Conversation
…ore its work The fourth review found two P0s in `2a6f838`, both reproduced before anything changed. They are the same shape: something that looked like authority was a statement by the party it was meant to constrain. An approval's `predicate_id` was compared as a string, and the facts required of it came from the same policy that named it. A policy could therefore configure `review` and require `git_recorded`. Reproduced: a failing verification, an actor-written registry pointing the command at a script that passes, an actor-written approval, committed, accepted — NOT_CONVERGED to CONVERGED. `predicates.py` now holds a closed table where each predicate owns its fact requirement and `required_mutation_facts` may only add to it. An unimplemented predicate is never satisfied. `signature` is implemented rather than merely named: Git verifies the commit that last wrote the observed paths, against the repository's keyring or allowed-signers file. It replaces `git_reviewed` as the documented default, which no provider could ever establish. `WorkController.create()` still established a project's policy, root, registry and rules, so every N to N+1 protection could be sidestepped by choosing a different N. Project trust is now bootstrapped first and pins the genesis root; a work no anchor pins is unevaluable, a foreign root is refused, and re-bootstrap is refused. `root_history()` listed revision directories, so a revision promoted by a write that never reached its manifest replace read as historical authority. The committed chain now lives in the manifest, which is the commit marker. Reverting the three fixes in place makes all seven new blocking cases fail while the three controls keep passing — checked, not asserted. Affects: predicates, bootstrap, controller genesis and root chain, evaluator trust gate, provenance signatures, authorization, trust transitions, CLI. Does not affect: the runner, freshness, traceability, substance, isolation. Larger than the 400-LOC budget at ~490. Splitting it would require an intermediate commit whose tests do not pass, which this branch has shipped twice and will not ship again. Cases: A94 (3), A95 (6), A96 (3) in tests/test_workplane_authority_origin.py
…implemented ADR-0004 records the two decisions and what was rejected: a predicate is a closed mechanism rather than an identifier, and project trust is bootstrapped before any work contract exists. It also states what the anchor deliberately does not pin — the policy, because every change to it since bootstrap passed the mutation bar, which is stricter than a frozen digest — and why it pins the genesis root rather than the current one, which would make rotation impossible without a second genesis. ARCHITECTURE.md said `git_reviewed` was the portable default while `observe()` could never establish it. The supported default is `signature`, and the section now carries the predicate table and the bootstrap state machine. The threat model gains the two round-4 threats with their residual risk. The DoD gains four gate lines and drops the claim that A54-A93 is the full matrix. Two residual risks are stated for the first time rather than discovered by the next reviewer: under `recorded_owner_ack`, at either level, an actor with commit rights is the whole bar; and `scripts/workplane_pilot.py` calls the pure `converge()` kernel rather than `evaluate_work`, so it exercises neither the trust anchor nor the mutation bar. AGENTS.md scope figures re-measured: the core stack is 142 files and ~252k tokens, the whole repo ~381k. The previous numbers were inside tolerance and drifting, which is how that block became wrong the first time. Verdict unchanged: P0 not claimable, P1 not claimable, PRODUCTION NO-GO, MERGE spec -> main NO-GO.
The fifth review found two P0s in `2f0420b`, both reproduced first, and both at the boundary of a round-4 fix rather than in something it missed. Project trust authenticated the root a work used, and stopped there. A controlled actor could create a sibling work under the project's legitimate pinned root, choose a trivial requirement, a trivial criterion and an easy verification, and converge. Root and policy both legitimate; nobody authoritative had agreed what that work must accomplish. Revision 1 states the whole of the bar, so it is a success condition exactly as later revisions are. A `work_creation_approval` now binds the anchor and the exact genesis normative digest, and the evaluator recomputes that digest from revision 1 rather than reading a field. `signature` proved that Git accepted a signature. It never asked whose. A repository may accept several signing identities, and being allowed to sign ordinary commits is not being allowed to approve a policy change. The anchor now pins authorized_signers by key fingerprint, and Git's answer decides validity while the anchor decides authorization. That pinning is circular on its own, and this round's own test caught it: an actor that rewrites the anchor to add its key is measured against the list it just wrote. The cut is that the anchor must have exactly one commit in its history — which also turns "a governed project never re-bootstraps silently" from an API refusal into a structural property, since refusing to overwrite never stopped a direct write to the path. Two P1s: `git log -1 -- a b` reports the most recent commit touching either, so one signed commit made a whole path set look signed; the identity is now resolved per path. And the chain still terminated at any predecessor-less root, making transition_approval optional exactly where it decides something; it now terminates only at the pinned genesis, with the controller refusing a root change that names no predecessor. Reverting the four fixes makes eleven blocking cases fail while every control keeps passing. Affects: bootstrap, provenance, controller creation and root connectivity, evaluator, trust chain termination, contracts, CLI. Does not affect: the runner, freshness, traceability, substance, isolation, convergence kernel. Cases: A97 (5), A98 (4), A99 (3), A100 (4)
ADR-0005 records four decisions and what was rejected: creating a work contract proposes while admission promotes it; a signature predicate answers validity and authorization separately, and only the first is Git's; the anchor is written exactly once, because pinning signers inside a mutable anchor is circular; and a chain terminates at the pinned genesis rather than at any predecessor-less root. The circularity is worth reading rather than skipping. An actor that rewrites the anchor to add its own fingerprint would be measured against the list it just wrote. That was not a hypothesis — it is what A98 caught in this round's own correction, on the first run. The one-commit rule cuts it, and turns ADR-0004's "a governed project never re-bootstraps silently" from an API refusal into a structural property, since refusing to overwrite never stopped a direct write to the path. The threat model gains five round-5 threats. The DoD gains four gate lines and carries the matrix to A100. ARCHITECTURE.md documents admission, the two questions the signature predicate asks, and conjunctive path provenance. One round-4 residual risk is now closed and said so; three new ones are stated rather than left for the next reviewer — chiefly that a lost signing key means a new anchor, not an edit. AGENTS.md scope re-measured: 145 files and ~267k tokens for the core stack, ~396k for the whole repo. Verdict unchanged: P0 not claimable, P1 not claimable, PRODUCTION NO-GO, MERGE spec -> main NO-GO.
Running the round-5 qualification found two defects in the harness itself. The per-gate budget was 120 seconds, sized to a suite that no longer exists: every authority case now spawns an ssh-keygen and several commits, and the V2 suite takes about three minutes. The gate timed out. The timeout was the smaller problem. TimeoutExpired escaped uncaught, main() never ran, and the previous report file stayed on disk reading `passed: true` at an older commit — a stale pass presented as evidence about a newer one, which is precisely what that file exists not to be. A gate that cannot finish is now a failed gate carrying its refusal, and the budget is 1800s with a note saying to look at why rather than raise it again. Also pins the round-5 packet to 92875e5 and CI run 33790454070, and regenerates claude-code.json at that commit.
Two structural findings from the sixth review, both reproduced first. The chain walk required every root in the walk — including historical predecessors — to carry the *current* policy commitment. ADR-0004 said the anchor deliberately does not pin the policy because policy evolves through authorized mutation; the implementation made that unreachable, because an evolved project could never validate its own genesis. Worse in principle: had it worked, history would have been judged by today's rules, so a later and weaker policy could retroactively authorize a transition it never saw. The manifest now records a committed policy chain beside the root chain. Only the current root must carry the current policy commitment; every earlier root must carry one the project actually committed; and a transition into a root is judged under that root's predecessor's policy — its predicate and its required facts. P0 authorized P1 and P1 authorized P2, not "the newest policy authorizes everything". A consequence worth disagreeing with: because the current root must carry the current policy commitment, changing the policy rotates the root in the same mutation. That is not a workaround — a root of trust names the policy it was established under, so a policy change is a new root generation, and the transition approval issued under the predecessor's policy authorizes both. Separately, WorkController loaded the project anchor without establishing that it was still valid, so the sole normative writer could accept a mutation under an anchor the evaluator would reject a moment later. One verified_anchor() is now called by the writer and by the judge, so the two cannot drift. Reverting both fixes makes four blocking cases fail while the controls keep passing. Affects: controller policy chain and anchor verification, trust chain walk, evaluator, bootstrap, manifest schema, CLI labelling. Does not affect: the runner, freshness, traceability, substance, isolation, convergence kernel, evidence origin. Cases: A101 (2, a boundary), A102 (3), A103 (3)
…antee The sixth review's P0 is not a defect in the code. It is a claim the documentation was making that the code cannot support, and the correction is to stop making it. A root of trust cannot prove its own legitimacy from data whose authority comes from that root. Round 5's one-commit rule proves the anchor was not edited afterwards; it cannot prove anyone outside the actor chose it. On an uninitialized repository a controlled actor can generate a key, configure Git to verify it, authorize its own fingerprint, sign the anchor and converge — every check passing truthfully. The test fixture is exactly that protocol. ADR-0006 takes Option A of the review: establishing the first anchor is a privileged ceremony inside the trusted computing base, its legitimacy is an assumption, and the deployment requirement is that trusted bootstrap precedes controlled-agent access. `ainative trust bootstrap` says so in its help and labels its output `authority: privileged_trust_establishment`. Option B — an external machine-verifiable root — is the only mechanical answer and is deliberately not built; the ADR records why rather than leaving it implied. One sentence from rounds 4 and 5 is corrected rather than quietly dropped: "under `signature` an actor without the key cannot produce a valid anchor" is true only after a trusted anchor exists. Before that, the actor makes the key. A101 asserts the boundary rather than a defence, and must fail if an external trust source is ever added. That is its purpose. The threat model gains a dedicated bootstrap-boundary table plus the two round-6 threats. The DoD carries the matrix to A103 and marks BOOTSTRAP_TRUST as out of scope by declaration rather than closed. AGENTS.md scope re-measured: 147 files, ~277k tokens for the core stack. Verdict unchanged: P0 not claimable, P1 not claimable, PRODUCTION NO-GO.
…l to its base Three findings from the seventh review — the first to report P0 = 0 for the authority layer — all reproduced first. ADR-0006 asserted that a policy change rotates the root in the same mutation, and the controller did not enforce it. A policy-only mutation committed cleanly, leaving a revision where the current policy and the current root disagree: a state the evaluator can never treat as authority. A sole normative writer that knowingly writes an impossible state is not being one. One rule does it — a root must carry the commitment of the policy it is written with. My first draft added a second "a policy change must rotate the root" branch; it was unreachable, because carrying a new policy commitment already changes the root's own commitment and a changed root already requires a predecessor and a transition approval. Removing dead reassurance is the honest result. The chain walker received one facts object — an observation of the current authority — and used it for every historical transition, asking "does today's authority satisfy the historical predicate" instead of "did this transition have the property when it was authorized". The manifest, which is the commit marker, now records the commit that carried each rotation's approval and that approval's digest. The evaluator re-establishes facts from that commit, which is immutable, so the same question of the same object gets the same answer every time; a transition with no bound evidence is invalid rather than inheriting whatever is true now. A mutation approval named the state being reached and not the state being left, so an old one replayed to undo a later strengthening. It now binds base_digest. The first version of that case proved nothing: the intermediate strengthening returned to exactly the revision-1 state, which makes the replay legitimate — identical state, genuinely approved transition. It was rebuilt with a distinct third state before it demonstrated anything. Removing the three fixes makes five blocking cases fail while the four controls keep passing. Affects: controller policy/root atomicity and transition evidence, manifest root_chain authority, trust chain walk, evaluator, provenance commit observation, mutation_approval schema. Does not affect: the runner, freshness, traceability, substance, isolation, convergence kernel, evidence origin, bootstrap. Cases: A104 (4), A105 (3), A106 (2)
ADR-0007 records three decisions and what was rejected. Putting transition evidence inside the root artifact was rejected: the root is written by the caller, evidence about a transition is not the caller's statement about itself, and the successor commitment covers the transition approval, so it is circular. The manifest carries it instead, because the manifest is the commit marker. It also settles the review's P2 rather than leaving it ambiguous: a mutation_approval is transition-scoped, naming both ends of the change; a work_creation_approval stays content-addressed, because genesis has no base and two works with byte-identical contracts sit at the same bar. What to add if that is ever wrong is written down. Two residual risks are stated rather than left for the next reviewer: a historical transition's facts are re-established from an immutable commit but against the signer set the anchor pins today, so removing a signer invalidates that identity's earlier transitions; and the same creation approval may admit more than one work carrying identical contracts. The DoD records that this review reported P0 = 0 for the first time, and that its findings were consistency and history-of-proof invariants rather than new ways to manufacture CONVERGED. AGENTS.md scope re-measured: 148 files, ~286k tokens for the core stack. Verdict unchanged: PRODUCTION NO-GO, MERGE spec -> main NO-GO. Two empirical gates remain open and one targeted authority review is still owed.
The eighth review found that round 7 recorded a transition's approval digest and never checked it. Reproduced: replacing the recorded digest with a fabricated one left the verdict CONVERGED, because reconstruction consumed only the commit. A commit signature says something was signed; it does not say what. The manifest's chain entry now records the approval's repo-relative path alongside the commit and the digest, and the evaluator reads the object back out of that commit with `git show <commit>:<path>`, canonicalizes it, and requires the digest to match before deriving any provenance facts. The working tree is deliberately not consulted: what is on disk today proves nothing about what was approved then. Any step failing leaves the transition unbound, and an unbound transition was already invalid. Removing the fix makes three blocking cases fail while the two controls keep passing. Affects: the manifest root_chain authority entry, transition reconstruction. Does not affect: anything else. Cases: A107 (5)
…ion I left alone ADR-0007 section 2 now records what the first version got wrong and why: the binding was to a commit rather than to the approval that commit was supposed to contain, and the fix reads the object back out of the commit instead of trusting the working tree. One observation is written down rather than acted on. A broken root chain surfaces as ROOT_OF_TRUST_INVALID inside the reasons an individual run was ruled ineligible for, not as a standalone gap, so the verdict is NOT_CONVERGED where INVALID would classify it better. It never produces a false CONVERGED. The eighth review asked for a narrow round, so it is reported for the reviewer to weigh rather than changed unilaterally. AGENTS.md scope re-measured: 149 files, ~291k tokens for the core stack.
Two P0s from the ninth review, both reproduced first, both closed by one change. Commands ran before authority was proved. A work no project trust anchor governed still executed its registry command, and the refusal arrived afterwards — reproduced with a command that writes a sentinel file: the verdict was INVALID and the file existed. The verdict was fail-closed; the execution boundary was not. And the complete root-chain walk lived inside the per-evidence check, so a contract satisfied entirely by human approval never walked it: no evidence, no _assess, and the kernel was handed TrustVerdict(True, "AUTHORITY_PRESENT") whenever the policy, root and registry merely existed. A false-convergence path. evaluate_authority_trust() now holds everything decidable about authority without an evidence run, and evaluate_work establishes it before a single runner process starts. Unevaluable authority returns INVALID having executed nothing. evaluate_trust keeps only the evidence-specific checks and takes the established verdict, so the chain is walked once per evaluation rather than once per run. This also closes the observation the round-8 packet reported and left alone: a broken chain is now a standalone ROOT_OF_TRUST_INVALID gap, so INVALID with exit code 2 rather than a reason buried in one run's ineligibility. Leaving it was right — the same change fixes it properly. Two existing cases had to be corrected. Both relied on the evidence check running first and masking a more fundamental authority failure; neither was wrong about the property it names. The fixture gained separate `required` and `required_evidence` so a case can ask about evidence provenance without also making the work unevaluable. Reverting the change makes seven blocking cases fail while both controls keep passing. Affects: the evaluator's order of operations, trust's split into authority and evidence, the fixture's fact requirements. Does not affect: the controller, bootstrap, provenance, contracts, runner. Cases: A108 (4), A109 (2), A110 (3)
…ot cover ADR-0008 records the split between authority trust and evidence trust, why the preflight gates execution rather than only the verdict, and the precedence change it introduced — an authority that cannot be established is now reported instead of, not alongside, an evidence-level reason. It also states what is out of scope and why: `run_verification` still runs one declared command on request without the preflight. It produces evidence rather than a verdict, and the evaluator never reads recorded evidence, but it is a production entry point executing a registry-chosen command. Widening the gate is a decision for a reviewer, not one to take quietly here. ARCHITECTURE.md gains the ordering guarantee and the precedence rule. The threat model gains the two round-9 threats. The DoD carries the matrix to A110 and replaces the round-8 classification note, now closed, with the `run_verification` scope note. AGENTS.md scope re-measured: 151 files, ~298k tokens for the core stack.
…ecutes The tenth review found the surface the round-9 packet had flagged and left alone. `ainative verify` loaded the authority files and ran the command they named without the preflight — and exited 0 doing it. Reproduced for an ungoverned work, a broken root chain and an unadmitted work alike: converge refused and executed nothing, verify executed and returned success. That the recorded evidence is never consumed by a verdict is beside the point. A command was selected by authority nobody had established, and it ran. This is an execution-authority question, not an evidence-reuse one. establish_authority() is now the single production boundary: committed state, the verified anchor, project governance, the initial admission, policy, root, the complete chain, historical policies, each transition's own evidence and the authority provenance — and it starts no process. Both evaluate_work and run_verification refuse unless it holds. The established context is passed to an internal _run_established, so the chain is walked once per evaluation rather than once per specification. There is no public parameter that skips the gate, and A111 asserts run_verification accepts exactly three arguments. `ainative debug run-command` stays ungated on purpose: everything it evaluates comes from the caller, and it labels its own output `authority: none`. A production surface is gated; an explicitly caller-controlled one is not authority at all. Reverting the gate makes five blocking cases fail while the control keeps passing. Affects: the evaluator's production entry points and their shared boundary. Does not affect: the controller, bootstrap, provenance, contracts, trust, runner, convergence kernel. Cases: A111 (5), A112 (1, covering all three surfaces)
ADR-0008 gains an amendment rather than a new record, because it is the same decision finished: the scoping note in it was the right thing to report and the wrong place to stop. ARCHITECTURE.md now carries the surface table — converge and verify gated, `debug run-command` deliberately not, with the reason. The threat model gains the second-execution-surface threat. The DoD carries the matrix to A112. One item is recorded rather than acted on, at the review's suggestion: _valid_root_chain still measures each historical root's required_mutation_facts against the current authority observation, while each transition is measured against its own bound evidence. No false-success reproducer is known, and widening a round that was meant to be narrow is how the last two findings got their scope wrong in the first place. AGENTS.md scope re-measured: 152 files, ~303k tokens for the core stack.
An external closure review of 2fb2154 reports P0 authority = 0 and P1 authority = 0, and declares the authority hardening gate closed. It verified CI run 33819616022 at that head independently, accepted A108-A112, and looked for an adjacent path able to execute a production command, manufacture CONVERGED, bypass human-only validation, self-authorize a mutation, replay an approval, replace a root without predecessor authorization, borrow current provenance, or substitute working-tree contents for historical approval evidence. It found none. Thirty gate lines move from "awaiting external review" to "closed by external review". The figure is written down because a third party wrote it first — ten rounds of not claiming it is what makes it mean anything, and the record of those rounds stays in this file for exactly that reason. The architecture is frozen. Reopening it should require a concrete empirical reproducer or a newly adopted threat-model requirement; a change that cannot name a failing case is a speculative pass. The residual P2 is recorded as what it is: current authority facts applied to some historical root-level required_mutation_facts, where the risk if any is a false refusal rather than a false success. Two gates remain, and the DoD now says plainly that they are the whole of what stands between this branch and a production decision — that neither can be closed by writing more code, and neither by the author alone. The closure review also adds a requirement the current pilot harness does not meet: the pilot must exercise the authoritative production surfaces, while scripts/workplane_pilot.py still calls the pure convergence kernel. PRODUCTION = NO-GO. MERGE spec -> main = NO-GO.
The closure review added a requirement the old harness did not meet: the pilot must exercise the authoritative production surfaces. The old one called the pure converge() kernel with a hand-built trust verdict and a hand-built freshness result, created a non-normative artifact instead of a contract, ran the runner with a hand-built binding, and reported CONVERGED five times. It measured nothing about authority and could not have failed. The replacement is an instrument, not a source of work. It measures governed work someone else did, and it is built to have three properties the old one lacked. No authority is injected. Every verdict comes from evaluate_work(). The module imports no converge, evaluate_trust, evaluate_freshness, TrustVerdict, FreshnessResult, VerificationEvidence or VerificationRunner, and the tests assert that by parsing its imports — a comment saying so is not a guarantee. Measured and declared are separated. Whether a verdict was correct is not observable from inside: it needs someone who knows what the work was supposed to do. The plan declares the expected verdict and the friction; the instrument measures verdict, gaps, runs, durations, contract revisions, the approvals the work actually needed, contract integrity and repository state. A field the instrument cannot establish is never quietly filled in. And it refuses to call itself pilot evidence unless the plan meets the protocol: the five kinds, at least two distinct harnesses, nothing synthetic, no measurement error, and a declared expectation per item so a false verdict is detectable. The refusals are part of the record, so the gate cannot be closed by running the script with a convenient plan. `--self-check` measures one governed work built on the spot and labels the result pilot_evidence: false, listing why. CI and the qualification harness now call that mode. The authority freeze held: this touches no controller, trust, authorization, evaluator, contracts, bootstrap, provenance or convergence code. The rewrite found no authority bug, so it fixed none. No plan has been run. The five real items and the second harness are not the instrument's to invent. Affects: scripts/workplane_pilot.py, its tests, CI and qualification wiring, PILOT_REPORT and the DoD's pilot gate. Does not affect: the engine.
EMP-002, found by the H01 historical gate. build_verification_evidence stamped started_at and finished_at with two separate datetime.now() calls at record-build time, so every run in every audit trail described a window of microseconds however long it took. H01 froze a 5 524 ms run whose recorded window was 35 us. The runner already measures duration correctly with a monotonic clock; it simply never passed the wall-clock start. It does now, and the field degrades to the record time when a caller does not supply one rather than inventing a window. Nothing reads these fields to reach a verdict, so no verdict changes. The defect was in the audit trail, which is the part a human reads. Affects: evidence record metadata, runner. Does not affect: authority, trust, freshness, convergence, any verdict path.
H01 reached a real verdict on its third run. The first two were blocked by a missing crate, which the checks refused loudly rather than reporting green over nothing. The frozen result discriminates: two hostile scenarios rejected with the messages ADR-0001 promises, a control accepted, and one scenario accepted that should not have been. Classification waits on the organiser's reveal. Also records EMP-002, the audit-trail defect the case surfaced in the plane itself.
…e through
Five real, independently verified changes, each implemented under the Verified
Work Plane and measured through evaluate_work():
feature ainative work admit -- the documented flow had no surface for the
middle step and dead-ended at UNADMITTED_WORK EMP-003
feature full verification output kept beside the run record EMP-007
bugfix malformed input refused instead of stack-traced EMP-004
refactor traceability.analyze 71 LOC / ~32 branches -> 16 / 1 EMP-009
hotfix the five subcommands that shipped with no help EMP-005
Also fixed on the way: EMP-008, a latent NameError that would have crashed any
evaluation whose verification timed out, and the missing build/ and egg-info
ignores.
check_complexity_budget.py now runs in CI. AGENTS.md has declared >25 blocking
since the beginning; nothing measured it, which is how 32 shipped.
Pilot: 5/5 CONVERGED, two real harnesses (Claude Code, OpenCode/MiniMax-M3),
0 false CONVERGED, 0 false NOT_CONVERGED, no contract or repository corruption.
README, 790 lines, never mentioned the Verified Work Plane or ainative at all -- the branch's whole deliverable was absent from the project's front door. The pilot report keeps the friction in: nine manual interventions, a harness that crashed on every edit, a dispatch that did nothing, an operator mistake of mine, and a latent NameError the existing suite could not catch. A pilot that reported only the happy path would measure nothing.
H01 DETECTED, H02 DETECTED, H03 INDIRECTLY_EXPOSED. Zero false CONVERGED. H02 and H03 were sealed mechanically, selection performed by a separate harness in a separate context, so blindness is checkable rather than attested. H03 is classified strictly. The contract did not name the sealed defect; it put a finding thirteen lines from it, in the same function, on the same class of fault. That is exposure, not detection. The ticket also carried a no-memory-leak requirement I wrote no specification for at all -- the defect was representable and the contract failed to represent it. The engine was right throughout. One repository was discarded as BLINDNESS_COMPROMISED before use: staging printed its commit log, which named fix commits.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements the Verified Work Plane V2 kernel and the H0–H13 production hardening plan on
spec: 45 commits, 52 files, +4858 lines.What this is
A deterministic work-contract engine. One controller writes normative state, a constrained runner observes registered verification, and convergence is decided from evidence bound to a contract revision, a specification, a repository snapshot, a command registry, a policy and an approval root. Narrative artifacts and language models propose; nothing here lets them decide a verdict.
Gate state
Nine engine gates are closed, each held by an executed test rather than by prose: architecture, contracts, controller, evidence, trust, freshness, verification, traceability, convergence. The A01–A53 adversarial matrix runs as one suite.
docs/VERIFIED-WORK-PLANE-V2-DOD.mdmaps every gate to what holds it.Three gates are open and are stated as open in that document:
workplane-v2job execute for the first time. Everything so far was verified locally, on Windows, on one Python.external_harness: false; a direct API against a CLI facade is not two AI harnesses.Per section 62 of the plan the delivery decision is therefore NO-GO, which is the plan's verdict for this state, not a judgement about the code.
Defects the adversarial matrix found
Writing the matrix surfaced three real defects, none of them visible by reading:
stream.read(8192)blocks until the buffer is full, so the output bound never fired for a command emitting less than 8 KB and then continuing to run.OpenProcesswas called without ctypes signatures, truncating the 64-bit handle, so a live process could read as dead — which would have let the controller reclaim a lock still held by its owner.Review note
This exceeds the 400-line PR budget in
AGENTS.md. It is a long-running branch with one commit per hardening phase; the history is meant to be read commit by commit. Say the word and I will split it into sequential PRs along the phase boundaries.