{ "identity": { "name": "Omega Protocol", "tagline": "Evidence that an autonomous system did what it was permitted to do.", "founder": "Warren Smith", "honesty": { "no_customers": true, "no_deployments": true, "no_team": true, "statement": "Omega Protocol has no customers, no deployments and no staff. The work is a body of results, public artifacts and reproducible checks. Anything on this site that reads as a track record is a link to something you can run.", "protocol_word": "The name is a name. Omega Protocol is not a published standard and has no adopters. The record format it began with is one project among fourteen." } }, "site": { "proposition": "Autonomous systems should not be trusted because they say they succeeded.", "supporting": "We investigate systems where consequential actions are explicitly authorised, independently observed, mechanically checked where possible, and replayable.", "issue": "2026-08-24", "version": "v1" }, "enums": { "status": [ "COMMITTED_BEFORE_RESULT", "MECHANICALLY_ESTABLISHED", "EMPIRICALLY_OBSERVED", "INFERRED", "UNCOVERED", "CONTESTED", "FALSIFIED", "UNKNOWN" ], "maturity": [ "REPLAYABLE_RESULT", "RESEARCH_PROTOTYPE", "SIMULATION", "PROPOSED", "SPECULATION" ], "subject": [ "LIVE_SYSTEM", "SANDBOX_COPY_OF_REAL_ARTEFACT", "SYNTHETIC_FIXTURE", "MODEL" ], "coverage": [ "covered", "uncovered", "contested" ] }, "derived": { "findings": 13, "reproducible": 13, "proven": 3, "measured": 5, "observed": 5, "results": 3, "flaws": 4, "unknowns": 8, "props": 9, "covered": 4, "uncovered": 4, "contested": 1, "cases": 24, "matched": 24, "prereg": 13, "afterMeasurement": 1, "safetyExpectations": 23 }, "grades": { "PROVEN": "follows from stated premises inside a named frame", "MEASURED": "empirical, with a stated sample and method", "OBSERVED": "witnessed in one instance, no frequency claim", "OPEN": "a question posed and not answered" }, "requirement_status": { "holds": "checked and holds", "refuted": "a counterexample exists", "uncovered": "nothing is checking it", "contested": "deliberately never claimed" }, "pipeline": { "heading": "The operating idea", "lede": "Five steps. Each one exists because skipping it is a way that real systems have already gone wrong.", "stages": [ { "id": "authorise", "n": 1, "name": "Authorise", "plain": "Decide in advance exactly what the system is allowed to do, and write that decision down before it acts.", "why": "If permission is worked out at the moment of action, or inferred afterwards from what happened, there is nothing independent to check the action against.", "evidence": [ "budget-bound-for-all-reachable-states", "concurrent-capability-bound-over-interleavings", "authorized-limit-and-executed-write-disagreed" ] }, { "id": "execute", "n": 2, "name": "Execute", "plain": "The system acts, and the action it takes is the one that was authorised, not merely one that resembles it.", "why": "The gap between the action a policy approved and the action that actually ran is where several of the failures below live.", "evidence": [ "n-1-permit-membership", "tools-hidden-from-discovery-remain-callable" ] }, { "id": "observe", "n": 3, "name": "Observe", "plain": "Measure what actually changed, by looking at the files, records or state afterwards.", "why": "A record of what a system intended reads exactly like a record of what it did, until something measures the difference.", "evidence": [ "monitoring-arm-recorded-preventions-that-executed" ] }, { "id": "verify", "n": 4, "name": "Verify", "plain": "Check the observation against the permission, mechanically, using something that was not part of doing the work.", "why": "Checkers can be wrong, and two checkers that share a source are wrong together.", "evidence": [ "judges-disagree-in-opposite-directions", "judge-agreement-is-partly-forced-by-accuracy", "completed-sample-count-depends-on-scorer-order", "cjson-does-not-round-trip-numbers" ] }, { "id": "replay", "n": 5, "name": "Replay", "plain": "Someone else can re-run the check later, from the record alone, and get the same answer.", "why": "Evidence that only its author can reproduce is testimony. Evidence anyone can re-derive is a different kind of thing.", "evidence": [ "tamper-of-a-sealed-record-forces-a-collision", "training-run-rederives-bit-for-bit" ] } ] }, "findings": [ { "slug": "n-1-permit-membership", "grade": "OBSERVED", "section": "constructible", "theme": "agent-control", "stage": "execute", "mechanism": "coverage-illusion", "plain": "A program passed all 24 of its recorded tests and still accepted a permission record that had never been issued.", "claim": "A start permit assembled entirely from public registry facts, with its reference number derived by the authorizer's own function and committed to no ledger, was accepted by the bounded executor and the registry-named transform was applied; the target's bytes changed.", "doesNotEstablish": "One defect in one program built for this study. Not a measurement of deployed systems, and no claim about how often authorisation records are treated as evidence of authorisation. Not a break-in: producing the forgery requires the ability to run code as the same user, and such an actor can edit the target directly without any record. The minimal fix establishes that a membership check closes this specific defect; it does not establish at-most-once execution, atomic consumption, or independent measurement of the effect.", "repo": "repowazdogz-droid/omega-n1-permit-membership", "verifiedAtCommit": "efba311", "reproduceCommand": "git clone https://github.com/repowazdogz-droid/omega-n1-permit-membership && cd omega-n1-permit-membership && python3 reproduce.py", "sourceUrl": "/findings/n-1-permit-membership/", "flagship": true }, { "slug": "authorized-limit-and-executed-write-disagreed", "grade": "OBSERVED", "section": "constructible", "theme": "agent-control", "stage": "authorise", "mechanism": "faithfulness", "plain": "An agent was limited to 4 KB. It wrote 100 KB. Every test passed, an independent replay verifier said VERIFIED, and a checked invariant held.", "claim": "A write of 100,000 bytes executed under a policy that capped writes at 4,096 bytes, while 66 of 66 tests passed, an independent replay verifier returned VERIFIED, and a checked complete-mediation invariant held.", "doesNotEstablish": "One defect in one server built for this study, not a measurement of deployed systems and not a claim about how often authorization layers and executors diverge. Mediation held throughout; what failed was the binding between the authorized operation and the executed one. Policy adequacy is separately not established, and two counterexamples covering it are retained unfixed.", "repo": "repowazdogz-droid/mcp-authority-boundary", "verifiedAtCommit": "03854ddc", "reproduceCommand": "npm install && ./run.sh", "sourceUrl": "/findings/authorized-limit-and-executed-write-disagreed/", "legacyUrl": "https://www.omegaprotocol.org/findings/authorized-limit-and-executed-write-disagreed/" }, { "slug": "budget-bound-for-all-reachable-states", "grade": "PROVEN", "section": "constructible", "theme": "formal-verification", "stage": "authorise", "mechanism": null, "plain": "A spending cap was proved to hold in every state the system can reach, not just the ones anyone tested.", "claim": "Total spend never exceeds the cap in any reachable state of the escrow protocol, proved in Lean for any finite set of replicas and any non-negative amounts.", "doesNotEstablish": "The bound, not conservation. No liveness, availability, or Byzantine model; crash is global in the Lean model, and per-replica crash is only exercised in the bounded checks. The proof holds relative to the transition system being a faithful abstraction of the protocol, which is argued, not machine-checked.", "repo": "repowazdogz-droid/escrow-budget", "verifiedAtCommit": "9c199db4", "reproduceCommand": "make clean && make check", "sourceUrl": "/findings/budget-bound-for-all-reachable-states/", "legacyUrl": "https://www.omegaprotocol.org/findings/budget-bound-for-all-reachable-states/" }, { "slug": "cjson-does-not-round-trip-numbers", "grade": "OBSERVED", "section": "existing-systems", "theme": "formal-verification", "stage": "verify", "mechanism": null, "plain": "A widely used library reads a number, writes it back out, and the two are not the same.", "claim": "A widely used C JSON library does not preserve numbers across a serialise-and-reparse round trip: its number pipeline is lossy by design, printing with limited precision and comparing re-reads by tolerance rather than equality.", "doesNotEstablish": "That the library is defective for its purpose. A lax parser tuned for triage is a different artifact from one built to be exactly round-tripping; this is that a round-trip theorem is false of the target, not a quality judgement.", "repo": "repowazdogz-droid/vsf-cjson", "verifiedAtCommit": "dcdae40b", "reproduceCommand": "./verify.sh --quick", "sourceUrl": "/findings/cjson-does-not-round-trip-numbers/", "legacyUrl": "https://www.omegaprotocol.org/findings/cjson-does-not-round-trip-numbers/" }, { "slug": "completed-sample-count-depends-on-scorer-order", "grade": "OBSERVED", "section": "existing-systems", "theme": "evaluation-integrity", "stage": "verify", "mechanism": "self-certification", "plain": "The same failing evaluation reported a different number of finished samples when its scoring steps were listed in a different order.", "claim": "In a widely used evaluation framework, the same failing run reported a different number of completed samples depending only on the order its scorers were declared in: 6 of 6 under one ordering and 4 of 6 under the other, with both runs ending in a success status.", "doesNotEstablish": "One defect in one framework, in the metadata a finished run records about itself. It says nothing about the correctness of any model score, nothing about how often the condition arises in practice, and nothing about other evaluation frameworks. The upstream design decision to score errored samples is separate and was not disputed.", "repo": "UKGovernmentBEIS/inspect_ai", "verifiedAtCommit": "f0e57a7c", "reproduceCommand": "pip install inspect_ai && inspect eval repro.py --model mockllm/model", "sourceUrl": "/findings/completed-sample-count-depends-on-scorer-order/", "legacyUrl": "https://www.omegaprotocol.org/findings/completed-sample-count-depends-on-scorer-order/" }, { "slug": "concurrent-capability-bound-over-interleavings", "grade": "PROVEN", "section": "constructible", "theme": "agent-control", "stage": "authorise", "mechanism": null, "plain": "A limit on what an agent may do was proved to hold no matter how concurrent operations interleave.", "claim": "A capability meter never exceeds its cap over every concurrent interleaving of charge operations, proved in Iris concurrent separation logic for any cap and any finite list of operations.", "doesNotEstablish": "It is terminal-observation safety, the value the driver reads is within the cap, not an all-intermediate-state invariant, and it carries no liveness or wait-freedom. The kernel check was not re-run in this pass; axiom-freedom rests on the committed assumptions audit plus a live search finding no admitted goals.", "repo": "repowazdogz-droid/capctl-iris", "verifiedAtCommit": "5e9284a0", "reproduceCommand": "eval $(opam env --switch=capctl-iris) && make verify", "sourceUrl": "/findings/concurrent-capability-bound-over-interleavings/", "legacyUrl": "https://www.omegaprotocol.org/findings/concurrent-capability-bound-over-interleavings/" }, { "slug": "judge-agreement-is-partly-forced-by-accuracy", "grade": "MEASURED", "section": "existing-systems", "theme": "evaluation-integrity", "stage": "verify", "mechanism": "convergence", "plain": "Two AI graders agreeing tells you less than it appears to, because part of that agreement is forced by both being right.", "claim": "Across 600 items and 171 judge pairs, judge errors correlated positively in 171 of 171 pairs at mean phi 0.567, and the correlation between pairwise agreement and accuracy fell from 0.824 to 0.077 once the algebraically forced component of agreement was removed.", "doesNotEstablish": "Not a claim that agreement between judges carries no information, and not a general law about language-model judges. It is a property of these judge checkpoints on these 600 items against a machine-checkable answer key. Ground truth here is a key, not human labelling, and the mechanism behind the second experiment is reported as open rather than settled.", "repo": "repowazdogz-droid/evaltrust", "verifiedAtCommit": "c8196e1a", "reproduceCommand": "python scripts/agreement/build_report.py && python scripts/agreement/sweep_writeup.py", "sourceUrl": "/findings/judge-agreement-is-partly-forced-by-accuracy/", "legacyUrl": "https://www.omegaprotocol.org/findings/judge-agreement-is-partly-forced-by-accuracy/" }, { "slug": "judge-agreement-undetermined-at-n45", "grade": "MEASURED", "section": "existing-systems", "theme": "evaluation-integrity", "stage": "verify", "mechanism": null, "plain": "At the sample size used, the question the experiment was built to answer could not be answered either way, and that is reported rather than rounded to a result.", "claim": "At 45 answers, a judge with zero disagreements has an agreement interval spanning its whole range; the perfect score reads as 'no counterexample found at this sample size', not as demonstrated reliability.", "doesNotEstablish": "That the ensemble judge is reliable. A degenerate interval at the endpoints cannot express uncertainty, and at larger scale even ensemble judges are imperfect.", "repo": "repowazdogz-droid/evaltrust", "verifiedAtCommit": "18e999a5", "reproduceCommand": "python scripts/build_report.py && python scripts/recompute.py && pytest -q", "sourceUrl": "/findings/judge-agreement-undetermined-at-n45/", "legacyUrl": "https://www.omegaprotocol.org/findings/judge-agreement-undetermined-at-n45/" }, { "slug": "judges-disagree-in-opposite-directions", "grade": "MEASURED", "section": "existing-systems", "theme": "evaluation-integrity", "stage": "verify", "mechanism": null, "plain": "Two off-the-shelf AI graders scoring the same work were wrong in opposite directions.", "claim": "Two language-model judges scoring the same 45 GSM8K answers disagreed with the ground truth in opposite directions: one systematically too strict, the other too lenient.", "doesNotEstablish": "That either judge is reliable, or that the direction generalises beyond this corpus. The sample is small; the per-answer correctness labels are assistant-adjudicated, not human; and two of the three judges also generated answers in the set, so self-preference is uncorrected.", "repo": "repowazdogz-droid/evaltrust", "verifiedAtCommit": "18e999a5", "reproduceCommand": "python scripts/build_report.py && python scripts/recompute.py && pytest -q", "sourceUrl": "/findings/judges-disagree-in-opposite-directions/", "legacyUrl": "https://www.omegaprotocol.org/findings/judges-disagree-in-opposite-directions/" }, { "slug": "monitoring-arm-recorded-preventions-that-executed", "grade": "MEASURED", "section": "constructible", "theme": "agent-control", "stage": "observe", "mechanism": "observation-boundary", "plain": "A dashboard reported 1,026 actions prevented. All 1,026 had already executed.", "claim": "Over 10,000 injected events, a monitoring arm recorded 1,026 actions as prevented and all 1,026 executed; an in-series arm consuming the same events, evaluator and policy recorded 6 of 9,880.", "doesNotEstablish": "A property of one synthetic, deterministic testbed under injected faults, not a measurement of any deployed safeguards product and not a rate that transfers outside this harness. The agent environment is deliberately trivial so that what is measured is the pipeline rather than model behaviour.", "repo": "repowazdogz-droid/safeguards-control-plane", "verifiedAtCommit": "08e52549", "reproduceCommand": "./demo.sh && make experiments", "sourceUrl": "/findings/monitoring-arm-recorded-preventions-that-executed/", "legacyUrl": "https://www.omegaprotocol.org/findings/monitoring-arm-recorded-preventions-that-executed/" }, { "slug": "tamper-of-a-sealed-record-forces-a-collision", "grade": "PROVEN", "section": "constructible", "theme": "assurance-architecture", "stage": "replay", "mechanism": null, "plain": "Changing a sealed record after the fact is provably as hard as breaking the hash it is sealed with.", "claim": "Tampering with a sealed, hash-linked decision record forces a hash collision: the canonical encoding is injective, the chain is append-only, and detection follows in Lean without a collision-resistance axiom.", "doesNotEstablish": "That the opaque hash function is SHA-256, that the recorded decision was correct, or that the formal definitions match the prose specification. It is tamper-evidence at the model level, not a claim about any deployed system.", "repo": "repowazdogz-droid/omega-lean-proof", "verifiedAtCommit": "2fab5d1", "reproduceCommand": "git clone https://github.com/repowazdogz-droid/omega-lean-proof && cd omega-lean-proof && lake build && lake env lean probes/AxiomProbe.lean", "sourceUrl": "/findings/tamper-of-a-sealed-record-forces-a-collision/", "legacyUrl": "https://www.omegaprotocol.org/findings/tamper-of-a-sealed-record-forces-a-collision/" }, { "slug": "tools-hidden-from-discovery-remain-callable", "grade": "OBSERVED", "section": "constructible", "theme": "security-engineering", "stage": "execute", "mechanism": "observation-boundary", "plain": "Tools removed from the list an agent is shown were still there to call by name.", "claim": "In a server built to exhibit the bug, tools filtered from the discovery listing remained reachable through the call surface: a presentation-layer authorization control with no execution-layer enforcement behind it.", "doesNotEstablish": "This is a demonstration against an authored mock, not a measurement of real servers. It does not test HTTP transport, prompt injection, or token scope, and a passing result does not mean a server is secure.", "repo": "repowazdogz-droid/mcp-boundary-audit", "verifiedAtCommit": "d932934f", "reproduceCommand": "pip install -e '.[dev]' && cd examples && mcp-boundary-audit --config vulnerable_server.config.json --execute --i-own-this-server", "sourceUrl": "/findings/tools-hidden-from-discovery-remain-callable/", "legacyUrl": "https://www.omegaprotocol.org/findings/tools-hidden-from-discovery-remain-callable/" }, { "slug": "training-run-rederives-bit-for-bit", "grade": "MEASURED", "section": "constructible", "theme": "assurance-architecture", "stage": "replay", "mechanism": null, "plain": "A training run re-derives its exact result from its recorded inputs on one machine. Across different hardware it stays unknown.", "claim": "A training run's final loss and trajectory re-derive bit-for-bit from its recorded inputs on one machine; cross-hardware re-derivation is left as UNKNOWN, and not claimed.", "doesNotEstablish": "Bit-for-bit reproducibility on other hardware, which is untested and reported UNKNOWN rather than upgraded. It does not establish code correctness, buggy-but-faithful code still verifies, nor result quality nor accountability.", "repo": "repowazdogz-droid/nanogpt-provenance", "verifiedAtCommit": "732da8b1", "reproduceCommand": "./run_all.sh", "sourceUrl": "/findings/training-run-rederives-bit-for-bit/", "legacyUrl": "https://www.omegaprotocol.org/findings/training-run-rederives-bit-for-bit/" } ], "narrative": { "_comment": "The Level 1 and Level 2 layers. Level 3 is the record set in corpus.json. Every surface (homepage, case page, share summary, JSON) reads from here; nothing is retyped per page.", "home": { "hook": "An AI system can report that it finished the job. That report is not evidence.", "what_we_do": "Omega Protocol studies how software that acts on its own, moving money or changing files or running infrastructure, can be held to account for what it actually did.", "three_questions": [ { "q": "Before it acted, what was it permitted to do?", "a": "Permission has to be recorded in advance, as a specific thing, not inferred afterwards from what happened." }, { "q": "After it acted, what actually changed?", "a": "Measured from the world, by looking at what the files or records now say, rather than read from the system's own report." }, { "q": "Can anyone other than the system itself check the answer?", "a": "A check that runs inside the thing being checked can be wrong in the same direction as the thing it is checking." } ], "why_it_matters": "Software is being handed decisions with real consequences faster than anyone is building ways to audit those decisions. When something goes wrong, the usual record of what happened is the system's own account of itself.", "what_this_is_not": "This is a research project, not a product. It has no customers and nothing here runs in anyone else's systems. What it has is a small number of results, worked out carefully, with the failures kept in." }, "flagship": { "headline": "A system passed all 24 of its recorded tests and still had a serious flaw.", "memorable": "Passing everything you checked is not the same as checking everything that matters.", "l1": { "what_happened": "A small program was allowed to fix one specific broken file on one machine, but only with permission. Permission took the form of a signed note saying which fix, on which file. The program was tested 24 times and behaved as recorded every time. Then it was given something it had not been given before: a permission note written by hand, without permission ever being asked for. The program accepted it and changed the file.", "why_it_matters": "The note was never checked against the list of permissions that had actually been granted. It only had to look right. Anything that could read a public list of what fixes exist could write itself a valid-looking note, and the program would act on it.", "what_it_shows": [ "The permission note was not proof that permission had been given. It was only proof that someone knew what a permission note looks like.", "Every limit the design named was real, and every one of them was applied at the moment permission was requested. None was applied again at the moment the file was changed.", "The flaw was already in the frozen program. It was found by testing it from outside, without changing a line of it." ], "what_it_does_not_show": [ "It is not a break-in from outside. It needed nothing secret, but it also needed the ability to run code on that machine already.", "It says nothing about someone who can already run programs as the same user. That person can edit the file directly and needs no permission note at all. That was out of scope before this finding and is still out of scope now.", "The repair has never run against the real target. Every successful run of the fixed version was against a copy, because producing a genuine broken file would have meant deliberately breaking a working one." ] }, "why_24_of_24": { "question": "How can a system pass all 24 of its tests and still be broken?", "answer": [ "24 out of 24 means every test behaved the way the test file said it would. It does not mean 24 separate safety requirements were shown to hold.", "One of those 24 is the flaw. The test that caught it records the unsafe behaviour as its expected result, because the expectation was written down after the behaviour was measured. That is why it counts as a pass.", "Only 13 of the case families were written down before any of the code existed. The rest, including this one, were added while attacking the system.", "The plan the tests were checking against was allowed to admit findings like this. It said in advance that any naturally occurring failure should be recorded rather than smoothed over. That is what makes this a finding and not a moved goalpost.", "And underneath the tests, the requirements themselves were only partly covered. Four of the nine things the design was supposed to guarantee had nothing testing them at all." ], "not_the_lesson": [ "The lesson is not that tests are useless. The two weaker forgeries were correctly refused, and it is those refusals that made the third result legible instead of invisible.", "The lesson is not that the 24/24 result was dishonest. It is accurate. It is a count of cases matching expectations, and it was never a count of safety properties." ] }, "l2": { "setup": "The program sits between a detector and a file. The detector notices that a specific configuration file has become malformed. The program is allowed to apply exactly one repair, named in advance, to exactly one file, named in advance. It cannot run shell commands and it cannot take a file path from whoever calls it.", "the_note": "To act, the program needs a start permit: a small record naming the condition, the repair, the target file and a reference number. The reference number is a hash of the rest of the record, so a permit is internally consistent by construction.", "the_gap": "The program checked that the permit was internally consistent. It never checked that the permit existed in the ledger of permits that had actually been issued. Its function signature had no way to reach that ledger, so the question could not be asked.", "the_attack": "Build a permit from public information, compute the reference number the same way the issuer computes it, and hand it over. Three lines. The program validated it, applied the repair and rewrote the file.", "the_fix": "The successor takes a reference number instead of a record. It fetches the permit body out of the ledger itself, so a caller-supplied body is no longer an input to any decision. The forgery is not forbidden, it is unsayable.", "still_open": "The fixed version has run only against copies of the broken file. Whether it survives being killed halfway through has been argued from the order of operations, not demonstrated." }, "two_minute": [ { "h": "What was tested", "p": "A program permitted to make one named repair to one named file, but only when holding a valid permission record. Twenty-four adversarial cases, run against a copy of the real broken file. The real file was untouched throughout and its hash is identical before and after." }, { "h": "What went wrong", "p": "A permission record that had never been issued was accepted, because the program checked only that the record was internally consistent, never that it had actually been granted. The repair ran and the copy's bytes changed." }, { "h": "Why it matters", "p": "Every limit in the design was enforced at the moment permission was requested, and none was re-checked at the moment the file changed. A permission record was treated as proof that permission had been given, when it was only proof that someone knew the format." }, { "h": "What it does not prove", "p": "Not an outside break-in, and no protection is claimed against someone who can already run code as that user. The fix has never run against a live target, and one requirement out of nine is still deliberately unclaimed." }, { "h": "How to check", "p": "The clause-by-clause coverage map, the exact case record with its expected and observed values, the committed ledger in order, and a downloadable manifest are all on this page." } ] }, "glossary": [ { "term": "permit", "plain": "A small record saying which action was approved, on what, and when. Think of it as a signed note rather than a password.", "where": "flagship" }, { "term": "committed", "plain": "Written into an append-only record that cannot be quietly edited afterwards. A permit that was issued is committed; one somebody typed out is not.", "where": "flagship" }, { "term": "property", "plain": "One thing the system is supposed to guarantee, written precisely enough that you could tell whether it had been broken.", "where": "global" }, { "term": "coverage", "plain": "How many of those guarantees actually have something checking them. Low coverage does not mean the system is broken. It means nobody would find out if it were.", "where": "global" }, { "term": "counterexample", "plain": "A specific case that shows a guarantee does not hold. Not an opinion about the design, but a thing that happened.", "where": "global" }, { "term": "preregistered", "plain": "Written down and hashed before the work started, so nobody can quietly adjust what counted as success once the results are in.", "where": "global" }, { "term": "witness", "plain": "Something that measures what actually changed in the world, instead of believing the system's report that it succeeded.", "where": "flagship" }, { "term": "contested", "plain": "A requirement deliberately never claimed. Different from one that simply went unchecked, and drawn differently everywhere on this site.", "where": "global" } ] }, "records": [ { "id": "startauth-01", "kind": "artifact", "title": "STARTAUTH-01", "statement": "A bounded executor that can apply exactly one registry-named pure byte transform to one registry-named file. No shell, no subprocess, no caller-supplied path, no model text.", "status": "MECHANICALLY_ESTABLISHED", "at": "2026-08-23T16:00:36Z", "author": { "type": "human", "name": "research" }, "maturity": "REPLAYABLE_RESULT", "subject": "LIVE_SYSTEM", "bundle": "startauth-01", "git": "d20368b", "freeze": "FREEZE INTACT, 8 pinned files", "supports": [ "c-executor-intent" ], "evidence": [ { "kind": "git", "ref": "commit", "value": "d20368b" }, { "kind": "ledger", "ref": "startauth-01/results/ledger.jsonl", "value": "5 committed records" }, { "kind": "freeze", "ref": "startauth-01/verify_freeze.py", "value": "FREEZE INTACT" } ], "notes": "Earned its status from one real repair of one real defect on the host it runs on." }, { "id": "startauth-sched-01", "kind": "artifact", "title": "STARTAUTH-SCHED-01", "statement": "A scheduled, proposal-only scanner. It runs the frozen detectors and the frozen authorization predicate hourly and unattended, and can produce only a mechanically grounded proposal. It cannot mint a start permit and cannot apply an effect.", "status": "MECHANICALLY_ESTABLISHED", "at": "2026-08-24T08:49:55Z", "author": { "type": "human", "name": "research" }, "maturity": "REPLAYABLE_RESULT", "subject": "LIVE_SYSTEM", "bundle": "startauth-sched-01", "git": "289c100", "freeze": "working tree clean", "supports": [ "c-sched-prereg", "r-sched-battery", "j-sched-auditor" ], "evidence": [ { "kind": "git", "ref": "commit", "value": "289c100" }, { "kind": "schedule", "ref": "launchd", "value": "hourly, RunAtLoad, 3 committed scans, exit 0" }, { "kind": "prereg", "ref": "startauth-sched-01/PREREG_HASH.txt", "value": "0116ad060676fc258a79d0ce2d748e0ffcec01199190d49197d1641c72ee26e5" } ], "notes": "The bundle whose adversarial testing discovered N-1 in its own frozen predecessor." }, { "id": "startauth-v2", "kind": "artifact", "title": "STARTAUTH-V2", "statement": "The successor that repairs N-1. A start permit is no longer a self-consistent assertion; it is a committed, ordered, single-use ledger fact, consumed under one exclusive lock before any byte is written.", "status": "EMPIRICALLY_OBSERVED", "at": "2026-08-24T00:00:00Z", "author": { "type": "human", "name": "research" }, "maturity": "RESEARCH_PROTOTYPE", "subject": "SANDBOX_COPY_OF_REAL_ARTEFACT", "bundle": "startauth-v2", "git": "f135277", "freeze": "V2 FREEZE INTACT, 21 files", "supports": [ "c-v2-prereg", "f-n1" ], "evidence": [ { "kind": "git", "ref": "preregistration commit", "value": "e7ba213 — contains zero .py files" }, { "kind": "git", "ref": "implementation commit", "value": "f135277" }, { "kind": "battery", "ref": "startauth-v2/tests/battery_v2.py", "value": "22 of 22 as declared" }, { "kind": "battery", "ref": "startauth-v2/tests/battery_v1_port.py", "value": "14 of 14, expectations unchanged" }, { "kind": "battery", "ref": "startauth-v2/tests/sched_differential.py", "value": "8 of 8" } ], "notes": "Experimental. No launchd job, no cron, no bridge hook. Every APPLIED result is against a sandbox copy of the real defective bytes — never the live target." }, { "id": "c-executor-intent", "kind": "commitment", "title": "The original intent, as written in the frozen executor", "statement": "Everything it is permitted to do is re-derived from the frozen registry at execution time, so a start permit cannot outlive the authorization that produced it.", "status": "COMMITTED_BEFORE_RESULT", "at": "2026-08-23T16:00:36Z", "author": { "type": "human", "name": "module docstring" }, "supports": [], "evidence": [ { "kind": "source", "ref": "startauth-01/src/execute.py", "value": "module docstring, quoted unmodified" } ], "notes": "A precise and correct statement about staleness. It was read as a statement about existence. It never was one." }, { "id": "c-sched-prereg", "kind": "commitment", "title": "STARTAUTH-SCHED-01 preregistration", "statement": "Thirteen case families (S1-S13) with their required outcomes, frozen and hashed before any scanner, projection or battery code existed — plus an explicit clause admitting any naturally occurring failure, recorded rather than smoothed over.", "status": "COMMITTED_BEFORE_RESULT", "at": "2026-08-24T08:49:55Z", "author": { "type": "human", "name": "research" }, "supports": [ "r-sched-battery" ], "evidence": [ { "kind": "hash", "ref": "PREREGISTRATION.md sha256", "value": "0116ad060676fc258a79d0ce2d748e0ffcec01199190d49197d1641c72ee26e5" }, { "kind": "hash", "ref": "ENVIRONMENT.txt sha256", "value": "76dffc0472a476278c71af459879efc23b7963b3673c2192fe66a18457482ff8" } ], "notes": "The naturally-occurring-failure clause is what makes S18's after-the-fact expectation legitimate rather than a moved goalpost." }, { "id": "c-v2-prereg", "kind": "commitment", "title": "STARTAUTH-V2 preregistration", "statement": "Every expectation of the repair was declared in a git commit containing zero .py files, so it is checkable that the expectations predate the code.", "status": "COMMITTED_BEFORE_RESULT", "at": "2026-08-24T00:00:00Z", "author": { "type": "human", "name": "research" }, "supports": [], "evidence": [ { "kind": "git", "ref": "commit", "value": "e7ba213 — zero .py files; implementation is the separate commit f135277" } ] }, { "id": "C-1", "kind": "property", "clause": 1, "title": "No byte of a target changes without a committed authorization", "statement": "No byte of a target changes without a committed authorization.", "status": "FALSIFIED", "coverage": "uncovered", "deliberate_scope": false, "vv_method": "TEST", "covered_at": "startauth-v2", "counterexample": "o-s18", "at": null, "author": { "type": "design", "name": "authored decomposition" }, "supports": [], "evidence": [ { "kind": "case", "ref": "startauth-sched-01/results/battery.json", "value": "S18" } ], "notes": "This is N-1. The frozen executor's signature carries no ledger path, so commitment was not a question it could ask. Covered at V2 by permit_not_committed." }, { "id": "C-2", "kind": "property", "clause": 2, "title": "At most one effect per permit", "statement": "At most one effect per committed start permit.", "status": "UNCOVERED", "coverage": "uncovered", "deliberate_scope": false, "vv_method": "TEST", "covered_at": "startauth-v2", "counterexample": null, "at": null, "author": { "type": "design", "name": "authored decomposition" }, "supports": [], "evidence": [ { "kind": "case", "ref": "startauth-v2", "value": "case D — permit_already_consumed" } ], "notes": "No consumption record existed at v1, so a valid permit replayed without bound. V2 delivers at-most-once deliberately, not exactly-once: a crash in the window leaves a burned permit and no effect, which is recoverable, rather than a double effect, which is not." }, { "id": "C-3", "kind": "property", "clause": 3, "title": "An effect cannot precede its commitment", "statement": "An effect cannot precede its commitment, and the order is auditable afterwards.", "status": "UNCOVERED", "coverage": "uncovered", "deliberate_scope": false, "vv_method": "ANALYSIS", "covered_at": "startauth-v2", "counterexample": null, "at": null, "author": { "type": "design", "name": "authored decomposition" }, "supports": [], "evidence": [ { "kind": "case", "ref": "startauth-v2", "value": "case E — line(permit) < line(consumed)" } ], "notes": "Enforced at consumption time inside the lock, then re-derived afterwards by an auditor that imports nothing from the implementation." }, { "id": "C-4", "kind": "property", "clause": 4, "title": "The caller's permit body is not a decision input", "statement": "The caller's permit body is not an input to any decision.", "status": "FALSIFIED", "coverage": "uncovered", "deliberate_scope": false, "vv_method": "INSPECTION", "covered_at": "startauth-v2", "counterexample": "o-s18", "at": null, "author": { "type": "design", "name": "authored decomposition" }, "supports": [], "evidence": [ { "kind": "signature", "ref": "startauth-v2/src/execute2.py", "value": "consume_and_execute(start_ref: str, ...)" } ], "notes": "At v1 the caller-supplied body was the only input to the decision. V2 removes it from the trusted set and adds one policy integer, a TTL — a net contraction of the trusted boundary, reported as such rather than as a general strengthening." }, { "id": "C-5", "kind": "property", "clause": 5, "title": "A permit cannot outlive its authorization", "statement": "A permit cannot outlive the authorization that produced it.", "status": "MECHANICALLY_ESTABLISHED", "coverage": "covered", "deliberate_scope": false, "vv_method": "TEST", "covered_at": "startauth-01", "counterexample": null, "at": null, "author": { "type": "design", "name": "authored decomposition" }, "supports": [], "evidence": [ { "kind": "case", "ref": "startauth-01", "value": "case L — registry drift detected" } ], "notes": "The one clause the original docstring genuinely described. True then, true now, and never the clause N-1 needed." }, { "id": "C-6", "kind": "property", "clause": 6, "title": "An out-of-scope action is inexpressible, not merely forbidden", "statement": "An out-of-scope action is inexpressible rather than merely forbidden.", "status": "MECHANICALLY_ESTABLISHED", "coverage": "covered", "deliberate_scope": false, "vv_method": "INSPECTION", "covered_at": "startauth-01", "counterexample": null, "at": null, "author": { "type": "design", "name": "authored decomposition" }, "supports": [], "evidence": [ { "kind": "code", "ref": "startauth-01/src/execute.py", "value": "effect_not_in_closed_table; target_not_authorized" } ], "notes": "Residual: only one transform is in the closed table. Nothing here shows the property generalises to a transform that is not idempotent and not byte-derivable from a backup." }, { "id": "C-7", "kind": "property", "clause": 7, "title": "The executor's claim of success is recorded and never consulted", "statement": "The executor's claim of success is recorded and never consulted.", "status": "MECHANICALLY_ESTABLISHED", "coverage": "covered", "deliberate_scope": false, "vv_method": "TEST", "covered_at": "startauth-01", "counterexample": null, "at": null, "author": { "type": "design", "name": "authored decomposition" }, "supports": [], "evidence": [ { "kind": "case", "ref": "startauth-01", "value": "case G — executor claims success, postcondition false, no permit mints" } ], "notes": "The executor still records 'repair applied successfully'. The postcondition is sabotaged behind its back and no completion permit mints. V2 adds a witness that measures the effect instead of reading the report." }, { "id": "C-8", "kind": "property", "clause": 8, "title": "The world is re-checked at the moment of effect", "statement": "The world is re-checked at the moment of effect, and a vanished condition is a safe no-op.", "status": "MECHANICALLY_ESTABLISHED", "coverage": "covered", "deliberate_scope": false, "vv_method": "TEST", "covered_at": "startauth-01", "counterexample": null, "at": null, "author": { "type": "design", "name": "authored decomposition" }, "supports": [], "evidence": [ { "kind": "case", "ref": "startauth-01", "value": "case F — condition_no_longer_holds" } ], "notes": "Moving the recheck inside the lock in V2 also meant a vanished condition does not burn the permit — a deviation from the preregistered design note, in the safe direction, reported as such rather than quietly enjoyed." }, { "id": "C-9", "kind": "property", "clause": 9, "title": "A permit is unforgeable", "statement": "A permit is unforgeable.", "status": "CONTESTED", "coverage": "contested", "deliberate_scope": true, "vv_method": "NONE", "covered_at": null, "counterexample": null, "at": null, "author": { "type": "design", "name": "authored decomposition" }, "supports": [ "u-a12" ], "evidence": [ { "kind": "residual", "ref": "A12", "value": "explicitly out of scope" } ], "notes": "Never claimed. An actor who can run code as the same user can append a well-formed start_permit to the ledger. V2 does not create an unforgeable token. What the repair changes is the class of the artefact, not its forgeability." }, { "id": "r-sched-battery", "kind": "run", "title": "STARTAUTH-SCHED-01 adversarial battery", "statement": "Twenty-four cases executed against the frozen predecessor and the scheduled scanner. Every case matched its recorded expectation.", "status": "EMPIRICALLY_OBSERVED", "at": "2026-08-24T08:58:00Z", "author": { "type": "test", "name": "startauth-sched-01/tests/battery.py" }, "host_role": "single-host research node (macOS, arm64)", "environment": "python 3.9.6", "subject": "SANDBOX_COPY_OF_REAL_ARTEFACT", "cases_total": 24, "cases_matched": 24, "preregistered_families": 13, "supports": [], "evidence": [ { "kind": "result", "ref": "startauth-sched-01/results/battery.json", "value": "passed 24, total 24" }, { "kind": "hash", "ref": "real target sha256 before", "value": "50ce380792d52cad2cf0fff656c2d079de5a9232d5c16a8d75ca54f74cbc42d1" }, { "kind": "hash", "ref": "real target sha256 after", "value": "50ce380792d52cad2cf0fff656c2d079de5a9232d5c16a8d75ca54f74cbc42d1" } ], "notes": "Thirteen case families were preregistered. S16-S18 were added during adversarial testing and are not in the frozen table; they are admitted by the preregistration's naturally-occurring-failure clause. The live target was never a subject of any case." }, { "id": "o-s16", "kind": "observation", "case": "S16", "title": "Raw scanner proposal fed to the bounded executor", "statement": "The proposal record exactly as the scanner emits it, handed to the executor.", "status": "MECHANICALLY_ESTABLISHED", "expected": "REFUSED", "observed": "REFUSED", "ok": true, "expectation_set": "before", "at": "2026-08-24T08:58:00Z", "author": { "type": "test", "name": "battery.py" }, "supports": [ "r-sched-battery" ], "evidence": [ { "kind": "code", "ref": "refusal", "value": "authorization_drift | bytes_unchanged=True" } ] }, { "id": "o-s17", "kind": "observation", "case": "S17", "title": "Complete forgery with an underivable start_ref", "statement": "Every field a start permit needs, but an arbitrary start_ref.", "status": "MECHANICALLY_ESTABLISHED", "expected": "REFUSED", "observed": "REFUSED", "ok": true, "expectation_set": "before", "at": "2026-08-24T08:58:00Z", "author": { "type": "test", "name": "battery.py" }, "supports": [ "r-sched-battery" ], "evidence": [ { "kind": "code", "ref": "refusal", "value": "authorization_drift | bytes_unchanged=True" } ] }, { "id": "o-s18", "kind": "observation", "case": "S18", "title": "Self-derived start_ref, never committed to any ledger", "statement": "A complete permit body assembled from public facts, with start_ref derived exactly the way the authorizer derives it, committed nowhere. It was accepted and the effect was applied.", "status": "FALSIFIED", "expected": "APPLIED", "observed": "APPLIED", "ok": true, "expectation_set": "after_measurement", "at": "2026-08-24T08:58:00Z", "author": { "type": "test", "name": "battery.py" }, "supports": [ "r-sched-battery", "f-n1" ], "evidence": [ { "kind": "case", "ref": "startauth-sched-01/results/battery.json", "value": "expected APPLIED, observed APPLIED, ok true" }, { "kind": "source", "ref": "startauth-sched-01/tests/battery.py:347-359", "value": "FINDING: a start permit is derivable, not unforgeable; execute() consults no ledger" } ], "notes": "This case row is why 24/24 must never be rendered as twenty-four safety properties. Its ok:true records that the system behaved as the test author had come to expect — and what the author had come to expect was a catastrophic failure." }, { "id": "o-s14", "kind": "observation", "case": "S14", "title": "The live target was untouched across the whole battery", "statement": "The real scheduled-job configuration file was byte-identical before and after every case.", "status": "MECHANICALLY_ESTABLISHED", "expected": "50ce3807…", "observed": "50ce3807…", "ok": true, "expectation_set": "before", "at": "2026-08-24T08:58:00Z", "author": { "type": "test", "name": "battery.py" }, "supports": [ "r-sched-battery" ], "evidence": [ { "kind": "hash", "ref": "sha256", "value": "50ce380792d52cad2cf0fff656c2d079de5a9232d5c16a8d75ca54f74cbc42d1" } ] }, { "id": "o-s15", "kind": "observation", "case": "S15", "title": "The frozen predecessor's freeze held after the battery", "statement": "STARTAUTH-01 reported FREEZE INTACT after the battery that found N-1 inside it.", "status": "MECHANICALLY_ESTABLISHED", "expected": "FREEZE INTACT", "observed": "FREEZE INTACT", "ok": true, "expectation_set": "before", "at": "2026-08-24T08:58:00Z", "author": { "type": "test", "name": "battery.py" }, "supports": [ "r-sched-battery" ], "evidence": [ { "kind": "freeze", "ref": "startauth-01/verify_freeze.py", "value": "FREEZE INTACT" } ], "notes": "The defect was found without modifying the code that contained it." }, { "id": "o-s13b", "kind": "observation", "case": "S13b", "title": "The scanner never imports the only module that writes a target", "statement": "execute is absent from sys.modules after a full scan.", "status": "MECHANICALLY_ESTABLISHED", "expected": "ABSENT", "observed": "ABSENT", "ok": true, "expectation_set": "before", "at": "2026-08-24T08:58:00Z", "author": { "type": "test", "name": "battery.py" }, "supports": [ "r-sched-battery" ], "evidence": [ { "kind": "code", "ref": "sys.modules", "value": "execute absent" } ] }, { "id": "o-s9", "kind": "observation", "case": "S9", "title": "The projection agrees with the frozen authorizer on every branch", "statement": "A ten-case matrix reaching every refusal branch plus the authorizable one, driven through both the non-minting projection and the real authorizer.", "status": "MECHANICALLY_ESTABLISHED", "expected": "IDENTICAL", "observed": "IDENTICAL", "ok": true, "expectation_set": "before", "at": "2026-08-24T08:58:00Z", "author": { "type": "test", "name": "battery.py" }, "supports": [ "r-sched-battery" ], "evidence": [ { "kind": "matrix", "ref": "10 cases", "value": "all codes equal" } ] }, { "id": "o-s12", "kind": "observation", "case": "S12", "title": "The daily proposal bound held under a storm", "statement": "Twelve eligible scans spread over twelve hours produced exactly four proposals, not twelve.", "status": "MECHANICALLY_ESTABLISHED", "expected": "BOUNDED", "observed": "BOUNDED", "ok": true, "expectation_set": "before", "at": "2026-08-24T08:58:00Z", "author": { "type": "test", "name": "battery.py" }, "supports": [ "r-sched-battery" ], "evidence": [ { "kind": "count", "ref": "proposals", "value": "4 of a cap of 4" } ] }, { "id": "j-sched-auditor", "kind": "judgment", "title": "Independent auditor over the committed artefacts", "statement": "Thirteen invariants re-derived from committed artefacts by a checker that imports nothing from the implementation. All hold.", "status": "MECHANICALLY_ESTABLISHED", "at": "2026-08-24T08:58:00Z", "author": { "type": "auditor", "name": "startauth-sched-01/verify.py" }, "invariants_total": 13, "invariants_named": [ "STARTAUTH-01 pins intact", "regime is proposal_only", "no import of the bounded executor", "no import of the minting authorizer", "no authority record kind ever written", "seq == physical line index", "every scan committed a no-effect verdict", "no-effect held on every scan", "every scan recorded before AND after hashes", "no proposal claims authority", "effect ledger holds no sched_* record" ], "supports": [], "evidence": [ { "kind": "result", "ref": "startauth-sched-01/verify.py", "value": "ALL INVARIANTS HOLD (13 checks)" } ], "notes": "Thirteen are reported. Eleven are recoverable by static extraction of the checker's labels; the remaining two are constructed at runtime and are not named here rather than guessed at." }, { "id": "f-n1", "kind": "flaw", "flagship": true, "title": "N-1 — permit membership was not checked at the point of effect", "statement": "A start permit was accepted for being self-consistent rather than for being committed. The executor validated the record and applied the transform; sandbox bytes changed. Start permits were derivable and self-consistent, not evidence that authorization had occurred.", "status": "FALSIFIED", "at": "2026-08-24T08:58:00Z", "author": { "type": "test", "name": "adversarial testing of the successor bundle" }, "discovered_by": "o-s18", "discovered_in": "startauth-01", "found_by": "startauth-sched-01", "affected_properties": [ "C-1", "C-4" ], "mechanism": [ "a complete start permit body was assembled from public facts — the registry, the entry, any target in the frozen list", "start_ref was self-derived, computed exactly the way the authorizer computes it", "the permit had never been committed to the authorization ledger", "validate_start accepted the body as self-consistent", "execute() applied the registry-named transform", "sandbox bytes changed, measured by the test hashing the file before and after" ], "root_cause": "execute() validates a start permit by re-deriving start_ref from the record's own body. Its signature carries no ledger path, so it could not check membership. The rate bound, the dedup bound and the observation binding were all enforced at mint time only, and none was re-asked at the point of effect.", "remained_valid": [ "o-s14", "o-s15", "o-s13b", "o-s9", "o-s12" ], "invalidated": [ "C-1", "C-4" ], "correction": "startauth-v2", "supports": [], "evidence": [ { "kind": "case", "ref": "startauth-sched-01/results/battery.json", "value": "S18" }, { "kind": "source", "ref": "startauth-01/src/execute.py", "value": "def execute(start_rec, reg, evidence_dir, now=None)" }, { "kind": "source", "ref": "startauth-sched-01/tests/battery.py:347-359", "value": "forgery construction and finding" } ] }, { "id": "f-n2", "kind": "flaw", "title": "N-2 — the executor raises instead of refusing", "statement": "An out-of-contract record reaches validate_start and produces a KeyError rather than a named refusal code.", "status": "EMPIRICALLY_OBSERVED", "at": "2026-08-24T08:58:00Z", "author": { "type": "test", "name": "battery.py" }, "discovered_by": null, "discovered_in": "startauth-01", "found_by": "startauth-sched-01", "affected_properties": [], "mechanism": [ "a record missing a derivation field reaches validate_start", "the function raises KeyError", "nothing is applied, so it fails safe" ], "root_cause": "Missing key handling in the refusal path.", "remained_valid": [], "invalidated": [], "correction": "startauth-v2", "supports": [], "evidence": [ { "kind": "case", "ref": "S16", "value": "KeyError, not a refusal code" } ], "notes": "It fails safe. A crash and a refusal are still different things in a ledger, which is why it is recorded as a flaw rather than waved through." }, { "id": "f-n3", "kind": "flaw", "title": "N-3 — blocked from a live eligible-condition demonstration", "statement": "The eligible branch has never been exercised against a live target, because manufacturing a live eligible condition would mean deliberately corrupting a real scheduled-job configuration.", "status": "UNKNOWN", "at": "2026-08-24T08:58:00Z", "author": { "type": "human", "name": "research" }, "discovered_by": null, "discovered_in": "startauth-01", "found_by": "startauth-sched-01", "affected_properties": [], "mechanism": [ "the action was refused by policy", "it was not worked around" ], "root_cause": "Obtaining the evidence would require causing the fault it is meant to repair.", "remained_valid": [], "invalidated": [], "correction": null, "supports": [ "u-no-live-demo" ], "evidence": [ { "kind": "scope", "ref": "policy refusal", "value": "not worked around" } ], "notes": "Recorded as a flaw in the evidence, not in the system. Every APPLIED result in the corpus is against a sandbox copy of the real defective bytes." }, { "id": "f-n4", "kind": "flaw", "title": "N-4 — a latent defect in frozen code, found and not fixed", "statement": "The ledger transaction double-counts a ledger whose final line lacks a trailing newline: it adds one for the partial line and one again when it repairs it.", "status": "EMPIRICALLY_OBSERVED", "at": "2026-08-24T00:00:00Z", "author": { "type": "human", "name": "research" }, "discovered_by": null, "discovered_in": "startauth-01", "found_by": "startauth-v2", "affected_properties": [], "mechanism": [ "three records on disk", "next_seq() returns 4", "the next append lands at line 3 declaring seq 4", "the seq == line index invariant is permanently broken" ], "root_cause": "Double increment in the transaction's entry path when repairing a torn write.", "remained_valid": [], "invalidated": [], "correction": null, "supports": [ "u-n4-residual" ], "evidence": [ { "kind": "measurement", "ref": "3 records on disk", "value": "next_seq() returns 4" } ], "notes": "It is in frozen code, so it was not edited. The successor detects it inside the lock and refuses with zero writes. Reachable only after a torn write; recorded so it is not rediscovered as a mystery." }, { "id": "u-a12", "kind": "unknown", "residual": "A12", "title": "A hostile actor running as the same user", "statement": "An actor who can run code as this user edits the target directly and needs no permit at all; equally, they can append a well-formed start permit to the ledger. The successor does not create an unforgeable token.", "status": "CONTESTED", "at": null, "author": { "type": "human", "name": "research" }, "why": "Explicitly out of scope. Not weakened or strengthened by the repair.", "supports": [], "evidence": [ { "kind": "scope", "ref": "A12", "value": "unchanged by the repair" } ] }, { "id": "u-crash-window", "kind": "unknown", "residual": "CRASH-WINDOW", "title": "At-most-once is argued, not demonstrated", "statement": "No process has been killed between the consumption commit and the write. The ordering argument is sound and untested.", "status": "UNKNOWN", "at": null, "author": { "type": "human", "name": "research" }, "why": "It is the cheapest remaining test and it has not been run. A scheduled consumer runs unattended, which is exactly the regime where a killed process matters.", "supports": [], "evidence": [] }, { "id": "u-lock", "kind": "unknown", "residual": "A-LOCK", "title": "The file lock is advisory", "statement": "Every writer must use the ledger transaction. That is convention, not enforcement.", "status": "INFERRED", "at": null, "author": { "type": "human", "name": "research" }, "why": "A writer that ignores the lock defeats the at-most-once guarantee. The auditor detects the resulting sequence disagreement after the fact; it does not prevent it.", "supports": [], "evidence": [] }, { "id": "u-clock", "kind": "unknown", "residual": "A-CLOCK", "title": "Freshness depends on the system clock", "statement": "A moved clock moves the time-to-live window.", "status": "UNKNOWN", "at": null, "author": { "type": "human", "name": "research" }, "why": "Carried as an assumption in the trusted base, named there rather than tested.", "supports": [], "evidence": [] }, { "id": "u-fs", "kind": "unknown", "residual": "A-FS", "title": "Filesystem atomicity and durability are assumed", "statement": "Atomic replace and durable flush are assumed, not tested.", "status": "UNKNOWN", "at": null, "author": { "type": "human", "name": "research" }, "why": "A crash must leave the original intact. That property rests on the platform and is carried as an assumption.", "supports": [], "evidence": [] }, { "id": "u-no-live-demo", "kind": "unknown", "residual": "NO-LIVE-DEMO", "title": "No live eligible-condition demonstration", "statement": "The successor has never executed anything outside a sandbox.", "status": "UNKNOWN", "at": null, "author": { "type": "human", "name": "research" }, "why": "Manufacturing a live eligible condition means deliberately corrupting a real scheduled job. Not done, not worked around.", "supports": [], "evidence": [] }, { "id": "u-n4-residual", "kind": "unknown", "residual": "N-4", "title": "A latent defect left unrepaired by design", "statement": "The sequence double-count in the frozen ledger transaction is measured, understood and deliberately not fixed.", "status": "EMPIRICALLY_OBSERVED", "at": null, "author": { "type": "human", "name": "research" }, "why": "Editing it would break the freeze that makes the predecessor citable evidence. The successor refuses on detecting it instead.", "supports": [], "evidence": [] }, { "id": "u-one-transform", "kind": "unknown", "residual": "ONE-TRANSFORM", "title": "One transform is in the closed table", "statement": "Nothing establishes that the property generalises to a transform that is not idempotent and not byte-derivable from a backup.", "status": "UNKNOWN", "at": null, "author": { "type": "human", "name": "research" }, "why": "The bound is real and it is narrow. The narrowness is the finding, not a caveat on it.", "supports": [], "evidence": [] }, { "id": "corr-unknowns-count", "kind": "correction", "title": "Open-unknowns count corrected from 7 to 8", "statement": "The first build of this site reported seven open unknowns. Direct enumeration of the successor handoff's residual section returns eight.", "status": "EMPIRICALLY_OBSERVED", "at": "2026-08-24T10:00:00Z", "author": { "type": "human", "name": "design" }, "field": "open_unknowns", "from": "7", "to": "8", "reason": "The figure was written from recollection instead of counted. The count is now derived from the records at build time, so authoring it is no longer possible.", "published_externally": false, "committed_at": "3806629", "supports": [], "evidence": [ { "kind": "git", "ref": "commit", "value": "3806629 — the build that carried the wrong figure" } ], "notes": "Preserved rather than silently amended. The earlier value was committed locally but never published, which is recorded here so the distinction is not lost." } ] }