GenesisCode Roadmap: Agent-Native, Universal, Efficient, Self-Hosted, and Trustworthy

Last audited: 2026-08-11

Status: canonical strategic plan for the path from v0.2 to v1.0 and the post-v1 frontier. This file is not release evidence. Repository history, clean-clone verification, and remote CI evidence are mandatory under R0.1.

Program objective: fully complete this roadmap end-to-end in a beyond state-of-the-art manner: AI-first, universal across declared product and hardware profiles, super efficient, fully self-hosted above a minimal auditable host, reproducible, formally hardened, validated by executable evidence, and eventually able to conduct independently verified proof-carrying algorithm discovery through Genesis Foundry without enlarging production trust. This describes the durable program, not the state of any Codex goal or work session.

GenesisCode is not trying to be another general-purpose language with an AI plugin. It is a deterministic software substrate designed for AI-authored and AI-iterated systems. Its differentiator is the combination of compact machine-facing semantics, content-addressed identity, sealed effects, deny-by-default capabilities, deterministic replay, semantic patches, evidence-carrying packages, and a self-hosted toolchain whose claims can be independently checked.

Its first delivery wedge is a fully functional, agent-usable, self-hosted GenesisCode Core whose production semantics are owned by GenesisCode above a minimal stage0 and whose bootstrap and release claims can be checked independently. Its second wedge is a finite Genesis Foundry Foundation that calibrates proof-carrying search against that frozen Core and publishes the first independently governed genesis/algorithms package release. Its third wedge is a finite GenesisExamples/GenesisApps seed: executable teaching projects and maintained application systems that consume the released algorithm package and prove useful end-to-end construction, beginning with a library/CLI, MCP server, web server, and a separate full-stack site/application served by that stack. Its fourth adoption wedge is GenesisBench: expose the frozen language, disclosed algorithm package, released examples, and bounded documentation to a model, require it to learn an unfamiliar executable formal system and complete real work, and score artifacts mechanically rather than by style or judge preference. This ordering prevents benchmark scaffolding, mutable language behavior, target-model failures, or unverified search output from steering an unfinished language, library, or application contract. Retained internal conformance fixtures may improve GenesisCode before v1, but executable Foundry work waits for exact reviewed R9.4.f; the curated example/app seed waits for F2.r; and new model campaigns, held-out commissioning, public ranking, and GenesisBench release work wait for that finite seed. High-quality outputs may become packages, examples, applications, or training material only through separate provenance, license, safety, verification, deduplication, destination-review, and held-out-firewall processes. Search, demo, or benchmark success never makes generated output authoritative by itself.

The roadmap is intentionally ambitious, but it is not a list of unrelated ambitions. It is a dependency-ordered release program. The first priority is making GenesisCode safe and effective for agents now. Performance tiers, broad domain support, and recursive self-improvement follow only after the semantic and evidence foundations they depend on are real.

---

1. Product thesis and boundaries

1.1 North-star outcome

A local or remote AI agent should be able to learn the stable GenesisCode profile from a small, generated context bundle; create or repair a complete product; receive structured diagnostics; run it under explicit capabilities and resource bounds; inspect or replay every effect; package it with provenance and obligation evidence; and deploy it without trusting raw model output. Within a declared target profile, the application author writes GenesisCode plus GenesisCode-owned manifests, policies, schemas, tests, and assets. They do not hand-maintain HTML, CSS, JavaScript, TypeScript, Python, Rust, C/C++, Swift, Kotlin, Java, shader source, linker scripts, or deployment YAML to finish the product.

This is a one-language authoring contract, not a claim that browsers, operating systems, silicon SDKs, databases, GPU drivers, or every third-party library cease to exist. GenesisCode may compile to or generate standards-compliant foreign artifacts and may consume audited components behind the capability boundary. Those implementation details are content-addressed, reproducible, inspectable, replaceable, and never become an undocumented second source language for the application.

The v1 toolchain should be self-hosted above a deliberately small stage0 host. “Fully self-hosted” means the language-level frontend, typechecker, formatter, optimizer, patch engine, obligation logic, package/registry logic, documentation generators, and build orchestration are authored in GenesisCode and bootstrap to a reproducible fixpoint. It does not mean pretending that hardware, an operating system, a WebAssembly engine, or the minimal evaluator/effect host does not exist.

The program delivers four dependency-ordered outcomes with independent version, release, compatibility, and evidence authorities:

1. GenesisCode: the language, runtime, package/build/deployment system, documentation, agent interface, and the governed GenesisExamples/GenesisApps distribution surfaces.
2. Genesis Foundry + Genesis Algorithms: an isolated proof-carrying search system plus a destination-governed first-party .gc algorithm package collection. The engine proposes; the package maintainers independently verify, accept, version, and support ordinary library releases.
3. GenesisBench: the self-hostable evaluation program for whether a model or agent can acquire an unfamiliar executable formal system from bounded evidence and construct trustworthy GenesisCode software using the same disclosed language and package surface available to users.
4. Genesis Model: a profile-bound, self-hostable specialist trained only from governed, lineage-preserving trajectories after the training/evaluation firewall is proven.

Their flywheel is deliberate but not circular authority. GenesisCode defines executable semantics and constraints. Foundry searches frozen profiles and retains candidates, proofs, costs, failures, and counterexamples; independently accepted results are copied into ordinary versioned genesis/algorithms releases that contain no mutable research dependency. GenesisExamples teaches one concept or workflow with the smallest complete executable project; GenesisApps composes those capabilities and released algorithms into maintained, deployable systems. GenesisBench then measures acquisition and trustworthy use of that disclosed language/library/example environment and produces independently checkable failures and successes. Those failures improve the language, diagnostics, cards, tools, libraries, examples, applications, and tasks. Verified artifacts may enter packages, examples, applications, or a training corpus only through explicit destination-owned promotion. The Genesis Model proposes more artifacts but never scores, verifies, authorizes, or promotes itself. Outcome versions advance independently, and no search, package, example, benchmark, or model release silently changes language semantics.

After the Foundry Foundation release, that ecosystem may also operate GenesisChallenge, a separately governed, non-ranking contribution contest for solving real GenesisCode, Genesis Algorithms, Foundry, and, once independently released, GenesisBench problems. GenesisChallenge is not a fifth product, a benchmark track, a difficulty band, or a source of release authority. Its accepted work enters the destination repository only through ordinary independent review, verification, provenance, and promotion controls; open or prize-bearing work can never be mixed into a benchmark score.

Each product therefore has its own release train and acceptance authority:

Product	Canonical release identity	May consume	Must never control	Independent release condition
GenesisCode	language/runtime/profile/source/artifact manifest plus separately versioned example/app catalog manifests	named immutable Genesis Algorithms releases, typed benchmark failures, and reviewed promoted artifacts	mutable Foundry state, benchmark scores, held-out custody, corpus admission, or model weights	language/runtime/package/toolchain claims meet their own compatibility, product, assurance, and E4 gates; every released example/app meets its declared target and maintenance contract
Genesis Foundry + Genesis Algorithms	Foundry snapshot/grammar/catalog/search/verifier/receipt manifest plus a separate signed package-release manifest	frozen GenesisCode releases, prior immutable algorithm-library releases as baselines, and independently authored tasks/checkers	production semantics, destination review, package acceptance, benchmark scoring, or same-run library mutation	calibration is independently reproduced; each library export has destination-owned contract/provenance/proof-test/cost/compatibility evidence; production remains valid with foundry/ absent
GenesisBench	protocol/epoch/scaffold/adapter/scorer/registry manifest	frozen GenesisCode and genesis/algorithms releases plus disclosed model interfaces	language or library semantics, model training, solver output, Foundry search state, or historical result rewriting	construct validity, challenge scale, custody, reproducibility, governance, and public-methods gates pass for the named cohort
Genesis Model	weights/tokenizer/runtime/training-lineage manifest	admitted corpus artifacts and frozen language/benchmark profiles	evaluator, held-out tasks, promotion rules, capability grants, or release signing	the named model package meets its declared quality, safety, license, provenance, local-resource, and reproducibility profile

No outcome waits for an unrelated outcome to reach the same major version. GenesisCode v1 Core ships without requiring Foundry, Genesis Algorithms, the post-Core example/app catalog, GenesisBench, GenesisChallenge, or a Genesis Model package. The first Foundry Foundation begins only against immutable GenesisCode v1 Core. The first curated GenesisExamples/GenesisApps seed begins only against the first independently promoted genesis/algorithms release and remains runnable with foundry/ absent. The first public GenesisBench and GenesisChallenge releases begin only against that Core identity, algorithm release, and finite public example/app seed; later releases name explicit compatible ranges and do not wait for unrelated Foundry or universal-showcase expansion. A Genesis Model package supports explicit language, algorithm-library, example/app, and benchmark profiles and fails closed outside them. Portfolio milestones may require evidence from multiple outcomes, but a release is blocked only by its declared prerequisites and compatibility tests.

The benchmark is an instrument for independently measuring and continuing to harden a usable language, not a substitute for finishing the language or a post-language marketing exercise. Before v1, only model-free benchmark protocol conformance, shared regression fixtures, security maintenance, and preservation of already completed evidence may run; they cannot publish a new model comparison or divert the self-host critical path. Candidate generation and research may run only within the activation boundaries in section 3.18, while promotion of a task, result, package, language change, corpus artifact, model, or release is discrete, independently verified, append-only where historical evidence is involved, reversible where state changes, and incapable of rewriting prior results.

After the v1 trust baseline, Genesis Foundry becomes the first post-Core program: an independently bounded system for discovering and comparing algorithms from typed computational mechanisms. It consumes frozen GenesisCode semantics, CoreForm, obligations, artifacts, replay, and at most a prior immutable genesis/algorithms release; generates candidates under quarantine; verifies them through independent checkers; retains failures and counterexamples; and emits reviewed promotion proposals. It cannot install a rewrite, expand the kernel, alter a verifier, admit training data, or authorize a package, model, benchmark, or language release. A Foundry snapshot has its own schema/catalog/task/search/verifier/receipt identities and an explicit compatible GenesisCode range.

Genesis Algorithms is the supplied library output, not the search engine under another name. It is an ordinary, signed, semantically versioned GenesisCode package collection containing independently accepted reference algorithms, specialized variants, exact applicability contracts, deterministic fallbacks, provenance/licenses, complexity/cost evidence, examples, and conformance tests. It contains no Foundry runtime, mutable registry, candidate history, hidden oracle, or same-release circular dependency. Foundry may search against release N as a baseline and propose changes for N+1; destination maintainers reverify those proposals without the search engine before release. GenesisCode, Bench, applications, and models may depend on a named library release but never on foundry/ or mutable research state.

GenesisExamples and GenesisApps are governed GenesisCode distribution surfaces, not additional semantic authorities or independent language implementations. GenesisExamples contains compact, executable, concept- and workflow-focused projects; GenesisApps contains maintained production-style systems assembled from the same public packages and capabilities. Existing parser, conformance, benchmark-reproduction, and host-workflow fixtures remain truthfully classified as fixtures rather than being relabeled as applications. Every catalog entry binds exact GenesisCode, target-profile, dependency, and Genesis Algorithms identities; capabilities and budgets; build/run/deploy/replay commands; deterministic acceptance; source/generated/dependency inventories; provenance and license; maintenance owner; and evidence level. Entries use a named released algorithm where it materially serves the workload, never as dependency theater, and build without Foundry code, candidate history, or mutable research state. Public examples may define disclosed benchmark capability families, but a public solution is never copied into held-out scoring material.

1.2 What “amazing” means here

GenesisCode v1 must be strong in all of these dimensions at once:

1. Agent legibility: the useful language surface fits within explicit context budgets and exposes machine-readable schemas, diagnostics, repair hints, examples, and capability contracts.
2. Mechanical trust: generated code is never accepted because it looks plausible. Semantics, effects, policy decisions, patches, packages, and releases carry independently checkable evidence.
3. Determinism: pure evaluation, canonical identity, effect logging, replay, concurrency, builds, and bootstrap outputs have specified cross-machine behavior.
4. Efficiency: the common agent edit-check-run loop is interactive, the reference interpreter is credible, compiled tiers are validated, and long-lived services have bounded memory and resource behavior.
5. Self-host authority: self-host claims describe semantic ownership and bootstrap closure, not merely a GenesisCode wrapper that routes to Rust implementations.
6. Self-hostable infrastructure: no required cloud control plane, hosted registry, proprietary model, or external telemetry service is needed to build, verify, package, or deploy software.
7. Practical reach: real programs across the declared v1 domain matrix work end-to-end, while unsupported domains are named rather than implied by broad marketing language.
8. Replaceability: an independent implementation can pass the kernel and artifact conformance suites from the published specifications.
9. Benchmark validity: model comparisons use precommitted tasks, deterministic scoring, reproducible run records, contamination labels, temporal challenge sets, and independently replayable evidence rather than opaque leaderboards.
10. Learning flywheel: benchmark failures improve GenesisCode, verified successes seed useful examples and packages, and only governed artifacts enter a lineage-preserving corpus for a future GenesisCode-native model.
11. One-language product construction: declared web, service, desktop, mobile, game, data/AI, embedded-Linux, and microcontroller profiles can be authored, tested, built, deployed, operated, and maintained without handwritten foreign-language glue.
12. Authentic targets: a filename, archive, descriptor, headless plan, empty Wasm export, or shell smoke token never counts as an application. Target support means the artifact executes the declared workload in the real browser, OS, simulator/device, container/runtime, or board and exposes exact evidence of that execution.
13. Proof-carrying discovery: post-v1 algorithm research preserves the exact task, grammar, semantic profile, search lineage, counterexamples, proof/test scope, cost samples, and promotion decision. A new hash is not novelty, bounded verification is not a general proof, and search output never becomes production authority by proximity.
14. A useful algorithm commons: the supplied genesis/algorithms collection offers stable, documented, portable .gc APIs with exact behavioral and complexity contracts. Foundry discoveries can improve it, but baseline implementations, known algorithms, negative results, and independently reviewed fallbacks are first-class; novelty is never an admission requirement.

1.3 One-language authoring contract

Layer	Allowed application-owned inputs	Toolchain responsibility	Acceptance rule
Language and product logic	.gc, Genesis package/workspace manifests, capability policy, typed schemas, tests, assets, and generated-lock inputs	Parse, type/effect check, optimize, compile, link, package, and diagnose	No handwritten foreign source is required in a canonical starter or flagship product.
Web presentation	Genesis document/component/style/route/accessibility IR	Emit HTML/CSS/JavaScript/Wasm/service-worker artifacts and source maps as deterministic build outputs	Browser-matrix behavior, accessibility, hydration/SSR identity, and network policy pass from the .gc source alone.
Native/mobile presentation	Genesis app, lifecycle, UI, permission, asset, and platform-service declarations	Generate platform project metadata, bindings, resources, signing plans, and executable packages	Real install, launch, lifecycle, accessibility, and device/simulator tests pass; generated Swift/Kotlin/XML/project files are not edited.
Games, graphics, and media	Genesis scene/ECS/render/shader/audio/asset descriptions and logic	Generate validated shaders, pipelines, asset packs, and target adapters	A real interactive frame/audio/input loop meets target budgets; a frame-plan hash alone is insufficient.
Services and operations	Genesis routes, schemas, migrations, jobs, deployment and observability declarations	Generate portable components, service/container/unit manifests, SBOM/provenance, and reviewable deploy plans	The service handles real protocol traffic, persistence, upgrade/rollback, and fault injection without handwritten shell/YAML.
Embedded and hardware	Genesis embedded-profile source, board manifest, pin/peripheral policy, static resource budget, and tests	Select BSP/HAL components, AOT compile/link, generate startup/link layout, flash/debug/OTA plans, and hardware evidence	The exact firmware boots and performs the workload on a named board; descriptor-only or host-bridge simulation does not count.
Extension packages	Genesis bindings and capability declarations	Import WIT/schema/header metadata and isolate audited foreign internals behind components	Application authors remain in GenesisCode; foreign internals are explicit supply-chain dependencies, not ambient escape hatches.

The contract is profile-scoped. A target that cannot meet it is reported as unsupported or experimental. GenesisCode does not silently emit a misleading file extension, invoke an undeclared cloud compiler, or ask the agent to finish generated glue by hand.

1.4 Non-goals before v1

• Syntax breadth is not a goal. New syntax must reduce total agent/human complexity or unlock a required semantic capability.
• A production JIT is not automatically a v1 requirement. It becomes critical-path work only if the interpreter, bytecode VM, prelude snapshot, and warm daemon cannot meet the measured product budgets.
• “Supports anything” is not an acceptable release claim. The north star is universal product construction through a finite, versioned profile and extension matrix; every release names exactly which products, hosts, boards, services, and lifecycle operations have authentic L4/L5 proof.
• Raw LLM inference never enters the pure kernel. Model access is an explicit host effect with capability, provenance, budget, redaction, and replay rules.
• One aggregate leaderboard never mixes raw-model acquisition, open agent scaffolds, GenesisCode-adapted systems, and embedded local systems. They answer different questions and remain separate tracks.
• GenesisBench never requires one vendor’s API, chat template, special tokens, native tool-call encoding, reasoning-effort control, streaming protocol, tokenizer, hidden chain of thought, CLI, or hosted service. Provider-specific integrations are adapters and named campaign scaffolds, never the semantic benchmark contract.
• Open-ended repository contributions, bounties, and improvement contests are not benchmark items. GenesisChallenge records them on a separate evidence and credit surface, and no contest outcome changes a GenesisBench cohort, rank, difficulty calibration, or historical score.
• GenesisCode novelty is not evidence of training-data absence. Public fixtures establish conformance and practice, not temporal cleanliness.
• Training a language model from scratch is not an early milestone. Begin from a capable, legally usable open base unless measured evidence shows that specialization cannot meet the declared local envelope.
• “English and GenesisCode” describes the intended human/model interface, not the full source of domain knowledge. Changeable knowledge should move into versioned packages and capability schemas; stable general knowledge may remain in model weights; tools and user context remain explicit inputs.
• A continuously running proposal loop is not continuous self-promotion. No model may grant itself authority, alter its evaluator, admit its own training data, or approve a language/model release.
• GenesisCode does not require agents to modify generated Rust or shell glue. Any unavoidable host surface must be small, generated where possible, versioned, and independently tested.
• Passing one local script or the existence of a JSON report is not release proof.
• Genesis Foundry is not a GenesisCode v1 prerequisite, an autonomous optimizer, a general algorithm-invention claim, or permission to enlarge the kernel. Before v1, exploratory boundary/schema notes may be retained as non-normative design inputs when they do not preempt the active release path; F2 execution and completion begin from a separate bounded workspace only after the production semantics and evidence interfaces it consumes are frozen. GenesisExamples/GenesisApps wait for finite F2.r, and GenesisBench/GenesisChallenge wait for finite R8.3.b, not open-ended Foundry or universal-showcase expansion.

---

2. Truth model

The project currently has broad functionality and many gates, but a single green checkmark hides important differences. From R0 onward, every capability and public claim uses this maturity ladder:

Level	Name	Meaning
L0	Specified	Normative behavior, failure semantics, resource model, and compatibility rules exist.
L1	Implemented	A reachable implementation exists; experimental wiring and wrappers qualify only for L1.
L2	Verified	Positive, negative, differential, property, and boundary tests pass on the reference host.
L3	Reproducible	Hermetic checks pass from a clean checkout on the supported host matrix with pinned inputs.
L4	Product-proven	The feature succeeds in representative agent and domain workloads under declared SLOs.
L5	Release-attested	A signed, immutable release evidence bundle binds source, toolchain, tests, artifacts, and claims.

Rules:

• feature_matrix.md must report the level, not a binary checkmark.
• A checked roadmap task cites durable evidence and its exact input identity. Mutable .genesis/perf/ files are local observations, not L5 evidence.
• A check_* command is read-only. It must never repair state, regenerate reports, download undeclared inputs, or turn a missing artifact into a pass.
• An update_* command may regenerate derived material, but its output must be reviewed and then checked separately.
• Release evidence is content-addressed, schema-versioned, reproducible offline from declared inputs, and independently verifiable without trusting the producing CLI.
• Routing a command through a .gc entrypoint establishes reachability, not self-host semantic ownership.
• Public documentation states the lowest level that all supported platforms satisfy.

2.1 Evidence classes

Class	Purpose	Durability
E0 local observation	Development timing, debug output, exploratory report	Ignored and disposable
E1 checked test	Named test/golden/property result tied to a source revision	Reproducible in-tree
E2 gate manifest	Machine-readable inputs, commands, versions, outputs, durations, and resource use	Versioned schema; generated artifact may be ignored
E3 release candidate bundle	Full host-matrix evidence, negative controls, SBOM, provenance, benchmark samples	Immutable candidate artifact
E4 release attestation	Signed hash tree over source, binaries, evidence, compatibility profile, and claims	Published and independently mirrored

2.2 Definition of done for a task

A task may be checked only when its line contains done YYYY-MM-DD; evidence: <stable path or test>; input: <revision/hash>. The cited check must include at least one negative control when the task protects a trust boundary. Performance tasks include raw samples, machine profile, variance, warm/cold distinction, and a reproducible command. Documentation alone cannot close implementation work.

2.3 Open-standards posture

GenesisCode should define new formats only for genuinely GenesisCode-specific semantics. It should pin and profile mature open standards for envelopes, transport, components, updates, and inventories rather than create gratuitously incompatible substitutes. Versions below are the audited 2026-07-10 baseline; R0 must pin exact schemas and provide an explicit upgrade process rather than following latest implicitly.

Area	Adopt/profile	GenesisCode-specific extension
Agent transport	MCP 2025-11-25 over stdio first, with version/capability negotiation; experimental Tasks are negotiated and never required by the core profile	Semantic workspace snapshots, capability minimization, evidence IDs, and deterministic tool-result contracts
Attestation framework	in-toto Attestation Framework v1.2, Statement v1, and an explicitly pinned authenticated envelope/bundle profile	Predicates for semantic patches, obligations, replay verification, bootstrap witnesses, and agent provenance
Build/source provenance	SLSA 1.2 provenance and verification expectations	Hermetic/reproducible-build claims, Genesis profiles, semantic inputs, and independent verifier results
Portable extension ABI	WebAssembly Component Model and WIT with WASI 0.3 as the async-capable candidate profile and a declared WASI 0.2 compatibility strategy	Mapping Genesis values/effects/capabilities/resource charges to component worlds
Package/update trust	TUF 1.0.34 threshold roles, delegation, freshness, rollback/freeze protection, and recovery	Content-addressed package graph, evidence policy, transparency proofs, and offline promotion
Software inventory	SPDX 3.0.1 or a later explicitly profiled compatible version	Genesis package/profile/capability/evidence relationships not represented by the base SBOM

The project may use narrower subsets or stricter rules. Every deviation records why the standard is insufficient, how interoperability is retained, and who independently verifies the extension.

2.4 Foundry discovery maturity

Foundry results use a separate ladder so research artifacts cannot borrow GenesisCode’s L-levels or a product release’s authority:

Level	Meaning	Explicit non-claim
FD0 Generated	The canonical candidate graph parses and its lineage is retained.	Not known to execute or satisfy a task.
FD1 Executable	It executes inside the declared sandbox on at least one admitted instance.	Not correct, general, fast, or safe to promote.
FD2 Bounded verified	Independent checks pass for the exact finite domain, properties, and semantic profile in the receipt.	Not a proof outside those bounds.
FD3 Generalized	Precommitted unseen sizes/distributions, metamorphic properties, adversaries, and ablations pass.	Not historical novelty or production readiness.
FD4 Independently reproduced	A separately provisioned verifier/operator reproduces correctness and cost evidence from the closed bundle.	Not authorized for a production destination.
FD5 Promoted	The destination’s independent authority accepts a semantic patch/package/rewrite under named rollback and compatibility rules.	Not valid for any unlisted profile, target, or future version.

Proof status remains orthogonal: unproved, tested, exhaustive-bounded, solver-certified, proof-assistant-checked, and independently-replayed are never collapsed into one verified flag. Semantic quotienting likewise means quotienting by a named certified equivalence relation, not deciding arbitrary program equivalence.

---

3. Historical audit log and current correction

Sections 3.1-3.23 preserve the dated decisions and counterexamples that produced the current plan. They are historical records, not an executable queue. When an older entry conflicts with a later entry, the latest dated correction controls; section 3.24 is the current correction. Current task selection comes only from section 10 and the machine-generated execution slice.

3.1 What exists

• An 18-crate Rust workspace implements the kernel, effects, CLI, types, optimizer, obligations, patches, packages, registry, VCS, WASI, WebAssembly, graphics, and runtime benchmarks.
• The pure-kernel, seal, no-user-panic, deterministic effect log/replay, deny-by-default capability, and self-host-boundary gates exist and currently pass when their prerequisites are built.
• Production command routing is artifact-only/self-host-first, strict fallback guards exist, and stage2 WebAssembly execution uses wasmi.
• Effect rows and deterministic concurrency specifications/implementations already exist. Their roadmap work is audit, completion, and product proof, not invention from scratch.
• The warm command and JSON request protocol exist. A generated MCP server does not yet appear to be the default agent interface.
• The authoring skill, pointer guide, prompt pack, recipes, agent index, generative workloads, and capability gauntlets exist and pass static structure checks.
• The project has substantial domain wiring across services, browser, data, process/network, GPU, hardware, mobile deployment, collaboration, UI, graphics, and XR.
• Recent interpreter work added inline small integers, hybrid vectors, compiled parse fast paths, fast primitive wrappers, n-ary application support, and inline environment slots.
• A local strict workload measured approximately: fib(25)=163ms, vector build =6ms, map build =402ms, string concatenate =15ms, self-host parse =3656ms, dispatch =1211ms. These are E0 observations, not release claims.

3.2 Material gaps found by this audit

1. ROADMAP.md is untracked, so the nominal canonical plan is not yet repository history.
2. feature_matrix.md reports a nearly all-green binary view and “Known gaps: none” despite open semantic, performance, self-host, agent-training, evidence, and release work.
3. Several evidence checks treat absent mutable reports as a reason to regenerate them. Audit and mutation are therefore conflated.
4. Resolved 2026-07-10: scripts/check_root_lock_policy.sh no longer assumes Python 3.11 tomllib; its required TOML subset is checked by a POSIX awk parser with embedded adversarial controls.
5. Cold hardening checks can rebuild much of the workspace. One no-panic/TCB run took about 182 seconds and regenerated roughly 4.8 GiB under .genesis/build/cargo, making the default agent loop too expensive.
6. The two largest Rust crates, gc_effects and gc_cli_driver, are roughly 40k and 32k Rust lines respectively. This concentration increases review, compile, and semantic-ownership risk.
7. Self-host .gc sources are much smaller than the remaining Rust semantic surface. Current command routing does not prove that typechecking, obligation decisions, packaging, canonicalization, or patch semantics are GenesisCode-authoritative.
8. The current authoring bundle is broad but not yet a compact, versioned, training-ready SDK. It lacks a stable diagnostic catalog, held-out task corpus, leakage policy, and model-agnostic scorecard.
9. Interpreter closure capture, linked lexical frames, let allocation, long tail-loop behavior, and map performance remain open.
10. Heap ownership, cycles, allocation accounting, deterministic out-of-memory behavior, and long-lived daemon leak limits are not yet closed as language/runtime contracts.
11. The existing roadmap places bytecode/JIT work before the agent loop and treats a heavyweight JIT as mandatory without a measured decision gate.
12. Version/profile compatibility, migration tooling, release evidence authority, gate cost, and disk lifecycle need first-class ownership.

3.3 Immediate interpretation

GenesisCode is ready for controlled experimentation and agent-assisted development inside the repository. It is not yet ready to be presented as a stable training target or trusted production language. The shortest path to that status is R0 plus R1, not a JIT. The shortest path to a defensible “fully self-hosted” claim is the ownership ledger and bootstrap program in R4, not more routing coverage.

3.4 Independent review delta: 2026-07-14

An independent dirty-worktree review exercised the newly built trust and agent surfaces rather than accepting their generated reports. It confirmed that the MCP server, warm protocol, structured diagnostics, compact cards, independent evidence verifier, signed failing baselines, and most of the gate architecture are substantive. Its full local run reported 1,565 passes, five failures, and 15 ignored tests across 269 binaries. Those counts are E0 observations, not clean-clone or release evidence.

The review also established the following release-blocking or roadmap-relevant deltas:

1. Denied-effect replay diverges between Rust and self-host engines on both native and WASI mirrors. This is one deterministic trust-path defect, not two unrelated test failures; R0.2.f owns its closure.
2. Spawn and persistent host-bridge kill/reap stress tests race under load, cli_agent_plan is load-sensitive, and a default regression test recursively launches a multi-minute changed-fast pipeline. R0.2.g must make the default suite hermetic and repeatably load-stable without hiding failures behind ignores.
3. The new MCP/warm code has 14 Clippy warnings. R0.2.h makes warning-free all-target/all-feature builds part of the ordinary checkpoint, including newly generated modules.
4. The current work accumulated hundreds of dirty/untracked files without a remote checkpoint, so neither bisectability nor the rewritten GitHub CI has been proven. R0.1.a and R0.1.g are the first priority.
5. Generated state reached about 59 GiB and deterministic cleanup classified about 51 GiB as rebuildable. Cleanup safety is strong, but automatic quota/lease enforcement is still absent; R0.4.g owns bounded steady-state caches.
6. Startup and fib observations drifted backward while PB-5 map construction and PB-7 self-host parsing remain honestly below budget. R2.1 and R2.3 prioritize general runtime fixes and regressions over microbenchmark-specific shortcuts.
7. The review found workload-specific recognizers in crates/gc_kernel/src/compiled_runtime/patterns.rs; R2.1.g has since deleted that production path, installed a governed tombstone, and added fail-closed scans against equivalent benchmark dispatch. Its removal exposed an honest PB-4 regression that R2.1.h must close through semantically general optimization.
8. MCP can suppress accepted in-flight responses when stdin closes, and concise human diagnostics are sometimes too terse. R1.3.e and R1.2.f close those lifecycle and usability gaps without creating a second semantic API.
9. The trust-infrastructure investment was necessary, but the project now has enough governance machinery. R0.4.h imposes consolidation, and milestone effort shifts to transactional agent sessions, corpus/held-out evaluation, the generated authoring skill, instruction/content separation, PB-4/PB-5/PB-7, and product proofs.

3.5 Three-product direction review: 2026-07-15

The benchmark-first product review is accepted with stricter normalization. GenesisCode, GenesisBench, and Genesis Model are coupled programs, but their versions and authorities remain separate. GenesisBench measures cold acquisition of an unfamiliar executable formal system plus trustworthy software engineering, not syntax imitation. The current 27 public cases are nine task lineages under three context conditions and cannot support 27 independent observations. A credible Preview therefore requires lineage-scale private challenges, four isolated tracks, a fixed reference scaffold, canonical adapters, predeclared statistics, useful post-release overlays, and maintenance tasks. The English-intent surface begins before the specialist model as a quarantined data-generation instrument; the specialist begins from an audited open base only after the corpus firewall passes. Model inference remains an explicit effect, general-domain knowledge remains available through weights/packages/tools/context, and continuous proposal generation never acquires continuous promotion authority.

3.6 Independent implementation review delta: 2026-07-16

A second independent review exercised GenesisBench end to end through real CLI run, validation, replay without model access, independent rescoring, deterministic bundling, and registry surfaces. It confirmed the three-product split, docs publication, replay parity, host-bridge hardening, warning-free build, and substantive benchmark trust core. Its reported 1,340 passing, two failing, and 19 ignored tests across 227 binaries are E0 observations from that checkout, not release evidence. That checkout exposed generated-view and ignored-output hygiene defects. A separate hosted Linux run then exposed process-boundary defects that the local summary did not classify: aggregate resident-memory policy had been implemented with a per-process virtual-address-space limit; successful children that closed standard input early were treated as FFI failures; WebSocket operations held a global network lock across blocking I/O; and persisted bridge counters allocated duplicate IDs under concurrent processes. These distinct observations remain distinct in the evidence record.

The review changes this roadmap in seven ways:

1. Generated views become a transitive closure, not a final manual regeneration step. A change to any canonical input must make focused local checks and remote CI fail before publication, and one explicit updater must regenerate the complete declared dependency closure without checks mutating state.
2. Test-lane membership remains auditable. Moving tests from the default lane to stress, performance, platform, or release lanes requires a manifest diff, rationale, owner, trigger, and proof that required CI still executes them; a lower default test count is never accepted on count alone.
3. Repository hygiene distinguishes tracked/source roots from classified generated roots. Ignored Quarto, cache, build, simulator, and benchmark outputs are excluded from source-topology scans only through the generated-state policy, remain bounded/cleanable, and cannot hide untracked source or evidence.
4. R1.4.o begins with a staged real-model reality gate: one immutable frontier general model attempts every public task class before broad baseline publication. The result may be poor or invalid; preserving the complete failure record is the value. A deterministic mock proves conformance, not model usefulness.
5. GenesisBench may remain a project-controlled Preview, but a public benchmark/leaderboard and E4 claims require an independent non-project reviewer/operator, conflict disclosure, and separately controlled signing or mirroring authority. Agent-family diversity helps challenge concentration but does not impersonate human or organizational independence.
6. Genesis Model receives a formal research-transfer lane. Project Theseus is treated as a report-first implementation reference and The ASI Stack as a living synthesis, claim/evidence ledger, and hypothesis source. Neither project, prose corpus, dashboard, or latest report becomes model architecture or training authority by proximity. R8.5.i and MQ-1 through MQ-8 require clean pinned releases, permission/license classification, artifact-level lineage, replay where possible, Genesis-specific replication, simpler baselines, ablations, negative/null retention, privacy/firewall review, and independent promotion decisions before a learning affects tokenizer, architecture, data, training, routing, memory, inference, or deployment.
7. Cross-platform boundary claims name the exact quantity, scope, enforcement mechanism, sampling/error bound, and fallback semantics. Process-tree memory cannot be substituted with per-process address space; successful early pipe closure is not equivalent to child failure; blocking stream I/O cannot monopolize unrelated bridge state; and persistent IDs require process-safe allocation. Native single-run success never substitutes for supported-host CI plus repeated high-contention and lifecycle stress.

Point 1 had no implementation owner despite being stated as an invariant. This review therefore reopens the current M0 acceptance state through R0.4.i; prior M0 evidence remains immutable historical evidence, but the current tree is not allowed to claim complete generated-authority closure until that task passes. R1.4.o and broad baseline publication depend on the reopened task.

The current local Theseus and ASI Stack worktrees are active and dirty, so their moving state is intentionally not pinned here. R8 freezes clean content-addressed source editions when the model lane actually begins; importing today’s mutable state would create false currentness and contaminate later experimental attribution.

3.7 Universal product and hardware audit delta: 2026-07-16

This audit tested the repository against the stronger one-language authoring objective rather than inferring product support from operation names, archive suffixes, or deterministic mock workflows. The existing foundation is useful: GenesisCode already has capability-shaped filesystem, process, network, database, crypto, media, plugin, browser, graphics, GPU, XR, package, and deployment surfaces; native/WASI/Wasm hosts; deterministic frame planning; mobile/edge target labels; and agent workflow fixtures. However, the generated capability ledger correctly rates the broad surfaces only L1. Reachability is not a product stack.

The audit establishes these gaps and owners:

1. gcpm build currently accepts web, desktop, service, ios, android, edge, and service-runtime, but several outputs are envelopes rather than executable products. The iOS and Android archives contain metadata, Genesis source, and a runtime descriptor without an executable app runtime; edge/service Wasm exports an empty function; web/desktop/service packages are CoreForm maps; launch scripts verify bytes and print synthetic boot/smoke tokens. R6.3 and R6.5-R6.7 must replace suffix-level conformance with authentic compilation, installation, launch, protocol, and device evidence while preserving these formats only as explicitly labeled descriptors if still useful.
2. Browser support exposes a small first-party window/input/audio/storage profile and deterministic graphics plans, not a complete website/application authoring system. There is no normative Genesis document/component/style/layout/router/forms/accessibility/SSR/hydration/PWA contract or compiler that removes handwritten HTML/CSS/JavaScript. R5.6 and R6.5 own that product layer.
3. gc_gfx provides valuable headless resource/frame codecs and scene/UI planning, but a frame hash is not a game or production UI toolkit. The repository lacks a complete retained/reactive app model, accessible widgets, text/layout/input composition, ECS, deterministic simulation clock, physics/collision, animation, asset pipeline, Genesis-authored shaders, game networking, save state, editor/inspector, and real multi-target render/audio loops. R5.6, R5.8, R6.6, and R8.2 own closure.
4. Mobile and desktop workflows do not yet prove installable applications, native lifecycle, permissions, accessibility, input, sensors, store packaging, signing, crash reporting, update/rollback, or real device behavior. R6.6 turns generated project glue into a toolchain-owned detail and requires simulator plus physical-device evidence without application authors editing it.
5. Service/data primitives exist but not a cohesive batteries-included product platform. Typed routing/middleware, authentication/session policy, schema/query/migration tooling, queues/jobs/cache/object storage/email, observability, configuration/secrets, and local production orchestration need one compatible package and capability model. R5.7 and R6.4 own it.
6. The hardware workflow is a shell plugin fixture, not a GPIO or firmware implementation. There is no bare-metal/no-OS Genesis profile, static-memory verifier, interrupt semantics, AOT MCU backend, linker/startup generation, BSP/HAL registry, GPIO/ADC/PWM/I2C/SPI/UART/CAN/USB/BLE/Wi-Fi surface, flasher/debugger/OTA flow, board simulator, or hardware-in-the-loop gate. R5.9 and R6.7 add Embedded Linux first, then representative RP2040, ESP32, and Arduino-compatible MCU families without silently changing core semantics.
7. Raspberry Pi-class Linux devices are best treated first as reproducible linux-arm64 hosts with explicit GPIO/I2C/SPI/serial capabilities, not conflated with bare metal. Tiny MCUs require a validated constrained Genesis profile with closed-world AOT, statically bounded memory/stack/effects, fixed-width numeric types, and explicit unsupported features; they cannot inherit arbitrary-precision/dynamic host behavior by accident.
8. Foreign ecosystems remain necessary under the hood, but the application authoring boundary is undefined. R5.5 expands schema/WIT/header import, generated bindings, component sandboxing, and audited package adapters so a missing domain library does not force the user or model into a second source language.
9. The current ten-archetype gauntlet and five flagship systems under-sample the north star. R8.2 expands to eighteen authentic product archetypes and R8.3 requires maintained cross-target products, real hardware, upgrades, and zero handwritten foreign application source. GenesisBench later measures these tasks by independent product lineage rather than multiplying target conditions.
10. Genesis Model cannot compensate for a missing platform contract. It may retrieve domain packages and propose GenesisCode, but compiler/runtime/package/deployment evidence remains authoritative. The model succeeds only when a general model and the eventual specialist can build and maintain products through public Genesis interfaces without private glue or privileged target knowledge.

The practical conclusion is not to put every framework into the kernel. Keep the language and TCB small; build breadth as versioned Genesis libraries, capability profiles, target adapters, component packages, generated bindings, and evidence-backed product kits. Common product paths are first-party and coherent. Long-tail domains use the same extension boundary without weakening the one-language authoring contract.

3.8 Independent runtime and benchmark-readiness review delta: 2026-07-17

The fourth independent review confirms that the runtime sprint materially improved the project rather than merely increasing its governance surface. The workload recognizers are gone and permanently guarded against reintroduction; PB-4 and PB-5 recovered through general execution improvements; cycle collection, deterministic logical allocation/live-heap metering, fallible bulk allocation, hostile-blob bounds, and native worker-process containment now have differential and adversarial coverage. These are implementation results, not evidence that every roadmap product is complete. PB-1/startup drift, PB-7, persistent-sharing stress, host-handle teardown, authentic model runs, and universal product execution remain open under their existing owners.

The review changes execution priority and acceptance in six ways:

1. R1.4.o is now the immediate product-proof lane. Its first named campaign uses Codex CLI with the provider-catalog slug gpt-5.6-luna at xhigh reasoning effort, followed by resource-fit local MLX models. Codex CLI is an Open Agent scaffold, not a raw-model Cold Acquisition result; the same underlying model may enter Cold Acquisition only through the fixed reference scaffold and an independently pinned immutable provider revision.
2. A model alias, CLI display name, or local directory name is not an immutable model identity. Every publishable attempt binds the exact Codex/adapter/runtime executable digest and version, requested model/effort, provider-returned revision/fingerprint when available, weights and tokenizer digests for local models, context/scaffold identity, repository snapshot, capability envelope, complete event transcript, and all missing identity facts. Missing immutable identity forces an explicit unranked/unknown label; it never blocks preserving the attempt.
3. The reality gate fires before further benchmark armor. One public case from each of the nine task classes runs under one frozen predeclaration and no between-class prompt, scaffold, tool, or budget tuning. Only after all nine attempts, including failures and invalids, validate and replay may the campaign expand to all 27 public conditions. Results feed typed language/documentation/tooling defects, but benchmark outcomes never weaken deterministic acceptance.
4. The existing command adapter is insufficient for claiming an agentic Codex CLI run because it has an empty working directory and no workspace tool contract. R1.4.o must version a capability-minimal Open Agent workspace-harness revision that provisions a copy-on-write benchmark checkout, makes frozen source/runtime/docs readable, confines edits to declared candidate paths, mediates tools through the disclosed scaffold, blocks private held-out and ambient user state, records every event, and destroys no failed attempt. It extends the front door rather than silently broadening the fixed Cold Acquisition adapter.
5. R1.4.o owns a campaign-execution regression beyond R0.2.g’s retained closure because a scoring integration test exceeded two minutes and failed only under the full parallel suite, while a scheduled hosted run remained queued long enough to lose operational value. Test-lane ownership must be based on measured resource behavior: long benchmark/scoring workflows move to a required serial or stress lane with an explicit trigger, while their small contract core remains in the default lane. Scheduled, push, and pull-request concurrency groups must neither starve cron evidence nor permit stale runs to consume capacity indefinitely.
6. Roadmap growth is now scope-neutral before each milestone. Every new task must name its milestone, critical-path dependency, evidence predicate, and an existing task it refines, defers, consolidates, or makes unnecessary. A milestone may grow only with an explicit capacity/sequence decision and updated exit criteria; frontier breadth cannot displace the next falsifiable product proof.
7. A 2026-07-18 local release-full audit passed the common gates, generated-authority freshness, warning-denied compilation, no-panic compilation, kernel tail stress, native/WASI workflow parity, real Apple M1 GPU parity, and source-decomposition parity before reaching the existing strict GCPM target-runtime gate at 45 minutes. That gate correctly rejected all four targets because only synthetic adapters were available and no real iOS, Android, edge, or service runtime commands were declared. This is a truthful product-readiness blocker, not permission to weaken CI=true, forge non-synthetic evidence, or raise GB-4 around duplicate work. R0.4.j refines the already-complete gate-budget work: reuse identity-matched private evidence across nested checks, provision a named reference runner with authentic target integrations, distinguish infrastructure failure from expected unsupported-product status, and re-establish the complete 45-minute/20-GiB release contract before claiming a release candidate.

3.9 Independent first-contact and benchmark-signal review delta: 2026-07-18

The fifth independent review exercised the retained Open Agent campaigns, local workspace suite, Clippy, and runtime timing. Its reported 1,397 passes, zero failures, 23 ignored tests across 231 binaries, warning-free Clippy, and approximately 0.34-second fib(25) observation are E0 checkout observations rather than release evidence. More importantly, it confirmed that the third Codex CLI/gpt-5.6-luna xhigh commissioning campaign preserved eight verified, independently rescored attempts and one genuine model/noneditable-input-drift deployment invalid after earlier harness faults were typed and removed. The observed seven perfect small-class scores and one 9,797-basis-point repair score show that this public small-context commissioning set has little remaining frontier discrimination. This is a prioritization signal, not the BQ-5 saturation trigger: one mutable-provider Open Agent family, one epoch, and one invalid cell cannot establish formal multi-family saturation or a ranked model claim.

The review adds four bounded corrections to the active sequence:

1. R0.4.k reopens generated-authority completeness without rewriting R0.4.i’s historical evidence. Changing cli_genesisbench_front_door.rs left the GenesisBench protocol closure and check_agent_authoring_bundle.sh gate input stale while the transactional graph still reported itself fresh. The immediate generated outputs must be repaired, and the graph must then discover transitive gate-input dependencies so the same class of partial freshness cannot recur.
2. R1.4.o keeps the failed expansion predicate immutable. The eight-verified/one-invalid commissioning campaign cannot be retroactively expanded under its old predeclaration. A complete 27-condition Luna follow-up requires a new frozen campaign/cohort after the deployment failure is dispositioned through general diagnostics/cards/tooling rather than task-specific prompting; all cells, including invalids, remain publishable. Medium and large contexts carry priority because the small public tier is already weakly discriminative.
3. R1.4.q distinguishes a valid held-out protocol and commitment ledger from a useful private benchmark. The current 90-lineage commitment structure reports private_verified=false; M1 therefore requires at least 45 real, independently authored or independently governed private payloads with complete custody, oracle, alternative-solution, leakage, and blind-execution evidence. Placeholder commitments, generator labels, or balanced metadata cannot satisfy this requirement.
4. R1.4.o’s publication step becomes an immediate commissioning deliverable: publish the benchmark card, methods, exact campaign chronology, all invalids and harness corrections, the deployment failure disposition, limitations/non-claims, and reproducible first-results analysis before presenting a leaderboard. Then close R0.4.j and begin R2.3 startup/snapshot work as the standing runtime priority. This refinement consumes existing M0/M1 hardening and benchmark-publication capacity; it adds no benchmark track, task class, runtime tier, or product target.

3.10 Release-graph and active-delivery audit delta: 2026-07-21

This audit compared the prose release contract, machine-readable roadmap graph, local branch, remote branches, and protected CI rather than treating a generated manifest as sufficient. It found six release and ordering defects that could make an otherwise rigorous plan execute incorrectly:

1. The local v0.5 custody tranche is preserved at commit 84a09a4, but it is not on origin/main. PR #5 is mergeable but blocked because test_suite correctly rejects the undeclared GB-8 Python packaging module scripts/lib/genesisbench_mlx_custody.py; the aggregate test job consequently fails. This is current R0.4.k evidence, not an excuse to bypass CI. No benchmark inference or downstream publication may use that tranche as a released authority until the exact commit or a reviewed successor passes required checks, is promoted to main, and the temporary branch is deleted.
2. The policy made R1.4.o start-ready even though the practical order required R0.4.k first. R1.4.o now depends on R0.4.k. Campaign predeclarations may be prepared offline, but no model inference begins against an unpublished or red authority.
3. The prose promised independent GenesisCode, GenesisBench, and Genesis Model release trains, while the graph made R9.1 wait for all of R8.5, including specialist training and packaging. Milestones are now explicit portfolio checkpoints with product-scoped submilestones. GenesisCode v1 waits for GenesisCode product proof, not a GenesisBench public release or Genesis Model package; each optional linked product must still be independently releasable and truthfully marked compatible, preview, or absent.
4. R8.5 sequenced corpus creation before the training/evaluation firewall and put independent benchmark adoption after the complete model-training chain. The corrected graph forks after verified ecosystem promotion: the GenesisBench adoption lane can close independently, while the Genesis Model lane establishes BQ-7/BQ-8 isolation before corpus admission and joins research-transfer, teacher, and base-model evidence before any training.
5. The mandatory local upgrade-health profile reproduced a host-bridge lifecycle failure: spawn_per_op_timeout_kills_bridge_processes_and_recovers returned gpu/bridge-reap because the process group survived repeated termination sweeps. P1.5 records the active defect and R2.2.f remains the sole roadmap owner; M1-A daemon sign-off and every robust-service claim wait for cross-host bounded kill/reap and no-surviving-descendant evidence.
6. The generated v1 ancestry could bypass R0 checkpoint discipline, R1.7 typed intent, R2.4 runtime observability, R3.3 optimizer/tier-controller closure, and R3.4’s explicit JIT-or-no-JIT decision; R1.5 also consumed only terminal R1.4.n rather than the complete public R1.4.a-n authority. The corrected graph explicitly fans R1.4.a-n into R1.5.a, orders R2.4 before R3.3 and R3.3 before self-host compiler migration, makes R8.1 wait for R1.7, makes R9.1 wait for the R3.4 decision, and fans every non-sequential R0.1 leaf into release assembly. Real-model campaigns and private/public GenesisBench governance in R1.4.o/q/p, the R8.5 benchmark/model lanes, and optional JIT implementation remain outside GenesisCode’s unconditional release dependency.

Capacity does not increase. Until the protected v0.5 tranche is green on main, R0.4.k is the only repository-changing publication lane. Private challenge commissioning may proceed under role-separated custody without target-model access, and analysis/specification work may continue without claiming the unpublished runtime. After promotion, the current executable tranche is: finish R0.4.j; complete the agent-authoring lane and R2.2.f daemon/handle closure; run the separately frozen Qwen3 4B, Qwen3 8B, and Luna cohorts; complete R1.4.q/p; close R2.1.h; then make R2.3 startup/snapshot work the standing runtime priority. R4.1 may proceed only as non-preemptive specification/ownership work until M1-A and M1-B are secure.

3.11 Genesis Foundry research-direction delta: 2026-08-03

The Foundry proposal belongs in this ecosystem because GenesisCode already has most of the trust substrate algorithm discovery needs: canonical CoreForm identity, pure deterministic evaluation, explicit semantic profiles, e-graph infrastructure, obligations, replay, semantic patches, content-addressed artifacts, and separate proposal/promotion authority. It does not belong in the production optimizer or the v1 critical path. The audited direction makes six corrections to the initial concept handoff:

1. Foundry is a separately versioned research program that depends one-way on frozen GenesisCode interfaces. Production crates and the default genesis CLI never depend on Foundry code; accepted results cross only through reviewed versioned artifacts and semantic patches.
2. Arbitrary semantic equivalence, mechanistic duplication, and historical novelty are not decidable by declaration. Every quotient, law, dominance result, and novelty label names its finite grammar, semantic profile, proof/test relation, literature-search limits, and defeaters. Unknown remains unknown.
3. The first slice is pure, finite, and calibrating: fixed-size bounded sequence/comparator tasks, deterministic enumeration, symmetry reduction, independent exhaustive verification, mutation controls, and known-result rediscovery. General recursion, effects, mutable heap graphs, LLM search, Circle Calculus, and Theseus scheduling enter only after that slice proves the artifact and authority model.
4. The proposed nine-crate decomposition is a target boundary map, not permission for premature fragmentation. Begin with one separately locked foundry/ workspace and a small number of modules/crates; split only when dependency, compile-cost, ownership, or independent-verifier evidence justifies it.
5. Candidate execution is hostile-input execution. It receives no ambient filesystem/network/process/model authority, has deterministic logical resource limits plus hard host containment, cannot observe hidden verifier state, and cannot alter task, reward, checker, registry history, or promotion policy.
6. Foundry quality is measured against simpler baselines. Search-space compression, rediscovery rate, counterexample yield, verifier false-accept controls, Pareto stability, abstraction reuse, total compute/storage, and human review burden are retained with negative results. A more complex search engine, law, or abstraction is rejected unless a predeclared ablation shows net value.

F2 takes this direction to its logical conclusion after v1 while allowing only non-preemptive schema/ADR research earlier. The initial browser draft remains a design input, not normative authority; F2’s checked artifacts and independently replayable evidence become the source of truth.

3.12 Portfolio concentration and model-readiness audit delta: 2026-08-03

The latest project-wide review is accepted where repository evidence supports it. The project has enough L1 breadth; the dominant risk is concentration failure, not missing ambition. This revision makes five execution corrections:

1. Independent utility is mandatory. GenesisCode and GenesisBench release on their own evidence and remain useful with no Foundry workspace or Genesis Model package. Foundry is research infrastructure, not a language or benchmark dependency. The Genesis Model is the final optional product and cannot become a hidden prerequisite for authoring, verification, deployment, scoring, or release.
2. v1 is finite. GenesisCode v1 Core freezes the language, deterministic runtime, package/evidence system, agent interfaces, native/WASI path, self-host authority, and one authentic CLI/WASI plus service profile. Web/UI, desktop/mobile, game/media, Embedded Linux, MCU/boards, GPU/XR, and later targets are independently versioned platform packs. Every pack retains the one-language and authentic-target burden, but an unfinished pack cannot hold the core release hostage. The eighteen-archetype gauntlet and ten flagships become portfolio maturity evidence rather than v1 Core prerequisites.
3. Foundry calibration precedes model implementation. This audit originally made F2.a-q the MF calibration boundary and all F2.r-z optional. Section 3.25 later strengthens the finite boundary to F2.r so the independently promoted Genesis Algorithms release also precedes Bench, Challenge, and Model; F2.s-z remains optional expansion.
4. Genesis Model has one hard readiness gate. R8.5.t is a recorded independent decision, not a slogan. It cannot pass until GenesisCode v1 Core and Genesis Algorithms are stable, GenesisBench has an independently useful trust release and a proven training/evaluation firewall, MF Foundation is reproduced, the Theseus/ASI/Foundry transfer pack is reviewed, legal/privacy/security/compute/release feasibility is closed, and a simplest-adequate open baseline strategy is predeclared. Corpus construction, teacher selection, tokenizer/base selection, training, distillation, packaging, and integration remain non-start-ready before that decision. Generic model-provider support and typed intent may continue because they are language capabilities, not Genesis Model implementation.
5. The current slice is bounded and generated. One repository-changing production task may be active. A separately custodied immutable benchmark campaign may coexist only with disjoint files, roles, and authorities. The existing roadmap policy orders the immediate slice as finish/publish R0.4.j, close P1.5 through R2.2.f, then resume the M1-A/M1-B and runtime sequence. Merely start-ready work is not permission to widen WIP. python3 scripts/lib/roadmap_execution_manifest.py --slice reports the selected task, blockers, owner paths, guards, rollback, and queued successors from existing authorities.

This order supersedes older prose that allowed pre-gate model architecture/tokenizer experiments or made every target pack a v1 Core blocker. It does not discard the universal one-language goal: it converts that goal into independently shippable, evidence-bearing packs so useful releases arrive before the complete portfolio does.

3.13 Executable release-lane isolation audit delta: 2026-08-03

A dependency audit of the generated execution manifest found that the prose-level Core/pack split was not yet mechanically complete. Historical edges through R8.4.e, R8.5.s, R8.5.r, and AB-7 could still make GenesisCode Core, GenesisBench Trust, Foundry calibration, or a profile-bound Genesis Model wait for the universal eighteen-archetype portfolio. This revision closes that gap:

1. GenesisCode v1 Core depends on R8.2.a-b and the Core human/documentation surface, never R8.2.c-r or R8.3. Pack documentation, device soak, and flagship operation remain mandatory for the pack that claims them.
2. GenesisBench Trust depends on a compatible frozen GenesisCode profile and its own independent operators, validity, custody, governance, and adoption evidence. It does not require universal product maturity or a Genesis Model.
3. At this audit MF depended on signed v1 Core interfaces and F2.a-q only. Section 3.25 replaces that boundary with F2.a-r so the initial independently governed algorithm-library release is included; F2.s-z remains separately gated expansion and cannot be pulled into Model readiness by a scalar F2 completion claim.
4. Genesis Model readiness depends on stable Core, GenesisBench Trust, MF, the firewall, and accepted transfer evidence. Model release evaluation covers its declared compatible profiles; a coupled language/model proposal gets the full four-cell design, while a model-only proposal uses an explicit frozen-language two-cell control rather than inventing a language change.
5. The execution policy’s closed release_lane_contracts table names each release root, mandatory ancestors, forbidden workstreams/task families, and narrow exceptions. The execution-manifest self-test injects representative cross-lane leaks and treats acceptance as a release-policy violation. Future prose, milestone, or policy edits must preserve these negative dependencies, not merely avoid graph cycles.
6. Shared service, build, test, and supply-chain authorities are profile-parametric rather than aggregate portfolio gates. Core requires the service/data/operations subset it actually demonstrates, but not the data/ML library. Product-generator adversarial testing and product/hardware supply-chain qualification provide reusable harnesses; each platform pack must bind and pass its own applicable cases, while Core, GenesisBench, Foundry, and Genesis Model cannot inherit unfinished pack cases through a scalar workstream dependency.

This correction removes accidental blockers only. It does not promote an unfinished capability, reduce any claimed profile’s evidence burden, or allow Core, Bench, Foundry, Model, or a platform pack to borrow another lane’s evidence.

3.14 CI control-plane and delivery-liveness audit delta: 2026-08-04

The seventh independent review identified a release-control failure that is accepted after direct verification against GitHub Actions history and repository runner inventory. At the audit boundary, the latest successful main CI run was 29664738972 on 2026-07-18. The subsequent history contained fifteen failed and sixteen cancelled default-branch runs, while the repository had zero registered self-hosted runners. PR #13 repaired the deterministic nested write-skill evidence-binding failure and passed all 97 protected aggregate steps before merge, but that does not by itself restore default-branch or scheduled-full observability. Local and PR green remain necessary observations; neither substitutes for a terminal run of the exact default-branch profile whose claims are being published.

This review makes five bounded corrections:

1. CI liveness is part of R0.4.j, not external operations trivia. P1.6 records the active control-plane defect. It refines the existing M0/M1-A/M1-B release-profile task, consumes its operational-hardening capacity, and adds no product, platform, benchmark, gate family, or release lane.
2. Concurrency policy must preserve authoritative work. Pull-request runs may cancel superseded runs for the same PR. Push, schedule, and operator-dispatched runs use event/profile-aware groups or an explicit bounded FIFO queue so a newer run cannot silently replace the sole pending evidence for an older immutable revision. Every cancellation has a typed supersession or operator disposition; scheduled full evidence cannot share a starvation domain with ordinary pushes.
3. Unavailable self-hosted labels are discovered before dispatch. A GitHub-hosted preflight checks the exact required label conjunction and online/busy state, binds the inventory observation, and prevents an impossible job from entering the 24-hour self-hosted queue. Absence becomes a bounded infrastructure-failure or unsupported-profile result. It may be non-blocking only for a release profile that explicitly makes no claim for that optional platform pack; it is a hard failure for any profile that claims authentic device coverage. A deterministic surrogate can prove harness semantics but never satisfy authentic GPU evidence.
4. An independent watchdog observes the observer. A disjoint workflow and concurrency authority checks that the latest pushed main revision receives its required aggregate disposition within two hours, every scheduled or dispatched full run terminates within sixty minutes, a successful full run is no more than forty-eight hours stale while the project is active, and no undispositioned failure/cancellation or impossible runner queue persists across the next observation. Static checks prove the watchdog cannot share the failing workflow’s concurrency group, and fixture tests reject stale-success, cancelled-only, missing-schedule, wrong-head, impossible-label, and self-reporting-success mutations.
5. The remaining recommendations already have owners. R1.4.o already requires immutable Qwen3 4B/8B and Luna campaigns plus the benchmark card, methods, chronology, invalid dispositions, and first-results report. R1.4.q already requires at least 45 custody-verified real private lineages. Sections 3.10, 7, and 14 already freeze milestone growth and WIP. Those requirements remain next in sequence and are not duplicated or displaced by another planning layer.

R0.4.j closes only after the exact reviewed main revision passes the complete standard and release-full profiles under these controls, the watchdog independently recognizes the evidence, the runner-absent negative path terminates within its bound, and the historical cancelled/failed sequence has an append-only disposition. This is a delivery-integrity requirement, not permission to treat optional unavailable platforms as implemented.

3.15 Release-DAG and milestone-flow audit delta: 2026-08-05

The latest independent review verified that the prior CI corrections work and independently reproduced the remaining release-full failure. Both hosted v0.1 pair workers completed their cold child in approximately 42.7 minutes under the unchanged 45-minute worker bound, then gave the warm child only the remainder of one shared 50-minute pair envelope: 430674ms and 442492ms. This is the expected failure of an impossible serial contract, not evidence for raising GB-4 or the watchdog SLO. The in-flight v0.2 policy, schema, validator, and class-selective health runner correct the methodology by using independent matched cold and deterministically prewarmed cohorts rather than calling observations from unrelated hosted machines pairs. They are necessary but not sufficient: hosted CI still runs v0.1 until the worker reports, read-only aggregate, workflow fan-out, failure-tail retention, and watchdog recognition are promoted as one reviewed migration.

This review changes execution in four bounded ways:

1. The next R0.4.j transaction is the hosted v0.2 cutover. Replace release_full_measurement_pair rather than tuning its constants. Run three independent cold and three independent warm cache-sensitive workers with fresh 45-minute bounds, execute invariant work once, execute three isolated stress/performance workers, derive warm precondition proof outside measured time, and give only the read-only aggregate authority to decide completeness. Permanent controls reject any surviving serial-pair route, fewer or even-sized cohorts, producer-authored verdicts, cross-run fan-out, or a workflow whose worst-case critical path exceeds sixty minutes.
2. R0.4.j retains one exact exit. Policy or local runner completion cannot close it. The exact reviewed main revision must produce a complete v0.2 bundle, bounded diagnostic tails for every failed node, named target dispositions, append-only disposition of the v0.1 counterexample runs, a successful aggregate, and independent watchdog recognition within the existing freshness window.
3. GenesisBench product proof moves directly behind R0.4.j. After the exact-main release cutover, the next repository-changing frontier is R1.4.o’s already-specified Qwen3 4B nine-class campaign: freeze and publish its predeclaration before inference, execute every cell once, preserve invalids and failures, validate/replay/rescore independently, and publish the result. R2.2.f and R1.5 remain start-ready M1-A work, but no longer serialize this dependency-free M1-B adoption proof.
4. Long production work cannot silently starve a disjoint authorized lane. If one production task remains active for more than 72 hours or spans two independent review checkpoints, the execution slice must record a dated disposition for every start-ready parallel lane: active, externally blocked with the missing authority/operator/resource, or explicitly deferred with milestone impact. One immutable benchmark custody/execution campaign or private-lineage commissioning campaign may proceed only under the existing disjoint-file, disjoint-authority, frozen-predeclaration, no-target-leakage conditions. This rule exposes avoidable serialization; it does not increase repository-changing WIP, compel model access before custody freezes, or let parallel work delay the selected production frontier.

Parallel-lane disposition 2026-08-05: R1.4.q commissioning is externally blocked from activation because no disjoint role-separated independent author/admission/custody operator set and storage authority is recorded for this tranche. Repository-changing corpus/protocol work also overlaps the current generated-authority closure and cannot become a second production transaction. No target-model access is authorized. An out-of-repository no-target-access commissioning lane may activate immediately once those named authorities, conflict declarations, storage boundaries, and frozen admission contract are recorded; otherwise the blocker remains visible in the next execution review.

3.16 GenesisBench stratification and GenesisChallenge audit delta: 2026-08-06

The benchmark direction is accepted with one structural correction: calibrated evaluation and open-ended project improvement answer different questions and must not share a rank. This revision refines R1.4.o/q/p and R8.5.a-e,s, adds the post-M5-B R8.5.u-v contest work, and consumes their existing benchmark/adoption capacity. It adds no product, platform, Foundry, or model dependency to the release DAG: M1-B/M5-B gain explicit acceptance detail inside their existing benchmark tasks, while GenesisChallenge blocks no release. The frozen v0.1 public campaigns, task IDs, conditions, outcomes, and failed expansion predicates remain immutable commissioning anchors; no new label or profile is applied retroactively.

1. Difficulty, context, and cost become orthogonal axes. Every future scored task declares exactly one empirically maintained easy, medium, or hard difficulty band; one existing small, medium, or large context condition where applicable; one run profile; one task class; one capability/product surface; one benchmark track; and the exact language, epoch, scaffold, adapter, and hardware cohort. Context length is never used as a proxy for difficulty, and no aggregate hides a missing required stratum.
2. Difficulty is calibrated, not editorialized. Authors predeclare a structural rationale covering semantic depth, repository scope, ambiguity, authority minimization, maintenance horizon, target authenticity, and resource pressure. Independent non-target pilots across at least two materially different model families then calibrate the bands with a predeclared item-response model or a justified nonparametric equivalent. Labels and ranking weights are immutable within an epoch; low-discrimination, differential-item-functioning, leaked, or unsound items receive append-only dispositions rather than post-hoc relabeling.
3. Run profiles answer different operational questions. smoke is a deterministic non-ranking conformance check. fast is a fixed, content-addressed, precommitted stratified subsample for inexpensive directional comparison. standard is the default statistically powered comparison over every required class and difficulty stratum. full is the complete declared compatible capability/product matrix, including target-authentic cases only where the frozen GenesisCode profile has the required L4 support. Fast results live in their own cohort, publish their sampling frame and wide uncertainty, and cannot satisfy Trust-release, universal-coverage, or strongest-model claims.
4. Fast never means hand-picked. Each epoch publishes at least two deterministic fast forms derived before target-model access from lineage-level strata, with no condition siblings split across train/evaluation or counted as independent tasks. Selection optimizes declared coverage, not prior model scores; every omitted class or capability is visible. A fast result names the form identity and is comparable only with the same form, track, profile, scaffold, adapter, attempt policy, and compatible hardware class.
5. Capability coverage follows the language, not marketing. The benchmark coverage ledger maps every released syntax/semantic form, effect/capability, package/build/deploy operation, agent workflow, maintenance operation, and L4 product/target pack to at least one eligible task or an explicit unbenchmarked/unsupported disposition. Easy cases isolate primitives and local reasoning; medium cases compose repository-scale libraries, CLI/service behavior, policy, packaging, and repair; hard cases require multi-subsystem construction, migration, optimization, authentic deployment, or maintenance without weakening obligations.
6. Translation becomes behavioral reconstruction. Once a destination profile is L4, GenesisBench may commission license-clean source migration tasks that expose a foreign-language application and spec reconstruction tasks that expose behavior, assets, protocols, and acceptance tests without requiring source. Solvers author only GenesisCode-owned source and manifests. Acceptance uses behavioral, property, metamorphic, security, accessibility, resource, deployment, and seeded-maintenance tests rather than reference-patch equality; generated foreign target artifacts are disposable and non-editable. An unsupported target is a typed benchmark exclusion, not a model failure.
7. Epochs rise without erasing the tide line. Public and private anchor lineages preserve longitudinal measurement; saturated items remain available as diagnostics and historical anchors while ranking weight rotates prospectively under BQ-5. New hard material is precommitted before target access, and difficulty advancement preserves overlapping anchors and publishes equating uncertainty. Tasks are retired for ranking only through governance; prior bundles, labels, weights, failures, and scores remain replayable.
8. GenesisChallenge is a separate contribution contest. Its challenge record freezes the exact repository revision and reproduced defect or measured baseline; editable and protected scope; acceptance tests and hidden adversarial controls; capability, resource, security, and compatibility bounds; verifier identities; expiry; prize or credit terms; and destination-owned promotion path. Runtime optimization, correctness/security repair, diagnostics/agent tooling, library/platform capability, proof/fuzz/conformance, and benchmark-validity work are eligible. Challenge status is append-only (proposed, admitted, open, claimed, verified, accepted, merged, retired, invalidated, or disputed), and proposer, solver, model/provider, scorer, custodian, contest operator, and destination approver conflicts are explicit. A solver may receive signed attribution for a verified delta, but cannot admit, score, merge, promote, or rewrite its own challenge; evaluator changes are meta-challenges that must shadow-replay history and cannot verify themselves.
9. The optimization target is a Pareto frontier, not one universal score. GenesisChallenge reports accepted correctness, safety, capability, latency, memory, energy, context, authority, proof burden, maintainability, and human-review deltas separately, with regressions and failed attempts retained. GenesisBench continues to compare acquisition and trustworthy construction under frozen contracts. Neither surface may claim that GenesisCode is universally best from a scalar composite or let benchmark-specific shortcuts enter production semantics.

3.17 Model-neutral benchmark portability audit delta: 2026-08-06

The concern is accepted. GenesisBench v0.1 already has model-agnostic semantic scoring, five closed adapter classes, fixed-scaffold cohorting, and typed harness invalids, but those facts do not yet prove that an arbitrary capable model can enter without imitating Codex CLI, OpenAI Responses, MLX, Qwen chat conventions, or a provider-specific reasoning control. R1.4.r now closes that portability proof before M1-B. It refines R1.4.e/f/g/k/l/n and the publication/governance work in R1.4.o/p; it does not rewrite completed evidence or retroactively reclassify any frozen campaign.

1. One transport-neutral task authority feeds every model. The canonical benchmark input is ordered UTF-8 content blocks, declared roles/trust labels, immutable file/artifact attachments, generic tool schemas where the condition permits them, budgets, and an acceptance manifest. It contains no provider wire object, tokenizer ID, hidden system message, SDK type, special token, or model-family instruction. Adapters perform typed lossless transport mapping only and cannot summarize, improve, reorder, omit, or semantically rewrite task content.
2. A minimum-common-denominator profile admits text generators. Every eligible non-interactive task has an artifact-text condition that requires only bounded text input and text output; the harness accepts versioned complete-file maps, unified patches, or declared final artifacts and performs parsing, workspace application, tests, and scoring outside the model. Bounded diagnostic-repair turns append canonical text observations without requiring native function calling. Models with chat, streaming, JSON mode, or tool calling can use those features only in separately keyed interaction conditions.
3. Generic tools do not imply one native encoding. A canonical-tools condition exposes the same closed tool names, schemas, results, order, and authority through either provider-native tool calls or a canonical JSON-text emulation. Cross-encoding scripted controls must produce identical normalized tool requests, workspace transitions, candidate artifacts, resource charges, and scores. Provider-owned search, code execution, subagents, memory, retrieval, or undeclared tools are disabled in fixed-scaffold tracks and disclosed only in Open Agent cohorts.
4. Capabilities are negotiated before task delivery. Each adapter declares support for plain completion, chat roles, multi-turn state, system messages, streaming, native tools, JSON constraints, seed, sampling controls, stop sequences, token accounting, context limit, image/audio inputs where applicable, and cancellation. Required-feature absence yields unsupported-interaction or unsupported-context, not a semantic model failure; it remains a visible missing cell and prevents complete-cohort eligibility rather than disappearing from the denominator. Optional unsupported controls are omitted and cohort-keyed rather than silently emulated; a provider rejection, timeout before valid delivery, malformed wire response, or adapter extraction defect remains an invalid infrastructure/harness outcome.
5. Context is tokenizer-neutral at authority boundaries. Task and card budgets are canonical UTF-8 bytes plus structural node/file counts. Every adapter records the exact delivered bytes and, when available, provider/model token counts and tokenizer identity as non-authoritative resource facts. No canonical task is truncated, reordered, or selected using one model’s tokenizer. If exact content cannot fit a declared model context window, the complete condition is reported unsupported and a separately predeclared smaller condition may run; hidden per-model compression or prompt tuning creates a new scaffold cohort.
6. Candidate extraction is plural and semantics-first. The closed extractor accepts the declared neutral artifact forms, preserves raw output, and never repairs generated code. Format variance that still yields the same declared workspace is normalization; absence of an extractable candidate produces a typed protocol outcome, not an invented semantic score. Once a candidate exists, all models face identical parser, type/effect, obligation, policy, test, resource, replay, and maintenance authorities; style, prose, markdown fences, identifier taste, and reference-patch resemblance do not affect quality.
7. Failure attribution precedes model judgment. Every attempt terminates in exactly one independently rederivable class: verified, semantic-failure, model-protocol-failure, adapter-failure, scaffold-failure, provider-failure, infrastructure-failure, resource-limit, unsupported-interaction, unsupported-context, or abstained. Only a validly delivered request, conformant response capture, successful neutral extraction boundary, and intact scoring workspace can produce semantic-failure. Ambiguous ownership fails toward invalid/non-claiming status and retains all evidence.
8. Portability is tested by metamorphic adapters, not brand count. One scripted semantic model runs through completion-only, chat, streaming/non-streaming, native-tool, JSON-text-tool, local direct-runtime, HTTP, and JSON-stdio fixtures; normalized requests, candidate workspaces, scores, and resource accounting must agree where capabilities overlap. Mutants that inject instructions, alter roles, drop content, use a different tokenizer to truncate, add retries, enable provider tools, repair output, leak secrets, or blame the model for harness failure must be rejected. At least three independently implemented real interface stacks and three materially different model families reproduce the common artifact-text matrix before GenesisBench Trust.
9. Bring-your-own-model is a product surface. A self-hosting user supplies one declarative adapter manifest plus either a bounded JSON-stdio command or a loopback/remote endpoint. genesis bench adapter inspect, conformance, and dry-run validate capability negotiation, secret isolation, request/response closure, timeout/cancellation/reap, transcript retention, and model-free replay before any scored access. Public documentation provides completion-only, generic chat, native-tool, JSON-text-tool, local-runtime, and Open Agent templates, with no GenesisCode or provider SDK changes required to add a conforming model.

3.18 Self-host-first activation decision: 2026-08-06

Historical note: sections 3.24 and 3.25 supersede items 3, 4, and 6 after the unchanged R9.4.f Core handoff; they are retained here to preserve the decision trail.

The concern is accepted. GenesisBench protocol and fixture work has exposed valuable defects, but the program must not optimize an unstable language around benchmark campaigns or let benchmark publication compete with semantic ownership. The stable task and milestone IDs remain unchanged so completed history and evidence remain addressable; activation order, not historical identity, is changed here and in policies/roadmap_execution_v0.1.json. This decision supersedes every earlier execution-priority or parallel-campaign statement in sections 3.5 through 3.15 while preserving those sections as dated historical rationale and evidence.

1. GenesisCode v1 Self-Hosted Core is the sole production critical path. The activation gate is exact reviewed R9.4.f evidence over the finite Core scope, including all R4 exit criteria: every production semantic decision above the specified stage0 reaches H2 GenesisCode authority; stage2/stage3 reach an H3 hermetic cross-host fixpoint; diverse double compilation and independent H4 conformance verification pass; legacy semantic authorities are unreachable; and the released language, runtime, compiler, formatter, type/effect checker, optimizer, patch/obligation/policy logic, package/registry/build orchestration, CLI/agent interface, documentation generation, native/WASI CLI, and service workflows are usable without GenesisBench, Foundry, a model, or mutable research state.
2. Completed benchmark foundations are preserved, not expanded or erased. Existing public fixtures, protocol/scoring authorities, adapters, frozen attempts, invalids, and historical reports remain append-only. Before R9.4.f, benchmark code may receive only security/correctness maintenance required by GenesisCode gates, model-free conformance tests, regeneration needed to keep completed authorities reproducible, and the non-scoring interface canary defined in section 3.19. No benchmark-task target inference, private-lineage commissioning, campaign, rank, benchmark governance release, adoption claim, GenesisChallenge operation, or benchmark-driven language tuning begins.
3. Superseded downstream activation. This decision originally activated GenesisBench directly after R9.4.f. Section 3.25 now requires F2.r/MF and the exact Genesis Algorithms release first; every later task, scaffold, adapter, context, scorer, and result binds both language and library identities.
4. Superseded Foundry ordering. This decision originally placed Foundry after GenesisBench Trust. Sections 3.24-3.25 reverse that edge safely: independent F2.a-r Foundation precedes Bench, while only cross-ecosystem F2.y waits for compatible Bench Trust.
5. Internal tests are not GenesisBench releases. Compiler differentials, conformance corpora, mutation controls, agent workflow tests, and authentic product acceptance remain mandatory throughout the self-host path. They establish language correctness and usability but carry no model-comparison, held-out, calibration, rank, adoption, or benchmark-release claim.
6. The freeze remains fail-closed and machine-enforced. The unchanged pre-Core rule keeps Benchmark and Foundry implementation out before R9.4.f. Section 3.25 now makes F2.r the required ancestor of Preview, Trust, Challenge, and model-transfer work, while release-lane controls reject Bench/Model ancestry inside Foundry Foundation and reject F2.s-z expansion ancestry in downstream releases.

3.19 Round-10 delivery, portability, and self-host checkpoint correction: 2026-08-06

The review’s load-bearing portability concern is accepted, while its repository-delivery snapshot is superseded by direct evidence. Exact head 0914f08561b6fe904acdcd214f4ba18cd639b3a6 is remotely backed up on the existing review branch, the documentation workflow passed that head, and the standard workflow is still running. Those facts protect the work but do not close R0.4.j: only exact reviewed main release-full evidence and independent watchdog recognition can do that. No task is checked from this local or PR observation.

1. Retire interface risk without reopening GenesisBench. One read-only, non-scoring portability canary may run for each transport-neutral authority revision after its model-free fixtures pass. It must use an already inventoried, digest-pinned local model from a materially different family and a direct-runtime or generic JSON-stdio stack that does not imitate Codex CLI or a hosted provider wire protocol; select the strongest predeclared host-fit model, currently Qwen3 8B, unless a score-blind resource preflight rejects it. The canary receives only fixed protocol content that tests lossless ordered blocks, candidate extraction, capability negotiation, timeout/cancel/reap, and transcript closure. It receives no GenesisBench task, private payload, scorer, answer, repair loop, tool authority, or language-change signal. Its only result is a typed pass, fail, unsupported, or infrastructure-failure interface-qualification record with exact model/runtime/adapter/input/output identities. It creates no attempt, score, cohort, rank, benchmark result, adoption claim, roadmap completion, or publication entitlement.
2. Use four demonstrable self-host checkpoints inside existing tasks. SH-A closes R4.1 with the minimal stage0 contract, complete semantic-ownership ledger, structural boundary gate, and one selected migration slice. SH-B closes R4.2.a with the GenesisCode frontend/canonicalizer at H2 under strict no fallback on native and WASI, independently reproducing source-to-CoreForm bytes, hashes, spans, diagnostics, and malformed-input behavior. SH-C closes R4.2.b-e with all non-codegen semantic authorities at H2 and proves that deleting or disabling their legacy Rust routes cannot change the declared command matrix. SH-D closes R4.2.f-g plus R4.4.a-b with one hermetic reference-host stage2/stage3 bootstrap rehearsal before the cross-host claim; R4.4.c-e and R4.5 then establish release H3/H4. Each checkpoint publishes a runnable artifact, exact no-fallback reachability evidence, negative controls, residual H-levels, and the next smallest blocking edge. None is a release milestone or permission to weaken final cross-host, DDC, or independent-conformance acceptance.
3. Migrate vertically instead of waiting for every execution tier. R4.2 frontend through package/policy migration begins after R4.1 and the relevant R5.1/R5.3 contracts freeze; only R4.2.f code generation waits for R3.1-R3.3. R4.4.a-b stage definitions and hermetic harness work may proceed after R4.1, while R4.4.c cross-host fixpoint remains blocked on the complete R4.2/R4.3 authority cutover. R4.5 conformance specifications may also begin after R4.1, but independent implementation acceptance remains blocked on the production authority switch. This exposes early end-to-end evidence without claiming that a routed wrapper or single-host rehearsal is H3.
4. Freeze conceptual scope through Core release. Until R9.4.f, the named concepts remain GenesisCode, GenesisBench, GenesisChallenge, Genesis Foundry, and Genesis Model. Do not add a product, program, benchmark track, research lane, milestone family, task family, or governed gate family. A reproduced P0/P1 correction may refine an existing task or replace an equivalent concept one-for-one with a recorded deletion, dependency impact, and acceptance delta; it may not increase WIP or release ancestry. Ideas outside that bound go to non-authoritative notes without implementation or roadmap tasks. The execution policy exposes this freeze as machine-readable review authority.
5. Finish the release transaction before opening another repository-changing lane. Hosted standard CI on the current head must terminate successfully, the coherent fixes must reach reviewed main, release-full must execute the complete v0.2 DAG on that exact revision within GB-4, and the disjoint watchdog must recognize fresh success. Infrastructure failures receive typed append-only dispositions and a retry of the unchanged revision; they are never converted into code passes. The interface canary is read-only and separately custodied, so it cannot delay, mutate, or authorize this transaction.

3.20 Round-11 closure and dependency-complete execution correction: 2026-08-08

The review correctly recognizes the first authentic release-full success and the remaining delivery concentration, but its claim that seventeen R1 tasks are immediately available is not supported by the generated graph. R1.6.e is load-bearing agent safety work, yet it depends on R1.3.f and R1.6.d; R1.3.f in turn depends on P1.5/R2.2.f lifecycle closure. Repository-changing WIP remains one. This correction closes the achieved release task, repairs the machine route that could otherwise skip unfinished sequential work, and records the exact order without adding a task, milestone, product, benchmark lane, or gate family.

1. R0.4.j is closed only by exact evidence. Exact main revision da9359fd35221421563ea77b7dbe17e0a33d0e12 passed standard run 31249172621, release-full run 31249173667, aggregate 68fab0fa55bdf560a81f45b35168bb55123c9f1370b56c01c24ddb357fdd4345, and independent watchdog run 31250800213. The append-only chronology retains all failures and cancellations through that success, and the resulting closure remains productReleaseQualified=false with every deferred target explicitly unsupported-product.
2. The execution frontier is dependency-complete rather than checkbox-shaped. A completed anchor in a sequential workstream now resolves to that workstream’s first unfinished task. After R2.2.f, the machine route advances through R1.3.f, the complete R1.5 authoring-skill sequence, the complete R1.6 collaboration sequence, the complete R1.7 typed-intent sequence, R2.1.h, the complete R2.3 startup/incremental sequence, and then the complete R4.1 SH-A sequence. A focused task may not be skipped merely because its first workstream task is already complete.
3. Instruction/content separation is prioritized at its real dependency boundary. R1.6.e remains mandatory before typed English intent and product-agent acceptance, with provenance/trust labels and prompt-injection, confused-deputy, and indirect-tool-instruction controls. It does not preempt R1.6.a-d or the daemon lifecycle evidence it consumes, and it cannot be declared parallel-ready to manufacture velocity.
4. SH-A starts after the finite agent/runtime frontier, not after benchmark work. R4.1 remains the first self-host authority checkpoint and GenesisCode v1 Self-Hosted Core remains the sole production release path. The benchmark freeze in section 3.18 is unchanged. The transport-neutral portability canary remains separately custodied, read-only, non-scoring, and non-blocking; its absence is visible interface risk but never authority to reopen a campaign or delay the selected production task.
5. Every handoff must show progress without rewarding shallow closure. A work session either closes the selected task with its required dated evidence or records the exact unmet acceptance edge, reproduced counterexample or external authority needed, completed evidence, and next executable action. The generated focus cannot silently change to an easier task. This is transaction accountability, not permission to split semantic work into artificial checkboxes or treat local mutable output as completion.
6. Working instructions must match current authority. Any AGENTS, skill, status, or handoff text that routes work into a pre-R9.4.f benchmark campaign or around the generated frontier is stale and fails review. GitHub availability affects publication evidence only; local implementation and verification continue on main whenever the selected task does not require the external service.

3.21 Round-12 lifecycle and evidence-control correction: 2026-08-08

The review accepts the lifecycle, watchdog, generated-authority, and timing criticisms that have executable counterexamples. It rejects the recommendation to manufacture velocity through seventeen parallel R1 tasks or to preempt the dependency-complete frontier with SH-A: only R1.5.c is independently start-ready, R1.6.e remains blocked by R1.3.f and R1.6.d, and repository-changing WIP remains one. This correction adds no product, task, milestone, benchmark lane, gate family, or release ancestor.

1. Historical success is preserved but cannot satisfy a later regression. The exact R0.4.i and R0.4.k evidence remains the durable record of the atomicity and transitive-input contracts established on those reviewed revisions; reopening them would falsely invalidate completed dependents. P1.7 records a later regression introduced in the operational release path, and reopened R0.4.j owns its correction plus a complete rerun of the R0.4.i/R0.4.k guards. R0.4.j also owns P1.6 because its watchdog does not independently classify the promised standard dispatch. M0 and the R0 completion count remain open until both current defects pass on reviewed main; a generated count or prior green watchdog cannot overrule the open defect ledger and task text.
2. Generated publication has one real resource owner. The canonical updater must run under a bounded aggregate observer that measures complete transaction wall time and generated-disk growth, owns the event channel, rejects network attempts, terminates and reaps every child process group, and emits a typed failure. Parallel nested checks retain their own hard duration and deny-network enforcement; only shared disk attribution may move to the aggregate, and only through an unforgeable supervisor path rather than a caller-selected environment switch. Node timeoutSeconds and diskMiB declarations become enforced limits, not schema-only metadata. Negative controls exceed each bound, omit the aggregate owner, inject a caller bypass, and prove no partial promotion.
3. Standard means standard. The disjoint watchdog must classify the separately dispatched exact-main standard profile by event, title/profile, head revision, attempt, terminal state, and canonical-history membership. A push-fast success is not a standard disposition. Missing, overdue, cancelled, failed, stale, wrong-head, and superseded-only standard histories fail independently of full-run freshness; the two-hour standard bound and append-only incident disposition remain distinct from the sixty-minute full termination and forty-eight-hour successful-full freshness bounds.
4. Cleanup errors cross the same boundary as operation errors. Persistent bridge malformed-response and disconnect paths, session eviction, owner shutdown, and daemon teardown may not discard a failed stop/reap result. Public operations return a typed cleanup/reap error that preserves the initiating failure as context; an explicit fallible close/drain path reports aggregate teardown failure, while Drop is only a bounded last-resort safety net. Mandatory fault injection reaches these public paths and proves bounded join/reap, no detached worker, no surviving descendant, deterministic diagnostics, and recovery of the next healthy request on every supported native host.
5. Timing gates combine hard containment with statistical calibration. A semantic pass never converts a hard timing failure into success, but one noisy hosted sample cannot authorize a budget change. Local warm, local clean/fallback, and hosted cold/shared-runner classes are measured separately with exact toolchain, host class, cache precondition, workload identity, and competing-lane state. After five discarded warmups, at least thirty retained conformant samples establish median, nearest-rank p95, MAD, and a distribution-free confidence interval; the hard ceiling is derived from the declared host-class distribution and documented headroom, while rolling median/p95 trend alarms detect sustained regression. Budget changes preserve the failed samples, cannot relabel cold observations as warm, and ratchet downward when repeated conformant evidence permits.
6. The corrected frontier remains sequential. First close P1.7 and P1.6 through reopened R0.4.j, ordering aggregate resource ownership before the hosted evidence rerun; then close P1.5 through R2.2.f. Only after exact reviewed evidence closes those boundaries does the existing R1.3, R1.5, R1.6, R1.7, R2.1, R2.3, and SH-A order resume. The portability canary remains optional, read-only, non-scoring, separately custodied, and non-authoritative; GenesisBench, Foundry, and Genesis Model activation remain frozen exactly as before.

P1.7 closed 2026-08-08 on exact main revision d07ff48e909fea43ec405b7160901b5bbe0b62ad. The generated-authority owner now bounds the complete transaction and each generation node, preserves nested duration/network enforcement, delegates only parallel disk attribution through an inherited append-only descriptor, and kills/reaps process groups on violation. The canonical update reached changed=0; the complete R0.4.i/R0.4.k and R0.4.j guard union passed; scripts/test_changed_fast.sh passed in 378,681 ms under its 720,000 ms/3-GiB envelope; and hosted push-fast run 31282158056 plus documentation run 31282158060 passed on that exact revision. Twenty telemetry controls and twenty-six generated-authority controls reject duration, disk, network, caller-bypass, missing-owner, concurrent-child, timeout, and partial-publication faults. This closes P1.7 only: P1.6, R0.4.j, M0, and release qualification remain open.

P1.6 closed 2026-08-08 on exact main revision 63db7e3f3a00da6b582aa0464ad1e12d9df2e85d. Push-fast run 31284538133, standard run 31284542152, release-full run 31284543591, and documentation run 31284538134 passed on that revision. The independently verified v0.2 aggregate has identity 6c5c4e3da4ce4ee04fd744caaa7d088746aa814463061021d702a8a4244733b9, authenticates all three cold, three prewarmed, one invariant, and three stress workers, derives its verdict read-only in 1,727 ms, and preserves productReleaseQualified=false; Android, edge, iOS, and service runtime remain explicit unsupported-product dispositions. Post-pair watchdog run 31287266902 independently observed exact-head standard 31284542152 and full 31284543591, reported exactHeadStandardFullPair=complete, emitted zero violations, and preserved releaseQualified=false. The append-only standard chronology retains the failed 31269647811 counterexample and all seven dispositions through the closing success. This closes P1.6 only: R0.4.j remains open because section 3.21 still requires statistically calibrated local-warm, local-clean/fallback, and hosted-cold/shared-runner timing classes; P1.5, M0, and product release qualification also remain open.

3.22 Round-13 readiness, self-host priority, and agent-operated calibration correction: 2026-08-09

The review’s corrected dependency analysis has teeth: only five of 300 open tasks were graph-ready on the reviewed snapshot, and R4.1.a was one of them. Sections 3.20 and 3.21 were right to reject seventeen parallel R1 tasks, but wrong to describe SH-A as dependency-deferred. Its deferral is solely the one-repository-changing-WIP rule. This correction makes that scheduling choice explicit, moves the complete R4.1 truth/boundary package directly behind lifecycle closure, and adds a global derived readiness view without adding a task, milestone, product, gate family, or authority.

1. Graph readiness and selection are separate facts. python3 scripts/lib/roadmap_execution_manifest.py --ready reports every open task whose declared prerequisites are complete, then identifies which of those tasks the WIP-limited policy selected. The report is read-only, recomputed from the roadmap and policy, closed to unknown fields by implementation tests, and cannot authorize start, completion, promotion, capability, signing, or release. --slice remains the work selector; a ready-but-deprioritized task cannot widen WIP.
2. SH-A is WIP-deferred, not dependency-blocked. Finish R0.4.j, close P1.5 through R2.2.f using the retained cross-host lifecycle evidence, then execute the complete R4.1 SH-A sequence before the longer R1.3, R1.5, R1.6, R1.7, R2.1, and R2.3 sequence. SH-A publishes only the minimal stage0 contract, semantic-ownership truth, structural boundary, and selected migration slice already declared in R4.1. It does not claim H2/H3/H4, broaden stage0, start R4.2 prematurely, or activate GenesisBench, Foundry, or Genesis Model work.
3. The WIP limit remains one. The reordered frontier is a priority decision among graph-ready work, not a parallel lane. Every handoff continues to name the selected task, completed evidence, exact unmet edge, and next executable action. GitHub unavailability blocks only evidence that specifically requires it; it does not permit substitution of an easier ready task.
4. Local timing represents the agent-operated product without inventing exclusivity. The original 5% local preflight repeatedly rejected an otherwise idle Apple M1 whose only application workload was the Codex operator itself: five observed one-minute load averages of 1.55-1.86 on eight logical CPUs corresponded to roughly 19-23%, with zero competing Cargo, Rust, Genesis, nextest, or Quarto process. A longer post-validation observation then stabilized near 40% with the same zero competing-build result while Codex, WindowServer, Spotlight, and macOS media analysis were the only material resident consumers, proving that a 30% replacement still encoded an unavailable idle-host assumption. After the complete changed-file profile passed, two further exact-clean-main admissions correctly found no competing build but rejected at the 50% boundary while contemporaneous one-minute load averages were 4.12 and 5.32 on eight logical CPUs, roughly 52-67%, again dominated by Codex and macOS indexing/media services. R0.4.j therefore keeps the general 5% unattended reference-lab control unchanged but gives its local agent-loop timing classes a separate policy-bound preflight: five one-second-spaced samples, maximum statistic, 75% logical-CPU ceiling, AC power, low-power mode disabled, nominal thermals, exact clean main, zero external competing build process, and hard process-group timeout/kill/reap. Exclusivity is not inferred from one process-name snapshot: argument-aware checks run before launch and once per second through termination, direct and wrapped Cargo/Rust/Genesis/nextest/Quarto commands are recognized, the complete measured-workload descendant closure is excluded even across nested process groups, and any matching external process becomes a retained competing-lane hard failure. Every observation records the exact applied ceiling and maximum observed competitor count; semantic passes require zero. This is a realistic class definition, not permission to relabel a contended run or weaken hosted/release containment.
5. Calibration failures remain evidence. The exact-main hosted campaign retains the cancelled startup observation as an interrupted hard failure with reaped cleanup rather than excluding it from review. Five discarded semantic-pass warmups and thirty retained passes are still required independently for each class; failures do not consume either quota, authorize a ceiling change, or disappear from chronology.

3.23 Delivery and validation-economy correction: 2026-08-10

The prior plan correctly built fail-closed evidence machinery, but it made a release-qualification campaign the sole WIP item before the language subject was ready for release qualification. That was a sequencing defect. Repeating the identical approximately six-minute standard command across ninety successful class observations could refine a future SLO, but it could not change whether the operational release DAG, watchdog, host lifecycle, self-host contract, or language implementation worked. It therefore consumed the only implementation lane without advancing the product.

1. R0.4.j closes on its actual operational acceptance. P1.7 established bounded aggregate publication ownership and passed the complete generated-authority guard union. P1.6 then produced a passing exact-main standard run, passing v0.2 release-full DAG and read-only aggregate, complete typed target dispositions, and independent watchdog recognition. Those were the task’s functional and delivery-liveness predicates. The later timing collector remains useful, but a calibration population cannot retroactively become a prerequisite for an already-proved release-control implementation.
2. Statistical timing ratification moves intact to R9.1.c. The three classes, hard containment ceilings, five discarded warmups, thirty retained conformant samples, hard-failure retention, exact statistics, anti-relabeling rules, and trend policy are preserved. Existing identity-matched E0 observations remain reusable. Their completion first blocks a release-candidate decision at R9.1.c, not R0 implementation, M1 agent work, runtime work, or self-host migration. Until ratification, the existing 720,000ms local and 7,200,000ms hosted values remain conservative hard containment limits and no permanent SLO is claimed.
3. Validation follows subject readiness. Contract and negative tests may precede implementation. Focused correctness and failure-path tests begin with the smallest runnable slice. One impacted integration profile runs after those pass. Cross-host matrices begin only when the claimed host implementation exists; statistical performance, fuzz, and soak campaigns begin only when their measured subject is correct, runnable, and stable enough that the result can change an engineering decision; release matrices and long soak begin only in R9. A synthetic adapter, stub, unsupported product, or known-broken functional path is not a useful subject for qualification.
4. Identical success is not additional evidence during development. For one exact revision, inputs, host class, cache state, seed, and command, the first successful invocation closes the ordinary implementation check. One additional identical invocation is allowed only to reproduce or confirm a recorded flake or nondeterminism hypothesis. Further repetition is valid only when a declared independent variable changes or when one bounded autonomous harness is itself the task subject, such as a microbenchmark distribution, fuzz campaign, lifecycle stress run, or release soak. Whole-repository profiles are not rerun once per inner sample.
5. Every campaign must be decision-bearing and autonomous. Before launch it names the decision the result can change, subject-readiness evidence, independent variable, observation-reuse rule, resource budget, stopping rule, and terminal artifact. It runs without model-turn polling and reports state transitions or terminal outcomes, not unchanged snapshots. If the result cannot alter implementation, containment, promotion, or release, the campaign is deferred or removed.
6. The critical path is implementation-first and self-host-first. Close P1.5/R2.2.f, publish SH-A, freeze R5.1/R5.3 semantics, migrate R4.2.a-e production authority, finish only the runtime/tiering prerequisites required for compiler authority, then close R4.2.f-g and R4.3-R4.5. Remaining agent-product polish follows the self-host authority path; GenesisBench inference, Foundry implementation, and Genesis Model work stay frozen by their existing gates. A blocked frontier anchor no longer prevents selection of its next ready prerequisite.
7. No safety evidence is discarded or weakened. All interrupted, failed, superseded, and successful timing records remain append-only observations. Hard timeout, disk, process-group kill/reap, capability, replay, panic, and semantic-parity checks remain mandatory at the phase where their subject exists. This correction removes redundant qualification work, not adversarial coverage.

3.24 GenesisCode completion handoff and post-Core fan-out correction: 2026-08-10

Historical note: section 3.25 supersedes this section’s immediate Bench/Challenge fan-out with the finite F2.r Foundry Foundation and Genesis Algorithms gate; the Core boundary and lane-isolation reasoning remain in force.

At this historical audit, the program still required a trustworthy language before spending its only implementation lane on products that evaluate, research, or improve that language, but it removed the then-current serialization of GenesisBench, Genesis Foundry, and GenesisChallenge after the language handoff. Section 3.25 subsequently found that immediate fan-out too weak: the current rule is exact reviewed Core, then finite F2.a-r Foundry Foundation and Genesis Algorithms, then downstream fan-out. The Core boundary, product independence, and lane-isolation conclusions below remain authoritative; the old activation order does not.

1. Exact reviewed R9.4.f is the GenesisCode handoff. It closes M6 GenesisCode v1 Core, not every optional task in the durable program. On this audit’s derived graph, the R9.4.f ancestor closure contains 255 tasks, of which 80 are already complete and 175 remain open; the other 124 roadmap tasks cannot block Core. Counts are observational and must be recomputed from the execution manifest, while the task identity and release contract are normative.
2. The implementation lane is GenesisCode-only until the handoff. Before R9.4.f, one repository-changing transaction follows the generated Core frontier. No target-model run, benchmark custody or commissioning, GenesisChallenge operation, Foundry implementation, Genesis Model work, or optional platform-pack breadth may consume that slot. The only concurrent activity is read-only assurance that directly satisfies the selected GenesisCode task, runs on separately provisioned resources, touches no repository or release authority, and requires no attention from the active implementation agent.
3. Core is small enough to finish and complete enough to build on. The handoff includes the frozen language and effect semantics, bounded runtime and validated execution tiers, H2 self-hosted semantic authority, H3/H4 bootstrap and independent conformance evidence, package/build/registry/deployment Core, generated human and agent documentation, safe agent interfaces, native/WASI CLI, authentic service operation, security/compatibility/support policy, signed artifacts, and independently reproduced release evidence. It explicitly excludes universal web/mobile/game/MCU/GPU pack maturity, benchmark campaigns, Foundry, Challenge, and Genesis Model. Exclusion means separate compatibility-scoped release work, not abandonment.
4. Historical fan-out rule, superseded by section 3.25. This audit activated GenesisBench Preview/Trust, F2.a-q calibration, and GenesisChallenge immediately after exact reviewed R9.4.f. The current DAG instead runs finite F2.a-r first and fans Bench/Challenge out only after the independently promoted algorithm-library release. The retained rule is that every active lane has one coherent WIP slot, separate owners, files, compute, custody, and promotion authority; shared-interface changes still merge serially and cannot rewrite a frozen consumed profile.
5. Cross-product edges remain task-specific, not lane-wide. F2.a-r uses frozen GenesisCode semantics and independent checkers, so it does not wait for GenesisBench. F2.y, which explicitly integrates GenesisBench and the later model ecosystem, still waits for a compatible R8.5.s Trust release. GenesisChallenge now waits for F2.r but not GenesisBench Trust; its benchmark-validity category stays ineligible until a compatible benchmark baseline and destination owner exist. Genesis Model remains final and requires GenesisBench Trust plus independently reproduced MF through R8.5.t.
6. The DAG must prove every handoff rather than merely describe it. The GenesisCode release contract rejects unfinished Benchmark, Challenge, Foundry, Model, universal-pack, and pack-assurance ancestors. The current contracts additionally reject Bench/Model ancestry in F2.r, require F2.r in Bench and Challenge, reject F2.s-z expansion ancestry in those downstream release roots, require Benchmark Trust for F2.y, and reject Challenge ancestry from Model readiness. Mutation controls must fail if any forbidden edge or prerequisite bypass is introduced.
7. The pre-Core selector is continuation-complete. Ordered anchors cover every unfinished task in the exact R9.4.f ancestor closure, including each Core member of non-sequential workstreams. Sequential-anchor advancement is filtered to that closure, so trailing pack-only assurance cannot leak onto the Core clock. A missing Core anchor, post-Core anchor, or selector candidate outside the closure fails the roadmap manifest instead of requiring a future manual queue rewrite or silently producing an empty focus.

3.25 Foundry-first algorithm-library correction: 2026-08-11

The earlier post-Core fan-out correctly removed Foundry from the GenesisCode release dependency graph, but it treated calibrated discovery as an optional peer of GenesisBench and provided no finite path from retained research results to a supplied GenesisCode algorithm library. That left two avoidable defects: Bench could construct tasks before the project had a canonical first-party algorithm package, and useful Foundry outputs had only a late generic promotion task after model/Bench integration. This correction replaces that ordering without moving research into production trust.

1. Foundry Foundation is the first post-Core outcome. Exact reviewed R9.4.f activates F2.a-r. F2.a-q builds and independently reproduces the bounded search/verification calibration; F2.r establishes the destination-owned package boundary and releases the first genesis/algorithms collection. GenesisBench Preview, GenesisChallenge operation, and Genesis Model work remain non-start-ready until F2.r. Optional platform packs and unrelated F1/F3/F4 research may still proceed under disjoint authority because they neither define nor consume the benchmark/library contract.
2. The finite gate is not “finish Foundry.” Foundry is an enduring research program, so requiring F2.a-z before Bench would replace one sequencing mistake with permanent blockage. F2.r is a bounded foundation release with exact artifacts, independent reproduction, destination review, compatibility, and rollback. F2.s-z expand engines, abstractions, laws, domains, integrations, and long-term memory after that foundation and may run beside Bench under isolated resources.
3. Search and library authority are split. foundry/ owns quarantined grammars, candidates, search state, failures, counterexamples, and proposal receipts. genesis/algorithms is an ordinary signed .gc package collection owned by package maintainers. Promotion copies a reviewed semantic artifact across a versioned boundary and reruns independent conformance without the search engine; the library cannot import Foundry code or mutable state, and Foundry cannot approve its own package proposal.
4. The library is useful even when discovery is not novel. Its first release includes independently verified reference implementations and exact-domain specialized variants from the calibration family, with stable APIs, deterministic fallbacks, complexity contracts, provenance/licenses, examples, and supported-profile tests. A result may be valuable because it is correct, portable, explainable, or efficient; historical novelty is neither required nor implied.
5. No same-release circularity is permitted. A Foundry run may use algorithm-library release N only as a frozen baseline and may propose release N+1. Its task, grammar, verifier, and acceptance are precommitted against N; it cannot mutate the baseline, oracle, or destination during search. Package N+1 is rebuilt and verified from its promoted .gc source with foundry/ absent.
6. Bench consumes only disclosed releases. GenesisBench binds exact compatible GenesisCode and genesis/algorithms identities. Public library APIs may be part of the provided environment, task surface, examples, or baselines, but mutable Foundry state, hidden candidates, and search-specific oracle material are excluded. Scorers verify task behavior independently and never infer correctness from library membership or a Foundry receipt.
7. Challenge and Model remain downstream. GenesisChallenge begins after F2.r so real algorithm/library and Foundry improvements can be contested under destination-owned review; benchmark-validity categories still wait for a compatible Bench release. Genesis Model still waits for Bench Trust and R8.5.t, and its research-transfer authority consumes the independently reproduced Foundry Foundation plus explicit promoted/rejected transfer records rather than mutable search history.
8. The machine DAG enforces the correction. F2.r becomes the Foundry release root; every unfinished GenesisBench Preview leaf and the Trust root inherit it; Challenge authority inherits it; model transfer/readiness inherits it. Mutation controls reject a Bench, Challenge, or Model path that bypasses F2.r, reject Foundry Foundation ancestry on Bench/model implementation beyond the explicitly allowed a-r set, and preserve the prohibition on Bench/Model ancestry entering F2.r.

3.26 Foundry-to-applications correction: 2026-08-11

Section 3.25 correctly put a finite Foundry Foundation and supplied algorithm release before Bench, but it still jumped directly from a library artifact to evaluation and contribution programs. That omitted the public proof that ordinary agents and users can compose the language and library into useful systems. This correction refines the existing R8.3 flagship allocation rather than adding a fifth product, semantic authority, or unbounded prerequisite.

1. Foundry and Genesis Algorithms remain first. Exact reviewed R9.4.f still activates F2.a-r and nothing in R8.3 can enter implementation WIP before F2.r. Examples consume a signed destination-owned library release, never candidate state or a mutable Foundry workspace.
2. Examples and apps have different jobs. GenesisExamples are compact executable learning/reference projects; GenesisApps are maintained production-style systems. Conformance, benchmark-reproduction, and host-workflow fixtures remain fixtures. A catalog manifest records the classification and rejects marketing relabeling.
3. The downstream gate is finite. R8.3.a-b publishes a bounded seed containing an algorithm/CLI, MCP server, real web server, separate full-stack website/application, and integrated workspace. It proves meaningful algorithm use, authentic execution, one-language source closure, maintenance, and operation with foundry/ absent. It does not wait for all 18 archetypes or ten universal flagships.
4. Universal breadth remains independent. R8.3.c-e retains the prior ten-flagship, real-target, maintenance, source-audit, and independent-operation burden and advances as platform packs mature. Open-ended app breadth cannot block Bench, Challenge, Foundry expansion, Core maintenance, or Model readiness.
5. Bench learns from surfaces, not answers. The public catalog may provide disclosed context, practice, capability taxonomy, and task-family evidence. Held-out lineages require independent provenance and cannot copy public source, oracles, traces, seeded defects, or acceptance secrets. Catalog membership never substitutes for scoring.
6. Challenge may expand the catalog without controlling it. After R8.3.b, GenesisChallenge may offer creation, promotion, target-expansion, maintenance, simplification, and optimization work against frozen baselines. Acceptance remains with the example/app destination owner and never follows automatically from a prize, score, or solver claim.
7. The machine DAG enforces the order. R8.3.a inherits F2.r; R8.3.b inherits the exact product profiles used by the seed; unfinished Bench Preview leaves, Bench Trust, and Challenge inherit R8.3.b; broad R8.3.c-e remain forbidden from their release ancestry. Mutation controls reject bypass, reverse dependency, mutable Foundry input, and accidental all-flagship serialization.

---

4. Non-negotiable invariants

These invariants apply to every phase and every execution tier:

1. Pure kernel: G-lambda evaluation has no filesystem, time, randomness, network, process, environment, UI, model, or hidden global-state access.
2. Unforgeable seals: UNHANDLED, EFFECT, and ERROR are observable only through Prelude-created seal tokens. User terms cannot forge them.
3. No panic on user input: parse, evaluation, effect, bridge, package, registry, compiler, replay, and deployment boundaries return explicit internal errors or sealed language errors. Production panic!, unreachable!, unchecked indexing, and abort paths require mechanically proven non-user reachability.
4. Deny by default: every effect, host bridge, plugin, package hook, deployment action, model call, and inbound service operation requires explicit authority.
5. Deterministic facts: canonical terms/hashes, value hashes, ordering, paths, numeric behavior, effect logs, replay decisions, scheduling, artifacts, and bootstrap outputs are specified and versioned.
6. Strict replay: replay checks every serialized fact or the specification explicitly marks a field derived and recomputes it canonically. Unknown/missing fields fail closed.
7. Bounded execution: step, allocation, heap, payload, response, effect, concurrency, process, wall-clock, and artifact budgets have defined enforcement and failure semantics. Cooperative timeout alone is insufficient for blocking host work.
8. Semantic identity across tiers: treewalk, compiled AST, bytecode, WebAssembly, and any JIT produce identical observable values, hashes, effects, errors, and resource-accounting semantics, subject only to explicitly versioned performance counters.
9. Optimizers remain outside trust: optimization, specialization, JIT, and AI-generated rewrites require differential or translation-validation evidence against authoritative semantics.
10. Compatibility is explicit: canonical identity and serialized formats never drift silently. Every incompatible change has a profile/version bump, migration, dual-read window where safe, and deprecation record.
11. Evidence cannot bless itself: the implementation under test cannot be the sole authority that validates its own release claim. Critical formats have small independent verifiers and negative-control corpora.
12. Self-hosting reduces semantic trust: migrating code to .gc must remove or demote the prior authority. Duplicating semantics without retiring an authority does not advance closure.
13. Generated closure is atomic: canonical-input drift, generated-output drift, and incomplete transitive regeneration fail focused checks and CI. Read-only checks never repair state, and publication cannot proceed from a partially refreshed authority graph.
14. Source and generated state stay distinct: ignored/generated roots are excluded from source topology only by explicit classification, ownership, quotas, and cleanup policy. They cannot hide source, tests, private custody violations, or release evidence.
15. Host boundaries are quantity- and scope-correct: resource limits, cancellation, pipe lifecycle, locking, and persistent allocation name and enforce the exact promised process/thread/session scope on every supported host. Platform approximations, polling intervals, and unsupported hard guarantees are explicit; supported-host CI and contention stress are mandatory evidence.
16. Research depends inward, never production outward: Foundry may consume frozen GenesisCode crates, schemas, artifacts, and binaries; no production crate, default runtime path, release gate, or language semantic authority depends on Foundry implementation code or mutable research state.
17. Discovery cannot promote itself: candidate generators, portfolio controllers, LLMs, task generators, benchmarkers, and research registries cannot certify correctness, erase failures, alter hidden evaluation, or approve their own laws/packages/rewrites. Promotion is destination-specific, independently verified, reversible, and preserves every rejected ancestor and counterexample.
18. Proof scope is exact: a proof, exhaustive check, differential test, cost model, benchmark, or theorem is bound to the exact candidate, lowering, semantic profile, assumptions, target, and verifier identity it covers. No theorem about an abstraction is silently laundered into a claim about emitted machine code or a wider input domain.

---

5. Release ladder and critical path

Milestone	Intended release	User-visible result	Hard gate
M0 Truthful Green Door	v0.2.x	Fresh clones build and checks report facts without mutating them	R0
M1-A GenesisCode Agent Preview	GenesisCode v0.3	Compact SDK, stable diagnostics, local warm/MCP interface, generated authoring skill, safe collaboration, and typed English-intent preview support reproducible agent work	R1.1-R1.3 and R1.5-R1.7; R0.4.j
M2 Runtime Beta	v0.4	Interactive, resource-bounded execution with validated bytecode and bounded long-lived processes	R2-R3 core
M3 Self-Host Authority Beta	v0.5	Frozen core semantics above stage0 are GenesisCode-authoritative and bootstrap to a cross-host fixpoint	R5.1 and R5.3 core freeze, then R4
M4 Platform Pack Betas	independently versioned packs	Web/UI, service/data, desktop/mobile, game/media, Embedded Linux, MCU/boards, and GPU/XR packs advance independently with authentic targets and one-language source closure	relevant R5-R6 workstream per pack
M5-C GenesisCode v1 Core Candidate	GenesisCode v1.0-rc	Formal/fuzz/security evidence, frozen core semantics, self-host authority, agent interfaces, native/WASI plus authentic CLI/service proof, and independent operation meet Core SLOs	R7.1.a-e, R7.2, R7.3.a-e, and R7.4.a-c; R8.1, R8.2.a-b, and R8.4
M5-P Universal Platform Maturity	independently versioned pack and GenesisApps catalog releases	Eighteen authentic agent-authored archetypes and ten maintained GenesisApps, including real boards, prove the growing one-language portfolio without blocking Core, Bench, or Challenge	R8.2 plus R8.3.c-e; may complete after M6 and after the finite R8.3.a-b seed
M6 GenesisCode Trust Release	GenesisCode v1.0 Core	Reproducible artifacts, signed evidence, compatibility guarantees, and operational support are published; compatible pack and benchmark versions are named independently, and a model may be absent	R9 Core scope
F1 Frontier Governance Lab	post-v1	Bounded self-improvement under preserved v1 compatibility and independent roles	F1
MF Genesis Foundry Foundation	independently versioned post-v1 Foundry snapshot plus Genesis Algorithms v0.1	Deterministically rediscover, verify, compare, explain, and replay bounded mechanisms, then independently promote useful .gc reference/specialized algorithms into a signed supplied library with no research-runtime dependency or novelty claim	R9.4.f, then F2.a-F2.r
M1-B GenesisBench Preview	first post-v1 GenesisBench release; stable historical ID	Four isolated tracks, transport-neutral task/artifact contracts, model-portable adapters and failure attribution, real-model commissioning, a useful easy/medium/hard private epoch with precommitted fast forms, reproducible results, and public Preview governance against immutable v1 Core, Genesis Algorithms, and finite GenesisExamples/GenesisApps seed releases	MF, then R8.3.a-b and remaining R1.4.o/q/r/p
M5-B GenesisBench Trust Release	independently versioned GenesisBench release	A >=90-lineage temporal, maintenance, reconstruction, calibrated-difficulty, and model-portable frontier is independently reproduced across standard/full forms and three interface stacks, governed, discriminative, and useful to language and library adoption	MF, M1-B, then R8.5.a-e and R8.5.s
M5-M Genesis Model Preview	independently versioned model package	After v1 Core, GenesisBench Trust, MF, and R8.5.t, a firewall-audited, lineage-bound, profile-bound local specialist is reproducible and useful without becoming a language, library, or benchmark dependency	R8.5.h,i,t,f,g,j-r with applicable four-cell or frozen-language two-cell controls; necessarily after M6, MF, and M5-B
F3/F4 Frontier Systems	post-v1	Optional validated specialization/JIT, distributed/hardware execution, independent implementations, and evidence-weighted governance	F3-F4

Milestone IDs are stable historical authorities, not sortable execution priorities. Sections 3.24-3.26 govern activation: M6 opens Foundry Foundation plus independent platform-pack and unrelated F1/F3/F4 lanes; MF then opens the finite GenesisExamples/GenesisApps seed and continued Foundry expansion; R8.3.b then opens GenesisBench and GenesisChallenge. M1-B precedes M5-B inside GenesisBench; M5-B and MF are prerequisites of the later Genesis Model readiness decision.

Critical path:

R0 truth/evidence
  -> R2.2 host/resource lifecycle closure
  -> R4.1 self-host truth boundary
  -> R5.1 + R5.3 core semantic/profile freeze
  -> R4.2.a-e non-codegen semantic authority
  -> R2.1/R2.3/R2.4 + R3 execution prerequisites
  -> R4.2.f-g + R4.3-R4.5 self-host authority and bootstrap fixpoint
  -> remaining R1 agent product surface
  -> R5.2 + R5.4-R5.5 core language/extension completion
  -> R6.1-R6.4 package/build/registry/deployment core
  -> R7.1.a-e + R7.2 + R7.3.a-e + R7.4.a-c Core assurance
  -> R8.1 + R8.2.a-b + R8.4 core product proof
  -> R9 v1 Core release
  -> F2.a-r Foundry Foundation + Genesis Algorithms v0.1
  -> R8.3.a-b GenesisExamples/GenesisApps seed
  -> GenesisBench Preview/Trust and GenesisChallenge
  -> R8.5.t Genesis Model readiness -> optional Genesis Model

Platform packs: relevant R5.6-R5.9 -> R6.5-R6.7 -> R8.2/R8.3 pack proof -> independent pack release

Concurrency contract:

• Before R9.4.f: one repository-changing GenesisCode Core transaction owns the implementation lane. Work described as “parallel” elsewhere in this historical roadmap is scheduling-ready only and cannot consume repository WIP, local compute, shared locks, or active-agent attention. One separately provisioned, read-only assurance observation may coexist only when it directly satisfies the selected Core task and has no authority to mutate or close it.
• At R9.4.f: publish the signed immutable Core identity and activate F2.a-r Foundry Foundation first. Optional platform packs and unrelated F1/F3/F4 research may use isolated lanes, but GenesisBench, GenesisChallenge, and Genesis Model remain frozen. Shared schema, compatibility, release, and generated-authority changes remain serial merge transactions even when lane-local implementation is concurrent.
• Genesis Foundry Foundation: execute F2.a-q calibration against frozen Core semantics and independent checkers, then F2.r promotes Genesis Algorithms v0.1 through a separate package authority. Foundry runs against an immutable prior library baseline, never the release it is proposing, and production builds remain complete with foundry/ absent.
• At F2.r: activate R8.3.a-b as the finite GenesisExamples/GenesisApps seed transaction and continued F2.s-z expansion as an isolated lane. Bench, Challenge, and Model remain frozen until the seed is released. This preserves Foundry-first ordering without making open-ended Foundry or universal app breadth a permanent downstream blocker.
• GenesisExamples/GenesisApps seed: publish exact catalog identities plus the algorithm/CLI, MCP, web-server, website/application, and integrated-workspace proofs against immutable Core and Genesis Algorithms releases. Every item builds with foundry/ absent, uses released algorithms materially, and separates public learning/reference content from independent held-out benchmark lineages.
• At R8.3.b: activate independent GenesisBench Preview/Trust and GenesisChallenge lanes. Continued R8.3.c-e universal showcase work proceeds independently and cannot block their release clocks.
• GenesisBench: complete remaining Preview and Trust work against exact immutable Core, Genesis Algorithms, and public example/app catalog identities, with independent custody, compute, adapters, scoring, and publication authority. Bench may consume only disclosed releases, never mutable Foundry state, published solutions as held-out answers, or search-specific oracles.
• GenesisChallenge: establish and operate its separate non-ranking ledger after R8.3.b. A challenge category is eligible only when its destination has a ready verified baseline and independent owner; example/app expansion is an explicit destination class, and benchmark-validity challenges additionally require a compatible Benchmark release.
• Platform and frontier lanes: optional packs plus F1/F3/F4 may advance after Core under separate resources and compatibility contracts. They cannot retroactively broaden Core or borrow M6 evidence.
• Genesis Model: remains outside the initial fan-out. Architecture, corpus construction, teacher selection, training, distillation, packaging, and integration stay at zero WIP until R8.5.t records GenesisBench Trust, reproduced MF, firewall, feasibility, and independent-review readiness.
• JIT research can start after the bytecode semantics are stable, but cannot displace critical-path work without failing a published performance decision gate.
• Additional capability families remain experimental until existing families meet the maturity and domain-proof rules. Universal-product work grows primarily through libraries, components, target adapters, and BSP packages; it does not expand the kernel or bypass profile negotiation.
• Foundry architecture/schema ideas may be captured before v1 only as non-authoritative inputs that are read-only with respect to production and benchmark semantics, consume no release capacity, and produce no algorithm or optimization claim. Ratification, executable search, and research-registry operation begin only after compatible v1 Core semantics/evidence interfaces are frozen. F2.r is the finite prerequisite for the GenesisExamples/GenesisApps seed; R8.3.b is the finite prerequisite for first GenesisBench and GenesisChallenge work; later Foundry and universal-showcase expansion never block GenesisCode maintenance, platform packs, or later compatible Bench releases. Independently reproduced MF and GenesisBench Trust both remain prerequisites of the optional Genesis Model readiness decision.

---

6. Program-wide budgets

Budgets are acceptance contracts, not aspirations. R0 records the reference machines, raw samples, and confidence method. Budgets may be tightened freely. Loosening one requires a dated rationale, before/after evidence, and an explicit milestone decision.

6.1 Agent experience budgets

ID	Budget	Preview target	v1 target
AB-1	Core language card	<= 4,000 tokenizer-independent approximate tokens	<= 3,000
AB-2	Task-specific context bundle	<= 12,000 tokens including capability cards and examples	<= 8,000
AB-3	Warm request latency, no execution	p50 <= 5ms; p95 <= 20ms	p50 <= 3ms; p95 <= 10ms
AB-4	Changed-file edit/check loop	p95 <= 2s on a 100-module workspace	p95 <= 1s
AB-5	Reference-agent parse success	>= 95% first attempt on public test split	>= 98%
AB-6	Diagnostic-guided repair	>= 85% recovery within two repair turns	>= 95%
AB-7	Held-out capability coverage	>=8/9 core task classes have an independently verified baseline solve across the >=45-lineage Preview, with uncertainty over lineages	GenesisBench Trust covers 9/9 classes across two independent model families on compatible frozen GenesisCode profiles; product-archetype coverage is reported separately under UP/M5-P and never blocks the benchmark
AB-8	Structured-output stability	100% protocol/schema conformance or explicit typed failure	100%
AB-9	Benchmark run reproducibility	100% of published runs validate and deterministically rescore from their closed bundle	100% plus independent replay by two operators
AB-10	Benchmark-to-language feedback	Every repeated failure cluster has a typed owner and disposition	>= 90% of eligible clusters produce a language/tooling fix or an explicit non-goal
AB-11	English-intent safety	100% of requests become a typed goal/acceptance/authority record or explicit abstention; no model response directly mutates accepted state	100% across two independent general-model families
AB-12	Trajectory completeness	100% of retained model calls, retrievals, tool calls, attempts, diagnostics, patches, decisions, and outcomes are content-addressed or explicitly redacted by policy	100% plus independent bundle replay

Agent benchmarks always publish model/runtime version, decoding settings, context, seeds where available, attempts, failures, and cost. A model result never substitutes for deterministic compiler/runtime conformance.

6.2 Benchmark validity budgets

These budgets govern benchmark claims separately from language correctness and runtime performance:

ID	Contract	Acceptance
BQ-1	Closed-run reproducibility	Every ranked run binds repository, runtime, cards, prompts, model/runtime identity, attempts, candidates, effects, scores, and host facts; deterministic rescoring is byte-identical.
BQ-2	Oracle and held-out isolation	Zero private prompt/input/oracle bytes in distributed packs, model contexts, logs, diagnostics, training corpora, or public run bundles before authorized disclosure.
BQ-3	Contamination truth	Every result is labeled temporal-clean, declared-uncontaminated, declared-contaminated, or unknown; only tasks committed after a model’s immutable release may receive the temporal-clean label.
BQ-4	Frontier freshness	At least 25% of scored challenge weight is newly precommitted per active epoch; rotate within 90 days, on material leakage, or when saturation triggers, whichever occurs first.
BQ-5	Saturation response	If the top three eligible model families each exceed 90% quality for two consecutive epochs, advance task depth or retire ranking weight without rewriting historical results.
BQ-6	External reproducibility	M1-B requires one project-controlled reproducible baseline; GenesisBench Trust requires two independent operators to replay and rescore at least three model families from closed bundles.
BQ-7	Training-corpus admission	100% of admitted artifacts have compatible license/consent, complete lineage, passing semantics/obligations/policy/resource checks, independent review, deduplication, and zero held-out overlap.
BQ-8	Evaluation firewall	Training builders cannot read active held-out custody material; evaluators cannot silently write training stores; cross-role access and artifact movement are capability-gated and audited.
BQ-9	Statistical unit	The independent task lineage, not its context/tool/scaffold condition, is the sampling unit. Reports cluster all repeated conditions by lineage, publish denominators and uncertainty, and never count a 3-condition ablation as 3 independent solves.
BQ-10	Track isolation	cold-acquisition, open-agent, genesis-adapted, and embedded-local results have distinct eligibility and ranking cohorts. No headline rank, aggregate, or confidence interval crosses track, profile, epoch, scaffold, or incompatible hardware class.
BQ-11	Challenge scale and balance	M1-B Preview has >=45 independently committed and private-payload-verified held-out lineages, >=5 per core task class, across declared difficulty bands and >=2 independently disclosed author/generator authorities; GenesisBench Trust has >=90, >=10 per class, and no author/generator family controls >25% of ranking weight. Commitment metadata without custody-verified payload/oracle bytes does not count.
BQ-12	Reference scaffold and adapters	Cold Acquisition fixes and hashes system prompt, retrieval, cards, tools, transactions, repair policy, budgets, and adapter conformance. The model revision is the only meaningful variable; any scaffold change creates a new cohort/version.
BQ-13	Useful novelty and maintenance	Post-release overlays introduce useful precommitted packages/capabilities rather than riddles, and >=25% of mature ranking weight exercises a follow-on requirement, migration, defect, policy tightening, or resource change against a previously accepted artifact.
BQ-14	Public governance and correction	Challenge/result admission, custody, conflicts, embargo/disclosure, security reports, appeals, invalidation, supersession, and operator rotation follow a signed versioned policy. Corrections append status and rationale without deleting accepted history or silently recomputing old cohorts. A public benchmark/leaderboard requires at least one disclosed independent non-project reviewer/operator; project-controlled evidence remains labeled Preview.
BQ-15	Orthogonal stratification	Every scored lineage has one immutable epoch-local easy, medium, or hard calibration plus separately keyed context, run profile, task class, capability/product surface, track, language profile, scaffold/adapter, attempt policy, and hardware cohort. Reports publish every required stratum and never infer difficulty from context size or merge incompatible cells.
BQ-16	Fast-profile integrity	Every fast form is content-addressed, precommitted before target access, selected at lineage granularity by a declared stratified algorithm, and accompanied by its sampling frame, coverage omissions, uncertainty, and at least one alternate form. Fast results remain a separate directional cohort and cannot satisfy Trust-release, full-coverage, or strongest-model claims.
BQ-17	Reconstruction authenticity	Every migration or product-reconstruction lineage binds license/provenance, destination profile maturity, behavioral and seeded-maintenance acceptance, one-language source closure, disposable generated artifacts, capability/resource/security bounds, and authentic target execution. Unsupported target support is excluded explicitly rather than scored as solver failure.
BQ-18	Model/interface portability	The common artifact-text matrix requires only bounded text input/output and produces the same candidate workspace and score through completion, chat, local-runtime, HTTP, and JSON-stdio adapters. Native-tool and canonical JSON-text-tool encodings are metamorphically equivalent where supported; vendor-only features create separate interaction cohorts and never become eligibility requirements.
BQ-19	Failure attribution	Every attempt has one independently rederived terminal owner class. A semantic model failure requires proven request delivery, closed response capture, conformant adapter/scaffold behavior, successful neutral extraction, intact workspace, and model-independent scoring; unsupported capabilities and adapter/provider/infrastructure defects remain non-scoring typed outcomes.
BQ-20	Tokenizer-neutral context	Canonical content and budgets are bound in UTF-8 bytes plus structural counts, exact delivered bytes never vary by tokenizer, and provider tokens/tokenizer IDs remain reported resource facts. Per-model truncation, summarization, instruction tuning, or content reordering creates a different scaffold and cannot share a cohort.

6.3 Runtime budgets

ID	Budget	Current E0 observation	Target
PB-1	Interpreter fib(25) strict workload	signed baseline upper median-confidence bound about 211ms; independent later observation about 220ms	<= 250ms, then ratchet
PB-2	Bytecode fib(25)	not implemented	<= 40ms
PB-3	Optional validated JIT fib(25)	not implemented	decision-gated; <= 8ms if built
PB-4	1M-element vector construction	about 6ms on smaller audited workload; normalize corpus	<= 150ms on normative workload
PB-5	100k-entry map construction	signed baseline about 489ms; failing	<= 300ms interpreter
PB-6	Cold CLI parse/check trivial module	process startup about 285ms; deterministic snapshot not implemented	<= 30ms with deterministic snapshot
PB-7	Self-host parse throughput	signed lower bound about 42.8 KiB/s; failing	>= 1 MiB/s, then ratchet
PB-8	Warm daemon leak	not established	<= 5% RSS growth after 100k bounded requests and quiescence
PB-9	Semantic tier parity	broad partial gates exist	100% normative corpus, all values/effects/errors/hashes
PB-10	Bootstrap fixpoint	not established cross-host	byte-identical stage2/stage3 on all tier-1 hosts

6.4 Engineering and gate budgets

ID	Budget	Target
GB-1	Static policy/doc checks	<= 15s warm, no compilation
GB-2	Default changed-file gate	<= 2 minutes warm; no network; <= 1 GiB additional disk
GB-3	Standard local pre-commit profile	<= 12 minutes warm; <= 3 GiB additional disk
GB-4	Full release profile	<= 45 minutes on reference CI shard set; peak workspace artifacts <= 20 GiB
GB-5	Clean development footprint	<= 8 GiB after a normal workspace build; genesis clean --cache-policy dev returns to <= 2 GiB generated state
GB-6	Evidence verification	<= 5 minutes offline with no compiler invocation for an already-built release bundle
GB-7	Crate/module concentration	no production Rust source file > 1,000 lines without exemption; no semantic crate > 20k lines by M3
GB-8	Fresh-clone prerequisites	one checked manifest; no undeclared Python package/module assumptions

The 720,000ms GB-3 value is a provisional hard containment ceiling, not a statistically calibrated warm-performance claim. Local clean/fallback observations exposed that the prior 480,000ms bound was not valid for that different cache class, but they cannot establish a warm distribution or authorize a permanent SLO. R9.1.c owns release ratification of separate local warm, local clean/fallback, and hosted cold/shared-runner classes: retain five discarded warmups plus at least thirty conformant samples per claimed class; publish median, nearest-rank p95, MAD, and a distribution-free confidence interval; derive the hard ceiling from the declared host-class distribution and documented headroom; and add rolling trend alarms. Until then each overrun remains a typed hard failure under the existing containment ceiling. Failed samples remain preserved, cold evidence cannot be relabeled as warm, and an incomplete calibration cannot block pre-release implementation or authorize a performance claim.

6.5 Assurance budgets

• Zero known P0/P1 trust-boundary defects at every milestone.
• Zero user-reachable panic/abort paths in release profiles.
• 100% negative-control rejection for seals, capabilities, replay tampering, package signatures, bootstrap artifacts, and evidence manifests.
• At least 30 continuous days of sanitizer/fuzz/property soak with no unresolved high-severity finding before v1.
• All tier-1 release artifacts reproduced by two independent builders; at least one uses an independently maintained verifier.

6.6 Genesis Model research-transfer budgets

These budgets govern what may be learned from Project Theseus, The ASI Stack, GenesisBench, and future research. They do not assert that any candidate architecture or training method is correct.

ID	Contract	Acceptance
MQ-1	Source and permission closure	Every imported claim, report, artifact, dataset, trace, or design binds a clean source edition, path, digest, generator/command, environment, timestamp, owner, license/consent, and public/private class. Dirty worktrees, mutable latest aliases, dashboards, and uncaptured conversations are non-authoritative.
MQ-2	Evidence-state honesty	Every candidate learning is classified as source-note-only, imported, artifact-missing, replay-ready, replay-failed, locally reproduced, stale, runtime-blocked, rejected, or archived lineage. Only locally reproduced evidence may directly support a Genesis Model design promotion; all other states remain visible.
MQ-3	Transfer replication	Every promoted mechanism has a predeclared Genesis-specific workload, frozen baseline, simpler comparator, ablation, resource envelope, and deterministic acceptance where applicable. Stochastic claims report seeds, dispersion, uncertainty, failed runs, and hardware; one favorable run cannot promote a mechanism.
MQ-4	Firewall and privacy	Zero active held-out bytes, private Theseus/ASI material without permission, secrets, evaluator instructions, or undeclared training rows cross into model research or training. BQ-7/BQ-8 and capability-separated storage remain mandatory.
MQ-5	Total-system efficiency	Architecture, routing, memory, recurrence, test-time compute, distillation, and quantization changes are judged on verified task quality plus training/inference time, energy, memory, storage, latency, context, authority, complexity, inspectability, and rollback. A more complex method must beat the simplest adequate baseline on a predeclared Pareto criterion.
MQ-6	Claim-boundary preservation	Theseus implementation receipts and ASI Stack synthesis may propose hypotheses but cannot establish Genesis Model capability, safety, self-improvement, or ASI claims. Every promoted claim names exact scope, assumptions, defeaters, non-claims, and independent verifier authority.
MQ-7	Negative-result retention	Failed replay, null lift, regressions, stale evidence, missing artifacts, unsafe transfers, and no-promotion decisions remain content-addressed and searchable. Selection cannot silently discard them or train only on favorable descendants.
MQ-8	Currentness and supersession	Refresh the transfer crosswalk before each model architecture freeze, training run, and release candidate. Changed upstream evidence creates a new candidate decision; it never rewrites the source edition, experiment, model checkpoint, or prior release history.

6.7 Universal product budgets

These budgets prevent broad platform names from substituting for usable products. Each target profile also publishes stricter hardware-specific limits.

ID	Contract	Acceptance
UP-1	One-language source closure	Every canonical starter and flagship contains zero handwritten foreign application/build/deploy source. Generated foreign artifacts are inventory-bound outputs, reproducible from Genesis inputs, read-only to authors, and deletable without losing source.
UP-2	Authentic artifact execution	100% of claimed target artifacts install or start in the named real runtime and execute a nontrivial acceptance workload. Descriptors, empty exports, extension-only archives, host-side simulations, and scripts that merely hash bytes are ineligible.
UP-3	Product profile conformance	Each product declares language, library, capability, target, SDK/BSP, artifact, lifecycle, and evidence profile identities. Unsupported combinations fail before build; no target silently falls back to a host interpreter or cloud service.
UP-4	Cross-target semantic identity	Shared pure logic, schemas, state transitions, and replayable effects agree across every promoted target. Platform-specific behavior is isolated behind typed capabilities and explicit differential tests.
UP-5	Web quality	Promoted web profiles pass real-engine navigation, responsive layout, keyboard/screen-reader semantics, security policy, offline/PWA where claimed, SSR/hydration equivalence, and declared startup/transfer budgets from Genesis source alone.
UP-6	Native/mobile quality	Promoted desktop/mobile profiles pass install, launch, suspend/resume, termination, permissions, accessibility, input, storage, network loss, update/rollback, and crash-recovery tests on supported simulators plus named physical devices.
UP-7	Interactive quality	Promoted game/graphics profiles meet declared frame-time, input-latency, audio-underrun, memory, asset-load, deterministic-simulation, and save/replay budgets on representative scenes; headless plan identity remains a prerequisite, not the product proof.
UP-8	Service quality	Reference services pass typed protocol, authentication/authorization, persistence/migration, concurrency, backpressure, observability, secret, rolling-upgrade, rollback, fault-injection, and sustained-load SLOs in a self-hosted deployment.
UP-9	Embedded static closure	Every MCU image has statically proven flash, RAM, stack, heap/arena, interrupt, task, peripheral, and energy/timing envelopes for its board profile. Unsupported dynamic language features fail at compile time with repair guidance.
UP-10	Hardware authenticity	Embedded Linux and MCU claims include emulator/simulator evidence plus repeated hardware-in-the-loop boot, peripheral, reset, brownout/power-loss, watchdog, flash/debug, and OTA/rollback results on named boards.
UP-11	Product iteration	After caches are warm, a representative one-file logic/UI/firmware edit reaches a runnable local target within the target’s published p95 budget; the build graph reports where time, disk, memory, and external SDK work were spent.
UP-12	Agent autonomy	A published general model, using only the released Genesis SDK and declared domain packages, completes each promoted product archetype from English request through build, run/device test, policy minimization, package, deploy, and maintenance without human-written code or foreign-source edits.

6.8 Genesis Foundry research budgets

These budgets govern research validity; meeting them does not authorize a production change or establish historical novelty.

ID	Contract	Acceptance
FB-1	Reproducible search	Same task, grammar, catalog, semantic profile, engine/version, seed, budget, and scheduler identity produce byte-identical candidate order, lineage, counterexamples, receipts, and terminal status; nondeterministic engines are isolated into explicitly statistical profiles.
FB-2	Authority isolation	Zero production-to-Foundry code dependencies, zero ambient candidate capabilities, zero generator access to hidden verifier state, and zero self-promotion paths; mutation controls prove each boundary fails closed.
FB-3	Complete lineage	100% of generated, deduplicated, pruned, timed-out, rejected, superseded, and promoted candidates have content-addressed disposition records or a deterministic aggregate commitment that can prove membership without retaining unsafe payloads.
FB-4	Verifier false-accept defense	Every task pack includes independently authored invalid candidates, forged receipts, wrong-profile proofs, hardcoded-oracle candidates, timeout/resource attacks, and law-poisoning mutations; accepted false positives are zero.
FB-5	Calibration before novelty	The first snapshot rediscovers predeclared known optimal or near-optimal bounded structures and known lower bounds where available, with no novel label. Failure to recover the calibration set blocks broader search claims.
FB-6	Certified quotienting	Every deduplication beyond canonical syntax cites a checked equivalence witness under an exact semantic profile. Heuristic similarity may prioritize search but never merges lineage, proofs, or identities.
FB-7	Search value	Each engine and abstraction reports coverage, valid-candidate yield, counterexample yield, frontier quality, wall/CPU time, peak memory, disk, and review burden against exhaustive/random and no-abstraction baselines. Added complexity requires a predeclared material Pareto improvement.
FB-8	Cost honesty	Abstract operation counts, measured host samples, target-specific models, uncertainty, warm/cold state, compiler/runtime identity, and applicability regimes remain separate. No scalar score fabricates a universal winner across incomparable profiles.
FB-9	Proof-to-artifact binding	100% of proof claims bind task, candidate graph, lowering, semantic profile, assumptions, theorem/checker identity, and emitted artifact where claimed; changed input invalidates the receipt rather than inheriting status.
FB-10	Counterexample permanence	Minimized counterexamples and failing property classes enter an append-only curriculum before candidate repair; later candidates must defeat the entire compatible set, and supersession never erases the original failure.
FB-11	Research resource ceiling	Every run has predeclared logical and host CPU, wall, memory, process, artifact, checkpoint, and energy-proxy limits; timeout/kill/reap is bounded and no descendant or lease survives terminalization.
FB-12	Independent reproduction	FD4 requires a separately provisioned checker/operator to replay correctness and cost evidence from a closed bundle without the search engine, model, mutable research registry, or producing CLI.
FB-13	Library promotion firewall	Every genesis/algorithms export has destination-owned API/semantic/complexity/applicability/provenance/license/compatibility review, an independently rerunnable test or proof bundle, rollback/deprecation policy, and a production build that succeeds with foundry/ absent. Search identity or FD status alone never admits an export.
FB-14	Library utility and portability	Every public export is implemented in .gc, documented for humans and agents, covered by examples and malformed/boundary controls, and checked on every claimed Core profile. Specialized variants have deterministic applicability tests and a correct supported fallback; the release reports regressions against the prior version and simplest adequate baseline without requiring novelty.

---

7. Execution protocol

1. Work the critical path in phase order unless a task explicitly names an earlier-safe parallel lane.
2. Before implementation, add or identify the failing test, negative control, benchmark, or proof obligation.
3. Prefer library behavior over CLI special cases and GenesisCode-authored semantics over new host semantics.
4. Keep the pure reference evaluator readable and authoritative until a published self-host/TCB decision changes that authority.
5. Run focused positive and negative checks first, then task-specific guards, then exactly one V2 integration route for the exact revision. Inspect bash scripts/test_changed_fast.sh --dry-run before launch; use its impacted route for ordinary source changes, or use one canonical generated-authority transaction when that transaction owns the source-to-derived closure and its declared read-only check set subsumes the changed-file route. Never run both for the same facts. Full workspace/release profiles run only where their manifest and validation stage require them.
6. Never hand-edit generated evidence or generated matrices. Use one explicit canonical update transaction, inspect the complete diff and terminal check set, and rely on that transaction’s staged fixed-point/read-only verification. Do not rerun the updater merely to prove that the updater just reached its fixed point.
7. Record wall time, peak RSS, disk delta, cache state, and network access for every governed gate profile when it runs; telemetry does not require an extra invocation.
8. If a gate is broken, add it to upgrade_plan.md as an active P0/P1 defect with a roadmap back-reference. Strategic unfinished work stays here.
9. If implementation reality contradicts this plan, fix the plan and evidence ledger in the same reviewed change. Do not preserve an inaccurate checkbox.
10. Commit every coherent green checkpoint in task-scoped chunks and push it to a reviewed remote before starting the next high-risk tranche. Dirty-state evidence may be useful, but the local worktree may never be the only copy. Do not combine semantic format changes, migrations, and unrelated optimization.
11. Default test profiles never invoke another governed aggregate pipeline and never absorb stress, soak, or performance loops. A test that fails under supported parallel load is a defect to reproduce and fix, not an ignore candidate.
12. Until exact reviewed R9.4.f, 100% of repository-changing implementation WIP serves the GenesisCode Self-Hosted Core critical path: R1-A agent usability, R2-R3 runtime/tiering, R5.1/R5.3 contract freeze, R4 semantic authority/bootstrap closure, Core R5-R9 delivery, and executable product proof. New benchmark, Challenge, Foundry, model, governance, or optional platform-pack breadth cannot displace that path; new governance entrypoints require proof that an existing schema, gate, or negative-control matrix cannot be extended and normally replace or consolidate at least one equivalent mechanism.
13. Enforce milestone scope neutrality and one high-risk WIP item globally before R9.4.f. After the signed Core handoff, permit one coherent item per isolated product/research lane, but serialize every shared-interface, compatibility, generated-authority, and release merge. A proposed task names the milestone and critical-path edge it serves, its falsifiable evidence, and the task or scope it refines, defers, consolidates, or retires; otherwise record it in section 9 without expanding the active queue. Changing milestone capacity or exit criteria requires an explicit dated decision, and product lanes never borrow completion claims from one another.
14. The machine-selected execution frontier is stricter than the set of graph-ready tasks: one repository-changing GenesisCode production task is focused; queued priorities do not begin early; curated GenesisExamples/GenesisApps, GenesisBench campaign/publication, GenesisChallenge, Foundry implementation, optional-pack breadth, and Genesis Model implementation WIP are zero before R9.4.f. After R9.4.f, Foundry Foundation F2.a-r is the first downstream product path while packs and unrelated F1/F3/F4 may use isolated contracts. The R8.3.a-b seed waits for F2.r; GenesisBench and GenesisChallenge wait for R8.3.b; F2.y still waits for R8.5.s; Genesis Model implementation still waits for R8.5.t.
15. No new feature family, target, schema, registry, gate, crate, or product archetype enters active WIP by default. It must close an observed acceptance gap for the current milestone and fit an existing authority; otherwise place it in the deferred frontier or a platform-pack backlog without changing the core release clock.
16. Elapsed time, token use, commit count, repeated review, or an unavailable external service never activates a different product lane before R9.4.f. Continue the selected task’s local implementation or independently useful prerequisites; if its next edge is genuinely external-only, let the generated selector choose the next start-ready Core prerequisite rather than target-model access, benchmark custody/commissioning, campaign publication, Challenge, Foundry, pack breadth, or Genesis Model work. A concurrent read-only assurance observation must use separately provisioned resources and require no active-agent supervision.
17. One successful invocation is the development limit for an identical command, revision, inputs, host class, cache state, and seed. One additional identical invocation is permitted only to reproduce or confirm a recorded flake or nondeterminism hypothesis; record that hypothesis before launch. A source or test change creates a new exact revision and may justify one new invocation.
18. Repetition is evidence only when a declared independent variable changes or when a bounded autonomous harness is itself the subject. Microbenchmark samples, fuzz seeds, lifecycle fault cases, host/target matrix cells, and release soak intervals may repeat inside one governed harness; the surrounding whole-repository profile runs once after that harness passes.
19. Before any campaign, record its decision, subject-readiness predicate, independent variable, observation-reuse rule, resource budget, stopping rule, and terminal artifact. Reuse compatible observations by exact identity. Statistical campaigns use a predeclared decision rule with anytime-valid uncertainty or an equally rigorous sequential method, a minimum identifiable sample, and a hard maximum budget; they stop as soon as the decision is resolved and report inconclusive rather than filling a quota or overstating an underpowered tail estimate. Do not start or continue a campaign whose result cannot alter an implementation, containment, promotion, or release decision.
20. Long-running commands and campaigns run autonomously. Agents do not spend model turns polling unchanged output; they report launch, a material state transition, terminal result, or required intervention. Stop when the declared rule is met rather than filling an arbitrary sample quota after the decision is already resolved.
21. Validation cannot outrun implementation maturity. Do not benchmark known-incorrect behavior, soak a stub, run cross-host qualification for an unsupported host, or exercise a release matrix before a release candidate exists. Preserve a truthful unsupported/not-ready result and advance the implementation that owns it.
22. Expensive evidence never becomes a retroactive prerequisite for a completed task. If a stronger later assurance requirement is discovered, assign it to the earliest not-yet-completed milestone whose decision it can change; preserve the earlier evidence and reopen a completed task only for a reproduced regression in its original acceptance boundary.
23. Machine-selected guards must test the selected task’s acceptance boundary. When one workstream contains materially different resource or evidence classes, bind the task to a narrower named execution profile rather than inheriting irrelevant benchmark, proof, or release commands. A checker must reject regression to the broader profile.
24. A changed-file dry run is a launch decision, not ceremonial output. If its fallback is caused only by generated-authority outputs, dependency fanout already validated by the canonical transaction, or path-classification gaps, do not launch the aggregate. Reuse the exact transaction observations, repair the impact classification if necessary, and reserve fallback profiles for unresolved hand-owned semantic/configuration impact.

Validation ladder:

Stage	Activation	Required evidence	Explicitly forbidden
V0 Contract	Before implementation	One falsifiable failure, negative control, or proof obligation	Pretending an absent implementation passed
V1 Focused	Smallest runnable slice exists	Focused success, malformed/denied/failure path, deterministic rerun only when semantics require it	Whole-suite loops and performance claims
V2 Integration	Focused checks pass	Task guards plus exactly one dry-run-selected impacted route: changed-file profile or subsuming canonical generated-authority transaction	Running both routes for the same facts or repeating a green aggregate to accumulate confidence
V3 Assurance	Relevant feature/workstream is functionally complete	Declared property/fuzz/stress/cross-host matrix in one bounded autonomous harness	Soaking known functional failures or unsupported products
V4 Release	R9.1 release candidate exists	Full host/reproducibility/security/performance matrix, class calibration, independent reproduction, and soak	Using pre-candidate repetition to block implementation

---

R0. Truthful Green Door and evidence authority

Goal: make the repository, planning state, checks, evidence, versions, and resource costs tell the truth from a clean clone.

R0.1 Canonical planning and status

• R0.1.a Track this roadmap. Add ROADMAP.md to repository history, retain its README/index registration, and record the replacement mapping in section 11. Evidence: clean-clone visibility and planning-doc gates. done 2026-07-14; evidence: scripts/check_planning_docs_fresh.sh, scripts/check_doc_topology_drift.sh, and scripts/check_capability_evidence_ledger_contract.sh; input: git-commit-object-sha256:1a0d9bdc8d967af45835abeb4391a1601ab6e9e56cc6a16db35882ee198b527e Evidence 2026-07-14: a network-fetched single-branch clone of the published revision resolved exactly to 43dfb0e02fc612a6636b49636fbc676426ac59ab, contained tracked ROADMAP.md blob 69b038a8cd53c65658ed5ed771a75601f79c9e34, retained the README and docs/INDEX.md registrations, and retained section 11’s complete prior-area replacement table. Planning freshness, documentation topology/reference freshness, the capability/evidence ledger with all 42 roadmap evidence identities, and the 247-task execution-manifest contract passed read-only; the clone remained clean after verification.

• R0.1.b Replace binary feature status. Convert feature_matrix.md to the L0-L5 maturity model, include supported-host scope, and replace “Known gaps: none” with generated gaps from the ledger. done 2026-07-10; evidence: scripts/check_capability_evidence_ledger_contract.sh; input: capability-ledger-bundle-sha256:80123071bac85018252e5aaac1ac9359f3a2c52fe19f79d792f04b02c787a1e7

• R0.1.c Create a capability/evidence ledger. Add a schema and source file mapping each claim to spec, implementation authority, host binding, tests, maturity by platform, owner, and immutable evidence IDs. done 2026-07-10; evidence: scripts/check_capability_evidence_ledger_contract.sh; input: capability-ledger-bundle-sha256:80123071bac85018252e5aaac1ac9359f3a2c52fe19f79d792f04b02c787a1e7

• R0.1.d Generate views. Generate feature_matrix.md, self-host status, compatibility tables, and release claim tables from the ledger. Drift checks compare generated output without rewriting it. done 2026-07-10; evidence: scripts/check_capability_evidence_ledger_contract.sh; input: status-authority-bundle-sha256:aa3e5341d45b6b5dc69451a9686185efc165d8e818bbad03a46cdf1f41051e0f

• R0.1.e Reconcile planning docs. Keep upgrade_plan.md as the active red-team defect queue, this file as strategic sequence, and status docs as generated/audited views. Remove contradictory hand-maintained status claims. done 2026-07-10; evidence: scripts/check_selfhost_doc_runtime_parity.sh and scripts/check_redteam_report.sh; input: status-authority-bundle-sha256:aa3e5341d45b6b5dc69451a9686185efc165d8e818bbad03a46cdf1f41051e0f

• R0.1.f Add a machine-readable execution manifest. Mirror every roadmap task ID into a versioned manifest with prerequisites, risk class, expected inputs/outputs, owning spec/implementation surfaces, required checks and negative controls, resource class, rollback, and acceptance evidence. A drift check proves one-to-one coverage; the manifest schedules approved work but cannot mark its own task complete or override this roadmap’s definition of done. done 2026-07-10; evidence: scripts/check_roadmap_execution_manifest.sh; input: roadmap-execution-contract-bundle-sha256:a5236f26498f58645385d180f8e970c2497e7d413103446b71c632105dcb445e

• R0.1.g Establish checkpoint and remote-CI discipline. Publish each coherent task-scoped checkpoint before the next high-risk tranche, require a clean-clone reconstruction from the published revision, run the complete GitHub CI matrix at least once as a shakedown, classify every remote-only failure, and protect release branches from bypassing required checks. A draft pull request is a valid backup checkpoint but cannot close this task until its exact revision is green remotely. done 2026-07-14; evidence: .github/workflows/ci.yml, .github/workflows/docs-site.yml, and scripts/check_docs_quickstart.sh; input: git-commit-object-sha256:1a0d9bdc8d967af45835abeb4391a1601ab6e9e56cc6a16db35882ee198b527e Evidence 2026-07-14: task-scoped commits were published through PR 1 and the exact head revision passed the complete push CI run 29383561115 with all 63 executed stages successful. The same revision passed PR-only strict selfhost/WASM equivalence, deterministic GPU-device, WebXR browser, and 170-page Quarto/Playwright lanes; the only remote-only defect found was the documentation-maintainer shell fence being executed as a language quickstart, fixed by the explicit genesis-doc-skip contract and revalidated locally and on Linux. A fresh network clone independently reconstructed the revision and passed the R0.1 checks. GitHub exposes exactly one default branch, main; it requires an up-to-date test status, enforces protection for administrators and linear history, and disables force pushes and branch deletion.

• R0.1.h Expand the capability ledger to product and target truth. Replace broad rows that conflate headless planning, host reachability, archive generation, and real products with independently governed rows for application/UI, static web, interactive/SSR/PWA web, service/data, desktop by OS, iOS, Android, games/media, data/ML, Embedded Linux, MCU language/AOT, board/HAL families, flash/debug/OTA, and hardware-in-the-loop. Each row names exact L0-L5 maturity, host/device scope, authentic artifact predicate, one-language source predicate, owner, gaps, evidence, and release eligibility. Generate a product/target matrix and prohibit aggregate CAP-DEPLOYMENT-PIPELINE, CAP-GRAPHICS-RUNTIME, or similar L1 wiring from implying child-target support. done 2026-07-16; evidence: scripts/check_capability_evidence_ledger_contract.sh, scripts/check_feature_matrix_gap_hygiene.sh, scripts/check_release_notes.sh, and scripts/check_doc_topology_drift.sh; input: capability-ledger-bundle-sha256:80123071bac85018252e5aaac1ac9359f3a2c52fe19f79d792f04b02c787a1e7

  Evidence 2026-07-16: the canonical ledger now separates 29 foundation claims from 16 independently governed product/target claims spanning shared application/UI, static web, interactive/SSR/PWA web, self-hosted service/data, macOS/Linux/Windows desktop, iOS, Android, games/media, data/ML, Embedded Linux, closed-world MCU AOT, representative BSP/HAL families, device flash/debug/OTA, and physical hardware-in-the-loop. Every target is truthfully L0 and unsupported: current CoreForm packages, metadata-only mobile archives, empty Wasm exports, headless frame plans, host-operation routing, synthetic launchers, and simulator-only observations cannot raise target maturity. Each target records required and optional browser/host/runtime/simulator/device/board/lab scopes, mechanically coupled maturity and release state, an authentic execution predicate, a deletion-and-regeneration one-language predicate, owner, exact roadmap gaps, evidence IDs, limitations, and related foundations explicitly marked non-inheriting. docs/spec/PRODUCT_TARGET_MATRIX_v0.1.json and the product/target section of feature_matrix.md are generated alongside the five prior status views and are indexed in the documentation topology, Quarto site, source catalog, roadmap evidence bundle, and release notes without increasing the active documentation-leaf budget. The validator requires the broad aggregate boundary, at least one release-required scope, valid foundation links, one-to-one check evidence, no maturity/status escalation, immutable E3/E4 evidence for L5, and no stale gaps; 19 negative controls mutate these boundaries. Release notes independently reject product-target escalation, gap hygiene counts both foundation and product-target gaps, and no product or target is authorized for release.

R0.2 Evidence lifecycle

• R0.2.a Separate check from update. Audit every check_*.sh; a check fails with an exact update command when required material is absent or stale. It never invokes update_*, writes .genesis/perf, warms caches, or compiles unless compilation is its declared subject. done 2026-07-10; evidence: scripts/check_check_update_boundary.sh; input: check-update-boundary-audit-sha256:08c0082749a597997094a308f9e1645191353df0f092cf441622db33cce2913b Progress 2026-07-10: the reachable-helper audit covers all 114 check entrypoints and their sourced/executed local closure; all 114 are compliant, no legacy persistent-output producers remain, all 45 conservatively detected compilation closures and the single network subject are declared, and refresh/update/mutation-helper counts are zero. The permanent smoke suite enforces 51 renderer contracts, 45 heavy-wrapper contracts, missing-output rejection, caller-output-override rejection, retained-tree immutability, and maintenance-mutation rejection. The final aggregate health migration uses input-only copied histories, private check reports, no persistent gate-result cache, no explicit Cargo prewarm, and an explicit retained updater. Write-skill conformance retained 100/100 across 28 rubric rows and 100 generative cases with hashed portable inputs; tracked source decomposition passed 9/9 reviewed parity commands, enforces calendar-valid non-expired waivers, and canonicalizes diagnostic host paths; the release-scale 10,000-module workspace passed lock/build/test/selfhost refresh in 16.553 seconds with a byte-identical retained tree during the check and portable retained output from the updater. The parity run exposed and fixed stage2 handling of slim Value::Int; all 117 gc_opt library tests pass. Full-cross, runtime-backend, GCPM target-runtime, AI SLO/stress, GPU/XR, task, bridge, assurance, package/deployment, in-toto/DSSE/SLSA profile, independent evidence-verifier, adversarial evidence/replay, immutable evidence-storage, dependency-mirror, version-surface, v1 compatibility-registry, gate-manifest, resource-telemetry, and deterministic-cleanup lanes retain the same check/renderer/updater boundary and hashed portable inputs.
• R0.2.b Version the evidence manifest. Profile in-toto Attestation Framework v1.2 with Statement v1 and a pinned authenticated envelope/bundle representation, plus SLSA 1.2 build/source provenance where its semantics fit; define versioned Genesis predicates for source revision, dirty-state policy, toolchain hashes, environment profile, declared network inputs, commands, negative controls, artifact hashes, raw samples, durations, peak RSS, disk delta, and verifier version. done 2026-07-10; evidence: scripts/check_genesis_evidence_profile.sh; input: genesis-evidence-profile-bundle-sha256:39a8fc5e56371df34bd7a558d4847b8f1ab06402f37eeb9d71bee9d3689e6938 Evidence 2026-07-10: four Draft 2020-12 schemas define the closed Genesis predicate, Statement v1 profile, strict SLSA Provenance v1 producer profile, and DSSE bundle. The deterministic E3 vector binds identical Genesis/SLSA subjects, canonical statement bytes, DSSE PAE, and two valid Ed25519 signatures from a public non-trust fixture key. Sixteen in-memory adversarial controls plus a duplicate-key file fixture reject version/type confusion, implicit dirty inputs, host paths, shell strings, undeclared network access, failed controls, floats, subject/payload substitution, missing authentication, malformed signatures, and statement reordering. Normative policy separates SLSA build provenance from source-only evidence, signature validity from authorization, and authenticated measurements from semantic identity.
• R0.2.c Add an independent verifier. Build a small read-only verifier for the profiled in-toto/SLSA envelopes, Genesis predicates, hash trees, signatures, compatibility profiles, and negative-control outcomes. Keep it outside the main CLI dependency graph and publish test vectors. done 2026-07-10; evidence: scripts/check_genesis_evidence_verifier.sh; input: genesis-evidence-verifier-bundle-sha256:6b1806d25003a759574a2ac9475190fd5fd451e0c9cfb4e227749c990cb9766c Evidence 2026-07-10: the nested standalone Rust workspace has an independent lockfile, no Genesis crate or root-workspace membership, no production signing/write/network path, exact duplicate-key and integer-only JSON parsing, externally pinned policy SHA-256, Ed25519 DSSE role/threshold verification, strict Genesis/SLSA compatibility and companion linkage, bounded inputs, normalized non-symlink artifact paths, streamed SHA-256, and a domain-separated Merkle tree. Three additional Draft 2020-12 schemas cover trust policy, artifact tree, and negative vectors. Four positive artifacts verify twice to byte-identical reports; all 30 published re-signed or structural adversarial cases fail at their expected boundary, and an authenticated future-field fixture proves SLSA monotonic extension compatibility. The permanent offline gate runs format, Clippy with warnings denied, six Rust tests, dependency separation, production capability scans, deterministic reports, and retained-tree immutability.
• R0.2.d Establish evidence storage classes. Keep E0 observations under ignored .genesis/; keep E1/E2 schemas and goldens in-tree; publish E3/E4 bundles as immutable release assets with mirror instructions. done 2026-07-10; evidence: scripts/check_evidence_storage_classes.sh; input: evidence-storage-classes-bundle-sha256:c8994da4b2bbf66f1670de7863481b90b146f2b88812555f6d90b29212581fd6 Evidence 2026-07-10: a closed E0-E4 policy and exact generated fixture catalog keep mutable observations ignored, schemas/examples at E1, and every retained signed fixture at non-authoritative E2 regardless of its claimed profile. The E3/E4 renderer requires an independently verified matching profile and class threshold, emits normalized deterministic USTAR only below ignored release roots, excludes trust roots, binds exact payload hashes and verifier policy, names assets by SHA-256, and creates sidecar plus executable mirror instructions. The E3 conformance candidate renders byte-identically twice, verifies without extraction, and mirrors create-new with byte parity. Eight controls reject overwrite, mirror replacement, E3-to-E4 escalation, non-release classes, archive mutation, duplicate policy keys, fixture authority escalation, and archive traversal. E4 policy requires two signatures and two mirrors; no E4 release is claimed until those independent external controls exist.
• R0.2.e Add adversarial fixtures. Reject missing fields, duplicate keys, path aliases, unsupported schema versions, reordered/altered replay facts, forged signatures, stale source identities, and reports produced from dirty inputs without an explicit dirty policy. done 2026-07-10; evidence: scripts/check_evidence_adversarial_matrix.sh; input: evidence-adversarial-matrix-bundle-sha256:80aa2c163a1364ef039c6c89145e4c52a280ce8bcea411fef95676696120a435 Evidence 2026-07-10: a Draft 2020-12 schema and reviewed matrix bind all eight requirements to eleven exact controls with one-time coverage, source authority, fixture, command, and expected diagnostic. The standalone verifier now rejects 30 published cases, including compound ./ path aliases, missing fields, unsupported bundle versions, malformed dirty declarations, missing dirty-path identities, and repository/revision/tree identities that differ from the out-of-band trust policy. The runtime replay control mutates 16 executable facts spanning order/count/index, operation and request/response hashes, response body, decision/cap, and every deterministic scheduler field. The offline aggregate gate rejects duplicate matrix keys, orphaned or multiply referenced controls, fixture/diagnostic drift, and failures at the wrong boundary.
• R0.2.f Restore denied-effect replay parity. Make denied capability decisions produce the same value/error boundary, exit contract, canonical log facts, and replay outcome across Rust and self-host engines on native and WASI. Add one shared regression corpus for allow, deny, unhandled, malformed, and tampered entries; compare every serialized fact including decision and capability; fail closed on any engine disagreement. done 2026-07-14; evidence: scripts/check_evidence_adversarial_matrix.sh; input: evidence-adversarial-matrix-bundle-sha256:80aa2c163a1364ef039c6c89145e4c52a280ce8bcea411fef95676696120a435 Evidence 2026-07-14: replay command success is now defined by complete log verification rather than by whether the faithfully reconstructed terminal value is a sealed ERROR. The shared runtime corpus covers allow, deny, allowed-but-unhandled operations, malformed unsealed requests, reordered/count-altered logs, and mutation of index, op, payload/continuation/request/response hashes, response body, decision, capability, and every scheduler field. The governed gate passes all 30 replay-focused library cases and both six-case Rust/selfhost mirrors on native and WASI; denied runs retain exit 41 and byte-identical canonical logs, while verified denied replays return the same sealed value and exit successfully.
• R0.2.g Make test profiles hermetic and load-stable. Remove aggregate-pipeline recursion from default Rust tests; place process-kill loops, performance probes, and dirty-tree stress in declared isolated lanes. Replace PID-log timing assumptions with explicit fixture readiness/ownership handshakes, prove descendant kill/reap deterministically, and run the affected host-bridge and agent-plan tests repeatedly under supported parallel CPU/I/O load. No closure through ignore, retry-until-green, reduced assertions, or serialized global execution unless the contract itself requires serialization. done 2026-07-14; evidence: scripts/check_test_execution_profile_matrix.sh, scripts/check_host_bridge_fault_injection.sh, and scripts/check_gc_agent_task_cards.sh; input: test-hermeticity-bundle-sha256:1a3d7b76a95c2205ad7e71476ecab4842f7a74a1c6d1d6b701e0b978994eb279 Evidence 2026-07-14: the nested changed-fast probe and both hard-cancellation loops are excluded from default Rust tests but are non-vacuously executed by their declared perf/stress gates. Spawn and persistent bridge timeouts terminate and reap process groups, perform a bounded post-reap sweep for fork/zombie races, quiesce I/O pumps/workers, reject uncertain retries, and recover for healthy calls; three consecutive 151-test parallel-load runs plus the dedicated gate passed without retries. Agent-plan parity now compares Rust and Python over one immutable generated registry snapshot while the separate freshness check binds that snapshot to authorities; the permanent gate passes 16 concurrent selector pairs. Default effect, planner, and shell suites pass with aggregate/stress cases skipped only where their dedicated gates execute them.
• R0.2.h Enforce a warning-free workspace. Run format plus Clippy with warnings denied for all workspace targets and supported feature profiles, including MCP, warm, WASI, build scripts, tests, examples, and generated Rust. Remove the current warnings at their cause; any lint suppression must be narrow, justified, reviewed, and covered by a negative control that prevents module-level or workspace-wide suppression. done 2026-07-14; evidence: cargo clippy --workspace --all-targets --locked --offline -- -D warnings, scripts/check_runtime_backend_feature_matrix.sh, and scripts/check_test_execution_profile_matrix.sh; input: warning-free-workspace-bundle-sha256:5e0aaf06c95bfa2b7a600e6bc1040f2eb52873f338212a962fa5faab7b109567 Evidence 2026-07-14: all workspace targets, MCP/warm paths, WASI CLI, tests, build scripts, standalone evidence producer/verifier, and the four mutually exclusive headless/GPU/graphics/combined runtime profiles compile offline with warnings denied. The fourteen observed MCP/warm diagnostics and three inherited package-report exceptions were removed at their API-shape causes using typed option/request records, named MCP annotation policies, and direct worker-state predicates; no Clippy suppression remains. The existing backend matrix now owns thirteen non-duplicative warning/semantic stages and its end-to-end package-environment test proves the exact active profile. Seven permanent negative controls reject module, workspace, broad, reasonless, and build-flag suppression while permitting only a narrow reviewed #[expect(..., reason = "...")] escape hatch.

R0.3 Hermetic bootstrap and versions

• R0.3.a Fix the root-lock check. Remove the undeclared Python 3.11 tomllib assumption from scripts/check_root_lock_policy.sh; use a Rust helper, a POSIX-safe parser for the required subset, or a checked fallback that works with the declared minimum Python. done 2026-07-10; evidence: scripts/check_root_lock_policy.sh (parser=posix-awk, three negative controls) and scripts/check_green_front_door.sh; input: root-lock-policy-bundle-sha256:da5bce85a48b6e89b160c9ea720356f00ba3a63384978a6cc08d26d0c9cdc059
• R0.3.b Declare one prerequisite manifest. Pin Rust, WASI/WebAssembly tools, Lean, shell/Python minimums, platform SDK expectations, and optional feature tools. Add a command that reports missing or mismatched prerequisites without mutating the host. done 2026-07-10; evidence: scripts/check_prerequisite_manifest.sh; input: prerequisite-manifest-bundle-sha256:b9a97b7316632f958bf2e0d6967e4bb8359caf977c53fe5d0934e7b5a45c3aaa Evidence 2026-07-10: genesis.prerequisites.json is the single semantic authority for nine profiles, four tiered host-platform SDK envelopes, and 28 probeable tool identities. It pins Rust/Cargo/components/targets, Bash and Python floors, Git, Node/npm/Playwright, wasm-bindgen, maintained Wasmtime, exact WASI SDK 33.0 with checksum-verified official platform archives and a complete Preview 1 sysroot, Lean/Lake, CI tools, fuzz tooling, and Apple/Android device helpers while checking tool-native mirrors in rust-toolchain.toml, npm locks, and CI. The read-only doctor emits deterministic JSON or human diagnostics, separates required failures from optional gaps, and only executes an implementation-sealed allowlist of bounded version/presence argv. Seven controls reject duplicate keys, arbitrary or mutating probes, general source drift, Rust-target mirror drift, incomplete profiles, unknown profiles, and unsupported platform selection; repeated core reports are byte-identical and retained inputs remain unchanged.
• R0.3.c Verify clean and offline modes. A fresh clone may fetch declared dependencies once; the offline profile then builds/checks from a content-addressed dependency mirror. Undeclared network access fails. done 2026-07-10; evidence: scripts/check_dependency_mirror_contract.sh and scripts/test_offline_dependency_mirror.sh; input: dependency-mirror-bundle-sha256:5607324af26cbec4bf4b998b9cf1de64ec146e86fbfaa8b01590237f4dbef6c2 Evidence 2026-07-10: the closed policy covers six authorities, two Cargo workspaces, 483 lockfile records converging to 443 unique registry payloads, and three npm SRI-addressed tarballs. Preparation invokes sealed direct argv, rejects non-crates.io or unlocked Cargo sources and npm origin/SRI/redirect drift, normalizes 864,570,518 expanded bytes and 26,498 files into a 103,712,661-byte canonical archive, and installs create-new by canonical-manifest SHA-256. An empty CARGO_HOME network fetch and a warm-cache fetch converged on mirror 62b01f75ac64665463886de0ffe55dde30b9c5873f3974cd7b27ffb1ec962b37; the ignored retained mirror occupies about 116 MiB. From clean Git inventory, empty Cargo/npm caches, and a new target directory, the offline profile built gc_cli, checked all workspace targets plus the independently locked verifier, installed/imported Playwright from local blobs, and preserved source authorities and mirror bytes. Every command used explicit offline/locked flags behind a live-canary-proven Darwin kernel sandbox; Linux full CI uses a fail-closed network namespace, while Windows remains explicitly unsupported rather than emitting false evidence. Eleven fixture controls plus ten internal controls reject policy, source, integrity, path, generated-manifest, archive traversal/link/duplication/bounds, and isolation downgrades; the fast gate is retained-input read-only and the full CI profile runs fetch-once followed by hard-isolated reconstruction.
• R0.3.d Align version surfaces. Reconcile crate versions, CLI output, package schema, GCLOG writer/parser/spec, canonical hash profile, compiled artifact magic, docs, and release metadata. Add migration notes for every dual-read format. done 2026-07-10; evidence: scripts/check_version_surfaces.sh, scripts/check_versioning_release_hygiene.sh, and scripts/check_release_smoke.sh; input: version-surface-bundle-sha256:11f2b7ba680dbff18c2af291f1c6e5787a885252b7ff8c3be888730180bf0ee0 Evidence 2026-07-10: a closed ten-surface registry separates release, package, workspace, lock, GCLOG, GPK, canonical hash, compiled-module, selfhost-cache, and selfhost-artifact identities. Current writers emit package schema 1, lock v2, GCLOG v3, and GPK v2 even with zero refs; explicit legacy package, lock v1, GCLOG v2, and GPK v1 readers are governed by four migration records, while missing lock/workspace/GCLOG and all unknown future versions fail closed. One exported canonical hash prefix preserves existing bytes; compiled and selfhost cache magics reject obsolete identities. Thirty-three maintained manifests are explicit schema 1, both production CLIs report genesis 0.2.0, Python 3.9 needs no undeclared TOML module, six registry adversarial controls pass, byte-level migration tests pass, and the docs ceiling remains 132 after consolidation.
• R0.3.e Create the v1 compatibility registry. Reserve stable IDs for language profile, CoreForm, value/effect hash, log, evidence, package, patch, bytecode, snapshot, and bootstrap formats. done 2026-07-10; evidence: scripts/check_v1_compatibility.sh; input: v1-compatibility-registry-bundle-sha256:7ba9eecb5b3b0173c8ce5840362db4fe5ddb0ad254e2e9f45ebfe85b072c5341 Evidence 2026-07-10: genesis.compatibility.json permanently reserves ten exact genesis/compat/v1/* identities while explicitly claiming reserved-not-stable; nine bind to source-checked pre-v1 candidates and bytecode remains unbound. A closed Draft 2020-12 schema and normative lifecycle define semantic/wire classes, the acyclic dependency contract, writer/readers and migrations per component, monotonic promotion, retirement policy, and seven mandatory R9 freeze requirements. Runtime authorities now name language, CoreForm, hash, log, evidence, package, semantic/VCS patch, snapshot, and bootstrap candidates without changing existing bytes; semantic patches reject absent versions and bootstrap seed reuse rejects absent or mismatched versions. The read-only Python 3.9 gate checks exact reservations, source drift, schema closure, migration links, path portability, candidate/stable separation, complete promotion coverage, and 13 adversarial controls. CI, release hygiene, and the green front door enforce it; the check-boundary audit remains 114/114 compliant, focused tests pass, and all workspace targets compile.

R0.4 Gate architecture and disk lifecycle

• R0.4.a Add a gate manifest. Describe gate inputs, outputs, dependencies, profile, expected duration, disk budget, network policy, platform scope, sharding, and whether the gate is static, build, test, benchmark, proof, or release-only. done 2026-07-10; evidence: scripts/check_gate_manifest.sh; input: gate-manifest-bundle-sha256:36c86b517b6c8dc95ad30c7b411f57b32cca14a1e1553177629206688e31b421 Evidence 2026-07-10: genesis.gates.json resolves all 114 governed checks into 47 static, four build, 33 test, 17 benchmark, three proof, and ten release-only gates with 59 acyclic direct dependency edges. Every entry declares source and execution SHA-256, a transitive exact repository-input identity covering non-shell helpers, conservative input sets, read-only output classes, minimum profile, expected duration, disk envelope, prerequisite tools, tier-1 platform scope, network mode, and shard/cache isolation. All 45 compiling closures declare rebuildable Cargo output, all benchmarks require isolated worktree/cache execution, and only check_selfhost_boundary.sh has optional external network with a named Git input. A reviewed policy, closed Draft 2020-12 schema, explicit updater, and byte-equivalent Python 3.9 checker independently rediscover the live inventory and recompute source/helper identities; the generated self-input uses one documented domain-separated exclusion to avoid a hash fixed point. Fourteen adversarial controls reject inventory, identity, dependency, path, network, write, budget, profile, isolation, output, and duplicate-key violations. The check is retained-input read-only, deterministic across repeated renders, completes within its 30-second local-fast planning envelope, is enforced by CI/profile-matrix/green-front-door gates, and defers history-backed resource envelope enforcement to R0.4.f while R0.4.d supplies measured observations.

• R0.4.b Eliminate accidental rebuild islands. Use one declared Cargo target/cache strategy per profile; stop scripts from creating redundant nested targets; key caches by toolchain/features/input hashes. done 2026-07-10; evidence: scripts/check_cargo_target_dir_policy.sh; input: cargo-cache-bundle-sha256:d90b64cd3ad821d40098d44c823bb93be23d7dca2b0a09278d0f061a5f1ce2e5 Evidence 2026-07-10, strengthened 2026-07-14: the closed policies/cargo_cache_v0.1.json policy and schema declare four semantic scopes: root host, root WASI, root browser/Node Wasm, and the independently locked evidence-verifier host workspace. The canonical SHA-256 key binds strategy, resolved target triple, pinned and observed Rust identities, every declared manifest, lock/config/toolchain bytes, feature and Cargo-profile definitions, and six build-affecting environment inputs while deliberately leaving source edits to Cargo’s incremental fingerprints. Sixty-five helper-using scripts and all 58 source-detected Cargo scripts now converge by scope rather than report, stress, release, or health-profile name; all Rust CI jobs resolve the same policy before rust-cache or raw Cargo, and Wasm/WASI transitions are explicit. The docs gate executes inside a locked stable runtime mirror but rewrites Cargo manifest selection to the authoritative checkout, preserving hermetic runtime writes while sharing exact source and target identities. Script-specific target overrides, direct exports, legacy build paths, and arbitrary inherited targets are absent and fail closed; only GENESIS_CARGO_CACHE_ROOT may relocate the hierarchy without changing the key. Canonical path-free metadata detects stale or colliding materializations. Twenty adversarial controls execute the resolver in a Git-initialized checkout with no .genesis directory, proving it safely creates the reviewed root, writes its producer marker before admission, materializes the cache, and leaves zero active leases for non-shell output modes. Shell mode transfers a process-bound lease to the actual Cargo caller; JSON/path/GitHub-environment modes use a self-owned transient lease and release it after materialization, preventing long-lived CI parent processes from pinning an 8-GiB reservation. Parent symlinks and conflicting roots still fail closed. The cleanup command never invokes Cargo or creates the cache it is reclaiming. Size-budget enforcement remains owned by R0.4.f.

• R0.4.c Implement changed-impact selection. Map files and generated schemas to affected crates/gates, conservatively falling back to broader profiles when dependency certainty is incomplete. done 2026-07-10; evidence: scripts/check_changed_impact.sh; input: changed-impact-bundle-sha256:a56286c16c783aba0efafe5ffad9faaea02af8a6b90e671882620fc1536511f2 Evidence 2026-07-10: policies/changed_impact_v0.1.json, its closed schema, and scripts/lib/changed_impact.py replace the hard-coded direct-crate/CLI heuristic with a deterministic plan that binds policy and gate-manifest identities. Locked offline Cargo metadata supplies all 18 workspace packages and path dependencies; changes compute the complete reverse dependency closure, so gc_coreform reaches all 18 crates while leaf gc_wasm remains precise. Exact gate inputs, declared input-set globs, and reverse gate dependencies produce separate direct and full semantic gate closures. Generated schemas/views, workspace/toolchain/CI authorities, unknown or relationship-free paths, and crate/gate sets above closed cardinality limits fail broad to prepush-standard; no unmatched path can silently become a docs-only no-op. Git collection unions committed divergence, index, unstaged/deleted files, both rename endpoints, and non-ignored untracked files; the current dirty worktree correctly reports 620 paths instead of the former two committed-only paths. Canonical UTF-8 repository paths reject traversal, absolute, dotted, and backslash aliases. Changed-fast executes the machine plan, records its SHA-256 plus affected counts/fallback profile, and retains deterministic override isolation for tests. Ten controls prove root/leaf graph closure, generated-schema and unknown-path escalation, malformed-path rejection, order/duplicate independence, host-path exclusion, complete four-state Git collection, closed schema/policy behavior, and duplicate-key rejection. CI, profile-matrix, and green-front-door entrypoints enforce the selector; the ambiguous two-file governance regression now escalates rather than choosing an arbitrary subset.

• R0.4.d Add resource telemetry. Every gate emits duration, peak RSS, bytes read/written, generated disk delta, cache hits, and network attempts in a common schema. done 2026-07-10; evidence: scripts/check_gate_resource_telemetry.sh; input: gate-resource-telemetry-bundle-sha256:0232e719e9a216ad988b4b3a5db934c6139b1ee51974a0ecf249ea1a9c1d988d Evidence 2026-07-10: all 114 governed checks carry an exact top-of-file wrapper and re-execute under a parent observer; entrypoint-scoped recursion suppression preserves one record for aggregates and one for every nested governed gate. A closed Draft 2020-12 schema requires gate ID, execution identity, platform, exit result, and all seven metrics with explicit units, methods, and exact, instrumented, sampled, estimated, or unavailable fidelity, preventing numeric zero from masquerading as proof. Monotonic duration is exact; process-tree RSS and Linux procfs I/O are sampled; Darwin I/O is labeled as a block-operation estimate; default disk delta is a constant-time sampled allocation observation with an opt-in exact logical scan of policy-declared generated roots. Parent-created bounded event channels account for content-addressed Cargo cache reuse and declared network attempts without entering semantic logs, replay identity, package identity, or generated artifact hashes. Fourteen controls cover complete preamble placement, nested observation, pass/fail/signal preservation, real cache-hit instrumentation, event count and line bounds, malformed/duplicate input, canonical paths, host-path exclusion, and cleanup after malformed events or launch failure. CI, the profile matrix, and the green front door enforce the local-only, remote-collector-free contract; ordinary checks retain no telemetry file.

• R0.4.e Add deterministic cleanup. Provide dry-run and execute modes that classify rebuildable outputs, retained evidence, dependency mirrors, and user-authored data. Never delete untracked user files by pattern alone. done 2026-07-10; evidence: scripts/check_deterministic_cleanup.sh; input: deterministic-cleanup-bundle-sha256:c82b4c9554c1ec87b2a89fc07b80dd5e01bdaf8b7aa09a0ce9763c437d2ff6c5 Evidence 2026-07-10, strengthened 2026-07-14: one closed policy enumerates fourteen exact roots across rebuildable-output, retained-evidence, dependency-mirror, and permanently non-deletable user-authored, with four explicit cleanup profiles and unknown .genesis children defaulting to user-authored preservation. Four closed Draft 2020-12 schemas govern policy, producer marker, canonical plan, and execution result. Deletion requires both reviewed root identity and a policy-bound producer marker; Cargo and dependency-mirror producers mark only their owned roots, explicit initialization rejects protected, tracked, symlinked, escaped, or cross-filesystem roots, and path/age/size/glob/untracked status alone grants no authority. Dry-run is repository-read-only, timestamp-free, host-path-free, and byte-identical for unchanged trees. Execute binds an exact canonical plan hash, revalidates every class, tree, marker, and tracked path, then atomically quarantines all selected roots before physical deletion with termination signals blocked. Whole-tree deletion retries a bounded eight times when host indexers recreate metadata between traversal and rmdir; continuous mutation still fails closed and leaves only quarantined rebuildable state. Forty-one controls include explicit transient metadata recreation, transactional rollback, stale-plan and confirmation binding, marker/symlink/mount protection, generated-state admission and cleanup races, crash recovery, and protected-class preservation. A reviewed real-checkout plan reclaimed 33.5 GB allocated from .genesis/build and legacy target, preserved mirrors, evidence, package state, unmarked roots, and user data, and returned total .genesis state to 114 MB. CI, profile-matrix, and green-front-door gates enforce the contract.

• R0.4.f Enforce GB-1 through GB-8. Split or redesign gates that exceed budgets. The no-panic/TCB policy check must not require a multi-minute cold build merely to scan source policy. done 2026-07-10; evidence: scripts/check_engineering_gate_contract.sh, scripts/check_upgrade_plan_health.sh --profile prepush-standard, scripts/check_gate_resource_telemetry.sh, and scripts/check_cargo_target_dir_policy.sh; input: engineering-gate-budget-bundle-sha256:43d9f7c0bd2d3609525eeda6154d67134aaaecf44f6d73dbc73f9acc09e5246e Evidence 2026-07-10, strengthened 2026-08-07: one closed authority fixes all eight normative budgets and is enforced by thirteen classifier and authority controls. All 47 static gates are compiler-free, network-denied, capped at 15 seconds/64 MiB, and the static panic scan completes in about 0.26 seconds while a separate Clippy lane preserves semantic assurance. Changed-impact fallback passed offline in 83.333 seconds with 6,475,776 bytes of positive disk growth; a clean locked/offline workspace build used 2,671,382,528 bytes; and the prebuilt signed-evidence verifier passed offline without a compiler in 6.1 seconds. The final warm prepush-standard run passed 67 gates in 365,794 ms against the 480,000 ms/3 GiB GB-3 limits, including workspace Clippy, panic assurance, 27/27 agent workflows, mobile/edge pipelines, and real-device Apple M1 GPU compute. Twelve release-scale gates are now held in a schema-closed releaseFullOnlyGates inventory that is proven absent from common/prepush scheduling and present in release-full; this includes full generative/performance suites, production CLI parity, domain bootstrap, source differential parity, backend feature matrices, and stress loops. Cargo scheduling consumes transitive compilation declarations, declared build-environment transitions are provenance-guarded with 19 cache-policy controls, and the retained release ceiling remains 2,700 seconds/20 GiB. GB-7 concentration debt is bounded by four reviewed file waivers and two M3-expiring semantic-crate waivers; GB-8 audits 381 Python and shell sources with zero undeclared modules using the vendored licensed Python 3.9 TOML compatibility path. Its pure classifier derives repository modules from the actual scripts/, tools/, and scripts/lib import roots, accepts governed namespace-package imports, recognizes Unix fcntl and Windows msvcrt as standard-library modules, and still rejects an injected third-party dependency.

• R0.4.g Enforce bounded generated-state caches. Apply GB-5 continuously, not only when a human remembers cleanup: every producer declares owner, content key, last-use/lease, size class, retention class, and safe reclamation order. Enforce configurable soft/hard quotas with concurrency-safe admission and garbage collection; refuse new rebuildable growth before crossing the hard limit; preserve user-authored data, retained evidence, dependency mirrors, active leases, and rollback quarantine. Prove dry-run/execute parity, crash recovery, concurrent builders, low-disk behavior, and steady state across repeated full profiles. done 2026-07-14; evidence: scripts/check_deterministic_cleanup.sh, scripts/check_cargo_target_dir_policy.sh, and scripts/check_default_iteration_workflow.sh; input: generated-state-lifecycle-bundle-sha256:54f5e2baddd3b6b5be4932d3b7ed9b97badc651c6e260eb2bdbbc3603486e658 Evidence 2026-07-14: a closed producer authority covers every reviewed generated or retained root with owner, content-key strategy, bounded size class, retention class, process/protected lease mode, and deterministic reclaim priority. Fixed 8 MiB JSON, 64-producer/class, 4,096-entry, 16,384-lease, 6 GiB soft, 8 GiB hard, and 2 GiB free-space ceilings make policy and registry growth structurally bounded; environment overrides may only tighten the GB-5 ceiling. Rebuildable admission reserves before materialization, accounts for the maximum of reservation and observed allocation, evicts inactive entries by reclaim priority/last-use/identity, trims an oversized inactive requested cache, and denies hard-quota or low-disk growth when only requested or active state remains. Random leases bind OS boot/session plus process-start identity, recover PID reuse and abnormal exits, and block intersecting whole-root cleanup; one-shot resolver formats use self-owned transient leases so a persistent CI supervisor cannot accidentally pin a reservation it cannot release. An external Git-control mutex works for linked worktrees and keeps Windows cleanup from renaming an open lock; atomic registry writes and planned/quarantined transactions recover interrupted reclamation. Every deletion still requires deterministic-cleanup class and current producer-marker authority, so retained evidence, mirrors, rollback quarantine, unknown/user-authored state, symlinks, tracked content, and active leases never become quota candidates. Forty-one exact lifecycle controls cover closed schemas, producer closure, clean-checkout provenance initialization, legacy reclamation, deterministic LRU, hard/low-disk/lease/cardinality denial, protected retention, stale-process recovery, crash recovery, eight concurrent same-entry builders, cleanup/admission serialization, duplicate/oversized input, transient metadata recreation, and twenty alternating host/WASI cycles reaching one-entry steady state. Cargo’s semantic resolver acquires and releases leases across scope transitions; its 21-control policy gate also rejects a Python-only parent gate reserving the full root-host class around nested verifier builds. Migration transactionally reclaimed about 61 GiB of pre-policy build islands, then a warm full fallback loop passed all core/CLI tests in 109,632 ms with zero active-target growth and a 3.0 GiB managed cache, within GB-2 and GB-5.

• R0.4.h Consolidate governance machinery before adding more. Until M1, use a one-in/one-out budget for governed check entrypoints and prefer extending existing schemas, manifests, matrices, and shared libraries. Remove duplicate wrappers/update scripts, collapse checks with the same authority and resource envelope, and publish the before/after inventory plus saved default/CI time and disk. A new entrypoint requires a distinct trust boundary and cannot be justified by documentation convenience alone. done 2026-07-14; evidence: scripts/check_gate_manifest.sh and scripts/check_check_update_boundary.sh; input: governance-consolidation-bundle-sha256:b4c23a101399afd34899b06e21b1e7b4ac11580a347153e6411951075b985a21 Evidence 2026-07-14: the existing closed gate policy and generated manifest now own a one-in/one-out budget rather than introducing another governance document or check. The renderer independently counts check, update, and render entrypoints; binds baseline, ceiling, current, non-positive delta, retired aliases, canonical replacements, and aggregate declared duration/disk; rejects any surviving compatibility-wrapper marker; and adds a dedicated budget-weakening negative control. The feature-matrix check and updater were pure aliases for capability-ledger authorities, so every caller and agent skill reference moved to the canonical names and both aliases were deleted. Inventory fell from 125 to 124 checks and 79 to 78 updaters, with renderers unchanged at 58. The removed aggregate check carried a 570-second/4,096-MiB declared prepush/CI envelope, so aggregate declared inventory fell from 63,420 to 62,850 seconds and 425,472 to 421,376 MiB; these are scheduling ceilings, not observed consumption claims. The canonical capability-ledger behavior and trust boundary remain intact. Roadmap evidence binds the gate policy, schema, renderer, and checks rather than recursively hashing the generated manifest that itself binds ROADMAP.md; check_gate_manifest.sh independently proves that derived output exact. The check/update audit passes 124/124, the gate manifest passes with 17 negative controls, and any future entrypoint growth fails unless an existing entrypoint is retired in the same reviewed change for a distinct trust boundary.

• R0.4.i Make generated-authority closure atomic. Replace the current operator-remembered updater sequence with one canonical, schema-driven dependency graph from authoritative inputs through every generated source, manifest, card, release note, evidence identity, site index, and publication view. Reuse the gate manifest and check/update audit as discovery authorities rather than maintaining a contradictory second inventory; require exactly one owner per output, declared read and write sets, acyclic topological order, bounded resources, and explicit edges for self-excluding fixed-point identities. The updater stages the complete closure outside authoritative paths, validates every read-only check against the staged result, then promotes all outputs atomically or leaves the repository byte-identical; it never signs, attests, rewrites retained E3/E4 evidence, or upgrades claims. A second update is byte-identical and leaves a clean tree. Changed-impact and prepush-standard run the complete read-only freshness closure for affected canonical inputs before publication. Negative controls mutate at least Cargo.lock, CLI schema, roadmap task/evidence text, diagnostic/profile authorities, and GenesisBench authorities, proving that release notes, version surfaces, authoring bundles, gate and roadmap manifests, reference/site indexes, and every other transitive dependent either regenerate in one invocation or fail closed. Satisfy R0.4.h by extending/replacing an existing canonical updater and retiring at least one redundant entrypoint rather than adding another permanent wrapper. done 2026-07-16; evidence: scripts/check_generated_artifact_policy.sh, scripts/check_check_update_boundary.sh, and scripts/check_gate_manifest.sh; input: generated-authority-closure-bundle-sha256:cf2d7548dcfca38f3085bd9ac42376723b20684176a42233c4623a26cdc043fa Evidence 2026-07-16: the existing closed check/update policy now embeds one 29-node, 77-output generated-authority DAG and reuses all 124 gate-manifest/audit entries as validator discovery. Every one of 78 updater entrypoints is exactly graph-owned, the sole orchestrator, or explicitly excluded as local E0, operator-custody, signing, dependency-mirror, or retained-evidence work; a post-implementation ownership audit promoted the assembled Prelude, its manifest identity, the self-host toolchain artifact, cutover dashboard, and review into the automatic graph, and assigned coupled evidence vectors plus the AI timing seed to operator-gated owners. The redundant diagnostic update wrapper and obsolete planning synchronizer were deleted without growing the governed updater inventory. Exact tracked read/write sets, one inherited .genesis/** staging-only temporary-write class, unique ownership, self-freshness routing, topological order, four named fixed-point exclusions, 7,200-second/8-GiB per-node ceilings, process-group timeout termination, and automatic E3/E4/sign/attest/keygen prohibitions fail closed. Six exact mutation routes cover Cargo.lock, CLI schemas, roadmap text, profile policy, diagnostic policy, and GenesisBench, reaching release/version, agent, gate, roadmap, and Quarto dependents as declared. The runner overlays all Git states into an external detached worktree, detects byte or mode changes even on already-dirty paths, validates affected read-only gates, snapshots live non-output inputs and output identities, and rechecks both under a Git-common-dir create-new lock before and after signal-masked promotion with reverse rollback. Fourteen adversarial controls reject duplicate owners, cycles, unknown checks/updaters, resource overflow, protected evidence, forbidden trust commands, automatic operator-gated publication, route drift, undeclared writes, concurrent input/output drift, injected mid-promotion failure, non-byte-identical rollback, and non-idempotent promotion. Acceptance runs first rejected stale outputs without touching the checkout, then atomically promoted the validated closure. Repeated fixed-point and integration runs exposed a stale evidence-count ratchet, duplicate nested validation that exceeded a cold-stage disk budget, a self-host component’s undeclared freshness side effect, byte-only promotion detection that missed a mode-only change, and inherited live-worktree Cargo lease provenance at the detached staging boundary; every failed run left live outputs unchanged, and each defect now has a fail-closed structural or executable regression control. Repository-scoped Cargo target and lease variables are scrubbed before staged generators and validators while unrelated and operator-provided configuration remains available. The final affected closure promoted five derived outputs and the identical second invocation passed with changed=0. Replacing the full docs quickstart as the Quarto-node validator with its existing exact static topology/freshness gate reduced that closure from about 120 seconds and 1.6 GiB of staged build output to about 0.18 seconds while preserving full quickstart coverage in prepush. Changed-fast passed the exact 61-file change set through 26 affected automatic nodes and all 124 fallback gates in 634,990 ms against an explicit 660,000-ms acceptance ceiling; fast-full completed in 60 seconds and the live Cargo target grew by zero bytes. Prepush/release/full-selfhost profiles also bind committed divergence from origin/main when available.

• R0.4.k Close transitive gate-input authority and prove no partial freshness. This M0/M1-A/M1-B publication blocker refines R0.4.i after the round-five counterexample; it adds no check or updater entrypoint and consumes the existing generated-authority hardening allocation. Extend the canonical graph so every governed gate’s recursively discovered implementation/input identity, including Rust integration tests and non-shell helpers reached by an aggregate authority, is either a declared graph input with complete reverse edges or an explicit fixed-point exclusion with an independently checked justification. A change to crates/gc_cli/tests/cli_genesisbench_front_door.rs must route through the GenesisBench protocol/profile closure, agent corpus/bundle, gate manifest, roadmap manifest, and reference/site indexes in one transaction; generated_authority.py --check, changed-impact, and hosted CI must fail before any partial publication. Add dependency-completeness controls that mutate one Rust test, one transitive Python import, one gate helper, one generated bundle input, and one fixed-point exclusion; compare graph discovery against the gate manifest and check/update audit; reject unowned reads, stale execution/input identities, and a graph that reports fresh while any governed check fails only for freshness. Extend the existing roadmap-manifest controls to reject a scalar prerequisite on a non-sequential workstream unless it expands to every required leaf; cover parallel proof, archetype, benchmark, and model-lane counterexamples. The updater must remain atomic, read-only checks must remain non-mutating, a second update must be byte-identical, and no retained E3/E4 evidence may be rewritten. Completion requires the current stale GenesisBench/gate identities to be repaired, the exact counterexample to pass locally and in protected CI, and PR publication to main without bypassing required checks. done 2026-08-03; evidence: scripts/check_generated_artifact_policy.sh, scripts/check_check_update_boundary.sh, scripts/check_gate_manifest.sh, scripts/check_roadmap_execution_manifest.sh, and protected CI run 30826800834; input: generated-authority-closure-bundle-sha256:cf2d7548dcfca38f3085bd9ac42376723b20684176a42233c4623a26cdc043fa Evidence 2026-08-03: the canonical authority graph now recursively discovers governed shell, Python-import, Rust integration-test, generated-bundle, and helper inputs; compares them against the gate manifest and check/update audit; requires complete reverse routing or an independently constrained fixed-point exclusion; and rejects stale execution identities, unowned reads, partial freshness, and scalar prerequisites that bypass leaves of non-sequential workstreams. Permanent mutation controls cover the original GenesisBench Rust-test counterexample, a transitive Python import, a gate helper, a generated bundle input, fixed-point exclusions, and parallel proof, archetype, benchmark, and model-lane fan-in. The GenesisBench mutation reaches protocol/profile, corpus/bundle, gate, roadmap, reference, and site outputs in one atomic transaction; failed checks remain non-mutating, updates preserve E3/E4 custody, and a second update is byte-identical. Local generated-authority, gate-manifest, execution-profile, roadmap-manifest, formatting, exact changed-fast regression, and strict workspace checks passed. The exact reviewed head ee758c435de58802e01f07e54c6c42b39e340516 passed protected GitHub Actions run 30826800834: all 97 aggregate steps plus documentation, strict-equivalence, WebXR, deterministic GPU, and local-workspace contracts succeeded. PR #5 was then promoted without bypass through the required linear-history path to main commit 2646e42ec7a27c929f5cbbbd5e62f979175eff90; local and remote trees were byte-identical, main was synchronized, and the temporary publication branch was deleted locally and remotely.

• R0.4.j Restore an authentic, hermetic release-full profile within GB-4. This is an M0/M1-A/M1-B critical-path refinement of R0.4.f, not a new release or platform scope. Give the serialized release evidence bundle one closed manifest whose report identities, semantic inputs, runtime/toolchain identities, and freshness are validated by every direct and nested consumer; source-decomposition and other aggregate checks may reuse a report only when the invoked gate, complete inputs, environment profile, and required evidence class match exactly, otherwise they rerun. Eliminate repeated native/WASI gauntlets, backend matrices, and other proven duplicate work without replacing execution with stale .genesis/perf state or weakening parity. Provision and document a named reference CI shard set with real iOS simulator, Android emulator, edge runtime, and service/container commands; bind each command, runtime class, SDK/image/device identity, artifact hash, logs, and lifecycle result. Until R6.3.f/R6.6 make the emitted packages genuinely installable and executable, strict target qualification must stop at a typed unsupported-product/readiness blocker and may not call a synthetic launcher non-synthetic; infrastructure/configuration failures remain distinct hard failures. Make the CI control plane fail boundedly: PR-only supersession may cancel an older run for the same PR, but default-branch pushes, schedules, and dispatches cannot silently replace one another; a hosted preflight binds exact self-hosted runner labels and prevents impossible 24-hour queues; unavailable optional pack runners produce typed non-claiming dispositions while unavailable runners required by a claimed profile fail; and a disjoint watchdog enforces latest-main standard disposition within two hours, full-run termination within sixty minutes, and successful full freshness within forty-eight hours. Replace the impossible v0.1 serial cold/warm pair with a closed v0.2 release-evidence DAG: execute exact-revision invariant nodes once with manifest-bound same-run fan-out, run independently matched odd cohorts of at least three cold and three deterministically prewarmed cache-sensitive workers plus separately declared odd stress/performance cohorts, and have one read-only aggregate reject missing or undeclared duplicate execution, cross-class reuse, forged cache state, overlapping exclusive lanes, identity drift, incomplete cleanup, or any failed node. Completion requires P1.7’s aggregate resource owner and complete R0.4.i/R0.4.k guard rerun, every DAG node on exact reviewed main to pass within its unchanged <=45-minute/<=20-GiB worker bound, the complete workflow and five-minute aggregate to terminate successfully within sixty minutes, named target dispositions and append-only incident evidence to verify, and the disjoint watchdog to recognize a successful exact-main standard disposition plus successful full evidence no older than forty-eight hours. done 2026-08-10; evidence: protected standard run 31284542152, release-full run 31284543591, independent watchdog run 31287266902, scripts/check_gate_resource_telemetry.sh, scripts/check_generated_artifact_policy.sh, and scripts/check_test_execution_profile_matrix.sh; input: ci-release-dag-aggregate-sha256:6c5c4e3da4ce4ee04fd744caaa7d088746aa814463061021d702a8a4244733b9

  Replace the contradictory v0.1 serial cold/warm pair with a v0.2 release-evidence DAG rather than increasing any limit. The closed DAG declares, for every required node, its governed gate identity, complete semantic and tool inputs, environment/host class, evidence class, cache-state sensitivity, repeat policy, isolation class, resource bounds, dependencies, and authorized consumers. Exact-revision invariant nodes execute once in the workflow and their authenticated same-run report may fan out to any number of manifest-bound consumers; this is evidence reuse, not result caching. No invariant node reruns merely because a second consumer, sample class, or aggregate needs the same fact. Cross-run .genesis/perf state, an unbound CI success, and a report from a different source, toolchain, environment, host class, invocation, or evidence class remain inadmissible.

  Cache-sensitive nodes use independent matched cohorts, not falsely paired samples from different hosted machines. Run at least three isolated cold workers and three isolated warm workers concurrently. Every cold worker starts from an empty, nonce-owned cache root. Every warm worker first performs a deterministic, bounded, untimed precondition into its own empty root, then proves the exact cache-key, toolchain, source, feature, artifact-inventory, ownership, and no-network state before starting the measured node set. Cold and warm cohorts execute the same closed cache-sensitive node set and match on source, workflow attempt, host profile, toolchain, workload manifest, limits, and GPU policy; they report distributions independently and never claim within-host deltas. Non-cache-sensitive stress or performance nodes execute only in their own contract-declared odd cohort of at least three exclusive workers. A node belongs to exactly one measurement class unless its normative question genuinely requires multiple classes, in which case the DAG records the reason and the aggregate rejects undeclared duplication. Optimizers, producers, pair/cohort workers, and prior reports cannot authorize or rewrite the aggregate.

  The read-only aggregate verifies complete DAG coverage, exact worker cardinality, disjoint owned roots, declared warm preconditions, no overlapping exclusive lanes, source/environment/target agreement, every artifact hash, cleanup recovery, bounded failure tails, and the absence of both missing and undeclared duplicate execution. It derives median, nearest-rank p95, dispersion, failure/abstention counts, peak RSS, generated-disk attribution, and critical-path wall time without treating correlated consumers or repeated reads as independent samples. Add adversarial controls for stale or cross-class report reuse, mismatched environment identity, forged warm state, nonempty cold state, hidden precondition time, duplicated invariant nodes, missing DAG leaves, overlapping exclusive workers, absent runtimes, impossible runner labels, cancelled-only history, missing schedules, wrong-head success, watchdog self-reporting, synthetic relabeling, and false success after an expected blocker.

  Keep node bounds, the per-worker GB-4 decision, job envelopes, the five-minute aggregate deadline, and the full-workflow watchdog distinct and ordered. Each worker must terminate and reap every child, retain complete logs plus a bounded portable failure tail, and leave diagnostic-publication time before external cancellation. Completion requires every required DAG node, not merely a prefix or one worker that reran the monolith, to pass on the exact reviewed main revision and named reference set; each measured worker is <=45 minutes and <=20 GiB, the successful DAG critical path plus aggregate is <60 minutes, and the disjoint watchdog recognizes a successful full run no older than forty-eight hours. The runner-absent path terminates within five minutes with exact setup, infrastructure, or unsupported-profile diagnostics. Append-only dispositions cover the 2026-07-18 through 2026-08-05 blackout and every subsequent failed full-profile design counterexample through the closing run. Capacity decision: this task owns P1.6, consumes the existing R0.4.f operational-hardening allocation, and must close before M1-A or M1-B publication; it defers no R6 implementation and does not make mobile, edge, service, GPU, or other platform-pack product claims early. Evidence 2026-08-05, round-eight disposition: the review correctly identified that hosted full had no successful authority and that the earlier monolithic run concealed its child failure, but its proposed single test_suite matrix and artifact diagnosis are now superseded by measured topology. Exact main revision b89fa08a947ff1edd4144553bc8694bf1af3f70b ran three disjoint governance/runtime/platform test lanes, four named target-readiness shards, two isolated release pair workers, and one read-only aggregate in Actions run 31023619554. All target shards and ordinary test lanes passed; the platform lane exposed a relocated-CARGO_TARGET_DIR Web binding bug, pair 2 exposed a 374159ms empty-target backend build against an incorrectly inherited 360000ms subordinate bound, and pair 1 reached the later stress sequence before the unchanged 2700000ms GB-4 supervisor terminated it. The corrective transaction resolves Web artifacts through the configured Cargo target, binds the release-only backend producer to its already-declared 600000ms gate envelope, reuses the exact release-full native gauntlet in native/WASI parity, and uses three stress repetitions in each independent pair rather than six repetitions in each worker. None of these corrections raises GB-4, changes a product claim, accepts stale evidence, or treats the review itself as completion. R0.4.j closes only after the exact promoted main revision satisfies the existing full-profile, pair, aggregate, target, watchdog, and append-only incident predicates above. Evidence 2026-08-05, exact-main serial-pair counterexample: PR #22 promoted the manifest-bound source-decomposition repair through all protected checks to exact main revision a4269136f17ca2e11c6b8f0bd296a2c3691d8138; its temporary branch was deleted locally and remotely. Full run 31063538202 then passed governance, runtime, platform, WebXR, deterministic GPU, all four named target-readiness shards, and both complete cold release-full executions. Pair 1 cold passed in 2568388ms; pair 2 cold passed in 2556616ms, each below the unchanged 2700000ms GB-4 ceiling with valid reports. Both workers nevertheless failed their warm child at the unchanged 3000000ms pair envelope: cold left only 430674ms and 442492ms, while warm logs independently reproduced the native gauntlet and roughly 313000ms backend matrix before reaching host-bridge stress. The source-decomposition gate no longer reran parity and was not the failure. This is a deterministic counterexample to the v0.1 requirement that two complete profiles execute serially inside fifty minutes: two individually legal 45-minute profiles cannot have a truthful 50-minute serial envelope, and the mandatory non-cache-sensitive work alone prevents a sub-eight-minute warm profile. Raising GB-4, the pair envelope, or the watchdog would conceal the contradiction. R0.4.j therefore requires the v0.2 DAG/cohort migration above, an append-only disposition for runs 31055018208 and 31063538202, permanent controls that reject the old impossible topology, and a successful exact-main full run plus independent watchdog recognition before closure. Evidence 2026-08-07, first exact-main v0.2 disposition: exact main revision 492aa3c5552b4584131ce82f394239cc5544a0d1 passed standard run 31169437484. Full run 31174700994 then passed governance, runtime, WebXR, deterministic GPU, all target-readiness shards, six of seven cache-sensitive workers, two of three stress workers, the invariant worker, and the GPU release gate. It exposed two independent orchestration defects rather than a language-semantic failure. First, the fan-out producer ran hosted image ubuntu24/20260720.247.2 with Node 22.23.1, while stress worker 3 ran rolling image ubuntu24/20260804.265.1 with Node 22.23.2; strict toolchain identity correctly rejected the consumer, but the diagnostic named no differing field. Second, the ordinary platform lane duplicated the DAG-owned native/WASI agent parity producer and failed only its tighter duplicate timing budget: both backends passed all 27 workflows and produced the same replay hash, while WASI took 2127ms against the duplicate 2080ms ceiling. The corrective transaction pins the hosted Node patch across every lane, rejects floating or inconsistent pins, preserves exact executable/version identity checks with field-level mismatch diagnostics and ten negative controls, and makes all release-evidence-owned direct updater steps standard-only so full CI executes each producer solely through its declared v0.2 DAG selector. No budget, evidence identity, parity requirement, or product claim is weakened. R0.4.j remains open pending a successful exact-main standard/full pair and independent watchdog recognition. Evidence 2026-08-08, historical closure: exact reviewed main revision da9359fd35221421563ea77b7dbe17e0a33d0e12 passed standard run 31249172621 in 4659s and release-full run 31249173667 in 2602s; both remained inside the independent 7200s standard-disposition and 3600s full-termination limits. The v0.2 aggregate 68fab0fa55bdf560a81f45b35168bb55123c9f1370b56c01c24ddb357fdd4345 derived its verdict read-only in 1176ms, authenticated all three cold, three prewarmed, one invariant, and three stress workers, rejected no declared condition, and reported status=pass, profileOperational=true, and productReleaseQualified=false. Cold p95 was 1293797ms, 6868234240 artifact bytes, and 3132882944 peak-RSS bytes; warm p95 was 823850ms, 6868246528 artifact bytes, and 3133816832 peak-RSS bytes. Every worker remained inside the unchanged 45-minute/20-GiB bounds with complete cleanup, and Android, edge, iOS, and service runtime each remained explicitly unsupported-product with releaseQualified=false. The append-only release-full chronology now retains all 20 scheduled or dispatched full runs through the closing success, including the explicit cancellation of redundant prior-revision schedule 31248899909; its canonical records digest is 9f38c2abba4f7ec8060cd5b7743ac8bd7a4718c383efdea81348d191b423c9d4 with 11 failures, 6 cancellations, and 3 successes. Independent watchdog run 31250800213 verified both retained ledgers, exact head and freshness, observed three canonical successful full runs, emitted zero violations, and preserved releaseQualified=false. This evidence remains valid for those runs but does not satisfy the later P1.6/P1.7 counterexamples; input: ci-release-full-closure-bundle-sha256:c75f96cacd842faa656845129de79ad49f41ec736fd4c5b2042d92a59c2a39d8. Reopened 2026-08-08 under P1.6: the closing standard run remains valid direct CI evidence, but the watchdog recognized exact-head push-fast and full histories rather than independently classifying that standard dispatch. Exact revision 6d22bc1e1eebee6ac76b8c20fb513f7d14b37d5b later demonstrated a failed standard run beside a successful full run and green watchdog. The correction required the standard classifier and negative controls, a passing exact-main standard/full pair, and independent watchdog recognition of both without rewriting the retained closure or failure chronology. Progress 2026-08-09 (local exclusivity correction; preserved R9.1.c input): the first local campaign proved that a point-in-time ps ... comm preflight could miss a shell-wrapped Quarto render and could not detect a competing build that began after admission, while still serializing competingLaneState=exclusive. Its six semantic observations remain preserved as superseded E0 diagnostics under ignored storage and cannot enter calibration. The corrected collector classifies complete process arguments for direct, shell, env, rustup, Deno, and Node wrappers; computes the measured workload’s complete descendant closure across nested process groups; polls once per second through workload termination; and kills, reaps, and retains any external match as a typed competing-lane hard failure with a positive maximum competitor count. Semantic passes and every other failure class require zero competitors. Twenty-nine collector controls, twenty-two independent calibration controls, closed schemas, static Python checks, and a bounded live macOS wrapper/ownership fixture pass locally. This collector work is preserved for R9.1.c; it is not an R0.4.j closure predicate and grants no SLO or release authority. Closure disposition 2026-08-10: P1.7 and P1.6 had already passed the operational acceptance boundary on exact reviewed main. Standard run 31284542152, release-full run 31284543591, aggregate 6c5c4e3da4ce4ee04fd744caaa7d088746aa814463061021d702a8a4244733b9, and watchdog run 31287266902 prove the bounded v0.2 DAG, cleanup, typed unsupported-target dispositions, and independent standard/full recognition while preserving productReleaseQualified=false. Section 3.23 assigns later multi-class SLO ratification to R9.1.c, closes this implementation task without weakening the provisional ceilings, and preserves every collected success and failure.

R0.5 Baselines and release hygiene

• R0.5.a Establish reference host profiles. Record tier-1 macOS arm64 and Linux x86_64; add Linux arm64 and Windows x86_64 as tier-2 until promoted. Include CPU, memory, filesystem, OS, compiler, and power-mode metadata. done 2026-07-10; evidence: scripts/check_reference_host_profiles.sh; input: reference-host-profile-bundle-sha256:41b7156b78e63cf10d3462d7a1618ae84c1827af7b4480469b3bd0fa9556a9d9 Evidence 2026-07-10: one closed policy and two closed Draft 2020-12 schemas define exactly four prerequisite-aligned host classes: tier-1/reference macOS arm64 and Linux x86_64, and tier-2/candidate Linux arm64 and Windows x86_64. Each profile pins CPU architecture/model/core floors, memory floor, filesystem type/block size/case behavior, OS range, Rust/native compiler family and range, and AC/low-power/governor state; measurement-session controls separately require an exclusive non-virtualized host, nominal thermals, at most 5 percent background load, and are consumed by R0.5.b rather than falsely inferred by this machine probe. Promotion requires signed E3 evidence, independent verification, at least two hosts, and at least 30 samples per workload. The dependency-free Python 3.9 probe emits timestamp-free, hostname-free, username-free, serial-free, absolute-path-free canonical JSON, derives rather than trusts conformance, and binds every portable fact with SHA-256. Nine controls prove conformant fixtures for all four platforms and reject tier drift, identity tampering, path leakage, stale derived conformance, and duplicate keys. Two consecutive real Apple M1 observations were byte-identical and conformant with identity 578df4adfb8b04c2c1cd9910ad195dae7448750afb293a25e3a858c247dc7c8c; this remains unsigned diagnostic E0 and cannot support a baseline or release claim. The read-only, compiler-free, network-denied gate is registered across all four platforms in CI, the gate manifest, the green front door, the profile matrix, topology/index authority, and all 117 update-boundary checks remain compliant.
• R0.5.b Normalize benchmark workloads. Fix exact source terms, input sizes, expected hashes, warmup, sample count, timeout, cache state, and statistical treatment for PB-1 through PB-10. done 2026-07-10; evidence: scripts/check_roadmap_workloads.sh; input: roadmap-workload-bundle-sha256:a14f98d85c198c2743873d94ee50eb0ad4a954c9e922e36a3f0d0b1c3136241f Evidence 2026-07-10: one closed Draft 2020-12 schema and canonical policy define all ten PB IDs in numeric order, with exact content-addressed source/protocol inputs, canonical expected-outcome descriptors and hashes, input sizes, runner and truthful availability state, target direction/unit/value, cache state, warmup, sample count/unit, and timeout. PB-1/PB-2/PB-3 share one exact fib(25) source and result; four currently executable workloads are active, five unavailable target runners are fail-closed roadmap-blocked, and the optional JIT is decision-gated, preventing specification from masquerading as implementation evidence. Timing workloads retain 30 ordered samples after five warmups, report median/p95-nearest-rank/MAD, retain every outlier, invalidate the whole set on timeout or semantic failure, and decide against the directional bound of the exact distribution-free 95 percent median interval at ranks 10/21. PB-8 fixes 1,000 warmups, 100,000 measured requests, 30 quiescent RSS checkpoints, maximum growth plus robust Theil-Sen slope, and a 45-minute hard session ceiling. PB-9 binds five transitive cases spanning values, canonical hashes, effects, sealed/resource errors, and scheduling; PB-10 binds the seed, source manifest, exact stage commands, two rebuilds on each of two tier-1 hosts, and byte-identical stage2/stage3. Twelve adversarial controls reject false availability, source/descriptor tampering, cache/sample/timeout drift, corpus omission, path escape, workload order drift, outlier deletion, fixpoint weakening, and duplicate keys. The 0.28-second, roughly 18.5 MiB read-only gate is compiler-free and network-denied; its cache identity covers twenty direct/transitive inputs and is enforced in CI, the green front door, profile matrix, topology, and all 118 update-boundary checks. Legacy scalar best_of output is explicitly non-authoritative E0; raw signed samples and truthful current failures remain R0.5.c work.
• R0.5.c Capture a signed baseline. Preserve raw samples and current failures without rewriting history; label local 2026-07-10 numbers E0 until reproduced under the new harness. done 2026-07-10; evidence: scripts/check_roadmap_baseline.sh; input: roadmap-baseline-bundle-sha256:712576d0f8f7975f63c8379119a38001f19e637f73319619457faf6b88378976 Evidence 2026-07-10: a closed statement schema, closed DSSE bundle schema, explicit capture producer, independent verifier, and content-addressed retained fixture preserve the complete first normalized run. The release-equivalent sampler accepts only active PB-1/PB-4/PB-5/PB-7 IDs, consumes exact normalized source bytes, prepares declared caches outside the clock, measures one execution with a monotonic nanosecond clock, validates every integer/vector/map/parser result after timing, and lets the controller enforce a hard process timeout. The E0 statement retains all 20 warmups and 120 ordered samples, recomputes exact-rational median/p95/MAD/rank-10/rank-21 statistics, binds workload policy 4fdb7f57fdf68a0ef33dcdf075c3697c8213317958e354c1d55e518784f69dea, conformant host observation, binary, Rust toolchain, Git revision, and complete dirty tracked/untracked material identity, and has baseline identity a3d6c7b809f1c1ba403bab0c4e18fce94154cbae4b35b23aa9e96cfb1c02e967. PB-1 passed with a 210,932,958 ns upper median-confidence bound and PB-4 passed at 6,928,000 ns; PB-5 truthfully failed at 488,535,292 ns versus 300 ms, and PB-7 failed with a 42,804 bytes/s lower bound versus 1,048,576. PB-2/PB-6/PB-8/PB-9/PB-10 remain runner-unavailable and PB-3 remains decision-not-approved; none carries fabricated samples. A generic standalone producer signed canonical DSSE bytes using an ephemeral 0600 Ed25519 seed that was destroyed after capture. The retained raw public key is independently pinned as sha256:f942d973dd550ff9b95e0a61f47e8cee9580e8bb8d43f0226408d57bde2d113f; the separate verifier workspace shares no producer code, recomputes payload and baseline identities plus the ten-workload/sample/failure inventory, and deterministically reports E0 with signatureGrantsAuthority=false. Nine cryptographic and eight statement controls reject forged signatures, payload/sample tampering, wrong/duplicate keys, authority/class escalation, permissive/short secrets, failure erasure, unavailable-runner fabrication, and overwrite attempts. The read-only warm gate passes offline in about 2.36 seconds from the governed cache, all 119 update-boundary checks remain compliant, and the sole update command uses create-new content-addressed paths, refuses an existing date or identity, rolls back only newly created outputs, and never rewrites retained history.
• R0.5.d Add release-note automation. Generate compatibility, migration, known-gap, evidence, dependency, and security sections from canonical inputs; reject unsupported claims. done 2026-07-11; evidence: scripts/check_release_notes.sh; input: release-notes-bundle-sha256:5ef01ad2e7c4b9be665998b062264d19be751c235410fdb01a382e1f0dacbd00 Evidence 2026-07-11: one reviewed policy and two recursively closed Draft 2020-12 schemas generate a content-addressed E1 JSON artifact plus a uniquely bounded Unreleased changelog block from exact canonical inputs. The artifact preserves all ten version surfaces, ten reserved v1 compatibility entries, four migration records, forty roadmap gaps mapped to twenty-nine capability claims, per-platform maturity and limitations, six classified fixtures, the signed E0 baseline and its two current budget failures, three Cargo lock inventories, npm integrity and mirror policy, and nine mandatory release/security gates. Static generation cannot assert execution: every gate is required-but-not-attested, passedChecks is empty, fixture authority remains false, the signed baseline remains observation-only, and an unqualified capability claim requires L5 on every tier-1 platform plus immutable E3/E4 evidence; none currently qualifies. Source hashes, lock hashes, selected gate execution identities, and a canonical content identity make every generated fact reproducible without timestamps or host paths. Seventeen adversarial controls reject compatibility, capability, evidence, or baseline authority escalation; migration, gap, limitation, or security-gate omission; injected gate success; dependency and source tampering; unknown or duplicate keys; absolute host paths; content-identity drift; duplicate changelog markers; and movement of generated content across released history. scripts/check_release_notes.sh is compiler-free, network-denied, read-only, deterministic, proves updater idempotence, and is registered in CI, release smoke, the green front door, profile topology, and the 120-gate manifest; only scripts/update_release_notes.sh may replace the generated JSON and marked changelog region, leaving released history outside its write boundary.

R0 exit criteria: a published clean checkout passes planning/topology/hygiene/complexity, root-lock, version, generated-artifact, warning-denied Clippy, no-user-panic static, and TCB static checks under declared tools on local and GitHub CI profiles; all checks are read-only; replay parity includes denied effects on native and WASI; the evidence verifier rejects every adversarial fixture; default tests neither nest aggregate pipelines nor contain stress/performance loops and remain stable under supported parallel load; default changed gates and generated-state caches meet GB budgets; generated status views exactly match the capability ledger.

---

R1. Agent Preview and preserved GenesisBench foundations: reproducible authoring and intent

Goal: make GenesisCode v0.3 a stable, self-contained target that the user’s AIs and other agents can learn, write, repair, test, and operate locally without hidden repository knowledge. Preserve completed GenesisBench protocol, fixture, scorer, and adapter foundations as non-expanding inputs; section 3.18 defers every unfinished campaign, custody, publication, governance, and Preview-release task until the GenesisCode v1 Self-Hosted Core release. Shared fixtures and schemas do not couple either product’s release authority.

R1.1 Versioned agent language profile

• R1.1.a Define GC-AGENT-v0.3. Freeze the supported surface for agent training: lexical grammar, CoreForm mapping, evaluation, values, contracts, modules, effects, packages, errors, resource limits, and compatibility identifiers. done 2026-07-11; evidence: scripts/check_gc_agent_profile.sh; input: gc-agent-profile-bundle-sha256:0c1fdf1f041602cb9e6d58a89819229db059597ed13a7e8f06e030580e7745d8 Evidence 2026-07-11: reviewed policy policies/gc_agent_profile_v0.3.json, recursively closed Draft 2020-12 schema docs/spec/GC_AGENT_PROFILE_v0.3.schema.json, and generated artifact docs/spec/GC_AGENT_PROFILE_v0.3.json freeze GC-AGENT-v0.3 across all 11 required semantic domains. The profile exposes 51 exact evaluator primitives and 12 runtime value variants, seven parser cases, six evaluator cases, two resource-limit cases, three package cases, and 12 explicit unsupported-behavior boundaries; its canonical identity is 089b28b9283b5d23a7aaf89a52711e1d0ec6a9c706e2c30700ddaf673e51ebf6. scripts/lib/gc_agent_profile.py independently rediscovers the primitive surface from Rust match arms, verifies special forms, runtime values, authority anchors, conformance paths, version registries, compatibility constants, and all five mandatory unsupported classes, hashes every normative input, and rejects 20 adversarial mutations. crates/gc_cli/tests/gc_agent_profile_v03.rs executes the declared parser, evaluator, resource, package, card, unsupported-class, and runtime-identity contracts directly (six tests). The profile is negotiated by the canonical authoring skill and pack, exposed through the agent index and onboarding bundle, uses repository-relative references, and is enforced by the governed check/update boundary, CI, profile matrix, and green front door. Independent jsonschema validation, profile check/self-test, Rust conformance, and all focused authoring-bundle gates pass.
• R1.1.b Generate a compact language card. Produce a <=4k-token core card from normative schemas/spec anchors, with canonical positive and negative examples. A drift gate proves every symbol/example parses against the current profile. done 2026-07-11; evidence: scripts/check_gc_agent_core_card.sh; input: gc-agent-core-card-bundle-sha256:8be7f276d116df8d70fd0fdaa7816b51d3ae4aa7d89c1dd62ae96f8a3a4db914 Evidence 2026-07-11: policies/gc_agent_core_card_v0.3.json generates docs/spec/GC_AGENT_CORE_CARD_v0.3.md and content-addressed manifest docs/spec/GC_AGENT_CORE_CARD_v0.3.json solely from the frozen profile and its schema. The card is ASCII-only and 3,916 bytes, establishing a tokenizer-independent upper bound of 3,916 tokens, below the 4,000-token requirement. Its manifest identity is 3510e24aac951e403c6f083c11f195731f9a820f5ad7acddc41707b423e3742f; it contains all 168 deduplicated profile surface symbols, six canonical examples split between successful semantics and valid-syntax failures at named semantic/resource boundaries, and all five mandatory unsupported classes with complete actionable records in the manifest. crates/gc_cli/tests/gc_agent_profile_v03.rs parses every symbol/example and proves class visibility with the production CoreForm integration corpus. The read-only checker proves byte-for-byte regeneration, profile/source identities, complete surface coverage, ASCII and byte ceilings, duplicate-key rejection, host-path exclusion, and 11 adversarial manifest controls. The card is exposed through agent-index, placed before the full profile in onboarding retrieval, required by the authoring skill and pack, and enforced by CI, the profile matrix, and green front door.
• R1.1.c Generate task-specific cards. Create capability, package, patch, replay, testing, deployment, and troubleshooting cards selected by declared task intent, each with a token budget and source hash. done 2026-07-11; evidence: scripts/check_gc_agent_task_cards.sh; input: gc-agent-task-cards-bundle-sha256:9eda4ffa6b9afd6f98121b7cae945ec634f752e9c55b809c5cb703cc73743afa Evidence 2026-07-11: reviewed policy policies/gc_agent_task_cards_v0.3.json generates the seven required records in docs/spec/GC_AGENT_TASK_CARDS_v0.3.json plus the human compendium docs/spec/GC_AGENT_TASK_CARDS_v0.3.md. Every card is ASCII-only, capped at 1,400 bytes, and independently binds reviewed authority content through sourceHashSha256; mutable tests, benchmarks, retained evidence, symlinks, repository escapes, and host paths cannot authorize content. All seven cards total 5,757 bytes/tokens, below both AB-2’s 12,000 maximum and 8,000 target; registry identity is d3f4d74c3141604f6f77f8e3f426ea00f62ae8bef3401445c6af64ce699a400f. The independent selector validates exact genesis/agent-intent-v0.1 fields, normalizes goal/domain/workflow/op declarations, emits deterministic reasons and bundle identity, falls back explicitly to troubleshooting, passes six positive fixtures, and rejects ten prompt-authority, schema, shape, budget, source, host-path, and content mutations. Production genesis --json agent-plan embeds the registry at compile time, rejects unknown intent fields, returns complete selected card content and identities in plan.context_cards, and binds that selection into plan_hash_blake3. Five planner tests pass, including byte-for-byte production/Python selector parity and repeated plan-hash stability. CI, profile matrix, green front door, agent index/onboarding, and the canonical authoring skill/pack require the governed card gate; diagnostics and executable skill conformance pass at 100/100.
• R1.1.d Publish a machine-readable symbol index. Include signatures, effects, capabilities, contracts, examples, diagnostics, deprecations, and source links. Support exact lookup without embedding the entire doc tree. done 2026-07-11; evidence: scripts/check_gc_agent_symbol_index.sh; input: gc-agent-symbol-index-bundle-sha256:25754cf52a47e735abcc667cb2bf43284702d8a304f9b05b4fc539e38ed240cf Evidence 2026-07-11: reviewed policy policies/gc_agent_symbol_index_v0.3.json, recursively closed Draft 2020-12 schema, and deterministic generator produce docs/spec/GC_AGENT_SYMBOL_INDEX_v0.3.json with one uniquely sorted record for every one of the 168 deduplicated GC-AGENT-v0.3 symbols. Each self-contained record carries a structured callable/form/value/field/identifier signature, explicit purity or deferred runner-effect semantics, required capability declarations, normative contracts, conformance or usage examples, diagnostic families, active/deprecated lifecycle state, and repository-relative authority links. The generator hashes 22 source authorities, verifies every anchor, independently proves exact closure over all 51 runtime primitive match arms, rejects duplicate JSON keys, host paths, symlinks, repository escapes, prompt authority, stale bytes, incomplete records, and ten adversarial artifact mutations, and exercises two lookup-cardinality controls; the generated index identity is ab2343f4e28bf631ec10f3cc93808ee800c194cbf48aeacfc0e7dc50ae25a39b. Production genesis --json agent-index exposes only bounded metadata and identities, including the unsupported inventory, while --symbol <exact-name> reads the compile-time index and returns at most one genesis/agent-symbol-v0.3 record without loading the doc tree; padded, unknown, and case-drifted names fail closed. Four production/parity integration tests pass. The gate is governed as read-only, offline, and compiling, and is required by CI, the profile matrix, green front door, onboarding, the authoring bundle, and the canonical authoring skill/pack.
• R1.1.e Define unsupported behavior. The card and schema must name experimental syntax, host-only operations, unavailable targets, nondeterministic facilities, and capabilities outside the selected profile. done 2026-07-11; evidence: scripts/check_gc_agent_profile.sh and scripts/check_gc_agent_core_card.sh; input: gc-agent-unsupported-behavior-bundle-sha256:b96ffc3ef48e79c837383c9f4febecc7662b58d64d5ed700400127226678c558 Evidence 2026-07-11: the frozen profile policy, recursively closed schema, generated profile, and compact card now require the ordered classes experimental-syntax, host-only-operation, unavailable-target, nondeterministic-facility, and out-of-profile-capability. Draft 2020-12 contains rules independently require every class, while the resolver requires exactly one canonical record per class and rejects missing classes, unknown fields, weak status, unknown enforcement, erased safe alternatives, duplicate IDs, host paths, and stale roadmap links. Twelve status-unsupported records define exact behavior, enforcement (reject, explicit-effect-only, deny-by-default, profile negotiation, bounded opt-in, or claim prohibition), rationale, safe alternative, and change-authorizing roadmap task; stale bytecode and JIT links were corrected to R3.1.a and R3.4.c. The 3,916-byte ASCII core card names all five classes, and its content-addressed manifest carries every complete record; 20 profile and 11 card mutation controls plus the six-test Rust corpus prove card visibility and actionable alternatives. The symbol/agent index exposes bounded class/count metadata and unsupported-inventory identity e0060de7377c7e5123c651c32baf974527493f72afed8947c1edbe12f9d3fcc5 without embedding the profile tree. Both profile and symbol artifacts pass independent Draft 2020-12 validation; authoring/onboarding rules forbid prompt- or index-derived authority and require safe alternatives without silent policy broadening.

R1.2 Diagnostics as an agent API

• R1.2.a Create a stable diagnostic catalog. Assign versioned IDs, severity, phase, primary span, related spans, structured parameters, likely causes, safe repair actions, and documentation anchors. done 2026-07-11; evidence: scripts/check_cli_diagnostics_contract.sh; input: gc-diagnostic-catalog-bundle-sha256:356bd19b37f25bb8f3ab0d001b9cec88613ab095841573cdec0b689c5596c36a Evidence 2026-07-11: reviewed policies/gc_diagnostic_catalog_v0.1.json, a recursively closed Draft 2020-12 schema, and the independent read-only generator close all 125 production CLI diagnostic codes across 20 explicit lifecycle phases. Generated docs/spec/GC_DIAGNOSTIC_CATALOG_v0.1.json has identity 27817269acf0a487e731b39d27788ba41ded0a7d3bc685dea5930dd2097a51ed; each uniquely sorted record binds a versioned genesis/diagnostic/v1/<family>/<name> ID to severity, nullable primary-span and always-present related-span contracts, JSON-typed parameters, nonempty likely causes, guarded safe repairs, anchored documentation, and exact source callsites. Runtime envelopes embed the catalog identity and emit those fields; producer context remains namespaced under the declared parameters.context object, and uncataloged routes fail closed as diagnostic/catalog-miss while retaining parameters.reported_code. agent-index --diagnostic <exact-code> returns at most one self-contained record without loading the documentation tree and rejects padding, case drift, unknown codes, and conflicting symbol lookup. Fifteen artifact mutations, two lookup controls, six runtime unit tests, six agent-index integration tests, the all-command-family matrix, independent JSON Schema validation, and source/freshness hashing pass. The whitespace-bearing debugger helper routes were collapsed to stable debug/bisect; normative prose was folded into the existing CLI JSON contract to hold the 134-active-doc ratchet; R1.2.b builds the universal closed context contract and typed domain producers on this catalog authority.
• R1.2.b Eliminate string-only failure contracts. Parser, typechecker, evaluator, package, policy, replay, patch, build, and deployment errors expose structured JSON while retaining concise human rendering. done 2026-07-11; evidence: scripts/check_cli_diagnostics_contract.sh; input: structured-failure-contract-bundle-sha256:b32f803da6513570233bca0aaa59bfc5989b976c14086a3a66a73a6a5a6473f3 Evidence 2026-07-11: the recursively closed Draft 2020-12 docs/spec/GC_FAILURE_CONTEXT_v0.1.schema.json defines the only runtime failure-context shape and the exact authority domains parser, typechecker, evaluator, package, policy, replay, patch, build, and deployment. crates/gc_cli_driver/src/structured_failures.rs converts typed parser offsets into UTF-8 line/column spans, preserves kernel and effect variants, records stable manifest/patch/build/replay facts, scrubs absolute paths recursively, and normalizes every remaining legacy producer into the same closed schema without treating prose as a routing contract. gc_types now creates stable typechecker diagnostic IDs, codes, severities, module identities, and ordinals at the checker authority while retaining legacy error/warning vectors and CoreForm rendering; gc_obligations and the CLI preserve those diagnostics end-to-end. Parser, evaluator, package, policy, replay, patch, build, deployment, and self-host protocol boundaries emit typed contexts directly; any failure envelope without a producer error fails closed to a cataloged synthesized error, and every other legacy context is preserved only as path-scrubbed facts.legacy_context. The 125-code catalog scanner recognizes plain, anyhow, and structured constructors and rejects scanner drift. cli_structured_failures exercises all nine domains, span localization, deterministic path exclusion, structured typechecker payloads, and concise non-JSON rendering; the existing all-command-family matrix now requires the closed context on every failure. Forty-nine driver unit tests, 35 typechecker tests, 18 obligation tests, five typecheck/patch frontend tests, both CLI matrices, the catalog self-test, schema closure check, and the no-user-panic gate pass. The check remains read-only, offline, isolated-cache aware, and completed in 13.39 seconds against a 300-second budget.
• R1.2.c Add repair hints with guardrails. Hints may propose syntax/contract/capability changes but never silently broaden policy or suppress an obligation. Capability broadening is a separately reviewable policy diff. done 2026-07-11; evidence: scripts/check_cli_diagnostics_contract.sh; input: guarded-repair-hints-bundle-sha256:19a1c623a02cfae36bf4d87f6857128b86a9973460830d37a349c464eda60d52 Evidence 2026-07-11: reviewed catalog policy now fixes genesis/diagnostic-repair-guardrails-v0.1 with no prompt authority, forbidden obligation suppression, catalog-only automatic eligibility, and policy broadening only through a separate reviewed diff. The recursively closed GC_DIAGNOSTIC_REPAIR_PLAN_v0.1 schema distinguishes inspection, verification commands, source patches, effectful commands, and policy review; every action binds diagnostic/content/policy preconditions, original-command retry and obligation-preservation postconditions, explicit policy and obligation effects, automation eligibility, and review state. The generator enriches all 125 cataloged diagnostics from 20 lifecycle phases: source patches, effectful reruns, and policy changes require review; policy actions are never automation-eligible; obligation-sensitive repairs require reruns; no action can suppress verification. Runtime diagnostics preserve compatibility strings while adding a catalog-bound repair plan whose authorization always denies policy changes and obligation suppression. A concrete capability denial emits only a genesis/capability-policy-diff-v0.1 proposal with requires_review = true, auto_apply = false, and an intentionally unresolved base-policy identity; code-derived placeholder capabilities cannot produce proposals. run now emits typed caps/denied failures carrying the exact blocked operation instead of degrading to error/unknown. Fifteen catalog mutation controls reject prompt authority, automatic broadening, obligation suppression, review bypass, stale sources, and malformed metadata; schema closure checks reject mutable authorization or applicable policy diffs. Fifty-two driver unit tests, the all-command-family matrix, and the nine-domain matrix cover automatic-action implications, obligation reruns, concrete and placeholder capabilities, policy proposal non-applicability, concise human compatibility, and deterministic path safety. The read-only diagnostics gate passes in 14.033 seconds against its 300-second budget.
• R1.2.d Build diagnostic goldens. Cover malformed syntax, type/effect mismatch, unhandled effects, seal misuse, replay tampering, path normalization, exhausted budgets, invalid packages, stale patches, and incompatible profiles. done 2026-07-11; evidence: scripts/check_cli_diagnostics_contract.sh; input: diagnostic-goldens-bundle-sha256:cd20894adc89f2b19e951f68444a4b9f2ceb721b4e86e1f5ce7a6184fba0180d Evidence 2026-07-11: tests/diagnostics/goldens/v0.1/diagnostics.json freezes ten uniquely sorted, one-per-class production failure projections under genesis/diagnostic-goldens-v0.1; every projection binds the exact catalog identity, diagnostic/error route, command or generic envelope kind, closed failure context, phase, spans, parameters, causes, documentation, and guarded repair plan. The executable Rust harness constructs all fixtures under an unpredictable absolute root and reproduces malformed CoreForm, a strict open effect-row mismatch, an allowed but unknown effect operation, a non-token seal argument, a tampered replay decision/capability fact, an absolute manifest path, hard kernel step exhaustion, an unsupported package schema, a stale semantic node identity, and an incompatible runtime backend profile. Full agent-consumed projections must contain no fixture root; absolute paths retain only safe basenames, preserving actionable deterministic material. Runtime probing corrected two success fallthroughs: sealed protocol ERROR results from eval now emit typed evaluator failures, and allowed-but-unhandled runner operations now emit typed policy failures instead of ok = true; replay applies the same sealed-ERROR boundary; caps denials remain distinct. scripts/lib/gc_diagnostic_goldens.py independently enforces exact class/code/domain/kind routes, one diagnostic per case, sorted uniqueness, closed outer shapes, catalog IDs, immutable repair authorization, and zero host-path leaks, while ten negative controls reject missing/duplicate coverage, reordering, success fallthrough, absent context, policy broadening, obligation suppression, and path leakage. The updater is a separate exact-opt-in command; normal checks are read-only. Fifty-two driver tests and both golden tests pass, and the diagnostics front door now runs catalog/schema checks plus the command-family, nine-domain, and ten-golden matrices in 9.679 seconds against its 300-second budget.
• R1.2.e Measure repair utility. Run deterministic mutation families plus pinned reference agents; report exact recovery, over-repair, policy broadening, regression, and token cost. done 2026-07-11; evidence: scripts/check_cli_diagnostics_contract.sh; input: diagnostic-repair-utility-bundle-sha256:8833cd125f585fc5a397be592a7e5e84ba1553f7f3a8cfe87716190db1926e14 Evidence 2026-07-11: reviewed policies/gc_repair_utility_v0.1.json, a closed Draft 2020-12 report schema, and an 18-case sorted corpus freeze six mutation families: missing and extra delimiters, integer literal type errors, primitive-name edits, unsupported package schemas, and deny-by-default capability policy cases. Fifteen cases are automatically repairable and three require safe abstention; every family has three variants. The hidden exact-source oracle remains in the runner only. The two source-hashed pinned agents run as isolated Python stdio programs with deterministic decoding, null seeds, no filesystem/network/subprocess imports, no case IDs, and no expected fields: the baseline receives only the human message, while the primary receives the complete structured diagnostic and authorization. Every hash-preconditioned patch is confined to declared mutable source or manifest bytes; policy files are immutable. Exact recovery requires expected bytes, the original production CLI command to succeed, and an independent replay to return the identical structured result within two turns. Exact UTF-8 byte-token accounting covers canonical request and response JSON. The retained report records all attempts, failure codes, file identities, outcomes, model/runtime/context/decoding metadata, and cost. Across two byte-identical production runs the catalog-guided agent recovered 15/15 automatic cases (10000 basis points, exceeding AB-6’s 8500 M1 threshold) and safely abstained on 3/3 reviewed cases, versus 6/15 recovery for the human-message baseline: nine additional exact recoveries and a 6000-basis-point lift at 41,865 exact byte tokens. Over-repair, policy broadening, regression, and initial diagnostic mismatch are all zero. The independent verifier recomputes every identity, route, hash, attempt bound, rate, token total, comparison, and acceptance decision; it enforces oracle isolation and rejects 15 corpus/report attacks. The diagnostics front door reproduces the report twice and compares exact bytes in read-only mode; intentional refresh is a separate producer. This deterministic evidence establishes current API utility without claiming the later held-out multi-model corpus result.
• R1.2.f Make human diagnostics independently useful. Render every stable structured diagnostic as a concise message that includes the failed operation, safe normalized subject, primary cause, and one next action without requiring --json. Generate human text from the catalog/context rather than maintaining parallel prose, preserve redaction and deterministic ordering, and test terse terminals, color/no-color, narrow widths, nested causes, and unknown-safe fallback. done 2026-07-14; evidence: scripts/check_cli_diagnostics_contract.sh; input: human-diagnostic-rendering-bundle-sha256:c05c0b1d7fa7c3937b2719301901866d66352e89b60ada9757e2343a013bd64c Evidence 2026-07-14: both production CLI profiles now render pre-dispatch and command-result non-JSON failures from the same catalog-bound diagnostic object used by JSON mode. Every rendering contains the exact diagnostic code, failed normalized operation, one safe subject, one primary cause, and exactly one catalog-authorized next action; fixed-priority traversal handles nested cause/legacy objects without turning prose into a routing contract. Absolute paths collapse to basenames, control characters become spaces, fields are bounded, and absent or uncataloged facts fail closed to explicit unknown/catalog-miss output. Deterministic wrapping clamps COLUMNS to 24-160 columns with a 96-column default. ANSI affects labels only, activates for terminals or CLICOLOR_FORCE, and is always disabled by NO_COLOR; stripping ANSI reproduces plain output exactly. Eleven focused renderer controls and three production-binary tests cover nested causes, path and terminal-control injection, unknown codes, terse/narrow output, forced color, no-color precedence, command-result routing, and stderr-only behavior. JSON and MCP protocol surfaces remain unchanged.

R1.3 Warm daemon and generated MCP interface

• R1.3.a Harden the existing warm protocol. Version framing, request IDs, cancellation, deadlines, bounded queues, per-workspace isolation, graceful restart, crash recovery, idle eviction, and protocol-level typed errors. done 2026-07-11; evidence: scripts/check_warm_protocol_contract.sh; input: warm-protocol-bundle-sha256:6dc3459c77f4f981cb100dd2584d5e75fb33aebc7a0ab2f545a8ae704104a304 Evidence 2026-07-11: genesis/warm-protocol-v0.2 is a closed newline-delimited JSON protocol with six exact methods, mandatory per-generation initialization, bounded ASCII request IDs, duplicate rejection, immediate execute admission plus exactly one terminal response, and sequence-ordered genesis/warm-response-v0.2 envelopes carrying closed genesis/warm-protocol-error-v0.2 failures. The recursively closed Draft 2020-12 schema and independent standard-library verifier bind protocol, response, error, and final session identities; exact method and bound sets; 19 mandatory failure routes; source capabilities; normative documentation; and seven public integration controls. Five schema mutations reject identity drift, open response objects, missing metadata, unbounded argv, and undeclared methods. Transport allocation is bounded before UTF-8 and JSON decoding, oversized frames are drained without desynchronizing the next frame, and malformed, oversized, and invalid-UTF-8 frames consume the same finite session budget as accepted frames. Queue depth, reader capacity, workspace count, frame bytes, argv cardinality/entry bytes, deadline, frame count, and idle lifetime are finite and initialization reports the negotiated limits. Workspace IDs bind once to canonical base-relative roots; parent, absolute, symlink, and rebinding escapes fail closed; active workspaces cannot be evicted; serialized dispatch prevents current-directory overlap; and restoration failure becomes a typed worker error. Native control remains responsive while one worker executes. Queued cancellation removes work; running cancellation and deadlines suppress late results; initialization explicitly advertises hard_termination = false and running_cancellation = cooperative-result-suppression, preserving R1.3.b as the kill-and-reap authority rather than overclaiming it here. Idle-only restart advances the generation and requires renegotiation; contained worker panic emits a typed crash, discards uncertain queued work, clears workspace/ID state, and requires reinitialization; shutdown and EOF drain accepted work. Five white-box parser, panic-boundary, eviction, and crash-reset tests plus seven shipped-binary tests prove cold/warm semantic parity, two-workspace isolation, strict framing, oversized recovery, path/rebind rejection, nested-command denial, finite malformed admission, queue backpressure, queued/running cancellation, deadlines, and restart negotiation. The dedicated governed gate passes in 21.97 seconds; all 125 checks remain read-only compliant; no-user-panic covers 332 production files; the lifecycle scheduler is decomposed to 690 counted lines under the 700-line no-new-debt target; source/test budgets, gate manifest, engineering contract, planning freshness, and all documentation gates pass. The full green front door passes in 176.53 seconds; changed-impact conservatively covers all 18 crates and 125 gates, its selected full suite completes in 75.91 seconds under the 120-second budget, network remains denied, and generated disk delta is 34.6 MB against the 1 GB allowance.
• R1.3.b Make cancellation real. Killing a timed-out host/process/bridge operation must terminate and reap the child or isolate it in a killable worker. Add repeated-hang stress tests and prove no worker/thread leak. done 2026-07-11; evidence: scripts/check_host_bridge_fault_injection.sh; input: hard-cancellation-bundle-sha256:77c8248ddc73c009077f31b41ba90a4a96a9c16ba948897aaf911aa388a6a2ef Evidence 2026-07-11: timed spawn-per-operation and persistent-stdio host bridges now start in fresh Unix process groups, enforce the deadline across process execution and pipe I/O, kill the complete group on expiry, synchronously reap the child, and join every bridge-owned I/O pump or persistent worker before returning a typed timeout. A timed-out persistent session is evicted, and the uncertain request is never retried; the next request starts a fresh session. Platforms without a supported process-tree primitive reject timeout_ms with a deterministic bridge-policy error before spawning instead of claiming cooperative cancellation as hard cancellation. The governed fault-injection gate executes 48 repeated hangs across both transports: 32 spawn-per-operation cases at 25 ms and 16 persistent cases at 200 ms. Fixtures record leader and descendant PIDs; tests prove every observed process is dead, child/worker join counters advance, active I/O pumps return to zero, stress completes within its isolated bound, and healthy requests succeed afterward. The same gate retains deterministic replay fault coverage for filesystem, network, process, and plugin bridges. It passes in 14.25 seconds with zero failures and no retained report mutation; the complete nine-test host-bridge unit group passes in normal parallel execution in 3.62 seconds. No-user-panic, source/test size, source decomposition, documentation, check/update-boundary, and the 125-entry gate manifest checks pass. The exact final source tree passes the full green front door in 190.03 seconds; its conservative 811-file fallback covers all 18 crates and all 125 gates in 85.90 seconds under the 120-second changed-impact budget, with zero network attempts and no generated-disk growth.
• R1.3.c Generate a pinned MCP interface from CLI schemas. Implement the MCP 2025-11-25 profile over stdio first, including lifecycle, version/capability negotiation, cancellation, progress, errors, roots, resources, and tools. Expose parse, format, check, run, test, explain, search-symbol, get-card, diff, apply-patch, verify, replay, package, build, and the transactional session lifecycle without hand-maintaining a second semantic API. MCP Tasks remain an experimental, explicitly negotiated extension mapped onto Genesis durable-job semantics; core interoperability cannot depend on them. done 2026-07-14; evidence: scripts/check_warm_protocol_contract.sh and scripts/check_cli_diagnostics_contract.sh; input: mcp-interface-bundle-sha256:009249478ef3d2ae188ecb653a7ab54318f922735352d84d4c3ac47d80963388 Evidence 2026-07-14: genesis mcp implements the pinned MCP 2025-11-25 lifecycle over bounded newline-delimited JSON-RPC 2.0 stdio with protocol/capability negotiation, stdout purity, finite input/output/session/root/queue limits, strictly increasing progress, queued cancellation and active-result suppression, typed transport errors, and native plus sequential WASI execution. Client roots are requested only after initialization, accepted only as bounded canonical local file:// directories beneath the configured boundary, and selected by exact negotiated URI; non-file, parent, absolute-argument, symlink, duplicate, inaccessible, unadvertised, and multi-root ambiguity cases fail closed. A reviewed exposure table selects 20 canonical CLI routes, including six transaction lifecycle tools, while names, descriptions, required/default/enum/type schemas, parent-option placement, boolean polarity, positional order, and argv spellings are derived and startup-validated against Clap; calls re-enter normal CLI dispatch, so no private semantic API exists. Canonical parse, bounded symbol search, exact generated card retrieval, and generated transaction begin/status execution complete the required authority surface. Seven genesis:// resources expose the generated CLI/MCP profiles and frozen agent authorities. Every core tool declares taskSupport = forbidden; Tasks are unadvertised and task methods/augmented calls are rejected until a future explicitly negotiated extension maps them to durable Genesis jobs. Six white-box controls and four shipped-binary tests cover catalog drift, resource parsing, root escape, cancellation state, lifecycle, output purity, malformed/oversized frames, output truncation, task rejection, negotiated parse and transaction execution, and progress ordering. The MCP session remains decomposed below the 700-line ratchet. The governed warm/MCP gate, 179-code diagnostics/golden/repair gate, panic policy, selfhost dashboard, source decomposition, check/update contracts, and gate manifest pass locally; generated diagnostic, profile, card, symbol, golden, and repair identities are fresh and deterministic.
• R1.3.d Add transactional sessions. Agents operate on content-addressed workspace snapshots; writes produce semantic patches, tests run against the snapshot, and commit/apply is explicit. done 2026-07-14; evidence: scripts/check_warm_protocol_contract.sh, scripts/check_agent_authoring_bundle.sh, scripts/check_cli_diagnostics_contract.sh, and scripts/check_write_genesiscode_skill_conformance.sh; input: transactional-agent-session-bundle-sha256:c0d40938b12d5a930ceb9e9c0f302268ef3232a9a76e1163e2ee21a9e55ff709 Evidence 2026-07-14: the closed genesis/agent-transaction-v0.1 and genesis/workspace-snapshot-v0.1 contracts define an open/applied/aborted lifecycle, ordered semantic-patch chain, exact-snapshot verification, sorted base-relative file manifest, and bounded content records. session begin recursively captures the package manifest, modules, declared capability policy, and local dependency closure as domain-separated BLAKE3 blobs and a snapshot identity; 4096-file and 256 MiB admission limits, regular-file and no-symlink-component checks, root confinement, canonical UTF-8 path material, object rehashing on reuse and before live writes, and chain validation fail closed. session stage materializes a fresh candidate, accepts only canonical Genesis semantic patches, applies through the existing patch engine, reruns obligations there, records patch/before/after/acceptance identities, and activates no partially failed candidate. session test rejects workspace tampering before binding obligation evidence to the exact current snapshot. session apply acquires a package-local lock, requires successful current-snapshot verification, rehashes both isolated and live trees, rejects stale live inputs, writes only managed files, verifies the result, and proves rollback to the base on write, post-write verification, or state-commit failure; session abort closes without live mutation. State and protocol results expose no absolute host paths. Twenty generated MCP tools now include all six lifecycle operations and prove begin/status execution through the normal CLI route. Six shipped transaction tests prove isolated staging, exact-snapshot testing, explicit apply, stale-base preservation, unverified, workspace-tampered, state-chain-tampered, and coherently content-addressed path-forgery rejection, absolute-path redaction, and lock reaping; four schema mutations reject open state, lifecycle broadening, missing verification, and unbounded snapshots. The 179-code diagnostic catalog includes every session code, and the generated patch card plus authoring skill mandate transaction use and hard-stop on integrity failure without direct-edit or policy-broadening fallback.
• R1.3.e Bound and observe sessions. Enforce CPU, wall, steps, heap, output, effects, processes, and disk. Emit provenance and an audit summary without collecting mandatory remote telemetry. On stdin EOF or client disconnect, stop admission, drain an explicitly bounded set of already accepted responses when transport permits, cancel and reap the rest, and report deterministic completion/cancellation provenance so accepted work is never silently dropped. done 2026-07-14; evidence: scripts/check_warm_protocol_contract.sh, scripts/check_no_user_panics.sh, and scripts/check_cli_diagnostics_contract.sh; input: agent-session-resources-bundle-sha256:26ceb2214bbaff7c710ce851158d8757ec83847d757a7e233739d0d43ee55654 Evidence 2026-07-14: warm and MCP sessions require finite wall, CPU, semantic-step, heap, combined-output, effect, process, workspace-disk-growth, bounded-drain-count, and drain-time limits whose canonical BLAKE3 identity is returned during initialization and in every terminal genesis/agent-session-audit-v0.1. Native macOS/Linux execution isolates each accepted command in a fresh worker process, applies kernel CPU/address-space/file-size ceilings where supported, samples the complete recursive process tree for aggregate CPU, resident memory, and process count even when host bridges create separate process groups, meters workspace growth without following symlinks, and kills then reaps the worker on cancellation or any hard resource breach. Unsupported native platforms fail closed before accepting work rather than claiming hard isolation; WASI-inline execution reports its exact enforcement profile. Request argv cannot weaken session ceilings, and effect dispatch uses a thread-local minimum of policy and session limits without cross-session leakage. Output is drained through one bounded channel so stdout/stderr cannot deadlock after overflow. EOF, disconnect, shutdown, deadline, queued cancellation, active cancellation, crash recovery, and oversized-frame fallback all stop admission, drain only the negotiated finite set, terminalize every accepted ID, and attach deterministic completion, cancellation, resource-exceeded, or not-started provenance without mandatory telemetry. The recursively closed session-resource and warm-protocol schemas, independent standard-library contract verifier, 13 schema/source negative controls, five warm unit tests, six MCP unit tests, 11 shipped warm tests, five shipped MCP tests, and six transaction tests prove all eight resource dimensions, descendant escape resistance, repeated hard termination, bounded EOF drain, exact audit propagation, override rejection, and zero silent drops. Strict Clippy, panic policy over 354 production files, source/test/decomposition budgets with a 690-line observed module ceiling, 185-code diagnostic catalog with deterministic replay and perfect 18-case repair utility, all 169 Quarto pages, planning freshness, documentation topology, and the 124-entry governed gate manifest pass on the exact source tree.
• R1.3.f Meet AB-3 and AB-4. Benchmark cold, warm, cache-hit, cache-miss, 100-module, 10k-module, parallel-agent, cancellation, and daemon-restart cases.

R1.4 Training and evaluation corpus

• R1.4.a Publish a corpus manifest. Version source provenance, license, generator identity, language profile, capability requirements, expected hashes, tests, difficulty, and intended train/dev/public-test/held-out role. done 2026-07-14; evidence: scripts/check_agent_authoring_bundle.sh and crates/gc_cli/tests/cli_agent_index.rs; input: gc-agent-corpus-bundle-sha256:8c4783aeaa8dd5794560c88613f19fb48c735d941c1b37b655e11aa30f5df917 Evidence 2026-07-14, refreshed 2026-07-16: the recursively closed GC_AGENT_CORPUS_v0.1 schema and content-addressed manifest publish eleven uniquely sorted corpus entries across train, development, and public-test roles. One hundred ninety artifacts totaling 1,166,457 exact context bytes bind repository origin, per-file SHA-256, Apache-2.0/MIT policy, authored or deterministic generator identity, frozen GC-AGENT-v0.3 profile identity, minimum capability operations, sealed executable test argv, four-level difficulty plus concept dimensions, and public versus commitment-only oracle exposure. The split contract reserves held-out as non-distributable and requires oracle separation; the validator now also forbids any distributed held-out entry and delegates only public commitments to R1.4.d’s separate authority. The read-only validator rejects duplicate keys; unknown fields; host, parent, symlink, and escaped paths; stale profile/artifact/generator hashes; license or provenance rebinding; split broadening; held-out oracle leakage; prompt-selected profiles; shell test injection; context drift; duplicate assignment; and identity drift. Thirteen permanent mutation controls pass. The existing authoring-bundle gate owns validation without adding a governance entrypoint, the bounded llms.txt and documentation indexes expose the authority, and production agent-index publishes its exact path; all ten shipped-binary index tests pass.
• R1.4.b Build canonical language examples. Include pure functions, persistent collections, contracts, modules, sealed errors, effects, replay, packages, patches, tests, and resource failures. Pair valid examples with minimal invalid counterexamples. done 2026-07-15; evidence: scripts/check_agent_authoring_bundle.sh and crates/gc_cli/tests/cli_canonical_language_examples.rs; input: gc-canonical-examples-bundle-sha256:9c097f95002d9ab9572b6a893bc305dd9330e03083a6677b35c30ba30693b0d5 Evidence 2026-07-15: GC-CANONICAL-EXAMPLES-v0.1 publishes exactly one valid/invalid pair for each of the eleven required concepts. The recursively closed suite binds all 44 fixture files, while the corpus binds the schema, lesson, suite, and fixtures as 47 teaching artifacts totaling 47,013 context bytes. Together they bind GC-AGENT-v0.3, per-file SHA-256 values, a complete-tree rule, explicit capabilities, production-only JSON argv, exact stable-envelope assertions, typed rejection classes, and one deterministic replace-once repair. The read-only validator rejects duplicate keys; unknown fields; missing, duplicate, host, parent, symlink, or escaped paths; stale hashes and profile identities; incomplete concept or file coverage; undeclared pair drift; unsafe frontend, engine, budget, artifact, or shell arguments; weakened assertions; accepted invalid cases; and suite-identity drift. All fourteen permanent mutation controls pass. The Rust integration test copies every scenario into an isolated workspace, injects only the repository-pinned selfhost artifact, executes all 22 cases through the shipped genesis binary, verifies exit code, ok, kind, exact JSON-pointer facts, and failure-path privacy, and passes in 44.79 seconds. The eleven-entry corpus, bounded agent index, onboarding spine, authoring bundle, and 100/100 write-skill contract expose the signed pairs without duplicating semantic authority.
• R1.4.c Build task benchmarks. Cover generation, completion, repair, refactor, policy minimization, replay investigation, performance repair, package migration, and deployment across increasing context sizes. done 2026-07-15; evidence: scripts/check_agent_authoring_bundle.sh and crates/gc_cli/tests/cli_agent_task_benchmarks.rs; input: gc-agent-task-benchmark-bundle-sha256:ed98f729a379239fa4a07c92b905ae5072450cee77595a19b12038dc4fe8189d Evidence 2026-07-15: GC-AGENT-TASK-BENCHMARK-v0.1 freezes a complete 9-by-3 public development matrix: generation, completion, repair, refactor, policy minimization, replay investigation, performance repair, package migration, and deployment each run under nested context packs of 3,916, 34,293, and 276,035 authority bytes, producing exact per-case context measurements between 4,045 and 277,260 bytes. The recursively closed Draft 2020-12 schema and 27-case content-addressed manifest bind GC-AGENT-v0.3, every input and reference byte, exact editable and changed paths, public-oracle labeling, production-only JSON argv, exit/kind/semantic assertions, and a complete-tree rule over forty corpus artifacts. The read-only validator rejects unknown fields; stale profile, file, and suite identities; host paths; task or tier omission; prompt-selected authority; policy, resource, shell, or editable-surface broadening; oracle relabeling; context drift; and reference tampering through fourteen permanent mutation controls. The shipped-binary integration test executes each unique reference in an isolated workspace through the repository-pinned selfhost artifact, verifies the full matrix and strictly increasing contexts, and additionally proves semantic-preserving refactor, finite-budget performance repair, schema-2 package rejection before migration, exact minimal filesystem authority, deterministic replay rejection plus safe diagnosis, and service packaging/build output. The eleven-entry corpus exposes the benchmark as public-test material, while the benchmark and roadmap explicitly reserve held-out protection, aggregate model-agnostic scoring, and run-record reproducibility for R1.4.d-f rather than overclaiming them.
• R1.4.d Protect held-out evaluation. Keep test inputs or oracle details outside distributed training packs, publish hashes and later disclosure rules, rotate compromised sets, and label any contaminated model result. done 2026-07-15; evidence: scripts/check_agent_authoring_bundle.sh and crates/gc_cli/tests/cli_agent_index.rs; input: gc-agent-held-out-evaluation-bundle-sha256:0dccf9375e5c92f28ba07b4f3b4f830462ef6a6fa9760b1492a63e94c6236bfc Evidence 2026-07-15: GC-AGENT-HELD-OUT-v0.1 publishes one active nine-case epoch with complete task-class coverage, 32-byte secret salts, domain-separated SHA-256 commitments, an exact commitment-snapshot identity, and no case payloads, prompts, inputs, salts, or oracles. The private custody pack is mode 0600 under ignored .genesis/private/agent-evaluation, and the local verifier opens all nine commitments without making private material a CI input. The closed public and private-shape schemas define append-only epochs, exactly one active epoch, mandatory non-self replacement after retirement or compromise, retained historical commitments, a computed 30-day scheduled-disclosure delay, and disclosure files whose salt and canonical payload must open the original public commitment. Contamination defaults to unknown when training provenance is incomplete, disclosed or leaked cases require declared-contaminated, and mixed-epoch aggregation is forbidden. The authoring gate rejects tracked private custody material and runs seventeen permanent mutation controls covering weak salts, raw hashes, distribution/training leakage, mutable history, missing replacement, early or active disclosure, unsafe contamination defaults, mixed epochs, task omission, oracle leakage, commitment reuse, and identity drift. The corpus validator independently forbids distributed held-out entries, the shipped agent index exposes only the public ledger, and the canonical authoring bundle records the threat model and rotation/disclosure procedure without growing the documentation topology. This task claims evaluation protection and precommitment only; deterministic scoring and full model-run records remain R1.4.e and R1.4.f.
• R1.4.e Make scoring model-agnostic. Deterministic tests score semantics, obligations, effects, patch minimality, resource use, and policy scope. Model-specific latency/cost is a separate dimension. done 2026-07-15; evidence: scripts/check_agent_authoring_bundle.sh and crates/gc_cli/tests/cli_agent_benchmark_scoring.rs; input: gc-agent-benchmark-scoring-bundle-sha256:e25788308b596fef6a235324eed15194a5749579c6ace8dbec1b3572d1625e01 Evidence 2026-07-15: GC-AGENT-BENCHMARK-SCORING-v0.1 defines a recursively closed, content-addressed 10,000-basis-point authority over semantics, obligations, effects, patch minimality, deterministic resource use, and policy scope for all nine public task classes. Applicability-aware weighting excludes absent obligation/effect dimensions, while semantic, applicable-obligation, policy-scope, and editable-scope validity gates fail the aggregate to zero. Candidate and reference executions use separate isolated workspaces, ordered verification steps, a fixed evaluator budget, bounded files and output, deny-by-default environments, no shell, hard process-group timeout kill/reap, declared generated-output prefixes, semantic TOML authority comparison, reference-normalized changed-span and resource units, and canonical host-path-free score identities. Runtime, contract, integration-test, benchmark, profile, scoring, candidate, output, artifact, policy, and result identities close provenance. Thirty mutation and arithmetic controls reject unknown fields, authority rebinding, weakened validity, wall-time or model-cost inclusion, unsafe paths, exact-file prefix broadening, task/step drift, and identity drift. The shipped-binary integration test scores every public reference archetype exactly 10,000, proves byte-identical repeat scoring, and independently rejects or penalizes semantic corruption, capability broadening, editable-scope escape, resource inflation, and both file and candidate-root symlinks. Model latency, API cost, energy, and provider queue time remain explicit genesis/agent-benchmark-run-v0.1 facts outside quality and are reserved for R1.4.f’s reproducible run record.
• R1.4.f Add benchmark reproducibility. Record model/runtime, prompt/card hashes, decoding, retries, tool protocol, host, and every candidate artifact. Permit fully local model runners through explicit effects. done 2026-07-15; evidence: scripts/check_agent_authoring_bundle.sh and crates/gc_cli/tests/cli_agent_benchmark_run.rs; input: gc-agent-benchmark-run-bundle-sha256:c300e478cd1a4ac67487ab8e41ea12c362929290fe5695a1d112e246a500a474 Evidence 2026-07-15: GC_AGENT_BENCHMARK_RUN_v0.1 is a recursively closed, content-addressed record for the exact benchmark/case authority, immutable model ID and revision, weights, tokenizer, runtime executable and version, secret policy, ordered prompt/card/context assembly, integer-only decoding and retry controls, every contiguous attempt, selected response, tool protocol, normalized host/environment/privacy facts, complete candidate tree, canonical model-agnostic score, separately non-quality model metrics, and a complete repository/bundle artifact inventory. The read-only validator rejects execution or update inputs, duplicate JSON keys, unknown fields, stale identities, incomplete inventories, unsafe or symlink paths, mutable model aliases, prompt-selected authority, policy/operation/network broadening, host or held-out leakage, attempt gaps, candidate rebinding, score tampering, model-metric quality influence, and model-effect authority broadening through thirty-five permanent controls. genesis.agent-model-runner.v0.1 provides the explicit local benchmark integration through digest-pinned, command/plugin-allowlisted, byte-bounded, hard-timeout host/plugin::command; request, response, transcript, and .gclog are retained, while replay succeeds byte-for-byte after deleting both the bridge and model weights without reinvocation. The shipped-binary integration test independently proves exact record validation and scoring across different absolute artifact roots, explicit capability denial, candidate tamper rejection, symlink rejection, and replay. Scorer resource identities now use normalized canonical JSON rather than presentation bytes, remove the scorer-selected selfhost authority path, disable ambient selfhost caches, and retain raw bounded accounting for malformed output, making quality records cross-root reproducible without weakening semantic assertions. The canonical example, agent index, authoring/onboarding/skill guidance, Quarto/LLM references, and an eleven-entry, 190-artifact public corpus expose the contract. This benchmark-only local effect profile does not claim the dedicated standard model API reserved for R5.4.e.
• R1.4.g Publish the GenesisBench protocol. Define a versioned, self-hostable benchmark profile that freezes the repository/runtime/docs snapshot, allowed context assembly, tool surface, capability policy, attempt policy, model disclosure, task visibility, scoring authority, contamination label, and ranked/unranked eligibility. A run may claim only the strongest label its evidence proves; unknown training provenance defaults to unknown, and judge-model preference never contributes to the deterministic quality score. done 2026-07-15; evidence: scripts/check_agent_authoring_bundle.sh, crates/gc_cli/tests/cli_agent_index.rs, and crates/gc_cli/tests/cli_agent_benchmark_run.rs; input: genesisbench-protocol-bundle-sha256:5024d7ef7e9da3698f7e9cf4b3c775c2d449575636b5713240e2d4e43ae000dd Evidence 2026-07-15, refreshed during R1.4.o on 2026-07-17: GenesisBench-v0.1 is a recursively closed, content-addressed, offline profile with identity d6d3c97394d54bdcbe280748c738fac3f023e1934622fba6b3ba66c05f8e8cc2. It freezes implementation commit 861a28957f03fb32d359fb6309ca828e5ed281a0, tree e58c48aac51026af4895265fa7736ac167ab8ca4, and all 1,775 source artifacts through complete SHA-256 manifest 1475632bbfefc77287e4e0de9482e21830b9389aec5c1480914ec2b59b7cf8c0; Git SHA-1 remains transport identity only. Eighty-two independently hashed authorities close protocol, task, context, MCP, capability, attempt, model, contamination, track/cohort, temporal custody, adapter, run/bundle, scoring/statistics, construct-validity, signed-registry, shipped-test, and documentation contracts. Four context modes, two interaction modes, the exact generated 20-route MCP surface, deny-by-default capabilities, one-attempt ranked admission, immutable model disclosure, four visibility classes, deterministic 10,000-basis-point quality, and decision-specific invalid/unranked/ranked reasons are machine checked. The public conformance run remains truthfully unranked at eligibility identity 01aa29393b850e3f87d5edec9a59298eb80e8e52986399ba56a03d0b5d8fc5bb in cohort genesisbench-cohort-v0.1/a73bfac921e776a2a0789274e9bd26b44fdbdbdbe18bc64ea650dd40ad332f8a; public exposure, incomplete training provenance, conformance-fixture identity, practice visibility, and lack of an admission-time independent rescore cannot be hidden. One hundred six protocol controls reject authority, context, run, contamination, chronology, custody, reason-class, false-ranking, track/scaffold/hardware/adaptation/cohort, and orchestration drift. The eleven-entry corpus binds 190 artifacts and 1,193,876 exact context bytes at identity 33e18cd2944ca23b1fbb43a22922eda578ec6e26ab5291476fa7cd54b238ae41; the generated agent index, Quarto reference/tutorial, authoring gate, front-door tests, signed-registry tests, and construct-validity tests expose and execute the protocol. Task lineage scale, the fixed reference scaffold, canonical adapters, signed registry, and construct validity are closed by R1.4.i-n; multi-model baselines remain R1.4.o.
• R1.4.h Freeze four non-combinable benchmark tracks. Define cold-acquisition as the headline model-comparison track with no GenesisCode-specific training and one fixed reference scaffold; open-agent permits arbitrary disclosed retrieval/orchestration under the same external authority and resource ceilings; genesis-adapted permits only declared, lineage-audited public adaptation material; embedded-local requires offline inference and versioned hardware classes, initially S/M/L at <=4/16/64 GiB combined model/runtime resident footprint. Track, scaffold, profile, epoch, context/tool condition, attempt policy, and hardware class are cohort keys. A raw model, a scaffolded system, an adapted specialist, and a local appliance never share one rank or aggregate. done 2026-07-15; evidence: scripts/check_agent_authoring_bundle.sh, crates/gc_cli/tests/cli_agent_index.rs, and crates/gc_cli/tests/cli_agent_benchmark_run.rs; input: genesisbench-protocol-bundle-sha256:5024d7ef7e9da3698f7e9cf4b3c775c2d449575636b5713240e2d4e43ae000dd Evidence 2026-07-15, refreshed after R1.4.k: scripts/lib/genesisbench_tracks.py is the single normative authority for four closed tracks, shared authority/resource ceilings, non-comparability, scaffold disclosure, Embedded Local class assignment, and cohort construction. cold-acquisition admits only none Genesis-specific training and the exact content-addressed genesisbench-reference-agent-v0.1; ranked admission is open only for that fixed scaffold. open-agent permits disclosed custom orchestration but downgrades unknown training provenance; genesis-adapted requires a run-inventoried public lineage manifest that is recursively closed, license-audited, lineage-audited, material-addressed, and content-addressed; embedded-local requires a local provider, network denial, and an inventoried measurement record whose model plus runtime bytes equal the claimed combined peak or enforced ceiling. S/M/L membership is deterministically the smallest fitting <=4/16/64 GiB class; missing evidence is unranked, while false class or offline claims are invalid. Every run carries a closed track record and a scaffold identity bound to an inventoried manifest covering system prompt, prompt algorithm, retrieval algorithm/config, agent/subagent topology, planner, repair loop, stop policy, tool catalog/operations, and non-broadenable authority/resource ceilings. Every eligibility result carries a separately content-addressed cohort binding track, scaffold, language profile artifact, task epoch, context, interaction/tool mode, attempt-policy identity, hardware class, protocol, visibility, and contamination; rankingCohort is that hash and cross-track aggregation is forbidden. The canonical fixture truthfully remains open-agent, single-agent, no retrieval, unknown-training, no hardware claim, and unranked. Schema-instance validation passes for profile/run/attestation/eligibility, all GenesisBench schemas pass Draft 2020-12 meta-validation, and permanent semantic controls reject re-signed policy drift, scaffold rebinding, hidden subagents, networked-local, false class/accounting, absent adaptation lineage, and cohort tampering.
• R1.4.i Make task lineage and statistical independence first-class. Give every task family an immutable lineage ID and every context, tool, repair, scaffold, and mutation condition a child condition ID. Reclassify the current 27 public cases truthfully as nine independent lineages times three context conditions; calculate solve rates, confidence intervals, saturation, and significance over lineages or declared hierarchical models, never over repeated conditions. Publish exact denominators, missingness, invalids, abstentions, clustering, multiple-comparison policy, effect sizes, and uncertainty; prohibit pairwise decimal-rank claims unsupported by the predeclared analysis. done 2026-07-15; evidence: scripts/check_agent_authoring_bundle.sh, scripts/lib/genesisbench_analysis.py, crates/gc_cli/tests/cli_agent_task_benchmarks.rs, crates/gc_cli/tests/cli_agent_benchmark_run.rs, and crates/gc_cli/tests/cli_agent_index.rs; input: genesisbench-lineage-analysis-bundle-sha256:2b9d229342a9d58d338c79f20e30bffcf6e1c20e2bcd6d3f78d252d27bd13b20 Evidence 2026-07-15: GC-AGENT-TASK-BENCHMARK-v0.1 now contains nine content-addressed parent lineages and exactly 27 content-addressed child conditions. Every case binds immutable lineage and condition IDs plus both identities; condition identity closes context artifacts and bytes, production tool mode, no-repair policy, public reference scaffold, and mutation state. The benchmark validator proves the exact nine-by-three matrix and rejects lineage promotion, condition rebinding, identity drift, omitted sampling units, and condition/tool mutation through 21 controls. GC_AGENT_BENCHMARK_RUN_v0.1 and every eligibility report carry the same four lineage/condition bindings, while 35 run controls and shipped replay tests reject detachment. GENESISBENCH_ANALYSIS_PLAN_v0.1 predeclares lineageId as the independent unit, one small-context primary condition per lineage, complete explicit outcome cells, Wilson 95% solve intervals, Newcombe-Wilson risk-difference uncertainty, paired exact two-sided McNemar/binomial tests, Holm-Bonferroni familywise correction, and a two-consecutive-ranked-epoch/three-model-family 90% saturation rule. Missing, invalid, abstained, solved, and unsolved cells have exact published counts and all five remain in the solve denominator; conditional quality has its own solved-only denominator. Repeated context summaries remain clustered by lineage, cross-cohort aggregation is forbidden, and unsupported comparisons emit indeterminate. The deterministic public fixture has three model families but remains explicitly unranked and cannot trigger rank or saturation claims. Twenty-four re-signed statistical controls reject pseudoreplication, silent missingness or abstention, invalid-score misuse, incomplete matrices, lineage/condition drift, unsupported ranking, p-value/count tampering, and false saturation. The offline 34-authority GenesisBench profile, production agent index, Quarto tutorial, corpus, consolidated authoring gate, and all 1/1 task-matrix, 3/3 run/replay, and 8/8 agent-index tests expose and execute the contract. This task does not claim the >=45 independent private Preview lineages owned by R1.4.j.
• R1.4.j Build scaled temporal epochs and useful post-release overlays. Reach BQ-11 with >=45 independent held-out lineages for Preview and >=90 for mature release, balanced by class, difficulty, author/generator, domain, and acceptance shape. Precommit private tasks after target model releases, enforce custody separation, reserve BQ-4 fresh weight, rotate on schedule/leakage/saturation, and disclose retired epochs under delayed-opening rules. At least one challenge family per epoch introduces a useful post-release package, protocol, data structure, capability, or semantic-patch operation that remains maintained after ranking weight retires; arbitrary riddles and benchmark-only APIs are ineligible. done 2026-07-15; evidence: scripts/check_agent_authoring_bundle.sh, scripts/lib/gc_held_out_evaluation.py, scripts/lib/gc_capability_lease.py, and crates/gc_cli/tests/cli_agent_index.rs; input: genesisbench-temporal-epochs-bundle-sha256:e4b586f057ddd4d633e3db4e034905325bd6f90cb7153cc76e96beb8f268ce16 Evidence 2026-07-15: GC-AGENT-HELD-OUT-v0.1 preserves the original nine-case pilot commitments byte-for-byte under snapshot 77cfe60ca3959c06badfda1b8ae77b71c4bda2eecb776d4becbcf07cc55fe3cf, retires that pilot only through an explicit replacement edge, and activates content-addressed epoch-2026-07-b with 90 independently salted private lineages under snapshot 99dc0ff2436cd382678720b95fa115936dba4113ad2f092c51b722b72bf62ea3. The active epoch has exactly ten lineages in each of nine core task classes; 30/30/30 foundation, engineering, and frontier weight; ten author/generator identities at nine units each; five generator families at 20% each; and ten domains plus ten acceptance shapes at nine units each. All 90 ranking units are newly precommitted, exceeding BQ-4’s 25% floor, while the machine lifecycle requires replacement on compromise, rotation within 90 days or sooner on leakage/saturation, retained historical commitments, and a 30-day post-retirement delay before scheduled opening. The release boundary is 2026-07-15T18:10:00Z; a result may claim temporal-clean only when its separately bound immutable model release predates that boundary and all existing training, non-exposure, active-undisclosed-epoch, commitment, and custody evidence also passes. No model result is made clean merely by this epoch’s existence. The ignored local mode-0600 pack opens all 90 commitments and binds every private quality contract to its public metadata; tracked audit identity 517df26cf0b8d914fa9f3792f828bc4d453f4b5aa75a75ef30bf310517faf038 publishes only pack/snapshot/verifier hashes and exact opening counts, never prompts, inputs, salts, or oracles, and public CI intentionally cannot inspect private payload quality across the evaluation firewall. GC-CAPABILITY-LEASE-v0.1 is the epoch’s non-benchmark-only maintained overlay: a general exact-scope, finite-use, deny-by-default protocol with explicit logical steps, append-only issue/consume/revoke transitions, and replay-bound state identities that remains active after ranking retirement. Thirty re-signed temporal controls plus seven lease controls reject pilot rewriting, underscale, pseudobalance, author domination, stale or reused commitments, freshness loss, chronology weakening, late rotation, custody leakage, early disclosure, benchmark-only overlays, maintenance retirement, authority drift, ambient time, scope broadening, and replay weakening. The closed 82-authority GenesisBench profile, 126-artifact authoring bundle, generated agent index and Quarto tutorial expose the system; the shipped 9/9 agent-index suite executes both public validators. This completes the scaled Preview and mature-size epoch authority, not the fixed reference scaffold, canonical adapters, registry, construct studies, or baseline runs owned by R1.4.k-o.
• R1.4.k Ship a fixed reference agent and controlled ablations. Version and hash the system prompt, typed prompt assembly, retrieval algorithm, core/task cards, MCP catalog, semantic transaction flow, execution/diagnostic/repair loop, stop policy, budgets, and adapter behavior so the model revision is the only meaningful Cold Acquisition variable. Publish predeclared core-card-only, fixed-context, retrieval, diagnostics, semantic-patch, grammar-constraint, one-attempt, and bounded-repair ablations as separate conditions under the same lineage. Model-specific prompt tricks require a new scaffold cohort; hidden retries, subagents, and provider tools are rejected in this track. done 2026-07-15; evidence: scripts/lib/genesisbench_reference_agent.py, scripts/check_agent_authoring_bundle.sh, and crates/gc_cli/tests/cli_agent_index.rs; input: genesisbench-reference-agent-bundle-sha256:b404c705af26241348c86e9bcca9a575ab4a4a76cf64b4d7e9edc63217fd5cac Evidence 2026-07-15: genesisbench-reference-agent-v0.1 is a frozen, recursively closed, content-addressed scaffold with identity 0015ae228787a36bc698a62b6e5dad6dedb313bfce16b090a3bcd96dc6da48d7. Fourteen exact artifacts bind its system prompt, generated profile/cards/grammar, diagnostics and repair contracts, semantic transaction and resource schemas, retrieval runtime/config, production MCP catalog source, benchmark run schema, and adapter disclosure contract. The only allowed run variable is an immutable model revision; model-specific prompting, subagents, provider tools, ambient authority/network, direct writes, text fallback, semantic adapter rewrites, and hidden retries are forbidden. Prompt assembly has six ordered typed roles; retrieval is offline, integer-only, bounded to one query/four results/128 KiB, uses deterministic lexical weights and path/SHA tie-breaking, and emits a complete content-addressed transcript. Execution uses one finite-state agent, six semantic-session operations, production parser/obligation acceptance, structured diagnostics, at most two model calls and one safe repair, hard compute/resource ceilings, terminal integrity/replay failures, and contiguous complete traces. The ablation authority has identity ca776a9dd6b54d43eea94085c4a33e5fd7435fce54365e6a929a1fb2e93ef693 and freezes eight conditions across the same nine immutable lineage IDs, producing exactly 72 child conditions and six predeclared within-lineage paired contrasts; conditions are explicitly not independent samples. The compiler reads only public case input roots, rejects oracle/private/reference paths, and emits a typed plan fixture with identity e6c4cd3f65bf75b1c6e6196ec7f22a4c49df7b1128ce8ddec2796f04baf0bcc1. The trace schema and canonical trace prove one agent, complete model/retrieval/tool/diagnostic/outcome events, declared attempt/repair budgets, semantic tool allowlists, deterministic verification, no provider tools, no semantic rewrite, and no hidden retry. Draft 2020-12 instance validation passes, 25 permanent mutations reject authority, prompt-order, oracle, budget, tool, adapter, retry, agent-count, sequence, verification, and identity drift, Cold Acquisition admission now accepts only this exact profile, the consolidated authoring gate passes with 126 indexed artifacts, and the shipped CLI test executes the validator and checks all three agent-index pointers. R1.4.l still owns provider/local adapters, canonical execution, and complete run-bundle emission; this task does not claim those front doors.
• R1.4.l Provide one canonical benchmark front door and adapter contract. Implement genesis bench inspect, run, validate-run, score, replay, bundle, and submit over existing authorities rather than duplicating semantics. Define closed, capability-minimal adapters for hosted APIs, local OpenAI-compatible servers, direct local runtimes, command/plugin runners, and a deterministic mock. Adapters normalize requests/responses without semantic rewriting, disclose provider transport and mutable service facts, retain all attempts, redact secrets by policy, cannot acquire ambient tools/network/filesystem authority, and pass identical conformance, timeout, cancellation, and replay suites. done 2026-07-15; evidence: scripts/lib/genesisbench_front_door.py, crates/gc_cli/tests/cli_genesisbench_front_door.rs, and scripts/check_agent_authoring_bundle.sh; input: genesisbench-front-door-profile-sha256:df18ea902400c39c6d145efe6f9886f40baade8950ff89b47131adb2eb5481c6 Evidence 2026-07-15, refreshed 2026-07-17: genesis bench provides the canonical seven-command execution and bundle surface, extended by R1.4.m’s four registry commands, and delegates task construction, reference planning, and quality scoring to their existing content-addressed authorities rather than cloning semantics. The recursively closed adapter profile has identity df18ea902400c39c6d145efe6f9886f40baade8950ff89b47131adb2eb5481c6 and covers hosted HTTPS APIs, loopback OpenAI-compatible servers, digest-bound direct local runtimes, digest-bound command plugins, and a deterministic mock through one request/response contract. Exact origin/path, redirect denial, declared mutable facts, immutable model revisions, digest-bound executables and model artifacts, empty process working directories, sanitized environments, no provider tools, no hidden retries, no semantic rewriting, and rankEligible: false make authority and the registry admission boundary machine-checkable. HTTP work and process adapters execute in isolated process groups with bounded output and hard timeout/cancellation kill-and-reap; all success, error, timeout, and cancellation attempts are retained, while secret values are never serialized and only declared/present names are recorded. Validation reconstructs the exact case, plan, adapter, request, response, inventories, score, and outcome; replay never invokes an adapter or model and independently reproduces every successful score. Bundles use sorted USTAR entries, fixed metadata, gzip mtime=0, no links, complete inventories, and byte-identical repeated output; submission writes SHA-named immutable signed bundle/statement records to a local outbox without network authority. The v0.1 runner truthfully supports only the canonical retrieval scaffold and rejects unsupported ablation names rather than approximating them. Twenty-six permanent controls exercise identical vectors across all five classes and reject capability, redirect, retry, secret, provider-fact, model, response, run, score, and identity drift while proving HTTP/process timeout and cancellation termination. Three shipped-binary integration tests execute all seven front-door commands, delete the command adapter before replay, independently rescore, prove deterministic bundling and immutable signed submission, retain a failed hosted attempt, and reject candidate tampering. The current GenesisBench protocol freezes implementation commit 861a28957f03fb32d359fb6309ca828e5ed281a0, 1,775 source files, 82 authorities, and 106 controls at identity d6d3c97394d54bdcbe280748c738fac3f023e1934622fba6b3ba66c05f8e8cc2.
• R1.4.m Build a signed result registry and lexicographic static leaderboard. Accept only closed run bundles that validate, deterministically and independently rescore, carry submitter provenance, and satisfy the exact track/profile. Rank within one compatible cohort by verified solve rate first, conditional quality among valid solutions second, then capability excess, context/tool efficiency, repair efficiency, and finally separately reported cost/latency; never let invalid partial quality or financial spend outrank a verified solve. Publish per-lineage and per-class results, all validity failures/attempts/abstentions, confidence treatment, model/runtime identity, contamination, hardware facts, and replay instructions. The locally hostable registry is append-only by result identity, independently rebuildable, and cannot rewrite or silently hide history. done 2026-07-15; evidence: scripts/lib/genesisbench_registry.py, crates/gc_cli/tests/cli_genesisbench_registry.rs, and scripts/check_agent_authoring_bundle.sh; input: genesisbench-signed-registry-bundle-sha256:200a90d0ef3596844f30fd3aeaa643ae219a9b0a1e3b7466cbcedb3f18f1063a Evidence 2026-07-15, refreshed during R1.4.o on 2026-07-17: the recursively closed registry authority has identity 017cca0158ab32df4dd89c0fd6713d3527460547e1283065ef862d4e3c678dd0 and generates seven Draft 2020-12 schemas for claims, signed submissions, policy, results, events, checkpoints, and publication. genesis bench exposes eleven public commands: the original seven execution/bundle operations plus policy-pinned registry initialization, admission, deep verification, and deterministic static build. Submission, event, and checkpoint statements use three domain-separated DSSE v1 payload types, canonical bounded ASCII JSON, Ed25519 signatures, exact key IDs, and Rust-only private-key handling; duplicate-key JSON, noncanonical payloads, permissive Unix key modes, key-material mismatch, forged signatures, and wrong operator keys fail closed. Registry policy immutably pins the exact protocol, operator and submitter keys with provenance, allowed tracks, bundle bound, public-reference treatment, complete-evaluation requirement, tie policy, and lexicographic order. Admission locks writers, verifies every signed binding, validates and safely extracts the closed bundle, replays without model access, independently rescores, derives rather than trusts eligibility, stores content-addressed bundles/submissions/results, appends an operator-signed event, and signs a checkpoint over every retained prefix. Deep verification closes root and object-store topology, rejects unknown/orphan/missing objects and byte rewrites, verifies every submission/event/checkpoint and complete prefix chain, then re-extracts and rederives every retained result; history deletion, insertion, rewriting, silent suppression, and immutable-run rebinding are rejected. Static publication is byte-identical across rebuilds and reports exact compatible cohorts, shared ranks for substantive ties, verified solves before conditional quality and capability/context/tool/repair efficiency, per-lineage and per-class cells, Wilson 95% intervals, missing/invalid/abstained evidence, all attempts and replay facts, model/runtime/contamination/hardware provenance, and separately non-ranking economics. The public conformance run correctly remains unranked and cannot seed a false leaderboard. Eight authority controls, 2/2 signed-registry tests, 7/7 front-door tests, 69 driver tests, panic policy, source budgets, and the 126-artifact authoring bundle pass. GenesisBench freezes all 1,775 files, 82 authorities, and 106 protocol controls at identity d6d3c97394d54bdcbe280748c738fac3f023e1934622fba6b3ba66c05f8e8cc2; construct validity is now independently closed by R1.4.n, while real-model baselines remain exclusively R1.4.o.
• R1.4.n Validate construct, alternatives, maintenance, and anti-gaming behavior. Prove that results track semantic correctness, obligations, minimal authority, maintainable patch quality, bounded resources, repository localization, and diagnostic recovery rather than syntax imitation, formatting, prompt length, provider latency, model identity, task-specific runtime recognizers, or oracle leakage. Accept alternative correct designs through behavioral/property/metamorphic tests, resource/capability/API envelopes, and hidden hand-reviewed verifiers rather than exact reference-patch equality. Add seeded follow-on requirements, profile migrations, defects, policy tightening, and performance constraints; source-equivalent anti-overfit variants; scorer/evaluator mutation; bootstrap confidence intervals; saturation tests; and independent stratified audits without making model or human preference the quality oracle. done 2026-07-16; evidence: scripts/check_agent_authoring_bundle.sh, scripts/lib/genesisbench_construct_validity.py, crates/gc_cli/tests/cli_genesisbench_construct_validity.rs, and crates/gc_cli/tests/cli_agent_benchmark_scoring.rs; input: genesisbench-construct-validity-bundle-sha256:4e28308f159277a4e77db12d8f798f1b16a48608f84bd1e743b3a291a953aa39 Evidence 2026-07-16: the closed, content-addressed GenesisBench-Construct-Validity-v0.1 study has identity 5fb03a7eddaaa0d4d2e782920fb1e082c332132ead4d8aa199f67a905829c5bd and binds the exact language profile, 27-case task suite, two-epoch/90-lineage held-out authority, scoring contract/runtime, reviewed study policy, and shipped runtime. It covers seven declared constructs with executable evidence; accepts 9/9 independently authored semantic alternatives across all task classes; rejects 9/9 shallow, authority-broadening, oracle, scope, obligation, resource, and semantic negatives; kills 10/10 scorer/evaluator mutants with zero survivors; and maintains 5/5 seeded defect, follow-on, performance, policy-tightening, and profile-migration scenarios. Alternative acceptance, negative rejection, mutation score, and maintenance are all 10,000 basis points. Deterministic cluster bootstrap over independent lineage IDs uses 10,000 fixed-seed replicates and yields exact 95% intervals of 10,000-10,000 basis points for both acceptance and rejection. Seven nuisance controls exclude formatting, prompt length, provider latency, model identity, syntax imitation, task-specific recognizers, and oracle leakage from score authority; the saturation contract exercises under-threshold, two-epoch trigger, and public-conformance exclusion paths; and the stratified audit records 18 construct/outcome/task-class observations without a preference oracle. Deployment scoring now canonicalizes only runtime-private PID/clock log path segments while retaining path multiplicity, payload bytes, and payload hashes; 30 scorer controls prove ephemeral-name invariance and payload-tamper sensitivity. Two independent complete studies are byte-identical, the shipped scoring suite passes 3/3, the shipped construct suite passes 2/2, and the 126-artifact authoring gate passes all component validators with exact zero retained generated-disk growth.
• R1.4.o Run named real-model campaigns, then publish reproducible baselines, benchmark card, and methods paper. Freeze one clean GenesisBench snapshot and predeclaration before execution. Campaign A runs Codex CLI with provider-catalog model gpt-5.6-luna and reasoning effort xhigh through a versioned Open Agent workspace harness: pin the CLI executable digest/version and invocation, bind the observed provider catalog without falsely claiming immutable revision identity, use an ephemeral isolated copy-on-write checkout, disclose its exact system/rules/tool/scaffold/capability/resource configuration, prohibit private held-out access and ambient user instructions, retain JSONL events and final artifacts, and perform no hidden retry or between-case tuning. It first attempts one public case from every core task class; only after all nine successes, failures, invalids, abstentions, capability requests, resource facts, and costs validate, replay, and independently rescore does it expand to all 27 public conditions. Campaign B runs at least two digest-pinned, license-compatible local model classes through the same frozen semantic acceptance authority: the smallest viable model and the strongest model that fits the host, using offline MLX/OpenAI-compatible or direct-runtime adapters with weights/tokenizer/runtime digests, measured combined resident memory, and no server fallback. Report local fixed-scaffold Cold Acquisition separately from agentic or Embedded Local runs; do not compare across track, scaffold, model-identity, context, hardware, or attempt-policy cohorts. Then expand to pinned frontier-general, code-specialized, and open-weight families under predeclared complete matrices. Report pass@1 and bounded pass@k separately, keep conditions clustered by nine independent lineages, select potential teachers per task class and verified trajectory rather than aggregate rank, and make no temporal-clean claim without proven release/precommit chronology. Publish every expected attempt or explicit missing cell as a closed bundle plus machine-readable benchmark/model cards, typed failure-to-owner dispositions, failure taxonomy, and a reproducible methods paper covering construct, non-claims, tracks, lineages, context conditions, scoring, contamination, custody, statistics, adapters, limitations, economics as non-ranking facts, and exact regeneration from accepted bundles. A deterministic mock, an unresolved mutable model alias, or a hand-copied candidate remains unranked and cannot satisfy the reality gate. Campaign order is fail-closed: (1) predeclare snapshot, task IDs, invocation, model identity policy, authority, budgets, stop rules, hardware, secrets, and publication class; (2) validate the workspace harness against deterministic and malicious fixtures; (3) execute and preserve the nine-case Codex/Luna reality gate once; (4) classify harness defects separately from model failures and repair only the harness under a new predeclaration; (5) execute the frozen 27-condition Codex campaign; (6) inventory local models and licenses without downloading or mutating weights, choose resource-fit representatives before observing scores, execute offline, then delete/replay without weights; (7) independently validate, rescore, bundle, analyze, and publish every attempt; and (8) convert repeated eligible failures into versioned language, diagnostics, documentation, skill, package, or benchmark dispositions without editing the scored epoch in place. Evidence 2026-07-17, historical pre-execution checkpoint: campaign steps (1) and (2) had a shipped boundary before the first model attempt. GENESISBENCH_OPEN_AGENT_v0.1 is separate from and explicitly preserves the frozen five-class Cold Acquisition adapter profile. Four new genesis bench operations predeclare, execute, validate, and replay Open Agent work. The predeclaration binds exact case/campaign/protocol/suite/snapshot/scaffold identities, Codex CLI executable digest/version, hosted or local runner class, requested model/revision, reasoning effort, optional immutable-revision claim, required local model-artifact digest/provider, one attempt, no resume/hidden retry, closed capabilities/environment names, and finite budgets. It is always unranked at this boundary; only independent signed-registry verification may derive admission. Execution reconstructs and verifies all 1,775 frozen source files under a read-only root outside the sole writable case workspace, supplies a digest-bound GenesisCode tool, runs one ephemeral JSONL workspace-write Codex process group, hard-kills descendants on timeout/capture overflow, rehashes source bytes/modes/topology, closes candidate paths, and scores only violation-free output. Fourteen malicious controls reject retry/capability/rank/model mutations, byte/mode/symlink/topology attacks, malformed transcripts, and surviving timeout descendants. A shipped integration fixture proves predeclare -> one attempt -> canonical score -> validate -> delete agent executable -> model-free independent replay. The exhaustive scorer matrix is now isolated in a required serial perf lane (148.91 s observed, 600 s ceiling, 30 s child ceiling) while the default suite retains a 6.11 s accepted-reference/symlink-rejection core. The first real predeclaration must request luna at xhigh; if the provider exposes only alias luna, it must not falsely assert immutability. Campaign steps (3) through (8), local-model selection, complete bundles, analysis, and publication remain open. Evidence 2026-07-17, superseding real-model checkpoint: the first named campaign is now immutable and complete at benchmarks/genesisbench/v0.1/campaigns/codex-luna-xhigh-2026-07-17/reality-gate/. One atomic campaign predeclaration binds all nine small-context task classes, Codex CLI 0.145.0-alpha.18 at executable SHA-256 a2bc3f63b0d7ce5c065ae070e16d964fa71192bf6ceb8da82d2315227d55a6bf, requested mutable alias luna, xhigh, one attempt, 900,000 ms per-case hard limit, non-selective continuation, exact protocol/snapshot/scaffold identities, and MacBookPro17.1-AppleM1-16GiB; nine derived attempt predeclarations bind that campaign identity. All nine attempts are retained, validate, and replay without agent/model access. All nine are invalid with one identical provider fact: the ChatGPT-backed Codex service returned HTTP 400 because luna is unsupported for the account before task execution. The rederived closed report identity is 5a26222d10b1d480f6ea3fa5d6db6b820f2e5fe86fb2d6aa76bbfdfada940ff4; it records 0 verified, 0 semantically failed, 9 invalid, makes no GenesisCode capability claim, remains authentic but unranked, and fail-closes 27-condition expansion. The transcripts also exposed two harness defects rather than model defects: parent traversal attempted to discover the repository authoring skill despite --ignore-user-config, and read-only frozen checkouts survived ordinary teardown, consuming 444 MiB across nine attempts. GENESISBENCH_OPEN_AGENT_v0.2 preserves v0.1 historical validation while moving process workspaces outside repository ancestry, atomically copying retained evidence back, and permission-normalizing protected trees before deterministic deletion; the leaked temporary roots were removed, leaving 316 KiB of campaign evidence. Twenty-two malicious controls now include complete-matrix omission, post-hoc campaign mutation, selective stopping, attempt rebinding, ancestry isolation, and read-only cleanup. Campaign A’s requested Luna reality gate is truthfully discharged as an availability failure and may not be retried or expanded under that predeclaration. R1.4.o remains open for a separately predeclared available frontier model, the two local model classes, complete bundle/publication integration, and steps (6) through (8). Evidence 2026-07-17, available-model and harness-closure checkpoint: the exact catalog slug gpt-5.6-luna executed all nine predeclared small cases at xhigh in codex-gpt-5-6-luna-xhigh-2026-07-17; that v0.2 campaign produced one verified package-migration score and eight harness-invalid attempts, exposing declared-output rejection, supplied-tool cache contamination, and a 1 MiB event-line false rejection rather than eight model failures. GENESISBENCH_OPEN_AGENT_v0.3 preserves v0.1/v0.2 validation while admitting and retaining newly created declared outputs, setting GENESIS_SELFHOST_COMPILED_CACHE_DISABLE=1, accepting one bounded event line up to the 16 MiB capture ceiling, replacing ephemeral stage prefixes with $GENESISBENCH_STAGE, and precommitting the supplied Genesis executable and self-host artifact digests. Twenty-eight controls cover these repairs, reject forged tool bindings, and resolve historical suite, protocol, and scoring bytes from content-addressed archives after current authorities advance. Historical independent rescore also requires the execution toolchain rather than merely the old JSON: legacy v0.2 tool archive eeaf5f7a227e7affa84d39114a7454ffd1a894f052b5d6be7c5a995ae5e63265 binds its campaign and authorities to the exact executable and self-host artifact, closing the one verified score without trusting the current runtime. A fresh, separately predeclared v0.3 campaign at codex-gpt-5-6-luna-xhigh-harness-v0-3-2026-07-17/reality-gate/ ran all nine attempts exactly once in canonical order: eight verified and independently rescored, while deployment was invalid because genesis pack pinned hashes into non-editable package.toml and the agent failed to restore it. No ambient skill discovery, cache contamination, declared-output rejection, oversized-event false rejection, ephemeral stage path, timeout, capture failure, provider failure, hidden retry, or semantic scoring failure occurred. The closed report identity is 3886173cf3cf0dd85d492dcbf231b0dec04b4dd3b94b944b2796bc156ba81a77; replay tool archive identity 10d2f1b4522997bba0289fb9ca5e2839a6bd4de0e198132a25d3f953ee3b71b8 preserves the exact 75,983,512-byte execution binary in deterministic gzip plus the bound self-host artifact, and all eight verified scores rederive after current suite/protocol/scoring authorities advance. Mutable provider identity keeps the cohort unranked and the one invalid cell correctly fail-closes 27-condition expansion. Evidence 2026-07-18, v0.4 execution-closure checkpoint: active authority GENESISBENCH_OPEN_AGENT_v0.4 has content identity af050173b445687c2c0b5aec81a7ec39d5da147255e907fe8d8bcaede4685e3a, scaffold identity e990663373e5763b4583e238d9b1ba45d297ce84bfe9956905478824ea41479a, and implementation identity 8bad26805b97254cac7dee13e07fde83c44c8da89b3acaf7f4fd2d291f695abd. It binds the exact bytes of both entrypoints and the complete recursively discovered 13-file local Python import closure; its deterministic renderer is owned by the repository’s transactional 30-node/87-output generated-authority graph, and validation compares the checked-in document against a fresh render rather than trusting listed hashes. Every inventory-valid invalid attempt now retains an exact, bounded observed-workspace/ payload whose independent inventory must equal the recorded post-run inventory; missing payloads, substitutions, extra files, digest drift, and byte tampering fail closed. Thirty-two adversarial controls pass, including implementation substitution and omission, retained invalid-workspace mutation, process-group timeout/reap, ancestry isolation, and historical-authority compatibility. The shipped strict-profile integration test executes a valid case and a deployment-like invalid case, proves that noneditable package.toml drift and editable deployment.json survive under the observed payload, validates and replays the invalid attempt without the agent or model, and rejects post-run payload tampering. The public Agent Index, schemas, front-door guide, authoring bundle, 82-authority protocol at identity d6d3c97394d54bdcbe280748c738fac3f023e1934622fba6b3ba66c05f8e8cc2, gate manifest, and Quarto references are synchronized. R1.4.o remains open: before observing any local score, inventory and license-check the existing weights, predeclare the smallest viable and strongest host-fit MLX cohorts, execute each matrix without server fallback, delete or make weights unavailable for replay, then publish all bundles, registry results, model/benchmark cards, methods paper, and steps (7)-(8). Evidence 2026-07-18, local-readiness audit (not score-producing): five existing generation snapshots were inventoried without downloading or changing weights. Preselection identity 60023b24b49c221bf184167631aab4a86f7ee646a9f558567d2ba102d6e8e7d4 binds the exact score-blind policy, five candidate revisions, retained immutable model-card/base-license evidence, selection reasons, and two roles; inventory identity 63576667d1c807a7b1976319f5b0b78a98404ae418ef09219f936cab699b83d9 binds every one of the 49 snapshot files by relative name, bytes, and SHA-256 without weights or host paths in Git. Apache-2.0 Qwen3 4B 4-bit at upstream revision 4dcb3d101c2a062e5c1d4bb173588c54ea6c4d25 and Qwen3 8B 4-bit at 545dc4251c05440727734bcd94334791f6ab0192 are preselected as the smallest adapter-viable and strongest 16-GiB-host-fit classes; offline MLX 0.29.3/MLX-LM 0.29.1 smoke generation succeeded with measured peak process footprints of 2,665,307,840 and 5,005,979,904 bytes and zero swaps. These are resource-admission observations only, not GenesisBench attempts or quality claims. Qwen2.5-Coder 0.5B is not in the selected MLX layout, Phi-4-mini carries repository executable code outside the no-remote-code policy, and Llama 3.2 3B has a more restrictive license than the similarly sized Apache alternative; all remain unselected rather than silently omitted. The stdlib-only verifier has ten adversarial controls and can rehash all five local snapshots before execution. Publication remains blocked until the runtime distribution and adapter closures are exact and the remaining custody controls below pass. The audit also falsified assumptions that must be repaired under a new harness authority before local execution. Codex CLI’s built-in lmstudio path invoked LM Studio model management and attempted a download instead of using the already-running offline MLX endpoint. A custom loopback provider inherited and sent the ambient ChatGPT bearer token unless HOME and CODEX_HOME were replaced with fresh auth-free roots, and default request/stream transport behavior retried one failing model request five times despite the declared no-hidden-retry policy. With isolated homes plus both retry limits pinned to zero, a malicious loopback fixture observed no authorization header and exactly one request. The isolated request still exposed default web-search and multi-agent/system-skill context, while Codex’s inner workspace-write sandbox does not establish read isolation from unrelated host files. Therefore no local campaign may be predeclared or scored until the successor boundary: (1) runs Codex inside an independently tested outer OS/container read-and-write allowlist covering only the frozen repository, case workspace, supplied tools, required system runtime, ephemeral empty homes, and one loopback provider endpoint; (2) disables web search, multi-agent, plugins/apps, hooks/rules, memories, and undeclared tools, then binds the exact observed tool and instruction scaffold; (3) uses an explicit Responses-to-MLX adapter with zero retries, no server fallback, hard process-group teardown, exact request/response retention, and no credential-bearing headers; (4) verifies a canonical model/runtime/license manifest before loading; and (5) proves malicious read, write, network, auth, retry, tool, ancestry, symlink, model-substitution, server-survival, and ambient-context controls. Historical v0.1-v0.4 evidence remains authentic and unranked; it is not retroactively upgraded by the successor. Evidence 2026-07-18, v0.5 local-custody gate (still not a GenesisBench score): active generated authority GENESISBENCH_OPEN_AGENT_v0.5 has content identity 1484ec49f9be6db6d0cb355e3ca202e241dcbc88ba19a276a83e7ed3f14f6b6a, scaffold identity a4b38e331e287aea8881e2946021eb88fd6a83e90852b8ef951d922e097e1823, and 16-file implementation identity 8e0ce880d6ccd35daf4bbc30aa4fdcf8ac4fcf4eeb2d95523d1be950d668230b. Local campaign and attempt predeclarations now bind the score-blind preselection, exact model inventory, model artifact, adapter, custody manifest, Python/MLX runtime, runner, profile, and auth-free secret policy identities. Codex and the adapter/model server run in separate default-deny macOS sandboxes with disjoint writable roots and only their exact loopback edge; built-in apps, browser/computer use, MCP apps, hooks, image generation, memories, multi-agent, plugins, skill discovery/dependency installation, workspace dependencies, and five built-in system skills are explicitly disabled. The supervised adapter translates the exact observed Codex Responses request to deterministic MLX Chat Completions with temperature zero, seed zero, no fallback, no credential-bearing headers, no hidden retry, and complete canonical request/backend/response/SSE/rejection evidence; duplicate turns and IDs, undeclared tools/context, model substitution, and request-shape drift fail closed. Local reasoning is closed as codex-low-to-qwen-thinking-disabled-v0.1: the adapter requires the exact Codex low reasoning request and MLX disables Qwen thinking, while medium, high, and xhigh local claims fail instead of being silently ignored; hosted Luna xhigh remains a separate non-comparable cohort. Zero backend requests derive provider-no-request; any rejection, credential, or retry observation derives provider-policy-rejection; either makes the run unscorable while preserving its workspace and custody evidence. The Qwen3 4B manifest at identity 689343f45427dc85a816891017d3134bfa597839e4f7cbe09a68b1df1f8c9b5e binds nine model files totaling 2,278,969,756 bytes, Python 3.9.23, 25 transitive distributions with 6,946 files totaling 295,379,654 bytes, and the exact two-script adapter closure without host paths or weights in Git. Thirty-nine Open Agent, thirteen adapter, and thirteen custody controls reject implementation/custody/provider/secret/reasoning substitution; ambient read/write; undeclared loopback and external network; credentials; retries; tools/skills/MCP context; malformed or duplicate requests; zero-request scoring; rejection-observation tampering; and surviving agent, adapter, model-server, or descendant processes. One disposable outer-sandboxed Codex-to-adapter-to-MLX probe completed with one request, seven declared environment names, and a reaped backend; it was intentionally not a benchmark attempt and carries no quality claim. This closes the five successor prerequisites above. R1.4.o remains open and now proceeds without further armor-first delay: atomically predeclare and execute the Qwen3 4B nine-class reality gate exactly once; retain, validate, replay, and publish every outcome; expand that cohort to 27 conditions only if its predeclared gate permits; then repeat under a separately frozen Qwen3 8B cohort. No model inference may begin before its campaign and custody bytes are committed, and no score may be reported, selected on, or used downstream before the complete run bytes are retained and validated. Round-five acceptance refinement: preserve the v0.3 Luna nine-case gate and its failed expansion predicate exactly. Treat its near-ceiling public-small observations as commissioning evidence and a task-priority signal, not a formal BQ-5 saturation event or ranked provider claim. Before any new Luna run, use retained events and the observed workspace to produce a typed root-cause disposition for model/noneditable-input-drift; trace whether the frozen card, diagnostics, tool behavior, or workspace contract made the protected/editable boundary unclear; repair only a general language/tooling/documentation defect under a new version; and prove the change on non-benchmark counterexamples. Then predeclare a separate complete 27-condition Open Agent cohort whose medium/large cases are the primary discriminative analysis, retain every cell, and never compare it as if it were the original scaffold/provider cohort. Publication order is Qwen3 4B nine-class local reality gate, its allowed expansion if any, separately frozen Qwen3 8B, the new Luna 27-condition cohort, then benchmark card, model cards, methods, commissioning chronology, first-results report, and machine-readable failure dispositions. The publication must explain the credential/context/retry faults caught before scoring, distinguish harness corrections from model failures, publish the deployment invalid and all limitations, and provide exact replay/rescore commands; it may not wait for a cosmetically complete leaderboard or suppress invalid campaigns. Campaign infrastructure acceptance refines, but does not rewrite, R0.2.g: split cli_agent_benchmark_scoring into a bounded non-vacuous default-lane contract core and a required serial/stress workflow; inventory every default-lane test whose measured p95 or hard ceiling exceeds 60 seconds; and prove the default parallel suite plus every moved heavy lane repeatedly from clean and warm caches. Diagnose hosted queue history before changing policy, then give scheduled, push, pull-request, and release/full runs event-specific concurrency behavior and bounded stale-run cancellation. Every moved test has a manifest diff, rationale, owner, trigger, timeout, resource envelope, and required hosted execution proof. Negative controls show a long main push cannot starve scheduled full evidence, a superseded pull request is cancelled, a live release/full run is not incorrectly cancelled, and no test disappears from all required profiles.
• R1.4.q Commission and audit a genuinely private discriminative Preview epoch. This is an M1-B critical-path refinement of the completed R1.4.j protocol/commitment machinery, not a new task class or larger headline sample. Materialize at least 45 useful private lineages, at least five per core class, from at least two independently disclosed author or generator authorities; no family controls more than 25% of ranking weight, and model-generated proposals require independent human or organizational admission. Each payload binds its secret salt/commitment, authorship and license/consent, post-release chronology where claimed, difficulty rationale, editable/protected scope, capability/resource envelope, deterministic oracle plus alternative-solution policy, maintenance follow-on, leakage canaries, and custody chain. Keep payloads and oracles outside distributed source, model context, logs, and training stores; execute a blind deterministic reference and non-target pilots from at least two materially different model families through role-separated custody without exposing answers; prove every public commitment opens exactly; and retain rejected, duplicate, leaked, invalid, or unsound proposals with typed dispositions. Predeclare the structural rubric and empirical calibration method, assign every lineage an immutable epoch-local easy, medium, or hard band, and publish class-by-difficulty composition without exposing payloads. Freeze at least two content-addressed lineage-stratified fast forms before target access; publish their sampling frame, coverage gaps, and directional-only non-claims. private_verified=false, placeholder payloads, metadata-only balance, one project-controlled author identity, post-hoc difficulty, score-selected fast cases, or a generator label without independently reviewable bytes cannot satisfy BQ-11, BQ-15, BQ-16, or M1-B. Publish only commitments, aggregate composition, audit evidence, limitations, and later disclosure schedule until retirement; R1.4.p still governs public admission and independence. Capacity decision: prioritize this work over adding public-small variants because the commissioned small tier is weakly discriminative; use the existing R1.4.j/M1-B corpus allocation and do not delay the Qwen3 reality gate, first-results report, R0.4.j, or R2.3 startup work.
• R1.4.p Establish public benchmark-task and result governance. Publish one signed, versioned policy for benchmark-task proposals, independent authorship/generator disclosure, duplicate/near-duplicate detection, useful-work and alternative-solution review, private-custody transfer, difficulty calibration, smoke/fast/standard/full form construction, anchor/equating policy, conflict recusal, embargo and prospective ranking-weight retirement, coordinated vulnerability/oracle-leak disclosure, result admission, appeals, operator-key rotation, and evaluator/scorer defect handling. Untrusted submissions enter quarantine; no proposer, solver, model provider, registry operator, scorer author, or custody holder may unilaterally admit its own task or result. Corrections, exclusions, supersessions, and retractions append signed status records and preserve the originally published cohort, bundle, rationale, labels, weights, and leaderboard history. Provide contributor templates, deterministic preflight tools, service SLOs, an escalation path, and adversarial exercises for collusion, Sybil authors, malicious archives, hidden duplicates, leaked oracles, conflicts, compromised keys, invalidated runs, disputed alternative solutions, post-hoc difficulty changes, score-selected fast forms, and missing strata. The policy reserves open-ended repository improvements, bounties, and prizes for the separately governed non-ranking GenesisChallenge surface in R8.5.u-v; they cannot enter a benchmark cohort or change benchmark rank. Before dropping the project-controlled Preview label, obtain at least one disclosed independent non-project human or organizational reviewer/operator, record scope/conflicts/dissent, and separate at least one admission, signing, or mirror authority from the project author. Agent-family diversity may satisfy generator-balance experiments but not this independence requirement. Meet BQ-14 through BQ-16 and BQ-18 through BQ-20 before calling GenesisBench a public benchmark.
• R1.4.r Prove model-neutral adapter portability and failure attribution. This is an M1-B refinement of the completed scoring, protocol, reference-agent, adapter, and construct-validity authorities, not a new track or provider campaign. Publish a transport-neutral request/content/artifact contract; artifact-text and canonical-tools interaction profiles; adapter capability negotiation; tokenizer-neutral byte/structure budgets; plural non-repairing candidate extraction; and the closed terminal-owner taxonomy from section 3.17. Add a one-manifest JSON-stdio or endpoint onboarding path plus genesis bench adapter inspect, conformance, and dry-run. Prove one scripted model is semantically invariant across completion-only, chat, streaming/non-streaming, native-tool, JSON-text-tool, direct local, HTTP, and JSON-stdio fixtures; reject prompt/role/content mutation, hidden system text, tokenizer-driven truncation, undeclared retrieval/tools, retries, output repair, secret leakage, and model-blame laundering. Before M1-B, execute the common public artifact-text smoke/fast matrix through at least two independently implemented interface stacks and two materially different model families; before GenesisBench Trust, require at least three of each plus native/JSON-text tool equivalence. Codex CLI, Responses, MLX, Qwen, and every future provider remain named adapter/scaffold instances only. Historical campaigns retain their original validity and cohort labels. Meet BQ-18 through BQ-20 before claiming portable model comparison. Pre-v1 exception: section 3.19’s fixed-content local canary may retire the narrower risk that a second family cannot cross the neutral interface at all. It cannot use a benchmark task or scorer and cannot satisfy R1.4.r, BQ-18, BQ-19, BQ-20, M1-B, or any comparison claim; the complete task remains activated only after R9.4.f.

R1.5 Authoring skill vNext

• R1.5.a Generate the skill from canonical inputs. Replace duplicated prose across .agents/skills/genesiscode-authoring, docs/write_genesisCode_skill.md, and the versioned pack with generated cards plus a small hand-owned workflow policy. done 2026-08-06; evidence: scripts/check_agent_authoring_bundle.sh, scripts/check_cli_diagnostics_contract.sh, scripts/check_write_genesiscode_skill_conformance.sh, and scripts/check_generated_artifact_policy.sh; input: authoring-skill-bundle-sha256:81109b0f3a179c7f2879a0d8afe7150d94d298a65d9dcf0392fd29c3402dfd66 Evidence 2026-08-06: policies/genesiscode_authoring_workflow_v0.1.json is now the sole hand-owned workflow, prompt, and recipe policy. The closed deterministic renderer scripts/lib/genesiscode_authoring_skill.py binds that policy, the skill contract, GC-AGENT-v0.3, compact core/task/symbol/diagnostic cards, and both capability indices by SHA-256, then atomically produces the frontmatter-valid .agents/skills/genesiscode-authoring/SKILL.md, the five-step human pointer, a progressive-disclosure authoring card, separate 14-prompt and 27-recipe JSON registries, and their provenance manifest. Forty-one independently drifting prompt/recipe prose files were removed. generate/authoring-skill owns all six outputs in the 31-node/93-output transactional generated-authority graph; stale inputs route through release, roadmap, Quarto, and gate views, while updates remain non-evidence. The isolated transactional run rebuilt 24 affected nodes, passed 22 independent read-only checks, and promoted only six changed derived views. Skill, pack, guide, distribution, diagnostics, 139-artifact bundle, release-profile fixture, check/update boundary, gate-manifest, documentation, and generated-authority mutation controls pass offline with no network attempts.
• R1.5.b Remove dead planning guidance. Do not direct agents to an empty upgrade_plan.md as their ordinary work queue. Route active defects, roadmap tasks, user tasks, and exploratory work explicitly. done 2026-08-06; evidence: scripts/check_genesiscode_authoring_skill.sh, scripts/check_write_genesiscode_skill_pack.sh, scripts/check_write_genesiscode_skill_distribution.sh, and scripts/check_agent_authoring_bundle.sh; input: authoring-skill-bundle-sha256:81109b0f3a179c7f2879a0d8afe7150d94d298a65d9dcf0392fd29c3402dfd66 Evidence 2026-08-06: the hand-owned authoring policy and machine contract now define exactly four non-interchangeable routes: a current user-task, an active-defect selected only from reproduced open P0/P1 IDs, a roadmap-task selected from the bounded machine-generated execution slice, and non-authoritative exploratory-work. Each route carries a closed selection source, empty-source behavior, closure authority, and explicit stop conditions. The active-defect route is machine-disabled when upgrade_plan.md has no open IDs, roadmap work cannot be selected by scanning unchecked boxes or status views, and exploration cannot mutate completion status. Generated skill and prompt-card text no longer substitute the defect ledger for a concrete user request or general roadmap progression. Renderer self-tests mutate empty-defect behavior and fail closed; the focused contract, pack, guide, distribution, and 139-artifact bundle checks pass offline with no network attempts.
• R1.5.c Add profile negotiation. The skill identifies CLI/language/card versions, supported capabilities, target platform, available resources, and strictness before writing code.
• R1.5.d Add compact workflows. Provide author, repair, refactor, package, replay-debug, optimize, deploy, and self-host migration flows with exact stop/fail conditions.
• R1.5.e Add safety invariants to tool calls. The skill never edits policy, signing roots, generated evidence, bootstrap trust, or format versions incidentally.
• R1.5.f Validate distribution. Test clean install, offline use, stale-card rejection, token budgets, links, examples, and behavior with at least two independent agent/model families.
• R1.5.g Generate domain and target guidance on demand. Build compact cards from the product/target capability ledger, package index, BSP/component catalogs, authentic artifact predicates, and unsupported-feature diagnostics. The skill retrieves only the selected web/service/desktop/mobile/game/data/embedded profile, never invents an unavailable API or board, never treats generated foreign glue as an editable fallback, and proposes an extension-package gap when first-party coverage is absent.

R1.6 Agent-safe collaboration

• R1.6.a Implement O(1)-logical workspace forks. Use content-addressed snapshots and copy-on-write overlays so multiple candidates do not duplicate build trees or mutate one another.
• R1.6.b Define deterministic candidate comparison. Rank by required-test pass, obligation strength, capability minimization, semantic patch size, resource delta, and risk; tie-break by canonical patch hash.
• R1.6.c Separate proposer, reviewer, and verifier identities. Provenance records role, tool/model version, context bundle, and evidence. One agent may fill roles in development, but release profiles require independent verification for high-risk changes.
• R1.6.d Prevent secret/context leakage. Cards, diagnostics, logs, model effects, and evidence redact or seal secret material; add canary negative tests.
• R1.6.e Separate instructions from untrusted content. Source comments, package docs, diagnostics, logs, registry metadata, model output, and retrieved files carry provenance/trust labels and cannot silently become agent policy. Add prompt-injection, confused-deputy, and indirect tool-instruction corpora.
• R1.6.f Bind tools to explicit intent and authority. Each mutating or effectful agent call carries workspace identity, requested operation, capability scope, budget, and confirmation policy; stale, cross-workspace, broadened, or replayed requests fail closed.

R1.7 Typed English intent and trajectory preview

• R1.7.a Define Goal/Intent IR. Translate an English request into a closed, versioned record of deliverables, constraints, accepted inputs, editable scope, target profiles, capabilities, budgets, acceptance tests/obligations, uncertainty, and explicit unsupported assumptions. Translation is an untrusted proposal; malformed, ambiguous, over-authorized, or untestable goals produce typed questions or abstention rather than executable authority.
• R1.7.b Ship a transactional genesis ask preview. A general model may propose the Goal/Intent IR, retrieval plan, and GenesisCode changes through the versioned agent interface; every mutation occurs in an isolated semantic transaction and reaches accepted state only through deterministic parsing, types/effects, obligations, policy, tests, resource checks, replay, and user/release confirmation. The preview may use R1.4’s benchmark model-runner adapter but does not claim R5.4.e’s production model-effect profile.
• R1.7.c Keep planning and specialization replaceable. Support one general model for English/domain planning and an optional separate GenesisCode specialist for source, patches, policies, tests, and repairs, with explicit content-addressed handoff records. Routing is versioned and benchmarked against a single-model baseline; no architecture is made permanent without measured quality, cost, privacy, and local-deployment benefit.
• R1.7.d Capture complete quarantined trajectories. Retain authorized English request, typed intent, retrievals, model calls, tool actions, attempts, diagnostics, repairs, accepted/rejected patches, capability decisions, evidence, and final outcome under AB-12. Raw trajectories are user-owned/quarantined by default and are not examples, packages, training data, or benchmark authority until a separate R8.5 promotion record proves consent/license, privacy, lineage, verification, deduplication, and held-out isolation.
• R1.7.e Evaluate intent safety and usefulness. Measure typed-goal validity, clarification/abstention calibration, acceptance-test completeness, capability excess, unsupported invention, transaction escape, repair recovery, user correction burden, and end-to-end verified completion across at least two general-model families. Prompt injection, retrieved instruction confusion, secret exfiltration, evaluator tampering, and direct-mutation attempts fail closed.
• R1.7.f Compile product intents into closed acceptance graphs. Decompose requests such as a website, game, mobile app, service, data pipeline, Raspberry Pi system, or MCU device into product features, target profiles, domain packages, assets, capabilities, resource/SLO budgets, real-runtime/device tests, deployment/update/rollback, and one-language source obligations. Unknown domain knowledge triggers typed retrieval or clarification; an unavailable target produces a truthful staged plan rather than foreign code or a fake artifact.

R1-A GenesisCode Agent Preview exit criteria: GC-AGENT-v0.3 is frozen and versioned; compact cards meet AB-1/AB-2; diagnostics are structured across every user boundary; warm/MCP meets AB-3/AB-4 and survives cancellation, handle-cleanup, and leak stress; the generated authoring skill passes clean/offline installs and negotiates domain/target support without foreign-source escape; collaboration preserves transactional authority; typed English intent meets AB-11/AB-12 and emits closed product acceptance graphs without bypassing deterministic acceptance; pinned agent-product runs meet AB-5, AB-6, AB-8, AB-11, and AB-12 without private repository context. Shared public benchmark fixtures may validate this release, but private-epoch commissioning, a public leaderboard, or a Genesis Model package cannot block it.

R1-B GenesisBench Preview exit criteria, activated only after R8.3.b: GenesisBench binds exact immutable GenesisCode Core, Genesis Algorithms, and GenesisExamples/GenesisApps seed releases and publishes four isolated tracks, lineage-correct statistics, >=45 independently authored/governed and private-payload-verified Preview lineages, useful temporal overlays, a fixed reference scaffold, canonical CLI/adapters, self-hostable result registry, benchmark card/methods/first-results commissioning report, closed baseline bundles, and signed Preview-governance rules. The private epoch publishes immutable easy/medium/hard calibration, separately keyed context conditions, and at least two precommitted lineage-stratified fast forms whose results are directional and cohort-isolated. A common tokenizer-neutral artifact-text smoke/fast matrix runs through at least two independently implemented interface stacks and materially different model families; adapter conformance and terminal-owner derivation prove that provider, harness, extraction, unsupported-feature, and model failures remain distinct. The preserved historical Codex CLI/Luna xhigh reality gate remains labeled by its original identities; a new complete 27-condition follow-up and local-model cohorts are predeclared only after the seed and bind the immutable released language/library/catalog profile. Every expected cell is a replayable bundle or explicit missing record, mutable Foundry state and copied public solutions are absent, and the deployment invalid has a typed general language/card/tooling disposition with non-benchmark regression evidence. Published runs meet AB-7, AB-9, AB-10, BQ-1 through BQ-6, BQ-9 through BQ-16, and BQ-18 through BQ-20. BQ-7/BQ-8 remain hard blockers for training-corpus admission; BQ-17 activates only for reconstruction lineages against compatible L4 destination profiles.

---

R2. Runtime and resource foundation

Goal: finish the reference runtime, make memory/resource behavior part of semantics, and deliver a fast long-lived agent loop before adding aggressive execution tiers.

R2.1 Complete the compiled interpreter

• R2.1.a Implement free-variable analysis and minimal closure capture. Closures retain only needed bindings; differential tests cover shadowing, recursion, nested patterns, and long-lived closure graphs. done 2026-07-16; evidence: cargo test --workspace --offline, cargo clippy -p gc_kernel --offline --all-targets -- -D warnings, scripts/check_no_user_panics.sh, and scripts/check_agent_authoring_bundle.sh; input: minimal-closure-capture-sha256:b00f5c04686265185fe6aaa99d7ac413d5b635eab90e09a7dbd277ca69a7f0ae Evidence 2026-07-16: the tree-walk evaluator now performs scope-aware free-variable analysis over CoreForm data/expression boundaries, sequential let, nested multi-parameter functions, shadowing, and malformed forms, then detaches closure captures from every intermediate lexical frame while retaining the nearest explicitly marked live module scope for recursion, forward definitions, and parent-environment lookup. The compiled interpreter derives an immutable capture plan from resolved Local, Module, and External references, stores only selected lexical depths in an independent sparse frame, fails immediately on an impossible capture-slot mismatch, and lazily reconstructs the same derived plan after decode without changing canonical GCKM5 bytes. A 129-binding adversarial graph retains exactly one required value in both tiers; an unrelated reference-counted vector is physically released while the closure remains live and callable. Differential tests preserve nested shadowing, mutual recursion, parent-backed module scopes, forward references, and rejection of the language’s unsupported nested non-symbol parameter pattern. All 53 kernel tests, strict all-target kernel Clippy, selfhost benchmark run/replay/tamper integration, every native and WASI workspace test, every library and doc test, the generated 115-artifact agent-authoring bundle, and the no-user-panic policy pass. An initial complete run’s sole failure came from declared ignored Quarto output, and the repository-hygiene test passed after cleaning only the rebuildable .quarto/ and _site/ roots; the final complete workspace run then passed with no failure markers.
• R2.1.b Replace linked lookup on hot paths. Resolve lexical locals to slots/frames where semantics permit; remove avoidable Rc frame walks and per-let environment allocation. done 2026-07-16; evidence: cargo test --workspace --offline, cargo clippy -p gc_kernel --offline --all-targets -- -D warnings, cargo test -p gc_cli --test cli_run_replay_engine --profile selfhost-strict --offline, and gc_runtime_bench --mode workloads under selfhost-strict; input: compiled-flat-lexical-slots-sha256:9558bf04201df493f44a7eaa13b226efd4cb90e6c87c6de285519f6426ac08be Evidence 2026-07-16: compiler-resolved Local { depth, slot } references now index directly into a copy-on-write active slot segment and an immutable depth-indexed closure-capture segment; the production compiled evaluator no longer walks linked Rc lexical frames. Sequential let evaluation moves its owned runtime, mutates the unique slot segment in place with amortized vector growth, and allocates a copy only when a runtime is genuinely shared. Consuming frame-extension operations preserve n-ary application order and avoid extension-time clones. Minimal captures retain Option holes for stable depth addressing but own only referenced values: adversarial tests prove one retained value across a 129-slot span and two retained values across a 512-slot span. Differential tests preserve deep sequential scope, closure application, shadowing, module forward references, source-shape step accounting, partial application, blob roundtrip, errors, and collection semantics; an internal ownership test proves 512 unique pushes retain the same Rc allocation and a real fork detaches before mutation. All 55 kernel tests, strict all-target kernel Clippy, the optimized six-case self-host run/replay integration, and the complete native/WASI workspace and doc-test matrix pass. A release-equivalent one-repeat smoke observation reported fib(25)=185 ms, self-host parse 373 ms, and dispatch 95 ms, all within existing smoke budgets; these observations are regression evidence only and do not replace the normalized multi-sample PB-5/PB-7 evidence required by R2.1.h.
• R2.1.c Close tail behavior. Test at least 10 million bounded tail iterations in treewalk and compiled modes with constant host stack and declared step accounting. done 2026-07-16; evidence: bash scripts/test_perf_gates.sh --kernel-tail-stress, env -u CI cargo test --workspace --profile selfhost-strict --locked --offline, cargo clippy --workspace --all-targets --locked --offline -- -D warnings, scripts/check_no_user_panics.sh, and scripts/check_source_decomposition_progress.sh; input: bounded-tail-proof-sha256:e2bd3e2ec5103329fa685a6db548e39328dfd8fbe84716e27f61c9d5dec42b66 Evidence 2026-07-16: both treewalk and compiled evaluators now expose test-only evaluator-entry depth instrumentation with RAII-balanced counters, leaving release behavior and value layout unchanged. Exact small-loop controls establish the linear accounting law 9 * (iterations + 1) at 0, 1, 2, and 10 iterations in both tiers; a one-step-short negative control fails identically with KernelErrorKind::StepLimit after the exact declared charge. The release-only ignored case executes 10,000,000 tail iterations per tier, requires equal results, exactly 90,000,009 charged steps per tier, and maximum measured evaluator call depth 3. Its existing ignored-test runner composes the ordinary structural TCB check’s unchanged 15-second/64 MiB telemetry envelope with independent 300,000 ms and 512 MiB cold-cache limits for the optimized stress proof; the final governed run passed in 157,346 ms, including compilation, with 1,044,480 bytes of cache growth. The kernel TCB contract now explicitly inventories free-variable analysis and environment capture, while responsibility splits return compiled.rs to 513/520 lines, env.rs to 71/100, and value.rs to 694 lines without increasing any existing ceiling; the source-decomposition guard reports an observed production maximum of 690/700. All 57 default kernel tests pass with only the governed 10M case ignored, and the complete optimized native/WASI workspace, integration, library, and doc-test matrix passes together with workspace all-target warning denial, no-user-panic enforcement, test-profile topology, and kernel TCB checks.
• R2.1.d Finish primitive call normalization. Preserve n-ary uncurried paths, partial application behavior, error spans, and hashes without wrapper allocation regressions. done 2026-07-16; evidence: cargo test -p gc_kernel --lib --locked --offline, cargo clippy -p gc_kernel --all-targets --locked --offline -- -D warnings, scripts/check_kernel_tcb_contract.sh, scripts/check_no_user_panics.sh, scripts/check_perf_budgets.sh, and scripts/check_runtime_workload_budgets.sh; input: primitive-call-normalization-sha256:7ac5dcee3c18e2c235b37cef832262756e55c23e0f51bdc2dba2806f9593a575 Evidence 2026-07-16: compiled unary and n-ary calls now use a compiler-derived primitive-forward plan based exclusively on resolved lexical (depth, slot) identities and the primitive allowlist. The plan supports renamed, reordered, repeated, ignored, unary, binary, and three-parameter forwarding without matching source names, constants, benchmark identity, or expected results. It replays argument order, intermediate-function and primitive/variable step charges, indexed statement sites, symbol coverage, sealed errors, and over-application order under ordinary and one-step-short limits. Partial applications and nontrivial bodies retain the ordinary closure path. Plan metadata is omitted from GCKM5 and value hashes and is deterministically reconstructed after decode; differential tests prove exact treewalk/compiled values, hashes, steps, errors, blob bytes, coverage, and partial-closure restored hashes. Compiled native AppN owns the original function and accumulates only newly supplied arguments: a full three-argument call materializes zero intermediate wrappers and an observable partial call exactly one. The dominant binary plan invokes prim_op2 without a replacement argument-vector allocation. All 58 active kernel tests pass. TCB inventory remains explicit at 23 files, every pre-existing source ceiling remains unchanged, panic/decomposition gates pass, normalized perf budgets pass, and smoke observations were fib(25)=345 ms, map build 3 ms, self-host parse 291 ms, and dispatch 99 ms.
• R2.1.e Close persistent collection budgets. Bring normative map construction under PB-5, specify order/sharing, and test adversarial hash/shape/update workloads. done 2026-07-16; evidence: gc_runtime_bench --mode workloads --roadmap-sample PB-5 under the normative 30-sample protocol, env -u CI cargo test --workspace --profile selfhost-strict --locked --offline, cargo clippy --workspace --all-targets --locked --offline -- -D warnings, scripts/check_foundation_stdlib_conformance.sh, scripts/check_perf_budgets.sh, scripts/check_runtime_workload_budgets.sh, scripts/check_roadmap_workloads.sh, scripts/check_kernel_tcb_contract.sh, and scripts/check_no_user_panics.sh; input: persistent-collection-closure-sha256:afdccea7c9dead8f85dca7adc2b74a114732cde6b7c3faa0178fdc23f36914ca Evidence 2026-07-16: the normative foundation contract now defines persistent alias behavior, unobservable structural sharing, canonical CoreForm-key observation independent of insertion history/tree shape/evaluator tier, right-biased merge, replacement, missing lookup, vector index/update behavior, logical length limits, and the prohibition on benchmark-shaped recognizers. CoreForm comparison keeps compound keys stack-safe while removing stack-growth setup from every atomic comparison; map lookup and update construct one owned key, avoid redundant clones, and preflight an existence lookup only at the configured length boundary while retaining exact observed-resource counters. Differential and adversarial tests cover every key tag, compound shapes nested 2,048 levels, insertion permutations, stable values/hashes across treewalk and compiled tiers, shared update branches, replacements, right-biased merges, fast-path counters, and replacement-versus-growth behavior at the map limit. Against the unchanged normalized 100,000-entry integer-identity PB-5 workload, the pre-change ten-sample median was 301.892 ms; the final 30 retained semantic-pass samples measured 276.087 ms minimum, 278.141 ms median, 281.216 ms mean, 290.229 ms p95, and 345.923 ms maximum, with 29/30 samples at or below 300 ms and the declared distribution-free upper 95 percent median-confidence rank at 280.339 ms. The complete strict native/WASI workspace and doc-test matrix, warning-denied workspace Clippy, normalized workload contract, foundation conformance, resource/panic/TCB guards, and independent budget gates pass. This closes the general persistent-collection implementation target; R2.1.h still owns a newly signed authoritative baseline, anti-overfit variants, cold/warm separation, and joint PB-5/PB-7 statistical closure.
• R2.1.f Keep the reference path readable. Optimization-specific code remains separated from the semantic evaluator and is continuously differential-tested. done 2026-07-16; evidence: scripts/check_kernel_tcb_contract.sh, cargo test -p gc_kernel --lib --locked --offline, cargo clippy -p gc_kernel --all-targets --locked --offline -- -D warnings, scripts/check_no_user_panics.sh, scripts/check_source_decomposition_progress.sh, scripts/check_doc_hygiene.sh, scripts/check_doc_complexity_budget.sh, and scripts/check_doc_topology_drift.sh; input: kernel-tier-boundary-sha256:8b9786f17e28d80b6657e5cd751106cb7af0656f6387529668719d43d3f28ef2 Evidence 2026-07-16: the normative technical handoff declares the treewalk evaluator as the implementation-level semantic reference and assigns all 23 production kernel files to an exhaustive, non-overlapping role partition: 3 reference-semantics, 9 shared-semantics, 2 explicit tier bridges, and 9 optimized-tier files. The governed TCB policy rejects missing or extra files, unclassified files, optimized files outside the compiled subtree, reference files in that subtree, compiled implementation markers in reference sources, treewalk fallback markers in optimized sources, and a missing default differential suite. Three mutation controls prove that role reassignment, differential-test removal, and optimized-symbol admission to a reference source fail closed. The default seven-case differential matrix covers data/collections, closure shadowing, seal behavior, sealed type errors, unbound names, explicit step exhaustion, and memory exhaustion; it compares success/failure, debug representation, canonical value hash, error kind/message, exact step counts, and semantic memory counters, then reruns every successful case one step short to prevent limit-bypassing happy-path equivalence. All 63 active kernel tests pass with the governed 10-million-iteration stress test retained in its isolated lane, warning-denied Clippy passes, no-panic and source-decomposition guards pass, and all documentation budgets and generated reference views remain fresh. R2.1.g continues to own removal of the explicitly classified workload-recognizer module rather than hiding that separate obligation inside this boundary closure.
• R2.1.g Retire workload-specific recognizers. Delete crates/gc_kernel/src/compiled_runtime/patterns.rs from production dispatch and prohibit replacement recognizers keyed to benchmark source shape, symbol names, literal constants, or expected results. General optimizations must trigger from documented semantic properties, improve a diverse anti-overfit corpus, and preserve exact behavior under source-equivalent rewrites that defeat syntactic recognition. done 2026-07-16; evidence: scripts/check_kernel_tcb_contract.sh, cargo test -p gc_kernel --lib --locked --offline, cargo clippy -p gc_kernel --all-targets --locked --offline -- -D warnings, scripts/check_runtime_workload_budgets.sh, scripts/check_perf_budgets.sh, scripts/check_no_user_panics.sh, and scripts/check_source_decomposition_progress.sh; input: recognizer-retirement-sha256:a18f73bff7504a26c0e243db59ecf98a858e92f3afed5f8c64d640ecf5a2f134 Evidence 2026-07-16: production compiled dispatch no longer contains the 332-line patterns.rs module or either source-shaped shortcut. The removed code matched exact external core/* wrapper names, recursive CExpr shape, integer literal 1, module self-slot identity, nil branch shape, and selected primitive combinations to bulk-return a byte lookup or million-element vector result. The governed TCB surface is now 22 files with 3 reference, 9 shared, 2 bridge, and 8 optimized files. The retired path is a permanent policy tombstone, and every optimized runtime source is scanned for benchmark IDs, exact source-symbol literals, integer-literal matching, match_*/recognize_* helpers, and expected descriptor/hash/value material. Five mutation controls prove role escape, differential-suite removal, reference-tier optimized imports, source-literal recognizers, and retired-path readmission all fail closed. Four renamed and structurally rewritten counted-vector/byte-access variants compare exact reference/optimized result representation, canonical hash, error, step count, and semantic memory counters and fail identically one step short; the existing compiler-derived primitive-forward corpus proves general optimization across renamed, reordered, repeated, ignored, unary, binary, and ternary arguments without source-name or literal matching. The honest normalized PB-4 observation changed from 4.075 ms with the recognizer to 2,160.934 ms through ordinary semantics, while the PB-1 control changed from 279.763 ms to 264.616 ms. PB-4 is therefore explicitly failing its 150 ms target rather than being hidden or rebaselined; R2.1.h now owns PB-4, PB-5, and PB-7 closure and requires a semantically general vector improvement. Ordinary smoke workloads still pass at fib=233 ms, vector build 1 ms, map build 2 ms, self-host parse 271 ms, and dispatch 91 ms; the independent performance gate passes with test_wall=3,157 ms, bootstrap 203 ms, and obligation runtime 185 ms. All 64 active kernel tests pass with the 10-million-tail case retained in its isolated stress lane, warning-denied Clippy passes, and panic/decomposition/document budgets remain green.
• R2.1.h Close PB-4, PB-5, and PB-7 and rebaseline PB-1 without hiding drift. Profile allocation, cycle-collector overhead, evaluation dispatch, hashing, shape transitions, parser/frontend routing, self-host dispatch, and process/startup contribution with normalized workloads; fix general data-structure, evaluator, and parser costs before benchmark-specific tuning. Meet the signed PB-4 vector, PB-5 map, and PB-7 throughput bounds with confidence intervals, anti-overfit variants, cold/warm separation, and no semantic fast-path bypass. Capture a new signed PB-1 distribution on the same conformant hosts after cycle-collection and runtime changes, compare it to the retained historical baseline, attribute statistically and by profile rather than resetting the target, and assign startup-owned cost to R2.3.b. PB-4 closure must recover the honest post-recognizer ordinary-execution baseline through a general optimization that benefits semantically varied vector-building programs; restoring source-shape dispatch is not an eligible improvement. Progress 2026-07-16: a semantics-derived tail-loop plan now resolves recursion by module-closure identity and primitive wrappers by compiler-derived opcode/argument forwarding. It supports conditional tail recurrences, sequential let/begin, branch inversion, and last-use moves while preserving shared persistent branches. It is disabled before argument consumption under step limits, non-default memory limits, or coverage. Renamed, structurally rewritten, and shared-accumulator variants compare exact values, hashes, errors, steps, and memory counters against the reference tier; byte-access nonloops remain unselected, and every one-step-short control falls back and fails identically. Against the unchanged normalized fixtures, 5 warmups plus 30 retained semantic-pass samples measured PB-4 at 122.807 ms minimum, 124.339 ms median, 124.991 ms mean, 128.958 ms p95, and 142.424 ms maximum versus the 150 ms bound; PB-5 measured 64.272 ms minimum, 65.836 ms median, 66.337 ms mean, 71.949 ms p95, and 72.962 ms maximum versus 300 ms. PB-7 remains honestly open: the same protocol measured 4,125.935 ms minimum, 4,263.718 ms median, 4,367.466 ms mean, 4,837.292 ms p95, and 5,304.275 ms maximum. Sampling attributes its cost to more than one million dynamic self-host parser calls plus immutable CoreForm construction, not compiler profile (opt-level 1 and 3 were equivalent) or the retired byte recognizer alone. Trials of generic helper-call caching, tail trampolining, inline argument buffers, primitive arity paths, singleton booleans/nil, and adaptive tiny maps preserved semantics but did not materially move PB-7 and were removed rather than enlarging the TCB without evidence. Completion still requires anti-overfit parser variants, cold/warm separation, authoritative signed samples, and a general parser/execution-tier improvement that meets the PB-7 lower bound. Progress 2026-07-17: R2.2.e’s retained-root-safe map representation preserves PB-5 headroom but changes the adjacent unsolved PB-7 control. Single release-equivalent semantic-pass observations during representation selection measured PB-5 at 75.588 ms and PB-7 at 7,035.009 ms for the selected 4,096-entry/32-way transition, versus 278.728 ms and 36,862.728 ms for a 32-entry transition and 124.248 ms and 18,404.140 ms for a 16,384-entry transition. These are diagnostic controls, not authoritative distributions. R2.1.h must recover the current PB-7 regression through a general parser/map workload improvement before closure; the target, historical samples, and failure status are unchanged.

R2.2 Heap and lifetime semantics

• R2.2.a Specify the value graph. Document ownership, sharing, closure environments, cycles, finalization prohibition or semantics, weak references if any, and host-handle lifetime. done 2026-07-16; evidence: docs/spec/VALUE_EFFECT_HASH.md, scripts/check_doc_topology_drift.sh, scripts/check_doc_hygiene.sh, scripts/check_doc_complexity_budget.sh, and scripts/check_planning_docs_fresh.sh; input: runtime-value-graph-sha256:c796c66e7f79d489d458f003b2b7ca1eab2c978b301017c12a20857a24e3d378 Evidence 2026-07-16: the normative value/hash specification now enumerates every runtime value variant and logical outgoing edge; distinguishes finite CoreForm trees, roots, strong edges, physical sharing, and language-visible identity; defines minimal tree-walk and compiled closure captures; and identifies both direct recursive-module backedges plus indirect cycles through collections, seals, contracts, native partials, and effect continuations. It records the current Rc cycle leak as an explicit R2.2.b blocker rather than confusing total hash cycle breaking with reclamation. The contract prohibits user finalizers, destructors, weak references, resurrection, pointer identity, and collection-trigger semantics; keeps operating-system and device handles outside kernel values in explicitly owned runner tables; defines root retirement across success, error, cancellation, timeout, disconnect, and teardown; separates current shape safety valves from future logical allocation/live-heap accounting; and gives eight fail-closed acceptance constraints for any structural, tracing, arena, or equivalent cycle solution across all execution tiers. The technical handoff and canonical index route implementations and agents to this authority without adding another documentation leaf.
• R2.2.b Choose and implement cycle handling. Prove structural cycle prevention or add deterministic cycle collection/tracing. Long-lived warm sessions may not leak recursive closures or host handles. done 2026-07-16; evidence: cargo test --workspace --all-targets --locked, cargo clippy -p gc_kernel --all-targets --locked -- -D warnings, scripts/check_kernel_tcb_contract.sh, scripts/check_no_user_panics.sh, scripts/check_supply_chain.sh, scripts/check_dependency_mirror_contract.sh, and normalized PB-4/PB-5 samples; input: runtime-cycle-collection-sha256:a4f4c5a327fc6f9408aec3a4a4dad890996216d3009875da351efb08af580587 Evidence 2026-07-16: every allocation that can transitively own a runtime value now uses a small Shared<T> facade over pinned rust-cc 0.6.2 with default features, automatic collection, finalizers, and cleaners disabled; ordinary Rc is confined by a fail-closed source inventory to immutable CoreForm terms and symbol text. Exact manual traces cover vectors, ordered maps, tree-walk and compiled closures, module cells, lexical/inline slots, sealed payloads, native partials, contract handlers/prototypes/metadata/overrides, pure/perform effect programs, and continuations. Collection runs only after the outermost panic-guarded evaluation/application boundary has unwound internal borrows; caller roots and returned values remain live, nested calls cannot trigger collection, and collector failure becomes an explicit internal error rather than a user-input panic. Direct recursive modules, live-root hash stability, every indirect value edge, and 128 repeated retired sessions per tree-walk/compiled tier are regression-tested. The governed TCB now inventories 27 production files and rejects hidden ordinary reference counting, a stale persistent-collection dependency, missing owner/trace/safe-point markers, source-shape recognizers, role escape, or absent differential/reclamation tests through seven mutation controls. Collection representations are isolated in a governed module, keeping the value algebra below both source budgets without raising either ceiling. The complete native, WASI, wasm, effects/replay, warm-session, package, self-host, and all-target workspace suite passes, as do warning-denied kernel Clippy and the no-user-panic gate. Five discarded warmups plus 30 retained semantic-pass samples measured PB-4 at 103.710 ms minimum, 104.085 ms median, 104.196 ms mean, 105.001 ms p95, and 105.232 ms maximum; PB-5 measured 36.996 ms minimum, 38.074 ms median, 38.222 ms mean, 39.766 ms p95, and 39.814 ms maximum. Collection pause and temporary work are documented as linear in the buffered candidate graph, while numeric representation-independent allocation/live-heap ceilings remain explicitly owned by R2.2.c. Host handles remain outside kernel values and their complete teardown matrix remains R2.2.f rather than being delegated to garbage collection.
• R2.2.c Add allocation and heap metering. Charge deterministic logical units independent of allocator internals; expose policy limits and sealed exhaustion errors. done 2026-07-17; evidence: cargo test --workspace --all-targets --locked --offline, cargo clippy -p gc_kernel -p gc_pkg -p gc_prelude -p gc_obligations -p gc_cli_driver --all-targets --locked --offline -- -D warnings, scripts/check_kernel_tcb_contract.sh, scripts/check_no_user_panics.sh, and scripts/check_source_decomposition_progress.sh; input: logical-resource-metering-sha256:5b6f83aafca9f05d5624cc204af6feef0e39d8e29fe0bc72469d7bd24b995c2f Evidence 2026-07-17: the normative value-graph contract now defines exact, allocator-independent units for every CoreForm node, byte, runtime constructor, semantic edge, environment binding, root, alias, and cycle-closing edge; inclusive limits, saturating arithmetic, trusted reset behavior, tier equivalence, safe points, and the boundary between semantic accounting and R2.2.d physical OOM containment are explicit. A session-scoped atomic ledger charges all smart constructors only while a bounded outer evaluation/application transaction is active, with u64::MAX retained as a valid finite limit; cycle-safe iterative live traversal expands physical aliases by logical incoming path and uses owner identity only to terminate an active cycle. Tree-walk and compiled tiers report identical allocation/live counters, disable allocation-eliding plans under memory policy, and replay ordinary curried application events; exact one-unit-short controls fail in both tiers while reset, alias-independence, recursive-cycle termination, constructor-unit, and CoreForm-unit tests prevent representation drift. --max-alloc-units and --max-live-units propagate through CLI, warm-session inheritance, package manifests, obligation cache identity, and minimum-of-CLI/package policy resolution; trusted self-host bootstrap profiles have finite ceilings and retain observed allocation/current-live/peak-live evidence. Internal failures carry typed dimension/observed/limit fields, structured CLI failures preserve them, and language boundaries can produce the reserved unforgeable ERROR seal with core/resource-exhausted plus exact context. The governed TCB inventories 29 production files across reference/shared/bridge/optimized roles, enforces resource implementation and test markers with nine mutation controls, and stays within every declared source ceiling. All 72 active kernel tests (one governed stress case ignored), 73 CLI-driver tests, the added package-policy regression, and the complete native/WASI/WebAssembly/all-target workspace matrix pass together with warning denial, panic policy, and source decomposition.
• R2.2.d Define out-of-memory behavior. Preflight bounded allocations where possible, catch recoverable host allocation failures, and isolate workloads so an untrusted program cannot terminate the daemon. done 2026-07-17; evidence: cargo test --workspace --all-targets --locked --offline, cargo clippy -p gc_kernel -p gc_cli_driver -p gc_cli --all-targets --locked --offline -- -D warnings, scripts/check_warm_protocol_contract.sh, scripts/check_kernel_tcb_contract.sh, and scripts/check_no_user_panics.sh; input: oom-containment-bundle-sha256:fbff64649b3109767f8ec5a8963f9dcf9902084c2dff5a4d5d9e73c109f3ed4c Evidence 2026-07-17: one governed kernel allocation layer now converts capacity arithmetic overflow and recoverable try_reserve_exact failure into explicit KernelErrorKind::MemoryLimit results without inventing a deterministic host limit. User-sized string concatenation, repetition, join, CoreForm escaping, UTF-8 conversion, hex conversion, byte concatenation/join, symbol cloning, and temporary join tables compute exact capacities, enforce semantic shape ceilings before allocation, reserve fallibly, and fill only within the reserved buffer. The compiled-module decoder bounds every declared collection cardinality against the minimum bytes remaining before reservation and fallibly reserves all decoded vectors and strings; a u32::MAX count in a ten-byte hostile blob is rejected without panic or large allocation. Both evaluator tiers fail at the exact nine-byte preflight boundary, capacity overflow is directly regression-tested, and fixed-size residual allocations remain honestly classified as process-containment obligations rather than falsely claimed recoverable. Native macOS/Linux warm and MCP execution already places each untrusted request and its host-bridge descendants in a separately killable and reapable process tree. A previously ambiguous signal exit now becomes a distinct contained-abort result carrying the signal and worker-signal-contained audit; warm emits retryable warm/worker-abort with daemon_available = true, MCP emits its typed server-available equivalent, and measured wall/CPU/heap/output/process/disk kills retain their resource classification. Unlike an inline/WASI panic, a native child abort cannot corrupt parent state, so it increments crash evidence without clearing initialization, workspace bindings, IDs, generation, or queued work. A shipped-binary adversarial bridge sends SIGKILL to its own worker, after which the same initialized daemon successfully executes the next queued GenesisCode program with generation zero and crash count one. Normative docs bind the exact bulk-allocation and isolation boundary and explicitly deny WASI hard-OOM parity. The TCB inventory now governs 30 production files and required allocation controls within unchanged existing ceilings plus one 70-line allocation module; all kernel, warm/MCP, mutation, warning-denial, panic-policy, and workspace target tests pass.
• R2.2.e Bound persistent sharing. Add stress tests for adversarial update chains, retained roots, maps/vectors/strings, package graphs, logs, and snapshots. done 2026-07-17; evidence: cargo test -p gc_kernel --lib --locked --offline, cargo test -p gc_cli --test persistent_sharing_stress --locked --offline, bash scripts/test_perf_gates.sh --test persistent_sharing_stress, cargo clippy -p gc_kernel -p gc_cli --all-targets --locked --offline -- -D warnings, scripts/check_kernel_tcb_contract.sh, and release-equivalent PB-5/PB-7 diagnostic controls; input: persistent-sharing-bounds-sha256:a893c104ed9ad1bf6e85ff894427295c4078f4c6befcf85bda2cbd5111623a54 Evidence 2026-07-17: vectors now use balanced 32-value leaves, while maps use canonical ordered transients with a bounded one-time freeze into 32-way trace-aware pages on the first aliased update at 4,096 entries. Unique updates mutate paths in place; retained updates copy only root-to-leaf paths, values remain observationally immutable, and canonical order, hashes, shape limits, right-biased merge, tracing, and treewalk/compiled equivalence are unchanged. A mandatory non-vacuous kernel test retains 1,025 versions of 4,096-element maps and vectors, verifies original/current values, counts distinct physical nodes, rejects a flat-copy-only map result, and enforces linear-plus-path-copy ceilings. The isolated composite lane retains 4,097 versions at the transition boundary and exercises equally sized strings, package dependencies, canonical effect-log roundtrips, and workspace snapshots under a 16 MiB artifact ceiling and 120-second wall budget; the measured test body completed in 3.26 seconds and the cold incremental gate completed in 70.979 seconds. Allocation-unit computation is now lazy when no allocation policy is active, while every exact bounded-accounting control still passes. Owned compiler forwarding preserves last-use collection ownership without changing reordered or repeated-argument semantics, and was extracted into its own governed optimized-tier module rather than increasing the tail-loop source ceiling. The kernel surface is 33 files, all nine TCB mutation controls pass, and no benchmark/source recognizer was introduced. PB-5 retains substantial margin; the explicit PB-7 diagnostic regression remains assigned to open R2.1.h rather than hidden by this closure.
• R2.2.f Prove host-handle cleanup. Files, sockets, processes, bridges, graphics, GPU, and model sessions close on success, malformed response, disconnection, error, cancellation, timeout, owner drop, and daemon restart; any failed stop, join, reap, or residual-group verification crosses the public boundary as a typed cleanup failure rather than being discarded. done 2026-08-11; evidence: exact-main GitHub Actions standard run 31456950564, full run 31456839013, and independent release_evidence_execution.py verify-aggregate; input: host-handle-lifecycle-closure-sha256:f8dd0073bf8820d3a2935bab30f0858781b0dd5021b63e8af69a114b3a022327 Progress 2026-08-06 (local macOS evidence; task remains open): replaced the process-global persistent-bridge cache with one HostBridgeRuntime owned by each run transaction and routed that owner through every browser, editor, graphics, GPU, XR, package, and low-level capability bridge call. Spawn-per-operation bridges now always run in a killable process group, terminate residual descendants after success and protocol/exit error as well as timeout, reap the leader, and join all I/O pumps before returning. Persistent teardown now signals once, closes request admission, joins the worker that exclusively owns and reaps Child, then performs bounded residual-group verification; owner drop and a fresh owner prove daemon-restart isolation. New regressions cover success, protocol error, timeout, runtime drop, restart, six representative bridge families, no surviving descendants, no live I/O pumps, and joined workers. Two governed 49-case fault-injection campaigns passed with zero failures in 33.235 seconds; the complete gc_effects all-target suite, test_fast_full.sh (111 seconds), native warning-denied Clippy, no-user-panic policy, generated-authority fixed point, WASI compilation, kernel ownership, runtime-workload, and performance-budget guards pass. Completion still requires the declared lifecycle matrix on every supported native host and retained daemon/service restart evidence on reviewed main; this local result does not close R2.2.f or authorize robust-service readiness. Progress 2026-08-08 (local macOS model-provider evidence; task remains open): exercised the frozen genesis.agent-model-runner.v0.1 profile through the real digest-pinned host/plugin::command persistent-stdio dispatch rather than introducing the standard model API owned by R5.4.e. One per-run HostBridgeRuntime reused exactly one provider process, reaped it on owner drop, created an isolated process after restart, returned sealed parse and timeout errors, and left neither provider nor descendant alive after error or hard cancellation. The dedicated success/error/timeout/drop/restart regression passed 20 consecutive executions; three complete parallel gc_effects --all-targets runs also passed after replacing an unrelated order-dependent exact assertion over a process-wide monotonic worker-join counter with a concurrency-safe lower bound. The governed host fault renderer now identifies model-provider processes as a verified hard-cancellation resource while keeping coverage_complete=false, independent_cross_host_evidence=false, and r2_2_f_closeable=false. Kernel-TCB, no-user-panic, execution-profile, runtime-workload, and performance-budget guards pass locally. Completion still requires exact reviewed-main retained evidence on Linux x86_64 plus the remaining supported-host and daemon/service restart matrix; this result does not standardize a model API or close R2.2.f. Progress 2026-08-08 (real warm-daemon lifecycle evidence; task remains open): added a bounded external probe that drives the public genesis/warm-protocol-v0.2 surface through digest-pinned persistent providers rather than simulating an owner restart in-process. Three fresh daemon processes exercised five unique providers and five descendants across successful owner drop, malformed response, hard timeout, generation restart with mandatory renegotiation, active shutdown drain, active EOF drain, and daemon-process restart isolation; every provider process and process group was absent after cleanup, with a local Darwin/arm64 maximum of 42 ms against an 8,000 ms fail-closed bound. Five verifier negative controls reject malformed or duplicate process records and non-persistent transport, detect a live process group, and accept it only after reap. The existing host-fault health report now binds exact Genesis executable, self-host artifact, and probe-source identities, and still emits coverage_complete=false, independent_cross_host_evidence=false, and r2_2_f_closeable=false. The full-profile macos-15 reference lane runs the same probe, while Linux continues through the signed health-profile bundle. The complete local one-run host-fault matrix passed with zero failures in 36.163 seconds. Completion still requires both exact reviewed-main CI artifacts to pass and be independently reconciled; local mutable output does not close P1.5 or R2.2.f. Progress 2026-08-08 (cross-host custody correction; task remains open): an acceptance audit found that the prior workflow uploaded the Darwin daemon report beside, rather than inside, the iOS replay inventory and discarded the authenticated Linux host-fault report after fanout consumption. This was an evidence-custody defect, so the earlier exact-main runs cannot close R2.2.f even if their jobs succeed. The corrected design places the macOS report inside the replay tree, retains the Linux report only in designated stress worker 1, and makes the read-only full aggregate retain both producer records and both report payloads. A new closed reconciler rejects producer-authored closure booleans and independently re-derives all lifecycle paths, resource families, process-tree/reap/quiescence facts, daemon scenarios, cleanup bounds, negative controls, tier-1 Linux x86_64/Darwin arm64 diversity, and shared probe/self-host identities before emitting hostHandleLifecycle.r2_2_f_closeable=true. Thirteen report/summary mutations fail locally. Completion still requires the corrected transaction on reviewed main, a passing exact-main full aggregate containing the four custody artifacts, independent post-download verification, and the ordinary standard profile; no local or pre-correction hosted observation closes P1.5 or R2.2.f. Progress 2026-08-10 (typed persistent-owner cleanup; task remains open): persistent bridge workers now return their own child-reap outcome through JoinHandle<Result<...>>; session eviction preserves a cleanup failure over its initiating transport error; and deterministic multi-session shutdown attempts every session in canonical session-key order before returning a family-scoped bridge-reap. Every effect-run success and error exit explicitly shuts down its HostBridgeRuntime; failure crosses the public Rust and CLI boundaries as EffectsError::Cleanup and evaluator/cleanup facts with cleanup_subsystem, typed reason, and retained prior_error, rather than relying on an infallible Drop. Synthetic negative controls inject a worker reap failure and a simultaneous prior run failure. Focused unit tests, the one 49-case host-bridge fault invocation (71.249 s, zero failed runs), no-user-panic, host-ABI conformance, and the impact-selected test_fast_full.sh integration profile (82 s) pass on local Darwin/arm64. This closes neither spawn-per-operation cleanup-error propagation nor file/socket/graphics/GPU lifecycle breadth, and it supplies no reviewed Linux or exact-main custody evidence; R2.2.f remains open. Progress 2026-08-10 (spawn-per-operation cleanup propagation; task remains open): replaced four discarded kill/reap results and six discarded pump joins with one deterministic finalizer. Thread-start, wait, timeout, and successful-exit paths now retain every started stdin/stdout/stderr pump, attempt all joins in fixed order even when residual process-group verification fails, aggregate cleanup failures, return family-scoped bridge-reap ahead of an operation result, and preserve the initiating timeout or execution error. Test-only faults are injected after real OS cleanup at the reap, residual-verification, and pump-join result boundaries; the public call_host_bridge path reports all three, leaves every real process absent, and the complete active host-bridge unit group passes 11/11 with two governed stress cases intentionally excluded. Completion still requires bounded pump quiescence when the OS cleanup operation itself fails, file/socket/graphics/GPU lifecycle breadth, and reviewed cross-host custody evidence; R2.2.f remains open. Progress 2026-08-10 (first-party network close correction; task remains open): TCP close, pending HTTP response, and WebSocket close now remove their owned handle before teardown and return typed net/cleanup failures instead of discarding them. HTTP attempts write, flush, and bidirectional shutdown in order even after an earlier failure; WebSocket attempts both close-frame emission and shutdown; both aggregate deterministic cleanup diagnostics, and HTTP retains the preceding write error in :prior-error. One public-boundary negative control injects failures only after each real OS action succeeds, proves all actions were reached, and proves every handle is absent before return. The control is part of the existing host-bridge fault campaign rather than a separate repeated suite. UDP close remains infallible removal/drop because its host API has no shutdown operation. R2.2.f remains open for bounded spawn-pump quiescence on failed OS cleanup, filesystem and graphics/GPU/model breadth audit closure, and reviewed cross-host custody evidence. Progress 2026-08-10 (failed-termination pump quiescence; task remains open): spawn-per-operation stdin/stdout/stderr pumps now use nonblocking Unix pipes and an owner-only cancellation signal. If the first process-tree termination attempt fails before touching the child, cleanup cancels and joins every pump in fixed order, then performs a separate fallback termination/reap and reports the original failure as family-scoped bridge-reap with the initiating timeout retained. Process control also returns immediately when both process-group signaling and leader kill fail instead of entering an unbounded wait. The existing public cleanup-fault test now injects a true pre-cleanup termination failure against a live hanging process, completes locally in 0.20 seconds, and verifies every recorded leader and descendant exits. R2.2.f remains open for filesystem and graphics/GPU/model breadth audit closure plus reviewed cross-host custody evidence. Progress 2026-08-10 (warm/MCP isolated-worker cleanup propagation; task remains open): the shared native worker now owns cancellable nonblocking stdout/stderr readers and converges setup failure, cancellation, deadline, every resource limit, wait failure, normal exit, and residual cleanup through one deterministic finalizer. Failed process-tree termination cancels both readers before a bounded fallback kill/reap; initial stop failures, fallback failures, residual-group failures, pipe read failures, join failures, and post-join liveness are aggregated rather than discarded. Cleanup takes precedence over the initiating outcome as warm/worker-cleanup: warm resets generation, initialization, workspaces, request IDs, and queued work, while MCP terminalizes accepted calls; either surface stops admission when containment is unproven. Fault controls exercise a live hanging worker, residual verification, pipe join, cancellation precedence, and both public protocols. The host-lifecycle renderer now rejects absent exact tests instead of treating Cargo’s vacuous zero-test success as evidence; its independent reconciler, release schema, and profile-topology guard require the same complete control set. Warning-denied gc_cli_driver Clippy and the governed warm protocol matrix pass; the corrected one-run host lifecycle campaign passed all controls with zero failures in 116.512 seconds and reaped all five daemon providers and descendants within 27 ms. A production-owner audit found filesystem handles operation-scoped, graphics/GPU handles RAII-scoped, and model sessions covered by explicit bridge shutdown, but also found that TaskWorkerPool::drop still discards thread-join failures and has no explicit fallible drain boundary. That task-pool defect and reviewed exact-main Linux x86_64 plus Darwin arm64 custody evidence remain before R2.2.f can close. Progress 2026-08-10 (task-worker explicit drain; task remains open): every effect-run exit now cancels all owned running jobs, closes task admission, joins workers in creation order, verifies per-pool post-join liveness, and then independently shuts down host bridges. Task and bridge cleanup failures are aggregated in deterministic owner order, retain the preceding run error, and cross the public boundary as typed EffectsError::Cleanup; Drop remains only a best-effort fallback after the explicit path. A post-cleanup fault control runs a real five-second task, proves cooperative cancellation and complete worker quiescence in under one second, and proves the injected join failure survives the public run boundary; simultaneous task/bridge failure and existing parallel-task controls also pass with warning-denied Clippy. The lifecycle evidence now requires this control while explicitly documenting that in-thread cancellation is cooperative rather than hard preemption. Local lifecycle implementation breadth is closed for the currently shipped owners, but R2.2.f remains open until the corrected exact-main Linux x86_64 and Darwin arm64 custody artifacts pass independent reconciliation. Progress 2026-08-08 (public cleanup-error correction; task remains open): review found that persistent timeout cleanup propagates bridge-reap, but worker disconnection, malformed-response session eviction, runtime clear, and owner drop can discard the same stop() failure; the existing synthetic test calls stop() directly and therefore does not prove the public operation boundary. P1.5 now requires a fallible explicit close/drain path, deterministic combined operation-plus-cleanup diagnostics, and public-path fault injection that forces signal, reap, join, and residual verification failures. No cross-host aggregate may set r2_2_f_closeable=true until those mutations are killed and every tested failure leaves no detached worker or surviving descendant. Evidence 2026-08-11: exact reviewed main commit 3c58f21d47282b97f05b586ae131fc639d523ef8 passed the ordinary standard profile in GitHub Actions run 31456950564 and the full release-evidence DAG in run 31456839013. The downloaded five-file aggregate was verified offline by python3 scripts/lib/release_evidence_execution.py verify-aggregate --report /tmp/genesis-r2.2.f-aggregate.LndOTZ/manifest.json; the verifier independently re-derived status=pass, complete custody, cross-host identity agreement, and r2_2_f_closeable=true rather than trusting producer booleans. Linux x86_64 supplied the complete host-fault/daemon matrix with a 16 ms maximum cleanup and report SHA-256 4d3dd3c4af2bbbd9928cb975279a25567bba5b2fde9a6306ff671c52039ec409; Darwin arm64 supplied the public warm-daemon lifecycle with a 40 ms maximum against the 8,000 ms bound and report SHA-256 449831954002e77a1fddaad362c35f8818182eb1bf8d8449b358af523d1e75b6. Producer custody hashes are 6d66d9f16c3d60bb872f5afff7f9fe84e19d03351d571da146c3ece13a2ba701 and 2d0f128b2a6f759f79aa382338c781677085fcc3678f0dc5993bb4a6de1ec4d0; shared probe and self-host identities are d7d6b1b1843a3b1f4ce3033013a3d05de9121cb398add7fac0fb9943cd8b21d8 and 9e5774160bae044f72847fcb5f120ce0ca50fe36fc18d9a24b8d84a183801c54. The reconciled resource families are filesystem, network, process, plugin, model-provider process, and warm-daemon provider process across success, error, cancellation, timeout, owner drop, restart, and repeated load, with all 14 required public-boundary controls present. The aggregate remains correctly non-release (productReleaseQualified=false, readinessStatus=unsupported-product). This closes P1.5 and R2.2.f without claiming unsupported product or platform readiness.

R2.3 Startup and incremental execution

• R2.3.a Build deterministic component snapshots. Version and hash the compiled Prelude/environment plus separately addressable frontend, type/effect, patch/refactor, package/VCS, compiler, and orchestration self-host components. A closed composition manifest binds exact component, dependency, semantic-profile, target, and stage0 identities; commands load only the components in their declared dependency closure, rebuild every component from source reproducibly, and reject wrong, missing, duplicate, reordered, cyclic, platform-incompatible, or profile-incompatible identities. A combined artifact may remain a distribution envelope, but it cannot force unrelated parse/fmt/hash commands to initialize the typechecker or another unused authority.
• R2.3.b Meet PB-6 and reverse startup/PB-1 drift. Attribute process creation and dynamic loading, per-component self-host artifact loading, catalog/card/schema loading, Prelude construction, snapshot validation, cycle-collector initialization, evaluator-only fib(25), and teardown separately under cold and warm profiles; reconcile these measurements with R2.1.h’s signed PB-1 distribution. Measure unrelated-command working-set and latency deltas when each semantic authority is added, and reject dependency-theater loading or a monolithic snapshot that hides those costs. Remove or defer nonessential work before adding caches. Load deterministic snapshots with bounded validation and no semantic dependence on cache state; preserve a source-bootstrap mode for verification and prove both modes agree. Ratchet PB-1/PB-6 only from conformant retained samples and never relabel runtime regression as startup improvement.
• R2.3.c Content-address frontend stages. Cache parse, canonicalization, type/effect inference, obligations, compiled AST, and tests by complete semantic inputs.
• R2.3.d Add precise invalidation. Track imports, capability schemas, contracts, profile versions, and generated cards. Negative tests prove stale results cannot be reused.
• R2.3.e Optimize large workspaces. Incremental check/test and symbol/card retrieval meet AB-4 at 100 modules and have explicit SLOs at 10k modules.

R2.4 Runtime observability without semantic leakage

• R2.4.a Add deterministic logical profiles. Count calls, steps, allocations, collection operations, effects, and cache decisions without embedding host addresses or unstable clocks in artifacts.
• R2.4.b Keep wall-clock telemetry out of replay identity. Performance reports may include host time as metadata, but semantic logs and hashes remain deterministic.
• R2.4.c Provide explainable hot paths. Map profile sites back to stable module/term IDs and generate optimization suggestions that require evidence before application.

R2 exit criteria: PB-1, PB-4, PB-5, PB-6, PB-7, and PB-8 pass on normalized workloads; closure/tail/heap/handle stress tests pass; all exhaustion paths return sealed or explicit errors; incremental invalidation negative controls pass; treewalk and compiled modes retain PB-9 semantic identity.

---

R3. Validated execution tiers

Goal: gain predictable speed without enlarging the semantic TCB or fragmenting effects, errors, resource accounting, and canonical identity.

R3.1 Bytecode contract and verifier

• R3.1.a Specify a versioned bytecode. Define instructions, constants, frames, closures, tail calls, spans, resource charges, serialization, validation, and compatibility/migration.
• R3.1.b Implement an independent verifier. Reject malformed control flow, stack/type errors, invalid constants, out-of-range indices, forged seals, unsupported effects, oversized artifacts, and version confusion before execution.
• R3.1.c Build the VM outside TCB-A. The bytecode producer and optimizer are untrusted; only verified artifacts execute, and authoritative semantics remain comparison oracle.
• R3.1.d Match resource semantics. Step/allocation/effect/heap budgets map to documented logical units; tier switching cannot evade a limit.
• R3.1.e Add complete differential coverage. Generate and mutate pure/effectful programs; compare values, canonical hashes, sealed errors, logs, scheduling, and limits across treewalk, compiled AST, and bytecode.
• R3.1.f Meet PB-2. Publish workload-normalized samples and regression thresholds without compromising PB-9.

R3.2 WebAssembly/stage2 closure

• R3.2.a Audit existing wasmi coverage. Generate a per-form/per-primitive/per-effect matrix and replace unsupported silent fallback with explicit profile negotiation or failure.
• R3.2.b Validate translation. Compare source/CoreForm semantics with emitted module behavior and independently validate embedded source/artifact hashes.
• R3.2.c Unify resource/capability enforcement. WASI imports and host functions use the same deny-by-default policy, path normalization, cancellation, payload, and log contracts.
• R3.2.d Fuzz the boundary. Mutate modules, imports, memories, tables, traps, resource limits, and host responses; no malformed artifact reaches a panic or capability bypass.

R3.3 Optimizer and tier controller

• R3.3.a Give every rewrite an identity and precondition. Rewrites are pure, versioned, independently testable, and disabled when their proof/precondition cannot be established.
• R3.3.b Translation-validate optimized units. Use equivalence checks, property tests, replay comparison, and bounded proof methods appropriate to the unit; fall back safely on uncertainty.
• R3.3.c Make tier decisions reproducible. Inputs are deterministic logical profiles and versioned thresholds, not hidden wall-clock races. Record decisions outside semantic identity where appropriate.
• R3.3.d Add deoptimization/fallback tests. Unsupported or failed optimization returns to a verified lower tier without duplicated effects or changed errors.

R3.4 Conditional JIT decision gate

• R3.4.a Measure the product gap after R2/R3. Use flagship and agent workloads, not only fib, to determine whether bytecode/snapshot/warm execution misses v1 latency or throughput SLOs.
• R3.4.b Write an architecture decision record. Compare no JIT, Wasmtime/Cranelift, native AOT, and specialization by binary size, startup, platform reach, memory, compile time, trust, maintenance, and measured gain.
• R3.4.c Implement only if justified. A JIT is feature-gated, optional on constrained targets, translation-validated, sandboxed, and excluded from canonical outputs. Bytecode and wasmi remain complete fallbacks.
• R3.4.d If implemented, meet PB-3. Include code-cache integrity, W^X, architecture fuzzing, deterministic tier decisions, and safe deoptimization.

R3 exit criteria: versioned bytecode and independent verification pass adversarial tests; PB-2 and PB-9 pass; stage2 coverage has no undeclared fallback; resource/capability behavior is identical across tiers. R3.4 may close with a documented “not required for v1” decision if product SLOs are met.

---

R4. Self-host semantic authority and bootstrap closure

Goal: make the toolchain above a minimal host genuinely GenesisCode-authored, independently verifiable, and reproducibly bootstrapped.

Demonstrable critical-path checkpoints: SH-A is the complete R4.1 truth/boundary package; SH-B is R4.2.a frontend/canonicalization at H2 on native and WASI with strict no fallback; SH-C is R4.2.b-e non-codegen semantic authority at H2 with legacy-route deletion controls; SH-D is R4.2.f-g plus R4.4.a-b and a hermetic one-reference-host stage2/stage3 rehearsal. Each checkpoint emits a runnable content-addressed artifact, ownership-ledger delta, differential and adversarial evidence, explicit remaining H-levels, and the next blocking edge. Only complete R4.4.c-e and R4.5 evidence can establish cross-host H3/H4 or close R4.

R4.1 Define self-host truth precisely

• R4.1.a Publish the stage0 contract. Keep TCB-A limited to the pure evaluator, immutable values/primitives, and seal machinery. Enumerate bytecode/artifact verification and the effect-host ABI as separate, explicitly layered trust domains; state exactly which host semantics remain trusted and why. done 2026-08-11; evidence: scripts/check_selfhost_boundary.sh --strict, scripts/check_selfhost_readiness_scorecard.sh, and scripts/check_source_decomposition_progress.sh; input: stage0-trust-contract-sha256:9e59cb97538ffbb39156085a1e71997ba00f759c277a51724527795ac6f31651 Evidence 2026-08-11: docs/spec/SELF_HOST_BOUNDARY.md now defines six ordered responsibility domains: S0-K pure semantics, S0-R CoreForm representation/identity, S0-P protocol/bootstrap assembly, S0-X compiled artifact validation/execution, S0-A artifact identity/admission, and S0-H effect-host containment. Only S0-K is TCB-A; broad crate membership, routing, implementation language, and binary linkage grant no authority. The content-addressed machine authority binds the exact normative prose (b7da4f4a7a38ea0d62fb9c1f443b783a032ba767883f8c8d49e59e48a5e6fc3a) and closed schema (07136db8aedfd0f9092d88c02498b4e6c8e6772ae1b712b3924eb5ac38232c9c), enumerates current implementation anchors, forbidden authority, demotion tasks, identity inputs, and five residual host assumptions, and reserves exhaustive source membership/dependency enforcement for R4.1.e. The existing boundary gate validates this authority before any diff-mode early exit; its independent hardcoded inventory rejects 20 authority, identity, schema/prose, anchor, ordering, and duplicate-key mutations. Strict production-source scanning and source-decomposition checks pass. The readiness guard also passes while truthfully reporting score 67 and dimension-failure; this closure establishes no H1-H4 level, production authority switch, bootstrap fixpoint, release readiness, or downstream-product authorization.
• R4.1.b Define closure levels. H0 routed, H1 GenesisCode implementation, H2 GenesisCode production authority, H3 reproducible bootstrap fixpoint, H4 independently reimplemented/conformant. done 2026-08-11; evidence: scripts/check_selfhost_boundary.sh --strict, scripts/check_selfhost_readiness_scorecard.sh, and scripts/check_source_decomposition_progress.sh; input: selfhost-closure-levels-sha256:93c437824ac6d5a8f6b022f66b898b0cca8d56ef317a99db710fe8ecb53eebdc Evidence 2026-08-11: docs/spec/SELFHOST_CLOSURE_LEVELS_v0.1.md and its closed machine authority define H0-H4 as cumulative predicates on an exact semantic decision/profile key, distinguish the non-promoting N/A applicability dispositions from closure, require sole reachable GenesisCode production authority and independently checked fallback absence at H2, repeated cross-host stage2/stage3 identity plus DDC or equivalent source binding at H3, and separately custodied implementation/proof-checker independence with hidden controls at H4. The authority binds the normative prose (73165edccc1c1f9ca7c810260dd49552e2839b3209a93235232757459875ace8), schema (60dc6a4d860dc761f68d13c10bcc977a43e08fe39719b54154b7dec7e7d5391c), and stage0 contract (9e59cb97538ffbb39156085a1e71997ba00f759c277a51724527795ac6f31651). The boundary gate validates it before diff-mode exits and rejects 21 hardcoded level, evidence, fallback, fixpoint, DDC, independence, aggregation, applicability, schema, prose, and identity mutations. Strict boundary and decomposition guards pass; the readiness guard remains truthfully 67/not ready. This closure assigns no H-level, changes no production authority, proves no bootstrap fixpoint, and authorizes no downstream product.
• R4.1.c Build a semantic-ownership ledger. For every command and semantic decision, name spec authority, producing implementation, production authority, host binding, verifier, fallback reachability, tests, and H-level. done 2026-08-11; evidence: scripts/check_selfhost_boundary.sh --strict, scripts/check_selfhost_readiness_scorecard.sh, and scripts/check_source_decomposition_progress.sh; input: semantic-ownership-ledger-sha256:3e1ae2f6d6bf0e2565712de4c177f9067f692aa72f2181febd7e79d054a2145b Evidence 2026-08-11: docs/spec/SEMANTIC_OWNERSHIP_LEDGER_v0.1.json binds every visible and hidden Clap leaf through 35 exact, non-overlapping selectors covering 114 commands and maps them to 37 closed semantic-decision rows. Every row names normative specs, producing and production implementations, stage0/host bindings, verifier and test paths, fallback reachability, rollback posture, command backlinks, migration tasks, limitations, applicability, and current H-level. The source parser follows the full cli_args.rs include closure, derives kebab-case and explicit names, includes two hidden benchmark crypto commands, and fails on any new, removed, renamed, duplicated, hidden, uncovered, or multiply covered leaf. Routing is a distinct H0 decision, residual S0-K/S0-H trust is non-promoting, and 24 applicable functional decision families truthfully remain below H0 rather than inheriting the routing dashboard’s status. The ledger binds its prose (8d9fe2aed71fd82b49917ed8e0e640088fc00bf1ed81e954fc7c0189c8cebd03), schema (c3bc52735a9d992a88857fc807de0dd9a605ab67d931ca24445596a0a57cfe74), and closure contract (93c437824ac6d5a8f6b022f66b898b0cca8d56ef317a99db710fe8ecb53eebdc); 25 independent mutations reject command, decision, path, fallback, applicability, H-level, schema, prose, duplicate-key, and identity drift. Strict boundary/decomposition guards pass and readiness remains truthfully 67/not ready; no authority, fallback, bootstrap, release, or downstream-product claim changed.
• R4.1.d Correct status documents. SELFHOST_CUTOVER, module-boundary migration tables, scorecards, and dashboards must never equate a .gc wrapper or route with H2/H3 closure. done 2026-08-11; evidence: scripts/check_selfhost_boundary.sh --strict, scripts/check_selfhost_readiness_scorecard.sh, and scripts/check_source_decomposition_progress.sh; input: semantic-ownership-ledger-sha256:3e1ae2f6d6bf0e2565712de4c177f9067f692aa72f2181febd7e79d054a2145b Evidence 2026-08-11: the generated docs/status/SELFHOST_AUTHORITY_v0.1.md is now an exact projection of all 37 semantic-decision rows rather than 18 broad capability labels: 35 decisions are applicable, 24 remain below H0, 11 are H0, two are declared non-promoting stage0 residuals, and none are H1-H4. SELFHOST_CUTOVER retains its independently checked 100% command-routing observation while naming the exact ledger and explicitly denying promotion of functional decisions. The readiness scorecard validates the sealed semantic ledger and adds fail-closed H2 authority and H3 fixpoint dimensions with exact blocker rows and ledger identity; it passes as a read-only check while truthfully reporting 50/not ready and dimension-failure. The 20-row module map and machine policy replace the overclaiming migrated status with structurally enforced route-present, redefine phases as route/decomposition observations, and reserve authority/fallback changes for the decision ledger and R4.2 tasks. Status parity rejects stale decision counts, routed-only promotion, legacy migration labels, and missing authority references. The canonical generated-authority transaction passed all 26 selected downstream checks; strict boundary and source-decomposition guards pass with the observed source maximum at 690/700 lines. No H-level, production authority, fallback reachability, bootstrap fixpoint, release status, or downstream-product authorization changed.
• R4.1.e Enforce the boundary structurally. Crate dependency rules prevent stage0 from importing CLI, package, registry, optimizer, self-host frontend, or ambient effect semantics. done 2026-08-11; evidence: scripts/check_selfhost_boundary.sh --strict, scripts/check_selfhost_readiness_scorecard.sh, and scripts/check_source_decomposition_progress.sh; input: stage0-dependency-boundary-sha256:379d9a5a41c886829413ed3010d681a3d12bbff70c98a4978ada9c2326f2574c Evidence 2026-08-11: docs/spec/STAGE0_DEPENDENCY_BOUNDARY_v0.1.json binds the exact three-crate production graph (gc_coreform -> none, gc_kernel -> gc_coreform, gc_prelude -> gc_coreform plus gc_kernel) to the six-domain stage0 trust contract. Each row freezes its manifest, direct production/build/dev dependency classes, feature definitions, workspace closure, and a root-independent digest over every resolved non-dev package identity, enabled feature, target-qualified edge, and package count: 47 packages for CoreForm, 51 for the kernel, and 65 for Prelude. Every non-stage0 workspace crate and 16 ambient-runtime package families are denied; production Rust sources and the declared Prelude build script must be regular non-symlink files, cannot import forbidden workspace crates, cannot escape through #[path], and expose only three exact reviewed include* lines. The strict boundary gate validates the closed prose/schema/policy authority and rejects 21 independent mutations covering manifests, direct and resolved dependencies, feature activation, package counts, source imports/escapes, trust binding, schema/prose, duplicate keys, and identity. Readiness remains truthfully 50/not ready, and source decomposition remains within 690/700 lines. This closure changes no semantic decision, H-level, production authority, fallback, bootstrap fixpoint, release status, or downstream-product authorization.

R4.2 Migrate semantic authorities

Each component follows the same sequence: normative corpus -> closed decision and call-site inventory -> GenesisCode implementation -> differential verifier -> production switch -> strict no-fallback profile -> Rust authority removal/demotion -> ownership-ledger update. A task cannot close while an applicable ledger row names only completed migration tasks but remains below its required level; every residual decision must name a still-open owner, an explicit stage0 disposition, or a separately justified non-applicability record.

• R4.2.a Frontend source canonicalization. Source parsing, formatting, source-to-CoreForm lowering/printing, frontend module identity/hash, exact source spans, and the production frontend profile become GenesisCode-produced with a minimal independent verifier for those identity-critical frontend artifacts. Non-frontend canonical term, VCS, semantic-patch, package, compiled, and bootstrap artifact identities remain assigned to their later authority and bootstrap tasks. done 2026-08-11; evidence: cargo test -p gc_cli_driver frontend_hash_transport_requires_canonical_lowercase_hex -- --nocapture, cargo test -p gc_obligations selfhost_frontend -- --nocapture, scripts/selfhost_frontend_authority_guard.sh, scripts/check_selfhost_boundary.sh --strict, scripts/check_selfhost_readiness_scorecard.sh, and scripts/check_source_decomposition_progress.sh; input: selfhost-frontend-authority-sha256:763f89ec2fa28eecc628130cf3a996dd490a4e18cdd2ba7455fd349502c6be39 Evidence 2026-08-11: core/cli::frontend-module now produces one closed eight-field genesis/frontend-module-v0.1 result containing canonical forms/source, normative module identity, exact UTF-8 source span, and genesis/coreform-canon-hash-v0.2; native CLI, WASI CLI, runtime/replay, and package-obligation consumers validate and decode that result without a reachable production parser, canonicalizer, printer, or hash fallback. The retained GenesisCode artifact is a230e9be416a94d9bde27340ac834261d744c568927ff2a003d973390398d637 from source identity b38da27f1892b0a2f530c6c9dfa7e49f29ff826dbab946543f2cefbd9c241cfc. The independent Python verifier imports no implementation crate, recomputes the domain-separated BLAKE3 identity, and passed 16 native/WASI runtime observations over three canonicalization/hash vectors plus malformed parse/fmt behavior; nine mutations reject schema/hash/profile/span tampering, missing authority, and restored fallback. Focused Rust controls additionally reject nonclosed results, wrong profiles/spans, and uppercase or padded authority hashes. The semantic ledger identity 63d83038edda3ced2cc87db807d5d26462f387085eaa97b92f8e63fd313dd046 assigns H2 only to exact source decode, source printing, and frontend canonical identity decisions while 24 applicable decisions remain below H0 and non-frontend term/artifact identities remain H0. Strict boundary validation passed with the resealed Stage0 trust (a44f3030762c4fe6cc10404ed737bf3c2a9d459e12012c375b4e968adab2c8b8), dependency (dccf60783253db5410b435e09fae49d7e50044c9c2f3b5d202dfc5cf50dce2d2), and closure (18be84e1619f5efc9e0094efbb9d76a93a7707910109917afdb650b3cd3c0868) authorities and their 20/21/21 negative controls; source decomposition is 698/700 lines. Readiness remains truthfully 52/not ready: this closes SH-B only and proves no H3/H4 bootstrap, exhaustive parser conformance, type/effect/compiler authority, release readiness, or downstream-product authorization; the profile and local verifier alone retain their explicit no-self-promotion nonclaim.
• R4.2.b Type and effect checker authority. Publish the normative decision inventory and closed authority contract in docs/spec/SELFHOST_TYPECHECK_AUTHORITY_v0.1.md, its machine profile in policies/selfhost_typecheck_authority_v0.1.json, the independent static verifier in scripts/lib/selfhost_typecheck_authority.py, and the native/WASI runtime harness at scripts/selfhost_typecheck_authority_guard.sh. Bind the static verifier into the governed scripts/check_selfhost_boundary.sh execution-profile gate and run the runtime harness before closure, because generic readiness/decomposition observations cannot authorize the switch. The inventory covers every production call site and observable fact for constraint generation, type constructors and compatibility, row/effect polymorphism, typed and syntactic effect inference, contracts and blame, unknown imported signatures, package context/exports, deterministic module resolution, contract composition, profile negotiation/migration, diagnostics and repair identities, capability summaries, ABI generation, determinism obligations, incremental dependency keys/invalidation, native/WASI routes, and resource accounting. Execute the normative pipeline in one frozen order equivalent to context collection -> profile negotiation -> contract composition -> module resolution -> module checking; bind each response to the exact ordered request module set, paths, forms/meta identities, profile offer, checker artifact, and semantic-profile identities. Decoders reject omitted, extra, duplicate, renamed, or reordered modules; duplicate or undeclared exports; nonclosed schemas; contradictory aggregate/module/export/profile :ok and error facts; incoherent active/identity/requirements/selection profile reports; and any missing report rather than synthesizing empty effects, gradual types, or unknown=false. Incremental results use complete content-addressed semantic inputs and are byte-equivalent to clean full recomputation after source, import, contract, capability, profile, card/schema, or dependency changes; stale, partial, cross-profile, and cyclic state fails closed. Differential coverage spans the complete normative corpus and generated/property cases, with minimized permanent counterexamples and mutations for malformed constructors/rows/contracts, shadowing, imported signatures, report tampering, request/report inventory attacks, resource exhaustion, and restored fallback. Native and WASI production observations agree on canonical reports, diagnostics, hashes, limits, and failure behavior. The independent verifier consumes the closed request/report bundle without gc_types, the producing self-host artifact, or mutable cache state. Rust checker code is removed from production dependencies or isolated in a compile-time parity-only crate/binary with no ordinary library setter, environment flag, CLI route, obligation path, ABI path, or release-graph reachability; no Rust effect inference or report default remains hidden outside the named oracle. Record checker and unrelated-command cold/warm latency, peak RSS, artifact size, step/allocation bounds, and component-loading closure; meet existing budgets or assign optimization to R2.3 without claiming authority completion. The task cannot close until every manifest-listed production .gc source is discovered by the decomposition guard, unknown over-budget files fail, each module is within the budget or has a bounded non-expired waiver, all declared authority artifacts are fresh, and the ledger reaches H2 for the exact type/effect decision set. Rust then remains only an independently invoked oracle for a bounded compatibility window or is removed. done 2026-08-11; evidence: cargo test -p gc_types inferred_record_rows_only_promote_parseable_symbol_labels, cargo test -p gc_obligations --features parity-oracle selfhost_typecheck_matches_real_failure_corpus_regressions -- --nocapture, scripts/check_selfhost_artifact_fresh.sh, and scripts/selfhost_typecheck_authority_guard.sh; input: selfhost-typecheck-authority-sha256:6fad624ec15f652dad561cd8b332e7f1aa87560d396568bd9cb0281c167313a4 Evidence 2026-08-11: core/cli::typecheck-package is now the production authority for the closed type/effect report consumed by package obligations, capability summaries, ABI generation, and determinism checks. The production decoder binds exact ordered module paths and request inventories, declared and inferred types, effect rows, diagnostics, profile negotiation, checker artifact identity, semantic profiles, and aggregate consistency; malformed, missing, duplicate, reordered, contradictory, or synthesized facts fail closed. Twenty-two focused GenesisCode checker modules are included in the reviewed 60-module toolchain, while gc_types is absent from ordinary production dependency graphs and remains available only through the compile-time parity-oracle feature and the separately invoked parity binary. Incremental obligation keys now bind source/dependency requests, limits, prior artifact bytes, the checker authority profile/schema, and diagnostic catalog, so semantic-authority changes invalidate stale results. The independent verifier imports neither gc_types nor the producer and passed eight profile/schema mutations, native/WASI valid and invalid observations, low step and allocation controls, unrelated-command no-load controls, exact reviewed fixed-point artifact measurement (0825decc640c8b236b27ae3407bd31a1872d3fe0be92ce6cb37db25fe1346e5d, 1,470,627 bytes), and the complete 25-fixture corpus (86db6ed0d0894bbf332cae7b0030fcac7265199838390ca25c861ecb663959c6). The differential corpus found and permanently covered real defects in local-Any export effects, nested function effect inference, non-symbol map labels, dynamic diagnostic construction, and missing-export effect inventories before reaching exact semantic parity. Closed discovery covers every manifest-listed source within the repository-wide 700-line ceiling; focused checker modules report a 671-line maximum, and the semantic ledger assigns the exact type/effect decision set H2. Cold/warm timing and peak-RSS measurements are retained only as E0 observations and PB-6 remains assigned to R2.3 with no performance claim. This closure claims no H3/H4 bootstrap fixpoint, compiler/package/patch/obligation authority, release readiness, or GenesisBench, Foundry, Challenge, or Model authorization.
• R4.2.c Patch and refactor engine. Semantic diff/apply/merge, preconditions, conflict explanations, patch minimization, and semantic-patch canonical identities become GenesisCode-authoritative; patch identity ownership cannot remain attributed to completed R4.2.a. done 2026-08-11; evidence: cargo test -p gc_cli --features parity-harness --test cli_typecheck_apply_patch_engine apply_patch_selfhost_frontend_matches_rust_frontend_artifacts --locked --offline --quiet, scripts/selfhost_patch_authority_guard.sh, scripts/selfhost_typecheck_authority_guard.sh, scripts/check_selfhost_boundary.sh --strict, scripts/check_selfhost_readiness_scorecard.sh, and scripts/check_source_decomposition_progress.sh; input: selfhost-patch-authority-sha256:de3f539333313b3019c2bbea6a73fdd57612241751d537e4380d5b783365861d Evidence 2026-08-11: the 12-module GenesisCode patch pipeline is the production semantic authority for normalized operations, preconditions and conflict explanations, minimized workspace diff, deterministic three-way merge, refactor plans, final apply outcomes, and patch/report/acceptance/package identities. The independently authored Python verifier imports no patch implementation crate, binds the closed authority profile and exact manifest source inventory, and proves the final gc_cli and gc_wasi_cli production graphs exclude both gc_cli_driver_parity and gc_patches/parity-oracle. Dedicated parity binaries require explicit opt-in; source-aware custody gates exactly 104 direct or helper-mediated parity tests across 33 files while preserving 45 unrelated production tests in those files for default cargo test, and three controls reject transitive/direct under-gating and unrelated over-gating. Native and WASI production entrypoints produced identical patch (f86de3442ccc25b83aa3eaea9d19d2f41904b94f6db1dcd405c98a4656e6ba16), report (7be7b7c503063f2964ccfebd1bc58387f5ee50fa78df716ead9bee3e510542b9), acceptance (41cefc2b01683f57aedab17857b0c4c20f0e7599bf20dac2b97dd929fe62b113), and package (589d10261586b7622e2e307dcf96a67e11cfda16d0343d739845ee79f874fd29) artifacts; both rejected the low-step control with exit 10 and left workspace source unchanged. Nine closed-profile mutations reject inventory, entrypoint, oracle, eligibility, resource, unknown-field, and stale-identity drift. The semantic ledger identity 68602c1a786d8df9b218e3550b88c8421d7ba469d4a65bf044f4f7b0869beead assigns only SD-PATCH H2 with none-proven fallback; Rust remains separately invocable solely through the opt-in compatibility harness until its 2026-11-11 sunset review. Strict boundary and decomposition guards pass at 687/700 lines, while readiness truthfully remains 53/not ready. This closure establishes no H3/H4 bootstrap fixpoint, obligation/package/compiler/CLI authority, release readiness, or downstream-product authorization.
• R4.2.d Obligation and policy decision logic. Obligation generation/evaluation and policy composition become GenesisCode-authored. Host code enforces already-authorized effects but does not invent policy outcomes. done 2026-08-13; evidence: python3 scripts/lib/selfhost_evidence_verify_authority.py --root . --profile policies/selfhost_evidence_verify_authority_v0.1.json --schema docs/spec/SELFHOST_EVIDENCE_VERIFY_AUTHORITY_v0.1.schema.json --artifact selfhost/toolchain.gc --self-test, bash scripts/test_fast_full.sh, scripts/check_selfhost_boundary.sh, scripts/check_selfhost_readiness_scorecard.sh, and scripts/check_source_decomposition_progress.sh; input: selfhost-evidence-verify-authority-sha256:f226266c6cb496a3ffca74d7a6e8ea35a8afead1b0206f7541edba2609ec6596 Progress 2026-08-11: SD-POLICY-ALIAS is H2 under genesis/selfhost-policy-alias-authority-v0.1. core/cli::policy-authority now exclusively normalizes local policy configs and resolves or mutates aliases/defaults in production; native and WASI agree on canonical Unicode-trimmed aliases, lowercase direct hashes, exit-10 parse denials, exit-50 selection denials, and denial non-mutation. The Rust semantic implementation is compile-time parity-harness only, while host TOML/filesystem transport remains explicit. The independent verifier rejects ten profile mutations and production-graph fallback. This is partial progress only: SD-EFFECT-POLICY, SD-REPLAY, SD-OBLIGATION, SD-SIGNING, and SD-EVIDENCE-VERIFY remain below H0, so R4.2.d and SH-C remain open. Progress 2026-08-11: core/cli::obligation-authority is now the sole production semantic producer for core/obligation::unit-tests expectation decisions, core/obligation::budgets threshold decisions, and core/obligation::capabilities-declared suite ownership and observed-operation membership decisions under partial profile identity 1a3f1ddeb9aaa341d79fd6a64b69f7bafa8ce39d587b368d4818add88e64fd93. Rust supplies only ordered primitive observations, invokes the exact selected self-host artifact under caller limits, verifies the canonical request hash carried by every closed result, strictly rejects open, reordered, substituted, or contradictory output, and persists only validated existing report shapes; the prior host comparisons, budget-error construction, suite mapping, and capability-membership logic are absent. Eight independent profile/source/inventory/frontend/request-binding mutations and focused malformed-request, unknown-operation, substituted-result, hash mismatch, sealed-error, inclusive/exceeded-limit, declared/undeclared-operation, missing-suite, open-observation, and empty-test whole-module-inventory controls pass. Native genesis and genesis_wasi agree across valid, failing-unit, 90,008-step failing-budget, and failing-capability packages, including exact exit disposition and canonical errors. This migration also repaired a stale negative fixture whose doubly quoted capability was malformed rather than valid-but-undeclared. The earlier runtime control exposed and repaired a production abort: non-default memory limits had disabled final-argument tail control in compiled curried applications, so fixpoint recursion could overflow the host stack before the step limit; compiled evaluation now combines segmented-stack protection with metered final-argument tail transfer, and the exact 5,000-iteration shape has bounded evaluator depth. Evidence: cargo test -p gc_kernel compiled_fixpoint_recursion_uses_segmented_stack --locked --offline, cargo test -p gc_obligations obligation_authority::tests --locked --offline, and python3 scripts/lib/selfhost_obligation_authority.py --root . --profile policies/selfhost_obligation_authority_v0.1.json --schema docs/spec/SELFHOST_OBLIGATION_AUTHORITY_v0.1.schema.json --self-test --runtime --binary target/debug/genesis --binary target/debug/genesis_wasi. This remains partial: 17 named obligation kinds retain host authority, SD-OBLIGATION is not promoted, and R4.2.d/SH-C remain open. Progress 2026-08-11: ordinary core/obligation::typecheck is now produced by the same closed self-host authority under partial profile identity cb7071c3655a6ad97badaeb735b66b7e6d174b64bde10cf4e0c44ae8f7ca861d. Rust transports only ordered base-relative module paths and canonical forms; GenesisCode validates the complete inventory, derives each ::meta itself, invokes the already-H2 core/cli::typecheck-package, and returns its closed genesis/typecheck-v0.2 report bound to the exact outer request. The host independently decodes module order, exports, declared types, diagnostics, aggregate messages, profile negotiation, and result consistency before persistence, but no longer selects the ordinary typecheck outcome. Ten focused authority controls cover successful and failing packages, host metadata injection, open requests, result substitution, and the previously migrated decisions. Nine independent mutations reject profile, inventory, source, frontend, request binding, and typecheck-route drift. Native and WASI produce identical exact migrated-obligation inventories across successful, failing-unit, failing-budget, failing-capability, and failing-typecheck packages without raising the fixed five-million allocation ceiling for an oversized redundant fixture. Evidence: GENESIS_TEST_SELFHOST_ARTIFACT=/tmp/genesis-obligation-toolchain.gc cargo test -p gc_obligations obligation_authority::tests --locked --offline and python3 scripts/lib/selfhost_obligation_authority.py --root . --profile policies/selfhost_obligation_authority_v0.1.json --schema docs/spec/SELFHOST_OBLIGATION_AUTHORITY_v0.1.schema.json --self-test --runtime --artifact /tmp/genesis-obligation-toolchain.gc --binary target/debug/genesis --binary target/debug/genesis_wasi. This remains partial: typecheck-strict retains its host-authored metadata transformation, 16 named obligation kinds remain residual, SD-OBLIGATION is not promoted, and R4.2.d/SH-C remain open. Progress 2026-08-12: core/obligation::typecheck-strict is now produced by the closed self-host authority under partial profile identity bfb7440db95740e0758dc24cb7e498d63d858ab3461a389e2ecf088aab529d93. The host transports the same metadata-free ordered module observations as ordinary typecheck; GenesisCode derives ::meta, sets :strict-effects and :strict-shapes, invokes the H2 package typechecker, and binds the complete result to the request. Rust independently reconstructs strict checker inputs only to decode contradictions and no longer selects the strict obligation result. The authority is decomposed into three ordered modules, each below 700 lines, and the profile binds their paths and exact bytes with domain-separated source-set identity be808f682327f4a79a4a0f24622a4cf3c3d118352c86acb74ab7afcbf095c8b3. Ten focused controls pass against the promoted artifact, including strict success, strict-only failure, and rejection of host metadata or strictness injection. Ten independent mutations reject source inventory, source identity, profile, frontend, request binding, and typecheck routing drift. Native and WASI produce identical exact inventories and outcomes across seven successful and failing packages under the fixed five-million step/allocation ceilings. Evidence: GENESIS_TEST_SELFHOST_ARTIFACT=/Users/corbensorenson/Documents/genesisCode/selfhost/toolchain.gc GENESIS_SELFHOST_TOOLCHAIN_ARTIFACT=/Users/corbensorenson/Documents/genesisCode/selfhost/toolchain.gc cargo test -p gc_obligations obligation_authority::tests --locked --offline and python3 scripts/lib/selfhost_obligation_authority.py --root . --profile policies/selfhost_obligation_authority_v0.1.json --schema docs/spec/SELFHOST_OBLIGATION_AUTHORITY_v0.1.schema.json --self-test --runtime --artifact selfhost/toolchain.gc --binary target/debug/genesis --binary target/debug/genesis_wasi, and bash scripts/selfhost_typecheck_authority_guard.sh over all 25 fixtures. This remains partial: 15 named obligation kinds remain residual, direct CLI strict-mode wrapping is not claimed by this obligation profile, SD-OBLIGATION is not promoted, and R4.2.d/SH-C remain open. Progress 2026-08-12: core/obligation::determinism is now exclusively produced by the closed self-host authority under partial profile identity e7c6189368e1d061cf801daafb75bec79c42e94b05340a8e53f5bb7017229ae0. GenesisCode derives metadata from canonical forms, invokes the H2 package typechecker, preserves the exact ordered static and runtime v0.2 rules and error bytes, resolves the first defining module for each observed test, and binds the result to the complete request. Rust transports only base-relative module forms and canonically deduplicated observed effect operations, validates the closed genesis/determinism-v0.2 envelope, and no longer computes capability emptiness, inferred-effect contradiction, suite ownership, or runtime-effect failure. The four-module source set has identity b247022a1bce0d20bc7014c40ac69c66048ba9a7f85d4c76ca5a19f80639a3aa, with every module below 700 lines. Twelve focused controls cover pure success, exact inferred and runtime failures, missing-suite legacy behavior, open observations, request substitution, and contradictory output. Eleven independent mutations reject profile, source inventory/identity, frontend redirection, request binding, typecheck routing, and determinism routing drift. Native and WASI agree exactly across eight copied-fixture cases under fixed five-million step/allocation ceilings; mutable effect tests cannot alter the normative fixture corpus. Evidence: GENESIS_TEST_SELFHOST_ARTIFACT=/Users/corbensorenson/Documents/genesisCode/selfhost/toolchain.gc GENESIS_SELFHOST_TOOLCHAIN_ARTIFACT=/Users/corbensorenson/Documents/genesisCode/selfhost/toolchain.gc cargo test -p gc_obligations obligation_authority::tests --locked --offline and python3 scripts/lib/selfhost_obligation_authority.py --root . --profile policies/selfhost_obligation_authority_v0.1.json --schema docs/spec/SELFHOST_OBLIGATION_AUTHORITY_v0.1.schema.json --self-test --runtime --artifact selfhost/toolchain.gc --binary target/debug/genesis --binary target/debug/genesis_wasi. This remains partial: 14 named obligation kinds remain residual, SD-OBLIGATION is not promoted, and R4.2.d/SH-C remain open. Progress 2026-08-12: core/obligation::lint and core/obligation::ai-style are now exclusively produced by the closed self-host authority under partial profile identity cf1851a787c57aa509d556d59bce29ebcd380406d0c56d0ff8e569260650efb2. GenesisCode invokes Prelude lint over closed canonical module forms, preserves exact diagnostics, classifies lint errors and the finite AI-style strict-warning set, constructs metadata-preserving missing-type patches, emits diagnostic fixes and patch intents, and returns all derived reports and patches through a hash-bound side-artifact transport. Rust supplies no lint or style decision: it independently recomputes EvidenceStore hashes, reconstructs the exact replacement from the original ::meta, rejects altered metadata, paths, reasons, diagnostics, aggregates, or artifact inventories, and persists nothing until the complete result validates. This migration also repaired the shared self-host authority nil predicate, whose symbol-tag comparison returned a sealed type error for both nil and non-nil values; it now uses the kernel’s structural nil predicate. The six-module source set has identity 492cd8182f2264f707a2cb3b44bf3d1461d9f1f74d89ad303e8ec324cfecfb5c, every module remains below 700 lines, and the exact tested candidate artifact has SHA-256 89c50222f4e960d0822f0595994ea0d4c7f8e3231033b6f1c5ba75730c27a0f7. Fourteen focused controls cover valid/failing lint and AI-style, lint and AI-style autofix paths, exact patch persistence, request substitution, side-hash replacement, contradictory final reports, and all prior migrated decisions. Fifteen independent mutations reject profile, source, frontend, request, typecheck, determinism, lint, AI-style, side-transport, and patch-reconstruction drift. Native and WASI agree exactly across 13 isolated fixtures under unchanged five-million step/allocation ceilings. Evidence: GENESIS_TEST_SELFHOST_ARTIFACT=/private/tmp/genesis-obligation-lint-recovery-v4.gc GENESIS_SELFHOST_TOOLCHAIN_ARTIFACT=/private/tmp/genesis-obligation-lint-recovery-v4.gc cargo test -p gc_obligations obligation_authority::tests --locked --offline and python3 scripts/lib/selfhost_obligation_authority.py --root . --profile policies/selfhost_obligation_authority_v0.1.json --schema docs/spec/SELFHOST_OBLIGATION_AUTHORITY_v0.1.schema.json --self-test --runtime --artifact /private/tmp/genesis-obligation-lint-recovery-v4.gc --binary target/debug/genesis --binary target/debug/genesis_wasi. This remains partial: 12 named obligation kinds remain residual, SD-OBLIGATION is not promoted, and R4.2.d/SH-C remain open. Progress 2026-08-12: core/obligation::replayable-tests and core/obligation::concurrency-replay are now exclusively decided by GenesisCode under partial profile identity 07791dc1073115147dae98e9a1bcb3795bd99ed218067ac339305e646ab709da. The host performs one bounded re-evaluation/replay pass for every effect-log-bearing test and transports only the test identity, log artifact, raw effect-program status, original/replayed value hashes, and ordered raw operation/schedule/task/await fields. GenesisCode selects task-like observations, enforces schedule positions and required task/await identities, compares replay hashes, preserves exact error order, and binds the concurrent-test count and complete reports to the request. Rust no longer uses a task-operation classifier, scheduling verdict, replay match decision, counter, or report producer as policy authority; its independent strict decoder reconstructs the expected reports from the closed primitive observations only to reject open facts, request substitution, error/count drift, or altered scheduling fields before report persistence. Both obligations share the same immutable observation set, eliminating the prior duplicate replay execution. The seven-module authority source set has identity b609d21aa8907432f036b2d3b50c6b111381ce306bc1562ab2548ba190813bf3, all modules remain below 700 lines, and the promoted canonical artifact has SHA-256 8f0cd0fb1b66dd8cefbd7d2324847110550bdfc4a5a5f3ae7ba55423df6b63ca. Sixteen focused controls cover matching and mismatched replay hashes, missing schedule/task/await facts, open observations, contradictory counts, and all prior authorities. Seventeen independent mutations reject every prior boundary plus replay routing and host-fact collection removal. Native and WASI agree exactly across 14 isolated fixtures, including the authentic task/GPU package. That workload measured 7,476,287 logical allocation units under the former five-million ceiling, so the explicit evidence profile was ratcheted to a still-bounded ten-million allocation ceiling while retaining the five-million step ceiling and 60-second per-case timeout; the workload was not removed or run unbounded. Evidence: GENESIS_TEST_SELFHOST_ARTIFACT=/Users/corbensorenson/Documents/genesisCode/selfhost/toolchain.gc GENESIS_SELFHOST_TOOLCHAIN_ARTIFACT=/Users/corbensorenson/Documents/genesisCode/selfhost/toolchain.gc cargo test -p gc_obligations obligation_authority::tests --locked --offline and python3 scripts/lib/selfhost_obligation_authority.py --root . --profile policies/selfhost_obligation_authority_v0.1.json --schema docs/spec/SELFHOST_OBLIGATION_AUTHORITY_v0.1.schema.json --self-test --runtime --artifact selfhost/toolchain.gc --binary target/debug/genesis --binary target/debug/genesis_wasi. This remains partial: 10 named obligation kinds remain residual, effect replay execution stays host-authoritative, SD-OBLIGATION is not promoted, and R4.2.d/SH-C remain open. Progress 2026-08-12: core/obligation::property-tests is now exclusively decided by GenesisCode under partial profile identity 45227de32562442f938d59ef28ab1407ca056e2264c370a4f5055d1790164816. A closed two-phase protocol first validates suite and entry observations, resolves direct and map-shaped property callables, and emits an immutable genesis/property-test-plan-v0.1 with exact case order, domain-separated BLAKE3-derived seeds, and the :first-non-pass stop rule; after Rust executes only that bounded authorized plan, GenesisCode validates every raw outcome and emits the canonical genesis/property-tests-v0.2 final report. The host no longer selects cases, derives seeds, interprets property outcomes, or constructs the report; its retained mechanism invokes the requested callable with the authorized seed, implements the authorized stop rule, and independently reconstructs the plan and final report only to reject contradictions before persistence. The eight-module authority source set has identity 4459b248282a440aefef1280437d5255b238d875f4077597fec3bce7561c10a7, every module remains below 700 lines, and the promoted canonical artifact has SHA-256 09509829ab483745f472b1fbd88bc8de10176b4efb3a4ceef3f31c699d16c8f6. Seventeen focused controls cover exact seed derivation and tamper rejection, passing direct and map-shaped properties, first-case failure, and every prior migrated authority. Nineteen independent mutations reject all prior boundaries plus property routing and removal of the closed host-fact inventory. Native and WASI agree exactly across 16 isolated fixtures under the unchanged five-million step, ten-million allocation, and 60-second per-case ceilings. The authentic passing package also expands the independently closed typecheck corpus from 25 to 26 fixtures; its schema, verifier, and profile are resealed together under identity 142dbe020b4efb1a2403d567779a684bfc5eed950cb06c7ee2dba31be5d7bfcf without changing typechecker semantics or its H2 assignment. Evidence: GENESIS_TEST_SELFHOST_ARTIFACT=/Users/corbensorenson/Documents/genesisCode/selfhost/toolchain.gc GENESIS_SELFHOST_TOOLCHAIN_ARTIFACT=/Users/corbensorenson/Documents/genesisCode/selfhost/toolchain.gc cargo test -p gc_obligations obligation_authority::tests --locked --offline and python3 scripts/lib/selfhost_obligation_authority.py --root . --profile policies/selfhost_obligation_authority_v0.1.json --schema docs/spec/SELFHOST_OBLIGATION_AUTHORITY_v0.1.schema.json --self-test --runtime --artifact selfhost/toolchain.gc --binary target/debug/genesis --binary target/debug/genesis_wasi. This remains partial: nine named obligation kinds remain residual, bounded property execution remains host mechanism rather than policy authority, SD-OBLIGATION is not promoted, and R4.2.d/SH-C remain open. Progress 2026-08-12: core/obligation::stage1-validation is now exclusively decided by GenesisCode under partial profile identity 1cb2e6a6aeec81dec6a382105fe28ac195dd619ede7d54614e18a3b6e7d539dc. Rust performs only the conservative transform, canonicalization, caller-bounded isolated pure evaluation, canonical hashing, and optimizer-counter collection; its closed observations carry separate value hashes or raw evaluation errors and never a gate verdict or error list. GenesisCode validates success/error outcome consistency, derives original and transformed evaluation failures and pure-value hash mismatch, preserves module and aggregate error order, and emits the exact genesis/stage1-validation-v0.2 report bound to the complete request. The strict Rust decoder independently reconstructs the report only to reject malformed outcomes, request substitution, open observations, or contradictory output before persistence. The nine-module authority source set has identity ec45d418d70aa227eb60998b3025fc2383a7db4d540a2f25fdd842b37d15ec0b; its new GenesisCode stage module is 161 lines and the production/decoder Rust modules remain below the 700-line ceiling. The promoted fixed-point artifact has SHA-256 4af6056b294e4812d2cc5b70f0c6b64b9e3f4f15f12d0978b5114b31c2933ccb. Nineteen focused authority controls cover raw evaluation failure, pure hash mismatch, malformed observation rejection, request substitution, report tampering, caller step-limit enforcement, and every prior migrated authority; 21 independent mutations reject the full prior boundary plus stage1 routing and closed host-fact removal. Native and WASI agree exactly across all 16 isolated fixture cases under the unchanged five-million step, ten-million allocation, and 60-second per-case ceilings. Evidence: GENESIS_TEST_SELFHOST_ARTIFACT=/private/tmp/genesis-stage1-authority-v2.gc GENESIS_SELFHOST_TOOLCHAIN_ARTIFACT=/private/tmp/genesis-stage1-authority-v2.gc cargo test -p gc_obligations obligation_authority::tests --locked --offline -- --nocapture and python3 scripts/lib/selfhost_obligation_authority.py --root . --profile policies/selfhost_obligation_authority_v0.1.json --schema docs/spec/SELFHOST_OBLIGATION_AUTHORITY_v0.1.schema.json --self-test --runtime --artifact selfhost/toolchain.gc --binary target/debug/genesis --binary target/debug/genesis_wasi. This remains partial: eight named obligation kinds remain residual, optimizer transformation and pure evaluation remain host mechanisms, SD-OBLIGATION is not promoted, and R4.2.d/SH-C remain open. Progress 2026-08-12: core/obligation::coverage, core/obligation::coverage-decision, and core/obligation::coverage-mcdc are now exclusively decided by GenesisCode under partial profile identity 7a773b994ba80e0b10fdec306e5f426ca5098cf13e4b43a67a9d7ba23c5d8767. Rust discovers static instrumentation sites, executes and strictly replays tests under caller limits, and transports only ordered export/statement hit counts, decision counts, raw condition/outcome samples, per-test instrumentation, test count, and names of effect programs missing replay logs. GenesisCode validates that closed inventory, applies symbol, statement, branch, and exact MC/DC independence policy, preserves legacy ordering and error bytes, and emits the canonical genesis/coverage-v0.2 report bound to the complete request. The strict host decoder independently reconstructs the report only to reject open facts, request substitution, profile/name drift, or contradictory output, then persists the validated GenesisCode report. The ten-module authority source set has identity 20d7659f9a62af887d22f7671b3ad58482003e495db46b4abfe37772efc01c7a; the 523-line GenesisCode authority and decomposed 366/505-line Rust observation/contradiction modules stay under the 700-line ceiling. The canonical artifact is 1,654,862 bytes with SHA-256 663550195ef9ca6551969338a35e3b8aee47e168ae6477b382d801f9aa09a8fe. Twenty-one focused controls cover all three profiles, complete and missing branch/MC/DC cases, uncovered exports, malformed observations, request binding, report tampering, and every prior migrated authority; 23 independent mutations reject the complete boundary plus coverage routing and host-fact removal. Native and WASI agree exactly across 18 isolated fixture cases, including authentic passing all-profile and failing uncovered-export packages, under the unchanged five-million step, ten-million allocation, and 60-second per-case ceilings. Evidence: GENESIS_TEST_SELFHOST_ARTIFACT=/Users/corbensorenson/Documents/genesisCode/selfhost/toolchain.gc GENESIS_SELFHOST_TOOLCHAIN_ARTIFACT=/Users/corbensorenson/Documents/genesisCode/selfhost/toolchain.gc cargo test -p gc_obligations obligation_authority::tests --locked --offline -- --nocapture and python3 scripts/lib/selfhost_obligation_authority.py --root . --profile policies/selfhost_obligation_authority_v0.1.json --schema docs/spec/SELFHOST_OBLIGATION_AUTHORITY_v0.1.schema.json --self-test --runtime --artifact selfhost/toolchain.gc --binary target/debug/genesis --binary target/debug/genesis_wasi. This remains partial: five named obligation kinds remain residual, instrumentation and replay execution remain host mechanisms, SD-OBLIGATION is not promoted, and R4.2.d/SH-C remain open. Progress 2026-08-12: core/obligation::translation-validation is now exclusively decided by GenesisCode under partial profile identity 07a550161ea7857f0e7b22da58f1e75206bfbc2bdd97e759489bcac96e55d50f. Rust performs only conservative transformation, canonicalization, bounded original/optimized evaluation, stage2 compile-and-evaluate execution, optimizer-counter collection, and optimized-test execution. Its closed observations separate complete, failed, and unsupported stage2 states and carry only module/test identities, value kinds and hashes, Wasm hashes and byte counts, optimizer counters, raw equality facts, and mechanism errors; they contain no obligation verdict or report. GenesisCode validates the complete inventory and one-for-one original/optimized test alignment, rejects incomplete or contradictory stage2 facts, derives module changes, stage2 support and equivalence, test mismatches, aggregate counters, exact error order, and the canonical genesis/translation-validation-v0.2 report. A strict independent Rust decoder reconstructs that report only to reject open facts, request substitution, inventory drift, or contradictory output before persisting the validated GenesisCode result. The eleven-module source set has identity 9208da5af07953692940300f6cbe1b0a386995fca8765ffae66cacb9ccdc0822; the 547-line GenesisCode authority and decomposed 301/300/211-line Rust observation, contradiction, and mechanism modules remain below the 700-line ceiling. The canonical artifact is 1,698,343 bytes with SHA-256 3f274a5e0cedf811a10ff23fe83d5fc8a9a0cbe52130a1a46fc4da7777b6a04b. Twenty-three focused controls cover complete equivalence, stage2 and optimized-test divergence, the exact no-test report, malformed/open observations, request substitution, test-inventory misalignment, report tampering, and every prior migrated authority; 25 independent mutations reject the complete prior boundary plus translation routing and closed host-fact removal. Native and WASI agree exactly across all 18 isolated fixture cases, including the authentic translation-valid package, under the unchanged five-million step, ten-million allocation, and 60-second per-case ceilings. Evidence: GENESIS_TEST_SELFHOST_ARTIFACT=/Users/corbensorenson/Documents/genesisCode/selfhost/toolchain.gc GENESIS_SELFHOST_TOOLCHAIN_ARTIFACT=/Users/corbensorenson/Documents/genesisCode/selfhost/toolchain.gc cargo test -p gc_obligations obligation_authority::tests --locked --offline -- --nocapture and python3 scripts/lib/selfhost_obligation_authority.py --root . --profile policies/selfhost_obligation_authority_v0.1.json --schema docs/spec/SELFHOST_OBLIGATION_AUTHORITY_v0.1.schema.json --self-test --runtime --artifact selfhost/toolchain.gc --binary target/debug/genesis --binary target/debug/genesis_wasi. This remains partial: four named obligation kinds remain residual, transformation, compilation, pure evaluation, and optimized-test execution remain host mechanisms rather than policy authority, SD-OBLIGATION is not promoted, and R4.2.d/SH-C remain open. Progress 2026-08-12: core/obligation::gfx-api-stability is now exclusively decided by GenesisCode under partial profile identity fe925d6cfec92a8463c5105acfb8aa2722f913738bbd366900c8143cafa7a090. Rust transports ordered definition symbols and canonical expression hashes, canonical unique metadata exports and configured exports, and the normalized optional configured surface hash; it no longer selects gfx membership or tracked exports, constructs the API surface, applies configuration or mismatch policy, produces diagnostics, or persists a report. GenesisCode validates the closed inventory, detects conflicting definitions, filters core/gfx/ exports, selects the configured or discovered tracked set, constructs and hashes the exact genesis/gfx-api-surface-v0.2 term, preserves legacy error order, and emits the canonical genesis/gfx-api-stability-v0.2 report. A strict independent Rust decoder reconstructs the result only to reject open facts, request substitution, malformed identities, or contradictory surface/report output before persistence. The twelve-module authority source set has identity b324c020055920e6f65bf9dc8fb90c7b54d8ff028fd6287f3f68c6f8c323e0fb; the new GenesisCode source is 247 lines and its decomposed 300/48-line Rust decoder/collector remain below the 700-line ceiling. The canonical artifact is 1,719,165 bytes with SHA-256 47915efa733d9c7293bf538c7c086ea147812bdea8b66733a9029de6ccadd5fe. Twenty-five focused controls cover valid, missing-export, conflicting-definition, open-envelope, request-substitution, and report-tampering cases plus every prior migrated authority; 27 independent mutations reject the complete prior boundary plus gfx API routing and host-fact removal. Native and WASI agree exactly across 20 isolated fixtures, including the authentic complete graphics package and configured surface-hash mismatch, under unchanged bounded limits. Evidence: GENESIS_TEST_SELFHOST_ARTIFACT=/Users/corbensorenson/Documents/genesisCode/selfhost/toolchain.gc GENESIS_SELFHOST_TOOLCHAIN_ARTIFACT=/Users/corbensorenson/Documents/genesisCode/selfhost/toolchain.gc cargo test -p gc_obligations obligation_authority::tests --locked --offline -- --nocapture and python3 scripts/lib/selfhost_obligation_authority.py --root . --profile policies/selfhost_obligation_authority_v0.1.json --schema docs/spec/SELFHOST_OBLIGATION_AUTHORITY_v0.1.schema.json --self-test --runtime --artifact selfhost/toolchain.gc --binary <managed-cache>/debug/genesis --binary <managed-cache>/debug/genesis_wasi. This remains partial: graphics golden-image comparison, graphics frame-budget policy, and preflight remain residual; definition extraction and canonical hashing remain host mechanisms; SD-OBLIGATION is not promoted; and R4.2.d/SH-C remain open. Progress 2026-08-12: core/obligation::gfx-golden-images and core/obligation::gfx-frame-budgets are now exclusively decided by GenesisCode under partial profile identity ebb9a7e3143469a83e667811502421753d3fcf517a1cfd02d57b63467e6f6d6b. A closed two-phase protocol validates manifest-ordered suite and entry observations, normalized expected hashes, kinds, dimensions, and exact budget limits before emitting immutable golden and frame plans; Rust invokes only the selected callables under caller limits and performs headless rendering only when an authorized frame-graph case requires a PNG observation. GenesisCode then validates the complete ordered raw outcomes, binds renderer results to frame hash and dimensions, extracts scene/frame payloads, computes canonical hashes and structural/time/byte metrics, applies all golden and budget policy, preserves legacy diagnostics, and emits the final reports. Rust no longer selects cases, interprets outcomes, compares hashes or limits, constructs diagnostics, or persists a host-authored report; its retained implementations independently reconstruct exact plans and reports only to reject contradictions. The fourteen-module authority source set has identity 05474338436ebaaf0fda6eb0805637d349873caaa70aec285648bcc3f1db17a3; all source modules and decomposed Rust boundary modules remain under 700 lines. The promoted canonical artifact is 1,793,653 bytes with SHA-256 b74789606a7f50f330378e661aac8d447dee5aca3042c0e55fd3bf1f7dce9cf7. Twenty-seven focused controls cover passing term/PNG goldens, term and PNG mismatch, frame-budget failure, open plan input, renderer substitution, and every prior migrated authority. Thirty-two independent mutations reject the complete prior boundary plus both graphics routes and both closed host-fact collectors. Native and WASI agree exactly across 23 isolated fixtures under unchanged five-million step, ten-million allocation, and 60-second per-case ceilings. Evidence: GENESIS_TEST_SELFHOST_ARTIFACT=selfhost/toolchain.gc GENESIS_SELFHOST_TOOLCHAIN_ARTIFACT=selfhost/toolchain.gc cargo test -p gc_obligations authority --lib --locked --offline and python3 scripts/lib/selfhost_obligation_authority.py --root . --profile policies/selfhost_obligation_authority_v0.1.json --schema docs/spec/SELFHOST_OBLIGATION_AUTHORITY_v0.1.schema.json --self-test --runtime --artifact selfhost/toolchain.gc --binary <managed-cache>/debug/genesis --binary <managed-cache>/debug/genesis_wasi. This remains partial: core/obligation::preflight remains residual, renderer execution remains a bounded host mechanism, SD-OBLIGATION is not promoted, and R4.2.d/SH-C remain open. Progress 2026-08-12: core/obligation::preflight, the final residual obligation kind, is now exclusively decided by GenesisCode under complete obligation profile identity 7c8b06b363621bfd6985d17194988eb214f912fcfab9e7f4dd0a8b97a53a6b47. Rust collects only bounded module-load/canonical-hash, dependency-hash, and capability-policy load/hash outcomes, normalizes absolute mechanism roots, and returns already observed modules/policy state after success. GenesisCode validates the closed four-field observation, owns fail-fast stage precedence, module-pin diagnostics and stable repair text, exact errors/disposition, and the canonical genesis/preflight-v0.2 report; a fixed five-million-step and ten-million-allocation control-plane budget ensures invalid package limits cannot prevent fail-closed evidence. The strict decoder independently reconstructs the result only to reject open, substituted, or contradictory output. Missing capability policies now produce preflight acceptance instead of escaping as host errors, and missing-pin artifacts are byte-identical across distinct absolute workspace roots. The fifteen-module authority source set has identity b6fae1ce5744e276f951369370045b13af91e10eee1c804e6c3275fcc4b57fd5; the 71-module candidate artifact is 1,804,072 bytes with SHA-256 ee6be7ff052147b1291e63b1359ca1040629326415ca4af1f29d23e34ad73d64. Thirty-nine focused authority controls pass; 34 independent mutations reject the complete boundary including preflight route/fact removal; native and WASI agree exactly across 25 isolated fixtures, including authentic hash and zero-memory preflight failures. The independently refreshed semantic ledger identity eba7d2260e55449452de59bf2479fbd61a0b535a704c5a73b9c559df725f493a promotes only SD-OBLIGATION to H2 while leaving SD-EFFECT-POLICY host-authoritative. Evidence: GENESIS_TEST_SELFHOST_ARTIFACT=/private/tmp/genesis-preflight-authority-v5.gc GENESIS_SELFHOST_TOOLCHAIN_ARTIFACT=/private/tmp/genesis-preflight-authority-v5.gc cargo test -p gc_obligations authority --lib --locked --offline; GENESIS_SELFHOST_TOOLCHAIN_ARTIFACT=/private/tmp/genesis-preflight-authority-v5.gc cargo test -p gc_cli --test cli_failures preflight --locked --offline; and python3 scripts/lib/selfhost_obligation_authority.py --root . --profile policies/selfhost_obligation_authority_v0.1.json --schema docs/spec/SELFHOST_OBLIGATION_AUTHORITY_v0.1.schema.json --self-test --runtime --artifact /private/tmp/genesis-preflight-authority-v5.gc --binary <managed-cache>/debug/genesis --binary <managed-cache>/debug/genesis_wasi. This completes the obligation sub-boundary but not R4.2.d/SH-C: effect-policy composition and replay execution authority remain open, and no H3/H4 bootstrap, release, or downstream-product claim is made. Progress 2026-08-12: core/effects::policy-inventory-authority, core/effects::policy-authority, and core/effects::resource-policy-authority now own eleven closed effect-policy composition decisions: deterministic candidate-operation union/deduplication/ordering, baseline admission, per-operation allow precedence and base-directory selection, selection and canonical path-free logging of the generic :op, :create-dirs, :timeout-ms, and :log-inline-max-bytes enforcement controls, private per-operation max_bytes state, all five runtime effect/payload/response resource limits, all task limits plus adaptive default-worker selection, global log inline/artifact and store run byte budgets, and configured-or-default log/store/refs location selection. The closed version-3 operation request carries an exact optional :base-dir, the raw closed max-byte observation, and a positive platform maximum; its request-bound result returns the selected directory and exact absent|invalid-type|nonpositive|platform-overflow|valid byte-limit state separately from the logged capability, and denied operations must return none of that private state. This preserves legacy effect-use timing and error text while keeping the configured limit out of .gclog. The closed version-3 resource request carries exact log/refs/runtime/store/task maps plus a bounded positive host available-worker observation. GenesisCode validates every map, preserves nonnegative runtime/task limits, selects worker and location defaults, normalizes nonpositive global byte budgets to nil, and decides whether an operation byte limit is absent, invalid, nonpositive, platform-overflowing, or valid. The decomposed 612/543-line Rust boundary strictly rejects missing/open/ill-typed/noncanonical/invalid-domain/overflowed/substituted results, independently reconstructs all eleven decisions as a required contradiction oracle, installs the validated GenesisCode base directory, create-directories flag, timeout, per-operation log limit, private max-byte state, and global resource state instead of its separately parsed copies, and only then resolves relative paths against the capability file base. Generic and bridge byte-limit consumers consult that installed state before the raw compatibility field. The production self-host loader no longer selects storage defaults, operation base directories, generic operation enforcement controls, or filesystem byte-limit policy. All ten file-backed production CLI policy loads and obligation preflight route through the selected artifact-only self-host frontend. Inventory and operation results likewise fail closed on malformed, duplicate, unsorted, open, hash-substituted, identity-drifted, contradictory, oversized, sealed, or opaque output. The fixed 4,096-operation, twenty-million-step, and twenty-million-allocation limits remain enforced before or during evaluation. The independently checked partial profile identity is 5fc430aa452010eb922280163b6cc535d8942eaf3c335c69236949dd4172b021; sixteen mutations reject binding, operation/resource request and result protocols, decision, residual, host-oracle, bound, source, schema, and identity drift. Sixteen focused controls cover the complete prior inventory/admission/capability/runtime/task/location surface, valid and absent max-byte installation across generic and bridge enforcement, exact invalid-type/nonpositive effect errors, platform overflow, denied-state erasure, and malformed or contradictory private decisions. Evidence: GENESIS_TEST_SELFHOST_ARTIFACT=/Users/corbensorenson/Documents/genesisCode/selfhost/toolchain.gc bash scripts/selfhost_effect_policy_composition_guard.sh. The promoted 1,843,047-byte artifact has SHA-256 6d08b4da38d933c20dd0fdf1a6eabb5d353248e5beea6011b78e5c5d6b0f1c31. This is intentionally not H2: Rust still parses TOML, resolves and canonicalizes authorized paths, enforces sandboxes, performs actual I/O and byte measurement, and retains the required compatibility oracle, while eleven named remote transport/authentication, remaining operation-specific, path/secret, execution, cancellation, replay, and syntax policy families remain host-authored. Filesystem policy configuration is complete for the current surface, but filesystem mechanisms remain host-owned. SD-EFFECT-POLICY remains host-authoritative, and R4.2.d/SH-C remain open pending complete policy and replay migration, no-fallback proof, native/WASI evidence, and host-oracle removal. Progress 2026-08-12: the closed version-4 operation protocol adds :process-programs and makes GenesisCode the semantic authority for the complete allow_programs policy domain used by sys/process::exec and sys/process::spawn. Rust transports only exact strings plus closed invalid-type/invalid-entry observations; GenesisCode preserves order and duplicates, applies frozen Unicode trimming, removes empty entries, and returns an exact absent|invalid-type|invalid-entry|empty|valid state bound to the request. The strict decoder rejects open, substituted, padded, empty-valid, denied-non-nil, and status/value-contradictory results, installs a private typed state, and process dispatch consumes it before the raw compatibility field while retaining exact/glob matching, payload decoding, process lifecycle, and hard cancellation as host enforcement mechanisms. The retained parser independently reconstructs only the contradiction oracle. A pre-fix negative control also exposed that the artifact updater requested missing-seed recovery while still supplying the stale committed artifact, silently reproducing version 3; the updater now uses a guaranteed-missing seed path, and the freshness gate pins that recovery route. The 635/106-line host authority split and 546-line GenesisCode producer remain under the 700-line ceiling. The partial profile identity is 46eafa3cc83decb79239cc954f799af6f66d07b86c4f4bb146b7e664a36839db, source identity is 8432b8c46fe7343472cdae618c2a1671f1cc5449d7369add2aa192e0db00e6cb, and the promoted 1,847,674-byte artifact has SHA-256 249f4f7b149e94fbe1daede2f668387ead15e75473a1b1cda1e491ebbab68411. Sixteen profile mutations, nineteen complete authority controls, and two dispatch controls pass. Evidence: cargo test -p gc_effects process_dispatch_ --locked --offline -- --nocapture, cargo test -p gc_effects selfhost_authority_rejects_malformed_process_program_decisions --locked --offline -- --nocapture, and GENESIS_TEST_SELFHOST_ARTIFACT=/Users/corbensorenson/Documents/genesisCode/selfhost/toolchain.gc bash scripts/selfhost_effect_policy_composition_guard.sh. This retires only process-policy: ten remote transport/authentication, network, database, crypto/signing, FFI/plugin/model, device/graphics, path/secret, execution/cancellation, replay, and syntax/type-decoding families remain residual; SD-EFFECT-POLICY stays host-authoritative and R4.2.d/SH-C remain open. Progress 2026-08-12: the closed version-5 operation protocol adds an exact private database map and makes GenesisCode authoritative for all database configuration consumed by SQL and KV dispatch: db_target_allow, allow_query_classes, max_result_bytes, max_row_count, and max_value_bytes. Rust transports exact strings and integers plus closed invalid-type/invalid-entry observations; GenesisCode applies frozen trimming, preserves order and duplicates, removes empty entries, and returns closed allowlist and positive-limit states bound to the complete request. The strict decoder rejects open, substituted, padded, empty-valid, nonpositive-valid, overflowing, denied-non-nil, and status/value-contradictory results, installs typed state, and database dispatch consumes it before raw compatibility fields. URL parsing, exact/prefix/glob matching, payload-bound injection, bridge execution, and measurement remain host enforcement mechanisms; the retained parser reconstructs decisions only as the required contradiction oracle. The 660/192/106-line decomposed Rust operation/database/process boundary and 622-line GenesisCode producer remain below the 700-line ceiling. The partial profile identity is cbdbc91b10c8d288d255d75e0195692f798626a971cb0418ac8c2724126cd111, source identity is 758c85dd833acf79021c8c53dda204c19e704a883c4e539040c7d0def1e7d13f, and the promoted 1,853,227-byte artifact has SHA-256 6c93fd124f9d241778724e70ae56f18a6e85fbbe0311432230c69449e7ea6457. Sixteen profile mutations, 22 complete authority controls, and two database dispatch precedence/error controls pass. Evidence: cargo test -p gc_effects database -- --nocapture and GENESIS_TEST_SELFHOST_ARTIFACT=/Users/corbensorenson/Documents/genesisCode/selfhost/toolchain.gc bash scripts/selfhost_effect_policy_composition_guard.sh. This retires only database-policy: nine network, crypto/signing, FFI/plugin/model, device/graphics, remote transport/authentication, path/secret, execution/cancellation, replay, and syntax/type-decoding families remain residual; SD-EFFECT-POLICY stays host-authoritative and R4.2.d/SH-C remain open. Progress 2026-08-12: the closed version-6 operation protocol adds a private network map and makes GenesisCode authoritative for the complete per-operation network policy shared by io/net::*, core/sync::*, package publication, and store-remote operation policy: independent url_allow and remote_allow normalization, allow_http, wasi_network_profile, allow_bind_hosts, allow_bind_ports, and max_request_bytes. Keeping both target lists prevents a false alias collapse: io/net still prefers a present URL list and otherwise uses the remote list, while sync/publication independently consume the remote list. Rust transports exact strings, booleans, and integers plus closed invalid observations; GenesisCode owns trimming, empty removal, wildcard/port-domain classification, optional value states, positive-limit state, and every effect-use error disposition. The strict decoder rejects open, substituted, padded, empty-valid, nonpositive-valid, overflowing, out-of-range-valid, denied-non-nil, and status/value-contradictory output, installs typed state, and both direct network and remote dispatch consume it before deliberately retained raw compatibility fields. URL and authority parsing, normalization, exact/prefix/glob matching, target-specific WASI backend discovery, TLS/authentication, DNS/socket/HTTP/WebSocket execution, cancellation, and measurement remain bounded host mechanisms under the remaining residuals. The 684/346-line Rust operation/network authority split, 512-line direct-network consumer, 567-line remote consumer, and 630/267-line GenesisCode producer split remain below the 700-line ceiling. The partial profile identity is 2fa8b3f39504a5c2d8631b146ff2eda7ad9274958fe1ecd42cc22379c4b8224f, complete two-module source identity is 5630e032351a611d327be2d4118b0f7a9e358c5e72428d8026322ac723993898, and the candidate 1,873,369-byte artifact has SHA-256 662a63a3faea5ce5a49c12c7a8709db3d264af04137cd93067c049a737d019c3. Seventeen profile mutations, 25 complete authority controls, and four direct/remote dispatch precedence/error controls pass. Evidence: GENESIS_TEST_SELFHOST_ARTIFACT=/private/tmp/genesis-network-policy-v6b.gc bash scripts/selfhost_effect_policy_composition_guard.sh and GENESIS_TEST_SELFHOST_ARTIFACT=/private/tmp/genesis-network-policy-v6b.gc cargo test -p gc_effects network --locked --offline -- --nocapture. This retires only network-policy: eight crypto/signing, FFI/plugin/model, device/graphics, global store remote transport/TLS/authentication, path/secret, execution/cancellation, replay, and syntax/type-decoding families remain residual; SD-EFFECT-POLICY stays host-authoritative and R4.2.d/SH-C remain open. Progress 2026-08-12: the closed version-7 operation protocol adds an exact private crypto map and makes GenesisCode authoritative for all fourteen per-operation controls consumed by core/crypto::{hash,sign,verify,kdf,aead-seal,aead-open}: trimmed ASCII-lowercase algorithm allowlists, trimmed case-preserving key-ID allowlists, and twelve positive platform-sized input/output bounds. Rust transports only exact strings and integers plus closed invalid-type/invalid-entry observations; GenesisCode owns normalization and every absent|invalid-type|invalid-entry|empty|nonpositive|platform-overflow|valid disposition while preserving list order and duplicates. The strict decoder rejects open, substituted, noncanonical, denied-non-nil, and status/value-contradictory output, installs typed state, and all six crypto operations consult that authority state before deliberately retained raw compatibility fields. Matching, key custody/provider configuration, cryptographic execution, measurement, bound enforcement, cancellation, and replay remain host mechanisms. The override request is now an exact ten-key map, closing a pre-existing length-only validation gap that could admit key substitution. Decomposition leaves the operation authority at 627 Rust lines, with 90-line capability and 125-line crypto boundaries plus 645-line authority and 263-line crypto GenesisCode modules, all below the 700-line ceiling. The partial profile identity is 3636dee67829735dfbd012f97d3bb5c41503682b40e1857d3bd9ec16a0641edf, complete three-module source identity is d7d8ad8f94c245cc83171b4c4b802aa0458257c765b1eb817aaed3f8d3ee82c9, and the tested candidate artifact is 1,892,578 bytes with SHA-256 788a50deb3fbd89e16ac737bc09f0e6bd973f69c596159d4909163fd298d43a8. Eighteen profile mutations, 28 complete authority controls, two crypto dispatch precedence/error controls, and all nine filtered crypto behavior tests pass. Evidence: python3 scripts/lib/selfhost_effect_policy_composition.py --root . --profile policies/selfhost_effect_policy_composition_v0.1.json --schema docs/spec/SELFHOST_EFFECT_POLICY_COMPOSITION_v0.1.schema.json --self-test; GENESIS_TEST_SELFHOST_ARTIFACT=/private/tmp/genesis-crypto-policy-v7.gc cargo test -p gc_effects crypto --locked --offline -- --nocapture; and GENESIS_TEST_SELFHOST_ARTIFACT=/private/tmp/genesis-crypto-policy-v7.gc bash scripts/selfhost_effect_policy_composition_guard.sh. This retires only crypto-and-signing-policy: seven FFI/plugin/model, device/graphics, global store remote transport/TLS/authentication, path/secret, execution/cancellation, replay, and syntax/type-decoding families remain residual; SD-EFFECT-POLICY stays host-authoritative and R4.2.d/SH-C remain open. Progress 2026-08-12: the closed version-8 operation protocol adds an exact private plugin map and makes GenesisCode authoritative for the allow_plugins, allow_commands, and optional allow_schema_ids list states consumed by both host/plugin::command and editor/plugin::command. Rust transports only exact strings plus closed invalid-type/invalid-entry observations; GenesisCode owns trimming, empty removal, order and duplicate preservation, and every absent|invalid-type|invalid-entry|empty|valid disposition. The strict decoder rejects open, substituted, padded, empty-valid, denied-non-nil, and status/value-contradictory output, installs private typed state, and both plugin dispatch routes consume that state before deliberately retained raw compatibility fields. Plugin/command/schema matching, bridge executable selection and digest verification, schema implementation, transport, hard cancellation, replay, and model-provider lifecycle remain host mechanisms. The override request is now an exact eleven-key map. Decomposition leaves the operation authority at 650 Rust lines, with a 64-line plugin decoder, 311-line plugin consumer, and 652/122-line GenesisCode authority/plugin split, all below the 700-line ceiling. The partial profile identity is f73a595f8e67fbd97c3a9ed7270eef049156d1968e5bb6e2f07097a171aee89f, complete four-module source identity is c59b5b886b0527e4bf73c1dfdf1306863f445770fa88244f571f06b414b459d1, and the tested candidate artifact is 1,901,762 bytes with SHA-256 fad4351ea60cdc2700e3f09a4a65f559e5e55ffae11b96f7339d67ee3b7527f1. Nineteen profile mutations, 31 complete authority controls, two plugin dispatch precedence/error controls, and the focused plugin behavior suites (16 unit, four editor-bridge, and two host-ABI replay tests) pass. Evidence: python3 scripts/lib/selfhost_effect_policy_composition.py --root . --profile policies/selfhost_effect_policy_composition_v0.1.json --schema docs/spec/SELFHOST_EFFECT_POLICY_COMPOSITION_v0.1.schema.json --self-test; GENESIS_TEST_SELFHOST_ARTIFACT=/private/tmp/genesis-plugin-policy-v8.gc cargo test -p gc_effects plugin --locked --offline -- --nocapture; and GENESIS_TEST_SELFHOST_ARTIFACT=/private/tmp/genesis-plugin-policy-v8.gc bash scripts/selfhost_effect_policy_composition_guard.sh. This narrows but does not retire the combined ffi-plugin-and-model-policy residual: seven FFI/bridge-identity/model, device/graphics, global store remote transport/TLS/authentication, path/secret, execution/cancellation, replay, and syntax/type-decoding families remain residual; SD-EFFECT-POLICY stays host-authoritative and R4.2.d/SH-C remain open. Progress 2026-08-12: the closed version-9 operation protocol adds an exact private FFI map and makes GenesisCode authoritative for the allow_abi_ids, allow_libraries, allow_symbols, optional allow_schema_ids, max_buffer_bytes, and max_call_payload_bytes states shared by host/ffi::call, host/ffi::buffer-pin, and host/ffi::buffer-unpin. Rust transports only exact strings and integers plus closed invalid-type/invalid-entry observations; GenesisCode owns trimming, empty removal, list order and duplicate preservation, positive platform-bound classification, and every absent|invalid-type|invalid-entry|empty|nonpositive|platform-overflow|valid disposition. The strict decoder rejects open, substituted, padded, empty-valid, nonpositive-valid, overflowing, denied-non-nil, and status/value-contradictory output, installs private typed state, and all three FFI dispatch paths consume it before deliberately retained raw compatibility fields. Matching, signed-policy metadata and provenance validation, bridge executable selection and digest verification, schema implementation, payload measurement and enforcement, transport, hard cancellation, and replay remain bounded host mechanisms. The override request is now an exact twelve-key map. Decomposition leaves the operation authority at 671 Rust lines, with an 89-line FFI decoder and 632/192-line FFI dispatch/policy split plus 659/66-line GenesisCode authority/FFI split, all below the 700-line ceiling. The partial profile identity is d74ed42fe9487e33b12abe2e72ed87972ded71ca4d5ed8a98b7ac133a3b00d24, complete five-module source identity is b0ab3feb409861e8f30e5c2bcf471d5d9f245fe89f9b65ab35bdc3279701e4aa, and the tested candidate artifact is 1,907,033 bytes with SHA-256 3c49b2fe784620e5db3d65525bf9dda6c359952a80d56c4921593ffa519b98ad. Twenty profile mutations, 34 complete authority controls, two FFI dispatch precedence/error controls, and 12 focused FFI policy, schema, signed-provenance, payload-bound, and deterministic-boundary tests pass. Evidence: python3 scripts/lib/selfhost_effect_policy_composition.py --root . --profile policies/selfhost_effect_policy_composition_v0.1.json --schema docs/spec/SELFHOST_EFFECT_POLICY_COMPOSITION_v0.1.schema.json --self-test; GENESIS_TEST_SELFHOST_ARTIFACT=/private/tmp/genesis-ffi-policy-v9.gc cargo test -p gc_effects selfhost_authority_ --locked --offline -- --nocapture; and GENESIS_TEST_SELFHOST_ARTIFACT=/private/tmp/genesis-ffi-policy-v9.gc cargo test -p gc_effects ffi --locked --offline -- --nocapture. This further narrows but does not retire the combined ffi-plugin-and-model-policy residual: seven signed-policy/bridge-identity/model, device/graphics, global store remote transport/TLS/authentication, path/secret, execution/cancellation, replay, and syntax/type-decoding families remain residual; SD-EFFECT-POLICY stays host-authoritative and R4.2.d/SH-C remain open. Progress 2026-08-12: the closed version-10 operation protocol extends the private FFI decision to eleven exact fields and makes GenesisCode authoritative for the normalized signed_policy_required decision plus closed optional-string states for policy_artifact_h, policy_signature_h, policy_key_id, and evidence_mode. All three FFI operations now receive one validated preflight object and use its authorized schema and signed-policy metadata without rereading those raw TOML fields; the call payload bound is activated by that same validated decision. Missing/non-boolean legacy opt-in remains false, while present metadata is classified as absent|invalid-type|empty|valid after frozen trimming. The strict decoder rejects open, non-boolean, padded-valid, empty-valid, status/value-contradictory, denied-non-nil, substituted, or oracle-divergent output. Host code deliberately retains hexadecimal and deterministic-mode checks, signature/provenance verification, bridge identity and digest verification, schema implementation, measurement, transport, hard cancellation, replay, and the compatibility oracle. The 671/144-line Rust authority split, 623/266-line FFI dispatch/policy split, and 659/108-line GenesisCode authority/FFI split remain below the 700-line ceiling. The partial profile identity is 56c08746e2f6a51356c07e1c154a02d8a6add253a6adea0f07821daab193d5b4, complete five-module source identity is 0cd3d4d50da686a969585de9e56d2d5896ff74bbdebb2ed0e7b54157fdf78e47, and the one missing-seed recovery candidate is 1,910,261 bytes with SHA-256 7d9ecd4c210fd71c7c55a2604c966120a90fe922a4102f8cea3fa49fa54570ab. Twenty profile mutations, 34 complete authority controls, and 12 focused FFI policy, schema, signed-provenance, payload-bound, and deterministic-boundary tests pass. Evidence: python3 scripts/lib/selfhost_effect_policy_composition.py --root . --profile policies/selfhost_effect_policy_composition_v0.1.json --schema docs/spec/SELFHOST_EFFECT_POLICY_COMPOSITION_v0.1.schema.json --self-test; GENESIS_TEST_SELFHOST_ARTIFACT=/private/tmp/genesis-ffi-signed-v10.gc cargo test -p gc_effects selfhost_authority_ --locked --offline -- --nocapture; and GENESIS_TEST_SELFHOST_ARTIFACT=/private/tmp/genesis-ffi-signed-v10.gc cargo test -p gc_effects ffi --locked --offline -- --nocapture. This narrows the residual to seven bridge-identity/model-provider-lifecycle, device/graphics, global store remote transport/TLS/authentication, path/secret, execution/cancellation, replay, and syntax/type-decoding families; SD-EFFECT-POLICY stays host-authoritative and R4.2.d/SH-C remain open. Progress 2026-08-12: the closed version-11 operation protocol replaces five loosely coupled FFI signed-policy fields with one exact five-field, fourteen-status decision. Rust now transports missing opt-in as false, exact booleans unchanged, and any present non-boolean as :invalid-type; GenesisCode owns malformed-opt-in rejection, required-field precedence, 64-hex artifact/signature admission, nonempty trimmed key-ID admission, exact deterministic evidence-mode admission, and the accepted metadata tuple. Malformed opt-in can no longer silently disable signed-policy enforcement. The strict decoder rejects unknown status, open fields, non-nil metadata on rejected states, invalid hashes, padded or empty key IDs, non-deterministic accepted modes, and every status/value contradiction. FFI dispatch has no raw metadata fallback and no hash/evidence-mode policy function; it maps the installed closed decision to sealed policy errors and passes only accepted metadata to host provenance enforcement. The direct TOML compatibility constructor materializes an explicit legacy decision for isolated tests and host mechanisms, while artifact-only production replaces it and rejects any divergence from the GenesisCode result. The 674/277-line Rust authority split, 640/215-line FFI dispatch/policy split, and 659/213-line GenesisCode authority/FFI split remain below the 700-line ceiling. The partial profile identity is cc8fccc72810caf0369c719504d6fd2f09c5d68ec2bc1629bcc0f267ad114dc8, complete five-module source identity is 38296bba21dca17ab64a6e76fec5d3aeb6dca6c0a150c41d0992a6add9155010, and the tested candidate is 1,919,116 bytes with SHA-256 b0ce6ee3f176f5790ee443d9b14747ffc68bc4765c7e7e768dd4a381523be2fa. Twenty profile mutations, 35 complete authority controls, and 14 focused FFI policy, schema, signed-policy, payload-bound, provenance-envelope, and deterministic-boundary tests pass; the first focused run exposed and permanently corrected an evaluated :valid symbol in the GenesisCode constructor. Evidence: python3 scripts/lib/selfhost_effect_policy_composition.py --root . --profile policies/selfhost_effect_policy_composition_v0.1.json --schema docs/spec/SELFHOST_EFFECT_POLICY_COMPOSITION_v0.1.schema.json --self-test; GENESIS_TEST_SELFHOST_ARTIFACT=/private/tmp/genesis-ffi-signed-v11.gc cargo test -p gc_effects selfhost_authority_ --locked --offline -- --nocapture; and GENESIS_TEST_SELFHOST_ARTIFACT=/private/tmp/genesis-ffi-signed-v11.gc cargo test -p gc_effects ffi --locked --offline -- --nocapture. The same seven residual families remain, but hexadecimal/deterministic-mode policy selection is removed from the FFI residual; cryptographic provenance/signature verification and bridge/model lifecycle remain host mechanisms, SD-EFFECT-POLICY stays host-authoritative, and R4.2.d/SH-C remain open. Progress 2026-08-12: the resource protocol advances independently to closed version 4 and makes GenesisCode authoritative for the global [store] remote target, normalized remote_allow list, and allow_http state used by store object operations and package-resolution fallback. Rust transports only exact optional strings, booleans, and list entries plus closed invalid-type/invalid-entry observations; GenesisCode owns trimming, empty-target rejection, empty-entry removal, order and duplicate preservation, and every absent|invalid-type|invalid-entry|empty|valid disposition. The strict decoder rejects open or substituted maps, padded and empty valid values, contradictory status/value pairs, and noncanonical booleans or lists before installing private typed state. Store dispatch and default package registry selection consume only that installed authority state; raw policy.store.remote, remote_allow, and allow_http fields are unreachable from their production decision paths. URL parsing and normalization, exact/prefix/glob matching, credential and secret lookup, PEM loading, TLS construction, transport, cancellation, and replay remain bounded host mechanisms. Splitting resource authority from the unchanged version-11 operation producer leaves the GenesisCode modules at 281 and 409 lines and the Rust resource/store-remote decoders at 559 and 133 lines, below the 700-line production ceiling. The partial profile identity is f9e78cede7aa6a7edd85cdff646151ab3e9ac4dc47690febc5ae0b7a26fb75d3, complete source identity is f76c43eb2e9e4fd7abf5927e4650de021f0de930a76a714e456fa41552f6e755, and the tested candidate is 1,922,050 bytes with SHA-256 82f6ad4f3e6c4834ef19a0b93a3efd12488085613cdc78a1b7e9f9063fecc007. Twenty-one profile mutations, 38 complete artifact-only authority controls, and two store dispatch precedence/error controls pass. Evidence: python3 scripts/lib/selfhost_effect_policy_composition.py --root . --profile policies/selfhost_effect_policy_composition_v0.1.json --schema docs/spec/SELFHOST_EFFECT_POLICY_COMPOSITION_v0.1.schema.json --self-test; GENESIS_TEST_SELFHOST_ARTIFACT=/private/tmp/genesis-store-remote-v12.gc cargo test -p gc_effects selfhost_authority_ --locked --offline -- --nocapture; and cargo test -p gc_effects store_remote_dispatch --locked --offline -- --nocapture. This narrows global-store-remote-transport-tls-and-auth-policy to global-store-credential-tls-and-transport-policy but leaves seven residual families overall; the version-11 operation protocol is unchanged, SD-EFFECT-POLICY stays host-authoritative, and R4.2.d/SH-C remain open. Progress 2026-08-12: the closed version-19 operation protocol makes GenesisCode authoritative for the complete per-operation XR backend and device-policy decision: haptics input normalization and amplitude/duration limits; hand-tracking, hit-test, and spatial-mesh gates and bounds; anchor-space and layer-type allowlists; and anchor, mesh, layer, and opacity bounds. Rust transports exact TOML observations through one exact 18-slot vector; GenesisCode owns primary/alias and production/bridge precedence, trimming, empty removal, selective ASCII lowercasing, order and duplicate preservation, optional-boolean state, positive-limit state, the amplitude range state, and lazy effect-use errors. The strict 17-field decoder rejects open, substituted, padded, empty-valid, noncanonical-case, nonpositive-valid, out-of-range-substituted, denied-non-nil, and status/value-contradictory output. Backend, haptics, hands, hit-test, mesh, anchor, and layer dispatch consume only the installed typed policy; a closed source scan rejects restored raw TOML reads. The first map-based request exceeded the unchanged 20,000,000-allocation authority ceiling at 21,750,702 allocations, and a compact-output variant remained over budget at 21,735,414; replacing only the private XR map transport with the exact positional vector brought the complete eight-operation fixture under the existing ceiling rather than raising or resetting the resource budget. The 678/287/109-line Rust authority/decoder split and 442/256-line GenesisCode authority/XR split remain below the 700-line ceiling. The partial profile identity is 226337d43796b2ff1ec470a4cface91ac8b71b7171413023bb3f6e0fdd0d3c8c, complete ten-module source identity is 53990be6d761bdfd612be1198369b3e80cbfcd886d7d7569df540a0bb8ba9586, and the tested 1,968,074-byte candidate has SHA-256 54747cfc3ec6b19a19c8a09c6d25ac8bd0d6cdc48010d83b71d52a7f9543fe4a. Twenty-five profile mutations, 55 complete authority controls, six focused XR unit controls, and seven XR host-ABI/replay controls pass. Evidence: python3 scripts/lib/selfhost_effect_policy_composition.py --root . --profile policies/selfhost_effect_policy_composition_v0.1.json --schema docs/spec/SELFHOST_EFFECT_POLICY_COMPOSITION_v0.1.schema.json --self-test; GENESIS_TEST_SELFHOST_ARTIFACT=/private/tmp/genesis-r4-2-d-xr-device-v19-vector.gc bash scripts/selfhost_effect_policy_composition_guard.sh; GENESIS_TEST_SELFHOST_ARTIFACT=/private/tmp/genesis-r4-2-d-xr-device-v19-vector.gc cargo test -q -p gc_effects --lib xr --locked --offline -- --nocapture; and cargo test -q -p gc_effects --test host_abi_surface xr_ --locked --offline -- --nocapture. This retires device-and-graphics-policy: six global-store credential/TLS/transport, bridge identity/execution/model lifecycle, path/secret, effect execution/cancellation, replay, and TOML syntax/type-decoding families remain; SD-EFFECT-POLICY stays host-authoritative and R4.2.d/SH-C remain open. Progress 2026-08-12: the resource protocol advances to closed version 5 and makes GenesisCode authoritative for global [store] credential-source and mTLS-path policy. Rust transports inline bearer and Basic secrets only as :present|:invalid-type|nil and transports environment names, Basic username, and mTLS paths as exact strings or closed invalid observations; no secret bytes enter the authority request, hash, result, or logged policy term. GenesisCode owns all seven malformed-type states, deterministic conflict/dependency precedence, bearer-versus-Basic exclusion, none|inline|environment|implicit-empty source selection, Basic username, and mTLS path admission. The exact eight-field decoder rejects open, unknown, non-nil-invalid, source/detail-contradictory, environment-substituted, username-substituted, path-substituted, and missing-retained-secret results before injecting any private inline secret into typed enforcement state. Global store auth and TLS consumers then read only that installed state; a closed source check rejects restored raw global fields. Environment/secret lookup, relative-path resolution, PEM reads, TLS/client construction, URL handling, transport, cancellation, and replay remain bounded host mechanisms, and per-operation sync credentials remain under the path/secret residual. The 660/93-line policy/store-type split, 690/585/452-line authority/resource/credential split, 663/107-line remote/credential-consumer split, and 448-line GenesisCode resource producer remain below the 700-line ceiling; closed discovery reports a 687-line repository maximum. The partial profile identity is ae14e9b2f43ab96bbc2741e1b39d6c44d01b3467cfd91da9d4b5da1466929466, complete source identity is dd36767294d65a1bcdbe59e046c2c60a1a910148914b1be26bf6aed6e8e58920, and the tested 1,981,755-byte candidate file has SHA-256 cbd7628e6970580411827a730770a849f1dc1758506b7834cd4d1a42bc6d8768. Twenty-five profile mutations, 58 complete artifact-only authority controls, three focused credential/decoder controls, and three store-auth parsing/consumer controls pass. Evidence: python3 scripts/lib/selfhost_effect_policy_composition.py --root . --profile policies/selfhost_effect_policy_composition_v0.1.json --schema docs/spec/SELFHOST_EFFECT_POLICY_COMPOSITION_v0.1.schema.json --self-test; GENESIS_TEST_SELFHOST_ARTIFACT=/private/tmp/genesis-store-credentials-v5.gc bash scripts/selfhost_effect_policy_composition_guard.sh; GENESIS_TEST_SELFHOST_ARTIFACT=/private/tmp/genesis-store-credentials-v5.gc cargo test -p gc_effects store_credential --locked --offline -- --nocapture; and cargo test -p gc_effects store_auth_ --locked --offline -- --nocapture. This retires global-store-credential-tls-and-transport-policy by placing its remaining transport mechanisms under existing execution/path/replay residuals: five bridge identity/execution/model lifecycle, path/secret, effect execution/cancellation, replay, and TOML syntax/type-decoding families remain; SD-EFFECT-POLICY stays host-authoritative and R4.2.d/SH-C remain open. Progress 2026-08-12: the closed version-20 operation protocol makes GenesisCode authoritative for per-operation credential-source and mTLS-path policy on exactly core/sync::{pull,push} and core/pkg-low::publish. The operation request transports inline bearer/Basic secrets only as :present|:invalid-type|nil; GenesisCode shares the global seven-field decision algebra for malformed-type precedence, source conflicts, bearer/Basic exclusion, password dependency, Basic username, and TLS-path admission. Rust strictly rejects open, contradictory, denied-non-nil, environment-substituted, username-substituted, path-substituted, or missing-retained-secret results, installs a separate typed operation state, resolves its relative TLS paths only after authorization, and no sync consumer rereads a raw credential field. Environment lookup, secret use, path joining, PEM reads, and client construction remain the bounded path-and-secret-resolution mechanisms rather than policy choices. The first complete guard exposed that evaluating the full credential decision for eight unrelated XR operations exceeded the unchanged 20,000,000 allocation-unit ceiling at 22,252,386; the protocol now sends and requires nil for non-applicable operations and the exact fixture passes without raising or resetting the bound. The Rust authority was decomposed to 642/94/534-line orchestration/override/credential modules, remote policy/auth remains 638/114 lines, the GenesisCode operation producer is 478 lines, and closed discovery reports the unchanged 687-line repository maximum. The partial profile identity is 7850a093e101c88bd7ea0bd48a25a630ac99ba4c5d721b257b41ea4e0e13580d, complete source identity is 17e1c3716980b2ce3bc3a4f0bff23bb3e1f8c2aa9007eb314d28315373b27e32, and the tested 1,984,154-byte candidate has SHA-256 e9758ee60e907a2a3871e28bccf317801c69c2e8eb689df1d64d9d145e847ba2. Twenty-five profile mutations, 60 complete artifact-only authority controls, two direct decoder/consumer controls, one denied-operation control, and the repaired eight-operation resource control pass. Evidence: python3 scripts/lib/selfhost_effect_policy_composition.py --root . --profile policies/selfhost_effect_policy_composition_v0.1.json --schema docs/spec/SELFHOST_EFFECT_POLICY_COMPOSITION_v0.1.schema.json --self-test; GENESIS_TEST_SELFHOST_ARTIFACT=/private/tmp/genesis-sync-credentials-v20-applicable.gc bash scripts/selfhost_effect_policy_composition_guard.sh; cargo test -p gc_effects operation_credential_decoder --locked --offline -- --nocapture; and cargo test -p gc_effects sync_auth_ --locked --offline -- --nocapture. This removes all remaining credential-source/conflict/path-admission choices from the path/secret residual, but its host lookup/read mechanisms and the other four bridge-lifecycle, execution/cancellation, replay, and TOML-decoding residuals remain; SD-EFFECT-POLICY stays host-authoritative and R4.2.d/SH-C remain open. Progress 2026-08-13: exact SD-EFFECT-POLICY reaches H2 with none-proven host-oracle dependence. Production policy loading and package runtime profiling now decode TOML through a neutral, bounded transport that preserves candidate-domain observations and opaque enforcement material without applying allow precedence, defaults, normalization, resource policy, or admission semantics; they then require the GenesisCode authority artifact, while the Rust compatibility constructor is reachable only in the explicitly compiled parity harness. The authority may deny any candidate by omission but cannot invent an operation outside the transported domain, and Rust no longer reconstructs resource, inventory, capability, limit, bridge, process, database, network, crypto, credential, graphics, GPU, XR, FFI, or plugin outcomes to approve the GenesisCode result. Four focused controls prove denied-override preservation, structural-only decoding, authoritative subset denial, and invented-operation rejection; the complete governed guard passes all 60 artifact-only authority controls, and 25 independent profile mutations reject transport, oracle, route, ledger, schema, and claim drift. The H2 profile identity is fe658f1799789fd5bd531c997b03044615154c3760a0059ae7b1452678c4894b, its unchanged ten-module GenesisCode source identity is 17e1c3716980b2ce3bc3a4f0bff23bb3e1f8c2aa9007eb314d28315373b27e32, the tested 1,984,154-byte authority artifact has SHA-256 e9758ee60e907a2a3871e28bccf317801c69c2e8eb689df1d64d9d145e847ba2, and the resealed semantic-ownership ledger identity is 27bf871c6bad6a899f683521297e3e038ed0bdc1311a8f58702b1459041e156b. Evidence: GENESIS_TEST_SELFHOST_ARTIFACT=selfhost/toolchain.gc bash scripts/selfhost_effect_policy_composition_guard.sh; python3 scripts/lib/selfhost_effect_policy_composition.py --root . --profile policies/selfhost_effect_policy_composition_v0.1.json --schema docs/spec/SELFHOST_EFFECT_POLICY_COMPOSITION_v0.1.schema.json --self-test; python3 scripts/lib/semantic_ownership_ledger.py --root . --ledger docs/spec/SEMANTIC_OWNERSHIP_LEDGER_v0.1.json --schema docs/spec/SEMANTIC_OWNERSHIP_LEDGER_v0.1.schema.json --spec docs/spec/SEMANTIC_OWNERSHIP_LEDGER_v0.1.md --closure docs/spec/SELFHOST_CLOSURE_LEVELS_v0.1.json --self-test; and cargo check -p gc_cli_driver. The five residual inventory entries are bounded host execution, bridge lifecycle, path/secret resolution, replay execution/validation, and TOML syntax/type transport mechanisms rather than effect-policy choices. This does not close obligation/replay authority, aggregate R4.2.d, SH-C, bootstrap, or release claims; the next R4.2.d slice must retire the remaining semantic authority rather than rerun this promotion evidence. Progress 2026-08-13: exact SD-REPLAY reaches H2 with none-proven host-oracle dependence under genesis/selfhost-replay-authority-v0.1. Production genesis, genesis_wasi, and package-obligation replay load core/effects::replay-authority from the exact artifact-only toolchain and consume its request-bound verdict for program identity, ordered entry presence/exhaustion, index, operation, payload/continuation/request/response hashes, decision/cap structure, response-load admission, and all deterministic scheduler metadata. Rust retains only structural log decoding, seal/effect-program stepping, canonical hash observations, artifact/codec loading, and continuation application after acceptance. The former Rust semantic checker and every CLI/obligation caller are compile-time parity-oracle/parity-harness only, with no production fallback. One bounded adversarial harness accepts an authentic log and rejects 16 mutations spanning every serialized fact, missing/extra entries, and an unavailable response artifact; two direct decoder controls reject open and request-unbound authority results, while 16 independent verifier mutations reject source, artifact, protocol, CLI/obligation routes, fallback, bounds, ledger, and claim drift. The replay evaluator enforces a 20M-step and 32M-logical-allocation session envelope; the allocation budget is reset after separately bounded trusted bootstrap so production work receives the complete declared envelope. The H2 profile identity is a1e7d3dcbc5798c0abd40ab7f7a3385c5ab884af91b641d1721ad439b9f3d1df, source identity is 7a7472815b1204395aec5c539596d2de232afa3accb3b81a1739dab8c068ba57, the shipped 2,022,451-byte selfhost/toolchain.gc artifact has SHA-256 7f035627016e8fdb671b22de60e9d5ad92554b3142c69251825dc3bb916cce0c, and the resealed semantic-ownership ledger identity is cc914944a33f5847938ecb7508bf94657b67dfc460a78e1bae1ccdd380aaf4e5. Evidence: GENESIS_TEST_SELFHOST_ARTIFACT=selfhost/toolchain.gc cargo test -p gc_effects production_replay_authority_rejects_every_serialized_fact_mutation -- --nocapture; cargo test -p gc_effects --test task_concurrency_stress -- --nocapture; python3 scripts/lib/selfhost_replay_authority.py --root . --profile policies/selfhost_replay_authority_v0.1.json --schema docs/spec/SELFHOST_REPLAY_AUTHORITY_v0.1.schema.json --self-test; python3 scripts/lib/semantic_ownership_ledger.py --root . --ledger docs/spec/SEMANTIC_OWNERSHIP_LEDGER_v0.1.json --schema docs/spec/SEMANTIC_OWNERSHIP_LEDGER_v0.1.schema.json --spec docs/spec/SEMANTIC_OWNERSHIP_LEDGER_v0.1.md --closure docs/spec/SELFHOST_CLOSURE_LEVELS_v0.1.json --self-test; and the canonical generated-authority transaction for this revision. This does not claim H3/H4, aggregate R4.2.d or SH-C closure, bootstrap fixpoint, signing/evidence authority, or release qualification; remaining R4.2.d work must migrate the unfinished signing and evidence-verification decisions rather than rerun replay promotion evidence. Progress 2026-08-13: exact SD-SIGNING reaches H2 with none-proven host-oracle dependence under genesis/selfhost-signing-authority-v0.1. Artifact-loaded core/security::signing-authority owns keypair admission, exact package acceptance-message bytes, canonical acceptance-signature terms, sorted/deduplicated signature sets, transparency entries, exact DSSE PAE bytes, and GenesisBench signature artifact facts. Rust retains only operating-system CSPRNG, Ed25519 and SHA mechanisms, fixed codecs, owner-only regular secret-file custody, content-addressed storage, and exact state-pointer writes; secret material never crosses into the pure authority. Production package and hidden GenesisBench signers consume closed request-hash-bound authority results, while legacy package signature/transparency constructors are compile-time parity-oracle only. Key files are create-only and descriptor-opened with no-follow semantics; path races, mismatched pairs, symlinks, and permissive modes fail closed, and malformed signature-set or transparency-head state is no longer treated as empty. Four direct authority controls cover every phase plus open/unbound results and false mechanism facts; the authentic package policy flow and DSSE sign/verify round trip pass; 16 independent mutations reject profile, source/artifact custody, routes, fallback, bounds, secret custody, tests, ledger, and claim drift. The evaluator enforces 20M post-bootstrap steps, 64M logical allocations, and a 16 MiB payload ceiling. The H2 profile identity is 74c2a3f3cc898ced0222e96fc54886ac872fae1a540bfb82de5ac86a0cf80cb1, source identity is bd1f0ef085576dac984a8ab8eadaf4445a81037b8d7698560392f815a6fc6a97, the shipped 2,054,170-byte selfhost/toolchain.gc artifact has SHA-256 03185a82eed88946ca3b09b9d9708872742beecd62cf373c4ab2cb1f6182968c, and the resealed semantic-ownership ledger identity is 2315cd4cada4c7b8bc2c5a946563cd1d2b4aaa9383b6f53bf4d80837e3efc51f. Evidence: GENESIS_TEST_SELFHOST_ARTIFACT="$PWD/selfhost/toolchain.gc" cargo test -p gc_obligations signing --locked --offline -- --nocapture; GENESIS_SELFHOST_TOOLCHAIN_ARTIFACT="$PWD/selfhost/toolchain.gc" GENESIS_TEST_SELFHOST_ARTIFACT="$PWD/selfhost/toolchain.gc" cargo test -p gc_cli --test cli_smoke sign_and_verify_with_policy_succeeds --locked --offline -- --nocapture; cargo test -p gc_cli --test cli_genesisbench_registry signed_registry_admits_rescores_rebuilds_and_rejects_history_tampering --locked --offline -- --nocapture; python3 scripts/lib/selfhost_signing_authority.py --root . --profile policies/selfhost_signing_authority_v0.1.json --schema docs/spec/SELFHOST_SIGNING_AUTHORITY_v0.1.schema.json --artifact selfhost/toolchain.gc --self-test; and the canonical generated-authority transaction for this revision. This does not claim evidence-verification authority, H3/H4, aggregate R4.2.d or SH-C closure, bootstrap fixpoint, registry/benchmark publication readiness, or release qualification; the next R4.2.d transaction must migrate SD-EVIDENCE-VERIFY rather than rerun signing evidence. Progress 2026-08-13: core/security::evidence-verify-authority establishes a closed artifact-only protocol and takes production custody of transparency traversal/link/schema/cycle/bound admission and the final GenesisBench DSSE identity/cryptographic conjunction. Package verification now also requires its request-bound verdict, legacy top-level package verifier routes are compile-time parity-oracle only, and malformed acceptance or transparency-head pointers fail distinctly instead of being treated as absent. Three focused authority controls, authentic package and signed-registry flows, 16 independent profile/source/artifact/route/bounds/ledger mutations, the standalone verifier’s 30 negative vectors, native and pinned-SDK wasm32-wasip1 compilation, and the 318-second canonical changed-file profile pass. The truthful partial profile identity is 502ca038baddd38dbbf6ea346b50372af25e92692a68adac313e1bcc11585f1a, source identity is d36d18d7976d733614ae36d9a1938d05228909d948e41cf8d84d5351891ebcec, and the shipped 2,088,951-byte artifact has SHA-256 4f95a5439cdd9578c1e2c7a9364646893c27ca95399dfded14ea01985955ad2f. Final review rejected an H2 promotion: production package dependency integrity, acceptance/signature schema extraction, store-integrity booleans, and key-policy admission still arrive as host-computed semantic facts, so the GenesisCode package phase is a fail-closed conjunction rather than the sole semantic producer required by H1/H2. SD-EVIDENCE-VERIFY therefore remains H0/host-authoritative and R4.2.d stays open. The next slice must transport raw dependency hashes, acceptance/signature terms, store hashes, policy observations, and cryptographic mechanism results; GenesisCode must derive schemas, reference closure, key admission, and threshold from those raw observations before any H2 or aggregate closure claim. Evidence 2026-08-13: exact SD-EVIDENCE-VERIFY reaches H2 with none-proven host-oracle dependence under genesis/selfhost-evidence-verify-authority-v0.1, completing R4.2.d’s non-codegen obligation and policy authority set. The new core/security::evidence-verify-package module consumes raw ordered dependency hashes, acceptance and signature terms, observed content-store hashes, decoded registry-policy keys and threshold, and Ed25519 mechanism outcomes; GenesisCode alone derives dependency integrity, exact schemas, acceptance-reference closure, key admission, duplicate/unknown signature rejection, valid-signature count, and threshold satisfaction. Store-backed acceptance, signature, and transparency terms are decoded from the exact captured bytes whose hash is transported, eliminating hash/term substitution between path reads. The existing authority module independently derives transparency and DSSE closure from raw inventories and observations. Rust retains bounded decoding, hashing, content-store access, and Ed25519 verification mechanisms but no package, policy, threshold, store-integrity, transparency, or DSSE verdict; production routes have no reachable host semantic fallback. Four focused authority tests plus one captured-byte/hash regression cover identity/mechanism binding, package admission, transparency cycles/substitution, closed DSSE inventories, and single-read payload custody; authentic unsigned rejection, signed package verification, and signed GenesisBench registry history pass. The independent verifier rejects 24 mutations spanning omitted acceptance references, dependency/store/key substitution, threshold failure, duplicate/open signatures, malformed inventories, single-read binding, cycles, crypto failure, source/profile/artifact/route/fallback/bound drift, and stale ledger claims. The closed profile identity is f226266c6cb496a3ffca74d7a6e8ea35a8afead1b0206f7541edba2609ec6596; its authority/package source identities are 392dea213bc123269facfccb86f07cbc9fdae10c32cf87c6048120c7d6adf4c9 and 57b4ab38ff9333f3e8bb9de26ea23173467877cbf8bbb79275fd3488ff858442; the shipped 2,140,463-byte artifact has SHA-256 87266ae2fa1ffbdfd71b994774942db8608c56106e12dce6c59a6eb853c0636e; and the resealed 38-decision ledger identity is 132d2e60dc6bc263de0414e99f1cdbb964f99f61ce34e32f75f1bad2c51584f9. The canonical changed-file profile passed all core suites and five selected CLI integration suites in 290 seconds; boundary, readiness, and decomposition guards pass with the scorecard truthfully 44/not ready and 20 Rust/85 GenesisCode production modules under the 700-line ceiling. Together with the already closed H2 SD-OBLIGATION, SD-POLICY-ALIAS, SD-EFFECT-POLICY, SD-REPLAY, and SD-SIGNING rows, this closes R4.2.d only. It does not close R4.2.e, SH-C, H3/H4 bootstrap, registry/benchmark publication, or release qualification.
• R4.2.e Package, registry, and VCS logic. Manifest/lock resolution, graph solving, evidence verification, publish decisions, snapshot/diff/merge, migration, and package/lock/VCS object canonical identities become GenesisCode-authoritative; no non-frontend identity remains attributed to completed R4.2.a. Progress 2026-08-13: the first SD-STORE production slice moves core/store::put payload admission, self-hosted canonical printing and UTF-8 bytes, per-operation and cumulative byte-budget admission, and plain-BLAKE3 content identity into artifact-loaded core/store::authority under partial profile identity d5e7a1d4b6a71773cb721c11df1fdca51f9e81c68a42bad34e16805214041d6f. Rust propagates the exact frontend artifact into the runner, strictly rejects open, unbound, mistyped, byte-count/hash-contradictory decisions, writes exactly the authorized bytes through the write-once atomic store mechanism, and fails closed without authority; the prior semantic producer is compile-time test/parity-oracle only. Nine focused store controls cover roundtrip/replay, open-payload rejection before write, missing-authority failure, operation/cumulative limits, and existing get/log budgets. The independent verifier passes 16 source, custody, ordering, exact-write, decoder, fallback, and production-route mutations. The refreshed 86-module toolchain artifact is 2,154,584 bytes with SHA-256 dcef1bdfb37a9fba00a395cd5b894ebce11bd90d527f63cc90cc1a73925d7d2c. Evidence: cargo test -p gc_effects --test store_caps --locked --offline -- --nocapture; python3 scripts/lib/selfhost_store_authority.py --root . --profile policies/selfhost_store_authority_v0.1.json --schema docs/spec/SELFHOST_STORE_AUTHORITY_v0.1.schema.json --artifact selfhost/toolchain.gc --self-test; and scripts/check_selfhost_boundary.sh. This is deliberately partial: core/store::{get,has,verify}, local/remote selection, traversal, package/registry/VCS decisions, H2 SD-STORE, aggregate R4.2.e, SH-C, H3/H4, and release qualification remain open. Progress 2026-08-13: the second SD-STORE slice gives the same artifact-loaded authority exclusive production custody of core/store::{has,get} payload/lowercase-hash admission, planner-before-I/O ordering, local integrity verdicts, local/remote source selection, self-hosted CoreForm parsing, operation limits, cumulative remote-cache budgets, and final presence/error/artifact results. Rust performs only bounded stable local reads, policy-authorized remote presence/byte/integrity mechanisms, strict request/result and exact-cache contradiction checks, and write-once cache mechanics; missing authority fails closed and the old read producers are test/parity-oracle only. Thirteen focused effect controls pass, including authority-first malformed-hash rejection, local corruption classification, stable nondisclosing I/O errors, replay without the store, and absent-authority failure; three authentic CLI remote controls pass successful hydration, transport hash-substitution rejection before cache write, and cache-budget denial before write. The independent verifier rejects 23 source, protocol, parse, ordering, bounds, exact-write, decoder, route, fallback, and custody mutations. The point-object profile identity is 74914872ff002bd3026f788c9660b1dc4eaa56da78877ccd5eb19c342a17a745, source identity is 497d004ab31ac287d99c9d76bde68605afa1e28427dcfe6e36158b957e1ce244, ledger identity is 2d5b6d7ebaf8d764434e347749a5fd443b243233c6f411a9a78d1a972ea3bf04, and the 2,191,165-byte artifact has SHA-256 703ebf11fd9e955025dd25436d10de0152bde553e3c3126df64a606236ef6b95. The canonical changed-file profile passed all core, self-host, and selected CLI integration suites in 241 seconds after the frontend loader fixture was corrected to use the same artifact-only authority path required in production. This remains partial and H0: core/store::verify, store inventory/traversal, internal direct-store consumers, package/registry/VCS storage semantics, R4.2.e, SH-C, H3/H4, and release qualification remain open. Progress 2026-08-13: the third SD-STORE slice moves core/store::verify payload/lowercase-hash admission, canonical whole-store inventory selection and raw-byte ordering, observation binding, per-artifact and cumulative verification limits, integrity verdicts, and first-failure attribution into artifact-loaded core/store::verify-authority. Rust retains only bounded raw directory enumeration/file-type observation and bounded streamed BLAKE3 mechanisms; GenesisCode revalidates exact entry shape/order, selects only canonical regular-file hashes, re-derives the observed inventory, and assigns all public outcomes. The previous host verifier is compile-time test/parity-oracle only, production fails closed without either store authority binding, specific and scan modes have distinct intent binding, unsupported mechanism statuses are protocol rejections, and host I/O transport is stable and nondisclosing. Nine focused controls cover bounded/sorted inventory and streamed hashing, malicious empty-singleton no-panic rejection, authority-before-observation, canonical filtering, first ordered corruption, nondisclosing I/O, native specific/scan success, and native corruption reporting. The independent verifier rejects 43 mutations across both GenesisCode sources, artifact bindings, strict decoders, planner ordering, bounds, streaming, dispatch, fallback isolation, native CLI coverage, ledger truth, and source identity. The partial profile identity is d53e09a6c225c9283e205f2d71f5eed81440c25c517658b2e18ffd3729d70e54; put/read source identity remains 497d004ab31ac287d99c9d76bde68605afa1e28427dcfe6e36158b957e1ce244; verify source identity is 3d9a0bcd10d92a6838792ccce338a948ef578c9d209ad3364401d0ebf9ae48e2; and ledger identity is ef7c8f8fb09a1ce55ac57099090852aaf55f3b2c057ba1c48128533b273b78d8. The self-hosted 87-module artifact is byte-identical to its successor, is 2,223,591 bytes, and has SHA-256 0d15677f4bfe5554822cf93d749431214a2c46f4cb4647a8dbc1acae362c9537. This remains partial and H0: direct internal store consumers and package/registry/VCS storage semantics remain host-authoritative, so R4.2.e, SH-C, H3/H4, bootstrap fixpoint, and release qualification remain open. Progress 2026-08-13: the first SD-COMMIT slice makes artifact-loaded core/commit::authority the exclusive constructor and closed-schema validator for native commit new/show. GenesisCode owns required/optional field closure, target and author shapes, lowercase parent/base/patch/result/evidence/attestation identities, obligation and metadata admission, canonical object construction, and exact request-hash-bound results; Rust retains CLI transport, ref/store/patch mechanisms, bounded toolchain evaluation, artifact-hash contradiction checking, and diagnostics. The adapter strictly reifies runtime persistent maps instead of incorrectly requiring syntax-data maps, rejects open or request-unbound results, fails closed on missing authority, stores only the authority-returned artifact, and no longer pre-normalizes direct base or patch identities. Two decoder units and three native CLI controls pass, including complete rationale/obligation/evidence/author metadata roundtrip and rejection of a stored open commit object; the independent verifier rejects 13 source, identity, field-closure, manifest, decoder, request-binding, route, normalization, and negative-control mutations. The truthful partial profile identity is c0500da19e2cf86d3019f2493a612d925af2de1095245588d627d4235fb87327, source identity is 2369dea00c778642e10d0d510c53ed646a26fb305b4c96372e1909342e262d3c, and resealed ledger identity is 53bccf7461f6ea6d7b514d09f04b09b9fff7f9fe90d20ab3ae30111bf0a60a8a. The 88-module artifact is byte-identical to its self-hosted successor, is 2,252,710 bytes, and has SHA-256 9fc4d84336cbc0df736904af806de2b6d7f50921e10dc155061606a37ec81335. Evidence: cargo test -p gc_cli_driver --locked --offline commit_authority::tests -- --nocapture; GENESIS_SELFHOST_TOOLCHAIN_ARTIFACT=selfhost/toolchain.gc cargo test -p gc_cli --locked --offline --test cli_commit -- --nocapture; and python3 scripts/lib/selfhost_commit_authority.py --root . --profile policies/selfhost_commit_authority_v0.1.json --schema docs/spec/SELFHOST_COMMIT_AUTHORITY_v0.1.schema.json --artifact selfhost/toolchain.gc --self-test. This remains H0 and does not close R4.2.e: ref/patch/store/signing orchestration, WASI command parity, internal package/registry/VCS Commit producers/decoders, and the remaining lock/package/VCS identity decisions are still host-authoritative. Progress 2026-08-13: the first SD-REFS authority slice makes artifact-loaded core/refs::authority the exclusive semantic producer for direct core/refs::{get,list,set,delete} database decisions shared by native and WASI effects execution. GenesisCode owns exact-name lookup, prefix filtering and canonical order, absent-versus-unset expected-old semantics, conflict/write selection, single-name update or deletion, and request-bound response facts. Rust retains capability transport, database parsing, exclusive locking, crash-safe replacement, strict result contradiction checks, and a bounded optimistic protocol that re-evaluates GenesisCode after any concurrent snapshot change rather than inventing a host CAS verdict. Authority contexts now load lazily only when their operation executes, so merely allowing refs no longer bootstraps refs authority for unrelated store work; the store custody verifier mutation-proves this exact lazy route. Three decoder controls reject lookup/list substitution, false conflict/write actions, smuggled multi-ref changes, open fields, and wrong request identity; the authentic CLI roundtrip covers direct set/get/list/delete, expected-absent conflict, contract namespaces, and the retained policy-obligation rejection. The independent verifier rejects 13 profile, source, manifest, production-route, atomic-adapter, identity, and claim mutations. The truthful partial profile identity is 0c907043f31ecf9188b81c53fb45b737a817e8caba5b7d0bf1068ebd3a17a74c, source identity is 57b56ebc487033ddacaa4e000f209420dbb43aeff002877ace6f2a43999d6df6, and resealed ledger identity is 1719f0abbcc1e817ff61e1b5fbf12cafebe33f47b06ab0ef539cb5144cb3133d. The published 89-module artifact is 2,268,887 bytes with SHA-256 119210191782e5f4577c965f3a0ec1a70d99ac128fde088fc6d429dd6759932c. Evidence: cargo test -p gc_effects refs_authority --lib --locked --offline -- --nocapture; GENESIS_SELFHOST_TOOLCHAIN_ARTIFACT=/Users/corbensorenson/Documents/genesisCode/selfhost/toolchain.gc cargo test -p gc_cli --test cli_refs --locked --offline -- --nocapture; the pinned WASI 33.0 cargo check -p gc_wasi_cli --target wasm32-wasip1 --locked --offline; python3 scripts/lib/selfhost_refs_authority.py --root . --profile policies/selfhost_refs_authority_v0.1.json --schema docs/spec/SELFHOST_REFS_AUTHORITY_v0.1.schema.json --self-test; and the canonical generated-authority transaction. SD-REFS remains H0 and R4.2.e remains open: policy/evidence/signature admission, bulk sync/GPK reference updates, registry refs, H2 fallback closure, SH-C, bootstrap fixpoint, and release qualification remain host-authoritative or unproven. Progress 2026-08-13: the first SD-PACKAGE-RESOLUTION slice makes artifact-loaded core/pkg::lock-write-authority the exclusive production semantic producer for core/pkg-low::save-lock normalization, update-policy and resolution-strategy normalization or inference, legacy-version upgrade, canonical TOML bytes, and raw BLAKE3 lock-h. Rust now retains only artifact bootstrap, strict request-bound result decoding, capability-policy and sandbox enforcement, and atomic persistence of the exact authorized bytes; it rejects open fields, wrong request identity, malformed success/rejection shapes, non-UTF-8 bytes, and bytes/hash substitution. The former Rust GenesisLock::to_toml_canonical path is compile-time test/parity-oracle only, and production fails closed without the authority. Four focused controls cover exact byte parity with the legacy writer, symbol-versus-string strategy compatibility, open/unbound/substituted results, and malformed rejection shapes; the authentic package-init frontend roundtrip crosses policy admission, lazy authority loading, serialization, persistence, and lock reload. That roundtrip also measured an ordinary 90-module package policy at 21,169,109 allocation units, so its still-hard authority ceiling was ratcheted from 20,000,000 to 32,000,000 rather than adding fallback. The independent verifier rejects 13 profile, source, manifest, artifact, production-route, hash-contradiction, runner-load, identity, and claim mutations. The partial profile identity is dd406395cb370464a917cd3e564dcdd65e7b549df22f0733c3124f1887069e77, source identity is 9c32b71af883d2cab48750238d2a703bfb818c5554aa11a220b9996d6c421317, and resealed ledger identity is 4d86ffe5035691e3882364071d609d612a48d394a11dd111c40f6a184454b73d. Two consecutive artifact-only publications are byte-identical; the 90-module artifact is 2,327,314 bytes with SHA-256 e318e63ab87b90bbae5b6813176e2907b8dc877d70bea1f6d820f195f2c8e144. Evidence: cargo test -p gc_effects pkg_lock_write_authority --lib --locked --offline -- --nocapture; GENESIS_SELFHOST_TOOLCHAIN_ARTIFACT=/Users/corbensorenson/Documents/genesisCode/selfhost/toolchain.gc cargo test -p gc_cli --features parity-harness --test cli_pkg_engine pkg_init_value_matches_between_frontends --locked --offline -- --nocapture; python3 scripts/lib/selfhost_pkg_lock_write_authority.py --root . --profile policies/selfhost_pkg_lock_write_authority_v0.1.json --schema docs/spec/SELFHOST_PKG_LOCK_WRITE_AUTHORITY_v0.1.schema.json --self-test; and the artifact-only fixed-point comparison. SD-PACKAGE-RESOLUTION remains H0 and R4.2.e remains open: lock parsing, graph solving, update/install, registry behavior, workspace scaffolding, package/VCS object identities, H2 fallback closure, SH-C, bootstrap fixpoint, and release qualification remain host-authoritative or unproven. Progress 2026-08-13: the second SD-PACKAGE-RESOLUTION slice makes artifact-loaded core/pkg::lock-read-authority the exclusive production semantic producer for the typed public result of core/pkg-low::load-lock. Rust performs a bounded 4 MiB file read, UTF-8 validation, and generic TOML syntax decoding into a closed term transport; GenesisCode then owns version admission, required workspace and policy defaults, requirement update-policy and strategy normalization or inference, tag-policy compatibility, locked-entry validation, empty-source normalization, and the exact closed public lock term. The strict request-bound decoder rejects open, unbound, malformed, substituted, ill-typed, or noncanonical results, and production fails closed when the authority is unavailable; gc_pkg::GenesisLock::load is retained only in the compile-time test/parity-oracle route for this operation. Three focused controls cover a canonical document with unknown TOML data and exact empty-source behavior, malformed syntax and typed-metadata/semantic rejection, and open/unbound result rejection. The authentic install/verify frontend parity route traverses policy admission, lazy authority loading, bounded file transport, TOML transport, GenesisCode normalization, and the public CLI result. The independent verifier rejects 14 profile, source, manifest, artifact, codec, bounded-route, lazy-route, identity, ledger, and claim mutations. The partial profile identity is 2cae5e4a88227976de4db75a4edc1f89464fa6380b11cea261677e7a6fe9748c, source identity is 37f2cc15538994c3024d40dbabff91fa176a04cec53ba0ea17896edc2f048e3c, and resealed ledger identity is f7ef50ecb60126a2f079ac95b05c1110897d8599ec3632f18cb34cb4c51e0093. The published 91-module artifact is 2,360,472 bytes with SHA-256 02cdf5c7b96685914f5f328e73d687280a22ae93bcaf894467fe4e2dd206f7ce. Evidence: cargo test -p gc_effects pkg_lock_read_authority --lib --locked --offline -- --nocapture; GENESIS_SELFHOST_TOOLCHAIN_ARTIFACT=/Users/corbensorenson/Documents/genesisCode/selfhost/toolchain.gc cargo test -p gc_cli --features parity-harness --test cli_pkg_engine pkg_install_verify_values_match_between_frontends --locked --offline -- --nocapture; and python3 scripts/lib/selfhost_pkg_lock_read_authority.py --root . --profile policies/selfhost_pkg_lock_read_authority_v0.1.json --schema docs/spec/SELFHOST_PKG_LOCK_READ_AUTHORITY_v0.1.schema.json --self-test. SD-PACKAGE-RESOLUTION remains H0 and R4.2.e remains open: the generic Rust TOML decoder, other typed lock consumers, graph solving, update/install, registry behavior, workspace scaffolding, package/VCS object identities, H2 fallback closure, SH-C, bootstrap fixpoint, and release qualification remain production-required, host-authoritative, or unproven. Progress 2026-08-13: the third SD-PACKAGE-RESOLUTION slice makes artifact-loaded core/pkg::resolution-identity-authority the exclusive production semantic producer for canonical package requirement environment fingerprints created by lock, update, and install-time hydration. GenesisCode owns the exact seven-field identity map, canonical CoreForm printing, one trailing newline, and raw BLAKE3; Rust retains typed transport, bounded artifact-only evaluation, strict request-bound result decoding, and sealed diagnostics. All four production fingerprint sites now require the authority, while the former Rust printer/hash producer is compile-time test/parity-oracle only. Review caught and fixed an exact-closure defect before publication: field count alone allowed an omitted optional field to be replaced by an unknown field, so the authority now proves presence of all ten named request fields and a focused regression rejects that substitution. Three focused tests cover legacy identity continuity, open/unbound result rejection, and optional-field substitution; the authentic package-update frontend route exercises policy admission, lazy loading, graph resolution, fingerprint production, lock persistence, and Rust/self-host value parity. The independent verifier rejects 15 profile, source, manifest, artifact, decoder, fallback, lock/update/install forwarding, runner-load, identity, ledger, and nonclaim mutations. The partial profile identity is d0c54c8118fabbd219df0ab70d85fd0b8efb9a2945dd3986e20850e439b46d3d, source identity is 87ac19da44dfd30ac8a7a4a4f057b1215a87f24ca4c5ece99de9fbfaec472878, and resealed ledger identity is 2b68ec92c850c8cc7679ac8ce67862ffa8735a33d3d4a7d8824e1d8f6796f983. The published 92-module artifact is 2,374,043 bytes with SHA-256 6921291f1776b8b5605f73a499674be9fe586303d58e5d692ded462f991c099b. Evidence: cargo test -p gc_effects pkg_resolution_identity_authority --lib; cargo test -p gc_cli --features parity-harness --test cli_pkg_engine pkg_update_value_matches_between_frontends -- --exact; and python3 scripts/lib/selfhost_pkg_resolution_identity_authority.py --root . --profile policies/selfhost_pkg_resolution_identity_authority_v0.1.json --schema docs/spec/SELFHOST_PKG_RESOLUTION_IDENTITY_AUTHORITY_v0.1.schema.json --self-test. SD-PACKAGE-RESOLUTION remains H0 and R4.2.e remains open: selector parsing, update admission, graph solving, registry behavior, typed lock consumers, workspace logic, other package/VCS identities, H2 fallback closure, SH-C, bootstrap fixpoint, and release qualification remain host-authoritative or unproven. Progress 2026-08-13: the fourth SD-PACKAGE-RESOLUTION slice makes artifact-loaded core/pkg::resolution-plan-authority the exclusive production semantic authority for effect-route selector trimming, form admission and classification, strategy inference and declared-strategy agreement, tag-policy coherence, semver selection-policy normalization, and existing-lock update admission across lock, update, strict validation, and install hydration. The plan and fingerprint bindings share one bounded artifact-only evaluator context; Rust executes only semver grammar/comparison, ref observation, artifact/commit/registry/network mechanisms, strict request-bound decoding, and sealed route diagnostics. The former Rust selector parser, strategy/tag-policy validator, semver-policy normalizer, and update planner are compile-time test/parity-oracle only for switched routes, and production fails closed without the authority. Review fixed three pre-publication defects: evaluated map keywords required explicit quotation, syntax-data nil? could misclassify a runtime persistent plan map, and a naive diagnostic switch would have changed strict strategy/tag-policy failures from core/pkg/lock-invariant to core/pkg/bad-selector; the final protocol uses closed rejection classes and preserves each route’s existing diagnostic without re-deciding semantics. Nine focused tests cover all selector/update forms, malformed and incoherent inputs, uppercase-hash continuity, deterministic semver mechanisms, fingerprint parity, route diagnostics, and open, request-unbound, contradictory, or unknown-code results; the authentic package-update frontend route passes end to end. The identity and plan custody verifiers reject 15 and 17 independent mutations, and the shared adapter is decomposed into 435- and 432-line modules under the 700-line ceiling. The plan profile identity is 3ab6cf905fc776ef28c8e97593f235fa81e82e36d83ec2974172e5ebf4caff2d, source identity is 3b054daeb925c9f0b26012f66d6b100b018ff048fea36c57d47009874a774a00, and resealed ledger identity is e3302dc5e6d2c161bf7ab2c52846a09ba8f500ee38ae5aae3098116bec951344. The published 92-module artifact is 2,398,923 bytes with SHA-256 018ba87289d7eca3a534fd44936efb4cf70025b19976d4e002272906645e6334. Evidence: cargo test -p gc_effects pkg_resolution --lib; cargo test -p gc_cli --features parity-harness --test cli_pkg_engine pkg_update_value_matches_between_frontends -- --exact; python3 scripts/lib/selfhost_pkg_resolution_identity_authority.py --root . --profile policies/selfhost_pkg_resolution_identity_authority_v0.1.json --schema docs/spec/SELFHOST_PKG_RESOLUTION_IDENTITY_AUTHORITY_v0.1.schema.json --self-test; and python3 scripts/lib/selfhost_pkg_resolution_plan_authority.py --root . --profile policies/selfhost_pkg_resolution_plan_authority_v0.1.json --schema docs/spec/SELFHOST_PKG_RESOLUTION_PLAN_AUTHORITY_v0.1.schema.json --self-test. SD-PACKAGE-RESOLUTION remains H0 and R4.2.e remains open: generic typed lock consumers, semver mechanics, graph solving, ref and registry transport, artifact/commit validation, workspace logic, remaining package/VCS identities, H2 fallback closure, SH-C, bootstrap fixpoint, and release qualification remain host-required, host-authoritative, or unproven.
• R4.2.f Compiler, optimizer, linker, and builder. Bytecode/Wasm production, translation-validation orchestration, snapshots, target builds, and artifact manifests become GenesisCode-authored.
• R4.2.g CLI and agent orchestration. Command dispatch, warm/MCP schemas, card/docs generation, gate planning, and release assembly run from self-host artifacts without hidden Rust command semantics.

R4.3 Reduce host complexity

• R4.3.a Split oversized production modules and make coverage complete. Decompose gc_effects and gc_cli_driver by generated capability/command interfaces and shrink them as R4.2 migrates authority; meet GB-7. Replace fixed-list decomposition coverage with closed discovery of every production Rust source plus every .gc source reachable from selfhost/toolchain_manifest.gc and other production package/component manifests. The guard rejects missing, duplicate, symlinked, escaping, unknown over-budget, or policy-untracked modules and reports the true repository maximum; generated, fixture, test, example, and vendored exclusions are explicit and mutation-tested. R4.2 tasks must repair coverage for their newly introduced modules before their own authority switch rather than deferring a false-green guard to this later cleanup task.
• R4.3.b Generate repetitive bridges. One schema produces Rust host bindings, Prelude wrappers, capability docs/cards, MCP schemas, codecs, and parity tests.
• R4.3.c Audit all host escapes. Inventory FFI, process, dynamic library, WASI, GPU/UI, plugin, and model bridges; require capability and deterministic boundary contracts.
• R4.3.d Remove legacy authorities. Delete or archive old_bootstrap/ and obsolete Rust paths only after the release profile proves no production/test dependency and history preserves recovery instructions.

R4.4 Bootstrap fixpoint and trusting-trust defense

• R4.4.a Define stages and bootstrap artifact identity. Stage0 builds stage1 from pinned source; stage1 builds stage2; stage2 builds stage3. Define and independently verify canonical self-host source, component, composition, compiled, and bootstrap artifact identities plus admission rules; these non-frontend identities are not inherited from R4.2.a. Compare canonical artifacts and explain every intentionally host-specific envelope field.
• R4.4.b Make builds hermetic. Pin source, dependencies, profiles, environment, locale, paths, ordering, numeric behavior, and timestamps. Normalize or exclude nondeterministic container metadata.
• R4.4.c Require cross-host fixpoint after authority cutover. macOS arm64 and Linux x86_64 are tier-1 minimum; add a second independent builder implementation and tier-2 hosts before v1. A one-host R4.4.b rehearsal is diagnostic only and cannot satisfy this task.
• R4.4.d Add diverse double compilation. Rebuild critical toolchain artifacts through independently built stage0/verifier paths and investigate any mismatch before release.
• R4.4.e Publish bootstrap witnesses. Include source tree hash, stage hashes, build graph, toolchain identity, commands, environment, and independent verification result.

R4.5 Replaceability and conformance

• R4.5.a Publish a kernel conformance suite. Cover evaluation, seals, errors, canonical values/hashes, resource limits, and malformed/adversarial inputs independent of Rust implementation details.
• R4.5.b Publish effect-host conformance. Cover capability decisions, normalized paths, logs/replay, cancellation/kill/reap, payload limits, scheduling, and host errors.
• R4.5.c Validate an independent implementation. At least one independently authored stage0 or verifier passes the normative suite before the strongest replaceability claim.

R4 exit criteria: every production semantic decision has an ownership-ledger row; no row below its required level points only to completed migration tasks; all required components reach H2; stage0 is contractually minimal; stage2/stage3 are byte-identical on tier-1 hosts; DDC and negative controls pass; legacy authorities are unreachable or removed; an independent verifier/conformance implementation validates release artifacts.

---

R5. Stable language and platform contract

Goal: freeze a coherent v1 language profile and complete the semantics needed by real agent-authored systems without uncontrolled surface growth.

R5.1 Audit and freeze existing semantics

• R5.1.a Reconcile paper, handoff, specs, parser, Prelude, types, and all execution tiers. Generate a normative-form matrix and reject undocumented behavior. done 2026-08-11; evidence: scripts/check_foundation_stdlib_conformance.sh, scripts/check_host_abi_conformance.sh, and scripts/check_no_user_panics.sh; input: normative-form-matrix-sha256:b3265433eff8c885fa769348c6a88f0df0ba02c06ae0ef6c720b7db9d29c2ff8 Evidence 2026-08-11: docs/spec/NORMATIVE_FORM_MATRIX_v0.1.md and its closed machine matrix establish the complete v0.2 lexical grammar and 19 executable-form families, including the exact nine reserved heads, scope, canonical disposition, runtime witness, type expectation, effect facts, Prelude role, and eight implementation bindings. gc_coreform::SpecialForm is now the single exported reserved-head inventory consumed by canonicalization and exhaustive type/effect dispatch; the foundation conformance target rejects matrix/inventory drift, extra or missing reference/compiled evaluator heads, an independent-Wasm overclaim, malformed reserved forms, and reference/compiled divergence in values and canonical hashes. All 19 rows parse, canonicalize, execute in both tiers, typecheck, and infer effects as declared. Reconciliation corrected a real hidden contract: docs/spec/TYPES.md now documents mandatory ::meta :caps and exact unknown/strict-effect behavior. The paper and technical handoff label their syntax as historical/conceptual and defer to the closed authority; CoreForm and agent bundles link it. Focused CoreForm (16), type (18), and foundation (5) tests pass; schema validation and the 21-control stage0 dependency boundary pass; required foundation, host-ABI, and 378-file panic guards pass. Wasm is truthfully recorded as a reference-evaluator route rather than an independent form tier. This closure freezes no adjacent R5.1b-e surface, claims no cross-host or independent-Wasm parity, promotes no H-level, and changes no stage0 authority, fallback, release status, or downstream-product authorization.
• R5.1.b Promote effect rows deliberately. Audit existing gc_types row inference, polymorphism, strictness, diagnostics, and module boundaries; close unsoundness/completeness gaps before declaring GA. done 2026-08-11; evidence: cargo test -p gc_types --lib, scripts/check_foundation_stdlib_conformance.sh, scripts/check_host_abi_conformance.sh, and scripts/check_no_user_panics.sh; input: effect-row-contract-sha256:8db875db9ef8a5d1dfd5fb7ce41ddbc28e14dd119e228ff50a069f55717bd9f3 Evidence 2026-08-11: docs/spec/TYPES.md now distinguishes closed, anonymous gradual, and outermost-parameter-bound rank-1 effect rows and specifies fresh per-application substitution, repeated-variable consistency, unknown widening, strict-mode admission, duplicate-op rejection, and package-boundary behavior. gc_types replaces wildcard named tails with scoped row bindings, substitutes result/function/program rows, uses declared parameter types while inferring functions, and propagates concrete exported signatures through one package-wide environment. Typed-effect traversal, application matching, and declaration compatibility are isolated in focused modules; the production entry files remain below the 700-line decomposition ceiling. Duplicate export ownership, invalid or escaping row variables, nested-return or standalone-contract row introduction, unknown strict imports, missing imported capabilities, repeated inconsistent bindings, unknown-variable escape, duplicate operations, and lexical parameter/let shadowing fail or remain conservative under 32 focused controls. The final foundation conformance target passes 5 tests; host ABI policy passes 7 FFI and 3 deny-by-default tests; the 381-file production panic scan passes. This closure claims only the audited v0.2 effect-row and package-signature contract: R5.1.c-e, general module resolution/compatibility under R5.3, higher-rank and per-method type/effect polymorphism, cross-tier release parity, and GA release status remain open.
• R5.1.c Freeze error and pattern behavior. Exhaustiveness, duplicate bindings, guards if supported, sealed errors, and span provenance must match across tiers. done 2026-08-11; evidence: cargo test -p gc_coreform --all-targets, cargo test -p gc_types --all-targets, cargo test -p gc_prelude --test selfhost_parse_equivalence, scripts/check_foundation_stdlib_conformance.sh, scripts/check_host_abi_conformance.sh, and scripts/check_no_user_panics.sh; input: error-pattern-contract-sha256:787f6fefc3e9661ba809b7332f3b4b19bf1664cfb9d7e7b60d8ec88a9dc2ee49 Evidence 2026-08-11: the closed normative-form matrix now binds exact v0.2 binder, pattern, error, and location semantics to 12 unique repository-relative implementation sources whose existence is checked by conformance. Function parameters and sequential let bindings are symbol-only and unique; the canonicalizer and typechecker reject duplicate or destructuring binders deterministically, while top-level def remains explicitly sequential and rebinding. Pattern matching, destructuring, guards, and exhaustiveness are unsupported rather than silently partial: pattern-like heads remain ordinary applications and produce identical reference/compiled failures. Parse diagnostics use exact UTF-8 byte offsets, including source length at EOF; the native Prelude adapters and self-host parser agree on EOF, trivia, delimiter, literal, escape, integer, and token fixtures. Canonicalization preserves the full cause with a zero-based module-form ordinal, type diagnostics retain module path and diagnostic ordinal, and spanless runtime failures do not fabricate source locations. Fatal failures remain explicit KernelError values across reference and compiled execution; recoverable language failures use the trusted genesis/error-v0.2 seal with equal payloads, and error-shaped maps or user-created seals cannot forge protocol ERROR. CoreForm passed 27 tests across its targets, gc_types passed 35, native/self-host parse equivalence passed, foundation conformance passed 8 tests, host ABI policy passed 7 FFI and 3 deny-by-default tests, and the 381-file production panic scan passed. This closure adds no pattern syntax or guard semantics, claims no source-map profile or independent Wasm tier, promotes no self-host or release level, and leaves R5.1.d-e, R5.3, cross-host qualification, and GA status open.
• R5.1.d Specify numeric profiles. Integers, overflow, division, floats/NaN, decimal/bigint if included, serialization, hashing, and GPU/backend differences must be deterministic or explicitly profile-scoped. done 2026-08-11; evidence: cargo test -p gc_coreform --all-targets, cargo test -p gc_kernel --lib, cargo test -p gc_types --all-targets, cargo test -p gc_opt --all-targets, cargo test -p gc_prelude --test prelude_numeric_profile_conformance, scripts/check_kernel_tcb_contract.sh, and scripts/check_wasm_production_surface.sh; input: numeric-profile-content-sha256:e1bc94ca7620944fe7a40ab9b628eefb642bb8bf5d41b1fd8920c6226dbac74d Evidence 2026-08-11: NUMERIC_PROFILE_v0.1 now closes the v0.2 numeric surface in normative prose, a recursively closed machine schema, and a content-addressed profile bound to 12 unique implementation sources. Int is signed arbitrary precision across reference and compiled execution; the runtime’s i64 path promotes rather than wraps, and new int/div/int/mod primitives plus Prelude wrappers use Euclidean semantics for all divisor signs. Zero divisors return tier-identical trusted sealed core/numeric-error payloads. Dec is now a precise opaque type over the canonical fixed-decimal map, with constructor/operator inference, canonical normalization/hashing, a hard scale ceiling of 4096 enforced before proportional exponentiation, and sealed numeric rejection for invalid input or multiplication scale overflow. Core floats, NaN/infinity/signed-zero/subnormal/rounding semantics, decimal division, implicit coercion, and GPU-defined Core arithmetic are explicitly unsupported. Stage 1 remains arbitrary precision; ordinary gc_wasm inherits the reference kernel; Stage 2’s i64 lowering is a candidate only, and every emitted Wasm artifact now fails closed unless exact translation validation succeeds even when a caller omits the separate gate flag. Falsifiable controls first reproduced acceptance of scale 4097 and unchecked Stage 2 emission, then passed after repair. CoreForm passed 5 focused decimal and 20 library tests plus its integration targets; kernel passed 78 non-stress tests and focused post-decomposition numeric parity; gc_types passed 36 tests; all 118 gc_opt tests passed across the integration and focused stale-binder repair; numeric-profile conformance passed 3 cross-tier/identity/negative tests; foundation conformance passed 8; host ABI passed 7 policy and 3 deny-by-default tests; the 381-file panic scan passed; the 34-file kernel TCB contract and 9 mutants passed with eval_prims.rs reduced to 880 lines; and the production Wasm surface passed after correcting its parent cache scope from root-host to root-wasm, eliminating a false dual-reservation quota failure without raising quotas. This closure changes no integer literal grammar or canonical hash algorithm, provides no floating-point or decimal-division claim, grants no accelerator semantics, promotes no optimized/self-host tier, and leaves R5.1.e, cross-host qualification, and release authority open.
• R5.1.e Specify text/path behavior. Unicode normalization, byte strings, graphemes, path separators, case sensitivity, locale independence, and base-relative error payloads are explicit. done 2026-08-11; evidence: cargo test -p gc_prelude --test prelude_text_path_profile_conformance, cargo test -p gc_effects runner_io_ops::tests --lib, cargo test -p gc_types unicode_text_primitives --lib, scripts/check_foundation_stdlib_conformance.sh, scripts/check_host_abi_conformance.sh, scripts/check_no_user_panics.sh, scripts/check_kernel_tcb_contract.sh, and scripts/check_wasm_production_surface.sh; input: text-path-profile-content-sha256:3b46f02f0d61eef89f2895134f3a05c77a8a4a38acdf80ce274b58bc993d1cab Evidence 2026-08-11: TEXT_PATH_PROFILE_v0.1 closes the v0.2 text, byte, and filesystem-path contract in normative prose, a recursively closed schema, and a content-addressed machine profile bound to 14 implementation sources. Str remains exact well-formed UTF-8 with no implicit normalization: equality, ordering, serialization, and hashing distinguish canonically equivalent scalar sequences. str/len remains the compatibility byte count, while explicit Prelude/runtime/type surfaces add Unicode 17 scalar length, extended-grapheme length and slicing, and NFC normalization; exact unicode-normalization/0.1.25 and unicode-segmentation/1.13.3 dependencies pin the tables. Invalid grapheme bounds return tier-identical trusted sealed core/text-range-error; operations use checked bounds, logical memory accounting, fallible allocation, and shared reference/compiled semantics. Stage 2 strictly lowers translation-validated known-value byte/scalar/grapheme metrics and NFC and uses an explicitly reported translation-validated constant fallback for grapheme slicing rather than claiming native coverage. Filesystem payloads now reject absolute, drive-prefixed, backslash, non-NFC, empty, dot-component, and parent-component paths before host access; accepted identity is case-exact, locale-free, base-relative, and slash-only, with . naming the capability root. Responses reject non-UTF-8 names as sealed core/path-encoding-error, reject NFC collisions as sealed core/path-collision-error, and never use lossy conversion. IO failures carry only NFC base-relative material or <outside-base>/<invalid-path> sentinels, never host prefixes or OS messages. A pre-fix required-symbol control reproduced the absent core/str::byte-len surface; 4 profile controls, 5 path-boundary controls, 2 type controls, 3 focused Unicode-kernel controls, and the Stage 2 Unicode control pass after repair. Agent profile and exact symbol-index sources now teach the same units, normalization boundary, unsupported locale behavior, and portable path rules. This closure adds no implicit normalization, ambient locale, case-folded identity, regex/layout/segmentation breadth beyond graphemes, absolute language paths, floating text semantics, or independent-Wasm/self-host/release claim; cross-host filesystem qualification and later library breadth remain downstream.

R5.2 Deterministic structured concurrency

• R5.2.a Audit the existing concurrency contract/runtime. Reconcile CONCURRENCY_v0.1.md, schedule logs, task IDs, cancellation, joins, errors, and resource accounting.
• R5.2.b Add structured scopes. No orphan tasks; parent cancellation and failure propagation are deterministic and replayable.
• R5.2.c Specify communication. Channels/select/races, backpressure, fairness, ordering, deadlines, and closed-channel behavior have deterministic schedule facts.
• R5.2.d Enforce global and per-scope bounds. Task count, queue depth, messages, bytes, steps, effects, processes, and host workers cannot bypass parent policy.
• R5.2.e Differential/model-check schedules. Explore bounded interleavings and replay every accepted trace across tiers/hosts.

R5.3 Modules, contracts, and compatibility

• R5.3.a Freeze module resolution. Content identity, imports/exports, visibility, cycles, profile constraints, workspace overrides, and package boundaries are deterministic. done 2026-08-11; evidence: cargo test -p gc_types --all-targets, cargo clippy -p gc_types --all-targets -- -D warnings, scripts/check_foundation_stdlib_conformance.sh, scripts/check_host_abi_conformance.sh, and scripts/check_no_user_panics.sh; input: module-resolution-profile-content-sha256:b186e589bc5b6e466496f224c694712e411dac47c0f46e7ecdde6a6ce36ef8e1 Evidence 2026-08-11: MODULE_RESOLUTION_PROFILE_v0.1 freezes the opt-in v0.2 module contract in normative prose, a recursively closed schema, and a content-addressed machine profile bound to seven implementation sources. Canonical CoreForm module hashes bind exact content and metadata; a separate resolution hash binds the exact profile and manifest-ordered portable module path, content hash, lexical import/export sets, and closed profile map, while invalid closures receive no identity. The package manifest vector is semantic order: each local import must be a unique public export of an earlier module, so self, forward, and cyclic imports fail before execution and same-module recursion remains unchanged. Only declared exports are public; other top-level definitions are module-private, qualified interface symbols have portable namespaces, lexical fn/let shadowing does not create imports, and quoted symbols/map keys remain data. Package dependencies stay an outer exact-hash export layer: only manifest/lock-declared dependency exports enter consumers, private definitions do not cross the package boundary, and no directory, cache, environment, sibling workspace, version label, or ambient override can replace a locked artifact. Replacement requires an explicit identity-changing manifest/lock transaction. A pre-fix negative control reproduced typecheck_package accepting an undeclared cross-module reference; the profile-gated resolver now makes that case a deterministic module error without silently switching legacy module authority. All 46 gc_types tests pass, including seven profile controls for content/profile drift, all six three-module order permutations under a separately encoded specification model, undeclared/private/forward/cyclic imports, duplicate ownership, malformed paths/symbols, and lexical shadowing; strict clippy passes. Required foundation, host-ABI, and 385-file production panic guards pass, and the canonical generated-authority transaction passed 27 affected read-only validators before atomically promoting 47 derived files. This closure infers no compatibility from version labels, adds no aliases/wildcards/friend visibility/dynamic loading, provides no ambient workspace override, switches no R4.2 production authority, and promotes no package, self-host, backend, Benchmark, Foundry result, or release level; exact package negotiation, migration tooling, and support policy remain R5.3.c-e.
• R5.3.b Complete contract composition. Define blame, refinement/shape identity, effect interaction, generics/parametricity where supported, and optimization preconditions. done 2026-08-11; evidence: cargo test -p gc_types --all-targets, cargo test -p gc_prelude --lib, cargo clippy -p gc_types -p gc_prelude --all-targets -- -D warnings, scripts/check_foundation_stdlib_conformance.sh, scripts/check_host_abi_conformance.sh, and scripts/check_no_user_panics.sh; input: contract-composition-profile-content-sha256:066940da54751062e56fd093e8f76434c71fc3c6a7bc510810b57201c841d736 Evidence 2026-08-11: CONTRACT_COMPOSITION_PROFILE_v0.1 freezes an opt-in, package-closure-wide boundary in normative prose, a recursively closed schema, and a content-addressed machine profile bound to eight exact implementation/specification sources. Profiled interfaces require deterministic module resolution, strict shapes/effects, exact export/type/refinement key closure, concrete public types, explicit empty refinement sets, and qualified unique symbols; mixed profiles, malformed metadata, gradual or anonymous public rows, non-function contract methods, and unsupported non-empty refinements fail with lexically projected provider/consumer/boundary blame and no profile identity. Static shape identities hash alpha-normalized declared types, refinement identities bind canonical sets, interface identities additionally bind portable module path/export, and the profile identity binds manifest module order plus lexical interfaces; runtime dispatch shape_id, runtime value contract_id, static shape, and interface identities remain separate domains. Type compatibility now instantiates only declaration-owned rank-1 effect rows before structural subtyping, checks function inputs contravariantly and results/latent effects covariantly, treats keyed contract operations soundly, preserves strict closed-row exactness, and rejects duplicate record/contract labels instead of silently overwriting them. The only supported parametric fragment remains outer-parameter-bound rank-1 effect rows; alpha renaming preserves static shape identity, while higher-rank effects, value generics, type classes, implicit method polymorphism, and shape-row substitution are explicit nonfeatures. Every interface reports concrete/closed-shape/closed-effect/pure/refinement-free/contract-free/monomorphic predicates; eligible requires all seven but grants no rewrite authority and never replaces exact-artifact translation validation. The pre-fix controls reproduced all three defects: unsound covariant function parameters, duplicate-row overwrite, and ignored refinement metadata. All 58 gc_types tests and 14 Prelude library tests pass, including seven profile controls, positive/negative variance and effect-row cases, alpha/identity drift, deterministic blame, optimizer denial, and runtime identity-domain separation; strict Clippy and the foundation, host-ABI, and 386-file production panic guards pass. This closure adds no runtime cast/refinement prover, value-type or higher-rank generics, profile negotiation, self-host authority switch, optimizer promotion, package compatibility claim, Benchmark/Foundry result, or release level; those remain assigned to their named downstream tasks.
• R5.3.c Add profile negotiation. Packages declare minimum/exact compatible language, capability, artifact, and target profiles; unsupported combinations fail before execution. done 2026-08-11; evidence: cargo test -p gc_types --all-targets, cargo clippy -p gc_types --all-targets -- -D warnings, scripts/check_foundation_stdlib_conformance.sh, scripts/check_host_abi_conformance.sh, and scripts/check_no_user_panics.sh; input: profile-negotiation-content-sha256:3f088f61f86a8a8d5bc2306521005c7cf35562ed1c08220836a3851df534564e Evidence 2026-08-11: PROFILE_NEGOTIATION_v0.1 freezes package admission in normative prose, a recursively closed Draft 2020-12 schema, and a content-addressed machine profile bound to eight exact implementation/specification sources. Either negotiation field activates the entire module-resolved package closure; every module must agree on a closed four-family requirement map whose language, capability, artifact, and target entries use only explicit exact or minimum modes. Compatibility is read only from reviewed ordered lineages, never parsed from version labels: exact requires offered-set membership, minimum selects the earliest explicitly offered member at or after the requirement, and unknown families, members, modes, missing offers, partial closures, or identity drift fail with portable lexically ordered errors and no negotiated identity. The typed built-in offer advertises only language v0.2, pure/host-ABI availability, canonical CoreForm v0.2 artifacts, and the portable host runtime; custom offers reject unknown and duplicate members before admission. Capability availability remains non-authoritative: :caps is now duplicate-free and symbol-only for negotiated modules, the selected pure profile requires an empty declaration, typed transitive effects remain mandatory, and the runtime policy still grants each operation separately. Successful identity binds the immutable profile, exact module-resolution identity, sorted requirements, and selected members; unrelated unselected offer members do not perturb it. TypecheckReport::to_term exposes activation, requirements, selected profiles, per-module errors, and the 32-byte identity or nil to package-obligation and agent consumers. The pre-fix control reproduced typecheck_package accepting an impossible browser-v9 target; all 66 gc_types tests pass across targets, including eight profile controls for exact/minimum selection, least-compatible choice, offer stability, malformed capabilities, mixed/incomplete/unresolved closures, unavailable targets, fail-closed version handling, and explicit legacy inactivity. Strict Clippy, schema validation, foundation conformance, host-ABI policy/abuse controls, and the 388-file production panic scan pass. This closure grants no capability, infers no compatibility, gives legacy/raw-file execution no negotiated identity, claims no future build/deployment target or stable artifact beyond the named Core surface, switches no self-host authority, and promotes no package, backend, Benchmark, Foundry result, model, assurance level, or release level.
• R5.3.d Ship migration tooling. Canonical semantic patches upgrade syntax/APIs/formats; dry-run explains identity/effect changes and preserves provenance. done 2026-08-11; evidence: cargo test -p gc_types --all-targets, cargo clippy -p gc_types --all-targets -- -D warnings, Draft 2020-12 validation of MIGRATION_PROFILE_v0.1, scripts/check_foundation_stdlib_conformance.sh, scripts/check_host_abi_conformance.sh, and scripts/check_no_user_panics.sh; input: migration-profile-content-sha256:d3c96d807a62f0a4144b5b1d293f6dbdfec538fa40f49ec43d58b0cf8f5db0b1 Evidence 2026-08-11: MIGRATION_PROFILE_v0.1 freezes a pure profile-aware planner in normative prose, a recursively closed schema, and a content-addressed machine profile bound to eight implementation, verification, patch, and admission sources. It accepts only non-empty manifest-ordered canonical CoreForm closures with unique NFC base-relative module paths and metadata exactly projected from one ::meta; an exact expected package identity binds profile, order, path, and module hashes, so stale, detached, malformed, reordered, or host-specific input fails before rewriting. The closed canonical plan order covers executable list-head syntax rewrites that preserve quoted/vector data, package-wide qualified API renames across definitions, unshadowed references, and metadata while respecting fn/let binders, and exact-presence/value metadata format replacements. Every symbol rewrite declares an exact positive occurrence count, target-definition collisions fail, and rewrite chains require separately receipted migrations. Dry-run clones rather than writes, recanonicalizes, re-derives metadata, requires complete target typechecking against the explicit negotiated offer, and emits only the existing patch-profile-v0.2 version-1 :replace-node operations in manifest/form order. The plan, patch, source/target package and module identities, changed-form indices, complete target typecheck, before/after/added/removed effect sets with unknown flags, typed producer/source provenance, and optional parent receipt are deterministically bound into a self-excluding receipt envelope. Public limits cap modules and steps at 65,536, IDs at 1,024 bytes, intent at 16,384 bytes, paths/symbols at 4,096 bytes, recursive stack growth at 4 MiB, and failure summaries at eight 512-scalar diagnostics; metadata mismatches expose term hashes rather than attacker-sized payloads. A pre-fix inspection established that the existing patch executor had no profile-aware source precondition, migration plan, target admission, effect delta, or provenance receipt. All 73 gc_types tests pass, including seven migration controls for combined syntax/API/format upgrades without input mutation, byte-identical replay, quoted-data and lexical preservation, a real introduced demo/op effect, parent provenance, stale source, detached metadata, count/format drift, definition collision, plan ordering/chaining, NFC/resource bounds, invalid targets, schema closure, content identity, and source binding. Strict Clippy and schema validation pass; foundation conformance, host-ABI policy/abuse controls, and the 391-file production panic guard pass. The canonical generated-authority transaction independently passed 27 read-only validators and atomically promoted 11 derived documentation, release, roadmap, gate, and site views. This closure applies no patch, grants no capability, infers no compatibility from versions, switches no R4.2 production authority, and promotes no package, backend, target, Benchmark, Foundry result, model, assurance level, or release level; support policy remains R5.3.e.
• R5.3.e Publish support policy. v1.x compatibility, deprecation windows, security exceptions, format readers, and end-of-life are explicit. done 2026-08-11; evidence: cargo test -p gc_types --all-targets, cargo clippy -p gc_types --all-targets -- -D warnings, Draft 2020-12 validation of SUPPORT_POLICY_v0.1, scripts/check_foundation_stdlib_conformance.sh, scripts/check_host_abi_conformance.sh, and scripts/check_no_user_panics.sh; input: support-policy-content-sha256:ff05236d7536f36db376ac8533fb3321889e96a1715ef5a8e908a799b83ed061 Evidence 2026-08-11: SUPPORT_POLICY_v0.1 publishes the v1.x lifecycle in normative prose, a recursively closed schema, a content-addressed machine profile, and a pure typed decision API bound to the existing compatibility, version-surface, migration, release, and runtime authorities. The current 0.2.0 train is explicitly preview-candidate-only; stable v1 activation requires exact reviewed R9.1.a evidence, ambient time and semantic-version inference are forbidden, and every lifecycle transition consumes an explicit reviewed record without granting transition authority. Ordered standard, maintenance, and security-only minima are 548, 365, and 365 days, ordinary EOL cannot precede 1,278 days after GA, and the final v1 line remains supported for at least 730 days after a stable successor major. Stable source/API removal requires 365 days plus two subsequent minor releases, replacement, migration, rollback, diagnostics, tests, release disclosure, and a new identity for observable change. The exact 18-reader projection covers every currently accepted reader across the ten reserved compatibility surfaces: current writers remain current, four predecessors are read-only under their exact migration records, unknown/future identities fail before interpretation, and a promoted stable reader cannot retire inside v1 or without a successor-major policy, 730-day deprecation, bounded migrator, goldens, corpus or telemetry evidence, rollback, and separate authority. Active deprecations and security exceptions are explicitly empty. Security proposals are 1-90-day non-authoritative review candidates with 1-32 strict lexical unique evidence references, 4,096-byte fields, rollback, and replacement identity plus migrator for wire/semantic change; any attempt to bypass purity, seals, explicit errors, deny-by-default capabilities, bounds, hard cancellation, deterministic logs, replay, canonical identity, independent evidence, signing, or release gates fails closed. Ten focused controls prove exact registry projection, byte-identical decisions, preview nonclaims, ordered lifecycle transitions, source/API and reader windows, final-major support, unknown/future/oversized rejection, exception bounds/canonicalization, protected-invariant denial, profile/schema/source identities, and grants_*_authority = false. All 83 gc_types tests pass across targets, strict Clippy and independent Draft 2020-12 validation pass, foundation conformance and host-ABI policy/abuse controls pass, and the 393-file production panic scan passes. This closure activates no v1 release or stable identity, retires no reader or API, approves no exception or EOL transition, switches no R4.2 authority, and promotes no package, backend, target, Benchmark, Foundry result, model, assurance level, or release level.

R5.4 Standard library and capability surface

• R5.4.a Define the v1 stdlib matrix. Pure data/text/encoding/math/testing plus capability-backed filesystem, process, network, time, randomness, crypto, data, service, and model operations.
• R5.4.b Keep effect APIs capability-shaped. No ambient global handles; resources use scoped ownership, bounded streams, explicit closure, and sealed host errors.
• R5.4.c Finish robust codecs/protocols. Canonical JSON/CBOR or selected formats, HTTP, WebSocket, streaming, TLS policy, and package/evidence codecs have fuzzed incremental parsers.
• R5.4.d Define crypto correctly. Use audited host/provider primitives behind explicit capabilities; never invent cryptography in the kernel; expose algorithm/profile/version and deterministic test vectors.
• R5.4.e Treat model inference as an effect. Version provider/model/weights identity, prompt/input hash, sampling, token/resource budget, secret policy, output provenance, and replay mode. Fully local providers are first-class.

R5.5 Safe FFI and component extension

• R5.5.a Adopt a component boundary. Use the WebAssembly Component Model and WIT with an explicitly pinned WASI 0.3 profile for native async, streams, futures, and cancellation, plus a tested WASI 0.2 compatibility/virtualization path where ecosystem reach requires it. Define the exact Genesis value/effect/resource mapping and treat native escape hatches as higher-risk profiles.
• R5.5.b Generate bindings and capability manifests. Types, ownership, errors, resources, limits, and evidence derive from one schema.
• R5.5.c Sandbox extensions. Memory, CPU, calls, effects, filesystem/network, cancellation, and lifecycle are bounded; malformed components cannot panic the host.
• R5.5.d Make extension behavior replayable. Pure components are content-addressed; effectful calls log canonical request/response or an explicit non-replayable policy decision.
• R5.5.e Generate foreign-schema adapters without foreign application code. Import pinned WIT, OpenAPI/JSON Schema, Protocol Buffers, SQL schemas, C header metadata, and selected platform interface descriptions into one typed Genesis binding IR. Generated wrappers, ownership shims, codecs, capability manifests, cards, tests, and SBOM edges are deterministic and carry source identity; unsupported constructs fail with an exact adapter gap rather than producing unsafe bindings.
• R5.5.f Govern native and legacy ecosystem packages. Where Component Model isolation is unavailable, package native libraries behind a separately signed high-risk adapter profile with ABI/SDK/architecture identity, memory/lifetime rules, thread/callback policy, hard resource isolation where possible, and platform-specific negative controls. Application packages consume only Genesis APIs; handwritten foreign glue cannot hide in the application tree or acquire ambient authority.

R5.6 Unified application, web, and UI model

• R5.6.a Define one application architecture. Specify deterministic lifecycle, immutable state/update/view/effect boundaries, component identity, routing/navigation, dependency injection, configuration, localization, theming, error boundaries, hot replacement, and server/client/native ownership without adding UI semantics to the kernel.
• R5.6.b Build a typed presentation and style IR. GenesisCode owns document structure, components, layout, typography, color, responsive constraints, animation, focus, semantics, forms, validation, canvas/scene embedding, and design tokens. Invalid trees, inaccessible interactions, unbounded layout, unsupported target features, and style conflicts produce structured diagnostics.
• R5.6.c Implement the web product stack. Compile Genesis routes/views/styles to deterministic static HTML, scoped CSS, browser Wasm/JavaScript adapters, assets, source maps, CSP/integrity metadata, workers, service workers, and manifests. Support static sites, SPA, SSR/streaming, hydration, forms/actions, API routes, WebSocket, storage, offline/PWA, and progressive enhancement without application-authored HTML/CSS/JavaScript.
• R5.6.d Implement accessible cross-target widgets. Text shaping, images, lists, tables, controls, dialogs, menus, navigation, virtualized content, drag/drop, clipboard, accessibility trees, keyboard/touch/pointer/gamepad input, IME, reduced motion, high contrast, and screen-reader semantics behave consistently or expose explicit target limitations.
• R5.6.e Make UI rendering efficient and inspectable. Incremental dependency tracking, keyed diffing, layout/paint invalidation, batching, retained resources, streaming SSR, and target-specific rendering are outside semantic trust but translation-validated against the presentation IR. Devtools expose state, effects, layout, accessibility, frame work, and source spans without hidden mutation.
• R5.6.f Ship product-grade UI testing. Pure state/update tests, semantic-tree goldens, screenshot/pixel tolerances, accessibility audits, browser/native interaction replay, responsive matrices, network/offline faults, and performance traces share one Genesis test API and deterministic fixture format.

R5.7 Batteries-included service, data, and AI platform

• R5.7.a Complete typed service construction. Provide routing, middleware, request/response streaming, TLS termination policy, compression, cookies, sessions, CSRF/CORS, authentication, authorization, OIDC/OAuth integration, rate limits, idempotency, health/readiness, graceful drain, and generated API schemas/clients under explicit capabilities.
• R5.7.b Complete durable data APIs. Add typed schemas, queries, transactions, pools, migrations, fixtures, pagination, change streams, backup/restore, and deterministic local test stores across an embedded database plus profiled SQL, KV, and object-store adapters. Query generation is injection-safe and migration plans are reviewable and reversible where declared.
• R5.7.c Add production coordination primitives. Bounded queues, jobs, schedules, cache, pub/sub, email, object storage, distributed locks/leases, workflow checkpoints, and retry/idempotency policies expose exact delivery/order/failure semantics and replayable local substitutes.
• R5.7.d Unify observability and operations. Structured logs, metrics, traces, profiles, audit events, correlation/context propagation, redaction, sampling, retention, SLOs, alerts, and incident bundles are capability-scoped and portable to self-hosted open telemetry/storage components without entering deterministic application semantics.
• R5.7.e Build first-party data/numeric/ML libraries. Add typed arrays/tensors, tables/dataframes, streaming transforms, statistics, linear algebra, signal/image/audio operations, dataset manifests, checkpointed pipelines, and local model inference/training adapters with CPU/GPU backends, deterministic profiles, resource accounting, and no Python requirement for users.
• R5.7.f Provide secure application foundations. Password/key handling, account/session lifecycle, tenancy, authorization policy, schema validation, file upload, content scanning hooks, audit trails, privacy retention/deletion, and abuse controls ship as reviewed packages and threat-modeled reference architectures rather than ad hoc snippets.

Service/data dependency boundary: R5.7 is a parallel capability family, not a scalar release gate. Secure Core service proof requires typed services, durable data, coordination, observability, and secure application foundations (R5.7.a-d,f). R5.7.e gates only data/numeric/ML profiles and products that consume it. A service, Core, benchmark, or research release cannot be delayed merely because an unrelated accelerator or ML backend is unfinished, and no data/ML pack may borrow the Core service proof.

R5.8 Games, simulation, graphics, and creative media

• R5.8.a Define a deterministic game/simulation core. Add fixed/variable-step clocks, ECS or equally explicit world state, scenes/prefabs, events, input mapping, deterministic RNG, rollback snapshots, save/load, and reproducible simulation tests; wall time, devices, network, and assets remain effects.
• R5.8.b Complete 2D/3D runtime systems. Provide sprites, tilemaps, cameras, meshes, materials, lighting, animation, particles, collision/physics, navigation, spatial queries, culling, level streaming, and bounded resource lifecycles with headless reference behavior and real GPU/render backends.
• R5.8.c Make shaders and assets Genesis-authored. A typed Genesis shader/kernel IR emits validated WGSL/SPIR-V or target formats; image/audio/font/model/scene import, compression, atlasing, level-of-detail, packaging, hot reload, and license/provenance tracking form one deterministic asset graph. Users never patch shader or importer source in another language.
• R5.8.d Add audio and creative timelines. Mixing, buses, spatial audio, synthesis/effects, MIDI, recording/playback, animation/video timelines, deterministic offline renders, real-time deadlines, device loss, and content pipelines have explicit quality and resource profiles.
• R5.8.e Support networked interactive systems. Authoritative server, snapshots/deltas, prediction/reconciliation, rollback, lag compensation, matchmaking/lobbies, anti-cheat evidence hooks, replay/spectator, and bandwidth budgets are packages over the typed service and deterministic simulation contracts.
• R5.8.f Ship editor and debugging workflows. Scene/world inspector, asset browser, profiler, frame capture, live reload, deterministic record/replay, test level, packaging, and crash evidence are available through Genesis-native tools and generated MCP surfaces, not a mandatory foreign editor scripting language.

R5.9 Embedded language and hardware contract

• R5.9.a Define Embedded Linux and MCU profiles separately. Embedded Linux retains the full compatible host profile on pinned linux-arm64/linux-riscv64 systems. MCU profiles name exact CoreForm, type, numeric, allocation, recursion, concurrency, effect, panic, and library subsets; unsupported full-language behavior is diagnosed before code generation.
• R5.9.b Add closed-world static resource verification. Whole-program analysis computes flash/ROM, static RAM, stack per task/interrupt, bounded arena/heap, handles, queues, DMA buffers, timing classes, and peripheral ownership. Dynamic dispatch, recursion, allocation, or effect bounds that cannot be proven require an explicit larger profile or fail closed.
• R5.9.c Specify real-time and interrupt semantics. Interrupt handlers, priorities, critical sections, atomics, timers, watchdogs, RTOS tasks, cancellation, deadlines, power/sleep transitions, startup/reset, and crash persistence have deterministic core rules and clearly delimited hardware nondeterminism.
• R5.9.d Define capability-safe HAL APIs. Board manifests grant typed ownership of GPIO, ADC/DAC, PWM, timers, I2C, SPI, UART, CAN, USB, storage, display, audio, camera, sensors, motors, BLE, Wi-Fi, and Ethernet resources. Pin conflicts, voltage/mode errors, concurrent ownership, unsafe ISR calls, and unavailable peripherals fail before flash.
• R5.9.e Build IoT and robotics packages. MQTT/CoAP or selected profiled protocols, device identity/provisioning, secure boot/update hooks, telemetry, local rules, time synchronization, sensor fusion, motor control, safety stops, digital-twin simulation, and fleet policy remain self-hostable and capability-minimal.
• R5.9.f Preserve semantic identity across constrained compilation. The MCU AOT backend validates each accepted program against authoritative semantics for the embedded subset; fixed-width arithmetic, memory layout, volatile I/O, interrupt observations, and hardware faults use explicit target profiles and never masquerade as full-host equivalence.

R5 exit criteria: the v1 profile has no spec/implementation matrix gaps; effect rows and concurrency meet L3; numeric/text/path behavior is cross-host deterministic; stdlib APIs satisfy ownership/resource rules; compatibility and migrations work on the full corpus; extension negative controls pass; web/UI, service/data, game/media, and embedded profiles each have closed semantics, resource and capability models, generated agent cards, unsupported-feature diagnostics, and at least L2 reference implementations before target packaging may claim support.

---

R6. Packages, registry, builds, and deployment

Goal: let agents ship verifiable systems to the declared target matrix using infrastructure that can run entirely on the user’s own machines.

R6.1 Package and workspace completion

• R6.1.a Freeze manifest/lock schemas. Canonical dependency identities, features/profiles, capabilities, targets, evidence requirements, source substitutions, and migrations are versioned.
• R6.1.b Make resolution deterministic. Same repository snapshot and policy produces the same graph or exact conflict proof across hosts; no unlogged ambient registry state.
• R6.1.c Add workspace-scale operations. Incremental resolution, shared caches, semantic diffs, atomic updates, offline mode, vendoring, and policy review meet large-workspace budgets.
• R6.1.d Verify lifecycle scripts by construction. Prefer declarative GenesisCode build actions; any host process hook requires explicit capability, sandbox, provenance, and noninteractive behavior.

R6.2 Self-hosted registry trust

• R6.2.a Ship a local registry distribution. Single-node/offline use is complete; replication/mirroring is optional. No mandatory external account or hosted control plane.
• R6.2.b Add transparency and immutability. Append-only publish records, inclusion/consistency proofs, content-addressed blobs, namespace policy, and mirrored verification.
• R6.2.c Implement signing and rotation. Profile TUF-compatible threshold roles, delegated scopes, offline roots, freshness, rollback/freeze protection, compromise recovery, expiry, and reproducible key-policy tests; bind package evidence/transparency data without weakening TUF client rules.
• R6.2.d Enforce evidence policy. Registry acceptance checks source/artifact identity, compatibility, capabilities, obligations, reproducibility level, SBOM, provenance, and malware/policy scans without trusting publisher prose.
• R6.2.e Support air-gapped promotion. Export/import bundles preserve proofs, policy, revocations, dependency closure, and audit history.

R6.3 Build target matrix

• R6.3.a Define target profiles and promotion tiers. Profile native CLI/service, self-contained desktop, static/SPA/SSR/PWA web, WASI/component, edge/serverless, OCI/system service, iOS, Android, embedded Linux, and constrained MCU firmware separately. Each binds exact host/architecture/SDK/BSP/runtime, supported language/library/capability subset, artifact/install/launch contract, resource envelope, signing/update policy, and evidence level. A shared product may select several profiles, but an unavailable target fails before build.
• R6.3.b Implement genesis build. One self-hosted build graph emits target artifacts, capability manifests, runtime requirements, a profiled SPDX SBOM, in-toto/SLSA provenance, and Genesis evidence pointers.
• R6.3.c Make builds reproducible. Normalize paths/timestamps/order/archives; pin base images and SDK identities; compare independent outputs.
• R6.3.d Minimize artifacts. Tree-shake unused Prelude/capabilities, strip evidence duplication without losing verification, and report size/startup/memory budgets per target.
• R6.3.e Validate target parity. Normative programs produce the same semantic result/effects or an explicitly declared target limitation.
• R6.3.f Enforce authentic-artifact qualification. Replace current descriptor, empty-export, and synthetic launcher smoke paths with target-native executable entrypoints. Tests install or start each artifact in its declared runtime, cross the real process/browser/device boundary, exercise application logic and at least one scoped effect, collect logs/crashes/resources, and reject an archive whose suffix or metadata is the only target-specific property.
• R6.3.g Make generated glue disposable and non-authoritative. Platform projects, HTML/CSS/JavaScript adapters, Swift/Kotlin/XML, C startup/link files, shaders, container/unit manifests, and deployment configuration live in declared generated roots, carry source maps and input identities, are never hand-edited, and reproduce after deletion. Build diagnostics map failures back to Genesis source or a typed toolchain/SDK gap.

R6.4 Operations and lifecycle

• R6.4.a Generate deploy plans, never hidden imperative magic. Agents receive a reviewable diff of artifacts, capabilities, secrets, network exposure, storage, rollback, and evidence.
• R6.4.b Add health, migration, rollback, and recovery contracts. Service upgrades and data migrations are bounded, idempotent where required, observable, and reversible or explicitly irreversible.
• R6.4.c Handle secrets safely. Secret values never enter canonical source, logs, diagnostics, model contexts, or evidence; only references/policy and redacted attestations do.
• R6.4.d Verify deployment provenance. Running instances can report the exact package/artifact/evidence/profile identity without exposing secrets.
• R6.4.e Build a self-hostable deployment IR. Express machines, containers, services, routes, certificates, storage, queues, schedules, health, scaling bounds, updates, and rollback in typed Genesis data. Generate reviewable systemd/OCI/Kubernetes/edge/provider adapters where selected, but retain a direct single-machine path and never require users to author shell or YAML.
• R6.4.f Close application observability and incident response. Deployments bind dashboards/queries/alerts/runbooks to application schemas, preserve redaction and tenant boundaries, capture crash/replay/evidence bundles, and rehearse backup, restore, regional/host loss, certificate/key rotation, and compromised release rollback.

Shared delivery authority boundary: R6.3-R6.4 complete the profile-parametric build, artifact, deploy, rollback, provenance, and incident authorities plus their declared native/WASI CLI and service Core cases. Their generic harnesses must reject unsupported or synthetic targets, but completing them does not qualify every listed platform. R6.5-R6.7 and the corresponding R8.2 proof own the authentic execution, lifecycle, generated-glue, and physical evidence for each independently released pack.

R6.5 Web and full-stack product delivery

• R6.5.a Ship the Genesis web compiler and development server. Incremental route/view/style/asset compilation, SSR and browser bundles, hot reload, source-mapped diagnostics, local TLS, API proxying, deterministic fixtures, and offline operation use the same build graph and never require Node as an application-level dependency.
• R6.5.b Produce standards-valid deployable sites and applications. Emit static hosting bundles, self-hosted SSR services, portable edge components, service workers/PWA packages, integrity/CSP metadata, cache policy, redirects/headers, sitemap/feed/metadata, and optional OCI artifacts from one Genesis workspace.
• R6.5.c Prove real browser behavior. Test supported browser engines and mobile viewports for routing, forms, storage, workers, offline/online transitions, WebSocket, accessibility, security policy, hydration, update/rollback, and performance. Generated output is inspected for deterministic identity, dead-code/asset elimination, and absence of undeclared network dependencies.
• R6.5.d Ship a maintained full-stack reference product. Authentication, authorization, database/migrations, background work, file/object storage, email substitute, realtime updates, observability, backup/restore, deployment, and seeded maintenance are implemented in GenesisCode and run self-hosted end to end.

R6.6 Desktop and mobile product delivery

• R6.6.a Build real desktop applications. Generate signed/installable macOS, Windows, and Linux packages with a Genesis runtime/component, native windows, menus, tray, dialogs, clipboard, drag/drop, notifications, file associations, deep links, accessibility, GPU/audio/input, crash capture, auto-update, and rollback. Headless CI is supplemented by real OS launch and interaction evidence.
• R6.6.b Build real iOS and Android applications. Generate complete Xcode/Gradle projects as disposable outputs, compile/link the Genesis runtime and app, package valid signed .ipa/.aab artifacts, and support lifecycle, navigation/UI, touch/keyboard, accessibility, permissions, storage, networking, background modes, notifications, deep links, camera/media/location/sensors where profiled, crash evidence, and deterministic app data migration.
• R6.6.c Automate platform qualification. Simulator/emulator matrices plus named physical devices test install, first launch, suspend/resume, process death, permission denial/revocation, rotation/window changes, offline recovery, low memory/disk, upgrade/downgrade policy, and uninstall/data retention. Store submission remains an explicit operator-approved effect with reproducible unsigned inputs and separately managed credentials.
• R6.6.d Prove shared-product reuse honestly. A reference app shares Genesis business logic, schemas, tests, state/update/view code, and assets across web, desktop, iOS, and Android while recording target-specific code, capability, artifact-size, startup, memory, accessibility, and maintenance deltas. No percentage claim hides generated or duplicated code.

R6.7 Embedded Linux, microcontroller, and board delivery

• R6.7.a Promote Embedded Linux first. Produce reproducible linux-arm64 images/packages for Raspberry Pi-class boards with service/UI modes, GPIO/I2C/SPI/UART access, device-tree/udev/system integration through capabilities, cross-build and native-build parity, remote deploy/debug, read-only/offline operation, update/rollback, and power-loss recovery.
• R6.7.b Implement a closed-world MCU AOT pipeline. Compile the R5.9 subset to validated machine/object code or a proven minimal runtime; generate startup, vector table, linker layout, BSP/HAL bindings, memory map, debug symbols, firmware image, SBOM, provenance, and flash plan. Host Rust/C toolchains may be pinned implementation dependencies, but users author no C/C++/linker/startup source.
• R6.7.c Establish representative board families. Reach L4 on at least RP2040, a RISC-V ESP32 profile, an Xtensa ESP32 profile where the pinned toolchain is reproducible, and one Arduino-compatible constrained board; add new boards through signed BSP packages and conformance kits rather than compiler special cases.
• R6.7.d Build board simulation and hardware-in-the-loop infrastructure. Deterministic peripheral models and QEMU/Renode or selected open simulators run ordinary CI; isolated physical rigs flash, power-cycle, capture serial/debug traces, inject peripheral/network/power faults, measure timing/memory/power, and retain signed evidence without exposing lab control as application authority.
• R6.7.e Complete flash, debug, and OTA lifecycle. genesis device discovers only explicitly authorized boards, explains pin/resource plans, flashes/verifies, opens bounded serial/debug sessions, captures crash dumps, provisions secrets without logging values, performs signed A/B OTA with rollback, and recovers bricked/interrupted updates where the board permits.
• R6.7.f Ship maintained hardware products. Required proofs include a Raspberry Pi edge service/UI, RP2040 sensor/control firmware, ESP32 connected device with offline behavior and signed OTA, and an Arduino-compatible teaching/control workload. Each has a digital-twin test, physical-device test, enclosure/power assumptions, and seeded maintenance task authored entirely in GenesisCode.

R6 exit criteria: deterministic offline resolution and package builds pass tier-1 hosts; a self-hosted registry supports publish/mirror/revoke/recover; target builds meet reproducibility, semantic-parity, authentic-execution, and one-language-source gates; native CLI/service, WASI/component, web static/interactive/SSR, OCI/system service, desktop, iOS, Android, Embedded Linux, and at least two materially different MCU families reach L4 or are explicitly excluded from the named release; deploy/rollback/secret/device negative controls pass; no descriptor, empty export, synthetic hash launcher, simulator-only result, or generated-glue edit is counted as product support.

---

R7. Assurance, formalization, and security

Goal: turn the trust story into independently checkable evidence focused on the smallest and highest-impact boundaries first.

R7.1 Layered test strategy

• R7.1.a Classify the suite. Unit, semantic golden, negative boundary, property, differential, mutation, fuzz, model-check, integration, host-matrix, benchmark, proof, and release tests have explicit profiles and owners.
• R7.1.b Add grammar/AST/CoreForm generators and shrinkers. Generate valid and near-valid terms with effect/resource/profile annotations; preserve failure while minimizing counterexamples.
• R7.1.c Fuzz every parser and decoder. Source, CoreForm/artifacts, GCLOG, evidence, packages, locks, patches, bytecode, Wasm/component, protocols, and registry inputs must be bounded and panic-free.
• R7.1.d Add fault injection. Partial reads/writes, ENOSPC, permission races, process hangs, crashes, corrupt caches, lost network, clock anomalies, cancellation, and concurrent updates fail closed.
• R7.1.e Use mutation testing on trust checks. Demonstrate that tests fail when capability, seal, replay, signature, hash, bootstrap, and evidence validation is intentionally weakened.
• R7.1.f Build profile-parametric adversarial qualification for product generators and target adapters. Supply reusable mutation harnesses for presentation IR, generated glue, SDK/BSP identities, app/container archives, linker/memory layouts, shader/asset graphs, permission manifests, deploy plans, and device evidence. Every claimed pack binds its exact cases and proves stale, hand-edited, malformed, over-authorized, or non-executable outputs cannot qualify; completion of the harness alone qualifies no target.

R7.2 Formal models and proofs

• R7.2.a Mechanize the pure core. Define syntax, values, evaluation, determinism, substitution/environment relation, errors, and canonicalization in Lean or the chosen proof system.
• R7.2.b Prove seal properties. User terms cannot forge protected variants; boundary opening preserves the intended abstraction.
• R7.2.c Model effect dispatch/replay. Prove state-machine determinism, complete fact checking, fail-closed unknowns, and replay equivalence under the specified host assumptions.
• R7.2.d Prove bytecode safety/refinement. Verified bytecode cannot violate stack/frame/seal invariants and refines authoritative evaluation for the covered subset; track proof coverage explicitly.
• R7.2.e Model deterministic concurrency. Prove schedule-log/replay properties for the core task/channel calculus and connect executable tests to extracted/model traces.
• R7.2.f Verify critical canonical codecs. Prove or independently cross-check injectivity/canonicality assumptions used for content identity.
• R7.2.g Establish type/effect soundness. Prove progress/preservation or an equivalent executable safety theorem for the declared v1 fragment, including row/effect dispatch and sealed boundary behavior; publish machine-checked coverage and every excluded feature.

R7.3 Host and supply-chain hardening

• R7.3.a Threat-model every boundary. Kernel, Prelude, bridges, processes, network/server, plugins/components, model providers, package sources, registry, build workers, CI, signing, and update channels.
• R7.3.b Sandbox host execution. Least privilege, hard kill/reap, syscall/filesystem/network restrictions where available, bounded IPC, and platform-specific degradation policy.
• R7.3.c Pin and audit dependencies. Provenance, licenses, advisories, minimal features, checksums, vendoring/offline mirror, and update policy are part of release evidence.
• R7.3.d Harden release keys and builders. Isolated signing, threshold/recovery policy, reproducible unsigned artifacts, attestations, builder identity, and independent mirrors.
• R7.3.e Run external review. Commission or invite independent review of TCB, effects/replay, package/registry trust, bytecode verifier, and bootstrap process; track findings in upgrade_plan.md.
• R7.3.f Build the profile-parametric product and hardware supply-chain gate. Cover browser injection/XSS and origin policy, native/mobile signing and permissions, game asset/shader parsing, service authentication/data isolation, cross-compilers/SDKs/BSPs, debug and provisioning ports, physical access, firmware rollback, secure boot, OTA, peripheral/DMA races, and malicious component packages. Each claimed pack binds only its applicable threats, profile-specific mitigations, residual risks, and honest hardware-root assumptions; one pack’s qualification cannot satisfy or block another pack.

R7.4 Reliability and scale

• R7.4.a Soak long-lived daemons/services. 100k+ requests, cancellation storms, malformed clients, package churn, cache corruption, and constrained memory/disk.
• R7.4.b Test adversarial complexity. Parser/typechecker/collections/solver/log/registry inputs have documented worst-case or enforced budgets.
• R7.4.c Validate disaster recovery. Registry restore, key compromise, corrupt release mirror, bad migration, failed bootstrap, and incompatible package release have rehearsed runbooks and automated tests.
• R7.4.d Soak real products and devices. Browser/native/mobile applications, services, games, Embedded Linux systems, and MCU firmware undergo lifecycle, update, power/network loss, resource exhaustion, malformed input, and long-duration hardware tests under their declared SLOs; emulator success cannot erase physical failures.

R7 exit criteria: all trust boundaries have threat models and mutation-tested negative controls; fuzz/sanitizer/property soak has 30 clean days with no unresolved P0/P1; required formal statements are checked and coverage limits are published; independent review findings are closed or explicitly release-blocking; supply-chain/recovery drills pass.

Core assurance boundary: M5-C/M6 require R7.1.a-e, R7.2, R7.3.a-e, and R7.4.a-c for the finite Core subjects. R7.1.f, R7.3.f, R7.4.d, and target-specific product/device evidence gate only the platform pack that claims those targets. A missing pack witness cannot block Core, GenesisBench, Foundry, or Genesis Model, and a Core result cannot satisfy a pack’s generator, supply-chain, physical, or lifecycle evidence.

---

R8. Product proof and adoption

Goal: prove GenesisCode is useful rather than merely feature-rich, especially for the user’s own AI systems.

R8.1 Reference agent integration

• R8.1.a Integrate at least two agent stacks. One may be the user’s AI system; one must be independently implemented. Both use the versioned cards/diagnostics/MCP protocol rather than private repo prompts.
• R8.1.b Exercise the complete loop. Plan, author, check, run, inspect effects, repair, test, minimize capability policy, package, build, deploy, replay, and explain provenance.
• R8.1.c Publish failure taxonomy. Attribute failures to language ambiguity, card retrieval, diagnostics, model reasoning, tool protocol, runtime, policy, performance, or missing domain support.
• R8.1.d Ratchet from evidence. Roadmap priority responds to repeated measured failure classes, not isolated demo success or benchmark gaming.

R8.2 Eighteen-archetype universal product gauntlet

• R8.2.a Pure library and CLI. Parsing/transformation, tests, package, reproducible native/WASI builds.
• R8.2.b HTTP/WebSocket service. Structured concurrency, TLS policy, persistence, cancellation, replayable tests, OCI deploy/rollback.
• R8.2.c Data pipeline. Streaming, bounded memory, deterministic transforms, checkpoint/recovery, provenance.
• R8.2.d MCP/tool server. Generated schemas, authentication policy, bounded tools, audit/replay.
• R8.2.e Browser application. Worker/runtime boundary, deterministic state, package/build evidence, sandboxed effects.
• R8.2.f Package and registry workflow. Author, resolve, sign, publish, mirror, revoke, migrate, offline verify.
• R8.2.g Parallel agent refactor. Candidate forks, semantic merge/conflict, independent verifier, minimal patch selection.
• R8.2.h GPU or numeric workload. Pure kernel semantics, deterministic tolerance/profile, backend evidence, CPU fallback.
• R8.2.i Mobile embedding pilot. One iOS and one Android host integration using preserved platform toolchains; promote only if reproducibility, lifecycle, size, and debugging meet L4.
• R8.2.j Self-host toolchain change. Agent updates a non-TCB compiler/tooling component, bootstraps, differentially verifies, and produces a reviewable evidence bundle.
• R8.2.k Full-stack web product. The agent builds a responsive accessible site plus authenticated interactive application, SSR/API/database/background/realtime paths, offline behavior, browser tests, self-hosted deployment, and rollback with no handwritten HTML/CSS/JavaScript/YAML.
• R8.2.l Native desktop product. One shared Genesis app installs and runs on macOS, Windows, and Linux with native lifecycle, accessibility, filesystem/dialog/clipboard/notification capabilities, signed artifacts, update, crash recovery, and no edited generated project files.
• R8.2.m Cross-target game. A nontrivial 2D or 3D game uses deterministic simulation, input, physics/collision, animation, audio, Genesis-authored shader/assets, save/replay, networking or a declared offline scope, and real web/desktop plus one mobile build under frame/resource budgets.
• R8.2.n Creative media tool. An image/audio/video/scene workflow imports assets, performs deterministic transforms, previews through the real UI/media runtime, exports a standard artifact, preserves license/provenance, and handles malformed or oversized content safely.
• R8.2.o Embedded Linux product. A Raspberry Pi-class device runs a Genesis service or UI, accesses real GPIO/I2C/SPI/UART hardware under policy, survives power/network loss, updates/rolls back, and reproduces from a clean cross-build without foreign application code.
• R8.2.p Microcontroller firmware. RP2040 and ESP32-class boards compile the constrained profile, pass static memory/timing checks, exercise real peripherals and watchdog/reset paths, flash/debug through Genesis tools, and complete signed OTA/rollback where supported.
• R8.2.q IoT or robotics system. Device, gateway, service, dashboard, provisioning, telemetry/control, offline reconciliation, safety stop, fleet update, digital twin, and hardware-in-the-loop test form one capability-minimal Genesis workspace.
• R8.2.r Data science and local ML system. A reproducible dataset-to-analysis/model pipeline uses Genesis tables/tensors/statistics, CPU/GPU execution, checkpoints, evaluation, local inference service/UI, provenance, and resource evidence without Python notebooks or scripts.

R8.3 GenesisExamples and GenesisApps

This workstream refines the existing flagship-system allocation rather than creating a fifth product or a new semantic authority. GenesisExamples is the compact executable learning/reference catalog; GenesisApps is the maintained production-style showcase. R8.3.a-b form a finite post-Foundry seed checkpoint before GenesisBench or GenesisChallenge. R8.3.c-e continue toward universal platform maturity without blocking those downstream programs.

• R8.3.a Freeze the catalog, classification, and admission contract. Define versioned closed manifests for examples, apps, suites, and catalog releases; classify every retained project as language conformance, host/workflow fixture, tutorial example, reference example, or maintained application; and forbid relabeling a fixture, descriptor, headless plan, mock, screenshot, or generated archive as an app. Before each release, rank proposed projects by uncovered capability/profile combinations, compositional depth, algorithm leverage, agent-learning value, authentic-target evidence, user usefulness, maintenance burden, duplication, and opportunity to retire weaker fixtures; publish accepted and rejected portfolio decisions rather than expanding by taste. Each admitted item binds exact GenesisCode/CoreForm/package/lock/target/Genesis Algorithms identities, learning objectives or user outcomes, public API use, capabilities, resource budgets, threat model, deterministic and authentic-target acceptance, build/run/test/deploy/replay commands, source/generated/dependency inventories, provenance/license, supported and unsupported profiles, owner, maintenance window, evidence level, and supersession. Generate a browsable human/agent catalog, task cards, dependency graph, copy-free project creation command, and machine lookup from this single authority. Keep existing paths stable where practical and use catalog metadata rather than adding root-level clutter.
• R8.3.b Publish the finite algorithm-backed GenesisExamples/GenesisApps seed. After F2.r and the required authentic Core/web/tool profiles, release at minimum: a pure genesis/algorithms library-and-CLI tour; an MCP/tool server exposing bounded algorithm operations; a real HTTP/WebSocket server with persistence, cancellation, policy, replay, deployment, and rollback; and a separate responsive accessible full-stack website/application built and served by that stack with SSR/API/data/background/realtime/offline paths and no handwritten HTML, CSS, JavaScript, TypeScript, Python, Rust, shell, or deployment YAML. Also ship one integrated workspace composing the server and site while preserving their independent package/build identities. Every project must use one or more released algorithms for a workload-relevant purpose, exercise deterministic fallbacks and unsupported-profile behavior, install from a clean public checkout, and build/run with foundry/ deleted. Publish reproducible evidence, tutorials, architecture explanations, operational guides, and seeded repair/upgrade exercises. Independent checks must reject dependency theater, stale catalog identities, copied Foundry candidate state, hidden foreign source, mock-only target evidence, and public-example leakage into held-out benchmark payloads. This finite checkpoint activates GenesisBench Preview and GenesisChallenge; it does not claim universal platform maturity.
• R8.3.c Expand to at least ten maintained GenesisApps across every qualified archetype. Required set: replay-audited service/data system, MCP tool server, full-stack web product, native desktop app, shared iOS/Android app, game or rich interactive simulation, creative/data/ML tool, self-hosted package registry deployment, Raspberry Pi-class product, and MCU/IoT product across at least two board families. Map all eighteen R8.2 archetypes to at least one maintained app or an explicit unsupported/blocked record, prefer shared multi-target workspaces over target-specific clones, and add smaller GenesisExamples only where they isolate a genuinely reusable concept. Each app consumes only released packages, including a named Genesis Algorithms release where applicable; later Foundry proposals target successor package/app versions through ordinary destination review rather than mutating a running app or its baseline.
• R8.3.d Prove maintenance and one-language source closure. For every released seed and flagship, perform agent-authored seeded upgrades, dependency and algorithm-library migrations, defect repairs, policy tightening, target-profile migrations, rollback, disaster recovery, and generated-artifact deletion/rebuild. Publish patch quality, diagnostics and repair turns, total agent work, human review time, resource deltas, compatibility outcomes, and retained failures. A complete source/generated/dependency inventory rejects hidden handwritten glue, vendored target projects, cloud-only build steps, manual post-build repair, mutable Foundry dependencies, undeclared services, and generated files that have become source authority.
• R8.3.e Require independent operation and keep the catalog useful. At least two people or organizations outside the producing agent reproduce each claimed seed/flagship class from public documentation, complete clean install/build/run/deploy or flash, execute a maintenance change, and report every undocumented prerequisite, misleading claim, inaccessible workflow, foreign-language escape, or algorithm/profile incompatibility as a product defect. The documentation site exposes live compatibility and evidence status, exact commands, expected outputs, architecture and threat-model views, resource footprints, screenshots or recordings only as supporting evidence, and migration/supersession history. Measure successful starts, useful forks, maintained downstream use, issue-to-repair latency, and example-to-package/app promotion without treating page views, benchmark scores, or challenge prizes as product proof.

R8.4 Minimal human surface

• R8.4.a REPL: structured values/effects, multiline editing, history privacy, resource controls, profile selection, and replay inspection.
• R8.4.b LSP: parser/type/effect diagnostics, semantic navigation, format, safe actions, capability/policy insights, and incremental performance from shared schemas.
• R8.4.c Playground: locally hostable, browser-sandboxed, capability-minimal, version-pinned, shareable by content hash, and incapable of implying unsupported host effects.
• R8.4.d Core documentation spine: ship one getting-started path, language reference, agent SDK, capability and product/target matrices, Core CLI/WASI and service guides, operations/security, package/registry, self-host/bootstrap, and contribution guide generated from canonical sources. The matrix links independently versioned pack documentation and labels unavailable packs without requiring unfinished web, desktop/mobile, game/media, data/AI, Embedded Linux, MCU, or board tutorials for Core. Every released pack owns a Genesis-only tutorial with authentic build/run/device evidence and labels generated foreign artifacts as disposable internals before that pack can ship.
• R8.4.e Core ten-minute proof: a clean user evaluates a pure program, runs an effect under policy, inspects the log, and replays it in <=10 minutes without hidden setup; this proof uses only the finite Core profile and cannot inherit success from a platform-pack demo.

R8.5 Benchmark-to-adoption and native-model flywheel

R8.5-A GenesisBench adoption lane

• R8.5.a Build a calibrated capability frontier, not a puzzle set. After the finite R8.3.b GenesisExamples/GenesisApps seed, evolve GenesisBench from syntax and bounded repairs through repository-scale feature work, capability-safe services, public genesis/algorithms use and extension, performance engineering, package/deployment operations, cross-platform debugging, and self-host toolchain changes. Bind exact immutable GenesisCode, Genesis Algorithms, and public example/app catalog releases and maintain a versioned coverage ledger over every released language, library, toolchain, maintenance, capability, example, and L4 product surface. Every task represents useful GenesisCode work, has a mechanically checkable acceptance contract, declares an immutable epoch-local easy/medium/hard calibration independently from small/medium/large context, and remains valuable as an example, diagnostic, library regression, or general regression after its ranking weight retires. Public examples may define capability families, disclosed practice, and scorer-independent acceptance patterns, but private tasks require independent lineage and cannot copy a published solution, oracle, trace, or seeded repair. Publish smoke, fast, standard, and full forms with the distinct semantics in section 3.16; no missing stratum is hidden by an aggregate and no fast form substitutes for Trust-release or full-coverage evidence. Foundry search state and private candidate/oracle material are excluded; library or example membership never substitutes for independent scoring.
• R8.5.b Run rolling, equated temporal evaluations. Evaluate newly released models only against epochs precommitted after their immutable release when claiming temporal-clean; retain public and private anchor tasks for longitudinal trends, report contaminated and unknown results without suppressing them, and advance difficulty under BQ-5 rather than making scores easier to preserve a leaderboard narrative. Calibrate prospective easy/medium/hard bands on role-separated non-target pilots across materially different model families, test discrimination and differential item behavior, publish equating uncertainty, rotate saturated ranking weight without deleting anchors, and never relabel a historical item or score after observing a target model.
• R8.5.c Compare diverse model and agent families without interface favoritism. Include local open-weight, hosted, general-purpose, code-specialized, and GenesisCode-adapted systems under the same transport-neutral task authority. Preserve a minimum-common-denominator artifact-text matrix across at least three independently implemented interface stacks and model families, and prove native-tool versus canonical JSON-text-tool equivalence where both are eligible. Separate base-model capability from agent scaffolding through controlled card/tool/context/interaction ablations, report pass@k and attempt budgets without cherry-picking, and never combine incompatible epochs, interaction profiles, tokenizers, or scaffolds into one rank. Publish per-difficulty, per-class, per-capability/product, interface, and maintenance/new-build strata with lineage-clustered uncertainty; fast results name the exact form and remain directional, while standard/full claims require their complete predeclared matrices. Differential item behavior by model family, interface, tokenizer, or output convention triggers review and prospective repair, never target-specific prompt tuning inside a cohort.
• R8.5.d Turn failures into language and library work. Cluster failures by language ambiguity, missing primitive or algorithm API, library contract/retrieval/dispatch defect, card retrieval, diagnostics, repair guidance, tool protocol, policy ergonomics, runtime defect, performance, or model reasoning. Reproduce each eligible cluster with a minimal deterministic case, assign a destination owner, and either improve GenesisCode or Genesis Algorithms with regression evidence or record an explicit non-goal; AB-10 measures closure, not leaderboard movement. A Bench failure may propose a future Foundry task but cannot alter an active task, checker, library release, or historical score.
• R8.5.e Promote successful artifacts into the ecosystem. A benchmark candidate becomes a GenesisExample, GenesisApp component, genesis/algorithms change, other package, recipe, or diagnostic fixture only after independent destination review, semantic/obligation/policy/resource verification, provenance and license checks, secret scanning, simplification, catalog classification, and maintenance ownership. Algorithm-library admission uses the same F2.r promotion firewall and never trusts score, Foundry ancestry, or candidate similarity as correctness; example/app admission uses the R8.3 authority and never trusts score as usefulness or maintainability. Promotion does not expose active held-out material or preserve benchmark-only scaffolding in production APIs. Add license-clean source-migration and spec-reconstruction lineages only after the destination profile has authentic L4 support; score behavioral, property, metamorphic, security, accessibility, resource, deployment, and seeded-maintenance acceptance rather than reference-patch similarity, enforce GenesisCode-only application source, and meet BQ-17.
• R8.5.s Prove independent value and adoption. Require external operators to reproduce benchmark results, submit useful benchmark tasks, use and improve the disclosed Genesis Algorithms release, and build maintained GenesisCode artifacts without private project prompts. Track benchmark-to-doc, benchmark-to-diagnostic, benchmark-to-library, benchmark-to-package, benchmark-to-flagship, benchmark-user-to-language-user, and language-user-to-corpus conversion with consent. Optimize for durable software, trustworthy agents, reusable algorithms, and lower total agent work rather than leaderboard traffic or synthetic volume alone. Report GenesisChallenge participation and accepted contribution deltas separately; contest traffic, prizes, claims, or merges cannot satisfy benchmark reproduction, adoption, or rank.

R8.5-B Genesis Model lane

• R8.5.h Enforce the training/evaluation firewall. Use separate capability identities, storage roots, operators, and audit logs for corpus construction, training, held-out custody, evaluation, and result publication. Prove with canaries and adversarial tests that training cannot read active private epochs, evaluation cannot write training data, model output cannot alter scoring authority, and post-evaluation promotion requires an explicit reviewed transfer record.
• R8.5.i Build an evidence-bounded Theseus/ASI/Foundry research-transfer authority. Freeze clean, signed, content-addressed source editions of Project Theseus and The ASI Stack plus the independently reproduced MF Foundation snapshot and exact Genesis Algorithms release; record exact commits, included promoted and rejected artifacts, generators, permissions, licenses, evidence states, supersession links, and an artifact-to-claim crosswalk under MQ-1 through MQ-8. Treat cognitive compilation/IR, routing and specialists, memory and recurrence, fast generation, governed deliberation and test-time scaling, data and continual learning/unlearning, local hives, model custody, safety, resource economics, and Foundry mechanisms only as candidate hypotheses. For each candidate, replay the exact source report, closed Foundry receipt, or package evidence where artifacts permit, then predeclare a Genesis-specific workload, simplest adequate baseline, ablations, multiple seeds or deterministic proof, uncertainty, hardware/resource envelope, privacy/firewall analysis, claim/non-claim boundary, and independent transfer decision. Preserve null, negative, stale, missing-artifact, unsafe, and rejected outcomes. No prose, dashboard, dirty worktree, favorable latest run, Foundry search result, package membership, or project affiliation can directly choose the tokenizer, base, architecture, data, objective, routing, memory, inference, or deployment design. Emit a versioned transfer manifest consumed by all downstream model experiments; a reviewer independent of the source author, Foundry operator, algorithm-package maintainer, model trainer, benchmark operator, and release signer must approve every promoted mechanism.
• R8.5.t Ratify the Genesis Model Readiness Gate. Produce a closed, signed, independently reviewed readiness manifest that binds the stable GenesisCode v1 Core and Genesis Algorithms releases and support windows; an independently useful GenesisBench Trust release and BQ-7/BQ-8 adversarial firewall evidence; the reproduced MF Foundation snapshot; the accepted and rejected R8.5.i transfer records; data ownership, consent, license, privacy, safety, export, and retention decisions; available compute/storage/energy/operator budgets; threat model and incident/rollback plan; target local hardware profiles; reproducible training and release feasibility; and a predeclared simplest-adequate legally usable open-base strategy. An independent reviewer with no training, benchmark custody, Foundry search, algorithm-package promotion, source-project, or release-signing role must record pass, fail, or bounded deferral for every criterion. Unknown, unaffordable, unlicensed, unreproducible, privacy-unsafe, benchmark-contaminating, or operationally unsupported status fails the gate. Passing authorizes only the scoped model program; it grants no language, library, benchmark, capability, corpus, checkpoint, or release authority and can be revoked when an input identity or risk decision changes.
• R8.5.f Create a lineage-preserving training corpus after readiness. Store prompts, authorized context, tool traces, attempts, candidate trees, scores, reviewer decisions, accepted patches, failures, and counterexamples as content-addressed records. Split by task lineage, repository snapshot, profile, model family, and time before deduplication; preserve rejected outputs with explicit labels where safe; exclude secrets, active held-out material, incompatible licenses, unverifiable outputs, benchmark evaluator instructions, and every artifact not admitted under the exact R8.5.t decision.
• R8.5.g Select teachers by verified artifact quality after readiness. Teacher eligibility requires deterministic acceptance, obligation preservation, minimal authority, bounded resources, no editable-scope escape, independent review, stable replay, corpus admission, and compatibility with the exact R8.5.t scope; aggregate benchmark rank alone is insufficient. Weight diversity and difficult correct trajectories to reduce imitation collapse, cap repeated near-duplicates, and retain failure/repair contrasts so the student learns diagnosis rather than only final-form copying.
• R8.5.j Audit tokenizer and select a base model by evidence. Compare legally usable open bases across Cold Acquisition, general English/domain competence, context length, local inference, license, architecture/tooling openness, and per-profile hardware cost. Measure tokens per CoreForm node, symbol, diagnostic, task card, semantic patch, policy, and English request; add GenesisCode-specific merges only when they materially reduce complete trajectory cost without degrading English, structured output, or compatibility. Do not train from scratch unless a predeclared ablation proves specialization of available bases cannot meet the target. Every Theseus/ASI-influenced choice cites an accepted R8.5.i transfer record; absence of one means the baseline design remains unchanged.
• R8.5.k Perform manifest-bound continued pretraining. Train only on BQ-7/BQ-8-approved canonical source, specs/cards/indexes, valid-invalid pairs, tests/obligations, packages/policies, replay/evidence traces, semantic patches, self-host sources, and maintained projects. Bind exact dataset, tokenizer, base checkpoint, optimizer/schedule, code, toolchain, hardware, seeds, checkpoints, energy, licenses, and accepted research-transfer records; evaluate every checkpoint on non-training public diagnostics and private Genesis-Adapted tasks without selecting against active held-out answers.
• R8.5.l Train on verified observable trajectories. Supervise English request -> Goal/Intent IR -> authority retrieval -> plan -> transaction -> patch -> tests/obligations/policy -> diagnostics -> repair -> accepted artifact or abstention. Preserve successful first attempts, failed-then-repaired paths, safe abstentions, capability minimization, counterexamples, and alternative valid implementations. Train only on observable plans/tool records and consented artifacts; never claim or require reconstruction of private hidden reasoning.
• R8.5.m Add contrastive and preference learning from score vectors. Construct lineage-deduplicated comparisons for correct/minimal versus correct/over-authorized, root-cause repair versus workaround, semantic patch versus scope escape, general optimization versus benchmark recognizer, safe abstention versus invented API, and preserved versus weakened obligations. Keep deterministic validity as a hard gate, retain every comparison’s component score and reviewer authority, test preference-transitivity failure, and prevent stylistic/model-judge preference from overriding executable evidence.
• R8.5.n Add verifier-guided reinforcement under independent authority. Use multi-objective rewards for correctness, obligations, minimal authority, repair efficiency, patch quality, replay, and deterministic resources, with penalties for unsupported invention, evaluator interaction, scope escape, benchmark hardcoding, and policy broadening. The solver cannot read hidden verifiers, modify rewards, select retained episodes, or promote checkpoints; adversarial verifier, deterministic evaluator, corpus admission, and release authority are separately provisioned. Monitor reward hacking, mode collapse, task memorization, regression on Cold Acquisition accessibility, and exploit transfer across verifier versions.
• R8.5.o Distill, quantize, and meet Embedded Local profiles. Distill diverse per-class teachers and verified repair/abstention behavior into the smallest student that crosses declared reliability thresholds. Publish precision/quantization, memory, storage, startup, latency, energy, context, semantic quality, capability behavior, and degradation by Embedded-S/M/L hardware class; require offline inference, bounded cancellation, deterministic request identity, and no mandatory proprietary dependency. Size reduction never justifies hidden server fallback or weaker acceptance.
• R8.5.p Release a profile-bound Genesis Model package. The bundle contains model/weights/tokenizer/runtime identities, supported GC-AGENT and GenesisBench profile ranges, context/resource/capability limits, training-lineage and license summaries, accepted and rejected research-transfer manifests, benchmark evidence by isolated track, known limitations, reproducible inference/build instructions, SBOM/provenance, and migration/rollback policy. Language, benchmark, scaffold, and model versions remain independent; unsupported future profiles fail negotiation rather than being silently treated as understood.
• R8.5.q Integrate the specialist as a replaceable explicit effect. Route English/domain planning and GenesisCode specialization through content-addressed Goal/Intent IR and the R5.4.e model effect, preserving local and remote provider parity, secret policy, token/resource budgets, cancellation, provenance, and replay. Compare general-only, specialist-only, and routed two-model systems under identical acceptance contracts; deterministic runtime, obligations, policy, and release authority remain final. genesis ask works with no native model installed and with no required cloud service.
• R8.5.r Run controlled language/model co-evolution experiments. For every coupled language/tooling change and candidate model, predeclare and run current-model/current-language, current-model/candidate-language, candidate-model/current-language, and candidate-model/candidate-language cells across frozen model families. A model-only proposal freezes the language/tooling identity and runs the non-degenerate current-model versus candidate-model two-cell control; it may not invent a language candidate to manufacture four cells. Evaluate only the Core and independently released pack profiles declared compatible with the candidate, recording unsupported packs as exclusions rather than blockers. Measure verified solve rate and total agent work: context consumed, tokens, retrievals, repair turns, tools, runtime resources, required authority, migration, TCB/proof burden, and human inspectability. Reject private co-adaptation that improves only the combined cell, damages cold general-model learnability, weakens compatibility, or encodes benchmark answers. Research may run continuously; language or model promotion remains discrete and independently authorized.

R8.5-C GenesisChallenge contribution-contest lane

• R8.5.u Establish the GenesisChallenge authority and append-only ledger. This is post-v1 ecosystem work activated by the finite R8.3.b GenesisExamples/GenesisApps seed after exact reviewed R9.4.f and F2.r; it does not require GenesisBench Trust and does not block any product, pack, later Foundry expansion, or model release. Publish signed schemas and independently checked policy for challenge proposal, reproduced-defect or measured-baseline admission, exact repository/library/example/app revisions, editable/protected scope, acceptance and hidden adversarial controls, capability/resource/security/compatibility bounds, solver budgets, verifier identity, conflicts, expiry, claim leasing, coordinated disclosure, prize/credit terms, dispute/appeal, and destination-owned promotion. Include independently owned categories for creating a new example, promoting a tutorial into a maintained app, extending an app to a qualified target, replacing an inefficient algorithm use, and repairing or simplifying a retained app, but admit only work with a ready destination contract and reproducible baseline. Preserve every proposal, attempt, claimed result, invalidation, supersession, and terminal status by content identity. No proposer, solver, model/provider, Foundry operator, contest operator, benchmark custodian/scorer, verifier author, prize sponsor, or destination approver may unilaterally admit or verify its own work; evaluator or scorer changes are meta-challenges that shadow-replay retained history and cannot score themselves. Static and adversarial controls prove that GenesisChallenge records cannot enter GenesisBench cohorts, ranking weight, held-out custody, scorer authority, Foundry verification authority, algorithm-library or example/app acceptance, or release evidence.
• R8.5.v Operate a useful, credit-bearing GenesisChallenge season. This is post-v1 ecosystem work and starts only after R8.5.u. Admit real runtime optimization, correctness/security repair, diagnostics/agent-tooling, language/library/platform capability, proof/fuzz/conformance, and, only after a compatible independently released benchmark baseline exists, GenesisBench-validity challenges with reproducible baselines and independent destination owners. Run at least one challenge in each eligible category that has a ready verified baseline, retain failed and withdrawn attempts, and publish signed solver/model/tool attribution plus before/after vectors for correctness, safety, capability, latency, memory, energy, context, authority, proof burden, maintainability, and human review. A category without a ready destination is excluded with a typed reason rather than blocking the season. A claim becomes accepted or merged only after destination-owned review and complete regression/release gates; reward and credit never imply merge, language authority, benchmark rank, corpus admission, or training eligibility. Independently audit false-baseline, scope-escape, verifier-overfit, benchmark-hardcoding, capability-broadening, resource-shifting, collusion, Sybil, stolen-attribution, and self-verification controls, then feed accepted artifacts through the same promotion and provenance firewall as any other contribution.

R8-C GenesisCode v1 Core proof lane: R8.1, R8.2.a-b, and R8.4 close when the relevant AB-5, AB-6, AB-8, AB-11, AB-12, and Core-applicable UP budgets meet v1 targets; independent agents complete the native/WASI CLI and authentic service loops without human code or foreign-source edits; the human quickstart/tooling meet their SLOs; and failures and unsupported domains are published. This lane alone may advance GenesisCode v1 Core to release candidacy.

R8-P Universal platform maturity lane: R8.3.a-b first publish the finite post-MF GenesisExamples/GenesisApps seed and unblock Bench/Challenge without claiming universal maturity. The remaining R8.2 work and R8.3.c-e close when all eighteen archetypes pass for their independently versioned packs; ten GenesisApps reach L4; seeded cross-target and physical-device maintenance succeeds; every one-language source audit passes; and independent operators reproduce each claim. This broader lane advances M5-P and individual pack releases, not the v1 Core, Bench, or Challenge release clock.

R8-B GenesisBench trust-release lane: After MF and M1-B, R8.5.a-e,s close when AB-7, AB-9, AB-10, BQ-1 through BQ-6, and BQ-9 through BQ-20 meet v1 targets on held-out, temporal, maintenance, authentic-target, reconstruction, stratified-difficulty, model-portable, and isolated-track tasks; exact compatible GenesisCode and Genesis Algorithms releases are bound; three model families, three independently implemented interface stacks, and two independent operators reproduce the common closed artifact-text standard runs; native/JSON-text tool encodings agree where supported; fast forms remain directional; benchmark-task/result governance and adoption evidence pass; and no language, library, Foundry-search, contest, provider, or model release evidence is borrowed. This lane alone may advance GenesisBench after the compatible language-and-library environment is frozen.

R8-M Genesis Model lane: R8.5.h,i,t,f,g,j-r close only after GenesisCode v1 Core, GenesisBench Trust, reproduced MF including the exact Genesis Algorithms release, BQ-7/BQ-8, and MQ-1 through MQ-8 pass; R8.5.t is the single readiness decision and every implementation task depends on it; every admitted artifact satisfies corpus policy; the Theseus/ASI/Foundry transfer manifest is independently reproduced and reviewed; the profile-bound model meets one declared Embedded Local class without cloud fallback; and applicable four-cell or frozen-language two-cell studies preserve cold general-model accessibility across every profile the package claims. This lane alone may advance the Genesis Model package. Portfolio completion may report all four outcomes plus Challenge operation, but no outcome borrows another lane’s evidence or waits for an optional release clock beyond its explicit prerequisites.

R8-X GenesisChallenge operating lane: R8.5.u-v may start only after R8.3.b, which itself follows F2.r, and close a contest season, not a product release. The lane has independent challenge admission, verification, credit, dispute, and destination-promotion authority; it never changes a GenesisBench score, a Foundry receipt, or algorithm-library/example/app acceptance and blocks no maintenance or later release. Benchmark-validity challenges remain ineligible until a compatible independently released benchmark baseline exists. Accepted contributions advance only the destination task or release whose ordinary evidence contract they independently satisfy.

---

R9. v1 Core Trust Release

Goal: freeze, reproduce, attest, publish, operate, and support a finite GenesisCode v1 Core without overstating any claim. Core includes the frozen language/runtime/package/evidence/agent/self-host authorities, native and WASI execution, and authentic CLI/WASI plus service product proof. Platform packs, GenesisBench, Foundry, and Genesis Model retain independent release clocks and identities; compatible versions may be named, absent, experimental, or unsupported without blocking Core.

R9.1 Freeze and release candidates

• R9.1.a Freeze finite v1 Core profiles. Language, CoreForm, hashes, logs/replay, evidence, package/lock, patch, bytecode, snapshot, component ABI, bootstrap, native/WASI, CLI/service, and agent profiles receive final IDs. Every platform-pack profile remains independently versioned and outside the Core release dependency unless explicitly included by this frozen manifest.
• R9.1.b Enforce release branches by evidence. Only reviewed semantic patches with required gates and compatibility decisions enter release candidates.
• R9.1.c Qualify at least two release candidates without redundant execution. Both receive the complete Core host matrix, Core-scoped agent gauntlet, bootstrap, reproducibility, migration, rollback, security, and performance review. Before collection, replace the provisional fixed-quota sampling in policies/engineering_gate_timing_calibration_v0.1.json and its verifier with a predeclared class-separated sequential decision contract. Local warm, local clean/fallback, and hosted cold/shared-runner define distinct readiness and cache populations: cold observations are never discarded as warmups, while a warm class may discard only a bounded, retained, explicitly labeled prefix until a deterministic stationarity rule passes. Reuse every identity-compatible timing emitted by required candidate work; launch a dedicated observation only while an anytime-valid median/tail confidence sequence or equally rigorous distribution-free method remains unable to decide the declared containment or regression question. Each class declares the minimum sample needed to identify its statistic, precision target, hard maximum executions/time/cost, hard-failure treatment, anti-relabeling controls, and pass|fail|inconclusive terminal rule. Stop immediately when the decision resolves, preserve every conformant sample and hard failure, and never claim p95 or another tail statistic when the retained population cannot support its stated confidence. Derive ceilings only from a resolved class within the prior containment bound; never rerun a whole profile because another consumer needs the same fact. Collection runs autonomously under section 7 and cannot begin before a release candidate exists. The final candidate accumulates at least 30 continuous days of required soak with no unresolved high-severity finding; a change to an observed semantic, runtime, packaging, security, or release subject resets only that subject’s soak clock. Candidate overlap and observations from required lifecycle work are reused when identities match, but neither substitutes for the complete final-candidate exposure contract; calibration and soak never retroactively block pre-candidate implementation.
• R9.1.d Publish product-scoped release manifests. GenesisCode Core receives its own signed identity, owner, support window, compatibility range, evidence set, rollback path, and status. Every separately released GenesisBench, scaffold/adapter, task epoch, platform pack, Foundry snapshot, or Genesis Model package receives the same product-scoped treatment when it exists. Absent optional products are represented only by an explicit absent compatibility relation and require no fabricated package identity, evidence, owner, or synchronized release. A portfolio index may link compatible identities but cannot merge authorities, imply lockstep versions, or block GenesisCode because an optional product is absent.
• R9.1.e Freeze the Core and platform-pack matrix. Name every Core-qualified and independently pack-qualified web, service, desktop, mobile, game/media, data/AI, Embedded Linux, MCU, board, SDK/BSP, architecture, artifact, install/deploy, update, and operations profile at its exact L-level and release identity. Core requires only its declared native/WASI CLI and service rows. Experimental, unavailable, or unfinished pack cells remain machine-readable exclusions and cannot inherit a broad “full stack” or “embedded” claim.

R9.2 Reproducible distribution

• R9.2.a Produce signed source and binary bundles. Include installers/packages for supported hosts, self-host artifacts, offline dependency/registry options, profiled SPDX inventory, in-toto/SLSA provenance, licenses, symbols, and independent verification instructions.
• R9.2.b Reproduce independently. Two builders reproduce every tier-1 artifact; discrepancies block release and are preserved as evidence.
• R9.2.c Publish independently controlled E4 attestations and mirrors. At least two attesters/signers and two durable mirrors, controlled by independent people or organizations with disclosed conflicts and threshold/rotation/revocation policy, bind source-to-artifact, bootstrap witness, package graph, target profile, and evidence identities. Users can verify the complete set offline; loss or compromise of one project-controlled key, host, or operator cannot erase history, forge quorum, or make an unsupported claim E4.
• R9.2.d Reproduce authentic claimed products and firmware. Independent builders reproduce, install, launch, exercise, update, and roll back every artifact class claimed by the candidate. The Core candidate requires only its declared native/WASI CLI and service classes. A separately released hardware pack requires physical-device witnesses for its named board workloads, on its own release clock. Generated foreign glue is rebuilt from Genesis source and compared, not accepted as an opaque checked-in input.
• R9.2.e Test install/upgrade/uninstall. Clean, existing v0.x, air-gapped, low-disk, and rollback paths preserve user data and report exact compatibility issues.

R9.3 Operations and governance

• R9.3.a Publish security policy. Scope, reporting, supported versions, severity, disclosure, patch/signing procedure, and compromise recovery.
• R9.3.b Publish compatibility governance. Decision process, profile evolution, deprecation, emergency exceptions, and independent implementation input.
• R9.3.c Establish incident response. Rehearse bad release, compromised key, malicious package, registry split, verifier defect, replay defect, and bootstrap mismatch.
• R9.3.d Make telemetry optional. The project works fully offline; any opt-in metrics are transparent, minimal, redacted, erasable, and never required for evidence.
• R9.3.e Audit public claims. Every performance, self-host, security, agent-success, domain-support, and reproducibility statement links to an E3/E4 evidence ID and states limitations.

R9.4 Final acceptance

• R9.4.a No open release blockers. upgrade_plan.md has no open P0/P1, all required ledger rows are L5 on tier-1 platforms, and accepted lower-level items are explicitly excluded from v1 claims.
• R9.4.b Independent verification succeeds. A clean verifier environment checks the release, conformance corpus, bootstrap witness, registry/package proofs, and signatures without the producing CLI.
• R9.4.c User AI pilot succeeds. The user’s target AI systems complete independently custodied Core product-acceptance workflows with the published SDK and no private migration prompt. These workflows are not GenesisBench held-out material, do not require a benchmark release, and cannot be reused as benchmark or training claims without their separate admission authorities.
• R9.4.d Publish v1.0 and preserve it. Tag, sign, mirror, archive source/dependencies/evidence, publish migration/support dates, and create the post-v1 baseline.
• R9.4.e Demonstrate the finite v1 Core one-language promise publicly. From clean machines, independent general agents build and maintain the canonical CLI/WASI package and one authentic local service using only released GenesisCode interfaces, including package, policy, effect/replay, deploy, upgrade, rollback, and evidence workflows. Publish complete failures and manual interventions; any foreign-source edit invalidates that profile’s claim. Broader web, native/mobile, game/media, Embedded Linux, MCU, and hardware demonstrations attest their independently versioned packs and never retroactively block or inflate Core.
• R9.4.f Publish the four complete release views. Ship one version-bound human view (problem, install, supported products, explicit exclusions, and shortest complete demonstration), agent view (compact profile/cards, tool schemas, capability negotiation, stop conditions, and exact identities), auditor view (source/artifact identities, negative controls, evidence, reproduction, limitations, and nonclaims), and maintainer view (compatibility, migration, deprecation, rollback, security support, resource budgets, and release procedure). A clean human, an unfamiliar general agent, an independent verifier, and a downstream maintainer must each complete their declared workflow from the corresponding public entrypoint without private instructions or undocumented state. Generated projections remain derived, every view links the same signed release identity, contradictions fail publication, and the auditor surface may not substitute for a usable product experience.

R9 exit criteria: every R9 task is complete; all M6 GenesisCode v1 Core claims have E4 attestations; independent reproduction, authentic native/WASI CLI and service execution, and verification pass; operational drills and all four public release-view workflows pass; GenesisCode is installable and usable offline without GenesisBench, Foundry, or a Genesis Model; public claims exactly match the Core and platform-pack ledgers; the one-language source audit passes for every Core proof artifact; and every linked pack, GenesisBench, scaffold, epoch, Foundry, or model identity is independently releasable and truthfully marked required, optional, compatible, incompatible, preview, or absent. Physical-device and wider platform witnesses are mandatory for the pack that claims them, not for Core.

---

F. Post-v1 frontier program

Post-v1 autonomous promotion is intentionally outside the v1 critical path. Sandboxed task generation, solver/verifier research, non-normative Foundry design notes, and R8.5.r controlled co-evolution experiments may run earlier, but they cannot complete frontier tasks, change compatibility, evaluator, corpus, model, trust, or release authority, or weaken maintenance of the released profile. Foundry ratification and execution begin from the preserved v1 semantic/evidence baseline, remain separately locked and removable, and earn expansion through calibration rather than scope optimism.

F1 Bounded self-improvement

• F1.a Roadmap/task compiler. Extend R0.1.f’s reviewed static manifest into a proposal compiler that can derive candidate dependencies, risk, context, tests, evidence, rollback, and acceptance policy, but requires independent validation before changing the approved manifest and never treats prose or model output as authority.
• F1.b Supervised improvement loop. Retrieve cards, fork bounded candidates, propose semantic patches, run focused/full gates by risk, minimize/ablate, compare deterministically, and stop for human acceptance.
• F1.c Protected governance roots. Agents cannot unilaterally alter capability policy, signing roots, evidence verification, release rules, bootstrap trust, or their own approval constraints.
• F1.d Independent roles. Separately provision task proposer, solver, adversarial verifier, deterministic evaluator, and release authority; high-risk changes also require an independent human/reviewer role and conflict-of-interest records. No model, operator, credential, storage root, or derived agent may control all generation, verification, selection, and promotion roles.
• F1.e Longitudinal evaluation. Track accepted/rejected patches, regressions, repair time, evidence cost, human review load, and benchmark overfitting.

F2 Genesis Foundry: proof-carrying algorithm discovery

Activation: F2.a-r Foundry Foundation work is non-start-ready until exact reviewed R9.4.f closes. It then consumes the frozen Core semantics and independent verifier interfaces without waiting for examples, apps, or GenesisBench. F2.r is the finite Foundry/Genesis Algorithms release gate required by the R8.3.a-b GenesisExamples/GenesisApps seed and Genesis Model transfer work; R8.3.b in turn gates GenesisBench Preview and GenesisChallenge. F2.s-x and F2.z may expand after F2.r under isolated resources; F2.y remains non-start-ready until a compatible GenesisBench Trust root R8.5.s also closes. Earlier material is design input only and creates no workspace, implementation WIP, research receipt, package release, example/app release, or claim.

Goal: establish a separately bounded computational-science system that composes typed mechanisms, searches only declared grammars, quotients only by certified relations, verifies candidates independently, compares correct candidates on honest Pareto frontiers, mines reusable abstractions, and proposes but never authorizes production changes. Convert independently accepted proposals into a supplied, stable, .gc-native Genesis Algorithms package through a separate destination authority. The initial objective is calibrated rediscovery, trustworthy negative evidence, and a useful algorithm-library foundation, not a claim that general algorithm invention or novelty detection is solved.

Boundary and authority foundation

• F2.a Ratify the Foundry charter and ADR. Write docs/research/GENESIS_FOUNDRY.md and an ADR defining purpose, non-goals, FD maturity, proof-status vocabulary, candidate/task/law/promotion authorities, one-way dependency rule, compatibility policy, decommissioning, and exact distinctions among rediscovery, implementation improvement, regime-specific improvement, new local composition, candidate novelty, and externally reviewed novelty. The handoff text is input, not copied authority; every undecidable or aspirational claim is narrowed to a falsifiable contract.
• F2.b Establish the isolated workspace and dependency firewall. Create a separately locked foundry/ workspace whose code may depend on frozen public GenesisCode interfaces but is absent from the root production workspace’s default build/runtime/release graph. Start with the minimum modules/crates needed for the vertical slice; add gf_ir, gf_catalog, gf_search, gf_verify, gf_cost, gf_lineage, gf_registry, gf_packs, or gf_cli splits only after a measured boundary justifies them. A static architecture test rejects production imports of Foundry and a clean GenesisCode release succeeds when foundry/ is absent.
• F2.c Close the threat, trust, and claim models. Model combinatorial exhaustion, malformed graphs, nontermination, resource escape, undefined-behavior exploitation, verifier/oracle leakage, hardcoding, benchmark overfit, proof laundering, false-law poisoning, search-engine authority capture, history deletion, complexity ratchet, novelty inflation, dependency confusion, and compromised research artifacts. Identify the smallest independent proof/receipt checker TCB, provision generator/verifier/benchmark/promotion roles separately, and prove hostile mutations fail closed without weakening GenesisCode invariants.
• F2.d Freeze canonical artifact schemas and identity domains. Version closed schemas for mechanism/law manifests, semantic profiles, task specifications, candidate graphs, search manifests/checkpoints, verification and benchmark receipts, counterexamples, Pareto frontiers, abstraction proposals, promotion decisions, rejection/supersession records, and closed replay bundles. Use domain-separated canonical hashing, explicit parent/grammar/catalog/tool identities, bounded parsers, unknown-field rejection, migration fixtures, and independent decoding; a changed assumption, verifier, lowering, target, or proof invalidates inherited status.

Typed substrate and retained memory

• F2.e Implement the typed candidate IR and research CLI. Represent typed partial/terminal DAGs with ports, effects, semantic profile, pre/postconditions, produced invariants, unresolved obligations, representations, resource estimates, lineage, and explicit serial/parallel/conditional/fixed-iteration/divide-recombine/feedback/representation/incremental operators. Canonical serialization is stable across insertion order and hosts; malformed, cyclic-when-forbidden, type-incompatible, effect-incompatible, and resource-impossible graphs fail before execution. Expose a small research-only genesis-foundry CLI whose check commands are read-only and whose generation commands emit receipts.
• F2.f Build the versioned mechanism, law, and pack catalog. Define Levels 0-3 without mistaking textbook algorithms for primitives; each entry binds types, profiles, effects, contracts, executable reference, laws, proof/test scope, cost model, provenance/license, deprecation, and pack fingerprint. Separate production-approved, research-certified, and speculative law sets; duplicate or weak mechanisms face a complexity budget and consolidation/deletion review.
• F2.g Create independent task authority. Define task families by input domain, output relation, preservation, approximation, effects, resources, target profiles, generators, adversaries, reference relation, verifier configuration, hidden material, and alternative-solution policy. Precommit task and oracle identities before target search, separate development/calibration/held-out sets, preserve task lineage under mutation/interpolation, and prevent generators or search engines from changing acceptance after observing candidates.
• F2.h Implement append-only research memory. Store mechanisms, laws, tasks, candidates, checkpoints, verifier/benchmark receipts, counterexamples, negative results, discarded/pruned commitments, promotion decisions, and supersession edges in a research registry distinct from the package registry. Content identity, transactional writes, corruption detection, garbage-collection policy, export/import, transparency commitments, privacy redaction, and deterministic replay preserve history; no dashboard or mutable alias is evidence authority.
• F2.i Enforce hostile-candidate containment and reproducible scheduling. Execute candidates with no ambient effects under deterministic logical steps/allocation plus hard CPU, wall, memory, output, process, disk, checkpoint, and descendant-lifecycle limits. Seeded work allocation, ordering, resumable checkpoints, cancellation, lease cleanup, and crash recovery are replayable; resource exhaustion is a typed terminal result, and repeated timeout/kill/reap stress leaves no worker, descendant, pipe, lock, or artifact lease alive.
• F2.j Build an independent verifier protocol and checker. The checker runs without the search engine or mutable registry and combines structural/type/effect validation, contract checks, differential/property/metamorphic/adversarial tests, exhaustive bounded checks, symbolic/SMT adapters, proof-assistant replay, and artifact-to-theorem/translation validation as applicable. It minimizes and retains counterexamples, rejects forged/wrong-profile/stale/partial receipts, distinguishes unknown from false, and never converts tests or model judgment into a proof.

Decisive bounded calibration

• F2.k Freeze the pure bounded-sequence calibration pack. Start with compare, equality/order, select, compare-exchange, swap, rotate, min/max, load/store, and fixed network composition over bounded integers or symbolic comparison relations. Predeclare sort, min/max, median, top-k, short partition/dedup, prefix extrema, and merge tasks: sizes 3-5 are mandatory exhaustive calibration; sizes 6-8 advance only under explicit search/lower-bound budgets. Exclude arbitrary recursion, unbounded loops, effects, general mutation, floating point, LLM proposals, and novelty claims.
• F2.l Implement deterministic exhaustive search and structural reduction. Enumerate canonical well-typed graphs by increasing declared complexity with grammar-relative completeness, alpha/isomorphism canonicalization, symmetry breaking, partial-obligation pruning, branch-and-bound, resumable shards, and deterministic merge. Publish generated/pruned/deduplicated counts and independently checkable coverage commitments; a heuristic prune may not support an optimality claim unless its admissibility is proved.
• F2.m Add certified semantic quotienting and quarantined e-graphs. Convert eligible pure candidates to e-graphs under exact profile-tagged laws, retain witness paths, and extract deterministically for multiple cost models. Syntactic canonicalization, proved equivalence, bounded extensional equivalence, and heuristic mechanistic similarity remain distinct; only the first three may merge search states under their declared scope. Speculative laws run in isolated branches and every extracted candidate is independently verified; no research law enters gc_opt state.
• F2.n Add CEGIS and adversarial curriculum growth. Alternate proposal and independent counterexample search, minimize failures, append them permanently before repair, and require descendants to defeat the complete compatible curriculum. Separate generator and verifier randomness/authority; demonstrate detection of boundary, duplicate-heavy, sorted/reverse, overflow-profile, aliasing, nontermination, excessive-allocation, hardcoding, and law-poisoning families without leaking hidden inputs.
• F2.o Implement multiobjective cost and Pareto evidence. Keep symbolic operation/depth/space bounds, measured latency/memory/allocation/branch/cache/code-size/energy proxies, target profiles, conversion costs, amortization, and uncertainty separate. Retain raw samples, machine/tool/warm-state identities, outliers, timeouts, and applicability regimes; compare against reference, random-search, exhaustive/no-quotient, and simplest-known baselines. Never reduce incomparable profiles to an undeclared universal score.
• F2.p Prove construct validity with calibration and mutations. Predeclare known networks/results/lower bounds, intentionally broken candidates and receipts, search-engine ablations, anti-hardcoding variants, and cross-host replay. The system must rediscover several known optimal or near-optimal structures, reject every seeded false candidate/proof, preserve negative results, and explain misses before broader work. Search-space compression and speed count only if completeness/correctness claims remain valid.
• F2.q Release the Foundry Calibration snapshot. From a clean isolated checkout, deterministically search, verify, compare, explain, export, and replay the bounded sequence suite; a second operator reproduces its closed bundles without the producer or model. Publish complete methods, lineage, counterexamples, Pareto sets, compute/storage costs, calibration misses, limitations, and explicit no-novelty/no-production claims. This is the research calibration checkpoint and the hard gate for library promotion and every later Foundry search mode or pack.

Calibration checkpoint: F2.a-F2.q are complete; FB-1 through FB-12 pass for the bounded calibration scope; the second operator reproduces the snapshot and every accepted/rejected receipt from declared inputs; all misses, counterexamples, resource costs, proof limits, and no-novelty/no-production claims remain visible; production builds pass with foundry/ absent. This checkpoint authorizes only destination review under F2.r; it does not authorize a package, model, optimizer, benchmark, or language change.

Promotion boundary and first supplied library

• F2.r Release Genesis Algorithms v0.1 through an independent package authority. Establish the supplied genesis/algorithms package collection and a closed promotion schema that binds source candidate and calibration snapshot, exact destination API/contract, supported semantic and target profiles, proof/test/counterexample scope, complexity and measured cost, provenance/license, deterministic fallback, compatibility/migration, maintainer, review/signature threshold, rollback, and supersession. Seed the release with useful .gc reference algorithms plus only those fixed-domain specialized sequence variants independently accepted from F2.q; generic APIs must remain correct outside a specialization through explicit applicability checks and fallbacks. Generate compact human/agent documentation, package-local examples, symbol cards, and package evidence; reproduce build/test/package/install/use from a clean checkout with foundry/ deleted. Foundry operators can submit proposals but cannot review, sign, publish, or mutate the destination; a run against library N may only propose N+1. Publish the signed library and Foundry Foundation snapshot together with all accepted/rejected decisions and explicit no-novelty claims. This closes MF and activates the finite R8.3.a-b GenesisExamples/GenesisApps seed plus later isolated Foundry expansion; Bench and Challenge remain frozen until R8.3.b, and no Genesis Model implementation is authorized.

MF Foundry Foundation exit criteria: F2.a-F2.r are complete; FB-1 through FB-14 pass; the calibration snapshot is independently reproduced; every promoted and rejected package proposal is independently replayed; the public package is .gc-native, documented, versioned, installable, portable across its claimed Core profiles, and correct with deterministic fallbacks; no production, example/app, or Bench path depends on foundry/, mutable research state, or a search receipt as correctness authority. MF may feed R8.3.a-b and R8.5.i, but it does not authorize Bench, Challenge, a model, optimizer, language change, or F2.s-z result.

Expansion only after Foundry Foundation

• F2.s Add plural search engines and an evidence-driven portfolio controller. Introduce beam, evolutionary, MCTS, solver-guided, e-graph exploration, and optional LLM proposal adapters one at a time behind the same candidate protocol. Each engine is deterministic when feasible or statistically specified otherwise, runs under identical authority/resource envelopes, cannot see hidden verifiers, and survives predeclared comparison against enumeration/random/simple heuristics before remaining enabled. Allocate bounded resources using only declared observable progress, diversity, uncertainty, and historical evidence; preserve fairness and starvation bounds, deterministic decisions for deterministic profiles, and complete allocation receipts. Fixed/equal allocation and single-best-engine baselines must be beaten on held-out task families before adaptive control is promoted; neither engine nor controller changes tasks, rewards, destination APIs, or promotion rules.
• F2.t Mine reusable abstractions without vocabulary inflation. Detect repeated successful subgraphs, anti-unify typed instances, infer the weakest candidate contract, verify instances and generalization, and compare search with/without the abstraction against a simple macro baseline including context, proof, compile, and review cost. Proposals remain versioned mesomachines until independent reuse across multiple task families and targets justifies catalog promotion; failed abstractions and deletion decisions remain searchable.
• F2.u Discover laws under a stronger proof burden. Generate candidate equalities/refinements from repeated e-graph evidence, abstraction structure, solver hypotheses, and model proposals, then search aggressively for counterexamples across semantic profiles. A law requires exact side conditions, proof or translation-validation strategy, independent replay, downstream poisoning analysis, complexity budget, rollback, and dependency tracing from every extraction; optimizer promotion is a separate gc_patches decision with stronger obligations than an ordinary implementation.
• F2.v Expand representations, incrementalization, specialization, and dispatch. Search encode-operate-decode, sparse/dense and push/pull duals, delta maintenance, shared work, fast-path/fallback, and profile-guided whole-program specialization while charging conversion/state/fallback costs and preserving the authoritative semantics. Verify dispatcher thresholds and regime labels on precommitted distributions, retain robust alternatives rather than one universal winner, and translation-validate any target lowering or emitted artifact.
• F2.w Admit broader domain packs through a fixed qualification gate. Add bounded bit manipulation first, then incremental collections, graph traversal, sparse structures, dynamic programming, parsing/encoding/compression, and numerical iteration only when each pack supplies independent task authority, semantics, generators/adversaries, references, proof strategy, cost profiles, calibration set, licenses, resource bounds, and claim boundary. A failed pack cannot weaken the common verifier or expand the kernel.
• F2.x Add Circle Calculus only as an external optional pack. Bind theorem IDs, source fingerprints, assumptions, semantic mappings, proof-checker identities, and explicit non-claims; stale or mismatched packs fail closed. Cyclic mechanisms compete against non-cyclic baselines on predeclared cyclic tasks, Python tests never imply theorem proof, and Circle-specific success cannot bias the general catalog or task distribution.
• F2.y Integrate Theseus, the ASI Stack, GenesisBench, and Genesis Model through proposal-only interfaces. These systems may propose quests, task families, mechanisms, invariants, schedules, or consume accepted Genesis Algorithms releases and other promoted results, but cannot access hidden oracles, alter verifiers/rewards, suppress failures, promote outputs, mutate the active library baseline, or train on active evaluation material. Every transfer binds clean source editions, exact language/library/Bench identities, permission, evidence state, ablations, and the MQ/BQ firewalls; model-assisted discovery is reported separately from autonomous search and human-authored packs.
• F2.z Operationalize subsequent library releases, destination promotion, and long-term research memory. Generalize F2.r’s independently governed path for later Genesis Algorithms releases, research examples, reusable mechanisms, other packages, stdlib implementations, optimizer rewrites, compiler specializations, and rejected/archive status using semantic patches, threshold review, compatibility/migration, canarying, rollback, incident response, and post-promotion monitoring. Publish independently reproducible Foundry snapshots with mechanism/law/task/counterexample/lineage memories, total resource and review costs, correction/supersession history, and external literature/expert review before any historical novelty claim. Every search binds a prior immutable library release and every promoted release is rebuilt without Foundry; no promotion makes Foundry a production runtime dependency.

F2 exit criteria: F2.a-F2.z are complete; MF Foundation was independently reproduced before expansion; FB-1 through FB-14 pass; every candidate and claim carries exact FD/proof status; Genesis Algorithms releases remain independently useful and production builds remain independent of foundry/; hostile candidates and false evidence fail closed; no model/search engine controls verification or promotion; broader packs and abstractions demonstrate measured value over simpler baselines; and any promoted artifact is destination-approved, reversible, compatibility-scoped, and independently verifiable from a closed bundle.

F3 Distributed and hardware-aware execution

• F3.a Deterministic distributed task graphs. Explicit partitioning, retries, idempotence, data identity, capability delegation, and replay envelopes.
• F3.b Portable accelerator profiles. SIMD/GPU/NPU backends specify numeric/order semantics, translation validation, resource evidence, and CPU fallback.
• F3.c Federated self-hosted registries/builders. Transparency consistency, policy federation, offline roots, reproducible builders, and compromise containment.
• F3.d Validated JIT/AOT expansion. Add architectures or engines only where measured product value exceeds binary size, startup, memory, security, proof, and maintenance cost; every tier preserves authoritative semantics through translation validation and fallback.
• F3.e Verified incremental and distributed cache. Share content-addressed frontend, build, proof, and evidence artifacts across machines with corruption detection, lease/eviction accounting, provenance, and no semantic or correctness dependence on cache hits.
• F3.f Profile-bound whole-program deployment specialization. Specialize closures, effects-free paths, contracts, representations, data layouts, and target backends from frozen deterministic profiles while preserving general fallback behavior and rejecting stale or adversarial profiles.

F4 Ecosystem governance and replaceability

• F4.a Multiple conformant implementations. Encourage independent stage0, verifier, VM, and tooling implementations; resolve spec ambiguities through tests and versioned decisions.
• F4.b Evidence-weighted standards process. Language/profile proposals include compatibility, agent-context cost, implementation/proof burden, migration, and measured user value.
• F4.c Preserve a small language. Track semantic/syntax/context complexity budgets and require deletion/simplification opportunities alongside additions.
• F4.d Research ledger. Every frontier claim records hypothesis, baselines, raw data, machine/tool versions, negative results, reproduction, and limitations.

---

10. Sequencing and parallelization

GenesisCode:  R0 -> R2.2 -> R4.1 -> R5.1/5.3 -> R4.2.a-e -> R2/R3 prerequisites
              -> R4.2.f-g/R4.3-4.5 -> R1-A -> R5 Core -> R6.1-4 -> R7/R8 Core -> R9 v1 Core
                                                                                       |
                                     exact reviewed R9.4.f Core handoff               |
Foundry:                              F2.a-q calibration -> F2.r / MF + Algorithms v0.1
                                                               |
GenesisExamples/Apps:                  R8.3.a-b finite seed      |
                                                               |
               +-----------------------------------------------+-----------------------+
               |                                               |                       |
GenesisBench:  M1-B Preview -> M5-B                            |                       |
GenesisChallenge:                                              R8.5.u-v season         |
Examples/Apps expansion:                                       R8.3.c-e                |
Foundry expansion:                                             F2.s-z                  |
Packs/frontier:                                                                    pack releases + F1/F3/F4

Genesis Model: M5-B + MF + transfer/firewall/feasibility -> R8.5.t -> build/package
               | proposals return through deterministic GenesisCode acceptance

Practical order:

1. Preserve the completed R0 publication/control-plane checkpoint. R0.4.k repaired transitive gate-input authority; P1.7 established bounded generated-publication ownership; P1.6 and R0.4.j closed on exact-main standard/full/watchdog evidence. Keep all incidents and timing observations, retain provisional hard ceilings, and defer class calibration to R9.1.c rather than rerunning green implementation gates.
2. Close P1.5/R2.2.f through public cleanup-error propagation and one declared lifecycle/fault matrix per supported native host. Exercise success, malformed response, disconnect, cancellation, timeout, owner drop, restart, and repeated load in one bounded harness; do not rerun the surrounding workspace profile for every case.
3. Complete R4.1’s stage0 contract, H0-H4 definitions, semantic-ownership ledger, truthful status, dependency firewall, and selected migration slice. This SH-A truth package must make every remaining host-owned semantic decision visible before migration work can claim progress.
4. Freeze R5.1 and R5.3 against the correct current interpreter/resource semantics, then migrate R4.2.a-e by semantic risk and build leverage: frontend/canonicalization, type/effect checking, patch/refactor, obligation/policy, and package/registry/VCS. Each switch must make the GenesisCode implementation the reachable production authority and demote or remove the Rust semantic path; wrappers and parity-only demos remain H1 at most.
5. Finish R2.1.h, R2.3, R2.4, and the R3.1-R3.3 execution prerequisites needed for self-hosted code generation. Performance tasks use one bounded normalized sampler rather than repeated whole profiles. Build bytecode only after semantic/resource contracts are fixed, and keep the optional JIT decision outside the self-host closure unless measured product evidence requires it.
6. Close R4.2.f-g and R4.3-R4.5 end to end: compiler/optimizer/linker/build, CLI/agent orchestration, bridge generation, legacy removal, hermetic stage0->stage1->stage2->stage3 bootstrap, cross-host fixpoint, DDC, bootstrap witnesses, kernel/effect-host conformance, and an independent implementation or verifier. A .gc wrapper, matching local output, or self-issued receipt is not closure.
7. Complete R1.3.f and R1.5-R1.7 against the self-hosted authority to release M1-A: compact negotiated authoring, collaboration, typed intent, cancellation, and warm/MCP behavior. Preserve prior GenesisBench bundles and invalids byte-for-byte, but do not run or expand a model campaign before v1.
8. Complete the finite Core portions of R5.2/R5.4/R5.5 and R6.1-R6.4 against the self-hosted authority. Package resolution, registry operations, builds, deployment plans, documentation generation, and release assembly must operate self-hosted, offline where promised, with deterministic artifacts and no hidden Rust command semantics.
9. Run applicable R7 assurance only after each subject reaches V3 readiness, then close R8.1, R8.2.a-b, and R8.4 Core product proof. Do not count labels, descriptor archives, empty exports, headless plans, or simulator-only demos as products. The native/WASI CLI and service workloads must be authentic, maintainable, independently operable, and authored under the one-language contract.
10. Release M5-C and then R9/M6 only from independently reproduced E4 evidence. R9.1.c owns full timing calibration and release soak. The v1 Core release binds the exact stage0, self-host sources/artifacts, compatibility profile, package/build/docs/agent surfaces, supported hosts, support window, and rollback path. Unfinished platform packs, GenesisBench, Foundry, GenesisChallenge, and Genesis Model cannot block or lend evidence to this decision.
11. At exact reviewed R9.4.f, publish the signed Core handoff and activate F2.a-r as the first post-Core product transaction. Allocate Foundry generator, independent verifier, package destination, and release roles separately; retain serial merge ownership for shared GenesisCode interfaces and generated authorities. Optional packs and unrelated F1/F3/F4 may use isolated resources, but Bench, Challenge, and Model remain frozen.
12. Execute F2.a-q against frozen Core semantics, independently reproduce the calibration snapshot, then complete F2.r. Release genesis/algorithms v0.1 from destination-owned .gc sources, not the research workspace; bind exact contracts, fallbacks, profiles, provenance, proofs/tests, costs, compatibility, and rollback; prove clean build/install/use with foundry/ absent. Do not claim novelty or let the search engine verify or publish itself.
13. At F2.r/MF, execute the finite R8.3.a-b GenesisExamples/GenesisApps seed before Bench or Challenge. Freeze the catalog/classification authority; publish the algorithm/CLI, bounded MCP server, production HTTP/WebSocket server, separate full-stack website/application, and integrated workspace; bind exact immutable Core and Genesis Algorithms releases; prove meaningful algorithm use, one-language source closure, authentic execution, clean build/deploy/replay/maintenance, and operation with foundry/ absent. Public examples are disclosed learning/reference inputs, never private benchmark answers.
14. At R8.3.b, reissue the frontier for isolated GenesisBench, GenesisChallenge, broader R8.3.c-e application, and continued Foundry-expansion lanes. In GenesisBench, bind exact immutable Core, Genesis Algorithms, and public catalog releases and complete Preview R1.4.o/q/r/p, then Trust R8.5.a-e,s. Predeclare Qwen, local-model, Luna, and future-model campaigns; require private custody, difficulty calibration, fast forms, model-neutral adapters, failure attribution, independent operators, three model families and interface stacks, construct validity, adoption evidence, and reproducible standard/full forms. Never expose mutable Foundry state, copy public solutions into held-out payloads, rewrite historical attempts, or use scores to mutate the evaluated language/library/example profile.
15. Concurrently after R8.3.b, establish R8.5.u and operate R8.5.v under the independent non-ranking GenesisChallenge ledger. Open only categories with ready verified destination baselines; include creation, target expansion, maintenance, simplification, and optimization of GenesisExamples/GenesisApps, while routing algorithm-library and Foundry improvements only through destination-owned acceptance. Defer benchmark-validity challenges until a compatible Benchmark release exists. The contest can stop without delaying any product or research lane.
16. Continued Foundry F2.s-x and F2.z may proceed after F2.r under isolated resources and prior-release baselines; broader R8.3.c-e may proceed after the seed as relevant packs reach authentic support; F2.y waits for compatible GenesisBench Trust because it crosses the Bench/model integration boundary. Optional platform packs and F1/F3/F4 may also advance under disjoint resources and compatibility-scoped releases. Every later useful Foundry output crosses only through the F2.r/F2.z package or destination-promotion firewall.
17. After both MF and GenesisBench Trust, freeze clean Theseus/ASI editions, bind accepted and rejected Foundry Foundation and algorithm-library transfer records plus the exact example/app catalog used for evaluation, and complete R8.5.i. Ratify R8.5.t only after the adversarial firewall, legal/privacy/compute/release feasibility, and independent review are also closed. No Genesis Model corpus, teacher, tokenizer, architecture, training, distillation, package, or integration implementation begins earlier.

Workstream dependency matrix:

Workstream	Hard prerequisites	May proceed in parallel	Hard-blocks
R0.1 truth sources	none	R0.3 prerequisite discovery, R7 formal-model scoping	every generated status/release claim
R0.2 evidence lifecycle	R0.1 authority decisions	R0.3-R0.5	M0, every L3-L5 promotion
R0.3 hermetic versions	R0.1 source-of-truth rules	R0.2, R0.4	reproducible checks, profiles, R1 card/version negotiation
R0.4 gate/resource architecture	R0.1 ledger and R0.3 tool identities	R0.2, R0.5	affordable continuous evidence and release execution
R0.5 normalized baselines	R0.3 host/tool profiles and R0.4 telemetry schema	late R0.2 verifier work	every performance claim and JIT decision
R1.1 profile/cards	R0 version/compatibility registry	R1.2 diagnostic catalog	R1.3 schema generation, R1.4 corpus, R1.5 skill
R1.2 diagnostics	R1.1 profile IDs and R0 evidence schemas	R1.1 cards	R1.4 repair benchmark and M1-A/M1-B
R1.3 warm/MCP	R1.1 schemas; R2.2 semantics required before final daemon sign-off	R1.4-R1.6 prototypes	agent product loop, AB-3/AB-4
R1.4 GenesisBench foundations and post-v1 Preview	Completed foundations retain R1.1/R1.2 identities; every unfinished inference, custody, publication, portability, and governance task additionally requires F2.r and its exact Core/library identities	No pre-v1 or pre-MF product lane; model-free correctness/security maintenance may accompany its owning GenesisCode gate	Post-MF M1-B and R8.5 temporal benchmark/corpus candidates
R1.5 skill	generated R1.1/R1.2 inputs, completed R1.4.n fixtures, and green R0.4.k authority	R1.4.o/q/p and R1.6	M1-A agent readiness
R1.6 collaboration	R0 evidence/identity; R1.3 transactional API for completion	R1.4-R1.5	safe parallel-agent proof
R1.7 typed intent preview	R1.3 transactional API and R1.6 authority separation	R1.4-R1.5	AB-11/AB-12, responsible real-request trajectory capture, R8.5 specialist integration
R2.1 interpreter	R0 normalized semantic/perf corpus	R2.2 heap specification	R2.3 snapshots, R3 execution tiers
R2.2 heap/resources	R0 evidence and resource schemas	R2.1	final R1.3 daemon sign-off, all R3 tiers
R2.3 startup/incremental	R2.1 stable compiled representation and R2.2 accounting	R2.4	AB-3/AB-4, R3 artifact caches
R3 bytecode/Wasm/tiering	R2 semantic, resource, startup, and observability contracts	R4.1 ledger, R5.1 semantic audit	R4.2 compiler authority, M2, and the v1 JIT-or-no-JIT decision
R5.1 and R5.3 core freeze	R0 compatibility registry; R2/R3 discrepancies resolved	R4.1 ownership mapping	every corresponding R4.2 authority switch
R4.1 ownership/TCB	R0 truthful ledgers	R2-R3 and R5 core audit	all R4.2 migration acceptance
R4.2-R4.5 self-host closure	relevant R5.1/R5.3 contract frozen; R3 verified artifact path	remaining R5.2/R5.4/R5.5 implementation	M3 and trusted self-hosted R6 orchestration
R5.2/R5.4/R5.5 completion	R5 core profile plus R2/R3 resource semantics	late R4 migration	R6 compatibility and target claims
R5.6 web/UI and R5.7 service/data	R5.1/R5.3 core, R5.2 concurrency, R5.4 stdlib, R5.5 extension boundary	late R4 migration and R5.8/R5.9	R6.5 web/full-stack and shared product foundations
R5.8 game/media	R5.1/R5.3 core, R2 resources, R3 tiers, R5.4/R5.6	R5.7 and R5.9	real interactive target/product claims
R5.9 embedded contract	R5.1 numeric/text/profile semantics, R2 resources, R3 validated AOT inputs, R5.4/R5.5	R5.6-R5.8	R6.7 firmware and board claims
R6.1-R6.4 ecosystem/core delivery	R5 compatibility/ABI freeze; self-host build authority for GA	R7 continuous assurance	target packaging, registry, and operations authority
R6.5 web/full-stack delivery	R5.6/R5.7 and R6.1-R6.4	R6.6/R6.7	authentic web/full-stack flagships
R6.6 desktop/mobile delivery	R5.6/R5.8 and R6.1-R6.4	R6.5/R6.7	authentic native/mobile flagships
R6.7 embedded/MCU delivery	R5.9, R5.7 IoT services, R6.1/R6.3/R6.4	R6.5/R6.6	authentic Embedded Linux/board flagships
R7 assurance	formal models and test scaffolding may start with their GenesisCode subject; release claims require frozen subjects	the selected Core task only before R9.4.f; isolated lanes afterward	every applicable M5-C/M5-B/M5-M gate and M6
R8-C GenesisCode proof	M1-A interfaces; relevant R2-R7 features at least L3; authentic target and one-language source gates for claimed profiles	no other repository-changing product lane before R9.4.f	finite GenesisCode v1 Core acceptance through R8.1, R8.2.a-b, R8.4; separate M5-P maturity through the remaining R8.2-R8.3 tasks
R8.3 GenesisExamples/GenesisApps	MF/F2.r for catalog start; R8.3.b additionally requires authentic Core, MCP, service, browser, and full-stack product profiles; R8.3.c-e require the corresponding R8.2/pack subjects	continued Foundry expansion after F2.r; broader apps, packs, and F1/F3/F4 under isolated ownership	finite public seed for Bench/Challenge, then M5-P universal showcase; never a semantic authority or Core prerequisite
R8-B GenesisBench trust release	MF/F2.r; finite R8.3.a-b seed; M1-B; R1.6 authority; R7.1 assurance; R8.1 agent integration; exact compatible Core, Genesis Algorithms, and public catalog releases	continued Foundry and R8.3.c-e expansion, Challenge, packs, and the independently gated model lane	GenesisBench scope, independent reproduction, governance, and adoption; never blocks GenesisCode v1 or later Foundry/application maintenance
R8-M Genesis Model lane	stable v1 Core; GenesisBench Trust; BQ-7/BQ-8; reproduced MF; MQ-1 through MQ-8; R8.5.i; independent R8.5.t decision	post-v1 platform work and optional Foundry expansion	independently reviewed research-transfer manifest, profile-bound model package, and Embedded Local evidence; never blocks GenesisCode, packs, or GenesisBench
R8-X GenesisChallenge contest	R8.3.b plus R8.5.u policy/ledger authority; benchmark-validity category separately requires a compatible benchmark release	post-seed product and research lanes under disjoint files/authorities	one independently audited contest season and destination-owned accepted contributions, including example/app expansion; blocks no release
R9 GenesisCode Core release	R0-R7 plus R8.1, R8.2.a-b, R8.4, and zero Core release blockers	no other repository-changing product lane before R9.4.f; the handoff activates Foundry Foundation first	GenesisCode v1.0 Core
F1 bounded improvement	preserved v1 compatibility/governance baseline	F2 specification and independent F3/F4 research	no v1 milestone
F2 Genesis Foundry + Genesis Algorithms	signed v1 Core semantic/evidence interfaces; F2.a-q calibration precedes F2.r independently promoted library release; F2.r precedes R8.3.a-b; F2.s-z are later expansion; F2.y additionally requires compatible GenesisBench Trust	packs and independently sandboxed F1/F3/F4 during Foundation; examples/apps and later expansion after F2.r; Bench/Challenge after R8.3.b	MF Foundation and Genesis Algorithms v0.1, then destination-specific proposals/releases; never a Core or production-runtime dependency; MF is an input to examples/apps and optional model readiness
F3 distributed/validated execution	preserved v1 semantics plus relevant R3/R6/R7 profiles	F1/F2/F4 under separate budgets	optional post-v1 target/profile promotions
F4 ecosystem governance	preserved v1 compatibility and independent verifier baseline	all frontier lanes	standards/replaceability decisions, never retroactive authority

---

11. Migration from the 2026-07-02 roadmap

No substantive objective from the prior R0-R11 plan is intentionally discarded. It is reordered and given stricter acceptance semantics:

Prior area	New home	Change
Prior R0 foundation repair	R0	Reopened and expanded because root-lock hermeticity, evidence mutation, status accuracy, and gate cost remain unresolved.
Prior R1 interpreter overhaul	R2	Retains completed inline-int/vector/parser/primitive work as baseline; focuses open work on closures, frames, maps, tails, heap, and startup.
Prior R2 bytecode/JIT	R3	Bytecode remains required; JIT is conditional on measured need rather than assumed critical path.
Prior R3 warm/MCP/agent loop	R1-R2	Moved before bytecode because it is the shortest path to useful AI adoption; warm exists and is hardened rather than rebuilt.
Prior R4 self-host closure	R4	Strengthened with H-levels, semantic authority, DDC, independent conformance, and explicit stage0 truth.
Prior R5 AI completeness	R1 and R8	Compact SDK/training readiness moves early; broad gauntlet and flagship proof remain late product gates.
Prior R6 language completeness	R5	Existing effect rows/concurrency are audited/promoted instead of described as absent.
Prior R7 deployment	R6	Adds offline/self-hosted infrastructure, profile compatibility, reproducibility, and operations.
Prior R8 ecosystem	R6 and R9	Registry/package GA and release governance are separated.
Prior R9 verification	R7	Adds mutation evidence, threat models, fault injection, DDC, and independent review.
Prior R10 human UX	R8	Kept minimal and schema-generated, tied to real flagship workflows.
Prior R11 self-improvement	F1-F4	Moved post-v1 so recursive automation cannot outrun evidence, governance, and release stability.

Completed work from the prior plan is preserved in git history and the audited baseline. It must be reclassified in the capability ledger rather than copied as unchecked green claims. If a prior task has durable evidence and satisfies the stronger definition of done, it may be marked at the corresponding new maturity level without reimplementation.

---

12. Milestone acceptance summary

Milestone	Required phases	Headline acceptance
M0 Truthful Green Door	R0	Published clean clone and live remote CI; clean, hermetic, read-only checks; replay parity; load-stable default suite; warning-free build; bounded gate/cache disk and time; non-starving event/profile concurrency; bounded runner-unavailable disposition; independently watched standard/full evidence freshness; complete transitive generated/gate-input freshness; independent evidence verifier
M1-A GenesisCode Agent Preview	R1.1-R1.3, R1.5-R1.7; R0.4.j	Versioned compact SDK; structured diagnostics; bounded warm/MCP; generated skill; safe collaboration; typed intent; clean/offline agent use without benchmark/model release coupling
M1-B GenesisBench Preview	F2.r/MF, then remaining R1.4.o/q/r/p	First post-v1 benchmark release against immutable Self-Hosted Core plus Genesis Algorithms; four-track profile; transport-neutral artifact-text baseline; two independent interface/model-family portability proof; typed failure attribution; >=45 independently authored/governed and private-payload-verified held-out lineages; immutable easy/medium/hard calibration; precommitted lineage-stratified fast forms; fixed scaffold; CLI/adapters; registry; protected temporal overlays; complete newly predeclared commissioning cohorts; benchmark card, methods, first-results report, and Preview governance; no mutable Foundry state
M2 Runtime Beta	R2-R3 core	Resource-bounded runtime; deterministic snapshot/incremental loop; verified bytecode; semantic tier parity
M3 Self-Host Authority Beta	R4	H2 toolchain authority; H3 cross-host fixpoint; DDC; independently verifiable stage0 contract
M4 Platform Pack Betas	relevant R5-R6 workstream per pack	Stable shared profile and independently versioned web/UI, service/data, desktop/mobile, game/media, Embedded Linux, MCU/board, and GPU/XR packs; each claimed target has authentic reproducible execution and one-language source closure
M5-C GenesisCode v1 Core Candidate	R7.1.a-e, R7.2, R7.3.a-e, R7.4.a-c; R8.1, R8.2.a-b, R8.4	Formal/fuzz/security gates; frozen Core; authentic native/WASI CLI and service proof; one-language source closure; independent operation and maintenance; no R5.7.e, R7.1.f, R7.3.f, R8.2.c-r, or R8.3 dependency
M5-P Universal Platform Maturity	R8.2-R8.3	18/18 authentic archetypes for claimed packs; ten maintained flagships including physical boards; independent operation and maintenance; may complete after M6
M5-B GenesisBench Trust Release	MF, M1-B, then R8.5.a-e,s	>=90-lineage independently reproduced temporal/maintenance/reconstruction benchmark over exact compatible Core/library releases; orthogonal difficulty/context/run profiles; common artifact-text standard matrix across three interface stacks/model families; native/JSON-text tool equivalence; smoke/fast/standard/full forms; signed public governance; discriminative validity; external benchmark-task/result operation and language/library adoption evidence
MF Genesis Foundry Foundation	R9.4.f, then F2.a-r	Independently reproduced bounded rediscovery with frozen Core semantics, external checkers, complete lineage/cost evidence, followed by destination-owned Genesis Algorithms v0.1 promotion, clean package rebuild/use with foundry/ absent, and no model, novelty, or production-authority claim
R8-X GenesisChallenge Season	F2.r, then R8.5.u-v	Independently governed non-ranking contest with ready language/library/Foundry destination baselines, signed attribution, adversarial controls, and destination-owned promotion; benchmark-validity category waits for a compatible Benchmark release
M5-M Genesis Model Preview	post-MF/post-Trust R8 Genesis Model lane	Stable Core, exact Genesis Algorithms, and GenesisBench Trust; reproduced MF; audited firewall; independent R8.5.t decision; admitted lineage-preserving corpus; clean pinned Theseus/ASI/Foundry transfer evidence; profile-bound Embedded Local model; applicable four-cell or frozen-language two-cell accessibility proof; rollback
M6 GenesisCode Trust Release	R9 finite Core	Reproduced signed GenesisCode v1 Core, E4 evidence, authentic CLI/WASI and service proof, offline verification/install without benchmark/research/model dependencies, compatibility/security operations, and independently scoped pack manifests

---

13. Risk register

Risk	Why it matters	Mitigation and trigger
Status theater	Broad routing/tests can look complete while semantic ownership or cross-host proof is absent	L0-L5 and H0-H4 ledgers; generated matrices; independent verifier
Local-only accumulation	Large dirty worktrees are neither bisectable nor protected from accidental loss, and CI changes remain unexercised	Task-scoped green commits, remote draft checkpoints, clean-clone reconstruction, required GitHub CI
Flaky assurance	Load races and recursively nested suites turn trust checks into timing lotteries or encourage ignored failures	Hermetic lane ownership, explicit fixture readiness, repeat-under-load controls, no retry-to-green acceptance
Validation theater	Repeating an unchanged green aggregate or qualifying a stub consumes the implementation lane without changing a decision	V0-V4 readiness ladder, one identical development success, autonomous decision-bearing campaigns, full calibration only at R9.1.c
CI evidence darkness	Local/PR green can mask cancelled default-branch runs, stale full profiles, or jobs queued forever for absent self-hosted labels	R0.4.j/P1.6 event-aware concurrency, hosted runner preflight, typed optional-profile nonclaims, disjoint watchdog, bounded standard/full freshness, append-only incident disposition
Generated-view partial refresh	A canonical or transitive gate-input change can leave one protocol, manifest, card, schema catalog, index, site page, or model context silently stale while the graph itself reports fresh	R0.4.k gate-input discovery, atomic transitive closure, one explicit updater, read-only freshness checks in local and remote gates, Rust/Python/helper/fixed-point dependency-completeness controls
Ignored output masks source drift	Quarto renders, caches, build trees, simulator state, or benchmark output can pollute topology scans or hide untracked source/evidence behind broad ignore rules	Explicit source/generated root classification, bounded generated-state inventory, cleanability proof, ignored-source canaries, and source-only hygiene scans derived from policy rather than ad hoc exclusions
Benchmark-shaped execution	Workload recognizers can manufacture impressive numbers without improving the language runtime	Remove production recognizers, anti-overfit source variants, property-based optimization preconditions, differential semantics
Roadmap scope overwhelms delivery	A single maintainer can spend years on breadth before agents can use the language	M1-A is the first language product and M1-B the independent benchmark wedge; critical paths block speculative breadth; each milestone is independently useful
Wrong post-Core serialization	Starting Bench before a canonical supplied library and useful public applications loses Foundry and product-proof leverage, while requiring open-ended F2.a-z or all ten universal apps would block adoption indefinitely	Exact R9.4.f -> finite F2.a-r Foundation/library gate -> finite R8.3.a-b example/app seed -> Bench/Challenge fan-out; continued F2.s-z and R8.3.c-e remain independent; mutation controls reject bypasses and accidental expansion ancestry
Optimizations change identity/effects	Breaks the core trust model	Reference semantics, differential corpus, translation validation, versioned formats, mutation tests
JIT dependency and security cost	Can harm startup, platform reach, build size, and TCB without helping agent workloads	R3.4 decision gate; bytecode/wasmi completeness; optional feature
Memory leaks or host OOM	Warm agents and services become unsafe despite step/effect limits	R2 heap semantics, logical metering, isolation, 100k-request stress, hard cleanup
Self-hosting duplicates rather than removes trust	Two implementations increase attack and maintenance surface	Ownership ledger; production authority switch; strict no-fallback; Rust demotion/removal
Self-host migration targets moving semantics	Switching authority before a profile freeze causes duplicate churn and makes parity evidence ambiguous	Freeze the relevant R5.1/R5.3 contract before each R4.2 production switch; version any later semantic change
Bootstrap trusting-trust attack	A fixpoint alone can reproduce a malicious compiler	DDC, independent builders/verifiers, signed source/evidence, conformance implementations
Agent benchmark contamination	Inflates quality claims and trains to tests	Temporal-clean labels only for post-release precommitments; split manifests, hidden oracles, commitments, rotation, canaries, contamination labels, model-agnostic scoring, immutable history
Statistical pseudoreplication	Counting three context conditions of one task as three independent successes creates false precision and unstable model rankings	Immutable lineage IDs, clustered/hierarchical analysis, BQ-9 denominators and intervals, predeclared statistics, no unqualified pairwise decimal ranks
Benchmark track conflation	A raw model, heavily scaffolded agent, adapted specialist, and local appliance answer different questions; one rank would be uninterpretable	Four closed eligibility tracks, scaffold/profile/hardware cohort keys, separate leaderboards and claims, BQ-10 negative controls
Small, saturated, or author-biased benchmark set	Public-small near-ceiling results can erase frontier discrimination while a few private tasks, placeholder commitments, or one generator dominate rankings and teacher selection	BQ-11 custody-verified 45/90 payload floors, per-class/difficulty balance, independent author/governor identities, family weight cap, medium/large priority, rolling epochs, stratified audits; one commissioning cohort never alone triggers BQ-5
Difficulty/context conflation and fast-set selection bias	Calling long context hard or selecting a cheap subset after seeing model scores can manufacture gradients, hide capability holes, and produce unstable ranks	BQ-15/BQ-16 orthogonal keys, non-target calibration, precommitted lineage-stratified fast forms, alternate forms, visible omissions/uncertainty, standard/full claim gates, immutable epoch labels
Provider/scaffold overfit masquerades as model quality	A benchmark built around one API, chat template, tokenizer, tool-call encoding, reasoning control, or output convention can reward interface familiarity and reject otherwise capable models	R1.4.r transport-neutral authority, common artifact-text profile, capability negotiation, native/JSON-text tool metamorphism, tokenizer-neutral budgets, BQ-18/BQ-20, differential item review
Harness failure is blamed on the model	Request rejection, hidden prompt injection, adapter extraction defects, unsupported context, or broken workspaces can depress a model’s score without testing GenesisCode reasoning	Closed terminal-owner taxonomy, model failure only after delivery/capture/extraction/workspace proof, independent rederivation, adversarial blame-laundering controls, BQ-19
Benchmark gaming distorts the language	Task-specific APIs, runtime recognizers, or easier suites can improve rank while reducing general value	Useful-work task criterion, anti-overfit variants, construct-validity audits, saturation ratchet, independent challenge authors, no score authority in production semantics
Contribution contest captures benchmark or release authority	Open repository work has moving baselines and visible tests; mixing it with held-out evaluation enables self-scoring, Goodhart optimization, collusion, and prize-driven unsafe merges	R8.5.u-v separate GenesisChallenge ledger and roles, no leaderboard bridge, hidden adversarial controls, destination-owned review/promotion, append-only failures/disputes, vector rather than scalar deltas
Native-model co-adaptation	A specialist and language may improve only together while GenesisCode becomes harder for every general model and independent implementation	Permanent Cold Acquisition track, applicable four-cell or frozen-language two-cell R8.5.r controls, total-agent-work accounting, compatibility/TCB costs, reject combined-only gains
Research-transfer cargo cult	Appealing Theseus implementations or ASI synthesis can become architecture authority without surviving Genesis-specific replication, laundering claims and complexity into the model	MQ-1 through MQ-8, R8.5.i clean editions and crosswalk, simplest-baseline/ablation gates, independent decisions, preserved null/negative/rejected outcomes
Premature specialist training	Training before corpus diversity, lineage, consent, and held-out isolation wastes compute and irreversibly contaminates evaluation	BQ-7/BQ-8 hard gate, tokenizer/base audit first, quarantine-only R1.7 trajectories, checkpoint manifests, no active-epoch selection
Teacher-output feedback collapse	Training only on top-model answers can amplify common errors, erase diversity, and contaminate evaluation	BQ-7/BQ-8 admission and firewall, lineage/time/model-family splits, deduplication, verified counterexamples, teacher diversity, independent held-out evaluation
Context bundle drift	Agents learn APIs that no longer match runtime behavior	Generated cards/symbol index, parse/run goldens, profile negotiation, stale-card rejection
Gate explosion and disk growth	Slow checks discourage use and can consume tens of gigabytes	Gate manifest, impact selection, shared caches, GB budgets, deterministic cleanup
Capability convenience erodes security	Agents may solve errors by asking for broad authority	Structured repair rules, policy diffs, minimization score, negative controls, independent review
Cross-platform nondeterminism	Breaks hashes, replay, builds, and bootstrap	Numeric/text/path specs, tier-1 host matrix, normalized archives, exact mismatch reports
Registry/signing compromise	Invalidates ecosystem trust	Offline roots, threshold/rotation/revocation, transparency, mirrors, rehearsed recovery
Formal work becomes decorative	Proofs may cover a toy subset while claims imply full runtime	Coverage ledger tied to executable forms; published assumptions/gaps; proofs hard-gate only their stated claims
Public claims outrun product proof	Damages credibility and user trust	E4-linked claims, explicit unsupported domains, flagship maintenance exercises
Artifact-suffix theater	An .ipa, .aab, .wasm, app bundle, firmware image, or launcher can look complete while containing no executable product logic	UP-2 authentic-runtime execution, R6.3.f real install/launch/effect workloads, target-native inspectors, independent builders, and explicit descriptor labels
Generated glue becomes a second source language	Agents may be forced to patch HTML/CSS/JavaScript, Swift/Kotlin, C/linker scripts, shaders, shell, or YAML, defeating the one-language promise and reproducibility	UP-1 inventories, read-only disposable generated roots, source maps, deterministic regeneration, R8.3.d deletion/rebuild audit, fail instead of manual repair
Universal scope collapses delivery	Web, mobile, games, data, and boards can turn one language into many unfinished frameworks	Shared app/data/capability/extension contracts, profile promotion by L-level, authentic flagship gates, package-first breadth, no kernel growth for domain convenience, explicit unsupported cells
Platform semantics leak into the kernel	UI, cloud, device, or game convenience forms could bloat the TCB and make portability impossible	Keep product APIs in libraries/effects/components, use typed target profiles, preserve pure shared logic, require compatibility and proof-cost review for syntax/semantic changes
Embedded profile silently changes GenesisCode	Fixed-width arithmetic, static allocation, interrupts, and no-OS constraints can diverge from host semantics while still using the same name	R5.9 explicit subset/profile, compile-time rejection, translation validation, target-specific numeric/fault rules, cross-profile corpus, never claim full-host equivalence
Simulator-only hardware confidence	Mocks can pass while pin maps, timing, electrical behavior, resets, radio, flash, or OTA fail on physical boards	R6.7 hardware-in-the-loop, named boards, repeated power/peripheral fault tests, measured envelopes, independent device witnesses, simulator evidence remains separate
Ecosystem escape-hatch erosion	Missing packages may push agents toward arbitrary native code or broad process plugins	R5.5 component-first adapters, signed high-risk native profiles, generated bindings, package provenance, explicit capability/resource isolation, application tree foreign-source audit
Single-project review authority	One maintainer, key, host, or organization can accidentally validate its own benchmark, model, and release claims	BQ-14 independent reviewer/operator, conflict records, role-separated custody, R9.2.c threshold attestations, and independently controlled mirrors
Foundry combinatorial/resource runaway	Search can consume unbounded compute, disk, energy, or review effort while producing little knowledge	Typed finite grammars, FB-7/FB-11 budgets, grammar-relative completeness, checkpoints, deterministic pruning evidence, per-pack admission, and automatic bounded terminalization without automatic promotion
Foundry verifier or proof laundering	A candidate may pass a weak finite test or theorem about a simplified model and be advertised as generally correct emitted code	Orthogonal FD/proof status, F2.j independent checker, FB-4/FB-9 mutations, exact artifact-to-theorem/lowering bindings, unknown status, and no promotion from benchmark evidence alone
Foundry law/catalog poisoning	One false equality or over-broad mechanism can contaminate many later extractions and production proposals	Quarantined speculative laws, stronger law obligations, versioned catalogs, dependency tracing, independent replay, rollback/canaries, append-only supersession, and zero direct mutation of gc_opt
Foundry novelty inflation and benchmark overfit	New hashes, hidden hardcoding, or rediscovered literature can be mislabeled as invention	Calibration-first MF, anti-hardcoding tasks, honest claim taxonomy, local/literature similarity limits, external review before novelty, complete negative-result publication, and regime-scoped claims
Foundry dependency/authority creep	Convenient research code could become a hidden compiler/runtime dependency or allow a generator to approve itself	One-way workspace architecture test, production build with foundry/ absent, separately locked releases, role separation, proposal-only bridges, and destination-owned semantic-patch promotion
Coupled product release clocks	Waiting for model training can delay a ready language, while shared version numbers can make benchmark/model evidence appear authoritative for language semantics	Independent signed release manifests, compatibility ranges, product-scoped blockers, optional model integration, and separate GenesisCode/GenesisBench/Genesis Model acceptance lanes

---

14. Maintenance rules

• Keep Last audited current whenever priorities, facts, budgets, or release criteria change.
• Never check a task without the full done annotation and durable evidence described in section 2.2.
• Never delete completed work to make the queue look smaller. Move historical detail into a versioned evidence/changelog view when this file becomes unwieldy.
• Generate status matrices from the capability/evidence ledger after R0; do not manually synchronize multiple truth sources.
• Ratchet budgets downward. A loosening requires a dated decision record and evidence.
• Promote repeated active failures to upgrade_plan.md as P0/P1; close them there only when their regression gate passes.
• Keep governed check entrypoints one-in/one-out until M6 and the later M1-B activation. Prefer extending an existing authority and record consolidation savings; never add a gate merely to assert that too many gates exist.
• Keep the R9.4.f GenesisCode Core closure free of unfinished curated Examples/Apps, Benchmark, Challenge, Foundry, Model, universal-pack, and pack-only assurance work. At the signed handoff, activate F2.a-r Foundry Foundation first; after F2.r, execute finite R8.3.a-b while continued Foundry, pack, and unrelated frontier lanes may remain isolated; after R8.3.b, activate Bench and Challenge without waiting for R8.3.c-e. Do not serialize unrelated lanes or parallelize shared-authority merges.
• Keep program-level concepts frozen through R9.4.f as section 3.19 defines. A new product, program, benchmark track, research lane, milestone family, task family, or governed gate family requires a reproduced P0/P1 need and a one-for-one retired equivalent with explicit dependency and acceptance deltas; otherwise retain it only as a non-authoritative note.
• Keep a published remote checkpoint for every coherent green tranche. An unpushed local worktree is not durable project state.
• Regenerate declared views as one transitive closure. A canonical-input change may not be committed or published with a partial card, index, schema, site, context-bundle, or evidence refresh; the updater is explicit and all checks remain read-only.
• Treat every governed gate’s recursively discovered source/helper/test identity as generated-authority input unless a reviewed fixed-point exclusion proves why it cannot be. A graph that reports fresh while any governed check fails only for stale identity is itself stale and blocks publication.
• Keep source and generated state disjoint under one reviewed policy. Ignored or cleanable output roots may not contain authoritative source/evidence, and adding an exclusion requires a bounded-state owner plus a canary proving untracked source still fails hygiene checks.
• Treat test-lane membership as governed data. Moving a test to stress, performance, platform, release, or ignored status requires a manifest diff, rationale, owner, trigger, expected frequency, and proof that required CI executes it; ignored tests never silently disappear from published counts or coverage claims.
• Treat CI control-plane liveness as release evidence. PR supersession may cancel only the same PR’s obsolete run; pushes, schedules, and dispatches retain a terminal typed disposition, impossible self-hosted label sets are rejected by a hosted preflight before queueing, and a disjoint watchdog must detect stale or cancelled-only standard/full history without trusting the workflow it observes.
• Never describe a task as outside a model’s training data merely because GenesisCode is new. Use the exact BQ-3 label supported by model-release, task-precommitment, custody, and disclosure evidence.
• Benchmark task changes are append-only by epoch: preserve historical weights/results, precommit new private material before model access, disclose or rotate under policy, and never tune hidden tasks from a target model’s observed failures.
• A benchmark condition is never promoted to an independent lineage because context, tools, scaffold, repair budget, prompt wording, or a semantics-preserving mutation changed. Preserve the parent lineage and use BQ-9 clustered analysis.
• Keep benchmark axes orthogonal. Difficulty, context size, run profile, task class, capability/product surface, track, language profile, scaffold/adapter, attempt policy, and hardware cohort are independently keyed; changing one never silently changes or substitutes for another.
• Keep the benchmark authority transport-neutral. Vendor SDK payloads, chat templates, special tokens, native tool encodings, reasoning controls, tokenizers, CLIs, and hosted services belong only in adapters or disclosed Open Agent scaffolds; adding a conforming model never requires changing task semantics or the scorer.
• Preserve a minimum-common-denominator artifact-text condition for every eligible non-interactive lineage. Native tools, JSON mode, streaming, multimodality, and provider features are separate interaction conditions, never admission requirements or hidden advantages in the common cohort.
• Attribute before scoring. No attempt is a semantic model failure until request delivery, response capture, adapter/scaffold conformance, neutral candidate extraction, workspace integrity, and model-independent scoring are independently rederived; ambiguous ownership remains invalid and non-claiming.
• Bind canonical context in bytes and structure, not one tokenizer. Record provider tokens separately, never truncate or rewrite per model inside a cohort, and treat unsupported complete context as an explicit capability outcome with a separately predeclared smaller condition where useful.
• Freeze every fast form before target-model access using a declared lineage-stratified algorithm. Publish its complete sampling frame, omissions, uncertainty, and alternate forms; fast evidence is directional and never closes standard/full, Trust-release, universal-coverage, or strongest-model claims.
• Do not infer formal saturation from one model family, one mutable provider alias, one public commissioning epoch, or a cohort containing invalid cells. Such observations may reprioritize medium/large and private work, but only BQ-5’s predeclared eligible multi-family evidence changes saturation status.
• Retire benchmark ranking weight prospectively. Preserve public/private anchors, historical difficulty labels, weights, attempts, and scores; equate new epochs through predeclared overlaps and uncertainty instead of rewriting the tide line.
• Do not count a held-out commitment as a usable private lineage until custody can verify the payload, oracle, alternative-solution policy, provenance/consent, leakage status, and blind-execution contract without exposing it to the solver or training lane.
• Never publish a cross-track rank. Cold Acquisition, Open Agent, Genesis-Adapted, and Embedded Local results require separate eligibility, cohort, analysis, and leaderboard surfaces; scaffold or hardware drift creates a new cohort.
• Keep GenesisChallenge outside GenesisBench ranking and release authority. A contribution contest is never a fifth track, difficulty stratum, held-out epoch, benchmark adoption substitute, or corpus shortcut; accepted work enters only through destination-owned review, ordinary gates, and the R8.5 promotion/firewall rules.
• Preserve GenesisChallenge attribution and failure history append-only. Solvers may earn signed credit for independently verified deltas, but no proposer, solver, model/provider, sponsor, contest operator, verifier/scorer author, benchmark custodian, or destination approver may admit, verify, reward, merge, or promote its own work unilaterally.
• Never merge Foundry maturity with GenesisCode capability maturity, GenesisBench rank, or Genesis Model quality. FD and proof status are exact, orthogonal, artifact-bound, and can only advance through the named independent authority.
• Foundry search history is append-only in meaning: pruning may compact payloads only through committed membership/disposition proofs; rejected candidates, failed laws, counterexamples, null ablations, and superseded promotion decisions remain discoverable and cannot be deleted to improve reported yield.
• A Foundry pack, search engine, mechanism, abstraction, or law must beat its simplest adequate baseline under FB-7 before becoming a default. Added research breadth consumes an explicit resource/complexity budget and proposes at least one consolidation, retirement, or non-goal.
• Production remains buildable, testable, releasable, and supportable with foundry/ absent. Any production dependency on Foundry code or mutable registry state is a P0 architecture violation; promoted artifacts must be copied through versioned destination-owned schemas and independently reverified.
• Treat genesis/algorithms as an ordinary destination-owned package, never as a mounted Foundry registry. Every export binds exact semantics, applicability, complexity, provenance/license, supported profiles, independent evidence, fallback, compatibility, owner, and rollback; discovery, FD status, benchmark score, or challenge credit cannot admit it.
• Prevent same-release circularity. Foundry may consume only a prior immutable Genesis Algorithms release as a baseline and may propose only a successor; tasks/checkers are precommitted before search, and the successor rebuilds and verifies with foundry/ absent before publication.
• GenesisExamples/GenesisApps bind exact disclosed GenesisCode, target-profile, and Genesis Algorithms releases and exclude mutable Foundry state, hidden candidate history, and search-specific oracles. Every released item is independently runnable, classified, maintained, and evidence-bound; a dependency that does no workload-relevant work is rejected.
• GenesisBench binds exact disclosed GenesisCode, Genesis Algorithms, and public example/app catalog releases and excludes mutable Foundry state, hidden candidate history, published solutions as held-out answers, and search-specific oracles. Later library/catalog releases create explicit compatibility cohorts rather than rewriting tasks or historical results.
• Version GenesisCode, Foundry snapshots, Genesis Algorithms, GenesisExamples/GenesisApps catalogs, GenesisBench, reference scaffolds/adapters, task epochs, and Genesis Model packages independently. Every compatibility claim names all relevant identities; no release rewrites another outcome’s historical evidence.
• Keep portfolio milestones observational and dependencies scoped. The machine policy must not make GenesisCode Core wait for Foundry/Algorithms, curated examples/apps, Bench, Challenge, or Model; must require finite F2.r before R8.3.a-b and finite R8.3.b before the first Bench/Challenge release; must not make later Bench wait for unrelated Foundry, universal-app, or model expansion; and must never let one outcome borrow another’s evidence.
• Never use a non-sequential workstream name as an implicit scalar prerequisite. Fan in every required leaf task explicitly, keep parallel branches explicit, and require the roadmap-manifest self-test to reject terminal-task-only expansion.
• Treat product compatibility as a typed relation, not shared branding: required, optional, compatible, incompatible, preview, and absent are explicit, and an optional Genesis Model can never become an undeclared GenesisCode build, verification, or operation dependency.
• Admit model output to examples, packages, or training data only through R8.5 provenance, license, verification, review, deduplication, secret, and held-out-firewall rules.
• Establish and adversarially verify BQ-7/BQ-8 capability, storage, operator, and audit separation before admitting the first training artifact or starting training; a later firewall audit cannot retroactively cleanse an exposed corpus or checkpoint.
• Import Theseus or ASI Stack learning only through a clean signed content-addressed R8.5.i source edition and transfer manifest. Mutable latest state, dirty worktrees, prose summaries, dashboards, and uncaptured conversations may propose a candidate but cannot authorize model design, data, training, or release decisions.
• Evaluate a coupled language/model pair change through R8.5.r’s four cells before promotion; evaluate a model-only change against the frozen language through its two non-degenerate cells. Preserve cold-model accessibility and reject benchmark-specific APIs, evaluator changes, or combined-only co-adaptation even when the candidate specialist improves.
• Add a new capability family only with a spec owner, capability schema, resource model, threat model, host/platform scope, negative controls, generated bindings/cards, and at least one product workload.
• A target name or file suffix is never capability evidence. Promotion requires install/start/flash and a nontrivial workload in the declared real runtime, plus resource/lifecycle evidence; descriptor, empty-export, synthetic launcher, and simulator-only results remain labeled below L4.
• Preserve the one-language authoring contract. Generated foreign artifacts are disposable read-only outputs with source maps and identities; if a user or agent must edit one, record a product defect and remove that target from the qualified matrix until GenesisCode owns the missing abstraction.
• Keep Embedded Linux, full-host, and constrained MCU profiles distinct. New boards arrive through BSP/HAL packages and conformance suites, never hidden compiler branches; every firmware claim names exact silicon, board, toolchain, memory map, peripherals, and physical evidence.
• Change canonical hashes, logs, package/patch/evidence formats, bytecode, snapshots, or bootstrap envelopes only through a versioned compatibility proposal and migration corpus.
• Review this roadmap at every milestone and at least monthly while active. Reordering must explain dependency or evidence changes, not preference alone.
• The final test of the roadmap is not how advanced it sounds. It is whether an independent user and their agents can reproduce the claims, understand failures, remain inside explicit authority, and ship useful software without trusting hidden machinery.