Current state, honestly
What runs, what is qualified, and what does not run yet
Reported per the system’s own discipline, from the repository. This page supersedes any more optimistic reading of the rest of this site — and any more pessimistic one, since the repository has repeatedly outrun earlier drafts of the paper.
Enacted and enforcing
The substrate governs itself
The founding decision landed under its own machinery
DEC-0001 landed by signed merge under its own ratification machinery. Subsequent decisions activated the rule set and corrected the coverage meters when operation revealed a single meter doing two jobs — DEC-0004 split the coverage and drift meters and added a lifecycle retirement edge, retiring sixteen closed-story acceptance specifications.
Proposed, ratified, deprecated, and superseded populations have all been exercised. The lifecycle is not a diagram — every edge has run.
The build gate is live and emits public evidence
A conformance workflow runs the control suite on every change; a red suite blocks merge; the evidence rows are uploaded publicly, so a reader can check the claim rather than trust the badge.
Evidence rows are committed, not left in an expiring CI artifact. They are records — true-at-T and never regenerable — so a row that lives only in an ignored directory is provenance with a countdown timer.
The declared riskiest hop
Walked through its current acceptance set
The build order walks the riskiest hop early by design. This is acceptance-test evidence, scoped to the tested set — not a claim that the attack surface is closed.
The spawn contract — the supervised, interruptible agent-session interface — ran its acceptance set to green: a CLI-session agent in a hardened, credential-less citizen container, in bidirectional streaming mode under harness control. Proven portable across two model providers by changing two arguments.
Spawn gate refuses unresolvable spawns
acceptance-test pass
Container isolation and act-level attribution verified
acceptance-test pass
Network egress pinned and enforced on the exercised paths
acceptance-test pass
Supervision demonstrated as interrupt-in-flight, mid-session injection, and clean termination
observed instances — not exhaustive proof of interruptibility under all states
Credential minting confined to the harness; citizen image verified unable to mint on the tested paths
adversarial test
Chain verifier control green; its rogue fixture set caught two verifier defects on the way
adversarial test
The standing query for rules without passing evidence moved from 22 to 8 across this work — a session-reported standing query, and one you can re-run yourself.
Declared, not silent
Four postures are stated rather than hidden — and an outside reader found what that made findable
Posture 1 — reconciliation lag
Posture 2 — the spawn gate requires a resolvable story, not a ratified one
SPEC-0122.Posture 3 — what the spawn gate reads during that lag window is an open question
Posture 1 says the window exists. This is the sharper form a round-3 reviewer raised and none of the ten prior reviewer passes had named: inside that window, does the spawn gate resolve lifecycle state live, or from the last reconciliation? A spawn inside the window is the fixture that answers it.
It is accepted and routed with its probe fixture. The candidate answers are live in-memory reconciliation at gate time, or the window declared as a posture with a stated bound. It is listed here while it is still a question.
Posture 4 — revocation is teardown, and there is no on-wire token revocation
For a spawned agent, revocation is harness teardown within the container’s lifetime. There is no on-wire credential revocation — by design, as a consequence of the no-standing-service architecture: the same choice that removes a governance service to fail open also removes the service that would field a revocation call.
The honest posture names supervised teardown and short container lifetimes as the compensating controls. Revocation-propagation latency already sits in the declared-work list for the identity layer; this is its concrete form.
The two postures compose — and that was the finding
An agent authored a story revision’s content. Authorship and authorization are separate fields by design, and the atom’s force remains the human floor’s to grant — but agent authorship was not yet bounded by any mandate check, a gap named in the corpus as SPEC-0123 rather than left for a reviewer to find.
An external reviewer then found what the declarations made findable: an agent could author a weakening of its own in-flight acceptance criteria, and the gate would grade against the weakened set — reintroducing the closed loop inside the governance plane itself.
The mitigation is ruled and time-boxed. The grading gate pins each story’s acceptance baseline to the last floor-touched instance; the spawn act pins the initial set and explicit floor touch moves it thereafter; agent revisions are recorded but move nothing until touched; a lint flags every non-floor acceptance edit without attempting to classify weakening. The posture retires when mandate-bounded authorship goes live. Chartered as STORY-0014–0016, with the composition posture reserved as SPEC-0128.
It is reported as evidence rather than confession. The attack was findable only because both postures were declared — external, resolvable disclosure recruited the adversary into the security analysis, which is the thesis operating on the project’s own governance.
Ahead of the front
What does not run yet
These are named, not hidden. They are the difference between testable and tested, and the distinction is one the paper insists on about itself.
The full chain-level run (C1)
The semantic retrieval instrument
Consult-and-render services
Three limitations, declared rather than discovered
- The governance tax is real. Structure front-loads cost at authoring time, and mechanisms that raise the cost of every change create pressure to route around them. The bet is that supervision’s costs compound while structure’s amortize — and the bet is measurable, not assumable.
- Cold start is real. The plane assumes governed atoms exist, and legacy estates hold neither atoms nor structured intent. The anticipated path is enrollment, not migration — identity assigned to legacy artifacts as-is, on touch, never by bulk rewrite.
- Operational costs are unquantified pre-C1. Provenance storage and walk latency, gate latency in fast agent loops, and evidence telemetry volume are open engineering quantities. Because the plane measures its own overhead as a side effect of operating, the quantification is part of the first chain run’s output.
The commitment
Cost and friction results publish with the same prominence as defect and stability results
Four falsifiable hypotheses carry stated measurement bases, and the refutation criteria are handed over in full in §8 and §9 of the whitepaper. The hypotheses can come out false, and negative evidence would be visible: gates that pass defective artifacts leave records that later defects trace to through provenance; standing queries can report nonzero.
After the paper, the deliverable is the measurement, not the feature list.