated model/call/job/session grants, exact Connector dialects, and durable service attempts while retaining the current model path as explicit v1 compatibility.

Do not expect yet: There is no CapabilitySpecV2, CapabilityDemand@1, [[capabilities]] compiler, general call/job/session driver registry, ServiceJobAttempt@1 persistence or relay, AWAITING_SERVICE, local durable reservation transfer, OpenAI audio/image/video dialect bake, or CapabilitySet placement solver.

Evidence

Extension activation and contributions

State: Partial

Proved now: Dependency-first built-in assembly supplies Rune, Portal, runtime, Quadlet, and delegation contributions under registrant-bound registration, sealed membership, owned schema branches, and fail-closed synchronous hooks. Host-assigned registrant attribution survives v1 capability hydration, detached reads, grants, Orchestrator status, and Nexus response rows; adapter-supplied attribution cannot override it. Raw adapter injection remains unattributed.

Separate Python interpreters verify Phoenix selection, inactive samples, configured Rune and Quadlet projection, and disable with retained fixture files. The current cached generation stays unchanged when its Settings file changes.

Boundary — Not yet: These are registration, projection, and offline grant receipts, not Linux inscription, service startup, or database recovery. Package installation, locks, upgrade/uninstall, migrations, lifecycle effects, Forge admission, and a stable public SDK are absent. General-service interface/profile/driver contributions remain Designed; v1 attribution does not pin code, model artifacts, or runtime generations for resumed work.

Evidence

llama.cpp integration

State: Operator validation

Proved now: Runtime planning, static and router connectors, discovery, capability derivation, model-load control, and contract tests exist. Known command/endpoint port conflicts fail during declaration compilation. Runtime construction captures one preset catalogue and generation profile; capability synthesis uses that captured generation even if the preset file changes. Router inventory distinguishes exact loaded, loading, and clean unloaded models and rejects missing or malformed evidence. Dispatch-to-convergence tests cover loading without duplicate activation and inference refusal with autoload disabled after warmth is lost. The supported command profile explicitly disables engine idle sleep: managed plans begin with the disabling pair, and passthrough commands must carry it at the supported argument-vector or executable prefix without being rewritten. Later sleep controls and ambiguous spellings fail declaration validation. This is command admission, not live runtime attestation. Explicit managed modes govern the plan and connector mode; conflicting known model-source arguments and environment projections fail validation, including secret_env_files. AUTO and passthrough metadata follows the final command and projected environment: per-option CLI overrides preserve explicit empty sources, main models take precedence over router inputs, and aliases accumulate before inventory identity is selected. Default model selection uses the captured catalogue. Effective main Hugging Face repositories, main-model shortcuts, and ambiguous source/alias syntax fail admission. Projected secret presets are not opened locally for catalogue or generation-default discovery. The engine profile defines the bounded grammar and remaining runtime-validation requirements. Model unloading is not a separate adapter operation; Orchestrator shuts down whole runtimes.

Receipt needed: Name the image and revision, model and quantization, GPU and driver, flags, systemd/Podman host, load, inference, disabled-sleep behavior, and whole-runtime shutdown results.

Evidence

vLLM integration

State: Operator validation

Proved now: A vLLM runtime plan, OpenAI-compatible connector, model/capability derivation, and focused tests exist.

The standalone local-model probe explicitly registers the built-in adapter and exercises exact Dispatcher grants, AgentForge text output, and an observed harmless tool round. Its offline tests cover response-identity and completion-state refusal before tool processing, unavailable or malformed inventory, transport failure, retained observations across deadline/cancellation, and client/lease cleanup. It reads no installation configuration and has no lifecycle authority. An operator-generated probe receipt does not qualify the installed Vessel, Bridge, persistent Runs, model artifacts, managed activation or shutdown.

A frozen historical profile joined the source-registered vLLM adapter to the production factory, Dispatcher, Graph, Context, SAQ and PostgreSQL. One actual streamed BridgeReply settles; the same turns and valid model history survive a second application boot without another model POST. Both startups observe the exact shared model as WARM; no lifecycle actuation occurs. HTTP is TestClient and the host actuator is a refusing fixture. A second selection performs those boots in independent sequential spawn processes: the first fully exits before the second, which retains identical settled turns and history and submits no inference. This recorded the former clean application-process restart profile; both selections used TestClient HTTP and do not qualify current OCI execution.

A third frozen historical selection invoked the removed source CLI native Granian launcher with real loopback TCP. Both boots reach authenticated HTTP readiness. Before one admitted Run, wrong or absent local access and foreign-Origin or missing-CSRF message submissions refuse with zero durable Runs and model POSTs. One structured reply settles through the production services and the second normal process boot recovers identical turns/history without inference. The test supplies Settings/Runes, wraps the real production lifespan and refuses host actuation; engine disposal after CLI return is supplemental test cleanup. Observed native limits apply per process after interpreter/module startup; PostgreSQL's separate CPU, memory and PID limits were read back. This recorded only the retired TCP and clean-restart conjunction, without installed caged-body, managed-model, model-byte, crash, cancellation, browser, autonomy or aggregate-native-resource qualification.

The frozen trusted installed-hybrid profile used the installed local vLLM adapter and a borrowed warm model for one useful attributed reply retained across two normal native boots and signed stops. Complete SDK history and exact durable capability/Pattern are verified; inert owned model units do not activate the model. This bounded profile does not satisfy full generated deployment or managed-model lifecycle requirements below.

A closed model-local qwen3.8-non-thinking generation policy now compiles through the frozen capability grant to the exact Qwen chat-template request field. Unsupported bindings, runtime and Soulstone defaults, Portals and Responses refuse it; omitted settings remain unchanged. Real-SDK mock-wire tests cover ordinary and streaming calls. A dated bf1162f source-app observation completes one fixed public-source review in196 generated tokens and retains it over two ordinary in-process boots. Its independent reviewer accepts only partial semantic utility: the core assertions are correct, but a claimed passing counterexample would fail the displayed test. DONE is not a correctness verdict. That separate Codex review is operator evidence, not a delivered native verifier, installed cutover or autonomous development.

A dated operator observation on 2026-10-16 uses installed source 0cc0988, a matching noneditable host CLI and pinned Vessel image. One canonical /orchestrator/activate request launches the dedicated vLLM service through the Host Reactor; completed intent/custody, exact model WARM and inventory from the Core pod are observed. One model HTTP200 POST settles a DONE Bridge Run, followed by repeated retained API history and Orb reads with empty queues/leases. This is same-boot API projection evidence, without raw model history or raw Run-result access. The receipt preserves the historical compiler and attestor fingerprints and the 447-file archive/host/image parity-map digest. Its offline check validates dated metadata and privacy; it is not a current-source freshness gate. A changed compiler, attestor or installed image needs its own same-source qualification. Full caged stop, model shutdown, restart/crash recovery, browser, autonomy, model bytes and aggregate resource containment remain unqualified by this observation.

Receipt needed: Name the image and revision, model, GPU and driver, arguments, systemd/Podman host, readiness, inference, and shutdown.

Evidence

SGLang integration

State: Operator validation

Proved now: An SGLang runtime plan, OpenAI-compatible connector, model derivation, and focused tests exist.

Receipt needed: Name the image and revision, model, GPU and driver, arguments, systemd/Podman host, readiness, inference, and shutdown.

Evidence

ExLlamaV3 through TabbyAPI

State: Operator validation

Proved now: The TabbyAPI-backed runtime, control plane, connector, Soulstone, registration, revision boundary, and contract tests exist.

Receipt needed: Name TabbyAPI and ExLlamaV3 revisions, NVIDIA GPU and driver, EXL3 model and quantization, cache, split, flags, load/inference/unload, and measured VRAM.

Evidence

Declared conflict topology and systemd target switching

State: Available

Proved now: Declared conflict domains compile into an incompatibility graph and compatible Animator/Coven targets. Switching attests the loaded graph and current world, performs one bounded compound target request, waits for systemd settlement, and classifies success or exact restoration.

Boundary: The private user-manager receipts cover inert services and an opt-in real rootless Quadlet transaction using production-generated target relationships. The latter verifies container ordering and cleanup in an isolated fixture; it does not exercise the Orchestrator, Host Reactor, production pod, GPU or model. Declared coexistence is not measured capacity admission.

Evidence

Safe runtime transitions

State: Partial

Proved now: Admission closure, lease drain, serialized transition plans, compound target actuation, exact-prior-world compensation, interrupted-work containment, and refusal on stale topology are covered by focused protocol tests. Manual transition priority is constrained to the canonical 0..100 doctrine range before trace publication or arbitration and at the HTTP query boundary. Each preflight and owned replan bounds the complete managed-runtime observation set with one configurable planning deadline. A timed-out observation settles before a no-effect decline; cohort followers share that result, gates remain open, and fresh requests can retry. Transition callbacks receive the journal's immutable observation; traces and projection callbacks cannot expose the mutable eviction and launch plans used during execution. Soft convergence failures before invoking adapter activation are classified as no effect, including observation-only static or already-warming waits. Their gates reopen, coalesced requests share the classification, and unrelated warm capabilities remain usable. Soft activation writes a durable owner-only guard before invocation and clears the exact record only after target WARM. Crash, failed activation, or incomplete marker writes fence a replacement Vessel before queue connection, under either actuator profile. Focused filesystem tests include an abrupt process exit; generated mount and initialization tests cover persistent storage and mode agreement. Hidden host recovery validates the exact record, current declarations, Scribe-owned loaded topology, stopped Vessel and target runtime, and pending jobs before release. Hard-transition compensation completes or contains before caller or observer cancellation propagates, including a first cancellation that arrives during the inverse after ordinary readiness failure. Coalesced followers retain the owner's terminal classification and physical/compensation IDs while keeping their own request identity, independently of bounded journal eviction. These cases are covered by hard-effect boundary tests with inert runtime effects. Direct actuator observation failures before submission reopen admission without claiming an effect. Cancelled Host Reactor requests preserve proved decline/restoration receipts; uncertain outcomes remain contained. Actuator tests exercise both cancellation paths and the manager's gates.

Direct local activation accepts optional admission_timeout_s, with distinct HTTP 409 codes for owner expiry and a follower's expired wait. The cutoff covers queueing and observation until invocation or confirmed readiness; timely admission leaves later settlement under the existing safety budgets. Coalesced followers cannot tighten the owner's cutoff or cancel its work. Planning, drain, and convergence reject success after their actual cutoffs, including delayed timer delivery when no admission timeout was requested. Repeated cancellation settles required probe cleanup, and an already-selected deadline retains its cause through that cleanup. The soft activation path rechecks both cutoffs after the durable guard write, immediately before invoking the runtime. If persistence consumed the deadline, no activation occurs; the exact guard and closed gates remain for explicit recovery. Deterministic tests exercise a real guard file, fresh-instance startup refusal, and independently expiring coalesced followers.

Boundary — Not yet: Dynamic shared-capacity admission, durable multi-process orchestration, general repair, and a maintained real model/GPU transition receipt are absent. After a soft activation call is invoked, its failure has no trustworthy rollback and requires contained operator recovery; its durable runtime-guard/pending.json fences Vessel restart separately from the Host Reactor's .contained and unresolved .processing records. General recovery of corrupt or changed declarations is absent; the bounded host command refuses them. Live recovery remains unvalidated.

Evidence

Resource-aware VRAM and topology scheduling

State: Designed

Proved now: Orchestrator law defines the scheduling seam; deterministic tests preserve the current simple eviction baseline.

Do not expect yet: Current policy counts conflicting neighbors; it does not model VRAM, footprints, load time, topology, bandwidth, LRU, refits, tiers, or transition peaks.

Evidence

Altar and observability

The Svelte 5 static client, generated /api/v1 types, validated semantic SSE, local schema assets, and Litestar delivery exist. Loom and Orb share an immutable graph-projection supply and a read-only Svelte Flow adapter, with @xyflow/svelte 1.6.6 installed. Focused tests establish contracts and components; the required cross-engine retained-heap qualification after forced collection remains under verification. Installation and a visible canvas do not discharge ADR 15's renderer admission gate. The reading hierarchy and visual direction and instrument reading scenarios distinguish current reading surfaces from further presentation targets. Design studies and illustrative browser checks do not establish renderer qualification, restart recovery, large-collection performance, or accessibility acceptance; the instrument records below retain their existing evidence boundaries. The document language and interface copy are English. There is no message catalogue, explicit locale resolver or selector, Principal-preference binding, translated accessibility surface, or right-to-left receipt. Browser-native date/time formatting may reflect a device locale, but that incidental variation is not delivered localization support. The compiled Altar has one fixed LychD Dark palette, dark browser metadata, dark native-control colour scheme, and no light/system selector, system-scheme following, palette configuration, runtime theme loader, or supported theme extension. Semantic CSS custom properties establish a future refactoring seam, but hard-coded dark surfaces remain in the main background, graph chrome, and static artwork. There is no complete contrast matrix or bright/dim production-browser receipt; ADR 15's bounded operator-palette contract is design law, not delivered configurability.

Atlas undertaking map

State: Partial

Proved now: Atlas provides a fifth Altar route with a project list and detail forms. Projects retain a brief, concerns and criteria, attributed assessments with the requirement text and revisions judged, append-only decisions and supersession, a proposed next step, lifecycle, and explicit session or Run references. Changes are owner-scoped and version-checked; retained request identities prevent repeated writes after an uncertain response. Editing requirements marks earlier assessments for review. Bridge and Orb display links back to explicitly related Projects. Creating, pausing, closing, reopening, or linking a Project admits no execution. The shared PostgreSQL profile retains these records; disposable database tests exercise races, replay, owner boundaries, and migration downgrade refusal. The real application factory's two-boot HTTP receipt restores a Project and its Run reference and replays the retained request.

The next-step area groups conversation destinations without merging their concern relationships, and offers an explicit Bridge chooser carrying an inert Project return hint. Board summaries separate current insufficient/disputed judgments from missing or stale assessments. Bridge and Orb can carry an activity identity through project selection into an Atlas link draft; navigation alone saves nothing. Concerns support local search and assessment filters, with the active editor kept beside its concern during comparison. Conflict comparison exposes differing fields and explicit saved-value choices; citations can open in a separate tab while a draft remains. Superseded decisions remain available by disclosure. Board filters describe the loaded page, not the full catalogue or an inferred project-health judgment. Project detail places concerns first, with separate assessment-group filters and a read-only comparison of a stale judgment's retained basis against current requirements. Secondary Project context preserves explicit continuation links alongside the concern list.

Boundary — Not yet: Concerns remain embedded in Projects. The independent Concern contract is Designed: no standalone Concerns, shared decomposition, addressing or decision-to-Concern relations, versioned source derivations, or source-based proposal acceptance are delivered. There is no AI concern generation, automated coverage judgment, autonomous continuation, project scheduler, implicit Context injection, inferred clustering, or project-wide control over Run admission and cancellation. References identify related activity; they do not freeze execution evidence. The surface has no delete action or complete edit audit. The local Sigil remains bootstrap context rather than an authenticated person. The memory profile is process-local. Production-browser, multi-user, and large-history performance receipts remain outside this evidence; existing installations require migration 0009 before use.

Evidence

Bridge conversation and consent surface

State: Partial

Proved now: Bridge supports typed sessions, one-nonterminal-Run session admission, consent, inspection, semantic SSE, closed GenUI descriptors, durable request identity, authoritative snapshot recovery, lifecycle fencing, and bounded reconstruction against server-owned Run and Pattern identities. Exact retries reuse the canonical Run; distinct overlapping turns are refused. Its compact per-turn Circle exposes complete supplied identity, evidence and exact declared-score links, status/activity and eligible cancellation. Older retained replies report missing metadata; a mismatched Run projection cannot provide another Run's status or actions. Dispatcher grant ids rebind the Environment snapshot before inference and after consent re-entry. History governors retain whole exchanges, including legacy tool-call, result, and retry chains without Run ids. Browser-shell state retains per-session drafts and immutable unknown-admission envelopes across instrument navigation. The shell's Bridge link returns to the last explicit session path, restoring that session's draft; before any explicit selection, it leaves the root session choice to the server. Later middleware refusals cannot replace an earlier uncertain identity. Late responses settle that state even after view teardown, and admission overtaking a snapshot requires a newer read. After an initial snapshot read fails, Retry read repeats the current route's read, preserving drafts and unresolved offerings without submitting text. Terminal Run snapshots prefer the retained reply and fragments over incomplete live deltas while preserving the stream cursor. A failed Run's nonempty live text carries an explicit notice that it is not a completed answer, including when a terminal event already supplied a failure message. The session snapshot's retained agent turn replaces that live projection and notice. Empty failed text keeps the explicit no-reply message; transport errors alone do not trigger the notice. Definitely refused text is retained alongside a later draft. Hard unload warns; this state does not survive browser termination. The shell's consent link opens a session chooser with server-owned per-session counts; decisions update only their owning session's visible attention. The same workspace retains pending and uncertain consent verdicts across card and instrument remounts, reconciles late responses, and warns before document exit. IME confirmation does not submit an unfinished message. Shell consent counts refresh without overlapping reads every five seconds while visible, and on focus or return to a visible tab. Hidden, loading, and failed reads show unknown; teardown and newer invalidations fence late results. This remains a sampled count, not durable Attention. The conversation has a collapsible rail and secondary session detail. Incoming text preserves an older reading position; an explicit Latest turn action releases linked-Run focus without losing the draft. The composer explains the current admission or active-Run restriction. The Bridge snapshot also identifies the admission engine's configured default casting, separate from retained Run identities. A configured Scout default supplies fixed command guidance with a two-line example and the complete URL's public declaration. The composer renders that text literally, preserves its line breaks, and removes it when refreshed guidance is absent. This is configuration help, not readiness or permission; ordinary admission and native review still apply.

The conversation rail reads metadata in pages of 50 with an explicit continuation and Load more; its pending counts use one grouped PostgreSQL query without hydrating archive histories. HTTP event streams reserve capacity before headers, at most four per Run and 32 per process; excess connections receive 429 with retry guidance, and disconnects release their reservation. The browser caps envelopes awaiting a Run snapshot at 256, closes on overflow, and invokes its bounded recovery path. Nexus detects permanently closed native SSE and uses its existing one-shot ticket recovery. Refreshing a linked transition preserves the operator's keyboard focus.

Native prepared-action Consent has a portable server prerequisite: an immutable review binding, complete owner-produced text, and an authenticated reviewer passed through snapshots, events and decisions. Both verdicts require the exact review identity and fresh judgment eligibility before settlement or resume; retries preserve the first verdict. Missing or malformed required review stays unavailable. The client renders the complete review as labelled, escaped text, preserves long and multiline values, and sends its exact binding with either verdict. Read-only or unavailable reviews cannot submit a decision. An unresolved choice retains its original verdict and review identity across remounts and later refusals; a changed review permits outcome refresh, not a new choice or a retry against different material. Legacy Consent remains supported. Existing PostgreSQL installations require migration 0010 before running this code. The opt-in Scout public-page workflow supplies an owner-produced native review, atomic preparation/Consent custody, and current authority checks before acquisition and local inference. Its deployment and mechanism qualification limits remain those of Scout.

The trusted source-browser profile separately qualifies its fixed controlled-failure/useful-reply, exact Orb/Loom journey and retained reload. It does not extend Consent, other castings or public-note browser acceptance.

Boundary — Not yet: There is no ordinary installed production-browser receipt, durable cross-process event/token delivery, general multi-approval, Attention, or notification channel. Text is the only command modality, and no focused Circle workspace composes Scroll, active Spell placement, Context/authority, capability, and evidence projections. Selected-session turns and model history still hydrate that one conversation. There is no general storage quota or retention policy; archive paging and stream limits do not bound every retained payload or protect against a hostile authenticated operator. Native action owners beyond that Scout path still require their own production admission, review/custody transaction, and effect-time authorization. The client review and recovery tests use component fixtures and intercepted HTTP requests; they do not qualify complete production-browser layout or accessibility. The separately assembled Blockworld test workflow exercises a native action with inert effects. Native binding and reviewer unit tests use memory or session doubles. Separate disposable PostgreSQL receipts now exercise migration 0010, exact binding, decision concurrency and rollback; they do not qualify production deployment or live effects.

Evidence

Nexus transition board

State: Partial

Proved now: Nexus renders typed state and plans, submits explicit transitions, fences ambiguous request identities, follows bounded process-local tickets, and durably reserves the first target request before launch. An earlier unknown outcome retains its UUID through later middleware refusal. Navigation guards protect in-flight and unresolved admission from accidental discard. Native capability disclosures expose served health, warmth and reason independently of the compact chip. Preview loading is target-specific and closing it fences late responses. Full uncertain request identities remain visible, and a previous ticket survives selecting another preview. Containment and no-op conditions explicitly disable the transition action.

Boundary — Not yet: Only request admission is durable. Transition observations lack a durable owner, complete history, cross-process projection, restart recovery, and production-browser receipt. Durable admission prevents duplicate launch, but a lost ticket cannot prove the outcome or resume safely; retry refuses to relaunch it.

Evidence

Loom workflow instrument

State: Partial

Proved now: Loom browses exact immutable Pattern revisions, manifests, semantic station and permission outlines, checkpoint schemas, implementation revisions, source, active/default state, and retained revisions with stale-response-fenced client loading. Verified Orb origin links retain the Run and selected event on return; mismatched context is reported without choosing another Run. The semantic outline selects a station with labeled incoming and outgoing permissions, declared self-loops, and keyboard return to its row. The shared Svelte Flow canvas displays the same read-only score, folding the whole Pattern or revealing its stations through zoom and explicit controls. Graph failure leaves the outline and inspector available. Failed score reads offer an exact-revision retry. Copied Mermaid source retains the exact Pattern key, revision and manifest digest even when two revisions declare the same topology; it remains a view, not execution evidence.

Boundary — Not yet: Loom is a view over the fixed registry, not a Spellweaver editor, mutation surface, independent Spell identity or catalogue, compatibility or teaching surface, drafting canvas, inert unresolved-Spell projection, or Suite executor. The shared renderer's cross-engine forced-collection qualification and complete production-browser acceptance remain unproved.

The trusted source-browser profile covers only its keyboard link to the exact bridge_chat@2 score and return to the same Run. It does not discharge renderer lifecycle, graph-failure, editor or general accessibility acceptance.

Evidence

Composition Portfolio

State: Partial

Proved now: The Portfolio publishes Native Reference Composition contracts and examples; the default boot catalogue contains the Core bridge_chat lineage (revisions 1, 2 and 3) and delegated_rite lineage (revisions 1 and 2). An explicit application selector additionally registers the bounded creation.investigate@2 Pattern. The exact scavenger.observe_market@2 Pattern is registered for historical resolution and receives new admissions only under its explicit selector. The accepted designs include Health for attributable personal clinical records and bounded diagnostic and care proposals, Keeper for animal and colony care, Cultivator for cultivation, and the narrowed Homestead revision 2 for site and stores stewardship.

Creation investigation revision 2 has an explicitly selected PostgreSQL application, protected local submit/read/cancel/continue API and serial creation.investigate@2 Pattern. It retains immutable public sources, role reservations, one-shot claims, complete provider bytes, a candidate and a fresh attributed verdict. The Creation delivery boundary keeps its focused evidence and remaining gaps.

Scavenger revision 3 now defines one model-free finite-feed observation contract with a complete supplied campaign seed, whole title/link field, explicit deletion and recovery law. Pure immutable value contracts validate the bounded seed and source-order field, group exact-locator duplicate occurrences without dropping them, and derive a literal local filter over the unchanged field. Their tests cover explicit unknowns, UTF-8/total byte bounds, excluded-content projection and literal filtering. These values confer no acquisition, consumption, retention or retrieval authority. An explicit PostgreSQL selector now enables the model-free scavenger.observe_market@2 Pattern and its protected application admission/read/filter/delete API. The serial Graph retains only references, uses native Core consent and commits the whole field under application custody. The Altar's /scavenger application view supplies the complete seed, displays source/coverage and all occurrences, and separates local filtering, Run cancellation and terminal payload deletion. Scout's evidence boundary owns the assembled development proof and its remaining installed, public-network and process limits.

Blockworld has an explicitly assembled, inactive one-block placement Pattern. Portable tests drive real Run admission, the worker, serial Graph, native Consent review, HTTP decision, and resume with a composite memory store and an inert effect port. They reconstruct serialized fixture state into fresh services, retain the canonical Run and exact command through interruption, and reconcile a claimed action without repeating its invocation. Matching response and event evidence settle the receipt, mission cursor, and placement budget together in that fixture. PostgreSQL models, a store, and migration 0011 have passed disposable PostgreSQL transaction, recovery and migration-cycle tests, including comparison with the ORM schema. A further PostgreSQL vertical connects those stores to actual Run admission, worker execution, native HTTP Consent review, and serialized checkpoints. Fresh adapters resolve acknowledged and lost-acknowledgement outcomes without repeating the world command; an injected SQL failure proves receipt/cursor/budget rollback, and racing reconciliation returns one settled receipt. Current authority and world-epoch changes refuse execution after an earlier approval. This uses an inert world and captured queue in one process; it does not establish broker delivery or automatic recovery of an orphaned running worker after process death.

Companion has a pure Kotlin/JVM model for memory-only client interaction: expiring text drafts, exact review before a separate submit request, reconnect without replay, observed presentation and playback state, and separate local stop/cancel controls. Its pinned harness compiles and tests those local transitions. A submit signal establishes neither native admission nor a settled handoff; its one-signal guarantee follows the returned state lineage and provides no transport deduplication.

A native Android Compose screen now exposes the offline text-draft path. The person chooses a positive whole-second lifetime, edits against the original deadline, sees idle expiry, and cancels locally before starting a fresh session. The Activity preserves its state across configuration recreation within the same process; process death restores neither the draft nor unsubmitted form input. Review and Submit remain disabled while disconnected. The prototype lives in the opt-in offline application alongside the existing audio client. Its Kotlin/JVM reducer has passed the shared JDK 17 toolchain checks. ViewModel and instrumented Activity tests are authored, including input batches before recomposition and lifecycle-bound expiry sampling; this combined checkout has not yet been qualified with an Android SDK, emulator or handset.

Boundary — Not yet: Creation's one application selector supplies no general Composition or Product catalogue, shared store, Suite execution or application scheduler. Other Portfolio members have no domain/effect path enabled in normal application assembly. Blockworld has no server, bot, Minecraft adapter, production route or review producer registration. Its portable fixture alone does not establish database atomicity or migration safety; those boundaries have separate disposable PostgreSQL receipts. Neither fixture qualifies live game effects or a deployed Linux operation. Crucible is a designed Weaver choreography, not a registered Pattern, parallel Graph, dossier schema, or Altar surface. Keeper and Cultivator's durable record contracts do not supply database models or migrations. Transmuter remains a candidate study outside the accepted Portfolio. Its Extractor and Synthesizer pages establish proposed responsibilities, not import adapters, processing records, executable Patterns, or Memory/Identity handoffs. Accounting Office also remains a candidate study: its proposed mail/bank ports, entity books, jurisdiction profiles, privacy workflow, and accounting Patterns establish no implementation, live account access, tax filing, or supported-country claim. Thorn remains a candidate whitehat security workbench for scoped assessment, incident response, cooperative investigation, and reviewed reports/corrections. General monitoring and system maintenance remain outside its case ownership. It supplies no implemented case records, monitoring integration, response automation, peer investigation network, actor attribution, or reporting adapter; deterrence remains unmeasured.

The Android screen supplies no device capture/playback, transport, persistence, credential enrollment, or authoritative Companion records and receipts. Emulator evidence does not qualify physical devices or every Android version allowed by the declared minimum SDK.

Evidence

Offline music and Comfy engineering probes

State: Partial

Proved now: A source development runner validates immutable bounded recipes, preserves earlier control variants behind an expected-digest guard, and renders finite owned FAUST instruments or exact PCM clips through an isolated optional DawDreamer process. Aligned stems and a mix retain source, recipe, implementation, executable-package and output identities. Verified cache hits refuse corrupted/incomplete entries. A standalone read-only audition shows the exact recipe timeline and verified mix/stems without a native editor or independent synthesis. A classic loopback Comfy probe pins reviewed workflow/input declarations, persists an indeterminate submit fence before POST, reconciles exact prompt identity, and retains bounded immutable artifacts with partial-download receipts. Deterministic local staging supports explicit digest-verified repair after interrupted file installation, without HTTP or receipt identity changes. Unpinned staging blocks refetch. Focused tests exercise real DawDreamer 0.9.0 audio and MockTransport Comfy failure paths.

Boundary — Not yet: These are finite engineering mechanisms, not a native Riffmaw or Atelier application, canonical musical project, registered Pattern, Invocation, ServiceJob, media custody or semantic acceptance path. There is no shipped studio API/editor, live input, plug-in loading, realtime/latency proof, engine containment, Comfy deployment, loaded-model attestation or real MiniMax generation. Lost, damaged or unpinned Comfy staging and conflicting final files still require manual reconciliation; targeted cancellation refuses. Stable operator-owned external directories and the optional native profile remain explicit prerequisites. Portfolio and general-service delivery stay Designed.

Evidence

Companion Android Client

State: Partial

Proved now: The native Kotlin/Compose client provides a development-only Bridge HTTP fixture, generated wire models and token-shape checks from the Altar OpenAPI export, bounded local interaction state, and Android foreground AudioRecord/Media3 capture and replay. A closed local presentation policy gates views and direct actions, defaults to unavailable and fences context replacement. The Android assembly delegates transient mechanics to a controller with injected audio ports. Focused JVM tests verify malformed/bounded responses, lost acknowledgements, denied offers, stale callbacks, WAV bounds and file custody. Real Ktor fixture tests distinguish caller cancellation from the transport's own deadline, keep unacknowledged submissions unknown, and refuse redirect/replay or late-response restoration after context clearing. The fixture performs no host work; these client mechanics do not deliver a Portfolio Composition. The debug APK builds with the pinned Gradle toolchain and passes Android lint; that compile evidence is separate from the outstanding handset probe.

Boundary — Not yet: There is no enrolled handset or real-device validation receipt, live network engine, protected mobile ingress, Ward/Familiar enrollment, authenticated working-view projection, object-scoped authorization, semantic event subscription, Echo transcription/synthesis transport, settled Companion handoff/presentation, or Communion Suite execution. Release builds show an unavailable screen. Music, photo access and copy sync remain candidate work.

Evidence

Orb instrument

State: Partial

Proved now: Orb opens a paginated Run catalogue and a parallel pan/zoom field. At most three live lenses retain 100 records each; the visible catalogue refreshes every five seconds; zoom or explicit controls disclose Run, station/subject, supplied occurrence, and loaded records. Exact pinned workflow graphs show declared permissions separately from retained evidence. Catalogue queries select bounded metadata without loading prompts, manifests, or event histories. The selected-Run route retains ordered, paginated evidence with Pattern revision, capture durability, ledger boundaries, gaps, transition links, stable selection, bounded retry, and teardown-cancelled reads. Its ledger-polled SSE serves bounded batches, resumes from a delivered cursor, reports resets, and closes after the currently retained terminal account drains. Feed connection state does not settle Run status. Its delegated-job projection applies newest-job and per-job event limits at the store query boundary before rendering the public 32/64 suffixes. The shell Orb tab opens the parallel field. Exact Run/event links and the Loom round trip preserve selection, and Bridge return focuses the exact Run's turn or reports its absence. A historical consent record carries only a bounded syntactic Consent reference and an exact Bridge destination. Bridge checks the requested id and Run against its authorized session snapshot, reports unavailable requests without replacement, and focuses once per navigation. The return link preserves the originating Orb Run and event; drafts and uncertain verdicts remain in the existing shell workspace. This adds no current Consent status or review disclosure to Orb. Capture limits and coverage precede the evidence list. Rows expose supplied subjects and dated local timestamps; selecting one focuses its inspector, and closing it returns focus to the row. Delegated jobs unfold after the evidence, with verified linked-job focus preserved. The selected Run has a loaded-record playback cursor with a frozen evidence lens; live events continue without moving that lens. LIVE and Follow latest resume the newest loaded account. Allowlisted Animator dispatch identities supply a coloured rail and cursor highlight, with no inferred call duration or uptime. Loom and Orb share hover/focus previews and a dot-free canvas. Run groups retain an explicit unloaded-evidence label or loaded-record and supplied-gap counts at every folding depth, including supplied omission notices and further retained history outside the lens.

Initial read recovery and loaded-record subject/attempt browsing preserve the current route and historical selection. Refresh and pagination do not move focus when an unchanged job hint becomes available.

An optional, current-authority-checked Creation summary follows the selected Run's exact retained admission link. A dedicated metadata query preserves custody even when a deadline has elapsed and the slot remains encumbered. The client separates Run status, case status, constructor/verifier adoption, native verdict, latest external assessment and current owner disposition. Historical admissions explicitly display case-current outcome; absence discloses no case existence. Active SSE polls refresh or clear this metadata without changing the evidence cursor. Later feedback after terminal settlement requires explicit Refresh. No source, prompt, response, candidate, report or free-text reason body enters the summary.

An optional two-route preference inspector shows the selected Run's immutable admission decision: literal keys, unitless weights, dated phases, admission openness, exclusions and selected key, with the policy digest and observation window. REST and settled SSE project the same allowlisted metadata from the retained Run without refreshing readiness or applying current configuration. The client identifies these as admission-time observations and marks fallback as unavailable; legacy Runs omit the inspector. A keyboard-focusable table region contains overflow at narrow widths.

Boundary — Not yet: Loaded graph counts are not complete-history counts. The current manifest supplies no nested subworkflow or parent-Run identity. There is no durable Oculus read model, Sigma/Graphology adapter, cross-process completeness, health query, artifact custody, or annotation. There is no wall-clock workspace replay, configurable retention, continuous model-call activity, or historical Animator availability projection. The shared renderer's cross-engine forced-collection qualification remains under verification.

The trusted source-browser profile separately verifies the fixed Bridge→Orb→exact Loom→Bridge route and retained failed/useful Runs across a normal reload. It supplies no complete event capture, continuous runtime activity or general renderer receipt.

Evidence

Structured logging configuration

State: Available

Proved now: One tested builder configures human and JSON stdlib/Structlog output for CLI and Litestar while preserving stdout/stderr semantics, recovery-command fallback, and thread-stable repeated bootstrap without an unused logging queue. Worker-thread stdlib exception records and direct Structlog exceptions retain usable diagnostics as valid JSON on stderr; human console exceptions remain readable.

Boundary: Shared configuration does not prove complete semantic audit coverage, trace storage, OpenTelemetry export, redaction, retention, resource correlation, or Oculus.

Evidence

Native Oculus

State: Designed

Proved now: Observability law defines LychD's canonical evidence meanings and a native read-model boundary; no native Oculus implementation is delivered.

Do not expect yet: There is no native ingestion, durable query/read model, retention path, or Oculus-backed Svelte service. Orb is a bounded Run projection, not Oculus.

Evidence

Phoenix

State: External

Proved now: LychD can generate an optional Phoenix service contribution and preserves an explicitly configured legacy service name. Its generated database connection uses a separate role and credential after the migration gate; it receives neither the administrative nor Vessel runtime database password.

External owner and boundary: Arize owns Phoenix. LychD does not own its lifecycle or state, require it for Oculus, or prove application trace export. A latest image is not a reproducible receipt.

Evidence

Authority and artifacts

Context privatization and Portal egress

State: Partial

Proved now: Immutable influence labels and conservative joins exist. Context Blocks default to unknown/restricted; assembly accounts for ungoverned query, history and continuation without lowering known ancestry. The offline closed-diagnostic@1 profile prepares one complete typed projection through deterministic redaction, ordered receipts, independent reconstruction and utility verification, and a process-local authenticated Cut. Its closed vocabulary and exact sensitive spans cover a synthetic diagnostic fixture, not arbitrary text or code. The public event projection exposes only an opaque random identifier. Changed bytes, evidence, policy, identity, target, expiry, unknown lineage and meaningless redaction refuse verification.

Boundary — Not yet: No governed SQL/tool/artifact adapters, end-to-end source lineage, semantic Privacy Agent, general PII detector, reversible map/Vault, provider-specific sanitized wire branch, Egress Gate, transmission accounting, cumulative-disclosure policy or deletion propagation ships. An in-memory Cut neither survives restart nor grants disclosure. Normal private Context and effectful delegated execution remain ineligible for remote use.

Evidence

Local Sigil and scope authority

State: Partial

Proved now: Typed Sigils, scopes, guards, consent preauthorization, transactional use-budget consumption, policy synchronization, and digest-bound auto-grant revalidation are tested on the loopback bootstrap surface.

Boundary — Not yet: A dedicated local possession credential precedes the fixed magus:* Sigil, but it does not identify separate people. There is no object authorization, delegation, revocation, tenant isolation, remote exposure, or general effect-time reauthorization.

Evidence

Local browser and bind boundary

State: Partial

Proved now: Generated host publication binds IPv4 loopback. The managed image selects fixed internal 0.0.0.0:8000; alternate listener, supervisor, reload and metrics configuration refuses. Host-native serve is retired. Current source guards preserve this fixed container policy. Launch, Host, CORS, local schema assets, fixed root handlers, and CSRF contracts are bounded and tested. Missing, wrong, malformed, or duplicate HTTP Basic credentials fail before fixed-Sigil admission on protected HTTP/API/SSE paths; foreign-Origin mutations fail even with valid credentials and CSRF. lychd access explicitly retrieves the local credential without exposing it in generated commands or ordinary status. The raw SAQ diagnostic UI configuration is refused while its workers remain available. The HTTP assembly tests verify this security configuration against memory services without entering runtime lifespan.

Boundary — Not yet: Admitted requests still receive the fixed local Sigil. No hostile-browser receipt, security-header contract, or remote principal exists. The developer fixture's configured loopback Vite proxy has a bounded development exception. The trusted source-browser profile retains dated authenticated journey/security-refusal evidence for the retired native profile; it does not qualify the current container/Vite fixture, rebuilt image, installed startup, hostile browser or general browser security. Production access through a proxy, tunnels, non-loopback access, and untrusted-browser use remain unsupported.

Evidence

Scout web acquisition

State: Partial

Proved now: Web-acquisition law separates search, fetch, render, extraction, destination pinning, quarantine, authentication, and paid effects. The accepted design selects native static Fetch + Extract, a SearXNG Search Soulstone, and a later isolated Crawl4AI renderer candidate; Firecrawl remains deferred and paid web-acquisition Portals remain private-extension territory. The design now binds Scout provider contributions, a narrow SearXNG query/result contract, per-transmission engine egress mediation, and static extraction qualification limits and cases. The complete acquisition envelope remains a design target. Pure destination preflight now validates bounded canonical HTTPS URLs and exact-host supplied address sets against an explicit conservative IP policy. Its tests cover ambiguous syntax, forbidden and mixed answers, caller-forged facts, bounds and absence of I/O. These facts establish neither actual DNS resolution nor permission to connect. Workflow law now separates stable acquisition identity from Graph re-entry and requires separate custody before content can survive a workflow park or restart.

The fixed native extractor now projects bounded UTF-8 HTML and plain text through a supervised Linux child. A maintained Linux x86-64/Bubblewrap 0.12.0/CPython 3.15.0 receipt proves that exact runtime's ordinary and hostile fixtures, host-network/filesystem/environment/descriptor denial, CPU/address-space/process limits, bounded pipes, and timeout/cancellation/parent-death cleanup with observed new-session descendants. It fingerprints the runtime closure and source; a freshness test prevents a historical pass from silently qualifying changed code. This proves the local extraction mechanism, not arbitrary host compatibility or acquisition authority.

A separate scout-rss-extract@1 profile now projects strict UTF-8 RSS 2.0 into immutable channel/item observations in that same fixed child. It accepts three explicit XML media types; the old static header and public-page media contract still refuse XML. Expat declarations, entities, controls (including omitted attributes), element/depth/item/field bounds and the complete return ceiling have independent behavioral tests. A fresh identified runtime proof joins the current static confinement proof to 43 actual RSS/probe launches, ordinary and hostile inputs, parent locator validation, pipe flooding, timeout and cancellation with observed cleanup. Its maintained receipt fingerprints the worker, parent, domain, destination syntax and both proof harnesses; ordinary CI checks source freshness and agreement with the maintained static runtime. That receipt proves the RSS extraction mechanism. The separately selected finite-feed application below joins it to native admission and receiving custody; recurring watching remains unfinished.

The native acquisition mechanisms now use explicit A/AAAA DNS-over-TCP observations, a pinned hostname-verified TLS connection, a gate at every network write, bounded HTTP/gzip decoding and exact manual redirects. A maintained Linux receipt proves real DNS/TLS/HTTP and extraction in an isolated loopback-only namespace, including wrong certificates, mixed addresses, unlisted redirects and revocation during TLS preventing the HTTP send. Unit tests challenge malformed and fragmented inputs, deadlines, cancellation and limits. Source and dependency freshness checks prevent reuse of that proof for changed mechanisms. Optional Run-effect lifecycle hooks fence the exact worker claim before settlement awaits, preserve refusal after failed cleanup, and fence shutdown before draining; their tests include stale-worker/successor races.

A second maintained isolated-network receipt joins the production credential owner, current policy, Run fence and network gate to real DNS/TLS/HTTP. It verifies the exact GET and accounting, refuses same-host path/query substitution, and observes no HTTP bytes after authentication, policy, claim, Run or shutdown revocation during TLS. Zero budgets prevent their next effect; finite exhaustion after DNS prevents the origin connect or TLS ClientHello as applicable. Its source/dependency freshness check includes the authorizer and shared network fixture. Preparation and claim are explicit fixtures, so this proof does not establish database admission, extraction authorization or inference.

The opt-in bridge_chat@4 path now binds an actual local authentication marker, an explicit public-locator declaration, an immutable Scout profile and an exact local chat capability. Native review precedes acquisition. PostgreSQL retains preparation and consent atomically, admits one active claim per binding, reserves host/binding counters, and releases them only against an owned completion. Unknown attempts keep reservations and their slot; a new process cannot reconstruct material or live authority from those rows. Transactional migration and retained-history downgrade guards have separate PostgreSQL acceptance.

The production composition shares the same effect lifecycle between HTTP and workers. Current authority is checked after waits and before DNS, TLS/HTTP writes, extraction, token counting and local inference. The source envelope is transient and contributes unknown/restricted Context influence; only references and the ordinary answer enter the retained workflow. The answer may quote its source. Controlled workflow tests cover native consent, exact local-model selection, hardware waits, cancellation races, material loss and absence of refetch or remote fallback. An assembled PostgreSQL fixture additionally crosses actual credential admission, Run delivery, native consent and resumed claim, owned settlement and persisted turns. Its transport, child process and model are controlled substitutes, distinct from the separately qualified mechanisms.

A worker-driven PostgreSQL test now parks the actual Graph and restores its typed continuation from durable storage through perform_run. Scout checkpoints carry the exact native consent owner before entering the Gate and clear it before proceeding. Approval acquires and settles once; denial settles a refusal without acquisition or inference. Missing or conflicting owners fail before any resumed station, stale deliveries remain inert, and terminal events, delivery settlement and source exclusion are checked. Legacy checkpoints without an owner remain non-resumable; the worker never infers authority from their review reference. The test reconstructs checkpoint and event-bus objects, while retaining the admitted Scout service in the same process; queue publication, dispatcher, acquisition and model remain controlled substitutes.

A maintained composed Linux receipt now joins actual credential admission, PostgreSQL native consent and a store-issued claim to the real current-authority DNS/TLS/HTTP path and fixed supervised extraction child. The disposable database has no IP network or published port; its dedicated pathname socket remains reachable from the isolated acquisition namespace. The passage checks the exact request, all settled host/binding counters, reference-to-receipt identity, ordinary answer retention and absence of transient source input from retained state, history and settlement. Reconstructing the service cannot refetch consumed material. Revoking access during TLS prevents HTTP application bytes, extraction and the deterministic model call, while retaining a refused settlement. Container, anonymous volume and socket-directory removal are observed before the receipt passes. Nodes and services are invoked explicitly; queue, dispatcher, events and model remain controlled adapters.

A separate opt-in Scavenger3 / scavenger.observe_market@2 application now fixes one Bazoš PC RSS locator and a model-free title/link projection. Its selected PostgreSQL/ASGI/native-worker test parks and resumes the actual Graph through Core consent, then crosses real isolated DNS/TLS and the fixed RSS child to a committed whole field. Read, literal filtering and identical admission replay cause no further source request; no Bridge Session or model lease is created. Other PostgreSQL cases cover exact terminal deletion/tombstones, lost commit acknowledgement, current access changes, unknown claim custody, private driver failures, delayed exact retention replay and cancellation withdrawing pending review. Queue publication uses a controlled port; unknown custody is injected through the real store. This proves a synthetic development combination, not public Bazoš contact, a SAQ worker process, whole-process restart or installed operation.

An ordinary native public-feed observation at source 577105de used the production CLI and its in-process SAQ workers to retain 50 Bazoš PC RSS title/link occurrences and a local RTX view, with no model call. Its one acquisition succeeded; host and binding each record three connects, five transmissions and 1,876 outbound payload bytes. These are hierarchical counters for the same passage, not received RSS size. The first pilot failed its pre-restart closure guard on an adopted child whose historical state and exit were not captured. Separate external settlement removed its owned processes and container while retaining the volume.

A later, separately admitted native process authenticated afresh and read the exact whole document from that same volume. Canonical JSON equality and accounting checks before startup, after GET and after process closure show no new acquisition or budget reset. Its owned resources were independently reconciled and the volume remains retained and unattached. Source577 still logged two heartbeat-manager shutdown failures: OS process closure therefore does not qualify clean application shutdown or retroactively pass the first pilot. This dated observation establishes finite acquisition and retained readback; installed Scavenger, recurring watching and autonomous work selection remain unfinished.

A separate after-fix ordinary native readback used an exact frozen dirty candidate based on 577105de, with the application-owned queue plugin and no batched heartbeat manager. It preserved the same 50 occurrences and permanent accounting in approximately 4.45 seconds, without submission, acquisition or inference. Complete ordinary CLI logs contain zero heartbeat crashes, tracebacks or error messages; two SAQ zero-grace cancellation warnings remain recorded. Independent outer settlement passed. This closes the observed heartbeat-thread regression for an idle readback, while active-work shutdown and the original pilot restart remain unqualified.

The separate native owned-stop/restart case preserves the same field across two production boots and signed stops, with full-row accounting equality. It adds idle lifecycle evidence; it does not add another acquisition, recurring watching or automatic work selection.

The generated Altar application uses current protected reads and the existing native consent card. It preserves uncertain action identities, freezes identical admission replay bodies, fences stale selection responses and clears protected state on access refusal. Escaped item locators remain inert. Component/transport tests and a desktop synthetic-browser inspection cover these controls and keyboard access to the table; no Android or cross-engine qualification follows.

A dated authenticated native Altar readback on clean source 3bf598d9 now joins the ordinary CLI, retained PostgreSQL field and compiled Altar in actual sandboxed Chrome. In approximately 7.76 seconds it verifies all 50 whole rows in source order, acquired time, coverage, counts, disclosed attribution and inert locators. Actual protected documents match the retained canonical baseline; four SQL accounting boundaries remain identical, with no submission, acquisition, filter mutation, inference or reset. Independent process/resource closure and complete log assessment pass. One error/traceback is the normal initial Basic-authentication 401 challenge; two SAQ zero-grace cancellation warnings remain. The explicitly trusted functional UI profile enforces time, stop and PID controls but qualifies no hard CPU/memory ceiling, hostile-browser safety, installed lifetime or broad clean shutdown. Earlier failed pilots remain failed.

A separate native Altar filter session on clean source 3e221f56 exercises the ordinary controls in actual Chrome through an explicitly API-mediated, no-redirect/no-retry transport. In approximately 8.68 seconds, exactly two protected CSRF POSTs show the retained field's legitimate zero RTX matches with a visible explanation, then restore all 50 individually visible rows in source order through an empty-query submission. The complete protected document and four permanent-accounting summaries remain equal; no new acquisition, inference or reset occurs. Independent outcome review and resource closure pass; 17 captured process records represent 16 distinct identities. Two SAQ shutdown-grace warnings remain. This bounded functional session qualifies neither Chrome-direct HTTP, a persistent endpoint, hard browser CPU/memory containment nor clean application shutdown. Earlier failed attempts remain failed; no new full-row SQL snapshot is claimed.

Separate pinned SearXNG service fixtures now cross actual authenticated local HTTP, the upstream web application, dispatch thread, asyncio processor, host-sealed fixture TLS and engine parser. The unmodified dispatch baseline refuses before exchange; a narrow context-propagation prototype returns two exact observations, while a separate 303 case refuses before parsing or a follow-up request. All three independently settle their owned resources. These are private one-use fixture experiments, not a shipped service, live-engine qualification, repeated-use profile or native Search authority.

Boundary — Not yet: No SearXNG or Crawl4AI Rune/adapter, general Scout provider store, effect-scoped Agent tool, download quarantine, website authentication/session custody, or Smith ingestion path ships. No Search engine has passed qualification. The transport/extraction proof uses a synthetic audit gate; the additional current-authority network proof uses fixture admission data. The composed receipt adds real PostgreSQL and extraction but does not exercise HTTP routing, a SAQ worker process, durable Graph checkpoint/resume or model inference. The separate page worker test proves durable Graph continuation with substituted effects. The model-free feed test joins its own selected HTTP/Graph execution to real isolated network and extraction; no receipt joins page execution to the real inference service. These receipts do not prove a deployed combination or arbitrary host compatibility. The first workflow accepts only its explicit public-page command, follows no redirects, and requires a qualified local extractor and exact local model. Budget reset and unknown-attempt reconciliation have no automatic operational path. Rendering remains separately unimplemented outside the shared Pod.

Evidence

Vision admission

State: Partial

Proved now: Capability declarations distinguish the Vision family from image modality and dispatch metadata preserves that distinction. A WARM v1 vision record still fails closed at grant issue because no typed visual execution surface exists.

Boundary — Not yet: LychD does not upload, store, normalize, request, transport, or render image bytes through Bridge and an engine.

Evidence

Audio admission

State: Partial

Proved now: V1 capability metadata can declare audio input through modalities_in; it has no output-modality field. Speech services remain the stt and tts families. Even when observed WARM, both v1 families fail closed at grant issue because no typed transcription or synthesis call surface exists. A pure, unregistered Echo helper checks supplied bytes against their ArtifactRef digest, size, and media type, then inspects the exact canonical PCM WAV subset: mono, 16 kHz, 16-bit samples, 1–480,000 frames, at most 1 MiB. It returns immutable source and measured PCM facts.

A separate trusted Echo helper consumes retained bytes through the explicit local custody profile. It reruns the PCM inspector under quarantine-inspection authority, needs a separate admission decision, and obtains fresh read authority before consuming an admitted payload.

Boundary — Not yet: Structural inspection proves neither speech, consent nor provider compatibility. The local helpers have no capture, upload, transport or dispatch integration. There is no streaming socket, resonance buffer, working STT/TTS adapter, selectable Echo extension, or Audio Coven.

Evidence

Artifact references and local custody

State: Partial

Proved now: ArtifactRef defines immutable artifact identity, digest, classification, size, and media type. Delegated-agent requests and results carry those references; focused coordinator tests pass input metadata to an inert runtime, and a PostgreSQL receipt covers reference round-tripping through delegated-job creation and result adoption.

An explicitly constructed filesystem adapter implements the bounded same-host-trusted-bootstrap@1 Reliquary profile. It copies supplied immutable audio/wav bytes into quarantine under a retained private-root binding and requires an injected current authorizer. Reads compare the complete retained record before accessing payload bytes; admission reruns a trusted inspector and needs separate current authority. Immutable holds and exact releases govern manual retention. A tombstone denies reads and identity reuse before physical cleanup, whose result distinguishes absence, pending cleanup and recovery. Focused tests exercise actual WAV bytes, authorized access, control transitions, failure boundaries and clean same-root reopening.

Boundary — Not yet: This is an unregistered local composition seam, with no configured root, upload endpoint, credential-backed Principal/Ward integration, provider retrieval or derivation graph. Injected-authorizer tests prove consultation and refusal, not deployed caller security. Activation checks metadata and controls; only an authorized payload read establishes byte integrity. Native Linux physical retirement and power-loss recovery still need receipts. Known restore, clone or uncertain history cannot activate; in-place rollback by a hostile same-UID process is outside this trusted profile. Intent and Bridge remain text-only, with no artifact or required-modality fields in the Run ledger. A bare ArtifactRef grants neither custody nor access.

Evidence

Evolution and federation

Archive intake and semantic memory

State: Partial

Proved now: The opt-in local-public-notes@1 profile admits explicit public notes to one configured PostgreSQL namespace. Exact request and source revisions are idempotent; explicit promotion, supersession, archival and revocation enforce lifecycle versions. Revocation clears controlled text and its search index while retaining minimal anti-reingestion identity. Bounded lexical recall writes text-free receipts and rechecks current subject, namespace, policy and selected revisions before returning source bytes. Transaction timeouts bound database work.

bridge_chat@3 pins the exact local chat capability and Archive profile at admission. Its read-only answer uses an attributed transient source message, reserves its Context budget, and revalidates the receipt before dispatch, each model request and settlement. It exposes no tools and replays no settled history. PostgreSQL tests cover real HTTP controllers, Run admission and worker execution, typed checkpoint reconstruction, stale-source refusal, migration lineage and the actual restricted runtime database role. Earlier Bridge manifests remain retained unchanged.

Authorized configuration discovery and finite metadata reads now support review after reload or a lost mutation response. Profile discovery performs no storage, registration, model or Run work. Lists expose at most 50 metadata records per page across all lifecycles, with an exact source-key filter and stable timestamp/UUID cursor; exact-record reads recover the current lifecycle/version. Both select only metadata columns, including revoked tombstones, and never hydrate source text, search vectors or embeddings. Reads create no persistent namespace, note or receipt rows. A missing namespace lists empty; changed retained bindings and storage failures refuse distinctly. Current management authority is checked before storage, after namespace preparation and after session cleanup. Inspection grants no recall eligibility or automatic lifecycle retry.

A separate authorized exact-Run read returns a bounded text-free Archive receipt only when the retained supported Bridge3 Pattern, complete admitted/current profile and exact expected recall request match. Current management authority is distinct from Run visibility and is rechecked after ledger, namespace and session preparation. The response distinguishes unsupported history, absent receipt, successful empty selection, budget omissions and failure. PostgreSQL tests execute the worker with a substituted model, observe terminal Context release and then read the same receipt through a fresh service and repeated HTTP reads without dispatch. Historical selection survives source supersession, archival and revocation; inspection reads no source table and creates no rows. Bridge3 uses live checkpoints; this is no durable-checkpoint deletion or crash-recovery proof. Orb now exposes that separate read in an explicit Archive selection inspector. It performs no request on mount or structural live updates; current failure clears protected metadata, and an exact-Run keyed child aborts and fences old responses on navigation. Selected source metadata is escaped and ordered, long digests use native disclosures, and read time stays separate from receipt creation. Component/transport tests cover empty, absent, unsupported, refused and malformed results, explicit retry, stale completion and preservation of Orb graph/history/SSE ownership. Capture remains matching_retained_request: a caller can preseed an exact public recall before workflow execution. It proves neither consumption nor provider transmission and reconstructs no complete historical Context.

Bridge now supplies a Public notes focus at /bridge?notes=manage|new|UUID, using the generated management transport. It shows configured profile and a separately authorized actual-default/full- profile match, finite all-lifecycle pages and exact-record recovery. Explicit intake freezes the UUID/body/submitted UTF-8 digest; promotion is separate. Correction fixes the source key and asks for complete new text under a different revision; revocation requires exact consequence review. Unknown intake and lifecycle outcomes remain distinct from observed current metadata. No refresh, navigation or late response retries a write or takes over a newer focus. Current refusal/profile change and teardown fence protected data and callbacks. Component/transport/controller tests cover these paths, full-mode navigation races, escaped source identities and preservation of ordinary Bridge drafts, unresolved offerings and Consent. These portable tests do not qualify a real-browser or installed workflow.

A distinct Recall public sources focus at /bridge?notes=recall now composes the explicit semantic API into a sources-only query and exact current-source read. It requires a user-supplied finite threshold, shows numeric bounds and freezes the raw request with a fresh UUID. It displays escaped ordered source/revision identities, similarity, coverage/omissions and distinct selection and resolution-response times. Unknown Check uses the same frozen request for metadata only; recovered selection needs an explicit current-source load. It never automatically retries a query, activates a model, prepares derivations or admits an answer Run. Profile/generation/current-authority and lifetime fences clear protected projections and reject late responses. Portable controller, transport, component and route tests cover these paths and preserve the separate conversation workspace. This does not qualify ordinary installed runtime preparation, real-browser interaction or retrieval quality; configuration metadata alone establishes none of those prerequisites.

The exact-note detail also provides separate configured-generation registration, explicit preparation Check and reviewed preparation of one promoted revision. It uses the existing typed Archive ports; opening, navigation, promotion and completion never automatically register, derive, activate a model or submit recall. Latest derivation row/attempt state does not attribute one HTTP invocation or all compute spent; a lost preparation response remains unknown after Check, and a further explicit attempt may repeat work. Local write guards, current-authority/profile/selection and lifetime fences preserve management ownership and reject stale callbacks. These are portable browser-controller/control tests, separate from the fixed native lifecycle below; ordinary installed preparation and real-browser acceptance remain open.

A separate 19 October native operator observation at source c4d86be6 exercised ordinary Settings/Runes, database bootstrap, CLI, Granian TCP, PostgreSQL and the existing shared Qwen3.8-27B runtime. Four fresh Sessions answered one frozen synthetic lexical question: the candidate was excluded; promotion supplied revision 1; correction supplied only revision 2; revocation restored explicit uncertainty. Independent review checked source attribution, the conditional exception, exact receipt/wire bindings and lifecycle-caused stale refusals. Four model POSTs used 2,356 prompt and 252 generated tokens. Root independently settled the temporary service, process groups, listeners, database and anonymous volume while preserving the warm model and retained data. The receipt retains raw native API responses and model request bodies, but no raw model response stream or outgoing API headers. This is a dated single-case observation, not a released live-test harness or general retrieval benchmark.

An independent optional Archive configuration exposes its exact generation reference through the authorized GET /api/v1/archive/derivations/generations/configured route. Discovery checks current policy without reading storage, registering rows, acquiring a lease or probing a model. The caller can then explicitly register that generation and derive promoted notes into 1024-dimensional pgvector values. Each explicit attempt retains its source, profile and generation identity, with a database deadline and conditional completion. Archive, revocation, supersession and generation retirement clear affected vectors and prevent late results from restoring them. Status exposes metadata only; expired work requires an explicit retry. PostgreSQL tests cover concurrency, expiry, lifecycle races, float32 round trips, migration rollback and restricted runtime permissions. The configured HTTP test uses the real Core driver with substituted model responses, covers discovery through registration and derivation, and shares the application's lease ledger without emitting Run events for caller-supplied Run identifiers.

A separately enabled archive.semantic = true consumer uses that same configured derivation generation. Its strict request requires an explicit cosine threshold. The authenticated /api/v1/archive/semantic/recalls endpoint returns a text-free schema2 selection receipt and any query execution incurred by this caller; exact completed replay performs no query inference. Sibling POST inspection and receipt-resolution routes distinguish historical selection from currently eligible source bytes. Source-attributed resolution rechecks the active exact generation and every selected source/vector fence. Receipts report the final snapshot's promoted and eligible note counts; partial derivation coverage is explicit. Existing lexical/schema1 and Bridge3 remain unchanged.

Actual PostgreSQL tests cover filtered exact signed cosine, deterministic ties, coverage, bounded whole-note selection, concurrent publication, lifecycle/generation races, corruption, transaction timeouts and the existing restricted runtime role. Authenticated ASGI plus actual PostgreSQL tests exercise the configured factories, real Core HTTP driver and shared leases with intercepted model responses. HTTP numeric-coercion negatives use the production schema plugin. These tests do not qualify real-model Archive composition, general retrieval quality, a browser semantic instrument or semantic Bridge execution.

The separately boot-selected bridge_chat@5 composes that semantic generation with one exact local Soulstone Chat capability. Admission retains the complete manifest/reference, explicit threshold and finite recall bounds; each node resolves the Archive subject from the persisted caller. Component controls cover exact admission and checkpoint bindings, changed-service/receipt refusal, current authority before chat, each outbound model count/request and settlement, and query cleanup before chat acquisition. The transient archive_semantic_recall envelope carries the schema2 receipt, generation, coverage and source attribution. It supplies no instructions or tools, and this casting excludes prior conversation history. The injected source envelope stays out of retained state and model history; generated answers may quote source text and persist. Execution uses the existing shared hardware lease path, without automatic generation registration, preparation or lexical fallback.

The final serialized response is checked before ordinary answer/history assignment. A known normalized length finish refuses with answer_output_limit, even if the SDK returns nonempty text. Component controls prove that the original code accepted this case, then exercise refusal, normal/unknown completion metadata, final-response ordering, one provider call and lease closure. Other or absent metadata retains adapter compatibility without certifying completeness. Streamed text remains provisional evidence; this check adds no automatic retry or larger budget.

A successful current resolution with no selected sources instead returns a labelled deterministic recall outcome before Chat, Context assembly, counting, forge or pump work. Component graph tests distinguish no promoted notes, no searchable notes, a threshold miss and character-budget omissions, with historical coverage and an explicit source-limited abstention. They retain actual query cleanup and winning-receipt versus caller-work accounting. A real in-memory session store proves unchanged prior SDK history, clearing of an unsettled SDK suffix, one visible outcome and replay without another embedding. Authority revoked before or during answer/final resolution still refuses. This branch also has the fixed native A/B/C observation below; the earlier SQL runs do not qualify its new outcome. Earlier failed native attempts remain failed.

The separate maintained native answer observation qualifies one public synthetic generated-answer-and-empty-recall-v2 occurrence through authenticated in-process ASGI, actual PostgreSQL, the registered CPU embedding profile and warm Qwen3.8-27B with bridge_chat@5. A returned the fixture's 14:20 opening time with its exact source key/revision and normalized/provider stop. B retained typed source_integrity after revocation with zero Chat or Context assembly. C returned a labelled source-limited deterministic recall result with no selected/promoted/searchable notes, zero Chat, zero Context assembly and zero new SDK messages; the normal terminal release was recorded. A and C recorded replay with no new compute. Four embedding operations/eight POSTs used 118 input tokens; one Chat POST matched the independent warm-counter delta of 1,029 prompt and 239 generated tokens. All observed clients closed, no leases remained, and application SQL disposal returned once after service close. An independent retained visible-output review passed these fixed cases and recorded operation evidence; Root's separate 20 October terminal audit passed 23 physical checks and recorded 20 raw custody pairs. These are attributed retained observations. Raw SDK text equality, retained input/state exclusion, history equality, replay identity and revocation timing remain test-backed reports, not independently reconstructed from the sanitized receipt. Its raw semantic-answer-v1 outer envelope permits two Chat calls; active v2 admission permitted one and observed one. The observed source head and fixed Chat-profile fixture revision are recorded separately.

Actual PostgreSQL source-answer controls passed five cases in each of two bounded runs, with zero failures, errors or skips and independently confirmed physical settlement. A fresh fixture drives HTTP admission, retained idempotent binding and the actual worker through ordinary answer settlement. Four separate cases explicitly persist and reconstruct the typed PostgreSQL snapshot: unchanged state proceeds; revoked source, retired generation and changed composed service refuse before a Chat grant, outbound request or settled agent turn. Ordinary revision 5 uses Live Stasis; these manual reconstruction controls do not establish automatic worker-death recovery. Component embedding substitutes, FunctionModel and a local Chat substitute replace native inference, and the broker is captured. Both runs made zero real-model calls; they establish SQL custody and settlement, not grounding, abstention, model usefulness or installed startup.

A further six-case PostgreSQL run preserves those cases and adds the actual worker failure path for a nonempty output-limited FunctionModel stream. Its normalized metadata passes through the original SDK and pump: the Run retains FAILED and the safe reason, with one provider attempt, no normal settled answer or SDK history, and observed Context/lease cleanup. The recall receipt stays inspectable; ordinary Live Stasis leaves no retained checkpoint in this case. All six cases pass with zero real-model calls, and an independent terminal audit confirms resource and input custody. This is an offline-provider SQL result, not native output-completeness qualification.

A separate native composition test and maintained observation qualify one fixed public synthetic lifecycle through authenticated in-process ASGI, current factories, the shared lease ledger, actual PostgreSQL and the registered Qwen3-Embedding CPU profile. Candidates are excluded; promoted notes can be derived, ranked and resolved. Correction requires explicit rederivation and refuses the old current source; revocation clears source/vector custody. Historical replay stays inspectable and adds no embedding operation. Eight actual operations (five queries, three documents), 16 model POSTs and 177 input tokens completed with all observed clients closed and no leases remaining. An independent operator audit confirmed owned processes, groups, cgroups, containers, anonymous storage, listener and socket absence, and unchanged source/model/selected SDK, unrelated work, warm services and retained storage. Application startup also probes capabilities whose preloaded metadata has no readiness state, before recovery starts; metadata never forces cold/error observations to warm. Focused lifespan controls distinguish this real-adapter observation from metadata hydration or forcing warm state. The test requires a separately admitted bounded outer unit and an independent terminal audit; its operation procedure retains the trusted operator and fixed host/profile boundary. It does not activate a model through the Orchestrator or exercise normal Settings database socket configuration.

Boundary — Not yet: Ordinary Bridge3 remains lexical RAG for explicit same-host public notes. The separate semantic API has only the fixed native lifecycle qualification above; general retrieval quality remains unqualified. Revision 5 additionally has the fixed native answer observation above; general answer usefulness and grounding, installed startup and automatic crash recovery remain unqualified. General CandidateArchivePort, automatic conversation retention, extraction, Curator, GraphRAG, shared namespaces, remote IAM, private-material egress and training remain unqualified. Public-note management controls have no source-body preview or prefilled editing; real-browser keyboard/reflow/reload acceptance and installed cutover remain unqualified. Ordinary revision 3 execution uses live Graph persistence; separately proved typed checkpoint reconstruction does not establish automatic recovery after worker death. The portable vertical receipt substitutes model/resource seams; the separate native observation qualifies only its named model, configuration and trusted operator profile. Its native address-space/CPU limits apply per process, not to the aggregate cgroup. Neither receipt qualifies an installed caged body, private memory or autonomous improvement. The derivation path has no background worker, automatic model activation, chunking or ANN index; oversize notes refuse. The standalone live Core embedding proof remains transport evidence; the fixed native composition above is the separate Archive/database/model qualification. Generated answers can quote sources; later revocation does not erase earlier output or influence.

Evidence

Mirror identity

State: Designed

Proved now: Identity law defines a filtered, revisable binding rather than a second cognitive runtime.

Do not expect yet: There is no identity store, synthesis loop, hydration adapter, versioned Persona, calibration, or promoted persistent identity.

Evidence

Shadow simulation

State: Designed

Proved now: Simulation law defines branch expansion, scoring, pruning, authority, and verified collapse, including versioned exploration strategies and retained histories for bounded replay.

Do not expect yet: There is no runnable branch graph, MCTS engine, branch store, exploration strategy executor, budgeted simulation, collapse implementation, or reaper.

Evidence

Drift evaluation

State: Designed

Proved now: Evaluation law binds declared goals to versioned Cases and Rubrics, with adversarial evidence, capability comparison, and calibration. The reference workflow-improvement method specifies baseline/candidate comparison, causal replay limits, human-attention measures and proposed starter Cases. It includes a historical exploration-replay pilot outline; evaluation law distinguishes mechanism reuse from measured improvement in its successors.

Do not expect yet: There is no runnable harness, replay simulator, maintained suite, scorer contract, benchmark history, pass-at-k experiment, or routing update.

Evidence

Soulforge training

State: Designed

Proved now: Training law defines how consecrated examples may enter governed training. The discernment-training reference applies it to conditional human corrections, lineage-safe splits and independently evaluated model candidates.

Do not expect yet: There is no dataset harvest, training job, isolated trainer, checkpoint evaluation, model registration, rollback, or production promotion.

Evidence

Offline Evolution comparison

State: Available

Proved now: A bounded offline mechanism checks caller-admitted historical obligations and retain, reconcile, replace or reject dispositions against an exact base, candidate, policy and history. For retain, reconcile and replace, missing required, failing, conflicting or mismatched summaries block; replacement requires declared owner retirement and transition/recovery evidence. Deterministic reports distinguish completed comparison, recorded rejection and blocked work. Focused tests cover insecure-contract retirement with unrelated-extension preservation, exact replay and strict input refusal.

Boundary: This is consistency checking over admitted claims. It does not retrieve or authenticate artifacts, establish factual test results or independent evaluation, create a Drift Outcome or Promotion Request, persist an adoption ledger, dispatch work, or authorize activation. Native autonomous Creation and target-owner promotion remain designed.

Evidence

Creation and Forge promotion

State: Partial

Proved now: The narrower Creation investigation revision 2 has a PostgreSQL store, explicit selector, protected local API, fixed serial Pattern and distinct constructor/verifier AgentSpecs. It retains original request/source/profile bytes, admission attribution, reserved attempts, complete provider responses and separate candidate/verdict. Current credential-backed local object/action policy and actual Run state fence claims and adoption. Invalid, duplicate-key and length-terminated output remains retained noncompletion without repair calls. Valid citations establish exact source spans, not semantic correctness. Deterministic line counts guide both roles without changing source bytes or relaxing citation validation.

Focused unit/API and real PostgreSQL cases cover admission refusal, observed-usage limits, authority and profile changes, cancellation winning adoption, worker loss after candidate commit followed by one explicit fresh-authority verification Run, and unknown claims retaining the slot. Migration 0016 covers empty-cycle and retained-custody downgrade refusal. Those worker histories reconstruct adapters in one process with a captured queue and inert model; they do not prove an OS-kill or live broker. Generated OpenAPI/TypeScript and the frontend checks pass.

Altar now offers a typed public-source Investigation focus within existing Bridge. Explicit ?investigation=new opens intake; a case UUID opens an operator-triggered protected Check. The browser retains the exact request identity/body after any failed POST, including authorization refusal, without inferring that admission did not occur. A 404 Check does not settle an in-flight submission. Identical replay requires an explicit action and the original transient body; reload or leaving this focus cannot reconstruct it. Valid mounted case selection retains transient work; duplicate or invalid selection retains the departure warning. Explicit discard has separate Keep/Discard controls and preserves keyboard focus during a pending Check. Ordinary Bridge session/draft state stays separate.

The report renders validated retained sources, candidate and native verdict as text, with exact admission Run links to Orb. Load feedback explicitly reads the existing protected historical projection; mounting or selecting a case performs no feedback read. Current IDs select the external assessment and owner decision, so a later assessment cannot inherit an older hold. Native verdict, external assessment, owner disposition and feedback status have separate scalar summaries; the current report, reason and supplied annotation coverage are escaped text. Refused, unavailable, unassessed and external not-assessed states remain distinct. Selection and teardown abort owned reads and fence late results; refusal clears protected feedback.

Detail GET, fresh POST and replay POST retain their existing current-authority rechecks after awaited case reads; this adds no read-scope requirement to submit. Deterministic regressions reproduce all three revoked-during-await cases. Integrated frontend checks pass 430 tests with zero Svelte errors/warnings; the affected protected Creation web contract passes nine tests. This UI adds no source editing, feedback mutation, automatic continuation or execution authority.

A dated operator observation at 3e518e81 also records an actual Qwen3.8 constructor/verifier pair: two calls retain separate outputs, two ordinary application lifespans preserve custody, changed-base replay refuses, and exact replay under fresh current credentials performs no inference. Native verification returns accepted; a separate coding-agent review judges the content partial: the core assertions are supported, but generic-message assurance is overstated and replacement wording lacks the appropriate source citation. The native verifier misses those qualifications. The earlier length-limited and invalid-span occurrences remain failed observations. This one-case profile injects settings, Rune and extension declarations and a refusing runtime actuator into the real application; it qualifies neither normal configuration/deployment, semantic reliability, independent-model verification nor autonomous improvement.

A separate dated observation at b3820bd uses ordinary XDG/TOML/Rune loading, native CLI, credential-backed loopback TCP, live SAQ workers and a separately owned SCRAM PostgreSQL cluster, with no fixture injection. One complete constructor response is retained as incomplete/output_bytes: its canonical result is 1619 bytes against the unchanged 1536-byte ceiling. No candidate is adopted and no verifier runs. An ordinary native CLI restart preserves exact case custody; exact replay performs no additional inference. Root independently observes unit/group/process/listener closure, matching model counters and unchanged installed bindings. The task container is removed; its named storage is intentionally retained. This qualifies normal loading and retained noncompletion/replay, not permanent deployment, useful semantic completion, crash recovery or hostile-runtime containment. Native aggregate enforcement covers pids only; per-process limits and separate PostgreSQL limits are narrower observations.

A distinct occurrence at 7929389 states that same canonical-output ceiling and concise writing margin in both role instructions. Ordinary configuration, native CLI, SAQ and protected TCP complete both calls in approximately 23 seconds (3743 prompt and 550 generated tokens), adopting candidate and verdict. Native disposition is accepted; external review judges both partial: settlement assertions cite only replacement-message prose, and the error string is blurred with the exception object. The actual test supports those assertions elsewhere; a valid span alone does not support the claim. This is a known-task iteration, not a controlled causal comparison or semantic reliability benchmark. Two ordinary app starts retain the new case, exact replay issues no inference, and the earlier failed case survives database-container replacement with unchanged named storage. Independent resource/model observations settle the task processes, listeners and container; storage intentionally remains. No permanent daemon, autonomous editing or improvement, crash recovery, whole-environment closure or model-byte attestation follows.

A separate protected feedback surface now retains an exact external UTF-8 report, claimed reviewer and authenticated submitting authority against the original request/profile/candidate/verdict and source/criterion identities. Optional submitter annotations stay distinct from the report; absent criteria remain not_assessed. An explicit owner hold or reject preserves the native verdict. Canonical identical replay returns original attribution; conflicting identity refuses. Case locking serializes append sequence and current decision, and a new assessment makes prior decisions historical. Feedback neither expires nor mutates original execution and requires settled bound Runs/deliveries, resolved inference and no matching local lease. Historical revision 2 assessment needs no current model readiness. Feedback intake itself publishes no successor Run; explicit successor admission is separate below.

Focused tests cover current credentials, scopes, Origin/CSRF, duplicate JSON, literal report and canonical target bounds. The earlier feedback checkpoint qualified fourteen real PostgreSQL cases covering custody, restart attribution, concurrent sequence/decisions, capacity/replay, post-lock revocation and settlement refusals. The complete affected migration module passes 89 cases, including additive 0017, original custody and retained-feedback downgrade refusal. Generated API/client checks and 341 frontend tests pass; previous OpenAPI paths/schemas are unchanged. These trusted inert-model checks issue no inference. A dated ordinary-native observation at 69829ad appends the original 2611-byte external report and explicit owner hold in approximately 10 seconds, with no additional inference. Native accepted, external partial and owner hold remain separate. An ordinary different-process restart and fresh protected client preserve both historical cases, exact feedback and original attribution; changed same-ID bodies refuse. The API does not expose the restarted current authority generation. Root independently observes task processes, ports, unit/group and container absent, unchanged model counters and installed bindings, and exact retained named storage without attachment. A complete private logical backup precedes migration; restore and rollback remain unproved. This establishes dated ordinary feedback custody and settlement, not a successor, automatic editing or measured improvement.

A further unfamiliar case at 16da86f retains incomplete/UnexpectedModelBehavior after one constructor call (1956 prompt and 423 generated tokens), with no adopted candidate or verifier. Offline validation of the exact returned arguments finds a 514-character summary against 512; compact JSON is also 1632 bytes against the unchanged 1536-byte ceiling. The SDK's internal exception message was not retained. Separate source-only review finds the core ordering and possible counterexample correct, but both criteria fail operative citation support: test line 31 checks non-None; the decisive maximum-ID assertion is line 32. The approximately 29-second native occurrence preserves this noncompletion and earlier custody through normal restart and observed protected replay without new inference. Independent resource/model settlement passes; owned storage and the private backup remain. Private operator lineage supplies no native successor authority. This is a failed transfer observation, not useful native completion or measured improvement.

Explicit numbered-source presentation now reconstructs the exact original request and UTF-8 bytes; concise per-field guidance changes both instruction keys to v4 and implementation to py.5. Dense-line overflow refuses before admission; existing packet/output limits remain unchanged. A dated known-case correction at 18235a8 completes both roles in approximately 28 seconds, using 6216 prompt and 646 generated tokens across two calls. Both retained packets roundtrip; 1115/1023-byte canonical outputs meet the unchanged 1536-byte ceiling. Native accepted and external judgment remain separate: fresh source-only review gives both outputs ordering PASS, discrimination PARTIAL. The operative test citation is now line 32, but both roles categorically assert that the last parked random UUID is greatest; their own qualification denies guaranteed UUID/insertion order. The verifier accepts that same defect. The correct counterexample is conditional on the second ID being greater. Normal restart and observed protected POST replay preserve the new case, three historical cases and parent hold without new inference. Independent resource/model settlement passes. This is one known-case correction observation, not causal improvement, unfamiliar transfer or native successor authority. An earlier zero-inference transport failure and its narrow observer-only repair remain separately recorded; its precise cause is unproved.

A subsequent ordinary-native feedback occurrence at 5844a22 appends the exact 2977-byte public report and separate local owner hold in approximately 8.7 seconds, with zero inference. Both typed criterion coverages remain not_assessed; report PASS/PARTIAL text is not submitter annotation. Native accepted, external partial and owner hold remain separate. Normal distinct-process restart, fresh protected client, observed POST200 replays and 409 conflicts preserve all four CaseViews, old parent hold, exact new feedback and original authenticated attribution. The API does not expose current authority generation. Independent resource/model settlement preserves original storage and backup; no bootstrap, migration, new backup or source change occurs. A preceding zero-write setup failure used an unconfigured version-table name; the corrected read-only query follows the owning LychD constant. The precise database error was not retained. No successor authority follows.

A separate protected local action now admits one new investigation from the exact latest assessment and owner decision. Fresh operator authorization supplies a complete new request, acceptance and bounded changed hypothesis. The child receives the current exact profile and its own finite reservation. The implementation closure advances to py.6 with unchanged role instructions, packets and limits. One transaction retains its Session, child, admission and immutable lineage before Run publication, permanently consuming the parent's one-child allowance. Parent custody, feedback and deadline remain unchanged; a child cannot admit another descendant through this action. Separate lineage projection preserves the historical CaseView shape. Identical replay returns original attribution without model readiness or renewal; only the original still-current binding may repair its exact held delivery. A fresh startup may read retained held custody without repair.

Current qualification passes 79 inert unit/API cases, 31 real PostgreSQL worker cases and the complete 90-case migration module. Controls cover concurrent one-child admission, a one-connection pool with exactly one Session, foreign-bind refusal, feedback freshness, revoked authority, unresolved claims, settled delivery, bound-but-held recovery, historical restart and permanent debit. Additive migration 0018 covers empty cycles and refuses downgrade while lineage remains. Generated OpenAPI/TypeScript, 341 frontend tests and repository static checks pass; the final test-only fixture repair passes focused static checks. Final non-container qualification passes 5,895 tests with 15 explicit optional skips and 448 container deselections. Three actual Bridge baselines and fresh extractor/composed Scout qualification preserve the maintained receipt oracles.

One ordinary native successor observation at source a80d91d uses ordinary CLI/configuration, protected API, SAQ and retained PostgreSQL. A private bounded backup precedes ordinary bootstrap from 0017 to 0018; restore remains unproved. The explicit child retains two one-shot roles in 29.8 seconds (6,490 prompt / 675 generated tokens), releases its slot and preserves all four historical cases and parent feedback. Protected replay before and after a distinct-process restart preserves original lineage attribution with no extra inference; changed-body and second-child requests refuse with 409. Independent settlement confirms exact task process/unit/group/container/port closure, retained storage and unchanged installed bindings.

The child is natively accepted, but a fresh reviewer commits source-only expectations before seeing its outputs and grades both roles ordering PASS / discrimination FAIL. Both answer the actual implementation's success instead of the requested last-parked alternative; verifier acceptance is unsupported. At that observation, this external report was not yet natively attached to the child and no child owner decision was observed. Parent native acceptance, external partial assessment and owner hold remained unchanged. No semantic improvement, autonomous work selection or executable candidate verification was proved.

The earlier successor observation retains its historical unattached-review boundary. A later native child feedback attachment at source 1777cbfb attaches that exact 3,346-byte public report to child 701dcbed-1ddb-4b96-80bf-3cad32f13588. Native accepted, Root-mapped external partial and owner hold remain separate; empty submitter annotations leave both criteria not_assessed in typed coverage. Exact protected replay and changed-body409 refusal preserve original feedback attribution across a normal restart. All six retained cases, prior feedback and lineage remain unchanged, with no new investigation, Run or inference. This records report custody and disposition, without semantic regrading, promotion or further child authority.

The wider SDLC law defines attributable request → candidate → verification → promotion-request → target-owner-effect ownership. The Creation method and Ouroboros map connect work to separately governed evaluation, memory, training and body change. The Development bootstrap procedure orders operator-controlled work and incremental qualification; these methods introduce no general scheduler or autonomous development service.

Boundary — Not yet: This investigation performs no source editing, executable workspace, filesystem/command execution, safe Forge, autonomous repair, target-owner promotion, rollback or self-extension. Its local credential role supplies no remote IAM or person-level tenancy; an unknown issued inference has no automatic slot-release path. Explicit successor admission remains operator-triggered; automatic task selection, correction and measured recursive improvement remain unbuilt. There is likewise no instantiated distributed repository identity or maintainer roster, executable key-custody/rotation mechanism, governance-epoch ledger, quorum verifier, signed portable promotion envelope, independent attestation plane, canonical source on Radicle, Radicle node topology or downstream-mirror cutover.

Evidence

Remote IAM

State: Designed

Proved now: The inactive host-opaque-candidate@1 Ward foundation and a separately composed closed native-candidate consumer have a dated combined disposable-PostgreSQL observation: 23 tests passed, comprising 18 Ward cases and five current-authority passage cases. Ward exercises the full real bootstrap/HBA and Alembic chain, including 0019↔0020 and restricted-runtime DML/DDL refusals. The native fixture instead creates isolated Ward/Creation tables through metadata DDL; its five passes qualify the declared authority/custody passage, not a second full migration-chain receipt. That passage binds exact retained candidate bytes and plan, an independent attributed assessment and inactive hold/reject decisions; it exercises actual Principal-lock waiting and committed revocation, database-clock expiry after real staging, serialized shutdown, exact retained-identity reconciliation after injected post-commit acknowledgement loss, and refusal of mapper/table/prebound-connection escapes before effects. Three cached PG objects and their anonymous volumes settled; Root separately recorded retained process/cgroup absence and protected warm/model-state preservation. The earlier Ward-only failed-then-passed receipt remains separate historical evidence. The whole old 66-input qualification is sealed history after the container-only correction. Its oracle checks byte continuity for 59 unchanged mechanism inputs and selected dependencies; seven retired configuration/dependency or test-transfer inputs are explicitly historical. It neither requalifies current configuration nor reruns PostgreSQL. The 20 October OCI occurrence passed the same 23 tests in the explicit test image, with actual per-database kernel limits and independently verified container, anonymous-volume and cgroup cleanup. Its dated OCI receipt binds the named configuration, mechanism and test inputs; no model or activation effect was submitted.

Do not expect yet: This isolated trusted-host passage is unregistered in the application. It supplies no installed body/CLI, foreign-constructor execution or containment, remote IAM/device enrollment, production activation, positive OwnerAdmission/promotion, repository write, general owned-content integration, genuine application/database-process restart, shared filesystem/database transaction, exactly-once effect or native/hostile aggregate containment. Reopening a service is not process-restart evidence. Acknowledgement faults are injected after actual commit; no physically broken database connection is proved. Ward's conservative eligible publication audit remains unknown. Remote identity and general activation remain Designed.

The current remote/device trial has no second device, so that physical roundtrip is externally blocked. This does not qualify enrollment or remote IAM, and does not discharge the separate implementation gaps above.

Evidence

A2A and Intercom

State: Designed

Proved now: A2A law defines sovereign asynchronous labor, bounded public-task envelopes, verification, replay, expiry and revocation boundaries, and durable inbox/outbox ownership.

Do not expect yet: There is no envelope, policy, or ledger implementation; peer/key custody, discovery, cryptographic verifier, transport, durable inbox/outbox, callback or artifact fetch, Run/Graph bridge, restart recovery, effect receipt, or interoperability profile.

Evidence

Toll economics and payments

State: Designed

Proved now: Toll law separates local MANA accounting from external payment negotiation and settlement. Toll judges economic terms before Dispatcher binds an eligible capability; neither road requires x402 or a global asset.

Do not expect yet: There is no MANA ledger or issuance path, quote, reservation, authorization, signer, conventional PAYG adapter, payment, settlement, reconciliation, budget enforcement, or safe HTTP 402 response.

Evidence

Legion federation

State: Designed

Proved now: Federation law separates cognitive Master authority from node-local physical authority and rejects shared databases and universal credentials.

Do not expect yet: There is no enrollment, expiring advertisement, reservation, fencing, artifact transfer, durable spool, cancellation, or settlement.

Evidence

VPN Tether

State: Designed

Proved now: VPN law defines Tether as private reachability over WireGuard without application authority, with exact peer and route intent and separate lifecycle ownership. It distinguishes that road from anonymous browsing and provider-visible request content.

Do not expect yet: There is no Tether Domain contract, Rune or provider, generated service, UDP publication, interface or enrollment effect, peer/key custody, live route policy, health, reconciliation, revocation effect, or identity proof.

Evidence

Proxy Veil

State: Designed

Proved now: Proxy law assigns edge proxy and TLS composition to Veil, including explicit plaintext custody at TLS termination. Re-encryption to Core does not remove edge visibility.

Do not expect yet: There is no provider, certificate lifecycle, generated edge policy, Gateway Host manifest or Home/Remote realization, firewall projection, remote ingress hardening, or proof that a proxy substitutes for application authorization.

Evidence

Boundaries still to cross

The missing pieces converge at a few larger boundaries. Their Covenants retain decisions; implementation and named receipts must establish the passage before this ledger can promote it:

  • single-Vessel ownership, hung shutdown, durable process leases, and multi-process event custody;
  • authenticated caller/object authority, effect-time reauthorization, and remote exposure;
  • extension trust, package lifecycle, stable ownership splits, and external-provider containment;
  • durable Creation, memory derivation, privacy, training eligibility, promotion, and rollback; and
  • Linux platform floor, production-browser evidence, and recovery of ambiguous physical effects.

Operator receipt requirements

A receipt names the exact commit, configuration, host and security context, runtime and dependency revisions, hardware/model identity when relevant, commands, expected and observed results, bounded timings, useful work, cancellation, shutdown, recovery, redacted logs, artifact digests, date, operator, verdict, and uncovered boundary. A materially different engine, model, image, driver, hardware topology, or configuration needs its own receipt.

Update law

When behavior or evidence changes, update source, focused verification, the owning topic, and this one delivery record together; downgrade immediately when proof disappears. Do not copy canonical states into README, Prophecy, Lexicon, ADR indexes, or every Composition leaf.

Enter the Work

Perform Summoning to test one bounded local conjunction. Preserve the observations as a named receipt; hope does not promote a delivery state.