Skip to main content

47  Runtime Adapters, Tool Permissions, and Human Approval

47.1 Chapter status

Field	Value
Chapter ID	runtime-adapters-tool-permissions-and-human-approval
Part	Part II - Planning, Memory, Reasoning, and Execution
Status	conceptual
Manuscript maturity	v0.3 claim-proof program
Last updated	2026-07-26
Primary source records	all twenty-six assigned architecture, operator, human-factors, distributed-systems, security-evaluation, historical-project, recovery, QCSA, and Reflexive Router mappings
Claim label	Design rationale
Evidence level	argument
Source queue	primary: talos, viea; supporting: ladon_manhattan, software_magic_grimoire, genesiscode, field_of_god_ai_constitution, theseus_operator_os, moecot_manifest_project, beastbrain_project, bugbrain_project, corbens_trainer_project, corbens_best_model_possible_project, reflexive_router_whitepaper; external comparator: ext_cap_theorem_gilbert_lynch_2002; connector/recovery: moecot
Source loading state	source notes: talos, deterministic_capability_compilation, platonic_world_model, viea, ladon_manhattan, software_magic_grimoire, genesiscode, moecot, field_of_god_ai_constitution, theseus_operator_os, ext_humans_automation_1997, ext_ironies_automation_1983, ext_levels_automation_2000, ext_complacency_bias_automation_2010, ext_cap_theorem_gilbert_lynch_2002, ext_inspect_ai_2024, ext_agentdojo_2024, ext_camel_prompt_injection_2025, ext_owasp_agentic_top_10_2026, moecot_manifest_project, beastbrain_project, bugbrain_project, corbens_trainer_project, corbens_best_model_possible_project, ext_claw_swe_bench_2026, ext_txfs_2018, qcsa_whitepaper, reflexive_router_whitepaper, ext_elizaos_agent_runtime_2026, ext_hermes_agent_2026, ext_openclaw_agent_runtime_2026; raw cache: talos, viea, ladon_manhattan, software_magic_grimoire, genesiscode; connector/recovery: moecot
Test state	Runtime adapter fixture validation now includes invocation state, impact class, risk tier, approval scope/expiry, effect lease, pre/post state refs, external side effects, verification refs, irreversible residuals, incident/audit refs, support-state effect, non-claims, and authority probes; finite permission, approval, effect-lease, rollback-obligation, authority-ceiling, confused-deputy, sandbox-escape, effect-receipt, dispatch-route, effect-replay, adversarial-boundary, revocation-route, and human-oversight degradation predicates plus negative-case theorems are implemented in AsiStackProofs.RuntimeAdapters for missing parent-job permission, high-impact unapproved adapter calls that try to remain unrejected, missing scoped approval, mismatched effect leases, expired leases, revoked leases, unsandboxed leases, over-ceiling requested authority, confused-deputy attempts, sandbox-escape attempts, high-impact rollback-required calls without rollback handles, revoked approvals and authority receipts without no-mutation denial evidence, missing effect receipts, missing no-mutation evidence, inexact rollback, repository/network side effects, support-state effects, parentage mismatch, approval expiry, sandbox path escape, secret materialization, missing audit refs, missing non-claim boundaries, reviewer overload, rubber-stamped approval, alarm fatigue, and automation-bias contradictions; python3 scripts/validate_runtime_adapter_permissions.py checks 2 valid and 7 expected-invalid synthetic typed-job, adapter-invocation, authority-use-receipt, and authority-probe scenarios; the Runtime adapter effect replay probe (python3 scripts/validate_runtime_adapter_effect_probe.py) checks valid_low_impact_local_write_effect_replay, a rollback-exact temp-file restoration, invalid_missing_permission_no_mutation, and invalid_expired_approval_no_mutation; the Runtime adapter adversarial boundary probe (python3 scripts/validate_runtime_adapter_adversarial_boundary_probe.py) checks two valid synthetic adapter boundary reviews and twelve expected-invalid controls without support-state promotion; the Human oversight degradation fixture (python3 scripts/validate_human_oversight_degradation.py) writes experiments/human_oversight_degradation/results/2026-07-03-local.json; evidence_transitions/v1_x_measured/human_oversight_degradation_no_change.json records an accepted blocks_promotion no-change decision for approval-workflow, reviewer-correctness, alert-quality, deployed-human-factors, runtime-adapter-safety, and chapter-core promotion claims; and the partitioned authority fixture (python3 scripts/validate_partitioned_authority_fixture.py) writes experiments/partitioned_authority/results/2026-07-03-local.json with stale-grant, fresh authority receipt, grant/effect race, no-mutation evidence, and CAP-style authority consistency checks. Deployed adapter execution, sandbox isolation, approval-service behavior, reviewer correctness, deployed human-factors behavior, secret-handle safety, rollback-service behavior, deployed partition tolerance, distributed consensus, revocation propagation, policy-enforcement correctness, and security review remain untested.

47.2 Drafting guardrail

The runtime-adapter layer treats adapters as effect-boundary records, not as proof that tools were safely executed. The repo validates an adapter-invocation fixture and now proves finite permission, approval, effect-lease, rollback-obligation, authority-ceiling, confused-deputy, sandbox-escape, effect-receipt, dispatch-route, effect-replay, adversarial-boundary, revocation-route, and human-oversight degradation predicates with negative cases for missing parent permission, high-impact approval bypass, missing scoped approval, mismatched leases, expired leases, revoked leases, unsandboxed leases, over-ceiling requested authority, confused-deputy attempts, sandbox-escape attempts, revoked approvals or authority receipts without no-mutation denial evidence, missing rollback handles, missing effect receipts, missing no-mutation evidence, inexact rollback, repository/network side effects, support-state effects, parentage mismatch, approval expiry, sandbox path escape, secret materialization, missing audit refs, missing non-claim boundaries, reviewer overload, rubber-stamped approval, alarm fatigue, and automation-bias contradictions. The synthetic harness now adds expected-invalid ambient-authority confused-deputy and revoked-receipt probes. The separate Runtime adapter effect replay probe executes one generated public-safe temp-file write in a temporary workspace, records pre/post/rollback hashes, verifies rollback-exact restoration, and denies invalid_missing_permission_no_mutation plus invalid_expired_approval_no_mutation. The Runtime adapter adversarial boundary probe adds two valid synthetic adapter boundary reviews and twelve expected-invalid controls. The Human oversight degradation fixture adds three valid finite records and seven expected-invalid controls grounded by source notes for automation use/misuse/disuse/abuse, automation irony, automation levels, complacency, and automation bias; the accepted no-promotion decision evidence_transitions/v1_x_measured/human_oversight_degradation_no_change.json now makes the promotion block explicit for approval-workflow, reviewer-correctness, alert-quality, deployed-human-factors, runtime-adapter-safety, and chapter-core claims. The partitioned authority fixture adds finite stale-grant, fresh-authority-receipt, grant/effect race, no-mutation-evidence, and CAP-style authority consistency checks at the hives/runtime boundary. All twenty-five assigned source mappings are reviewed at bounded scope. These probes still do not inject a secret, enforce a live approval service, enforce a production sandbox, measure reviewer correctness, test deployed human-factors behavior, prove deployed partition tolerance, propagate revocation in a deployed service, exercise a rollback service, or prove deployed adapter safety.

All twenty-five assigned mappings are now reviewed at their exact boundary. This layer owns the leased dispatch, independent observation, containment, and terminal receipt of an external effect. It does not own objective or plan correctness, principal or policy authorship, permission or approval legitimacy, context truth, artifact truth, mode-specific verification, evidence acceptance, support, readiness, or release. The current sixty-eight Lean declarations under six public targets retain forty-three finite predicate, route, negative-case, and summary results and add twenty-five reachable invariant, rollback, noninterference, countermodel, and authority-refinement results. No current record or theorem changes core support.

The runtime-adapter layer sits after artifact graphs so the reader already has the evidence surface in mind before the book turns to external effects. The runtime adapter is the narrow point where a typed job may receive authority, use a tool, produce an effect receipt, and hand evidence back to the artifact graph.

47.3 Human Reading Path

Concrete lens. The approval-token baseline reuses an old receipt. The adapter path rechecks lease epoch at dispatch and observes the effect afterward.

Artifact graphs record work, but runtime adapters create external effects under authority. The adapter is the boundary where a typed job may touch tools, files, networks, deployments, payments, credentials, hardware, or external systems under permission and approval.

This is the stack’s narrow waist for action. A plan can be brilliant and a job well typed, but external effect still needs an authority envelope, approval scope, effect lease, pre/post state, incident path, and residual record. The promise is action whose authority, evidence, and rollback surface are visible before harm compounds.

Denial is part of the product. The adapter should make action slower when the missing piece is permission, not intelligence, and it should leave a receipt for what was allowed, refused, approved, constrained, and reviewed. Approval matters when the adapter waits, preserves context, and resumes without treating pause as failure.

Human oversight degradation is the case where the approval gate itself becomes unreliable. A tired reviewer, a template-only approval, a noisy alert stream, or an unchallenged system recommendation should route to delay, reviewer rotation, independent evidence checking, or blocked dispatch.

47.4 Problem

Plans become real-world effects only through tools, runtimes, deployment adapters, and approval gates.

Typed jobs are still inert until a runtime adapter performs an effect. The runtime adapter is the boundary where work touches tools, APIs, filesystems, services, hardware, fabrication targets, organizational workflows, or deployment environments. The adapter is where permissions, sandboxing, approvals, secrets, result evidence, and rollback handles must be enforced.

Talos supplies the controlled runtime and approval discipline. Ladon supplies handle-mediated authority and secret isolation. GenesisCode supplies capability boundaries and effect logs. Theseus Operator OS adds the operator-surface requirement: mutating actions should be visible, bounded, and revocable.

The adapter boundary is where the stack stops being interpretive. A claim can be wrong without changing the world. A plan can be flawed without deleting a file. A route can be inefficient without spending money. Once an adapter runs, the system may have produced an external fact. That transition should be narrow, auditable, and reversible where possible.

Within the governed-cognition pattern, the runtime-adapter layer owns the external-effect delta. Here the shared record stops being descriptive and becomes a dispatch gate: permission, approval, lease, sandbox, secret handle, pre-state, post-state, rollback handle, residual, and effect receipt must be present before cognition can mutate outside state. Other layers can route work toward action; the runtime-adapter layer defines why action is a leased, audited effect rather than another thought.

47.5 Why existing approaches are insufficient

Tool calling without a permission and approval model turns reasoning errors into side effects.

A tool call is not just cognition. It can delete a file, spend money, send a message, deploy code, move a robot, leak a secret, or change an institutional state. If approval and permission are implicit, every planning error can become a real-world action.

External baselines split the adapter problem into several known pieces. The off-switch game (ext_off_switch_game_2016) frames correction and shutdown incentives, ReAct (ext_react_2022) ties reasoning to action and observation, TAMP (ext_integrated_tamp_2020) and behavior trees (ext_behavior_trees_robotics_ai_2017) expose action interfaces and reactive control, Dafny (ext_dafny_2010) and proof-carrying code (ext_proof_carrying_code_1997) foreground specifications and checkable obligations, and runtime-assurance work such as Black-Box Simplex (ext_black_box_simplex_2021) and Copilot (ext_copilot_runtime_monitor_2010) shows monitored control boundaries. Runtime adapters turn those baselines into permission, approval, receipt, and rollback fields; no deployed adapter assurance case is claimed.

The right boundary is not “never call tools.” It is “call tools through adapters whose capabilities, approval requirements, authority handles, result evidence, and rollback options are explicit.”

Runtime adaptation is where intention stops being enough. A typed job can describe what should happen, and a plan can explain why it should happen, but neither one should receive ambient authority. The adapter grants a narrow effect lease: this capability, for this target, under this sandbox, with this approval state, producing this evidence and these residuals. Anything outside that lease is a denial, escalation, or new request.

Human approval should also be treated as a structured artifact, not a vague blessing. The approval record says what was approved, by whom or by which role, under what scope, for which risk tier, and with what expiration or revocation path. Otherwise approval becomes a ritual that hides responsibility instead of a control surface that can be audited.

Approval is not a transfer of authorship. A human may approve a bounded action without approving every downstream reuse of the result, every future route that resembles it, or every policy update trained on it. The approval artifact should therefore expire, name the approved target, and state whether reuse, publication, deployment, or training use is permitted.

The human approver is also a component with failure modes. Human-factors literature on automation use, misuse, disuse, abuse, automation irony, levels of automation, complacency, and automation bias gives the book an external vocabulary for a local design rule: a high-impact adapter should not accept approval when the reviewer is overloaded, rubber-stamping, overwhelmed by false alarms, or following an automation recommendation that contradicts visible evidence without an independent check. This is human oversight degradation, and it belongs inside the adapter boundary instead of in a vague “human in the loop” slogan.

The distributed version of the same problem is partitioned authority. If an adapter can act on one machine while approval, revocation, or lease state is changing elsewhere, a stale grant can look available even when it is no longer safe. The adapter boundary therefore needs a fresh authority receipt for protected effects after partition healing, and it needs no-mutation evidence when revocation or expiry was observed too late. The CAP-theorem comparator (ext_cap_theorem_gilbert_lynch_2002) is used here only to state the consistency/availability pressure; it does not prove this runtime layer has distributed consensus, deployed partition tolerance, or revocation propagation.

47.6 Core Claim

[runtime-adapters-tool-permissions-and-human-approval.core, label: Design rationale, support: argument] Runtime adapters should enforce typed permissions, sandboxing, human approval, and post-action evidence capture.

Reader claim. A tool adapter is the last place to stop an unauthorized effect and the first place to record what actually happened; planning-time approval is not enough.

Operational rule. Immediately before dispatch, recheck caller identity, active lease, target, operation, permission, approval, epoch, secret handle, sandbox, and rollback pre-state. After dispatch, independently observe the effect; revocation blocks later events and rollback must name what it restored and what remains.

47.6.1 Worked adapter trace: approval is valid, then the lease is revoked

A repository adapter receives approval to update one generated file. Before dispatch it confirms the exact caller, target, permission, active epoch, secret handle, pre-state digest, and rollback path. The write commits and an independent read binds the observed post-state. The grant is then revoked. A queued second write carries the old approval receipt, but its lease epoch is stale, so the adapter denies it without mutation. Rollback of the first write restores the recorded baseline and preserves the effect and observer receipts.

The local model contains a six-event witness to exact modeled baseline restoration and eleven countermodels covering permission, identity, authority, expiry, secrets, dispatch, pre-state, revocation, and rollback failures. The harness also checks two valid and seven expected-invalid fixtures. It trusts its OS, sandbox, secret, service, and observer fields, so the trace does not establish hardware enforcement, reviewer competence, distributed revocation, target-service truth, or effect-complete rollback.

The claim remains at argument support. Talos supplies adapter and approval discipline; VIEA supplies intent-to-runtime and feedback boundaries; Ladon/Manhattan supplies handle-mediated secret use; GenesisCode supplies capability-mediated effects and replay logs; Software Magic Grimoire and Theseus Operator OS supply workflow and operator-surface pressure. MoECOT remains a connector implementation-reference route, not local execution evidence.

47.6.2 Claim-source mapping status

Appendix C maps all twenty-five assigned sources at their reviewed local-cache, public-project, source-note, or local-whitepaper boundary. Together they support typed effects, capability and secret mediation, approval and human-factors pressure, partitioned authority, adversarial tool-use evaluation, control/data separation, threat coverage, rollback, and receipt design. They do not establish safe tool execution, sandbox enforcement, approval correctness, secret isolation, or SOTA performance in this repository.

Source	What it supports	Review state	Limit
talos	Typed jobs, tool isolation, contract locks, human approval, blind handles, Digital SCIFs, evidence records, audit logs, replay, tests, residuals, and regressions.	passage-reviewed local raw cache	No live adapter runner, approval service, sandbox, security test, or Talos runtime result has been reproduced.
viea	Structured command contracts, runtime adapters, verified outputs, deployment feedback, residuals, tools, benchmarks, and regression coverage.	passage-reviewed local raw cache	No deployed runtime adapter, feedback loop, or verified VIEA execution trace exists here.
ladon_manhattan	Hardened secret managers, opaque credential handles, policy-mediated injection, ephemeral compartments, zeroization, outbound-call interception, and side-channel assumptions.	passage-reviewed local raw cache	Security architecture only; no Ladon implementation, kernel-level test, side-channel validation, or security audit exists here.
software_magic_grimoire	Guarded entry/exit rules, handoff artifacts, verification and failure behavior, incompatible-mode separation, evidence-advancing loops, and scoped recursion.	passage-reviewed local raw cache	Workflow vocabulary only; does not prove adapter enforcement, approval quality, or tool safety.
genesiscode	Authenticated privileged protocol variants; explicit effect programs; deny-by-default host capabilities; ordered allow/deny and response records; AI calls as governed effects; replay mismatch; and the distinctions between token origin and authority, hash verification and response-complete replay, observed-path coverage and full mediation.	full three-tab section-family audit	No seal issuer/custody system, capability runner, sandbox, complete effect transcript, replay checker, bypass analysis, OS enforcement, model-call reproduction, or security proof exists.
moecot	Specialist lanes, fail-closed control-plane ledgers, readiness gates, replay, handoff, promotion blockers, and authority-sensitive runtime orchestration.	authenticated connector text passage-reviewed	Runtime artifacts and benchmark/replay logs remain uninspected and unreproduced.
field_of_god_ai_constitution	Governed tool use, power, memory, delegation, consent, reversibility, least sufficient power, risk tiers, auditability, human review, and no self-authorization.	passage-reviewed local public-project source	Constitutional specification only; no runtime policy engine, red-team suite, system-prompt evaluation, or proof was run here.
theseus_operator_os	Shared command vocabulary, durable work board, node registry, background/watch/wake contracts, skill registry, tool hooks, feedback routing, TTLs, kill switches, signed updates, and isolation.	passage-reviewed local public-project source	No Hive board, SQLite database, node registry, command channel, hook ledger, or dashboard was run from this repository.

47.7 Mechanism

A runtime adapter is the authority chokepoint between cognitive work and external effects. The model may propose an action, and the job may carry a contract, but only an adapter can touch files, APIs, services, deployment surfaces, hardware, fabrication systems, credentials, or organizational workflows. Talos supplies the controlled runtime discipline, VIEA supplies the intent-to-runtime feedback boundary, Ladon supplies opaque handles for sensitive authority, GenesisCode supplies capability-mediated effects, and the Theseus Operator OS supplies the operator-visible surface for mutating work.

A Runtime Adapter Invocation therefore has to be more than a function call. It is a permission decision, sandbox decision, approval decision, authority-handle decision, effect receipt, rollback/residual record, and artifact-graph handoff.

The complete effect contract has eighteen mechanisms:

1. Freeze invocation, job, attempt, adapter, target, operation, requester, consumer, consequence, risk, authority, rights, budget, deadline, expiry, policy, and environment identities before outcomes.
2. Classify target type, effect class, impact, reversibility, visibility, affected parties, data sensitivity, secrets, and recovery objective.
3. Validate exact contract, plan, job, attempt, principal, delegation, authority ceiling, approval policy, lifecycle, and blockers.
4. Resolve an envelope over executable/digest, arguments, objects, paths, network, APIs, data fields, clock, randomness, environment, secrets, hardware, rate, cost, retention, and delegation.
5. Bind stable target/input identity, provenance, context transaction, taint, rights, freshness, policy, and pre-state; aliases and semantic neighbors cannot substitute for the authorized object.
6. Intersect parent authority, principal delegation, capability and target policy, security state, data/rights policy, risk, budget, and revocation; the adapter cannot mint a grant.
7. Keep semantic resolution, certificates, discovery, model confidence, and intent interpretation separate from authorization.
8. Require structured approval with target, operation, scope, inputs, risk, reversibility, evidence view, approver competence and authority, expiry, revocation, reuse, appeal, and non-claims.
9. Assess reviewer workload, approval streak, alert and rationale quality, contradiction, automation recommendation, independent evidence, conflict, fatigue, rotation, delay, and escalation.
10. Issue a purpose-bound effect lease over capability, target, scope, authority, sandbox, secrets, time, rate, cost, idempotency, retry, revocation, partition, and delegation.
11. Provision and independently identify the enforcement environment, sandbox, process/container boundary, filesystem/network policy, secret broker, resource limits, observation hooks, cleanup, and attestation.
12. Capture pre-state, expected post-state, effect inventory, verification, checkpoint, rollback/compensation, irreversible-residual forecast, incident route, and abort conditions.
13. Dispatch the exact adapter, executable, arguments, inputs, target, lease, and environment with duplicate-effect and confused-deputy defenses.
14. Independently observe actual reads, writes, messages, calls, flows, secret uses, costs, outputs, errors, side records, post-state, and downstream effects.
15. Route denial, timeout, crash, partial effect, partition, stale grant, revocation race, lease/observer loss, escape, secret exposure, unknown outcome, and intervention to typed custody.
16. Roll back, compensate, revoke, contain, clean up, or quarantine while preserving copies, disclosures, messages, physical effects, descendants, recovery time, failed restoration, and residuals.
17. Issue a terminal receipt binding request, parentage, authority, approval, lease, sandbox, secrets, actual effects, state, verification, rollback, incidents, costs, artifact refs, support ceiling, and non-claims.
18. Compare direct tools, prompt-only controls, OS/container sandboxes, capability systems, policy-mediated calls, human approval, workflow engines, CaMeL-like separation, AgentDojo-like attacks, Inspect-like harnesses, and the full adapter under matched natural work.

flowchart LR
  A["Typed job"] --> B["Adapter contract"]
  B --> C["Capability check"]
  C --> D["Authority / secret handle"]
  D --> E{"Approval required?"}
  E -- "yes" --> F["Human approval record"]
  E -- "no" --> G["Sandboxed invocation"]
  F --> G
  G --> H["Effect receipt"]
  H --> I["Rollback handle / residual"]
  I --> J["Artifact graph"]
  J --> K["Incident monitor or approval audit"]

Reading the adapter invocation: The adapter invocation is the authority chokepoint between a typed job and an external effect. Capability checks, secret handles, approval records, sandboxing, effect receipts, rollback handles, and residuals are all explicit so a tool call cannot masquerade as ungoverned action.

The adapter maps a typed job to a declared target type, capability, permission requirement, sandbox mode, and input/output contract. Authority handles stay outside model-visible context until policy, destination, and approval checks authorize use. High-impact actions such as irreversible deployments, external messages, monetary transfers, credential use, safety-relevant hardware, and institutional state changes fail closed without approval. Every invocation returns an effect receipt, a rollback handle where one exists, residuals where rollback is unavailable, and audit events for the artifact graph.

Adapters should declare target type, capability, permission required, sandbox mode, impact class, risk tier, approval requirement, approval scope, approval expiry, input/output contract, authority handles, effect lease, expected evidence, rollback handle, irreversible residuals, and post-action audit events. The tool itself is not the policy boundary; the adapter is.

High-impact actions include irreversible deployments, external messages, monetary transfers, credential use, safety-relevant hardware, and institutional actions. These should fail closed without approval.

The adapter’s evidence is as important as the effect. A successful call should leave enough receipt material for replay, review, or incident response. A failed call should leave the denied capability, policy reason, residual, and recovery path. A partially reversible call should say which part can be rolled back and which part becomes an external residual. That discipline lets procedural-memory chapters later learn from tool use without turning every successful-looking action into a reusable procedure.

47.7.1 Capability envelope and replay grade

The word sandboxed is too coarse to carry authority. A capability envelope names the exact executable and digest, readable prefixes, writable prefixes, network mode and endpoints, clock mode, randomness mode, environment keys, and secret-handle references. Each observed probe is compared against that envelope. A path prefix does not imply network denial; a deterministic random seed does not imply wall-clock denial; and a process that happened to stay inside its declared paths does not establish that the operating system forced it to do so.

Replay also needs a grade. Record playback reads an old receipt. Deterministic simulation reruns a model of the effect. Bounded live reexecution performs and reobserves the effect in a disposable scope. Deployed live reexecution further binds the same executable digest and an observed enforcement environment. The existing temp-file probe reaches only bounded live reexecution: it reobserves a write and rollback, but it does not independently bind the executable digest or observe an OS sandbox.

The historical-project lineage sharpens the boundary. MoECOT Manifest supplies typed effect, manifest, and replay records; BeastBrain and BugBrain supply negative cases where interface declarations or simulated checks can look like enforcement; Corben’s Trainer supplies quarantine and revocable evidence pressure; and Corben’s Best Model Possible supplies playback/live-replay and runtime-causality failures. They are one related local lineage, not independent replications or proof that a sandbox existed.

The strongest objection is that an exact envelope can be perfectly specified and still be ignored by the process or kernel. That is correct. The envelope is a policy and observation contract, not enforcement evidence. The record may authorize an OS-enforcement claim only when an identified sandbox instance and its probes were observed. Until then, it remains a bounded probe, ordinary dispatch stays blocked, and irreversible residuals remain explicit even when none were observed in the toy run.

47.7.2 Protocol authenticity, capability coverage, and replay-complete effects

GenesisCode’s sealed EFFECT, ERROR, and UNHANDLED variants improve on magic strings: ordinary model or program data cannot impersonate a privileged control response merely by sharing its shape. The boundary is authentication, not permission. Effect admission still intersects authenticated principal, delegation, operation, target, capability, policy, scope, consequence, approval, lease, sandbox, and revocation. Issuing or sharing the seal token is itself an authority event and requires custody, rotation, revocation, and incident semantics.

The source proposes a replay entry with request hash, allow/deny decision, response hash, capability identity, and optional response data. “Optional” is the critical fault line. A digest can verify a response supplied from elsewhere; it cannot reproduce a missing value. Deterministic replay therefore requires the response bytes or an immutable content-addressed reference with declared availability. If privacy, secrecy, licensing, size, or deletion policy prevents retention, the record must fall to verification-only, semantic, partial, or non-replayable status rather than call a response hash replay.

Request identity also binds the exact program and canonical semantics, captured continuation environment, dependencies, Prelude/runtime, initial state, capability and policy versions, effect index, and ordered prior effects. For a model call, prompt bytes, system/tool/context state, provider route, model revision, parameters, and returned artifact custody all matter. Reusing a cached response reproduces downstream reduction from that response; it does not reproduce the remote generation event.

Finally, “declared capabilities cover observed effect operations” is a trace property. It does not cover an unexecuted branch, adversarial input, dependency, reflection, FFI, or bypass path. The receipt distinguishes static effect-row or whole-program coverage, runtime reference-monitor enforcement, observed trace coverage, adversarial tests, and OS or hardware enforcement. A clean trace can support only the lane it actually observed.

The invocation lifecycle is:

sequenceDiagram
  participant Job as Typed job
  participant Adapter as Runtime adapter
  participant Policy as Policy/approval
  participant Tool as Tool or service
  participant Ledger as Artifact graph
  Job->>Adapter: Request capability and target
  Adapter->>Policy: Check permission, risk, scope, expiry
  Policy-->>Adapter: Deny, approve, or require escalation
  Adapter->>Tool: Invoke only within approved lease
  Tool-->>Adapter: Effect, error, or partial result
  Adapter->>Ledger: Receipt, rollback handle, residuals, audit refs

The lifecycle keeps three artifacts separate: the job request, the approval decision, and the effect receipt. Merging them is a common source of overclaiming. A job request is not approval. Approval is not proof that the effect succeeded. A successful effect is not permission to promote the route, reuse the procedure, or discard rollback obligations.

47.7.3 Semantic resolution never grants authority

QCSA introduces a hard separation between recognizing an operation and being allowed to perform it. Resolving a phrase to a deletion concept, finding a tool under a privileged semantic address, or receiving a signed Semantic Address Certificate does not grant delete authority. The adapter must independently bind authenticated actor and delegation, stable target identity, operation and scope, data sensitivity, reversibility, policy version, approvals, execution boundary, verifier, fallback, and effect receipt.

This blocks alias and neighbor escalation. An adversary cannot obtain a capability merely by inducing a benign label, moving an object near a trusted cluster, or exploiting a stale atlas path. The physical route compiler must intersect semantic content with the capability and policy graph, then record which authority predicate admitted or denied the effect. Cross-facet conflict, stale epoch, inadequate identity, missing permission, or unresolved migration must block or escalate before effect.

The bounded implementation now tests this separation directly. Full QCSA produced zero unsafe releases on the synthetic authority fixtures; removing certificate, residual, and authority fields produced nine unsafe releases across 180 seeded records. In the governed vertical trace, semantic resolution prepared a request, a separate policy allowed one reversible temporary-file write, an independent byte reader observed it, and rollback restored the exact pre-state. Scope widening, irreversible effect, stale epoch, certificate tampering, missing receipt, and hidden-effect paths all failed closed.

That result promotes only the exact field-separation and receipt mechanism finding to a non-core synthetic-test-backed state. The approval identifier is a fixture, the effect is temporary and public-safe, no external human or deployed policy service participated, and a single exact rollback cannot establish effect-complete recovery in an open system. Permission correctness, human-approval quality, production safety, and this core claim remain at argument.

47.7.4 Grounding witnesses and environmental evidence

The Platonic World Model treats a classifier, sensor, database query, theorem prover, simulator, or skill as a qualified grounding witness. Its contract names domain, calibration, output evidence, known failures, version, latency, and expiry. Recognition does not define the concept, and agreement among models with a shared training lineage does not count as independent corroboration.

Deterministic Capability Compilation adds a complementary rule for adaptation: the environment supplies evidence, not authority. Residual learners operate behind an independent gate and may narrow or improve behavior only inside a leased field and shield. Neither a new observation nor a better reward may expand tool permission, mutate the constitutional policy, or bypass the effect kernel. Prediction/observation disagreement remains visible and can trigger fallback, quarantine, or a governed update proposal.

47.7.5 The Effect Commit Kernel

The Reflexive Router draws a hard line between understanding an action and committing an effect. Natural-language interpretation, a learned router, a workflow compiler, or a direct capability command may propose a typed effect. Only a narrow Effect Commit Kernel may authorize, prepare, commit, observe, verify, record, compensate, or quarantine it. A direct command can skip action interpretation, but it cannot skip the kernel.

The kernel binds authenticated principal and delegation, stable target and pre-state, operation and typed arguments, policy and authority epoch, consequence and reversibility class, affected parties, approvals, sandbox or execution boundary, idempotency and retry lineage, expected postconditions, observer and verifier, rollback/compensation plan, expiry, and residual owner. Preparation is not execution; a tool’s success return is not observation; an observed change is not verification; and compensation is not erasure of an irreversible external effect.

Terminal custody must cover denied, prepared, committed, observed, verified, partially_effected, rolled_back, compensated, quarantined, and unknown_outcome. Retry is permitted only when the original attempt and observed effect state make duplication safe. Every committed or indeterminate path returns an effect receipt and feeds the typed result packet, Chronicle, artifact graph, residual ledger, and incident monitor.

This is the effect-boundary projection of the minimum trusted kernel and bounded liveness. Identity, authority, policy, observation, sandboxing, and rollback are trusted only to the exact extent required to admit or close the effect; their failures route to denial, unknown outcome, quarantine, compensation, or incident custody. Bounded liveness requires a finite terminal disposition and an owner for every unresolved effect, but it does not require unsafe retries or pretend that compensation restored the prior world.

This kernel is a proposed authority boundary, not a claim that the repository implements production enforcement. The source contains no deployed adapter, approval service, irreversible-effect campaign, or effect-complete rollback result; the runtime-adapter core remains at argument.

47.7.6 Three implementation comparators across one shared boundary

Current agent runtimes expose the same boundary through different component shapes. ext_elizaos_agent_runtime_2026 separates actions, providers, evaluators, services, memory, state, and scenario execution. Its action validation and handler split gives this chapter a concrete implementation anchor. The ASI Stack comparison then follows a wider transaction across principal, authority, actual effect, independent observation, and terminal custody; this broader join is outside the scope evaluated here, not a defect attributed to elizaOS. ext_hermes_agent_2026 adds command approval, file-write controls, container backends, context scanning, and staged approval for skill mutations. Those concrete controls anchor a second part of the boundary, while complete mediation and reviewer correctness remain separate questions that were not evaluated in this review.

ext_openclaw_agent_runtime_2026 makes another distinction explicit: sandbox placement decides where a tool runs, tool policy decides which tools exist, and elevation changes an execution route. These are independent axes. A permitted shell can still perform broad effects, and an ACP external harness is not wrapped by the parent sandbox even though gateway, agent, session, and delivery policies still apply. The ASI Stack therefore records each axis separately and binds each effect receipt to the enforcement owner that actually mediated it. These are scope comparisons, not project grades. elizaOS’s modular runtime and qualification design, Hermes Agent’s memory and approval surfaces, and OpenClaw’s identity and policy separation are valuable implementation anchors for practical agent infrastructure. Claims about local behavior await local execution or independent evaluation. Documentation review is the sole basis for this comparison; none of the three runtimes was executed in this repository.

47.8 Interfaces

Runtime work reaches tools through the Runtime Adapter Invocation.

1. Intent, Contracts, Planning, and Labor OS supply the exact authorized job, requester, plan node, consequence, risk, and lifecycle; adapters own effect dispatch, not objective or plan correctness.
2. Security kernels, identity, delegation, policy, and secret brokers issue and revoke principals, capabilities, authority ceilings, sandbox policy, and opaque handles; adapters cannot widen them.
3. VCM and Context Transactions supply exact input views, targets, taint, freshness, deletion, rights, and semantic certificates; availability and semantic resolution are not authority.
4. Artifact Graphs own identity, lineage, replay grade, audit reconstruction, receipt faithfulness, and impact closure; adapters emit observations and receipts into that custody.
5. Accountable humans and approval-policy owners own high-impact approval, reviewer qualification, exception, appeal, override, incident, and irreversible-effect decisions.
6. Privacy, Rights, Licensing, data owners, and affected-party governance constrain collection, access, disclosure, retention, deletion, export, redress, and derivatives.
7. Verification, proof, benchmark, and outcome evaluators own correctness and utility judgments; an effect receipt reports what happened, not whether it was wise or successful.
8. Resource Economics supplies compute, latency, rate, spend, storage, review, recovery, and displaced-work budgets with full denominators.
9. Inter-Stack Protocols supply remote principal, peer, credential, delegation, budget, revocation, dispute, and settlement records; protocol success is not local effect authority.
10. Replacement, Rollback, Readiness, and Publication decide promotion, deployment, recovery standing, external delivery, and release.
11. Incident response, monitoring, and operators consume denials, escapes, secret exposure, unknown outcomes, stale authority, rollback failures, residuals, and remediation duties.
12. Inspect AI, AgentDojo, CaMeL, OWASP, human-factors literature, CAP, workflows, sandboxes, and capability systems supply comparators and threat vocabulary, not local enforcement or SOTA evidence.

Minimum fields:

• invocation_id
• invocation_state
• job_id
• adapter_id
• target_type
• capability
• permission_required
• sandbox_mode
• impact_class
• risk_tier
• approval_required
• approval_record
• approval_scope
• approval_expiry
• authority_handle
• inputs
• effect_lease
• effect_receipt
• pre_state_ref
• post_state_ref
• external_side_effects
• verification_refs
• rollback_handle
• irreversible_residuals
• incident_refs
• audit_refs
• residuals
• support_state_effect
• non_claims

Execution owns adapters. Security mediates secrets and authority handles. Evidence records effect receipts, rollback handles, residuals, and deployment outcomes.

The adapter interface is also the point where human control stays attached to automation. A planner may request a high-impact action, but the adapter must know whether approval is missing, stale, insufficiently scoped, or contradicted by a newer policy. A security kernel may provide an opaque handle, but the adapter must not expose the secret bytes back into model context. The artifact graph may store the result, but it should store the permission and approval boundary with it.

47.8.1 Effect receipt fields

The effect receipt should distinguish:

Receipt field	Purpose
pre_state_ref	Identifies the state or artifact before the effect, when available.
post_state_ref	Identifies the state or artifact after the effect, when available.
external_side_effects	Records messages, deployments, payments, API calls, hardware actions, or institutional changes.
rollback_handle	Names the concrete rollback mechanism if one exists.
irreversible_residuals	States what cannot be undone.
verification_refs	Links to checks that the effect matched the contract.
incident_refs	Links to denial, exception, or partial-failure records.

This receipt structure keeps “tool call succeeded” from becoming a broad evidence claim. The adapter can report a successful API response while still leaving verification, rollback, or incident obligations open.

47.9 Invariants

1. Every invocation binds one exact job, attempt, principal, delegation, adapter, target, operation, capability, consequence, risk, authority, rights, policy, budget, expiry, environment, consumer, and owner.
2. Executable, arguments, reads, writes, network, APIs, data, clock, randomness, environment, secrets, hardware, rate, cost, retention, and delegation stay inside the intersection of current scopes.
3. Semantic resolution, aliases, addresses, certificates, discovery, model confidence, and intent interpretation never create or widen authority.
4. Target, input, context, policy, approval, authority, capability, lease, sandbox, secret, executable, and pre-state are fresh at dispatch or the gate reruns.
5. High-impact, external, privacy-sensitive, credentialed, irreversible, safety-relevant, financial, physical, or institutional effects require the exact current approval when policy requires it.
6. Approval is competent, informed, purpose-bound, scoped, expiring, revocable, non-transitive, and non-reusable by default.
7. Reviewer overload, rubber-stamping, alarm fatigue, automation bias, conflict, missing qualification/evidence, or visible contradiction cannot route directly to high-impact dispatch.
8. Effect leases are least-privilege, purpose-bound, time/rate/cost bounded, revocable, non-escalating, partition-aware, and preserved across retry, resume, delegation, and replay.
9. Declared scope, simulation, cooperation, or process observation cannot be labeled OS/hardware enforcement without an identified independent instance.
10. Secret values stay in the broker and authorized destination; context, logs, receipts, errors, artifacts, and prompts receive handles or bounded disclosures.
11. Actual reads, writes, calls, flows, messages, secret use, cost, outputs, errors, effects, state, and policy decisions remain independently observable within declared limits.
12. Queue, dispatch, tool return, status, file, API acknowledgement, approval, and receipt shape never replace effect observation and terminal custody.
13. Playback, deterministic simulation, bounded live reexecution, and deployed live reexecution remain distinct with exact executable, environment, effects, observers, and irreversible boundaries.
14. Revoked, expired, stale, partitioned, mismatched, over-ceiling, or unknown authority state blocks mutation until fresh authority or observed no-mutation closure exists.
15. Rollback and compensation inventory every local, remote, informational, financial, physical, organizational, copied, disclosed, and descendant effect; unhandled effects remain residuals.
16. Receipts separate request, approval, dispatch, observation, verification, rollback, incident, artifact, evidence, support, readiness, and release.
17. Denials, false refusals, missed help, approval delay, human work, sandbox and observer cost, partial effects, exposure, incidents, rollback failure, cleanup, and residuals remain in denominators.
18. Schemas, fixtures, finite theorems, temp-file writes, exact local rollback, synthetic tasks, frameworks, taxonomies, and green commands retain their exact evidence ceilings.

No adapter invocation is valid unless the parent job permissions include the adapter capability. A high-impact adapter call without approval is rejected before the tool receives authority.

The adapter boundary must preserve separation between request, approval, execution, and verification. A successful API response is not proof that the task was appropriate, authorized, or successful in the larger plan. Human approval must remain scoped to the named effect, duration, input, and risk class. If the effect is irreversible or externally visible, the record should preserve who approved it, what was known, what rollback was possible, and what residual remains.

47.10 Failure modes

1. Ambient tool authority permits effects without exact parent job, principal, capability, target, lease, policy, or receipt.
2. Capability overreach widens executable, arguments, objects, paths, network, APIs, data, clock, randomness, environment, secrets, hardware, rate, cost, retention, or delegation.
3. Semantic or alias escalation turns recognition, address proximity, discovery, rationale, or certificate into authority over another target.
4. Confused-deputy and delegation laundering use authority held by the adapter, service, human, or peer but never by the requester.
5. Prompt/data injection lets untrusted content alter policy, tools, arguments, destination, secret use, approval interpretation, or scope.
6. Approval bypass, laundering, reuse, expiry loss, coercion, capture, or self-approval converts a narrow or stale decision into broad authority.
7. Oversight degradation makes overloaded, unqualified, rubber-stamping, alarm-fatigued, biased, conflicted, or evidence-starved reviewers decorative.
8. Sandbox theater presents declared or cooperative scope as enforcement while escape, network, child-process, side-channel, or host paths remain reachable.
9. Secret-handle failure materializes credentials into context, logs, errors, artifacts, child processes, destinations, or retained memory.
10. Stale and partitioned authority dispatches on revoked grants, expired leases, unsynchronized policy, healed caches, or grant/effect races.
11. Unobserved-effect laundering omits calls, messages, disclosures, costs, copies, physical actions, side records, or delayed consequences.
12. Success and receipt laundering turns return, acknowledgement, file, approval, rollback handle, or receipt into correct, useful, safe, supported, or released work.
13. Replay laundering promotes playback or simulation to live reexecution, or a disposable bounded probe to deployed equivalence.
14. Retry, resume, delegation, or duplicate dispatch repeats non-idempotent effects, widens authority, reuses stale approval, or loses partial outcomes.
15. Rollback/compensation laundering declares restoration while messages, payments, disclosures, deployments, remote/physical effects, copies, descendants, or obligations persist.
16. Incident/residual abandonment leaves denial, escape, exposure, unknown outcome, partial effect, disputed approval, failed rollback, or affected party without owner and remedy.
17. Safety-by-refusal and denominator laundering hide false refusals, missed help, delayed approval, human work, or failed/unsafe effects.
18. Portability and SOTA theater treats one temp-file trace, fixture, sandbox, parser, benchmark, model, tool, organization, authority regime, or threat taxonomy as general safety.

Tool overreach means the adapter performed beyond granted scope. Approval bypass means governance was skipped. Irreversible deployment without rollback means a failed action cannot be repaired. These failures should produce effect residuals and block future route promotion.

Approval ambiguity is the adapter-level version of authority drift. A human says yes to one concrete action, but the system treats that yes as permission for a broader class of edits, deployments, payments, messages, or follow-up actions. The adapter should not infer durable authority from conversational trust. It should require a fresh lease or an explicit policy grant when the target, risk, cost, data exposure, or external effect changes.

Approval fatigue is the adapter-level version of a degraded sensor. The approval role still exists, but the signal no longer means what the architecture wants it to mean. A reviewer who has just approved a long series of similar requests, a reviewer who sees a high false-positive alert stream, or a reviewer who receives the model recommendation without independent evidence can become part of the failure path. The adapter therefore needs reviewer-load, rationale-quality, alert-quality, automation-recommendation, contradiction, and non-claim boundaries before approval can route to dispatch.

Partitioned authority is the adapter-level version of a stale control signal. A grant can be visible at the requester while a revocation is invisible at the effect site, or a lease can heal after a partition without proving that the cached grant is fresh. If the adapter treats available stale state as current permission, it creates a grant/effect race. The partitioned authority fixture models the conservative response: quarantine pending sync, request a fresh authority receipt, preserve residual ownership, and require no-mutation evidence before a denied or quarantined effect can be treated as closed.

47.11 Minimum Viable Implementation

The current minimum is one public invocation schema; a 2 valid/7 rejecting permission harness; one rollback-exact temporary-file effect with two no-mutation denial controls; 2 valid/12 rejecting adversarial-boundary records; 3 valid/7 rejecting human-oversight records and one accepted no-promotion decision; 3 valid/6 rejecting partitioned-authority records; one bounded/10 rejecting historical capability-envelope record; adjacent QCSA synthetic authority and reversible vertical-effect results at their exact non-core ceilings; and sixty-eight Lean declarations under six public targets.

These artifacts exercise record shape, finite transition and refinement consequences, one local write/restore, and synthetic authority, approval, injection-adjacent, revocation, reviewer, and partition controls. They do not establish deployed adapters, OS/hardware confinement, prompt-injection robustness, approval quality, reviewer correctness, secret isolation, distributed authority, target-service rollback, useful-effect advantage, production safety, independent reproduction, or transfer.

The adapter boundary begins with a runtime_adapter_invocation schema and fixture. It validates adapter ID, invocation state, target, capability, permission, sandbox, impact class, risk tier, approval scope/expiry, authority handle, effect lease, effect receipt, pre/post state refs, external side effects, verification refs, rollback handle, irreversible residuals, incident/audit refs, support-state effect, residuals, and non-claims. It does not execute a tool.

The runtime-adapter fixture checks the invocation envelope. AsiStackProofs.RuntimeAdapters adds bounded permission and approval predicates showing that a valid invocation requires the parent job permission list to include the adapter capability and that a high-impact unapproved invocation is rejected. It now also models effect leases, rollback obligations, a finite adapter route, a finite effect-replay route, and a finite revocation route: a leased invocation must use an active lease scoped to the requested capability and marked sandboxed; mismatched, expired, revoked, or unsandboxed leases cannot validate the invocation; over-ceiling requested authority is denied; confused-deputy and sandbox-escape attempts are rejected; high-impact rollback-required invocations without recorded rollback handles request rollback evidence; revoked approval, lease, or authority receipt records deny dispatch only when no-mutation evidence is recorded and otherwise request that evidence; missing receipt/audit/non-claim records block dispatch; incomplete effect replays request no-mutation, rollback, receipt, or no-promotion-boundary evidence; and a complete rollback-exact public-safe replay routes to accepted replay. The synthetic runtime-adapter permission harness adds cross-record checks over typed jobs, adapter invocations, authority-use receipts, and harness-only authority probes: valid fixtures cover low-impact local write and high-impact approved preview-deployment records, while expected-invalid fixtures reject missing permissions, high-impact approval bypass, expired approval, missing effect receipts, irreversible effects without rollback or residual records, adapter ambient authority substituted for the caller ceiling, and revoked authority receipts used by active invocations.

The Runtime adapter effect replay probe adds one executable but intentionally tiny effect trace. python3 scripts/run_runtime_adapter_effect_probe.py --write-result creates a generated public-safe temporary file outside the repository, applies valid_low_impact_local_write_effect_replay, records a 178-byte pre-state digest, a 289-byte post-state digest, restores the exact pre-state digest, and writes experiments/runtime_adapter_effect_probe/results/2026-07-02-local.json. python3 scripts/validate_runtime_adapter_effect_probe.py checks the result, including invalid_missing_permission_no_mutation and invalid_expired_approval_no_mutation. The probe records repo_write=false, network_used=false, support_state_effect=none, and chapter_core_support_effect=none; it remains a temp-file replay rather than a deployed adapter, production sandbox, approval service, secret-handle broker, revocation service, policy-enforcement result, rollback service, benchmark, or support-state transition.

The Runtime adapter adversarial boundary probe adds breadth rather than runtime depth. python3 scripts/validate_runtime_adapter_adversarial_boundary_probe.py --write-result records experiments/runtime_adapter_adversarial_boundary/results/2026-07-02-local.json with two valid synthetic adapter boundary reviews and twelve expected-invalid controls for confused-deputy parent mismatch, parent and lease authority ceiling overrun, approval scope mismatch, expired approval, sandbox escape path, secret materialized into model-visible context, missing rollback handle, missing effect receipt, missing audit refs, support-state promotion, and missing non-claim boundaries. Its public target is carried by fifteen named Lean route theorems—thirteen rejection cases and two accepted dispatch cases—rather than a theorem that merely projects fields from a hand-authored valid-summary predicate. It remains deterministic synthetic record-gate evidence, not deployed adapter execution, sandbox isolation, approval-service behavior, secret-handle safety, policy-enforcement correctness, rollback-service behavior, revocation propagation, security review, or support-state promotion.

The Human oversight degradation fixture adds a source-grounded reviewer-quality boundary. python3 scripts/validate_human_oversight_degradation.py --write-result records experiments/human_oversight_degradation/results/2026-07-03-local.json with three valid finite records and seven expected-invalid controls. It admits scoped low-fatigue approval, routes overloaded reviewers to delay or rotation, blocks automation-bias cases with visible contradiction and no independent evidence check, rejects missing reviewer qualifications, rejects template-only rubber-stamp approvals, escalates alarm fatigue, blocks support-state promotion from approval shape, and requires non-claim boundaries. The fixture is aligned to lean:runtime.adapters.human_oversight_degradation_fixture_bridge; evidence_transitions/v1_x_measured/human_oversight_degradation_no_change.json records the accepted blocks_promotion decision that keeps approval-service quality, reviewer correctness, alert quality, deployed human-factors behavior, runtime-adapter safety, and the chapter core claim at argument until public-safe deployed or externally reviewable workflow traces exist. This remains finite synthetic record-gate evidence, not an approval-service result, reviewer-correctness result, deployed human-factors result, or support-state transition.

The partitioned authority fixture adds the cross-boundary stale-authority case. python3 scripts/validate_partitioned_authority_fixture.py --write-result records experiments/partitioned_authority/results/2026-07-03-local.json with three valid finite records and six expected-invalid controls for partitioned revocation quarantine, healed-partition fresh authority receipt requirements, bounded fresh-receipt dispatch, stale-grant dispatch rejection, grant/effect race residual ownership, no-mutation evidence, support-state non-promotion, and non-claim boundaries. The fixture is aligned to lean:personal_hives.partitioned_authority.fixture_bridge; it is a hives/runtime boundary fixture, not deployed adapter execution, distributed consensus, partition tolerance, availability, revocation propagation, approval-service behavior, or evidence-transition support.

The historical-project capability packet adds schemas/sandboxed_adapter_capability_record.schema.json, one bounded record linked to the existing temp-file replay, and ten expected-invalid mutations. It rejects executable and write-path escape, network use under denial, wall-clock or OS-random scope widening, process observation mislabeled as OS enforcement, playback mislabeled as live reexecution, missing irreversible residual detail, ordinary dispatch from a bounded probe, and fixture-based support promotion. The record says sandbox_claim_allowed=false and does not retroactively turn the temp-file probe into a sandbox test.

The argument-exit campaign must use natural public-safe and deployment-like document, code, database, API, messaging, payment-simulator, service, hardware-simulator, and organizational tasks across multiple models, tools, sandboxes, capability systems, approval policies, secret brokers, and authority services. Direct tool calling, prompt-only controls, OS/container sandboxes, capability systems, policy-mediated tools, workflow engines, human approval, CaMeL-like control/data separation, AgentDojo-like adversarial tasks, Inspect-like harnesses, and the full adapter must receive matched information, authority, resources, faults, attacks, and horizons.

Independent observers must jointly measure correct useful effects, unauthorized and hidden effects, scope precision/recall, injection success, confused-deputy and escape success, secret exposure, approval calibration and degradation, stale/revoked dispatch, duplicate effects, receipt fidelity, rollback/compensation completeness, false refusal, missed help, privacy, latency, human work, recovery, and total cost. Prospective ablations remove parent authority, typed capability, control/data separation, approval, reviewer-readiness checks, leases, observed enforcement, secret handles, pre-state, independent observation, revocation freshness, rollback inventory, receipts, or complete denominators. A clean implementation must reproduce the result, and transfer must vary models, tasks, tools, targets, operating systems, sandboxes, organizations, authority and rights regimes, partitions, attacks, and time. Until then, the core support ceiling remains argument.

47.12 Mature Research Target

The proposed capability firewall combines typed least-privilege leases, control/data separation, independently observed enforcement, scoped human approval, reviewer-degradation controls, secret handles, partition-aware revocation, effect observation, effect-complete rollback accounting, and terminal receipts. Each component has mature partial precedents. Any novelty claim attaches only to their governed composition and must survive strong component baselines rather than describing familiar security practice as new.

The SOTA test is a joint frontier, not a zero-incident headline. The full adapter must improve correct useful effects and containment together while accounting for unauthorized and hidden effects, injection and escape success, secret exposure, stale dispatch, approval quality, false refusal, missed help, duplicate effects, rollback gaps, privacy, latency, human work, recovery, and total cost. Conservative non-dispatch is not a safety win when it merely removes useful work or hides risk outside the denominator.

Each signature mechanism needs a predicted causal fingerprint. Removing typed capability should widen scope; removing control/data separation should raise injection success; removing reviewer-readiness checks should degrade approval calibration under load; removing independent observation should raise hidden- effect error; removing revocation freshness should admit stale grants; removing effect inventory should create false rollback. Those effects must survive a clean implementation and heterogeneous transfer. No such campaign has passed, so the core claim remains at argument.

47.13 Codex test plan

Test	Purpose	Status
Runtime adapter fixture validation	Check that the adapter fixture matches the public schema and declares job, adapter, target, capability, permission, sandbox, invocation state, impact class, risk tier, approval scope/expiry, authority handle, inputs, effect lease, receipt refs, rollback handle, irreversible residuals, incident/audit refs, support-state effect, and non-claims.	implemented by protocol validation; validated locally
Adapter permission predicate and missing-permission negative case	Check that adapter capability is included in the parent job’s permissions and that a modeled invocation without that parent-job permission is not valid.	implemented in AsiStackProofs.RuntimeAdapters; checked by Lean build
Approval gate rejection predicate and unrejected-negative case	Check that high-impact adapter calls without approval are rejected and that a high-impact unapproved call cannot remain unrejected while satisfying the approval predicate.	implemented in AsiStackProofs.RuntimeAdapters; checked by Lean build
Effect lease scope and sandbox predicate	Check that a modeled leased invocation requires an active effect lease scoped to the requested capability and marked sandboxed, and rejects mismatched, expired, or unsandboxed leases.	implemented in AsiStackProofs.RuntimeAdapters; checked by Lean build
Rollback obligation rejection predicate	Check that high-impact rollback-required calls without a rollback handle are rejected and cannot remain unrejected while satisfying the rollback-obligation predicate.	implemented in AsiStackProofs.RuntimeAdapters; checked by Lean build
Runtime adapter route predicate	Check that a finite adapter review denies over-ceiling requested authority, rejects confused-deputy and sandbox-escape attempts, requires effect receipt/audit/non-claim records, and dispatches only a complete low-impact reviewed invocation.	implemented in AsiStackProofs.RuntimeAdapters; checked by Lean build
Runtime adapter effect-replay route predicate	Check that modeled effect replays deny missing-permission and expired-approval cases before mutation, request evidence for missing no-mutation proof, inexact rollback, missing receipts, repository/network side effects, or support-state effects, and admit only a rollback-exact public-safe replay.	implemented in AsiStackProofs.RuntimeAdapters; checked by Lean build
Runtime adapter adversarial boundary route predicate	Check that modeled boundary reviews route confused-deputy parent mismatch, authority ceiling overrun, approval scope mismatch, expired approval, sandbox escape, secret materialization, missing rollback, missing receipt, missing audit, support-state promotion, and missing non-claim boundaries away from dispatch while admitting complete low-impact and scoped high-impact records.	implemented in AsiStackProofs.RuntimeAdapters; checked by Lean build
Runtime adapter revocation route predicate	Check that modeled revocation reviews route revoked approvals, revoked leases, and revoked authority receipts away from dispatch unless no-mutation denial evidence exists, while complete non-revoked records preserve receipt, audit, support-state, and non-claim boundaries.	implemented in AsiStackProofs.RuntimeAdapters; checked by Lean build; finite-record coverage only
Rollback handle capture test	Check that deployment/effect records capture rollback handles or residuals.	implemented in python3 scripts/validate_runtime_adapter_permissions.py; synthetic records only
Approval-scope expiry test	Check that stale, underscoped, or reused approvals deny later high-impact invocations.	implemented in python3 scripts/validate_runtime_adapter_permissions.py; synthetic records only
Effect-receipt completeness test	Check that pre-state, post-state, side effects, verification refs, rollback handles, and irreversible residuals are represented before route promotion.	implemented in python3 scripts/validate_runtime_adapter_permissions.py; synthetic records only
Confused-deputy ambient-authority probe	Check that adapter ambient authority cannot authorize target-specific authority absent from the caller ceiling.	implemented in python3 scripts/validate_runtime_adapter_permissions.py; expected-invalid synthetic record only
Revoked authority receipt probe	Check that an active invocation cannot proceed with a revoked authority receipt.	implemented in python3 scripts/validate_runtime_adapter_permissions.py; expected-invalid synthetic record only
Runtime adapter effect replay probe	Check that a low-impact local temp-file effect can dispatch under the toy gate, record pre/post/rollback hashes, restore the pre-state digest, and deny missing-permission plus expired-approval controls before mutation.	implemented in python3 scripts/validate_runtime_adapter_effect_probe.py; local public-safe temp-file replay only
Runtime adapter adversarial boundary probe	Check two valid synthetic adapter boundary reviews and twelve expected-invalid controls for parentage, authority, approval, sandbox, secret, rollback, receipt, audit, support-state, and non-claim boundaries.	implemented in python3 scripts/validate_runtime_adapter_adversarial_boundary_probe.py; deterministic synthetic record gate only
Human oversight degradation fixture and no-promotion decision	Check three valid finite records and seven expected-invalid controls for approval fatigue, rubber-stamping, alarm fatigue, automation bias, reviewer qualification, support-state promotion, and non-claim boundaries; record a blocks_promotion decision for approval-workflow, reviewer-correctness, alert-quality, deployed-human-factors, runtime-adapter-safety, and chapter-core claims.	implemented in python3 scripts/validate_human_oversight_degradation.py and evidence_transitions/v1_x_measured/human_oversight_degradation_no_change.json; deterministic synthetic record gate plus no-promotion decision only
Partitioned authority fixture	Check stale grants, revocation-delay quarantine, fresh authority receipt requirements, grant/effect race residual ownership, no-mutation evidence, CAP-style authority consistency boundaries, and no support-state promotion at the hives/runtime boundary.	implemented in python3 scripts/validate_partitioned_authority_fixture.py; deterministic synthetic record gate only, no deployed partition tolerance or revocation propagation claim
Historical-project capability-envelope and replay-grade fixture	Check executable/read/write/network/clock/randomness scopes, enforcement-observation truthfulness, playback versus bounded live reexecution, irreversible-residual disclosure, ordinary-dispatch blocking, and no sandbox/support overclaim.	implemented in python3 scripts/validate_sandboxed_adapter_capability.py with one bounded five-project record and ten expected-invalid mutations; no OS sandbox or deployed adapter claim

Fixture-shape validation, bounded Lean theorem declarations over finite permission, approval, effect-lease, rollback-obligation, authority-ceiling, confused-deputy, sandbox-escape, effect-receipt, dispatch-route, effect-replay, adversarial-boundary, revocation-route, and human-oversight degradation predicates, the synthetic runtime-adapter permission harness, one public-safe temp-file Runtime adapter effect replay probe, one deterministic Runtime adapter adversarial boundary probe, one deterministic Human oversight degradation fixture, and one partitioned authority fixture are implemented. The remaining tests require a deployed adapter harness, real sandbox isolation, parent job permission lookup against real jobs, high-impact classification against policy, live approval decisions, live reviewer-quality checks, live effect receipts, rollback execution in target services, deployed revocation propagation, live partition traces, and secret-handle safety checks.

47.13.1 Formalization hooks

Tag	Module	Target	Status
lean:runtime.adapters.operational_invariant	AsiStackProofs.RuntimeAdapters	Every accepted event and arbitrary finite run in the reachable runtime-effect model preserves exact job, caller, capability, target, active-lease, approval, dispatch, caller-ceiling, epoch, revocation, and observed-effect accounting invariants, and refines the corresponding authority-effect run.	implemented
lean:runtime.adapters.failure_blocks_promotion	AsiStackProofs.RuntimeAdapters	The reachable model rejects missing permission, caller or scoped-target substitution, authority widening, expiry, secret materialization, effect without dispatch, missing rollback handles, pre-state mismatch, revoked-lease reuse, and post-revocation dispatch before any accepted state transition; denial is state-noninterfering in the modeled step semantics.	implemented
lean:runtime.adapters.effect_replay_fixture_bridge	AsiStackProofs.RuntimeAdapters	A six-event prepare-to-rollback witness reaches exact baseline restoration, and the entire trace simulates an accepted authority-effect trace while the independent temp-file probe supplies only bounded local effect and rollback observations.	implemented
lean:runtime.adapters.adversarial_boundary_probe_bridge	AsiStackProofs.RuntimeAdapters	The independently encoded permission and adversarial consumers reject identity, authority, approval, lease, sandbox, secret, rollback, receipt, audit, support, and non-claim mutations, while the reachable Lean countermodels prove the corresponding pre-effect rejections at exact modeled boundaries.	implemented
lean:runtime.adapters.revocation_route_bridge	AsiStackProofs.RuntimeAdapters	An accepted revocation clears active lease, approval, and dispatch state, advances the authority epoch, records the revoked lease, and prevents both same-lease preparation and dispatch until a distinct fresh lease is admitted; repository fixtures retain no-mutation and non-promotion boundaries.	implemented
lean:runtime.adapters.human_oversight_degradation_fixture_bridge	AsiStackProofs.RuntimeAdapters	An independent human-oversight consumer computes low-fatigue, overload, automation-bias, and invalid-control outcomes; separately, retained runtime-adapter route theorems govern permission, approval, lease, sandbox, rollback, receipt, and revocation boundaries. Lean does not formalize reviewer cognition or copy the consumer summary.	implemented

The sixty-eight theorem declarations retain the forty-three finite route and negative-case consequences and add twenty-five reachable refinement results. The new model proves one-step and arbitrary-run state invariants, exact adapter-to-authority event and run simulation, a six-event rollback witness, modeled denial noninterference, and eleven closed countermodels for permission, identity, ceiling, expiry, scope, secret, dispatch, rollback, pre-state, and revocation failures. python3 scripts/validate_runtime_adapter_permissions.py independently checks the existing two valid and seven expected-invalid fixtures and requires the exact refinement theorem surface. The authored human-oversight summary mirror remains retired; its executable consumer remains finite fixture evidence. None refines a deployed adapter, operating-system or hardware sandbox, capability service, approval service, secret broker, distributed authority service, effect observer, rollback service, or support gate. This is executable vocabulary and finite transition, refinement, and counterexample coverage, not empirical proof of the core claim.

The reachable model still trusts every encoded identity, permission, sandbox observation, receipt, digest, and independent-observer field. Its refinement theorem establishes that accepted adapter events obey the narrower authority state machine; it does not prove those fields are authentic or that either machine is enforced by a process, kernel, service, or organization. Human-oversight degradation outcomes are computed by the separate executable consumer, not proved by copying its summary into Lean. The full proof family does not prove deployed sandboxing, authority-handle mediation, actual production tool invocation, effect-receipt truth, approval-service quality, reviewer correctness, deployed human-factors behavior, secret-handle safety, distributed revocation propagation, effect-complete rollback, useful-action advantage, production security, reproduction, transfer, or chapter-core support.

47.14 Source crosswalk

Source ID	Title	Layer	Planned use	Readiness
reflexive_router_whitepaper	The Reflexive Router	pre_deliberative_reflexive_routing_control_plane	Action-understanding/effect-commit separation, non-bypassable authority admission, prepare/commit/observe/verify custody, idempotency, compensation, typed terminal outcomes, and effect receipts.	source note available
talos	Talos Protocol	labor_execution_os	AI labor OS. Deterministic cognitive manufacturing, typed jobs, control planes, auditability, tool isolation.	source note available; local raw cache available
viea	Verified Intent-to-Execution Architecture	whole_stack_execution_spine	Keystone source. Human intent -> command contracts -> artifacts -> routing -> runtime targets -> verification -> deployment -> feedback.	source note available; local raw cache available
ladon_manhattan	Ladon & The Manhattan Protocol	security_governance	Kernel-level security architecture for high-agency AI.	source note available; local raw cache available
software_magic_grimoire	Software Magic Grimoire	command_contracts_promptcraft	Structured command contracts and semantic density of software words.	source note available; local raw cache available
genesiscode	GenesisCode	executable_specification	Tiny pure calculus + obligations + provenance for auditable AI-symbiotic programming.	source note available; local raw cache available
moecot	MoECOT-Agent Architecture Whitepaper	implementation_reference	Concrete implementation evidence: governed low-parameter multi-core runtime, readiness gates, ledgers, replay.	source note available; connector or recovery required
field_of_god_ai_constitution	Field of God AI Constitution	constitutional_alignment_runtime_governance	Recovered in the Project Theseus repository. Constitutional alignment core for truth alignment, agency preservation, consent, non-domination, consciousness caution, least sufficient power, auditability, self-authorization limits, and runtime checks; use as source material only after source-note creation, not as proof or test evidence.	source note available
theseus_operator_os	Hive Operator OS and Work Board	labor_os_operator_surface	Shared command vocabulary, durable SQLite work board, node registry, background/watch/wake contracts, skill registry, tool hooks, feedback routing, and safety-visible operator surface.	source note available
ext_humans_automation_1997	Humans and Automation: Use, Misuse, Disuse, Abuse	human_factors_automation	External comparator for automation use, misuse, disuse, abuse, overreliance, monitoring failure, trust, workload, risk, false alarms, and operator-role design.	source note available
ext_ironies_automation_1983	Ironies of Automation	human_factors_automation	External comparator for automation-supervision failures where automation can leave humans with harder supervisory and abnormal-condition duties.	source note available
ext_levels_automation_2000	A Model for Types and Levels of Human Interaction with Automation	human_factors_automation	External comparator for separating approval by information acquisition, analysis, decision/action selection, and action implementation levels.	source note available
ext_complacency_bias_automation_2010	Complacency and Bias in Human Use of Automation: An Attentional Integration	human_factors_automation	External comparator for automation complacency, automation bias, omission and commission errors, workload, attention, and imperfect decision aids.	source note available
ext_cap_theorem_gilbert_lynch_2002	Brewer’s Conjecture and the Feasibility of Consistent, Available, Partition-Tolerant Web Services	distributed_systems_consistency	External comparator for CAP-style safety/liveness and partition-tolerance pressure at the adapter authority boundary: stale grants, revocation delay, fresh receipt requirements, and no-mutation evidence.	source note available
ext_inspect_ai_2024, ext_agentdojo_2024, ext_camel_prompt_injection_2025, ext_owasp_agentic_top_10_2026	Inspect AI, AgentDojo, CaMeL, and OWASP Agentic Top 10	agent_tool_security	Current comparators for agent/tool evaluation, indirect injection, capability-secure data flow, and agentic-risk coverage.	source notes available; no local adapter robustness, approval quality, or safety result
moecot_manifest_project, beastbrain_project, bugbrain_project, corbens_trainer_project, corbens_best_model_possible_project	Historical-project runtime lineage	local implementation-reference and negative-case lineage	Exact capability scopes, effect/replay records, declared-versus-enforced boundaries, quarantine, irreversible residuals, and playback/live-replay distinctions.	public-safe source notes available; projects not replayed; one related lineage, not independent confirmation

The twenty-five-source set anchors authority handles, approvals, tool permissions, operator control, human oversight degradation, partitioned authority, evaluation harnesses, prompt/data injection, current agentic risk, historical failures, transactional recovery, and semantic non-authority. Every mapping is reviewed at its exact boundary. The crosswalk does not claim safe tool execution, reviewer correctness, sandbox enforcement, secret isolation, distributed consensus, partition tolerance, revocation propagation, local baseline reproduction, or SOTA standing.

47.14.1 Manifest source assignment reconciliation

These rows keep Runtime Adapters, Tool Permissions, and Human Approval’s manifest assignments visible at their recorded review boundary. Passage review does not establish local reproduction, performance, safety, deployment, or support-state movement.

Source	Intake role	Boundary
deterministic_capability_compilation	Passage-reviewed Corben architecture source: Deterministic Capability Compilation: A Capability-Preserving Ladder from Executable Scaffolds to Governed Adaptive Agents. Corben-authored July 2026 architecture and research program for compiling executable scaffolds into contract-bound experts and linked Neural Capability Objects while retaining semantic obligation mass balance, candidate-specific translation validation, fallback, residual escrow, authority ceilings, reification, and effect-complete recovery. Existing chapters are upgraded first; no foundry implementation, learned-capability result, preservation result, safety result, SOTA result, AGI, ASI, or support-state promotion is inferred.	No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.
platonic_world_model	Metadata-first comparator: The Platonic World Model: A Semantic Constitution for Grounded, Proof-Carrying, Self-Editing Artificial Intelligence. Corben-authored July 2026 conceptual architecture and falsifiable research program for semantic continuity through stable Form lineages, immutable semantic versions, typed Essence Contracts, six mutually constraining planes, explicit proposition-attestation-commitment-proof separation, branch-protected world dynamics, qualified grounding, semantic transactions, runtime packet compilation, and federated mappings. Existing chapters are upgraded first; no implemented substrate, benchmark result, philosophical solution to grounding, safety result, SOTA result, AGI, ASI, or support-state promotion is inferred.	No passage-level source claim, local implementation, reproduction, safety, performance, deployment, support-state, or ASI result is established by this reconciliation row.
ext_claw_swe_bench_2026	Passage-reviewed comparator: Claw-SWE-Bench: A Benchmark for Evaluating OpenClaw-style Agent Harnesses on Coding Tasks. Supports binding coding-agent outcomes to a fixed model, harness, workspace, patch extraction, evaluator, runtime budget, and cost rather than attributing a harness result to the model alone.	Primary preprint comparator only; no reported task, score, harness, cost, contamination control, or safety result was reproduced here. No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.
ext_txfs_2018	Passage-reviewed comparator: TxFS: Leveraging File-System Crash Consistency to Provide ACID Transactions. Supports distinguishing declared effect-inventory restoration from ACID filesystem transactions, conflict isolation, crash consistency, durability, and bounded transaction capacity.	TxFS was not installed or reproduced; the local directory and state-tree snapshots do not establish filesystem transactions, crash safety, process recovery, service recovery, or external-effect atomicity. No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.
qcsa_whitepaper	Passage-reviewed comparator: Question-Compiled Semantic Addressing. Adds the hard capability-separation rule: semantic resolution, aliases, address confidence, and certificates never grant authority; the physical route must independently bind actor, target, operation, scope, policy, data, reversibility, approvals, and receipts. The later repository adds a bounded local 12-lane implementation, 60-case held-out evaluation over 13 systems and three seeds, and one 13-stage governed vertical trace.	The exact matched-advantage and resource gates failed, and the active-question ablation is N2 proxy/regime evidence rather than an exact or broad refutation. One reversible local effect does not establish permission correctness, production safety, human-approval quality, chapter-core promotion, AGI, or ASI. No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.
ext_elizaos_agent_runtime_2026	Passage-reviewed comparator: elizaOS Agent Runtime and Scenario Runner. Supplies a current implementation comparator for modular actions, providers, evaluators, services, runtime lifecycle, guarded host access, and scenario execution with an explicit boundary between in-process diagnostics and externally qualified provider evidence.	Official software and documentation review only; no plugin, permission, sandbox, scenario, provider qualification, security, or production result was executed or reproduced. No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.
ext_hermes_agent_2026	Passage-reviewed comparator: Hermes Agent: Learning, Memory, Tools, and Security Architecture. Supplies a current implementation comparator for dangerous-command approval, file-write restrictions, container isolation, credential filtering, context scanning, cross-session isolation, tool backends, and optional staged approval of agent-authored skill mutations.	Official software and documentation review only; no command, sandbox, tool, approval, skill-write, security, or deployment result was reproduced. No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.
ext_openclaw_agent_runtime_2026	Passage-reviewed comparator: OpenClaw Gateway, Agent Runtime, ACP, and Self-Learning Architecture. Supplies a current implementation comparator that separates sandbox placement, tool availability policy, approval, and elevated execution, while documenting that ACP external harnesses retain their own execution authorization and are not wrapped by the parent sandbox.	Official software and documentation review only; no policy, sandbox, approval, elevation, ACP confinement, effect observation, or security result was reproduced. No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.

47.15 Post-v2.1 governed adapter boundary

The post-v2.1 program runs each candidate through an explicit route and effect transaction. Across 36 held-out cases, the governed path emitted two useful releases and zero unsafe releases, versus 24 unsafe direct releases. That is a real local observation of permission-like gating around public-safe disposable effects, but the effect observer and operator remain internal processes and 32/36 attack-control rollbacks were exact rather than 36/36. The result therefore narrows the implementation burden: an adapter boundary must be judged by useful releases, unsafe releases, and effect-complete rollback together. It does not establish an OS sandbox, deployed approval service, secret isolation, or production revocation.

47.16 P4/M5 held-out policy result

A later prospectively frozen recampaign separates candidate generation from release policy. On one fresh 16-task authored corpus and one local quantized Qwen3-8B run, 15 outputs were schema-admissible and two deterministic evaluator implementations disagreed on none. The self-release and record-only policies released 0 useful and 0 unsafe candidates. Full governance released 9 useful and 0 unsafe candidates; its evidence-freshness ablation released one additional candidate classified useful-unsafe. The residualized partial- recovery case did not release under full governance.

That exact local policy effect is recorded as a non-core synthetic-test-backed result. It is evidence that the implemented freshness gate mattered on this corpus, not that adapters are secure, approvals are legitimate, effects are completely inventoried, or rollback is complete in an open system. The candidate baseline’s zero releases also means this run does not estimate unsafe-release reduction against a permissive production baseline. Model-family, workload, evaluator, organizational, and temporal transfer remain untested.

47.17 Summary

Runtime adapters form the leased external-effect boundary. Their distinct job is to dispatch, independently observe, contain, and receipt one exact effect under current authority; objective, policy, approval legitimacy, artifact truth, evidence, support, readiness, and release remain elsewhere. All twenty-five assigned sources are now reconciled against that boundary.

The rule is that real-world effects require explicit authority. Planning may propose action; only an authorized adapter may perform it. In this repository, the evidence now reaches one narrow toy trace: a generated temp-file write, rollback-exact restoration, and two denial controls. It still has no deployed adapter trace, approval service, production sandbox run, live secret-handle path, revocation propagation, or target-service rollback execution. Once real effect traces accumulate, the system can ask which recurring patterns deserve to become procedural memory.

The current evidence remains narrow: one schema, five authored fixture families, one rollback-exact temp-file effect, the bounded P4/M5 policy result, adjacent bounded QCSA results, and forty-nine finite Lean declarations under six targets. A natural multi-target comparison with independently developed effect observers, clean reproduction, real effects, and heterogeneous transfer is still required. Until it passes, the local result supports one policy subclaim; it does not prove adapter safety.

47.18 Evidence reconciliation (2026-07-16)

The invariant protocol, field meanings, and inference limits are stated once in Living Book Methodology. This packet contains only the chapter-specific projection; its authoritative per-atom rows are the runtime-adapters-tool-permissions-and-human-approval slice of experiments/claim_family_terminal_coverage/results/result.json.

The core remains blocked after full attempt at argument support. The strongest family attempt was Intent-to-execution vertical refinement. Its exact boundary is: Structured local scenarios only; no natural-language semantic sufficiency, production backend, transfer, or deployment claim. Across 77 atoms, the terminal ledger records 77 blocked_after_full_attempt.

Chapter-specific field	Value
Family / atom denominator	CF-03 / 77 atoms
Terminal dispositions	77 blocked_after_full_attempt
Core	runtime-adapters-tool-permissions-and-human-approval.core: blocked_after_full_attempt at argument
Core attempted / missing lanes	source-synthesis / causal, empirical, executable, formal, normative, transfer
Attempted local lanes	source-synthesis
Missing or unproved lanes	causal, empirical, executable, formal, normative, transfer
Strongest family bundle	Intent-to-execution vertical refinement (end_to_end): Nine versioned scenarios and 89 events from governed intake through six observed local effects and terminal outcomes.
Negative controls	pre-effect refusal; failed rollback quarantine; 30 rejecting mutations.
Accepted transitions	v1_0_pilot.runtime_adapters.no_change
Maximum inference	Structured local scenarios only; no natural-language semantic sufficiency, production backend, transfer, or deployment claim.
Reproduction / next burden	Replay scripts/validate_intent_execution_vertical_refinement.py and scripts/validate_claim_family_terminal_program.py; fill the named atom-specific lanes under a new prospective protocol.

47.19 Handoff

Runtime Adapters owns the local effect lease, but a permitted call can still miss a physical deadline or violate plant dynamics. Embodied Agency, Real-Time Control, and Physical Safety owns the independent safety envelope, fallback controller, interlocks, observed physical effects, and recovery path before physical traces cross stack boundaries.