Skip to main content

46  Artifact Graphs, Audit Logs, and Replay

46.1 Chapter status

Field	Value
Chapter ID	artifact-graphs-audit-logs-and-replay
Part	Part II - Planning, Memory, Reasoning, and Execution
Status	conceptual
Manuscript maturity	v0.3 claim-proof program
Last updated	2026-08-02
Primary source records	eighteen reviewed mappings: seven architecture/runtime sources, three provenance/metadata/attestation comparators, five historical projects, and three additional harness/recovery/faithfulness comparators
Claim label	Design rationale
Evidence level	argument
Source queue	primary: talos, viea; supporting and historical: sixteen additional assigned comparators and project lineages
Source loading state	source notes: talos, deterministic_capability_compilation, platonic_world_model, viea, cognitive_compilation, spinoza_composer, genesiscode, cognitive_loop_closure, moecot, ext_w3c_prov_o_2013, ext_mlcommons_croissant_1_1_2026, ext_in_toto_2019, cca_project, moecot_manifest_project, bugbrain_project, corbens_trainer_project, corbens_best_model_possible_project, ext_claw_swe_bench_2026, ext_txfs_2018, ext_faithfulness_information_flow_2026, ext_swe_rebench_v2_2026, regret_engine, ext_openclaw_agent_runtime_2026; raw cache: talos, viea, cognitive_compilation, spinoza_composer, genesiscode, cognitive_loop_closure; connector/recovery: moecot
Test state	AsiStackProofs.ArtifactRealityRefinement exposes twenty-one theorems over arbitrary finite runs: exact thirteen-field identity custody, rejected-event noninterference, batch composition, absorbing admission, and zero support/effect authority. python3 scripts/validate_artifact_reality_refinement.py recompiles that exact surface and independently recomputes eight suites: artifact replay 2/6, record reality 1/4, receipt faithfulness 3/6, repository audit 4/5, repository challenge 4/5, live attestation 1/7, randomized attestation 4/8, and epistemic TCB 3/6; it rejects 53/53 mutations across thirty-three routes and seven stages. Fifty-six theorems remain live across ArtifactRealityRefinement and ArtifactGraph: twenty-one refinement theorems and thirty-five retained consequences; eight weak summaries or projections were retired. No open-world provenance, deployed replay/revocation/attestation, independent reproduction, or support-state claim follows.

46.2 Drafting guardrail

Artifacts are provenance-bearing work products, not automatic evidence. All eighteen assigned mappings have been reviewed at their exact local-cache, source-note, or primary-paper-note scope. The repository exercises authored schemas and fixtures, selected current and historical repository observations, service-status records, and fifty-six finite Lean theorems under ten public targets. Twenty-one theorems define the reachable refinement and its countermodels; thirty-five narrower legacy consequences remain; eight copied fixture summaries or one-step projections were retired. It has not run a deployed artifact graph, complete event capture, open-world provenance observer, transitive-revocation service, replay engine, privacy/deletion closure, or natural multi-repository comparison.

This layer owns durable artifact identity, derivation, record-reality custody, replay grade, and impact closure. It does not own job lifecycle, source admission, permission, effect execution, mode-specific verification validity, evidence acceptance, support, learning, replacement, readiness, or release. Every current result is therefore bounded to its recorded bytes, routes, fixtures, services, time, and non-claims; no support state changes here.

After typed jobs, the stack needs a memory surface for work itself. The artifact graph records what a job produced, where it came from, which claims or tests it touches, and which parts can be replayed before the architecture allows those outputs to become evidence, context, or procedural substrate.

The key distinction is between storage and evidential continuity. A file path says where bytes live. An artifact node says what role those bytes played, which job created them, which sources and tools shaped them, what can be reconstructed, and what remains uncertain. The living book should preserve that distinction because later chapters depend on it: compressed artifacts, semantic nodes, benchmark records, reader editions, and prototype reports all become safer when they inherit an explicit artifact history instead of a loose folder convention.

46.3 Human Reading Path

Concrete lens. The hash-only baseline calls matching bytes reproduced. The graph records tool and environment lineage and preserves the missing dependency.

Typed jobs become trustworthy when their outputs remain traceable after action. Artifact graphs make those outputs durable: artifacts, logs, traces, receipts, replay records, source links, context links, and claim or test links. Without that graph, work disappears into conversation history.

The reason to care is accountability. If an AI system edits a file, writes a proof, summarizes a source, or runs a check, the next reviewer should be able to trace what happened. Replay does not make the work true, but it makes the work inspectable and reusable within declared limits. The artifact graph turns memory from a pile of outputs into an accountable work history.

Durability matters because future trust depends on recoverable context, not memory of confidence. A good artifact makes its own review path easier by preserving why it deserved attention, which checks touched it, and which limits still apply across revisions and later handoffs. Durable traces let future work inherit evidence without inheriting confusion; without that inheritance rule, audit becomes a story told after the fact.

46.4 Problem

Durable artifacts and replayable traces make work inspectable, reusable, testable, and improvable.

Typed jobs produce outputs. Those outputs must become artifacts with stable identities, provenance, audit events, replay metadata, claim/test links, and known replay limits. Otherwise every result is an isolated file or chat answer with no reliable path back to its causes.

Talos treats evidence, logs, and replay as execution primitives. GenesisCode adds effect logs, semantic patches, provenance hashes, and obligation artifacts. Cognitive Loop Closure uses repeated artifact traces as the substrate for future tools.

This is not only a software-engineering hygiene issue. It is an alignment boundary. A system that can alter documents, invoke tools, route tasks, summarize sources, or rewrite its own procedures must leave inspectable work products behind. Without artifact continuity, review becomes forensic guesswork and self-improvement becomes memory without accountability.

Within the governed-cognition pattern, the artifact-graph layer owns the record-reality delta. The common record shape is not enough: the artifact graph asks whether a receipt corresponds to a work product, whether replay has a declared grade, where verifier trust bottoms out, and what residual remains outside the trusted path. Other layers may emit receipts; the artifact-graph layer defines how those receipts become inspectable artifacts rather than self-reported confidence.

46.5 Why existing approaches are insufficient

If outputs are not tied to inputs, tools, context, claims, and logs, later verification and improvement cannot know what happened.

Untraceable output cannot support promoted claims. Non-replayable workflows cannot be debugged or improved. Provenance gaps make it impossible to tell whether an artifact came from a source, a tool, a model guess, a human edit, or a stale context packet.

External agent and software-evaluation baselines show what provenance must survive. ReAct (ext_react_2022) interleaves reasoning, action, and observation; AutoGen (ext_autogen_2023) composes conversational agents, tools, humans, and LLMs; SWE-bench (ext_swe_bench_2023) evaluates repository-scale issue resolution; proof-carrying code (ext_proof_carrying_code_1997) binds executable artifacts to checkable evidence. Artifact graphs route those pressures into traceable inputs, tools, logs, claims, and replay handles without claiming any benchmark or proof-carrying artifact has been reproduced.

The artifact graph is the system’s memory of work. It does not guarantee truth, but it makes verification possible by preserving what happened.

Ordinary repositories, chat transcripts, and build directories only partially solve this. They preserve fragments, but they usually do not encode claim relevance, source scope, replay limits, or promotion blockers as first-class fields. The artifact graph is the layer that makes those fragments usable by evidence ledgers, regression suites, and future agents without requiring every reader to infer the workflow from prose.

46.6 Core Claim

[artifact-graphs-audit-logs-and-replay.core, label: Design rationale, support: argument] Execution should produce an artifact graph with audit logs, provenance, replay metadata, and links to claims and tests.

Reader claim. An artifact is trustworthy only to the extent that its exact parents, inputs, tools, context, tests, observations, and unresolved differences can be followed and challenged.

Operational rule. Bind every produced artifact to its parent job, source and context versions, transaction, compiler, tool, claim, test, audit, environment, and replay grade. Replay creates a new observation; it never overwrites the original or turns matching bytes into proof of causal completeness.

46.6.1 Worked replay: matching output, different tool lineage

A chapter PDF is rebuilt from the same source digest and happens to match the earlier output bytes. The replay used a different renderer build and lacked the original font-cache receipt. A hash-only audit calls the artifact reproduced. The graph instead links both outputs to their distinct tool and environment nodes, records the byte equality, and marks causal replay incomplete until the missing dependency is resolved or explicitly residualized.

If a later reader challenges a claim tied to the figure, the graph can identify which source, renderer, test, and observation supported each edition without rewriting history. Receipt-faithfulness and repository-challenge fixtures exercise this record boundary, but they trust the recorded events and dependencies. The example shows why replay needs lineage and grade; it does not establish that the graph is complete, the receipts are true, the tool is deterministic, or the artifact is correct.

The claim remains at argument support. Talos supplies execution evidence and replay pressure; VIEA supplies artifact and feedback ledgers; Cognitive Compilation supplies build-graph and repair-locality pressure; Spinoza Composer supplies state/history preservation patterns; GenesisCode supplies effect logs, provenance hashes, and obligations; Cognitive Loop Closure explains why traces become procedural memory. Those six mappings now point to reviewed local raw-cache passages. MoECOT remains implementation-reference context until its runtime artifacts, ledgers, logs, or benchmark records are imported and inspected.

46.6.2 Claim-source mapping status

Appendix C maps this artifact-graph claim to all assigned source records. Six original mappings carry passage-reviewed local raw-cache references, the complete authenticated MoECOT connector text is passage-reviewed, and five historical-project mappings are reviewed from public-safe source notes as one related implementation lineage. The mappings support provenance-bearing artifacts, audit logs, projection/revocation duties, replay metadata, trace preservation, and improvement-substrate discipline—not a completed replay engine, transitive revocation service, or artifact graph deployment.

Source	What it supports	Review state	Limit
talos	Thirty-tab lineage for typed jobs, asynchronous delivery, evidence records, audit logs, replay, source allow-listing, blind handles, tests, residuals, regression coverage, forgotten-failure prevention, and the Ouroboros tension between semantic log compression/deletion and replay, investigation, appeal, and descendant invalidation.	Passage-reviewed local raw cache; repeated variants count once.	No Talos artifact graph, audit reconstruction, retention/deletion mechanism, replay run, benchmark, or security result has been reproduced here.
viea	Artifact graphs for claims, requirements, critiques, releases, feedback, tools, benchmarks, residuals, verification ledgers, runtime execution, and feedback loops.	Passage-reviewed local raw cache.	No completed VIEA deployment, runtime trace, artifact graph service, or benchmark result exists here.
cognitive_compilation	Build-graph traceability through source plans, typed semantic IR, dependencies, validation requirements, scheduling, target lowering, localized repair, and compiler-style metrics.	Passage-reviewed local raw cache.	No working compiler, trace suite, repair-locality benchmark, or empirical ablation exists here.
spinoza_composer	Ten-tab lineage: append-only evidence and rebuildable views, draft/active canon, modality and quotation custody, dependency-directed poison recovery, section/scene contracts, causal/presentation time, validator disagreement, Element Packs and continuity observations, partial delivery, audit bundles, disclosures, baselines, and cost/evaluation plans.	Complete section-family review using bounded-coherence v3.0 as the controlling claim surface.	No implementation, extraction/canon/validator/continuity/style result, benchmark, cost, security, deployment, support, or ASI claim is established.
genesiscode	Canonical CoreForm identity; content-addressed packages/evidence; ordered effect transcripts; semantic patch operations; patch precondition, impact-closure, revalidation, provenance, inverse/compensation, and self-weakening boundaries; and the requirement that replay retain response bytes or durable refs rather than hashes alone.	Full three-tab section-family audit.	No kernel, canonicalizer, response store, package/evidence invalidation engine, semantic patch checker, dependency-impact analysis, rollback, deterministic replay, or proof artifact exists here.
cognitive_loop_closure	Execution traces as procedural-memory substrate through logging, loop detection, tool cards, verification, registries, monitoring, lifecycle states, and retirement discipline.	Passage-reviewed local raw cache.	No local loop detector, trace miner, synthesized tool, or verification harness has been executed.
moecot	Runtime-reference ledgers, replay, handoff, readiness gates, benchmark artifacts, promotion blockers, and residual tracking.	Authenticated connector text passage-reviewed.	Runtime artifacts, ledgers, logs, and benchmark records have not been imported, inspected, or reproduced here.
ext_w3c_prov_o_2013	Interoperable asserted provenance vocabulary for entities, activities, agents, derivation, attribution, delegation, revision, and invalidation.	Complete source-note review.	Vocabulary does not establish provenance truth, completeness, integrity, authority, receipt faithfulness, or safety; no local conformance run exists.
ext_mlcommons_croissant_1_1_2026	Current dataset-metadata vocabulary for resources, checksums, record fields, provenance, usage conditions, and ML-tool portability.	Complete source-note review.	Metadata does not establish lineage completeness, fitness, legality, representativeness, safe use, or derivative revocation; no local Croissant record exists.
ext_in_toto_2019	Signed layouts, authorized functionary links, material/product matching, role separation, thresholds, consumer verification, compromise analysis, and last-mile dependencies.	Complete primary-paper-note review.	Signed authorized steps do not establish artifact correctness, complete layout coverage, uncompromised actors, confidentiality, model safety, or release merit; no local in-toto run exists.
ext_claw_swe_bench_2026	Binds coding-agent results to model, harness, workspace, patch extraction, evaluator, runtime budget, and cost.	Primary-preprint-note review.	No reported task, score, harness, cost, contamination control, or safety result was reproduced here.
ext_txfs_2018	Distinguishes declared restoration from filesystem transactions, isolation, conflicts, crash consistency, durability, and capacity bounds.	Primary-paper-note review.	TxFS was not reproduced; local restoration does not establish ACID filesystems, process/service recovery, or external-effect atomicity.
ext_faithfulness_information_flow_2026	Separates plausible reasoning from causal reliance through sufficiency, completeness, and interventional necessity.	Primary-paper passage review.	Model- and task-bounded metrics do not make reasoning traces receipts or prove local record-reality faithfulness.
Five-project local lineage	CCA, MoECOT Manifest, BugBrain, Corben’s Trainer, and Corben’s Best Model Possible expose canonical/projection drift, stale promotions after quarantine, playback described as replay, unacknowledged async completion, and absolute-path artifact identities.	Public-safe source-note review.	One local lineage, not independent replication; runtime revocation, replay, portability, and durability were not reproduced by the book.

46.7 Mechanism

The artifact graph is execution memory. A typed job may finish, fail, or be retired, but the stack still needs to know what was produced, which source/context/tool path produced it, which claims and tests it touches, and whether any part of the path can be replayed. Talos gives the audit/replay pressure, VIEA gives the artifact-and-feedback ledger, GenesisCode gives provenance hashes and effect logs, Cognitive Compilation gives build-graph traceability, and Cognitive Loop Closure explains why repeated traces become future tools.

An Artifact Graph Record is the durable node at that boundary. It is not a claim that the artifact is true. It is the minimum evidence surface that lets verification, memory, replay, and procedural learning reason about the artifact without relying on chat history.

The complete mechanism has eighteen steps:

1. Freeze an admission envelope with stable artifact and revision identity, type, role, producer, parent job and attempt, consumers, consequence, authority, rights, retention, expiry, and owner before reuse.
2. Compute content digests and, when policy affects identity, compound content-and-policy identities; paths, URLs, object keys, cache slots, and display names remain mutable locations or projections.
3. Bind the revision to the source, dataset, contract, plan, job, attempt, context transaction, semantic certificate, model, prompt, tool, adapter, code, environment, policy, approval, permission, cost, and residual that actually applied.
4. Record append-only or superseding creation, read, write, transformation, observation, verification, challenge, delivery, reuse, quarantine, revocation, deletion, export, and retirement events with actor and clock boundaries.
5. Observe bytes, effects, command results, service responses, and side records through independently challengeable routes rather than producer-authored receipts alone.
6. Version derivations, revisions, merges, splits, semantic patches, alternate derivations, supersession, and invalidation without erasing prior bytes, decisions, failures, or disagreement.
7. Separate canonical artifacts and events from caches, indexes, summaries, dashboards, claim views, promotion labels, releases, and public pages; bind every projection to source digest, policy, refresh state, and authority.
8. Maintain forward and reverse dependency indexes across artifacts, claims, tests, decisions, procedures, models, releases, and public surfaces.
9. Propagate quarantine, revocation, expiry, rights change, deletion duty, and corruption through every reachable dependent unless a valid current-policy alternate derivation preserves that descendant.
10. Grade replay as retained-output playback, deterministic re-execution, semantic replay, partial re-execution, non-replayable, failed, or not attempted, without upgrading grades by vocabulary.
11. Package replay with pinned inputs, code, models, tools, environment, dependencies, seeds, services, irreversible-effect limits, evaluator, expected comparison, observed divergence, and retained failures.
12. Reconcile asynchronous work through durable terminal receipts that bind actual artifacts to accepted, running, failed, cancelled, compensated, delivered, and evidence-ready states.
13. Link artifacts to exact claim atoms, proof obligations, tests, benchmarks, decisions, consumers, and support ceilings while leaving support movement to Evidence States and Claim Ledgers.
14. Challenge receipt faithfulness through independent byte, object, command, service, and downstream observations, trap receipts, mutations, sampled audits, and explicit attestation limits.
15. Declare the minimal epistemic trusted computing base, roots, verifier versions, delegation bounds, recursion stop, compromise response, and outside-TCB residuals.
16. Carry privacy, confidentiality, licensing, consent, deletion, legal-hold, redaction, disclosure, retention, and derivative obligations through lineage and revocation.
17. Expose impact queries for every affected artifact, claim, test, procedure, model, release, public statement, owner, unresolved descendant, alternate derivation, and remediation after change.
18. Compare folders, version control, workflow histories, provenance ontologies, dataset metadata, signed attestations, lineage catalogs, and the governed graph under matched natural work, faults, adversaries, costs, and delayed consequences.

flowchart LR
  A["Typed job"] -- "produces bounded work" --> B["Artifact node"]
  B -- "cites source lineage" --> C["Source refs"]
  B -- "names context use" --> D["Context refs"]
  D -- "materialized by" --> E["Context transaction refs"]
  E -- "bounded by" --> F["Semantic certificate refs"]
  B -- "records effect path" --> G["Tool / adapter refs"]
  B -- "preserves events" --> H["Audit events"]
  B -- "declares replay state" --> I["Replay metadata + grade"]
  B -- "links obligations" --> J["Claim + test links"]
  H -- "feeds review" --> K["Evidence gate"]
  I -- "limits reuse" --> K
  J -- "checks impact" --> K

Reading the artifact graph: The artifact node is the hub where work product history becomes reviewable: sources, context transactions, certificates, tools, audit events, replay metadata, claims, and tests all converge there. The evidence gate limits reuse based on what the artifact record can actually support.

The artifact record attaches identity to work product history. It links parent job, sources, context, context transactions, semantic certificates, tools, claims, tests, audit events, replay metadata, replay grade, environment assumptions, provenance status, replay limits, evidence gate, residuals, and non-claims in one node. Incomplete provenance remains visible as a residual, while verified traces and failed traces both become useful: one can support future regression coverage, and the other can prevent repeated failure.

Artifacts should have stable IDs and versioned revisions. Audit logs should be append-only or versioned. Replay metadata should declare what can be replayed, what cannot, and which environment assumptions matter.

Replay should be graded rather than binary. Some artifacts can be reconstructed byte for byte from recorded inputs and deterministic tools. Some can be replayed semantically, where the same obligations are checked even if nondeterministic text differs. Some can only be partially replayed because an external service, source snapshot, human decision, context transaction, or environment state is missing. Some have not been replayed at all. A replay record names that grade and exposes the residual instead of treating partial replay as success.

46.7.1 The decision-to-regret artifact chain

The Regret Engine source (regret_engine) adds two linked artifact families. The pre-action Decision Capsule commits information, objective and authority versions, available alternatives, forecasts, uncertainty, resources, checks, and exact runtime identities. The later Regret Packet links actual outcome evidence, admitted and rejected comparators, counterfactual models, intervals, attribution, learning eligibility, recovery, repairs, appeal state, and retirement back to that immutable capsule.

These records fit the event graph as typed transitions such as capsule creation, outcome observation, comparator adjudication, estimate production, recovery, repair proposal, update lease, promotion, rollback, supersession, redaction, and appeal. Large traces can remain content-addressed while the canonical graph retains hashes, producer identities, schema versions, access rules, and replay handles. The actor may contribute a reflection but cannot silently relabel it as independent adjudication.

Append-only history does not mean permanent unrestricted payload retention. A lawful deletion can cryptographically erase protected content while leaving a tombstone that narrows reproducibility and invalidates affected conclusions or derived artifacts. The source defines this contract but does not establish record completeness, receipt faithfulness, privacy compliance, or successful unlearning.

46.7.2 Semantic patches are governed artifact transactions

GenesisCode’s strongest change-management idea is to ask an AI for a structural patch rather than an unrestricted text rewrite. Structure alone is not enough, however. A production Semantic Patch Record binds source artifact and version, stable semantic anchor, expected old content or precondition, operation, intent and non-goals, authority, dependency and consumer impact, predicted obligation set, target identity, actual mutation set, validator and evidence refs, provenance, conflicts, inverse or compensation, and residuals.

Raw AST positions are brittle: canonical formatting, a neighboring edit, refactor, module move, or concurrent patch can redirect the same path. Stable semantic IDs or content-addressed anchors need ambiguity detection and compare-and-swap preconditions. A patch that changes a dependency, effect, public interface, proof assumption, capability, or evidence policy triggers affected-descendant closure and revalidation. Incremental checking is safe only when that closure is itself tested; uncertainty routes to the full gate.

Obligation changes require special authority. An ordinary behavior patch must not make itself acceptable by deleting a failing test, weakening a capability policy, changing the verifier, narrowing the benchmark, or replacing an exact postcondition with a looser one. Such changes become separate policy patches with independent review, explicit semantic debt, and downstream invalidation. The AI-proposal identity remains provenance, not correctness evidence.

Effect-log custody follows the same transaction rule. A response hash without the response bytes or a durable immutable reference supports integrity checking only, not deterministic replay. Redaction or deletion may be correct for privacy or rights, but it spends replay authority and must downgrade affected artifacts and descendants instead of leaving the old replay label in place.

The context-to-artifact handoff is now explicit: an artifact should not merely say that it used context. It should name the context transaction that materialized the view and the semantic certificates that bounded any derived cells. That lets later evidence, compression, and procedural-memory layers tell whether a work product inherited a valid representation boundary or only a loose source citation.

The graph is also an improvement substrate. Repeated traces can become procedural memory. Failed traces can become residuals. Verified artifacts can become regression coverage.

46.7.3 Preserve provenance, route relevance

Durability creates its own failure mode: if every scratch decomposition, alternative, and intermediate output remains equally active, the graph becomes an expensive and hazardous memory dump. VIEA’s answer is to separate storage custody from context admission. Core artifacts such as commands, claims, requirements, decisions, releases, tools, and feedback are retained until an owned retirement decision. Support artifacts may be summarized and archived. Transient artifacts expire or compress unless a content-bound link connects them to a core artifact, decision, residual, tool, or release. Deprecated and archived artifacts remain available for lineage but are excluded from default routing.

Retention does not authorize retrieval. An active-context selector filters by the current command, artifact type, dependency distance, freshness, support state, specialist scope, runtime target, permission envelope, and residual relevance. Its receipt records both included and materially excluded nodes so later reviewers can distinguish a deliberate bounded view from missing history. A concise invariant governs the choice: preserve provenance, but route relevance. This is not a deletion guarantee, relevance oracle, or privacy proof; it is the interface that lets retention, privacy, context adequacy, and resource cost be reviewed separately.

46.7.4 Compression and deletion spend replay authority

Talos’s proposed Ouroboros loop exposes a conflict that every living system eventually meets: raw traces are expensive and privacy-sensitive, while replay, incident investigation, appeal, and descendant invalidation depend on details that summaries may remove. Distilling logs into a semantic graph and destroying the originals can be a valid retention decision. It cannot preserve the old replay or forensic grade by declaration.

Every compression or deletion event therefore records the exact source set, derived artifact, transformation and evaluator, fields and relations retained, known omissions, rights and policy basis, legal holds, descendant dependencies, key-destruction or physical-erasure method, surviving caches and backups, effective replay-grade change, and residual owner. A digest proves which bytes were transformed; it does not prove that the summary retained the fact later needed to explain an effect.

The decision is consumer-specific. A compact semantic trace may remain adequate for routing statistics while becoming inadequate for safety investigation, affected-party appeal, source quotation, model-update attribution, or exact re-execution. Those lost capabilities are written as explicit consequences. Privacy deletion also inventories derivatives and descendants: destroying an encryption key or primary log does not establish that summaries, embeddings, training examples, checkpoints, caches, screenshots, exports, or external effects disappeared.

This prevents two symmetric errors. Audit requirements cannot justify indefinite, universally retrievable surveillance, and deletion claims cannot erase unresolved accountability or pretend that a lossy summary is original evidence. Privacy, legal, incident, evidence, and artifact owners negotiate the retention lease; the graph records the resulting capability loss and custody.

46.7.5 Canonical truth, projections, and transitive revocation

Artifact Graphs owns canonical-truth separation because supply-chain integrity governs admission and lifecycle policy, while this layer governs the durable dependency graph after admission. A canonical manifest, event log, or content-addressed artifact is not interchangeable with its cache, index, report, dashboard, claim evaluation, promotion label, or public page. Every projection records the canonical artifact ID and digest from which it was derived, its own digest, refresh state, and revocation state.

That distinction matters most when canonical state turns bad. Corben’s Trainer retains the sharp failure case: benchmark-labelled runs were later quarantined as synthetic placeholder fixtures, while earlier claim evaluations and a candidate.current promotion label were not transitively revoked. The report layer could exclude the runs, but the canonical claim and promotion surfaces remained stale. A graph that records only forward provenance cannot repair this. It needs reverse dependency closure from the quarantined input through evidence, claims, promotions, readiness decisions, reports, and public surfaces.

The transitive-revocation law is:

When an upstream artifact is quarantined or revoked, every reachable downstream dependency is invalidated unless a recorded alternate derivation survives the same policy. Unreached or unresolved descendants remain blockers, not silent successes.

Three adjacent duties complete that law:

• Replay-grade precision: playback returns retained output; deterministic re-execution reruns pinned inputs in a pinned environment and compares observed output; semantic replay reruns or reconstructs behavior against a named semantic validator; partial re-execution names missing effects; non-replayable and not-attempted remain explicit. These grades cannot be upgraded by vocabulary.
• Acknowledged asynchronous completion: queue acceptance is not terminal success. A completed, failed, or cancelled request needs a terminal receipt; restart recovery needs reconciliation against durable request state. Queue idleness alone cannot certify checkpoint completion.
• Relocation-safe identity: a path is a location, not artifact authority. Identity is content-digest or compound digest-and-policy based; relocation is accepted only when the digest is reverified. Absolute checkpoint paths may remain useful hints but cannot define the artifact.

flowchart LR
  C["Canonical artifact + digest"] --> P1["Cache / index"]
  C --> P2["Report / dashboard"]
  C --> P3["Claim / promotion / public surface"]
  Q["Quarantine or revocation"] --> C
  Q --> R["Reverse dependency closure"]
  R --> P1
  R --> P2
  R --> P3
  A["Valid alternate derivation"] -. "may preserve one descendant" .-> R
  P1 --> G{"Reuse gate"}
  P2 --> G
  P3 --> G
  X["Replay grade + terminal receipt + relocation digest"] --> G
  G -->|"complete and bounded"| U["Scoped reuse review"]
  G -->|"stale / playback-only / queued / path-bound"| B["Invalidate or block"]

How to read the closure graph: quarantine starts from canonical state and travels through reverse dependencies. A projection survives only through a valid alternate derivation, not because it is cached or public. Replay grade, terminal completion, and relocation identity then constrain reuse. This is a fixture-level design boundary, not evidence that the historical runtimes implemented it.

The strongest objection is operational cost: reverse-closure invalidation can cascade across many surfaces and make a system appear less ready after discovering one flaw. That apparent regression is the point. A graph that hides downstream invalidation preserves availability by spending truth. The bounded implementation may batch invalidations, prioritize high-authority descendants, and escrow unresolved nodes, but it may not silently keep a claim or release active because closure is expensive.

46.7.6 Foundry lineage and semantic history

Deterministic Capability Compilation requires one artifact graph spanning charters, scaffolds, capability graphs, corpora, traces, counterexamples, experts, NCOs, ABI versions, link plans, linked composites, validators, environment runs, residual leases, tribunal decisions, reified artifacts, and recovery exercises. Counterexamples and failed links remain durable nodes; a successful later candidate does not rewrite them out of the denominator.

The Platonic World Model adds immutable semantic history: Form families and versions, propositions, attestations, commitments, proofs, contexts, branches, grounding adapters, diffs, migrations, mappings, packets, and governance events. Replay binds both artifact lineage and the exact semantic basis that interpreted it. An unchanged byte artifact can become stale when a semantic dependency, grounder, authority, or mapping changes; an updated artifact can preserve old meaning through an explicit verified bridge.

46.7.7 Compiler trace bundles and lifted-origin custody

Cognitive Compilation contributes a concrete cross-artifact bundle. One compiler run binds the locked source plan, semantic IR, schedule, target IRs, rendered artifacts, source-to-artifact span maps, structured validator results, router decisions, complete cost report, security/redaction report, and a manifest hashing every component. The bundle records what was produced and why the system says it was produced; it does not prove that the source plan was complete, that the semantics were preserved, or that the artifact is useful.

Reverse compilation adds origin edges in the opposite direction. A lifted node points to exact repository files and lines, document spans, scenes, parser and model versions, extraction method, confidence, fact/claim/guess class, license metadata, taint, and source digest. Merge bundles retain every contributing origin, candidate alias, conflict, policy, authority decision, rejected alternative, and resulting semantic node. Refactoring or recompilation creates new descendants; it cannot replace the origin record or erase a rejected source from the decision history.

Replay therefore has three different targets: reproduce the forward build, reproduce the observed lift, and reproduce the governed merge decision. A parser-version change may invalidate a lifted fact without changing the source; a rights or deletion event may block reuse even when the semantic result still looks correct; and a changed merge policy may produce a valid alternative descendant rather than prove the old one wrong. Content-addressed storage binds identity across those paths, while explicit supersession, invalidation, and residual state explain what remains usable.

46.7.8 Evidence, canon, and cross-modal compilation

Spinoza Composer extends the artifact graph from software and prose into a cross-modal production dependency graph. Its mature correction is to reject one mutable “knowledge graph” as source of truth. Four stores have different authority:

Store	Contents	Mutation rule	Authority boundary
evidence store	raw and normalized statements, modality, exact pointers, extractor pins, conflicts, quotation scope, and taint	append or supersede; never rewrite source history	records what was captured or asserted, not what the artifact must claim
evidence view	resolved entities, aliases, clusters, communities, summaries, and search projections	rebuild when resolver, source, policy, or model changes	fallible interpretation and navigation only
draft canon	machine-assembled candidate commitments and continuity rules	revise freely with complete deltas	proposal surface; cannot constrain accepted output by itself
active canon	approved project commitments, uncertainty, rules, entity states, and continuity constraints	versioned approval, rollback, and retirement	governs this artifact within the approved stakes profile, not external truth

This separation catches a subtle provenance failure. Entity resolution may merge two people, a community summary may omit an exception, or an extractor may treat a character’s belief as narrator fact. Recomputing the view must not erase the evidence records that exposed the mistake. Likewise, approving a canon choice records what the project commits to; it does not retroactively make one contested source correct.

The evidence record therefore carries more than a subject–predicate–object triple. It distinguishes fact, reported speech, opinion, estimate, fiction canon, and instruction; asserted, negated, and uncertain polarity; quotation scope; exact page/span or media timestamp; extractor and configuration; and injection-like or policy-sensitive text. A quoted imperative remains data. It cannot turn itself into runtime instruction or canon authority because it was retrieved from a source.

A dependency graph then connects evidence records and views to canon nodes, section and scene contracts, generated segments, validation observations, disclosures, and final exports. When a source is poisoned, revoked, corrected, or newly contested, the graph finds the affected closure, marks projections and outputs stale, rebuilds only the necessary views, and requires the appropriate canon deltas to be reapproved. Incremental repair is a performance strategy; unresolved reachability remains a blocker rather than evidence that the rest of the artifact is clean.

46.7.8.1 Contracts across text and media

Each text section receives a Section Contract before generation: required and forbidden claims, evidence or synthesis state, entity and temporal assumptions, required uncertainty language, format, risk, allowed consumers, and retry, time, spend, and human-intervention budgets. Each shot receives a Scene Contract: stable element identities, props, actions, setting, continuity locks, forbidden elements, duration, camera hints, and acceptable variance. Candidate output includes a structured claim/state delta; acceptance means that the declared checks ran under their pins, not that a generator preserved meaning perfectly.

Local interaction checks can cheaply test possession, location, knowledge, and preconditions among entities that actually interact. Global lint checks inventory conservation, location exclusivity, lifecycle, causal ordering, unresolved references, and cross-segment conflicts. Neither route is complete. Pairwise checks miss higher-order dependencies; global checks operate under a bounded lookback and a fallible extracted state. Causal time, presentation order, and transaction/version time stay separate so a flashback can read an earlier state without rewriting the history that later scenes depend on.

Semantic and vision validators are sensors, not truth oracles. Deterministic checks can reject malformed IDs, missing fields, invalid pointers, and illegal state deltas. Model-based contradiction or visual-identity checks return confidence and disagreement. Multiple judges may expose instability, but voting does not create independence or correctness. Low-confidence minor findings can enter a warning route; high-impact uncertainty escalates. The audit record retains false-positive and false-negative estimates, shared model or data dependencies, retries, human overrides, and accepted residuals.

For visual work, a hashed Element Pack supplies reference frames, character sheets, prop turnarounds, location plates, palette, and camera constraints. A fallible vision route writes observed attributes and uncertainty into a continuity buffer for the next shot. Canon, references, observed frame state, and validator judgment remain separate: a wrong observation cannot rewrite an entity’s canonical identity, and reference conditioning cannot be advertised as an identity guarantee.

flowchart LR
  S["Untrusted sources"] --> ES["Append-only evidence store"]
  ES --> EV["Rebuildable evidence views"]
  EV --> DC["Draft canon"]
  DC -->|"reviewed delta"| AC["Versioned active canon"]
  AC --> TC["Section / scene contracts"]
  TC --> G["Text / visual candidates"]
  G --> V["Rule + semantic + vision observations"]
  V -->|"accept / warn / repair / escalate"| A["Artifact + audit bundle"]
  ES --> DG["Dependency graph"]
  EV --> DG
  AC --> DG
  TC --> DG
  A --> DG
  Q["Source taint / canon change"] --> DG
  DG --> R["Stale closure + bounded regeneration"]

How to read the foundry graph: source capture, interpretation, project commitment, generation contract, candidate output, validation observation, and final artifact are different nodes. A later source or canon change travels through the dependency graph and makes affected descendants stale; it does not rewrite the evidence store or silently regenerate public output.

46.7.8.2 Bounded degradation and complete delivery custody

The final Composer draft replaces indefinite video retries with explicit tiers: reliable slides/diagrams, bounded short-form generation, and hybrid longer-form production using stock, CGI, diagrams, or manual work. Each route fixes retry, review, latency, and spend caps prospectively and forecasts completion probability and cost ranges. A forecast is not a promise, so actual failures and overages remain in the denominator.

Before work begins, the consumer chooses the terminal route for exhausted budgets: Finish-Low delivers a complete timeline with visible warnings or watermarks on degraded segments; Finish-Hybrid substitutes reliable media; Stop-Clean delivers only completed sections plus the script, contracts, and shot list for missing work. A polished file cannot erase degraded, contested, unreviewed, or absent segments. Delivery state, disclosure, and consumer acknowledgement remain part of artifact custody.

The internal provenance bundle binds input snapshots, evidence and canon versions, contracts, prompts or protected templates, routes, validators, repairs, rejected candidates, deviations, element packs, observed continuity, backend versions, human approvals, costs, residuals, and final hashes. Portable content credentials may expose selected origin and transformation facts, but they are a separate projection: distribution platforms can strip them, and a valid signature establishes neither factuality, consent, complete lineage, nor safe publication.

Style examples and adapters are also artifacts. They carry ownership, licensing, consent, approved transformations, training and storage location, disclosure, model compatibility, expiry, deletion, and revocation. Surface similarity, perplexity, a LoRA file, or local storage does not establish authorship, faithful voice preservation, privacy, non-infringement, or the source’s early claim that style cloning preserves a person.

The research test compares this governed foundry with prompted LLM plus RAG and self-critique, ordinary continuity-bible/editorial practice, and current video generation plus human cleanup. It jointly measures extraction and conflict preservation, evidence-to-canon errors, contract coverage, validator calibration and dependence, provenance/synthesis/unresolved rates, text and visual drift, retries and intervention, partial-delivery usefulness, rights and privacy outcomes, delayed publication errors, and total production cost. A simpler accountable editorial workflow should win when it matches those outcomes at lower burden.

46.8 Interfaces

Artifacts become replayable through the Artifact Graph Record.

1. Labor OS supplies parent jobs, attempts, leases, observed effects, delivery, compensation, and terminal receipts; Artifact Graphs owns output identity, derivation, replay, and record-reality custody, not job lifecycle.
2. VCM and Context Transactions supply exact input views, source snapshots, transaction identity, taint, expiry, deletion state, and semantic certificates; artifact records cite rather than absorb them.
3. Runtime Adapters and tool runners supply independently observable calls, effects, outputs, errors, environments, and side records; adapter success is not artifact truth.
4. Source, data, model-weight, and supply-chain owners supply admitted inputs, signatures, attestations, usage conditions, compromise state, and lifecycle changes without granting correctness or release authority.
5. Claim Ledgers and Evidence States own support transitions and defeaters; artifact links supply inspectable candidates and blockers only.
6. Verification, proof, benchmark, and evaluator owners supply mode-specific results, checker identity, assumptions, outcome limits, and expiry; Artifact Graphs preserves but does not validate every method.
7. Security, Privacy, Rights, Licensing, and accountable-human owners issue access, disclosure, redaction, retention, deletion, legal-hold, export, challenge, and exception decisions.
8. Procedural Memory may mine repeated traces only through quality, privacy, rights, contamination, and retirement gates; frequency is not competence.
9. Readiness, Replacement, Rollback, and Publication consume impact closure, replay, residual, and revocation state while retaining deployment and release authority.
10. Resource Economics supplies storage, observation, replay, audit, human review, latency, retention, deletion, and remediation budgets with complete failed-work denominators.
11. Accountable humans own contested identity, provenance gaps, destructive deletion, cross-party disclosure, exception, appeal, and irreversible remediation decisions within exact authority.
12. PROV-O, Croissant, in-toto, version control, workflow histories, and lineage catalogs supply interoperability and comparator vocabulary, not local integrity, completeness, usefulness, safety, or SOTA evidence.

Minimum fields:

• artifact_id
• artifact_type
• parent_job
• source_refs
• context_refs
• context_transaction_refs
• semantic_certificate_refs
• tool_refs
• claim_refs
• test_refs
• audit_events
• replay_metadata
• replay_grade
• environment_assumptions
• provenance_status
• replay_limits
• evidence_gate
• residuals
• non_claims

VCM references artifacts as context cells. Evidence consumes logs and test links. Procedural memory mines repeated traces. Claim ledgers decide whether an artifact can support a claim.

A consumer should not have to parse a narrative paragraph to know whether an artifact is reusable. It should see a structured record: source refs for epistemic scope, context refs and transaction refs for memory scope, semantic certificate refs for representation scope, tool refs for authority scope, replay metadata and grade for reproducibility scope, and claim/test links plus an evidence gate for evidence scope. That makes the artifact graph the handoff format between execution, memory, evidence, compression, and release engineering.

46.9 Invariants

1. Every admitted revision has stable content identity, type, producer, parent work, role, consumer, authority, rights, retention, expiry, and owner; mutable locations never become identity authority.
2. Creation, observation, transformation, verification, challenge, reuse, quarantine, revocation, deletion, export, and retirement events are append-only or explicitly superseding with actor and clock boundaries.
3. Lineage distinguishes observed relations from producer assertions, inferred links, unknown parents, omitted effects, and unverified external records.
4. Canonical artifacts and events remain distinct from caches, indexes, summaries, dashboards, claims, promotions, releases, and public projections, each with source digest and refresh state.
5. Every derivation edge is traversable forward and backward; unknown, inaccessible, cyclic, or unresolved descendants remain blockers.
6. Upstream quarantine, revocation, expiry, rights change, deletion duty, or corruption invalidates all reachable dependents unless a valid policy-compatible alternate derivation exists.
7. Playback, deterministic re-execution, semantic replay, partial re-execution, failed replay, non-replayable, and not-attempted remain distinct with exact missing inputs and irreversible effects.
8. Replay claims bind inputs, code, models, tools, environment, seeds, services, evaluator, expected comparison, observed divergence, cost, and residuals.
9. Queue acceptance, worker response, file existence, digest presence, command exit, delivery, and acknowledgement never replace an observed terminal receipt and exact evidence gate.
10. A receipt cannot attest beyond independently observed bytes, objects, commands, services, effects, and roots; same-component agreement and record shape grant no authority.
11. Every verifier and attestation route names its trusted computing base, roots, version, bounded delegation, recursion stop, compromise response, and outside-TCB residual.
12. Claim, test, benchmark, support, readiness, procedure, model, and release consumers inherit artifact scope, replay grade, rights, expiry, defeaters, residuals, and non-claims.
13. Privacy, consent, confidentiality, licensing, deletion, legal hold, disclosure, redaction, retention, and export obligations propagate through derivatives and alternate copies.
14. Deletion or redaction preserves a non-sensitive tombstone and downstream obligation closure when permitted, without retaining prohibited content for audit convenience.
15. Every promotion, release, procedure, or model update affected by a changed artifact is discoverable through a bounded impact query with owners.
16. An alternate derivation preserves a descendant only when its complete current lineage independently satisfies the same consumer policy and does not reuse the revoked cause.
17. Observations, replay failures, missing artifacts, stale projections, rejected receipts, human interventions, privacy work, storage, cleanup, and residuals remain in evaluation denominators.
18. Schemas, hashes, signed metadata, authored fixtures, finite theorems, green commands, CI records, and served pages establish only their exact record, cryptographic, formal, local, service, and time boundaries.

An artifact with missing required provenance cannot support a promoted claim. It can still exist, but it should be labeled as incomplete, not evidence-ready.

The graph must also preserve parentage. A derived artifact should keep links to the source material, context packet, job contract, tool invocation, review record, and claim or test it affected. If any link is intentionally absent, that absence is a recorded limitation rather than a silent simplification. Reuse inherits those limitations. This is what prevents a useful artifact from becoming free-floating evidence after it moves through summaries, release notes, or future planning.

46.10 Failure modes

1. Artifact amnesia: work lacks stable identity, parent work, source, context, tool, effect, claim, test, owner, or residual lineage.
2. Path and name authority: relocation, renaming, cache movement, or object migration changes identity or silently binds the wrong bytes.
3. Provenance theater: plausible asserted edges hide actual inputs, transformations, side effects, omitted dependencies, or responsible actors.
4. Audit-log theater: mutable, dropped, selectively written, unauthenticated, inaccessible, or producer-controlled events are presented as complete reconstruction.
5. Projection laundering: a stale cache, report, dashboard, claim, promotion, release, or public page outranks canonical state.
6. Incomplete reverse closure: an upstream is quarantined while reachable claims, procedures, models, releases, copies, or statements remain active.
7. Alternate-derivation laundering: a nominal second path shares the revoked source, compromised tool, stale policy, or hidden transformation.
8. Replay-grade inflation: playback becomes re-execution, similarity becomes semantic replay, or partial reconstruction becomes reproduction.
9. Environment and service drift: a model, tool, dependency, dataset, evaluator, service, clock, or irreversible effect changes unnoticed.
10. Queue-success laundering: accepted, running, idle, delivered, or acknowledged work becomes completed, compensated, or evidence ready.
11. Receipt-reality divergence: shape-valid but reality-false bytes, effects, commands, services, or downstream outcomes survive review.
12. Self-attestation laundering: producer, observer, verifier, root, and approver collapse into one dependency without a residual.
13. Trust recursion and capture: circular attestations, fluent summaries, shared evaluators, compromised keys, or missing recursion stops extend confidence without warrant.
14. Evidence laundering: existence, digest agreement, replay, signature, or audit completeness becomes correctness, usefulness, safety, or support.
15. Privacy and rights laundering: sensitive traces persist, consent or deletion is ignored, or auditability becomes authority for surveillance.
16. Procedural contamination: erroneous, unauthorized, private, adversarial, or obsolete traces become reusable memory or training data.
17. Cost survivorship: failed replay, storage, indexing, challenge, human review, privacy work, deletion, remediation, downtime, and unresolved descendants disappear from comparisons.
18. Portability and SOTA theater: one repository, hash, fixture, CI service, public page, model, organization, threat model, or moment becomes general provenance or superiority evidence.

Untraceable output becomes a residual. Non-replayable workflows must declare replay limits. Provenance gaps block evidence promotion until repaired or explicitly bounded.

Convenience laundering is the quiet artifact-graph failure. A useful artifact can be repeatedly cited until its origin feels settled even though no record ever tied it to source, job, context, test, or review. The artifact graph should prevent that by keeping incomplete provenance visible at every reuse point.

Replay exaggeration creates a different distortion. A workflow may be partially reproducible, environment-dependent, or intentionally non-replayable for privacy or security reasons. Treating that partial replay as full reproduction inflates evidence. Replay grade, environment assumptions, missing inputs, and irreversible effects should remain visible so future agents know whether they can rerun, audit, or only inspect the record.

Receipt faithfulness is the harder record-reality problem. A receipt can be syntactically valid and still fail to correspond to the world: the artifact may be missing, the observation may come from the same component that produced the claim, the attestation may cover only record shape, or a trap receipt may reveal that the reviewer is not checking reality at all. The repository now checks that bounded failure mode through docs/receipt_faithfulness_adversarial_fixture.md: a shape-valid but reality-false receipt is rejected when it seeks support review; a trap-receipt negative control cannot be ignored; an independent cross-check route is required before support review; unbounded attestation is rejected; and receipt shape alone cannot promote support state. Accepted no-promotion decision evidence_transitions/v1_x_measured/artifact_receipt_faithfulness_no_change.json records that fixture as a blocking decision for receipt-faithfulness overclaims only; it does not move support state, create an upward transition, prove open-world receipt faithfulness, or promote the Artifact Graphs chapter core claim.

The next step is a Receipt repository audit rather than another synthetic receipt sketch. python3 scripts/validate_receipt_repository_audit.py writes experiments/receipt_repository_audit/results/2026-07-03-local.json after auditing four current repository receipt surfaces: the Resource flagship lane, the Theseus/Fast support lane, a reference trace replay, and the Circle external rope slice. It checks artifact refs, 55 tracked digest checks, command pass records, external receipt fingerprints, non-claim boundaries, and no support-state promotion, then rejects mutation controls for a missing artifact ref, tracked digest mismatch, failed command replay, missing non-claims, and support promotion from receipt shape. This is still a repository-level audit, not open-world receipt faithfulness, deployed attestation, deployed audit behavior, verifier correctness, or external project truth.

The follow-on receipt repository challenge makes that audit less static. python3 scripts/validate_receipt_repository_challenge.py writes experiments/receipt_repository_audit/results/2026-07-04-challenge.json after deterministically selecting three tracked-digest challenges and one Circle external fingerprint challenge from the prior audit. It accepts the sampled Resource, Theseus/Fast, reference-trace, and Circle fingerprint responses, then rejects challenge controls for digest mismatch, missing artifact, external fingerprint mismatch, missing non-claims, and support promotion. Accepted no-promotion decision evidence_transitions/v1_x_measured/artifact_receipt_repository_audit_challenge_no_change.json records the audit/challenge as a blocks_promotion decision for receipt-reality overclaims only. This still does not prove deployed attestation or open-world receipt truth; it proves only that selected repository receipts can answer a reproducible audit challenge without changing support state.

Record-reality should be read as an authority ladder, not a binary stamp. A paper trail with only the right fields is stored. If the file exists and the digest still matches, it is inspectable. If replay, command output, or an independent observation route agrees, it is reviewable. If negative controls fail in the expected way and residuals stay visible, it may block overclaims. Only an accepted evidence transition or named release approval can affect support state, and only within that exact scope. This ladder prevents a useful audit result from becoming an all-purpose proof.

flowchart TB
  A["Stored receipt\nfields present"] --> B["Inspectable artifact\nfile + digest observed"]
  B --> C["Reviewable artifact\nreplay or independent route agrees"]
  C --> D["Overclaim blocker\ntraps / controls reject bad routes"]
  D --> E["Authority-affecting record\naccepted transition or exact release approval"]
  A -. "cannot support promotion" .-> R["Residual / non-claim boundary"]
  B -. "still not proof" .-> R
  C -. "scope stays bounded" .-> R
  D -. "blocks only named overclaim" .-> R

Reading the record-reality ladder: The artifact graph does not ask the reader to trust a receipt because it is detailed. It asks what level of authority the receipt has earned. Storage preserves a claimable object. Inspection ties it to bytes. Review ties it to replay or an independent observation route. Overclaim-blocking rejects bad routes before they can launder confidence. Only a separate accepted transition or exact release approval can change support or publication state.

The epistemic trusted computing base is the companion problem: even an honest receipt needs a place where verifier trust bottoms out. A verifier cannot become trusted because it produced a fluent verdict, because it shares a component with the claim producer, or because a downstream agent repeats its summary. The bounded fixture at docs/epistemic_trusted_computing_base_fixture.md makes that finite-record boundary explicit. A trust-base record must name the minimal trusted core, root-of-trust refs, a bounded delegation rule, a recursion stop condition, verifier independence state, outside-TCB residuals, and non-claims. It accepts a minimal trust-base record, a delegated verifier record-only path, and a blocked self-verifier record, while rejecting missing roots of trust, verifier-trust laundering, ambient trust propagation, missing recursion stops, erased outside-TCB residuals, and support promotion from trust-base shape.

46.11 Strongest Objection

Record-reality is the artifact-graph version of the book’s hardest evidence problem: a record can be valid while the world it points at is not what the record says. Malformed attestations are easy to reject. The serious objection is a strategic or merely overconfident system that produces receipts, logs, proof summaries, replay traces, and verifier summaries that all pass the visible gates while the causal process remains outside the recorded story.

The current graph can ask narrow reality questions. Does the file exist? Does the digest still match? Did the command replay? Was the observer independent of the producer? Did a trap receipt force rejection instead of being waved through? Did the verifier route name its trust root, delegation limit, recursion stop, and outside-TCB residual? Those questions are not enough to prove open-world truth, but they change what a receipt is allowed to do. A receipt that cannot answer them can still be stored; it should not move a claim, qualify a release, bless a benchmark, or teach a future agent as if it were evidence-ready.

The repository now carries a bounded answer ladder for that objection. The receipt-faithfulness fixture rejects shape-valid but reality-false records, ignored trap receipts, missing independent cross-checks, same-component self-check laundering, unbounded attestation, and promotion from receipt shape. The repository receipt audit checks selected current receipt surfaces against artifact references, tracked digests, command status, external fingerprints, and non-claim boundaries. The deterministic challenge samples that audit and asks particular files and a Circle fingerprint to answer. The live artifact attestation probe then makes one produced artifact answer through filesystem bytes, git object bytes, and command replay. The randomized attestation audit widens the same bounded question across a deterministic pseudo-random sample of public-safe repository artifacts so a single handpicked artifact cannot carry the whole record-reality story.

The GitHub Pages CI attestation adds one externally hosted service route to the same ladder. python3 scripts/validate_artifact_github_pages_ci_attestation.py checks experiments/artifact_github_pages_ci_attestation/results/2026-07-05-local.json, which records GitHub Actions run 28733145259 for the Publish Quarto site workflow on main: source validation, Lean build, HTML render, live Human view validation, browser Human-view smoke testing, Pages artifact upload, and deploy completed successfully for commit fdff2c1cb0a100e4c68099adc5128d3b461384fd. Accepted no-promotion decision evidence_transitions/v1_x_measured/artifact_github_pages_ci_attestation_no_change.json records that run as a blocks_promotion side lane only. It is GitHub Actions service-status evidence for one commit, not independent external human review, not open-world receipt faithfulness, not deployed attestation behavior, not reader release approval, and not Artifact Graphs chapter-core support.

The public deployed-site attestation adds a served-page observation on top of that CI service record. python3 scripts/validate_artifact_public_site_attestation.py checks experiments/artifact_public_site_attestation/results/2026-07-05-live.json, which records a successful fetch of the public GitHub Pages Artifact Graphs chapter, the served HTML digest 8732d88da373a8135310bbaae3c9302b0a44423648028a3c7833cde373072c5c, and required fragments for the record-reality authority ladder, epistemic-TCB boundary, CI attestation section, live/randomized attestation probe references, and non-claim boundaries. Accepted no-promotion decision evidence_transitions/v1_x_measured/artifact_public_site_attestation_no_change.json records that fetch as a blocks_promotion side lane only. It says the public site served the expected record-reality treatment at fetch time; it does not prove deployed attestation behavior, open-world receipt faithfulness, verifier correctness, independent external human review, reader release approval, or Artifact Graphs chapter-core support.

That chain is a showpiece for the argument, not a victory lap. It demonstrates a bounded route from record shape toward record reality inside this repository: syntactic receipt checks, adversarial receipt traps, selected repository audits, deterministic challenges, one live local produced-artifact probe, a deterministic multi-artifact audit, an externally hosted CI-service record, and a public served-page observation. It does not prove deployed attestation behavior, verifier correctness, complete provenance, external-project truth, model quality, audit-service correctness, or open-world receipt faithfulness. The epistemic trusted computing base fixture adds the companion limit: a verifier is only useful inside a named trust path, and trust does not propagate indefinitely just because downstream records cite the verifier.

The weakening condition is therefore explicit. If the observer, verifier, producer, or approval path collapses into one untrusted component, or if a hidden dependency cannot be replayed, challenged, independently observed, or residualized, the artifact graph may preserve the record but must strip it of evidence authority. The next stronger artifact would be deployed or externally reviewable attestation and audit behavior, randomized challenges beyond one selected artifact, verifier-quality review, and trust-base storage/replay evidence. Until then, record-reality remains a disciplined boundary, not a claim that the stack can force reality to match its paperwork.

46.12 Minimum Viable Implementation

The current minimum is deliberately finite: two public artifact/projection schemas; 2 valid and 6 rejecting replay fixtures; 1 valid and 10 rejecting projection-revocation records; 1 valid and 4 rejecting record-reality sequences; 3 valid and 6 rejecting receipt-faithfulness records; a four-surface repository audit with 55 tracked digest checks and five mutations; four deterministic challenges and five mutations; one live artifact with three observation routes and seven mutations; four sampled artifacts with twelve accepted observation routes and eight mutations; 3 valid and 6 rejecting epistemic-TCB records; one historical GitHub Actions service record; one historical public-page fetch record; eight accepted no-promotion decisions; and fifty-six live Lean theorems under ten public targets. The fifty-six comprise twenty-one reachable-lifecycle theorems and thirty-five retained legacy consequences; eight weaker declarations were retired.

Those artifacts establish authored record shape, finite consequences, selected repository observations, digest and command challenges, service-status facts, and exact overclaim blockers. They do not implement complete event capture, open-world provenance, independent attestation, runtime transitive revocation, privacy/deletion closure, semantic correctness, causal benefit, or transfer.

Artifact continuity begins with an artifact_graph_record schema and fixture. It validates parent job, source/context/context-transaction/semantic-certificate/tool/claim/test refs, audit events, replay metadata, replay grade, environment assumptions, provenance status, replay limits, evidence gate, residuals, and non-claims.

The mined-project minimum adds schemas/artifact_projection_revocation_record.schema.json, one blocked five-project lineage record, and ten expected-invalid mutations. python3 scripts/validate_artifact_projection_revocation.py rejects stale projection source digests, missing or unknown revocation descendants, playback mislabeled as deterministic or semantic replay, terminal async states without receipts, path-based identity, relocation digest mismatch, unverified relocation, and bounded-review eligibility from playback with unresolved completion and blockers. The valid record keeps project replay at playback, checkpoint completion at unknown, and support effect at blocks_promotion.

AsiStackProofs.ArtifactRealityRefinement turns those formerly disconnected summaries into one reachable lifecycle: registration, provenance binding, replay validation, reality cross-check, trust binding, and consumer-acknowledged admission. Exact artifact and lineage identities persist through all stages. The same thirteen-field identity projection persists over every finite event list; rejected events preserve the exact state, event batches compose, and an admitted state absorbs every suffix without gaining support or effect authority. Progress stops when provenance, replay, observation, independent cross-check, trap, attestation-limit, trust-root, verifier-separation, recursion-stop, outside-TCB residual, revocation-closure, or consumer obligations fail. python3 scripts/validate_artifact_reality_refinement.py independently recomputes thirty-three routes and the eight exact bounded suites, rejecting all fifty-three declared mutations. The older exact validators remain consumers of the stronger model rather than theorem-shaped copies of their fixture rows. Their bounded receipts remain at experiments/receipt_faithfulness/results/2026-07-03-local.json, experiments/receipt_repository_audit/results/2026-07-03-local.json, experiments/receipt_repository_audit/results/2026-07-04-challenge.json, experiments/artifact_live_attestation/results/2026-07-04-local.json, experiments/artifact_randomized_attestation/results/2026-07-04-local.json, and experiments/epistemic_tcb/results/2026-07-03-local.json; each records bounded observations and explicit non-claims rather than chapter-core support.

The live artifact attestation slice is deliberately smaller than the final evidence lane: one tracked artifact, three observation routes, one trap receipt, and explicit limits. A dirty or uncommitted target is not attested merely because a prior receipt exists; filesystem bytes, the tracked Git object, and command replay must agree at observation time. The randomized audit broadens the slice to four deterministically selected public-safe artifacts and twelve routes, but still cannot establish open-world receipt faithfulness. The next step is a clean or externally replayable natural trace carrying the full parentage, context, tool, replay, residual, evidence, claim/test, independent observation, trap, and attestation-limit packet.

The argument-exit campaign must use natural artifacts rather than merely more authored rows. It should prospectively sample documents, code changes, proofs, datasets, model outputs, benchmark results, workflow receipts, and public surfaces across several repositories and storage backends. Strong matched comparators are ordinary folders plus version control, workflow/event history, PROV-O-style relations, Croissant-style metadata, in-toto-style signed lineage, and a mature data-lineage catalog. All routes receive the same artifacts, models, tools, authority, rights, storage, compute, faults, delayed changes, and review budgets.

Independent observers must label actual lineage and effects so the campaign can measure edge precision and recall, missing and false parents, receipt-reality error, replay fidelity by grade, reverse-closure completeness, revocation latency, alternate-derivation validity, stale-public-surface time, privacy leakage, deletion closure, useful downstream reuse, false blocking, incident reconstruction, latency, human work, storage, remediation, and total cost. Prospective ablations remove content identity, independent observation, canonical/projection separation, reverse closure, replay locks, receipt challenges, trust-base boundaries, rights propagation, or complete denominators. A clean implementation then reproduces the result, and transfer varies repositories, artifact types, models, tools, workflow engines, storage systems, organizations, threat models, legal regimes, and time. Until those joint gates pass, the support ceiling remains argument.

46.13 Mature Research Target

A mature artifact-evidence plane is a versioned, content-addressed dependency system for natural AI work and independently observed effects. It is more than a provenance vocabulary, metadata format, signed step record, workflow history, or version-control graph. Each has real value; the proposed contribution is the composition of stable identity, record-reality challenges, exact replay grades, canonical/projection separation, reverse dependency closure, alternative derivation tests, trust-base limits, rights and deletion propagation, claim and test consumers, and explicit authority ceilings.

The SOTA claim is therefore conditional and comparative. The full plane must beat or complement strong simpler systems on the joint frontier of useful reuse, lineage precision and recall, receipt-reality error, replay fidelity, incident reconstruction, revocation completeness and latency, stale-public surface duration, privacy and deletion closure, false blocking, human work, latency, storage, remediation, and total cost. It must retain every failure, unknown descendant, inaccessible copy, rejected receipt, delayed consequence, and privacy exposure in the denominator. Better bookkeeping alone is not a win if it does not improve decisions, reconstruction, containment, or reuse.

Each signature mechanism needs a causal fingerprint. Removing reverse closure should leave stale descendants; removing independent observation should raise receipt-reality error; removing replay locks should increase false reproduction; removing rights propagation should leave prohibited derivatives; removing complete denominators should change the apparent cost frontier. Those effects must survive an independently implemented reproduction and transfer across repositories, artifact types, models, tools, workflow engines, storage backends, organizations, threat models, legal regimes, and delayed changes.

No such campaign has passed. The core claim remains an argument, and any future advance must be scoped to the exact artifact families, observers, faults, rights regime, environment, horizon, metrics, and residuals that were tested.

46.14 Codex test plan

Test	Purpose	Status
Artifact record-reality and trust refinement	Recompile the exact twenty-one-theorem surface; recompute a reachable seven-stage lifecycle and arbitrary finite runs with exact custody, rejection noninterference, batch composition, absorbing admission, replay, independent observation, trap, attestation-limit, trust-root, verifier-separation, recursion-stop, residual, revocation, and consumer-acknowledgment gates; preserve all eight bounded suites and reject every declared mutation.	implemented by python3 scripts/validate_artifact_reality_refinement.py; 21 theorems, 33 routes, 53/53 mutations rejected, support-state effect none; finite authored model only
Artifact graph fixture validation	Check that the artifact fixture matches the public schema and declares parent job, source/context/context-transaction/semantic-certificate/tool/claim/test refs, audit events, replay metadata, replay grade, environment assumptions, provenance status, replay limits, evidence gate, residuals, and non-claims.	implemented by protocol validation; validated locally
Projection/revocation closure harness	Check one blocked five-project lineage record and reject stale projections, incomplete or unknown reverse closure, replay-grade inflation, terminal async state without receipt, path authority, relocation mismatch, unverified relocation, and support review from playback/unresolved completion.	implemented by python3 scripts/validate_artifact_projection_revocation.py; record semantics only; no runtime revocation, replay, portability, or support-state promotion
Artifact traceability predicate and missing-ref negative case	Check that produced artifact records expose parent job and source/context references and that a produced artifact missing those refs cannot satisfy the traceability predicate.	implemented in AsiStackProofs.ArtifactGraph; checked by Lean build
Missing, incomplete, or blocked provenance promotion predicate	Check that missing, incomplete, or blocked provenance blocks promoted-claim support.	implemented in AsiStackProofs.ArtifactGraph; checked by Lean build
Artifact graph route proof	Check that modeled artifact admission rejects missing parent/source/context transaction/semantic certificate/tool/claim/test/audit/replay/evidence/non-claim fields, stale certificates, blocked promotion, and admits complete non-promoted or approved-promoted records.	implemented in AsiStackProofs.ArtifactGraph; checked by Lean build
Artifact replay packet bridge proof	Check that modeled replay packets reject parent-job mismatches, missing audit chains, missing observed artifacts for byte-exact replay, stale certificates, support-review packets without replay-validated transactions, and partial-replay promotion attempts, while admitting complete bounded-review packets and preserving record-only partial replay as blocked from promotion.	implemented in AsiStackProofs.ArtifactGraph; checked by Lean build
Artifact graph replay harness	Check that synthetic artifact replay packets align artifact parentage, typed job outputs, context transaction refs, semantic certificate refs, source refs, replay grade, observed artifacts, audit reconstruction, stale-certificate blocking, and promotion-blocking boundaries.	implemented in python3 scripts/validate_artifact_graph_replay.py; synthetic records only
Record-reality sequence bridge	Check that stale certificates and partial replay block bounded-review eligibility, that support-review attempts without replay-validated transactions are rejected, and that only a fresh complete replay/provenance event restores bounded-review eligibility.	implemented in python3 scripts/validate_artifact_graph_record_reality_sequence.py, AsiStackProofs.ArtifactGraph, and accepted no-promotion decision evidence_transitions/v1_x_measured/artifact_record_reality_sequence_no_change.json; finite sequence fixture only, no deployed replay or upward support-state transition
Receipt faithfulness adversarial fixture	Check that bounded receipt records reject shape-valid but reality-false receipts, trap-receipt failures, missing independent cross-checks, same-component self-check laundering, unbounded attestation, and support promotion from receipt shape.	implemented in python3 scripts/validate_receipt_faithfulness.py; finite synthetic records only
Receipt repository audit	Check selected current receipt records for artifact refs, tracked digest integrity, command pass status, external receipt fingerprints, non-claim boundaries, and no support-state promotion.	implemented in python3 scripts/validate_receipt_repository_audit.py; repository receipt audit only
Receipt repository challenge audit	Check deterministic digest/fingerprint challenge responses over the selected repository receipt audit and reject digest mismatch, missing artifact, external fingerprint mismatch, missing non-claims, and support-promotion controls.	implemented in python3 scripts/validate_receipt_repository_challenge.py; repository challenge only
Artifact live attestation probe	Check one current produced artifact through filesystem bytes, git object bytes, and command replay while rejecting same-component self-check laundering, accepted trap receipts, unbounded attestation, and support promotion from attestation shape.	implemented in python3 scripts/validate_artifact_live_attestation_probe.py; local live repository attestation only; not a deployed attestation service
Artifact randomized attestation audit	Check a deterministic pseudo-random sample of four public-safe repository artifacts through filesystem bytes, git object bytes, command replay, trap receipts, attestation limits, and mutation controls.	implemented in python3 scripts/validate_artifact_randomized_attestation_audit.py; result experiments/artifact_randomized_attestation/results/2026-07-04-local.json; local repository audit only; not a deployed attestation service
Artifact public deployed-site attestation	Check that the public GitHub Pages Artifact Graphs chapter serves the expected record-reality authority ladder, epistemic-TCB boundary, CI-attestation section, live/randomized attestation references, and non-claim boundary fragments.	implemented in python3 scripts/validate_artifact_public_site_attestation.py; result experiments/artifact_public_site_attestation/results/2026-07-05-live.json; public served-page evidence only; not deployed attestation behavior, release approval, external human review, or chapter-core support
Epistemic trusted computing base fixture	Check that bounded trust-base records reject missing roots of trust, verifier-trust laundering, unbounded trust propagation, missing recursion stops, erased outside-TCB residuals, and support promotion from trust-base shape.	implemented in python3 scripts/validate_epistemic_trusted_computing_base.py, AsiStackProofs.ArtifactGraph, and accepted no-promotion decision evidence_transitions/v1_x_measured/artifact_epistemic_tcb_fixture_no_change.json; finite synthetic records only, no verifier-correctness or deployed trust-base claim
Audit reconstruction test	Check that audit events are sufficient to reconstruct the execution path.	implemented for synthetic replay packets; no deployed audit-reconstruction service
Replay metadata completeness test	Check that replay limits and environment assumptions are declared.	implemented for synthetic replay packets; no deployed replay engine

Fixture-shape validation, bounded Lean theorem declarations over finite provenance, replay-grade, artifact-admission, replay-packet route predicates, receipt-faithfulness fixture predicates, receipt repository audit/challenge predicates, live attestation predicates, and epistemic-TCB fixture predicates, plus synthetic cross-record replay, receipt-faithfulness, repository challenge, live artifact attestation, and trust-base harnesses are implemented. The remaining tests require richer produced artifacts, audit logs, replay attempts, attestation checks, trust-base checks, and receipt-faithfulness audits from a deployed or imported artifact graph service.

46.14.1 Formalization hooks

Tag	Module	Target	Status
lean:artifacts.graph.operational_invariant	AsiStackProofs.ArtifactRealityRefinement	Every finite artifact lifecycle run preserves exact artifact, content, parent-job, source, context, transaction, certificate, tool, claim, test, policy, and consumer custody; rejected events preserve exact state, batches compose, admission is absorbing, and support or external effects remain unassigned.	implemented
lean:artifacts.graph.failure_blocks_promotion	AsiStackProofs.ArtifactRealityRefinement	Missing provenance, replay, observation, cross-check, trap, attestation-limit, trust-root, verifier-separation, recursion-stop, residual, revocation, or consumer obligations block lifecycle progress without mutating exact state.	implemented
lean:artifacts.graph.replay_packet_bridge	AsiStackProofs.ArtifactRealityRefinement	The refinement preserves exact replay-packet custody and requires replay metadata, sufficient grade, limits, active certificates, and replay validation before reality review.	implemented
lean:artifacts.graph.record_reality_sequence_bridge	AsiStackProofs.ArtifactRealityRefinement	The independent consumer preserves the exact one-valid/four-invalid stale/partial/fresh record-reality sequence without assigning support.	implemented
lean:artifacts.graph.receipt_faithfulness_fixture_bridge	AsiStackProofs.ArtifactRealityRefinement	The independent consumer preserves the exact three-valid/six-invalid receipt-faithfulness suite while requiring observation, independent cross-checks, trap challenges, and bounded attestation.	implemented
lean:artifacts.graph.receipt_repository_audit_fixture_bridge	AsiStackProofs.ArtifactRealityRefinement	The independent consumer preserves the exact four-record/five-mutation repository audit while treating current digest and command checks as bounded observations rather than open-world truth.	implemented
lean:artifacts.graph.receipt_repository_challenge_fixture_bridge	AsiStackProofs.ArtifactRealityRefinement	The independent consumer preserves the exact four-response/five-mutation deterministic repository challenge while bounding fingerprint and digest observations to the sampled artifacts.	implemented
lean:artifacts.graph.live_attestation_probe_bridge	AsiStackProofs.ArtifactRealityRefinement	The independent consumer preserves one-artifact live attestation with three observation routes and seven mutations without treating a dirty or uncommitted target as attested.	implemented
lean:artifacts.graph.randomized_attestation_audit_bridge	AsiStackProofs.ArtifactRealityRefinement	The independent consumer preserves the four-artifact randomized attestation with twelve accepted observation routes and eight mutations without generalizing beyond the sample.	implemented
lean:artifacts.graph.epistemic_tcb_fixture_bridge	AsiStackProofs.ArtifactRealityRefinement	The independent consumer preserves the exact three-valid/six-invalid epistemic-TCB suite while requiring a bounded trusted core, roots, verifier separation, recursion stop, and outside-TCB residuals.	implemented

The fifty-six live theorems divide into twenty-one refinement theorems and thirty-five retained consequences. Eight weaker declarations were physically retired because they merely projected a field or normalized an authored fixture summary. None refines a deployed artifact store, event collector, provenance observer, reverse-closure service, replay engine, rights/deletion runtime, or support gate. The formal surface establishes consequences of the stated model; it is not semantic or empirical proof of the chapter core.

These proof hooks are implemented as finite-record predicates plus route, replay-packet bridge, record-reality sequence bridge, receipt-faithfulness fixture, receipt repository audit/challenge fixtures, live attestation fixture, randomized artifact attestation audit fixture, epistemic-TCB fixture, and negative-case theorems over modeled artifact records. They cover parent/source/context refs, replay-grade sufficiency, claim/test links, audit and replay metadata, replay limits, evidence gates, stale certificates, promotion permission, cross-record replay-packet alignment, byte-exact observation requirements, support-review transaction validation, partial-replay promotion blocking, fresh-replay restoration after blocked eligibility, receipt/reality mismatch rejection, trap-receipt failure rejection, independent cross-check requirements, repository receipt tracked digest checks, deterministic challenge responses, deterministic pseudo-random sample selection, command replay boundaries, git object byte checks, external receipt fingerprints, missing non-claim rejection, attestation-limit recording, root-of-trust recording, delegation bounds, recursion-stop requirements, outside-TCB residuals, verifier-trust laundering rejection, non-claim boundaries, and complete modeled admission. They do not prove replayability, audit reconstruction, artifact-type-specific completeness, provenance completeness in a deployed service, open-world receipt faithfulness, deployed attestation behavior, deployed audit behavior, verifier correctness, deployed epistemic trusted-computing-base behavior, external project truth, or source interpretation adequacy.

46.15 Reasoning records are not authority records

A reasoning trace is one artifact class, not an epistemic shortcut. The graph must keep six objects distinct: private model reasoning, a reported rationale, the externally observable action trace, a receipt for the action, evidence that the rationale is monitorable, and the authoritative effect that actually occurred. Any two may disagree. A polished rationale can omit a prompt shortcut; an action trace can be correct for reasons the rationale does not contain; a shape-valid receipt can still misdescribe reality; and an accurate rationale still carries no execution authority.

ext_faithfulness_information_flow_2026 sharpens this separation through sufficiency, completeness, and interventional necessity. A transcript may contain enough information to predict an answer without being the path the model used. Necessity therefore cannot be established by reading the transcript alone. The artifact graph records trace perturbation, action perturbation, hidden-computation controls, evaluator identity, and disagreement among trace, action, receipt, and observed effect. It does not promote a chain of thought into a receipt or require disclosure of sensitive private reasoning.

ext_faithfulness_information_flow_2026 | Metadata-first comparator: Faithfulness as Information Flow: Evaluating and Training Faithful Chain-of-Thought Reasoning. Primary 2026 comparator that separates chain-of-thought sufficiency, completeness, and interventional necessity, demonstrates prompt-to-answer shortcuts and transparent reward-hacking diagnostics, and documents low-entropy and reference-model limits. It does not make a reasoning transcript an authoritative receipt or establish local monitorability. | No passage-level source claim, local implementation, reproduction, safety, performance, deployment, support-state, or ASI result is established by this reconciliation row. |

46.15.1 Session, run, and harness identity in a live gateway

ext_openclaw_agent_runtime_2026 exposes a practical identity chain that an artifact graph must not flatten. A gateway request resolves a local session, returns a run identifier, serializes work through a session lane, and writes a transcript under a generation-checked lock. An ACP delegation then adds a local ACP session key and a harness-local resume identifier. The latter is not a channel session key, and authorization for loading it belongs to the external backend rather than to the gateway record alone.

OpenClaw also projects lifecycle and tool terminal events into a bounded, metadata-only audit ledger. That is useful privacy-aware operational evidence, but it is intentionally not a replay-complete copy of prompts, arguments, results, or external effects. The artifact graph therefore records the projection as one view, links it to separately governed transcript and effect records, and retains an explicit gap when the external harness owns execution or observation. No OpenClaw run, transcript, ACP session, audit projection, or effect was reproduced here.

46.16 Source crosswalk

Source ID	Title	Layer	Planned use	Readiness
talos	Talos Protocol	labor_execution_os	AI labor OS. Deterministic cognitive manufacturing, typed jobs, control planes, auditability, tool isolation.	source note available; local raw cache available
viea	Verified Intent-to-Execution Architecture	whole_stack_execution_spine	Keystone source. Human intent -> command contracts -> artifacts -> routing -> runtime targets -> verification -> deployment -> feedback.	source note available; local raw cache available
cognitive_compilation	Cognitive Compilation	planning_semantic_ir	Compiler framing for LLM-centered planning, semantic IR, target compilation, incremental repair.	source note available; local raw cache available
spinoza_composer	Spinoza Composer / Spinoza Trinity	reasoning_media_compliance	Bounded cross-modal compilation lineage: evidence/view/canon separation, contracts, dependency repair, visual custody, partial delivery, and internal/external provenance boundaries.	source note available; local raw cache available
genesiscode	GenesisCode	executable_specification	Tiny pure calculus + obligations + provenance for auditable AI-symbiotic programming.	source note available; local raw cache available
cognitive_loop_closure	Cognitive Loop Closure	procedural_memory	Repeated cognition should become procedural memory / verified tools.	source note available; local raw cache available
moecot	MoECOT-Agent Architecture Whitepaper	implementation_reference	Concrete implementation evidence: governed low-parameter multi-core runtime, readiness gates, ledgers, replay.	source note available; connector or recovery required
cca_project	Compiled Cognitive Architecture project	local_project_lineage	Canonical closure authority, append-only supersession/invalidation, trace bundles, and transitive claim effects.	source note available
moecot_manifest_project	MoECOT Manifest compiler-era project	local_project_lineage	Canonical event/graph state separated from read models and caches; attestation and replay context.	source note available
bugbrain_project	BugBrain bare-metal neuro-symbolic intelligence project	local_project_lineage	Report/canonical-state divergence, silently ignored audit writes, replay limits, and relocation-sensitive state.	source note available
corbens_trainer_project	Corben’s Trainer epistemic training and evaluation control plane	local_project_lineage	Content-addressed artifacts, stale promotions after quarantine, reverse dependency closure, and acknowledged checkpoint completion.	source note available
corbens_best_model_possible_project	Corben’s Best Model Possible recurrent-model and mechanism laboratory	local_project_lineage	Playback versus re-execution, named transitions without durable effects, and absolute-path artifact identity failures.	source note available
ext_w3c_prov_o_2013, ext_mlcommons_croissant_1_1_2026, ext_in_toto_2019	PROV-O, Croissant 1.1, and in-toto	provenance_and_attestation	External grounding for interoperable lineage, dataset/resource derivation, and signed lifecycle steps while separating replay, attestation, byte identity, semantic correctness, and authority.	source notes available; no local conformance or verified lineage result

The eighteen assigned sources support bounded artifact, provenance, audit, replay, metadata, attestation, workflow, recovery, faithfulness, and historical failure vocabulary. All mappings have been reviewed at their exact local-cache, source-note, or primary-paper-note boundary. None establishes a deployed graph, complete lineage, local baseline reproduction, or chapter-core support.

46.16.1 Manifest source assignment reconciliation

These rows keep Artifact Graphs, Audit Logs, and Replay’s manifest assignments visible at their recorded review boundary. Passage review does not establish local reproduction, performance, safety, deployment, or support-state movement.

Source	Intake role	Boundary
deterministic_capability_compilation	Passage-reviewed Corben architecture source: Deterministic Capability Compilation: A Capability-Preserving Ladder from Executable Scaffolds to Governed Adaptive Agents. Corben-authored July 2026 architecture and research program for compiling executable scaffolds into contract-bound experts and linked Neural Capability Objects while retaining semantic obligation mass balance, candidate-specific translation validation, fallback, residual escrow, authority ceilings, reification, and effect-complete recovery. Existing chapters are upgraded first; no foundry implementation, learned-capability result, preservation result, safety result, SOTA result, AGI, ASI, or support-state promotion is inferred.	No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.
platonic_world_model	Metadata-first comparator: The Platonic World Model: A Semantic Constitution for Grounded, Proof-Carrying, Self-Editing Artificial Intelligence. Corben-authored July 2026 conceptual architecture and falsifiable research program for semantic continuity through stable Form lineages, immutable semantic versions, typed Essence Contracts, six mutually constraining planes, explicit proposition-attestation-commitment-proof separation, branch-protected world dynamics, qualified grounding, semantic transactions, runtime packet compilation, and federated mappings. Existing chapters are upgraded first; no implemented substrate, benchmark result, philosophical solution to grounding, safety result, SOTA result, AGI, ASI, or support-state promotion is inferred.	No passage-level source claim, local implementation, reproduction, safety, performance, deployment, support-state, or ASI result is established by this reconciliation row.
ext_claw_swe_bench_2026	Passage-reviewed comparator: Claw-SWE-Bench: A Benchmark for Evaluating OpenClaw-style Agent Harnesses on Coding Tasks. Supports binding coding-agent outcomes to a fixed model, harness, workspace, patch extraction, evaluator, runtime budget, and cost rather than attributing a harness result to the model alone.	Primary preprint comparator only; no reported task, score, harness, cost, contamination control, or safety result was reproduced here. No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.
ext_txfs_2018	Passage-reviewed comparator: TxFS: Leveraging File-System Crash Consistency to Provide ACID Transactions. Supports distinguishing declared effect-inventory restoration from ACID filesystem transactions, conflict isolation, crash consistency, durability, and bounded transaction capacity.	TxFS was not installed or reproduced; the local directory and state-tree snapshots do not establish filesystem transactions, crash safety, process recovery, service recovery, or external-effect atomicity. No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.
ext_faithfulness_information_flow_2026	Passage-reviewed comparator: Faithfulness as Information Flow: Evaluating and Training Faithful Chain-of-Thought Reasoning. Separates a plausible reasoning transcript from causal reliance by distinguishing sufficiency, completeness, and interventional necessity; this sharpens the artifact graph’s private-reasoning, reported-rationale, action-trace, receipt, and authoritative-effect boundaries.	The paper’s metrics and training interventions are model- and task-bounded; they do not make a chain of thought a receipt or prove local record-reality faithfulness. No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.
ext_swe_rebench_v2_2026	Passage-reviewed comparator: SWE-rebench V2: Language-Agnostic SWE Task Collection at Scale. Supplies concrete source, repository, base-commit, solution-patch, test-patch, image, parser, and test-transition identities that a replayable repository task must bind.	Dataset records and image manifests do not prove local replay, independent evaluation, authority-to-effect linkage, or rollback completeness. No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.
regret_engine	Passage-reviewed Corben architecture source: The Regret Engine: Governed Counterfactual Learning Signals for Continual Adaptation, Prospective Risk Control, and Self-Correction in Artificial Agents. Corben-authored August 2026 conceptual architecture and research program for decision-time-fair Governed Counterfactual Regret, immutable Decision Capsules, admissible comparator contracts, sparse Regret Tensors, append-only Regret Packets, prospective regret control, regret-aware replay, regret-to-rule compilation, three update clocks, root-cause adjudication, and bounded update leases. Existing chapters are upgraded first; no implementation, experiment, reproduction, causal-identification result, formal proof, safety result, support transition, SOTA, AGI, or ASI is inferred.	The bibliography and Markdown figure companions were not supplied; the DOCX embeds its visual material. All propositions, algorithms, experiments, and architecture claims remain proposed rather than independently validated. No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.
ext_openclaw_agent_runtime_2026	Passage-reviewed comparator: OpenClaw Gateway, Agent Runtime, ACP, and Self-Learning Architecture. Supplies a current implementation comparator for serialized per-session execution, session-generation-checked transcript writes, bounded lifecycle/tool audit projection, and the separation between OpenClaw session identity and external ACP harness resume identity.	Official software and documentation review only; metadata-only audit projection is not replay-complete, ACP execution is not wrapped by the OpenClaw sandbox, and no trace, effect, replay, reliability, or security result was reproduced. No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.
assurance_shift_learning	Passage-reviewed comparator: When Success Stops Teaching: Assurance-Shift Learning and Governed Residual Boundary Learning for Mature AI Systems. Adds Boundary Evidence Bundle lineage, append-only lifecycle, supersession, repair descendants, preserved prefixes, counterexamples, and replay provenance.	A complete-looking bundle does not establish source truth, causal adequacy, or receipt faithfulness. No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.
adjudicated_persistence	Passage-reviewed comparator: Lineage for persistence transactions. Adds lineage requirements connecting experience, lesson, disposition, realization, qualification, authority, descendants, invalidation, and residuals.	Used only to specify lineage links among persistence objects and descendants; no replay completeness, causal recovery, or residual closure was demonstrated. No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.

46.17 Post-v2 record/reality result

The governed-work flagship now contributes 16 content-addressed plan/code run records, raw public-safe outputs, independent subprocess observations, fresh Git worktree identities, observed changed paths, candidate-byte receipts, first/final effect digests, four discovered governed residuals, eight exact rollbacks, and two visibly failed rollbacks. The validator reconstructs every route from retained candidate bytes and rejects outcome-erasing mutations.

This is stronger adjacent local replay evidence than a record-shape fixture, but it remains a bounded disposable workload operated inside one project. It does not establish open-world provenance completeness, verifier correctness, deployed audit durability, or external institutional independence. The core claim remains argument; the transition is no_change.

46.18 Post-v2.1 state and effect replay

Two successor results sharpen record/reality scope. The governed-work arm retains all candidate bytes, route decisions, observations, and pre/post-effect digests, but four of 36 attack-control rollback receipts fail exact replay. The update campaign separately re-observes fifteen complete state trees and restores all 24 declared surfaces in every seed-arm transaction. It also records lineage propagation for deletion-aware retraining while explicitly retaining the immutable source corpus. The artifact graph must therefore name which inventory a receipt covers: exact local state replay can coexist with inexact repository-effect rollback, persistent storage, and no external transfer. The accepted transitions are bounded narrow results, not evidence of open-world provenance or storage erasure.

46.19 Summary

Artifact Graphs, Audit Logs, and Replay owns durable identity, derivation, record-reality custody, replay grade, and impact closure for work products. The eighteen reviewed sources constrain that design through architecture lineage, provenance and metadata standards, signed attestations, workflow and recovery comparators, faithfulness research, and five historical projects. They do not establish local deployment or superiority.

The current repository surface is unusually broad but deliberately bounded: two schemas, ten fixture and observation families, eight no-promotion decisions, two historical service observations, and fifty finite Lean declarations under ten targets, with eight weak declarations retired. It proves only exact record, route, digest, command, service, and formal consequences. The core stays at argument until a natural multi-repository campaign measures lineage, receipt reality, replay, reverse closure, rights and deletion, useful reuse, false blocking, complete cost, causal contribution, independent reproduction, and transfer against strong matched comparators.

This is how execution becomes memory without becoming myth: the artifact graph records what happened, what can be replayed, and what remains uncertain. From there the execution layer reaches its most dangerous boundary: the adapter that turns a job into an external effect.

The later compression and semantic-representation chapters depend on this contract. A compressed artifact can only be trusted relative to the full artifact and replay record it points back to. A semantic node can only be grounded relative to the artifact or source record it cites. The graph is therefore not a storage accessory; it is the continuity layer that lets the stack improve without losing the chain of responsibility.

46.20 Evidence reconciliation (2026-07-16)

The invariant protocol, field meanings, and inference limits are stated once in Living Book Methodology. This packet contains only the chapter-specific projection; its authoritative per-atom rows are the artifact-graphs-audit-logs-and-replay slice of experiments/claim_family_terminal_coverage/results/result.json.

The core remains blocked after full attempt at argument support. The strongest family attempt was Situated world-model acquisition and consolidation campaign. Its exact boundary is: Bounded finite POMDP result only; no open-world truth, general memory transfer, deployment, or chapter-core promotion. Across 81 atoms, the terminal ledger records 81 blocked_after_full_attempt.

Chapter-specific field	Value
Family / atom denominator	CF-04 / 81 atoms
Terminal dispositions	81 blocked_after_full_attempt
Core	artifact-graphs-audit-logs-and-replay.core: blocked_after_full_attempt at argument
Core attempted / missing lanes	source-synthesis / causal, empirical, executable, formal, normative, transfer
Attempted local lanes	source-synthesis
Missing or unproved lanes	causal, empirical, executable, formal, normative, transfer
Strongest family bundle	Situated world-model acquisition and consolidation campaign (natural_work_and_end_to_end): Two partially observed environments, 11,250 episodes, 6,000 held-out episodes, six directional ablation signatures, and governed replacement/rollback.
Negative controls	ten arms; six matched ablations; ten laundering mutations; replacement and rollback checks.
Accepted transitions	none
Maximum inference	Bounded finite POMDP result only; no open-world truth, general memory transfer, deployment, or chapter-core promotion.
Reproduction / next burden	Replay scripts/validate_p4_m8_world_model_campaign.py and scripts/validate_claim_family_terminal_program.py; fill the named atom-specific lanes under a new prospective protocol.

46.21 Handoff

Artifact graphs preserve internal continuity, but some jobs must cross the boundary into tools, runtimes, deployments, filesystems, networks, or human-approved effects. Runtime Adapters, Tool Permissions, and Human Approval governs that edge. It separates request, approval, invocation, effect receipt, verification, rollback handle, and irreversible residual so external action remains traceable after it leaves the artifact graph.