Proposal 090: Inference Execution Provenance and Non-local Disclosure

Based on:

• doc/normative/20-vision/VISION.md
• doc/normative/30-core-values/CORE-VALUES.md
• doc/normative/40-constitution/CONSTITUTION.md
• doc/project/40-proposals/004-human-origin-flags-and-operator-participation.md
• doc/project/40-proposals/021-service-offers-orders-and-procurement-bridge.md
• doc/project/40-proposals/047-classification-label-propagation.md
• doc/project/40-proposals/063-inquirium-model-inquiry-organ.md
• doc/project/40-proposals/064-inquirium-implementation-recommendations.md
• doc/project/40-proposals/066-inquirium-assistant-channel.md
• doc/project/40-proposals/067-shared-offer-catalog-over-agora.md
• doc/project/40-proposals/069-corpus.md
• doc/project/40-proposals/070-room-primitive.md
• doc/project/40-proposals/073-agent-orchestration-organ.md
• doc/project/40-proposals/081-horizontal-protocol-primitives.md
• doc/project/40-proposals/086-component-communication-observation-and-trace-sessions.md

Related producer contract, extended by this proposal:

• doc/project/40-proposals/089-external-agent-runtime-adapter-contract.md

Related design (reuse boundary):

Proposal 091: File-backed Configuration and Explainable Composition. P091 reuses sealed-registry, bounded carrier, conservative projection and inventory-checker idioms, not inference-provenance semantics. Configuration describes intended/resolved behavior; it cannot prove realized locality or egress. The configuration contract keeps its own identities and types. This reciprocal reference does not add a P091 dependency to P090's existing completion gates.

Status

Accepted design, with the repository-evidenced carrier inventory and the five V1 design questions resolved on 2026-09-04. The two canonical schemas, pure comparison/join/projection and migration core, boundary Schema Gate, fixtures, and layering guards are implemented by P090-003. A first producer-to-Agent vertical is now partial: Inquirium generate and External Agent Runtime terminal products/outcomes emit durable compatible successors, while both an Inquirium passage and an ordinary External Agent Runtime controller step preserve a monotone join through trace, restart replay, and agent.outcome.v2. Real three-host Story-012 evidence now also retains the exact ordinary-controller sidecar for the final Codex Reviewer product after a mid-passage Agent restart; this is a bounded producer-to-Agent acceptance slice, not completion of the cross-node consumer matrix. The admitted provider registry, guided CLI/UI, and runtime/profile operator inspection are implemented. Direct successful generate, embed, classify, rerank, summarize, transform, image-generate, and image-edit executions now bind exact result sidecars into durable traces from explicit runtime characteristics; absent characteristics stay unknown, and a typed pre-I/O generation refusal is recorded as not-dispatched. The executable translator inventory runs its named verification sets in CI. P090-004a now carries bound generate/embed results, sanitized failure dispatch evidence, generate-backed translation, current embedding cache/restart and exact Agent passage ancestry through a compatible shared V2 envelope. Optional scoped Agent/external-runtime invocation preflight precedes new I/O and does not block historical replay. Other operation terminals, general public V2 negotiation, batch embedding, training, artifact/deferred/effect carriage, higher-layer consumer policies and the complete cross-node provenance matrix remain implementation work. Existing locality policies, provider metadata, classification labels, origin classes, runtime traces, and offer fields are antecedents only; none currently proves the proposal's complete result-level vertical.

Date

2026-09-01

Executive Summary

Orbiplex should let a consumer distinguish inference performed within an operator-declared local processing boundary from inference that involved an external processing boundary. The information must remain attached to the result as higher layers transform, aggregate, cache, replay, offer, deliberate over, or present it. When policy permits, the node may also disclose one or more inference-provider references. When exact disclosure is not permitted, the fact of non-local processing must remain visible.

This proposal introduces two separate semantic targets: inference-execution-posture.v1 for a scoped pre-execution declaration and inference-execution-provenance.v1 for an immutable, provider-neutral description of one realized execution path or one terminal operation whose dispatch state is known or ambiguous. Together they keep three facts from being collapsed:

1. pre-execution posture — what a profile, participant binding, or service offer declares it may do;
2. realized per-result provenance — what is known about the execution that produced this exact result;
3. evidence basis — why the emitting node is entitled to make each claim.

The propagation rule resembles taint tracking internally, but public contracts do not call non-local inference "tainted." Non-local processing is not contamination. It is a material execution characteristic that can affect consent, routing, disclosure, filtering, and presentation.

The contract is deliberately cumulative rather than absolute. It cannot prove physical locality against a dishonest node, a compromised runtime, or an adapter that conceals another provider hop. It can make honest implementations more transparent, preserve uncertainty, and prevent known non-local processing from silently becoming "local" as data crosses architectural layers.

Context and Problem Statement

Orbiplex already has several pieces of the intended mechanism:

• model-runtime catalog entries describe runtime locality, egress policy, adapter provider, transport, model binding, and trust posture;
• Inquirium performs pre-I/O locality, classification, and egress admission;
• external Agent runtime profiles declare transport, retention, authentication, and egress constraints;
• classification labels propagate conservatively under Proposal 047;
• human/model participation origin is made visible by Proposal 004;
• Corpus service offers may describe a coarse model class;
• communication observations and execution receipts can support evidence refs.

Those pieces answer different questions. A selection policy says what may be used. A runtime catalog says what is configured. A transport says how the host reaches an adapter. A trace says what one observation point recorded. None of them, alone, is a portable statement of how one exact inference result was produced.

Today this information narrows at the Inquirium result boundary. Runtime and model-binding refs survive, and some provider/model details survive in local diagnostics, but higher-level products do not receive one typed execution- provenance value. Agent, Corpus, Room, and Assistant therefore cannot preserve, join, filter, or present the characteristic without reverse-engineering local catalog state or relying on naming conventions.

That reverse inference is unsafe. A local process or local HTTP sidecar may call a remote provider. Conversely, an operator-controlled model may run on another machine that still belongs to the policy's declared local processing boundary. Transport location, model name, adapter name, and processing locality are related observations, not synonyms.

The missing abstraction is a small horizontal value that carries known execution origin and uncertainty without becoming an identity, authority, classification, or provider-specific protocol.

Normative and architectural lineage

This proposal operationalizes existing commitments rather than creating a new normative authority. Local-first operation, user and data sovereignty, minimal disclosure, layered audit traces, and explicit model-backed inference already come from the Vision, Core Values, and Constitution. The proposal compresses those commitments into a project-level data contract and newly determines the join, evidence, projection, and consumer boundaries needed to implement them.

The stratified chain is:

locality, agency, privacy, and transparent model use
  -> explicit and minimally disclosed processing facts
  -> inference execution provenance contract
  -> producer derivation and monotone propagation
  -> consumer policy, filtering, and presentation
  -> schemas, ledgers, fixtures, tests, and runtime evidence

Goals

• Give every inference-derived result a typed, immutable execution-provenance descriptor or exact content-addressed reference to one.
• Represent terminal pre-dispatch refusal without falsely claiming unknown inference execution.
• Distinguish an advertised pre-execution posture from realized per-result provenance.
• Preserve known non-local or mixed processing through higher-layer transformations, aggregation, cache, replay, and cross-node carriage.
• Preserve uncertainty instead of treating missing metadata as local execution.
• Let providers be identified through optional, open, namespaced references without defining a closed global provider enumeration.
• Support selective disclosure: provider identity may be redacted while the non-local characteristic and evidence limits remain visible.
• Let Corpus consumers filter offers by declared posture and validate delivered results against that declaration.
• Let Room and Assistant surfaces warn, label, or restrict non-local and unknown inference according to local policy.
• Reuse P081 receipts and P086 observations as evidence references without turning either diagnostic subsystem into the semantic owner.
• Keep the contract small enough for pure join and projection functions, schema fixtures, replay tests, and independent implementations.

Non-Goals

• No proof of physical locality against a dishonest or compromised node.
• No promise that an adapter or provider has disclosed every hidden downstream processor.
• No provider reputation, trust ranking, certification, or allowlist imposed by this proposal.
• No closed catalog of deliberation profiles, problem domains, provider names, or acceptable evidence policies.
• No reinterpretation of local inference as inherently trustworthy or non-local inference as inherently untrustworthy.
• No addition of locality or provider identity to the classification lattice.
• No replacement of human/model participation origin from Proposal 004.
• No promotion of runtime sessions, provider accounts, endpoints, request ids, or credentials to Agent, Room, or Corpus identity.
• No new capability, grant, membership, or publication authority derived from a provenance descriptor.
• No requirement to disclose exact provider identity when policy requires a coarser projection.
• No use of optional communication tracing as the only source of mandatory provenance.

Terminology

Term	Meaning
Local processing boundary	Versioned, operator-admitted boundary relative to which locality is asserted. It may be narrower than an organization and broader than one process, but its meaning must not be inferred from a hostname or transport.
Pre-execution posture	Signed or locally admitted statement of what an offer, runtime profile, or scoped participant binding may use before a particular invocation occurs, relative to an exact processing-boundary ref and assertion scope.
Realized provenance	Immutable claim about the dispatch, locality, egress, processors, and evidence of one exact result or terminal operation.
Evidence basis	Typed reason supporting one provenance claim, such as host-enforced no-egress, host-selected runtime profile, host-observed egress, adapter report, provider report, peer attestation, or derivation from parent values.
Provider ref	Optional opaque namespaced reference identifying a processor or inference service. Values are open; the shared schema does not enumerate providers.
Provenance projection	Policy-governed reduction of a fuller local descriptor for another consumer. Projection may remove details but may not strengthen evidence or erase known non-local processing.
Provenance join	Pure conservative combination of parent descriptors into a descriptor for a derived or aggregate result.
Unknown	An explicit absence of sufficient evidence for a claim after possible execution. It never means local.
Not dispatched	Host-established fact that provider/runtime I/O for the scoped inference did not begin. It is distinct from unknown execution.

The word posture in this proposal is always qualified as inference execution posture: a workload-scoped pre-execution declaration. It is not topology/host-posture, node-extension-posture.v1, an extension-posture evaluation, or an unqualified posture/ref/posture/digest from those contract families. Their refs, digests, evidence, and policy meanings are not interchangeable. The qualified inference-execution-posture.v1 name is retained because it describes an admitted operational stance rather than merely the fact that a declaration was serialized.

Proposed Model / Decision

Decision 1: Posture, realized provenance, and evidence remain separate

The system must not use one remote Boolean for three different claims.

Stratum	Question	Typical owner	May drive
Pre-execution posture	What processing may this offer, binding, or profile use?	profile owner, offer signer, participant-binding owner	admission, routing, consent, filtering
Realized provenance	What is known about the path that produced this exact result?	host boundary that admitted and observed execution	result labels, downstream joins, policy validation, presentation
Evidence basis	Why may the node make that claim, and with what limitation?	host evidence assembler; peer only attests to its own claim	assurance policy, warning strength, audit

Posture is an open characteristic map. Its small common locality vocabulary is:

• local-only;
• may-use-non-local;
• non-local-required;
• unknown.

Posture has its own contract, inference-execution-posture.v1; it is not a projection of realized provenance. The contract binds at least:

• the assertion owner and the offer, runtime profile, participant binding, or other exact subject;
• the versioned local-processing-boundary ref against which locality words are interpreted;
• the scope, generation or validity interval, and shared locality commitment;
• optional open provider refs, their disclosure state, namespaced extensions, and locally admitted evidence requirements.

An assertion that crosses an ownership boundary is signed. A locally admitted assertion retains equivalent owner, generation, and boundary binding in durable host state. Absence, invalidity, expiry, or a missing boundary ref becomes explicit unknown; it never becomes local-only.

The existing model-runtime LocalityMode and TrustMode values are legacy admission and routing inputs, not realized provenance and not sufficient evidence of locality. In particular, TrustMode names whether the legacy routing surface is restricted to, prefers, or is capable of admitting non-local candidates; it is not provider trust, evidence strength, or cryptographic assurance. Migration to the shared posture vocabulary is total and conservative:

Legacy catalog/profile facts	P090 posture result	Preserved qualification
Candidate policy and capabilities are both LocalOnly, trust mode is StrictLocal, and the host binds an exact admitted processing boundary plus the required enforcement facts	local-only	This remains a pre-execution commitment, never realized proof.
Any complete legacy tuple contains LocalPreferred, RemoteAllowed, or RemoteCapable	may-use-non-local	LocalPreferred may survive as an optional namespaced routing preference; it is not a separate shared locality ceiling.
A new explicit binding requires processing outside the admitted boundary	non-local-required	There is no lossless legacy equivalent; this value must be declared explicitly.
A required legacy field or boundary binding is missing, invalid, stale, or cannot be reconciled	unknown	No Rust or schema default may strengthen it to local-only.

At a deserialization or migration boundary, an enum's Rust Default implementation is never locality evidence. Raw legacy DTOs therefore keep locality and trust inputs required or optional until explicit validation and migration completes. Builders, container defaults, and unwrap_or_default() paths are subject to the same rule. An absent profile override may mean only “no additional override”; it cannot repair absent candidate facts or establish local execution.

This vocabulary describes one horizontal dimension, not a closed repertoire of profiles. Operators and communities may add namespaced characteristics and evidence requirements without changing the shared core. An offer or Room policy may require stronger evidence than another without creating a universal catalog of acceptable deliberation meanings.

Two posture or locality assertions are directly comparable only when they name the same boundary ref or when local policy admits an explicit, versioned equivalence or containment relation between their boundaries. Otherwise a federated filter returns non-match or unknown according to caller policy; it must not reinterpret another operator's local-only as its own.

Realized provenance never inherits a favorable posture merely because the profile promised it. It is derived from the selected binding and host-known execution facts after dispatch. A mismatch between posture and realized provenance is a policy violation or typed uncertainty, not a reason to rewrite the result metadata.

Decision 2: inference-execution-provenance.v1 is a horizontal value

The canonical contract uses one deterministic representation rule: carry the bounded descriptor inline together with its digest at or below the V1 canonical byte threshold, and carry an immutable content-addressed ref above that threshold. P090-003 freezes the exact threshold as a schema/core constant. In either form, descriptor/id is always the sha256: digest of the same domain-separated canonical semantic identity material, not a random identifier or a digest of the carrier wrapper. V1 uses CanonicalJsonProfile::JcsV1 and sha256_base64url_canonical_json_prefixed; the identity material includes a fixed descriptor-type domain and excludes only the self id, signature, carrier wrapper, and explicitly enumerated presentation-only fields. It never excludes locality, egress, dispatch, evidence/disclosure completeness, boundary, subject, or lineage semantics.

Its semantic fields are:

Field family	Required semantics
Contract and scope	Exact schema id, descriptor id/digest, subject result or terminal-operation ref, producing node or host assertion ref, and timestamp or sequence context.
Dispatch	not-dispatched, dispatched, or ambiguous, scoped only to the provider/runtime I/O for this invocation.
Locality	local, non-local, mixed, unknown, or not-applicable, interpreted relative to an exact local-processing-boundary ref.
Input egress	none, possible, occurred, or unknown, independent from transport kind and data classification.
Provider disclosure	Bounded open provider/refs, plus whether the set is complete, partial, withheld, or unknown.
Execution bindings	Optional runtime, adapter-profile, model-binding, model-snapshot, and external-runtime-profile refs that remain meaningful under the selected projection.
Evidence	Bounded typed assertions naming their basis, asserting subject, evidence refs, and any scope or completeness limitation.
Lineage	Bounded parent provenance refs or one content-addressed aggregate ref sufficient to reproduce the join.
Extensions	Bounded namespaced values admitted by policy; extensions cannot redefine core fields or authority.

not-dispatched is required for a host refusal that occurs before provider or runtime I/O. Such an outcome records locality=not-applicable and input-egress=none; it must not synthesize unknown execution. Every inference-derived result and every terminal outcome after a possible dispatch must carry or reference a descriptor. ambiguous dispatch preserves the fact that egress or provider execution may have occurred even when no result was committed.

The exact JSON field spelling, size ceilings, inline threshold, identity-material projection, and conditional requirements belong to the canonical schema tasks. Those details may not weaken the semantic distinctions frozen here.

Decision 3: Locality is relative to an admitted boundary, not a transport

local means that the emitting host has sufficient evidence that the scoped inference remained within the exact operator-admitted local processing boundary. It does not mean:

• the adapter process used loopback;
• the transport was stdio or a Unix socket;
• the model name appeared in a local catalog;
• the endpoint was configured by the local operator;
• the result arrived through a local Agent process.

A local Python sidecar calling the OpenAI API is non-local. A local Codex/App Server process using a provider-managed inference service is non-local. An operator-controlled runtime on another host may count as local only when the referenced boundary policy explicitly includes it and the evidence basis supports that claim.

Boundary-relative locality does not grant access to a host-local data plane. A runtime on another admitted host may be local for P090 while remaining unable to dereference this host's file:// path. Raw file-lease eligibility is a separate operation-scoped decision over placement, reachability, lease policy, canonical containment, and egress controls; cross-host data uses an admitted artifact or object-store carrier. Conversely, a co-located loopback sidecar may have file reachability while its provider inference is non-local. Neither decision may be derived from the other.

The boundary ref is part of claim interpretation. A receiving node treats another node's locality as a peer assertion relative to the sender's boundary; it must not silently reinterpret that claim as host-observed locality relative to its own boundary.

Decision 4: The host derives provenance; adapters contribute evidence

The host boundary that admits the runtime/profile and observes dispatch owns the realized descriptor. An adapter may report provider, model, request, or downstream processing information, but it cannot lower host-known egress, replace the selected runtime facts, or self-certify local execution.

Evidence basis is not a single confidence score and has no universal total ordering. At minimum the schema must distinguish:

• host-enforced-no-egress;
• host-observed-egress;
• host-selected-profile;
• adapter-declared;
• provider-declared;
• peer-attested;
• derived;
• unknown.

An implementation may admit additional namespaced evidence classes. It may not promote adapter-declared or peer-attested to host-observed merely because a signature verifies. A signature authenticates the assertion and signer, not the physical truth of the asserted processing path.

P081 execution receipts and P086 communication observations may appear as evidence refs. P081 continues to own causal/execution linkage, and P086 continues to own optional diagnostic observation. The provenance descriptor owns the portable semantic claim.

The existing model-runtime EgressPolicy is configuration and admission input, whereas P090 input-egress is a realized observation or enforced fact for one invocation. They are connected conservatively:

Host-known state	Realized input-egress
Refusal proven before provider/runtime I/O	none, together with dispatch=not-dispatched; catalog policy is irrelevant to that invocation.
Every relevant execution path is host-enforced no-egress for the complete invocation scope	none, with host-enforced-no-egress evidence. An empty allowed_domains, offline_ok=true, or a local transport is not sufficient without enforcement.
Dispatch occurred through a path that may egress, but no observation proves whether it did	possible.
The host observed an outbound write or received a dispatch-bound provider acknowledgement	occurred, with the corresponding observation/ref.
Dispatch or observation coverage is incomplete in a way that cannot establish even the preceding cases	unknown.

allowed_domains, proxy_profile, offline_ok, and on_error may constrain admission or posture, but configuration alone never proves occurred and cannot prove none. Conversely, an observed or acknowledged egress cannot be lowered by a more favorable configured policy.

Decision 5: Propagation is monotone and joins are conservative

Any component that derives a result from inference-derived inputs must either:

1. preserve the exact descriptor when the result is only a carrier or lossless projection; or
2. compute a new descriptor with the canonical pure join and retain bounded parent lineage.

The following invariants are mandatory:

• known non-local participation cannot become local;
• local is emitted only when all relevant paths are known local under the same compatible boundary and evidence is sufficient;
• local plus non-local becomes mixed;
• non-local plus unknown remains at least non-local, while evidence completeness records that other paths remain unresolved;
• local plus unknown becomes unknown, not local;
• occurred egress cannot become possible, none, or absent;
• none is emitted only when all relevant paths establish no scoped input egress;
• provider refs form a bounded set union; redaction changes disclosure completeness but not known locality;
• cache and exact replay reproduce the original descriptor id and semantics;
• a summary may point to bounded parent evidence, but truncation is explicit and never presented as complete lineage;
• missing legacy metadata migrates to unknown, never local.

The fold over no inference parents returns locality=not-applicable only when the producer proves that the parent set is complete and that the result is a purely deterministic, non-inference transform. not-applicable is then the join identity for such irrelevant parents. An empty set caused by missing, stripped, truncated, or unversioned inference lineage becomes unknown or a typed refusal according to policy; it must not use this identity rule.

The pure core must define a table-driven join for locality, dispatch, egress, provider disclosure, evidence completeness, and lineage bounds. A consumer must not reimplement the join from prose, runtime names, or provider-specific rules. The locality table covers all 25 ordered pairs, and exhaustive plus property tests cover commutativity, associativity, idempotence, permutation invariance over parent multisets, identity for proven not-applicable, and monotone preservation of known exposure and uncertainty. The tests apply to the complete value and its explicit completeness fields rather than assuming a misleading total order over the locality labels alone.

Decision 6: Selective disclosure narrows detail, not the material fact

The local full descriptor may contain provider refs, local runtime refs, model snapshots, and detailed evidence refs. A projection for Room, Corpus, Assistant, or another node discloses only what its policy and classification allow.

Projection rules are asymmetric:

• exact provider refs may become a provider class, withheld marker, or omitted set with explicit incomplete disclosure;
• local paths, endpoints, account ids, session/thread refs, credentials, provider request ids, and raw diagnostic payloads are never required public fields;
• known non-local or mixed locality survives provider redaction;
• known egress survives redaction;
• evidence strength may be preserved or weakened, never strengthened;
• the receiver records the sender's signed assertion as peer-attested even when the enclosed sender evidence cites stronger local observations;
• projection must not make a partial provider set appear complete.

Projection is a pure function project(full, policy) -> projected. Every projection has its own canonical projection digest and names the unchanged source descriptor/id; it does not reuse the full descriptor's content digest after redacting semantic bytes. Property tests require every admitted policy to preserve or conservatively weaken locality, input egress, disclosure completeness, and evidence basis, never strengthen them. Presentation-only wording may be excluded from the source semantic identity exactly as enumerated by the canonical contract; provider disclosure and other material semantics may not be erased under that label.

This preserves the Constitution's layered-trace and minimal-disclosure model: the full local trace may be richer than a federated projection without making the projection misleading.

Decision 7: Producers and consumers have distinct ownership

Layer	Responsibility
model-runtime / external runtime host	Describe admitted profile facts, dispatch state, host-observed egress, and adapter/provider assertions without inventing domain authority.
Inquirium	Emit or reference realized provenance on every inference-derived result and post-dispatch terminal outcome; retain it in operation traces, artifacts, cache, and replay.
Orbiplex Agent	Preserve or join provenance across passages and external-runtime products; expose it through Agent product/outcome contracts without provider-native session semantics.
Other Inquirium/Agent result translators	Declare a compatible successor or immutable sidecar carrier and preserve or conservatively join provenance; this includes Whisper redaction preparation, Semantic Index embedding projections, and generic workflow/JSON-e/Flow result translations.
Shared Offer Catalog	Index signed pre-execution posture and disclosed provider characteristics; support exact query/filter semantics without claiming that an offer proves a future execution.
Dator / service-order result producer	Bind the producer's realized descriptor or immutable sidecar ref to a compatible result contract; never synthesize provenance from offer posture.
Artifact Delivery	Carry the bound descriptor or sidecar opaquely with content, identity, digest, and correlation protection; do not reinterpret locality or evidence.
Arca / buyer host	Verify and preserve the producer assertion, retain Artifact Delivery provenance, compare boundaries explicitly, and apply buyer policy without upgrading peer evidence.
Corpus	Route by offer posture, validate delivered provenance against the selected offer and policy, and preserve realized provenance in answers/drafts/publication candidates.
Room	Carry per-contribution provenance or a stable ref; derive scoped display aggregates without changing participant identity or membership authority.
Assistant Channel	Present preflight disclosure before admitted non-local egress and post-result provenance after execution; preserve it in response, transcript, trace, and activity projections.
P081 / P086 mechanisms	Supply causal, receipt, or observation evidence refs; do not own the result-level semantic descriptor.
Receiving node or client	Verify framing/signature, preserve assertion provenance, apply local admit/warn/filter policy, and never upgrade peer evidence.

Carrier inventory and compatibility migration plan

The P090-001a audit below records the current repository carriers rather than an aspirational component list. A major successor is required when the consumer interprets the result and absence of provenance would change admission, completion, or product meaning. A bound sidecar/ref is appropriate when the carrier transports or stores an opaque product and can bind the descriptor to the exact content digest and result identity without interpreting it. Internal provider-edge DTOs remain provider evidence inputs and do not become realized provenance owners.

Current owner and carrier	Current inference relationship	V1 migration assignment	Repository evidence
model-runtime catalog, RuntimeCandidateConfig, AdapterInstanceConfig, and ModelRuntimeProfile	Selection and admission inputs, not realized results	Compatible local configuration additions may bind posture and processing-boundary refs; current LocalityMode/TrustMode migrate conservatively and never become realized proof.	node:model-runtime/src/lib.rs
Inquirium GenerateResponse	Direct inference result and common lower carrier for summarize, transform, Agent, Corpus, JSON-e Flow, and Assistant	inquirium.generate.response.v2; V1 remains readable only as provenance unknown or through an exact bound sidecar.	node:inquirium-core/src/lib.rs, node:inquirium-host/src/lib.rs, node:daemon/src/model_runtime_host.rs
Inquirium EmbeddingResponse	Direct embedding result; cached and consumed by future Semantic Index projections	inquirium.embed.response.v2; exact cache replay preserves its descriptor identity. V1 cache entries migrate to unknown, never current catalog facts.	node:inquirium-core/src/lib.rs, node:daemon/src/model_runtime_host.rs, node:daemon/src/inquirium_response_cache.rs
Inquirium BatchEmbeddingResponse	Artifact-producing batch inference	inquirium.batch-embed.response.v2; the artifact also carries a content-bound descriptor sidecar/ref so an opaque store does not need to interpret it.	node:inquirium-core/src/lib.rs, node:daemon/src/model_runtime_host.rs
Inquirium ClassifyResponse and RerankResponse	Direct interpreted inference results	inquirium.classify.response.v2 and inquirium.rerank.response.v2.	node:inquirium-core/src/lib.rs, node:daemon/src/model_runtime_host.rs
Inquirium SummarizeResponse and TransformResponse	Lossy translations of GenerateResponse	inquirium.summarize.response.v2 and inquirium.transform.response.v2; conversion preserves the exact descriptor for one-parent projection or performs the canonical join.	node:inquirium-core/src/lib.rs, node:daemon/src/host_capabilities_host.rs
Inquirium ImageResponse	Host-verified artifact result shared by image generation and editing	inquirium.image.response.v2 plus a content-bound artifact sidecar/ref.	node:inquirium-core/src/lib.rs, node:daemon/src/model_runtime_host.rs, node:daemon/src/host_capabilities_host.rs
training adapter TrainAdaptAdapterResponse	Private provider-edge response, followed by host evaluation and artifact publication	Keep the private adapter DTO as evidence input. Bind realized provenance to the host-published artifact and deferred terminal result through an immutable sidecar/ref; do not call adapter self-report realized provenance.	node:inquirium-core/src/lib.rs, node:daemon/src/inquirium_training_worker.rs, node:daemon/src/deferred_registry.rs
AssistantTurnResponse and retained transcript facts	Assistant-visible projection and durable transcript of generate output	inquirium.assistant.turn.response.v2 and a compatible transcript-fact successor; preflight posture remains separate from the result descriptor.	node:inquirium-core/src/lib.rs, node:daemon/src/host_capabilities_host.rs, node:daemon/src/inquirium_transcript_projection.rs
model invocation traces and deterministic response cache	Local diagnostics and replay state	Add an immutable descriptor/ref to the trace and cache record. Exact replay returns the original descriptor; V1 cache absence becomes unknown.	node:daemon/src/middleware_host.rs, node:daemon/src/inquirium_response_cache.rs, node:daemon/src/model_runtime_host.rs
ExternalRuntimeProduct and ExternalRuntimeTurnOutcome	Provider-neutral external-Agent result and terminal state	agent.external-runtime.product.v2 and agent.external-runtime.turn-outcome.v2; provider-native sessions, accounts, endpoints, auth, and request ids stay private.	node:external-agent-runtime-core/src/lib.rs, node:daemon/src/external_agent_runtime.rs
AgentInferencePassageProduct, AgentInferenceTerminalSelection, and AgentInferencePassageTrace	Agent passage product, selected lineage, and replay trace	Compatible V2 successors; every inference parent is preserved or canonically joined before terminal selection.	node:agent-core/src/passage.rs, node:daemon/src/agent_runtime.rs, node:daemon/src/agent_memarium_store.rs
AgentOutcome and Assistant draft projection	Interpreted terminal Agent product	agent.outcome.v2 and a compatible Assistant draft successor. V1 is historical and is not extended in place.	node:agent-core/src/lib.rs, node:daemon/src/agent_runtime.rs, node:daemon/src/host_capabilities_host.rs
JSON-e Flow and generic middleware envelopes/traces	Declarative translation and routing of Inquirium or Agent results	Carry a schema-gated content-bound provenance sidecar/ref in the workflow envelope and trace; JSON-e must not reimplement join or infer locality.	node:middleware-runtime/src/json_e_executor.rs, node:daemon/src/middleware_host.rs, node:middleware-runtime/fixtures/json-e-flow/
Whisper redaction prepare request/response	Currently deterministic JSON-e/Sensorium transform; future implementations may use Inquirium	Preserve a bound provenance sidecar/ref when the selected implementation has inference ancestry. Deterministic no-inference execution uses the proven empty-fold identity; missing ancestry does not.	node:whisper-intake/src/lib.rs, node:middleware-runtime/fixtures/json-e-flow/whisper-redaction/
Semantic Index embedding row/projection	Planned rebuildable consumer of Inquirium embeddings; no current Node runtime carrier exists	Require a content-bound descriptor/ref in the first durable row schema rather than introducing a legacy provenance-free row. Deferred until a Node implementation exists; see the conditional carrier decision.	orbidocs:doc/project/60-solutions/022-semantic-index/022-semantic-index.md; no implementing Node crate exists as of the audit
service-offer.v1 and Shared Offer Catalog projections	Pre-execution declaration and indexing	Add the separate posture through a compatible offer successor or signed characteristic sidecar; never place realized provenance in an offer.	orbidocs:doc/schemas/service-offer.v1.schema.json, node:catalog/, node:daemon/src/catalog_host.rs
service-order.result.v1, Dator result production, and Arca admission	Interpreted remote procurement result	Compatible result successor or mandatory content-bound sidecar/ref. Producer assertion, Artifact Delivery transport provenance, and buyer verification remain distinct.	orbidocs:doc/schemas/service-order-result.v1.schema.json, node:daemon/src/execution_host.rs, node:daemon/src/settlement_host.rs
Artifact Delivery envelopes, object pointers, results, and retained artifacts	Opaque transport and storage	Carry the immutable sidecar/ref with exact artifact, result, and digest binding; Artifact Delivery does not interpret locality.	node:artifact-delivery-core/, node:artifact-delivery/, orbidocs:doc/schemas/artifact-delivery-envelope.v1.schema.json
Corpus query/bid/answer, draft, experiment-review, and publication paths	Offer selection plus interpreted deliberation products	Posture enters a compatible offer/query binding; realized result contracts that affect validation or publication receive major successors. Domain-specific review claims remain orthogonal.	node:corpus-core/src/lib.rs, node:daemon/src/corpus_host.rs, orbidocs:doc/schemas/corpus-reasoning-answer.v1.schema.json
Room live messages, relay delivery, durable events, and read models	Per-contribution carriage and participant aggregate projection	Compatible message/event successors carry a descriptor or immutable ref; relay carriers transport it opaquely. Participant posture and badges remain scoped read-model data, not membership identity.	node:room-core/src/lib.rs, node:room-service/, node:room-wss/, orbidocs:doc/schemas/room-live-message.v2.schema.json
P081 receipts and P086 observations	Causal and diagnostic evidence	Reuse as bounded evidence refs. Neither contract is extended into a competing inference-provenance vocabulary.	node:horizontal-protocol-core/, node:communication-trace-core/

This inventory is also the initial layering allowlist for P090-003. Adding a new inference-derived translator without assigning a successor or bound sidecar is a promotion-blocking compatibility change, not an implicit extension of V1.

No consumer may infer the characteristic from adapter name, model name, host label, URL shape, or transport. If the producer contract is absent during migration, the consumer receives unknown or refuses according to policy.

Decision 8: Corpus posture is open and result validation is separate

corpus/model-class currently mixes execution locality (local-llm, remote-llm) with authorship/production mode (human-curated, hybrid-llm-curated). It is therefore not the source of truth for this proposal.

Service offers should expose a general, namespaced inference-posture contract that can state the shared locality ceiling and optional open provider refs. It binds the exact assertion owner, scope, generation or validity, and local-processing-boundary ref. Communities may define additional profile and evidence criteria. The Shared Offer Catalog indexes only registered bounded characteristics and does not impose a global repertoire of deliberation meanings. A query compares matching or explicitly related boundaries; an unrelated sender boundary is non-matching or unknown, never silently local.

The selected provider's actual result must still carry realized provenance. A local-only offer followed by a non-local, mixed, or insufficiently evidenced result is refused, quarantined, or surfaced as a typed contract violation according to the consuming policy. The catalog declaration is not retroactive proof.

The legacy corpus/model-class may remain as a compatibility projection while consumers migrate. It must not be extended into a second provenance vocabulary.

The 2026-09-05 procurement implementation freezes the exact selected declaration and host selection time before dispatch. Scope and the half-open validity interval are checked at selection; later delivery does not replace that promise with today's catalog generation or a new expiry check. Existing catalog admission still owns source/signature authority. Realized-result comparison and buyer consumption policy are independent conjunctions. Unknown handling follows the admitted buyer policy, defaulting to denial when a selected declaration has no explicit policy. A known contradiction remains a denial. Complete declared provider refs bound the set of possible providers, including a complete empty set; partial declarations do not assert a closed set. Evidence requirements are matched against bases actually verified by the receiving boundary, not labels inside an unverified peer claim. The initial remote receiving path supplies only peer-attested; stronger or namespaced requirements need an admitted verifier. This generic procurement checkpoint does not implement Corpus output carriage.

Decision 9: Room posture is scoped; realized provenance is per contribution

Whether an Agent may use non-local inference is not a permanent property of its identity. It may vary by runtime binding, task, Room policy, turn, or operator choice.

Room may therefore carry:

• a signed, scoped participant posture for admission and presentation;
• realized provenance on each inference-derived contribution or product ref;
• a read-model aggregate such as "non-local inference observed" and a bounded disclosed-provider set.

The aggregate is derived presentation metadata, not membership authority. A provider runtime never becomes the speaking participant, and an exact provider session never enters membership or floor-control semantics. Room policy may deny, warn, or allow non-local, mixed, or unknown contributions, but the policy decision does not rewrite their provenance.

Decision 10: Assistant disclosure has both preflight and post-result phases

Before any admitted non-local inference I/O, Assistant must show the operator the host-admitted non-local inference-execution-posture.v1 value and, when local operator disclosure policy permits, the provider ref. This preflight disclosure is unconditional for the admitted non-local route. Consent or an explicit acknowledgement remains a separate authority decision required when the local classification/context policy demands it; when required, it is bound to the posture assertion owner, exact runtime/profile generation, processing-boundary ref, classification ceiling, context digest, purpose, and expiry already owned by the Assistant/Inquirium path. The posture is policy input, not authority by itself.

After execution, the response and activity projection show realized locality, egress, provider disclosure state, and evidence limitation. Preflight consent is not substituted for post-result provenance. A route change, ambiguous dispatch, or provider mismatch is visible even if the operator previously approved a different route.

Decision 11: Classification and participation origin remain orthogonal

Classification answers what may flow and which gates must enforce it. Human/model origin answers how a contribution entered the social transcript. Inference execution provenance answers where and through which disclosed processing relationship model-backed computation occurred.

They compose but do not merge:

Classified<Originated<Provenanced<T>>>

The notation is illustrative, not a required Rust wrapper layout. A component may use an envelope or refs as long as it preserves all three contracts. No classification downgrade follows from local execution, and no classification upgrade follows merely from non-local execution. Existing Proposal 047 join and Proposal 004 origin rules remain authoritative for their own dimensions.

Decision 12: Honest provenance is not a locality guarantee

The descriptor can establish only what follows from its stated evidence. A signed peer may lie. A local adapter may conceal a provider cascade. A provider may subcontract processing. A compromised host may suppress an observation.

Consumers may require stronger evidence profiles, independent network controls, attestation, or local-only execution for sensitive work. Those policies are open and operator/community-defined. This proposal provides the shared facts and uncertainty needed to apply them; it does not claim to solve remote attestation or supply-chain truth.

Concrete Scenarios

Scenario A: Inquirium OpenAI through a local sidecar

The daemon selects an admitted OpenAI Responses adapter implemented as a local Python process. The Assistant has a may-use-non-local posture and asks for operator admission before sending protected context. The local sidecar calls a provider-managed API.

The host does not infer locality from stdio or loopback. The completed response receives:

• dispatch=dispatched;
• locality=non-local relative to the node's admitted boundary;
• input-egress=occurred;
• an optional open ref such as inference-provider:openai when disclosure is permitted;
• host-selected-profile and host-observed-egress evidence, plus separately scoped adapter/provider declarations;
• the selected runtime, adapter profile, model binding, and model snapshot refs allowed by projection policy.

An Agent passage consuming the result preserves that provenance. The Assistant shows a non-local result marker even though the adapter process itself was local.

Scenario B: Codex-backed External Agent Runtime

Orbiplex Agent invokes the admitted openai-codex external-runtime profile over local stdio. The provider runtime maintains a remote working session and returns a critique candidate. The speaking Room actor remains the Orbiplex Agent.

The Agent external-runtime product receives non-local realized provenance. The provider session/thread ref stays private to the fenced adapter checkpoint. A Room projection may disclose inference-provider:openai or only provider-disclosure=withheld; both projections retain locality=non-local. The Room read model may show that non-local inference was observed for this participant without calling Codex a Room member.

Scenario C: Corpus offer and delivered result

A Corpus provider signs an offer with:

• the shared posture may-use-non-local;
• the provider's exact local-processing-boundary ref and assertion scope;
• optional disclosed provider refs;
• a community-defined evidence-profile ref.

One buyer allows only local-only; the Shared Offer Catalog excludes this offer without knowing the topic's semantic profile. Another buyer admits it but denies one provider ref. A third selects it and receives a result whose realized provenance is mixed. Corpus compares that result with the offer and buyer policy, preserves the descriptor in its answer lineage, and either accepts, warns, or refuses by explicit policy. It does not rewrite mixed to the offer's pre-execution declaration.

Scenario D: Room aggregation

A Room participant contributes two Agent products: one from a local model and one from a non-local provider. Each contribution carries its own provenance ref. The Chair synthesizes them with a local model. The Chair's output joins all parents and becomes mixed; the additional local transform does not erase the known non-local parent.

Another node receives a redacted signed projection. It records the claim as peer-attested, preserves the mixed locality, and does not pretend it observed the sender's egress itself.

Scenario E: Refusal and ambiguous dispatch

A local-only request selects no admissible candidate. The host refuses before runtime I/O and records dispatch=not-dispatched, locality=not-applicable, and input-egress=none. It does not create an unknown inference result.

In a different request, a remote write begins and the adapter connection drops before the host can establish whether the provider accepted it. The terminal operation records dispatch=ambiguous, preserves the remote selected-profile fact, and uses input-egress=possible or occurred according to host evidence. It cannot be replayed as a fresh "local" result.

Acceptance Matrix

Case	Required evidence	Expected provenance	Required consumer behavior
Native MLX or llama-server wholly inside an admitted local boundary	host-selected profile plus enforced no-egress evidence	local, none	Preserve; no remote warning unless local policy adds one.
OpenAI API reached by a loopback/stdio sidecar	selected external profile plus a host-observed outbound write or a successful dispatch-bound provider acknowledgement	non-local, occurred; provider optional	Assistant preflight and post-result marker; Agent preserves. A profile alone can establish posture, not realized egress.
Codex/App Server reached over local stdio but using provider inference	admitted external-runtime profile and driver dispatch evidence	non-local, occurred or conservatively possible	Provider session remains private; Agent/Room carry generic provenance.
Result combines local and non-local parents	complete parent refs and canonical join	mixed; known egress retained	Every aggregate and publication candidate preserves mixed lineage.
Known non-local parent plus unknown parent	parent refs and incomplete-evidence marker	at least non-local, with incomplete evidence	Never present as complete or local.
Provider identity redacted	local full descriptor plus policy projection receipt	locality unchanged; provider disclosure withheld or partial	Filtering by locality still works; exact-provider filter treats identity as unavailable.
Peer supplies signed locality claim	verified peer assertion	sender claim retained with peer-attested basis	Receiver does not upgrade to host-observed evidence.
Offer posture uses an unrelated processing boundary	signed posture plus no admitted boundary relation	posture comparison is unknown or non-match	Catalog and buyer do not treat the offer as satisfying their own local-only filter.
Refusal before provider I/O	host admission/dispatch evidence	not-dispatched, not-applicable, none	Do not invent an inference result or warn that data left the boundary.
Dispatch outcome is ambiguous	durable dispatch intent plus missing terminal acknowledgement	ambiguous; egress possible, occurred, or unknown	No silent retry, downgrade, or local claim.
Egress policy lists no domains but execution lacks complete host enforcement	catalog policy only	at most possible after dispatch; never none from configuration alone	Do not turn offline_ok, empty allowed_domains, or local transport into observation evidence.
Cache hit or exact replay	original descriptor id/digest	byte/semantic identity with original provenance	No new provider claim and no metadata loss.
Legacy result lacks the field	version/migration evidence	explicit unknown	Consumer follows configured deny/warn/allow policy.
Legacy catalog omits locality or trust facts	legacy migration DTO plus version evidence	posture/provenance unknown; malformed current catalog rejected	No enum, container, or builder default may establish local processing.
Pure deterministic transform has a proven complete empty inference-parent set	producer proof of complete non-inference ancestry	not-applicable; empty-fold identity	Do not emit warnings for a result that has no inference ancestry. Missing or stripped ancestry is not this case.
Corpus local-only offer returns non-local or unknown result	signed offer plus realized descriptor	original realized fact preserved	Typed refusal, quarantine, or explicit policy warning; never silent acceptance.
Room receives local and remote contributions from one participant	per-contribution descriptors	per-turn facts plus derived participant aggregate	Badge is read-model metadata, not participant identity or authority.
Hidden provider cascade is suspected but not evidenced	incomplete adapter/provider assertion	unknown, or known non-local with incomplete provider set	UI states the limitation; no claim of physical-locality proof.
Downstream component strips or lowers provenance	fixture with parent descriptor and derived output	validation failure	Schema/conformance gate refuses the output.
Whisper, Semantic Index, or generic workflow translation consumes an inference-derived result	source descriptor plus translator ownership map	identical descriptor or canonical conservative join	Compatible successor/sidecar retains it; legacy carrier is not extended implicitly and no translator silently drops it.

Acceptance requires positive and negative fixtures, table-driven join tests, cache/replay tests, redaction tests, cross-layer no-drop tests, and retained multi-node evidence. A schema alone is not runtime acceptance.

For the ordinary Agent controller path, the compatible migration uses an immutable agent.controller-execution-provenance.v1 fact. It binds the exact Agent binding, controller step, external request, retained product ref and digest, and the provider-neutral realized descriptor. The controller execution value carries that fact only between daemon strata; agent.step-trace.v1 references the durable fact and agent.outcome.v2 names its generic execution-binding/ref. Neither the step nor the outcome reconstructs execution characteristics from a runtime name, transport, model snapshot, or product ref. Recovery must validate the fact against both the exact external-runtime V2 commit and the controller step before repairing a missing trace or outcome, and must reject substitution, stripping, or a conflicting replay.

Trade-offs

Decision	Benefit	Cost or constraint
Use a horizontal value rather than provider-specific flags	One contract composes across Inquirium, Agent, Corpus, Room, and Assistant.	Every producer and consumer needs a compatible migration.
Separate posture from realized provenance	Prevents promises and catalog metadata from becoming false execution facts.	Consumers must reason over two related values.
Make provider refs optional and open	Supports filtering without centralizing a provider registry or leaking identities by default.	Exact-provider filters must handle withheld and unknown explicitly.
Require evidence basis	Prevents signed reports from masquerading as host observation.	Descriptors and acceptance fixtures are larger.
Use conservative joins	Known exposure and uncertainty survive aggregation.	A derived result may remain mixed or unknown even after a local transform.
Define locality relative to a versioned boundary	Avoids equating hostnames and transports with trust or locality.	Cross-node consumers must interpret sender-relative assertions carefully.
Preserve provenance through cache and replay	Historical results retain the conditions under which they were produced.	Cache keys and stored artifacts need versioned migration.
Keep public term neutral	Supports transparent policy without morally ranking remote execution.	Implementers lose the shorthand of conventional taint APIs in public schemas.

Alternatives Considered

One remote: true|false field

Rejected. It cannot distinguish permission from realized execution, unknown from local, mixed ancestry, provider redaction, or evidence basis. It also invites transport-based inference.

Reuse classification labels

Rejected. Classification governs allowed information flow. Processing locality and provider origin are independent characteristics. Mixing them would distort the classification lattice and make local execution appear to declassify data.

Reuse human/model origin

Rejected. A contribution may be model-generated both locally and remotely. Origin class and execution provenance must compose.

Keep the fact only in local traces

Rejected. Local traces support audit but do not give higher-level consumers a portable typed value to preserve, filter, or present. P086 may be disabled and is not a domain carrier.

Infer locality from runtime, provider, or transport names

Rejected. A local adapter can invoke a remote provider, names can be misleading, and catalog state can change after a result is cached or federated.

Make provider identity mandatory and public

Rejected. Exact identity may expose private infrastructure or provider account relationships and is unnecessary for every policy. The material locality fact and disclosure completeness remain mandatory even when identity is withheld.

Put one permanent locality attribute on a Room participant

Rejected. A participant may change runtime per task or turn. A scoped posture and per-contribution realized provenance preserve the temporal fact without changing identity or membership authority.

Failure Modes and Mitigations

Failure	Mitigation
Local sidecar is mislabeled local although it calls an external API	Derive locality from the admitted processing boundary and profile, not adapter transport.
Offer or profile declaration is copied as realized fact	Require host-produced post-dispatch descriptor and validate it independently against posture.
Missing field is interpreted as local	Migration maps absence to explicit unknown; local requires positive evidence.
Adapter reports itself local and overwrites host evidence	Host owns the descriptor; lower-layer reports can only add scoped evidence and cannot weaken host-known facts.
Provider redaction removes the non-local marker	Projection tests require locality and egress to survive detail redaction.
A peer signature is treated as physical-locality proof	Preserve peer-attested basis and sender-relative boundary ref.
Classification and provenance become one policy lattice	Separate schema families, pure functions, error vocabularies, and conformance fixtures.
Provider/session/account data leaks into Room or Corpus	Permit only open provider refs and policy projections; forbid endpoints, credentials, provider request ids, and session refs in generic contracts.
Join drops one parent or allows a local transform to erase ancestry	Canonical pure join, bounded parent refs, no-drop fixtures, and deterministic aggregate digest.
Provider set or lineage grows without bound	Bounded deduplicated sets, stable ordering, content-addressed aggregate refs, and explicit truncation/completeness markers.
Cache or replay recomputes current catalog metadata	Bind the immutable original descriptor to the cached result and return it unchanged on exact replay.
Conflicting evidence is resolved optimistically	Preserve conflict/incompleteness, choose the conservative summary, and route to local deny/warn/allow policy.
Hidden provider cascade defeats the claim	State the threat-model limit, retain evidence basis, allow stricter profiles, and never market the descriptor as remote attestation.
Provenance grants trust, membership, or effect authority	Validate it only as a characteristic; all existing capability, Room, Corpus, and effect admissions remain separate.
Closed offer vocabulary forces every domain into one profile taxonomy	Keep shared posture small and namespaced characteristics open; let communities define additional criteria.
UI shows only preflight consent and hides the actual route	Require both preflight posture and post-result realized provenance projections.

Resolved Design Questions

The following decisions were accepted on 2026-09-04 without recorded dissent:

1. Node ships two non-normative boundary examples: one exact infrastructure host and one explicitly enumerated operator-controlled host set. “Local” in the default profile means the exact infrastructure host. LAN membership, hostname similarity, co-location, or transport never establishes locality.
2. Provider refs use the open convention inference-provider:<namespace>[:<name>]. A versioned, admitted, digest-bound local registry supplies display metadata and aliases without becoming global naming authority or storing endpoints, accounts, sessions, auth, or secrets. Operator tooling should make the common path a guided selection or simple configuration value. It may accept a URI or DID only through an explicit confirmation step and should help derive, preview, validate, and optionally install the resulting provider ref.
3. unknown never satisfies local-only. Protected-data egress, effects, settlement, automatic publication, and other high-impact paths deny or quarantine it. An explicitly configured ordinary deliberation profile may admit it with a visible warning. Storage and joins preserve unknown; they do not erase the result.
4. Cryptographic workload attestation is a later optional evidence class after honest-reporting V1. It becomes useful when a profile requires a verifier to bind runtime, model, boundary, and invocation measurements across an operator boundary. It supplements host observation and cannot optimistically upgrade adapter or peer assertions.
5. Compatibility follows the inventory-backed hybrid rule above. Interpreted result contracts receive major successors; opaque transport, artifact, cache, and replay carriers use content-bound immutable sidecars/refs. Legacy absence becomes unknown, and operator or power-user surfaces must make the distinction and remediation path understandable.

Conditional Semantic Index carrier (2026-09-25)

The operator made the Semantic Index carrier conditional. Solution 022 is still planned, and no Node crate, ledger row, or durable embedding row exists, so P090 has nothing to migrate or gate there. Requiring that carrier would make P090 completion, and with it the alpha-node completeness blocker, depend on building a component outside P090's scope.

The requirement itself is unchanged and moves to the moment the owner appears: the first durable Semantic Index embedding row schema must bind a content-bound provenance descriptor or ref instead of introducing a provenance-free row. Until a Node implementation of Solution 022 exists, Node's translator inventory records the carrier as deferred, with this decision and its condition cited. A deferred entry carries no sources, tests, or verifications, is skipped by --promote, and can never satisfy a scoped --require claim. When an implementation lands, the entry returns to planned and becomes part of P090 completeness again. This decision does not defer any other carrier.

Implementation Tracker

Status values: todo, in-progress, partial, done, deferred.

ID	Work item	Depends on	Status	Done criteria / evidence
P090-001	Complete the initial cross-layer semantic audit and distinguish posture, realized provenance, evidence, classification, origin, and authority.	—	done	This proposal's Context, Decisions 1–12, ownership table, scenarios, and acceptance matrix identify the semantic gap without claiming a complete carrier inventory or implementation.
P090-001a	Inventory existing inference-derived translators and carriers and draft their compatibility migration plan.	P090-001	done	The repository-evidenced carrier inventory above covers every current Inquirium/Agent operation, Whisper redaction preparation, the planned first Semantic Index embedding row, generic workflow/JSON-e/Flow paths, and higher-layer response, offer, Room, Corpus, Assistant, cache, replay, artifact, and procurement carriers. Each owner is assigned a compatible major successor or an immutable sidecar/ref; no V1 carrier is silently extended.
P090-002	Review and accept the horizontal semantic contract and threat model.	P090-001, P090-001a	done	The 2026-09-04 resolution above records acceptance without dissent of the host-local and operator-controlled boundary examples, open provider-ref convention and registry UX, risk-tiered unknown, deferred optional attestation, and hybrid compatibility rule. Decisions 1–12 freeze boundary-relative locality, dispatch, egress, evidence, selective disclosure, join, hidden-cascade limits, and inline-plus-digest/ref-above-threshold identity semantics.
P090-003	Define separate canonical inference-execution-posture.v1 and inference-execution-provenance.v1 contracts in a pure inference-provenance-core, plus comparison/join/projection rules, error vocabulary, and Schema Gate corpus.	P090-002	done	inference-provenance-core binds posture and realized provenance to exact subjects and processing boundaries, conservatively migrates the complete legacy locality/trust matrix, and owns domain-separated JcsV1 source and projection identities. One inference-provenance-common.v1 schema owns the shared ref, digest, provider, disclosure, evidence, and extension vocabulary; posture requirements deliberately exclude observation-only unknown and derived bases. The canonical 16 KiB inline and 64 KiB descriptor limits, content-addressed external form, bounded lineage, hidden uncertainty components, and provider-neutral error vocabulary are mirrored in both schemas and Schema Gate. Exhaustive tables cover all 25 locality, 9 dispatch, 16 egress, and 16 provider-disclosure pairs; unit and property tests cover identity, permutation, associativity, idempotence, replay, redaction, missing ancestry, no-downgrade, and unrelated-boundary policy. Positive, schema-negative, and semantic-negative fixtures are synchronized into Node; every schema conditional has a non-empty local discriminator requirement, and a mechanical test refuses copied common definitions. Mechanical dependency tests protect the pure core and the five currently inventoried semantic consumers; adding another consumer requires extending that explicit inventory and guard. Generated schema docs, full Orbidocs schema validation, crate tests, full Schema Gate tests, and Clippy with warnings denied pass. No provider-specific enum enters the shared core.
P090-003a	Add the admitted provider-ref registry and guided operator configuration surface.	P090-003	done	The canonical inference-provider-registry.v1 contract and pure registry own bounded refs, aliases, display metadata, disclosure defaults, generation and JCS identity. The shared daemon configuration service validates raw JSON before set normalization, resolves exact admitted names, previews URI/DID-derived refs without fetching or retaining the source identifier, and atomically installs only the confirmed preview against the current registry digest under a nonblocking lock. The offline CLI accepts hand-authored drafts, lists/resolves entries and requires typing yes; Node UI lists exact refs for configuration and has separate preview and initially unchecked confirmation forms. Tests cover canonical fixture/Rust identity agreement, malformed inputs, collisions, stale previews, duplicate raw aliases, concurrent writes, CLI process restart, escaped UI output, and the real authenticated daemon HTTP path. This installs display vocabulary, not runtime routing or inference authority.
P090-004	Bind Inquirium pre-execution posture and produce realized provenance for every inference-derived result and post-dispatch terminal outcome.	P090-003	partial	inquirium-core owns an exact response-bound inquirium.result-provenance.v1 sidecar, and inquirium-host has pure conservative posture and result-binding functions. Daemon configuration now admits explicit provider-neutral execution characteristics independently of transport and catalog posture, validates their runtime and registered provider refs at startup, and defaults missing characteristics to explicit unknown. Successful direct generate, embed, classify, rerank, summarize, transform, image-generate, and image-edit executions commit exact response-bound sidecars into their durable metadata traces before returning V1 success; a typed pre-I/O generate refusal is represented as not-dispatched, not-applicable, and no egress. The Agent-passage generate V2 response remains schema-gated and replay preserves its descriptor. LocalityMode and TrustMode Rust defaults are Unknown, while malformed current catalog entries missing required fields still fail deserialization. P090-004a now adds bound generate/embed results, sanitized failed/ambiguous terminals, the compatible shared V2 envelope, generate-backed translation and current embedding cache restart. P090-004b1 and P080-044/045 provide explicit V2 response selection, and P090-004b2 closes the scoped ordinary text-controller recovery matrix. P090-004b3/004b4 now close bounded batch/training source commits and image/artifact publication recovery. P090-004c closes terminal/refusal and sink-recovery coverage for the ten currently admitted operations, with a common same-run proof gate. Additional producer profiles and general effect carriage remain open; this scoped closeout does not promote the complete P090 inventory.
P090-005	Bind External Agent Runtime posture and make its products and terminal outcomes produce the same provider-neutral provenance.	P090-003, provider-neutral P089 runtime contract	done	The host layer derives posture only from an explicit host-owned context, not transport. V2 product and terminal-outcome contracts bind exact canonical V1 bytes. The daemon durably writes their V2 commit sidecar before V1 compatibility, recovers an interrupted V2-first bundle without duplicate charging or driver I/O, records not-dispatched plus not-applicable locality and none egress after a host-local pre-turn refusal with zero turn-driver calls, records ambiguous dispatch only after an uncertain dispatch boundary, and leaves the generic fake at unknown. The Codex composition root explicitly admits non-local plus occurred egress with provider identity withheld; neither stdio nor provider-specific session/account data enters the generic contract. Three-host Story acceptance now retains a real Codex-backed descriptor through its ordinary Agent controller sidecar. The 2026-09-06 generic disclosure matrix closes conformance for complete, partial, withheld and unknown identities in both completed and cancelled execution: posture, product and terminal descriptors retain exact provider refs and non-local/egress facts, and restart under a fresh unknown characteristic preserves the entire V2 commit without driver I/O, extra facts or duplicate charging.
P090-006	Expose scoped posture and propagate/join realized provenance through Orbiplex Agent products, passages, lineage, and AgentOutcome.	P090-004, P090-005	partial	agent-core owns compatible V2 passage product, successful invoke response, terminal selection, passage trace, and outcome contracts. The host distinguishes current execution from inherited Agent products, requires exact parent refs for a complete join, preserves explicit incomplete ancestry as unknown, and refuses substitution or stripping. Memarium facts write stronger V2 values first, repair V1 compatibility projections after interruption, and replay a four-passage Inquirium chain without reinvocation or duplicate charging. An ordinary External Agent Runtime action writes agent.controller-execution-provenance.v1 before its controller step/trace, deterministically rebinds the external product descriptor to the retained Agent artifact, exposes the sidecar ref as trace evidence, and emits agent.outcome.v2; dirty recovery recomputes the exact bridge and appends nothing. Real three-host Story-012 run federation-run:story-012-physical-three-host-three-node-codex-reviewer:20260904T160513Z then interrupted and resumed the Codex Reviewer Agent and retained the exact final sidecar ref agent-controller-execution-provenance:agent:story-012-reviewer:11 in its passing Story report. Operator inspection now reuses a pure five-axis scope matcher and checks runtime/profile catalog and registry fingerprints with half-open validity; a real HTTP regression proves missing, matched and wrong-generation outcomes. P090-004a adds independently scoped optional Agent/external-runtime policy preflight before new I/O, rechecks current fingerprints and preserves durable replay after policy change. Inquirium passages consume the received bound result rather than reconstructing evidence. P090-004b2/004b2a now cover the ordinary text-controller journal; P090-007b and P090-009b/c cover finalized Assistant and signed Corpus publication/receiving paths. Guided policy UX, general parent/effect joins and broader Room/remote projections remain open.
P090-006a	Gate every inventoried Inquirium/Agent result translator and higher-layer carrier against metadata loss or downgrade.	P090-003, P090-004, P090-006	partial	Schema Gate refuses stripped provenance across the representative Inquirium result sidecar, Agent/external-runtime V2 product, invoke-response, selection, trace, controller-execution sidecar, and outcome chain. Durable partial-write and restart tests cover the representative generate passage, external-runtime terminal commit, pre-turn refusal, and ordinary-controller bridge through terminal Agent outcome. Story-012 now binds each external Reviewer evidence check to the exact observed controller step, permits a later status projection without confusing value with observation time, rejects an older unrelated sidecar, and retains the final sidecar ref in its report. Node owns a 27-entry inventory with source/test pointers plus operation-enum and translator discovery across Inquirium Rust modules. Its reusable named verification sets use bounded argument vectors rather than a shell; CI executes the deduplicated checks for every done or partial entry, and --require/--promote run the selected checks after refusing unfinished or unlisted claims. P090-004a adds operation-specific checks for bound results, terminal translation, current embedding cache/restart, invocation preflight and the daemon Agent passage. The current embedding-cache row is done; other carrier rows retain honest partial status. P090-012a adds a promotable scoped durable-consumption aggregate, including real supervised role/WSS-AD/Arca and controller/Assistant sink matrices. This proves only the named checks, not runtime completion of remaining rows. Completion still requires the full P090-001a inventory: every operation, aggregate, cache/deferred/artifact replay, Assistant, Corpus, Room, offer, and procurement translator plus promotion-time inventory enforcement. The Semantic Index carrier is deferred under the 2026-09-25 decision and rejoins this requirement when a Node implementation exists; promotion skips it and never counts it as done.
P090-007	Add Assistant preflight and post-result disclosure.	P090-004, P090-003	partial	Current checkpoint implements authenticated preview/execute, independent sensitive-input acknowledgement, V2 response/refusal carriage, transcript-owned exact sidecars, restart replay without producer I/O, and UI/feed projection; P090-007a/007b and P090-012a close the inline synchronous text and finalized publication gate. Broader provider-disclosure variants and external resolution remain outside that scoped evidence. Acceptance target: before every admitted non-local inference I/O, UI shows posture bound to the exact context and profile generation; acknowledgement remains a separate gate required according to local classification/context policy. Response, transcript, trace, activity feed, and UI then show realized locality/egress and conservative unknown; route changes remain visible.
P090-008	Add open inference posture to service offers and Shared Offer Catalog filtering.	P090-003	done	Current checkpoint admits the optional signed policy_annotations.inference/posture characteristic with exact owner/offer/generation binding, retains it in Rust and Python catalog snapshots, and adds a pure receiving-policy contract/evaluator. Bounded host-evaluated filtering now covers Shared Offer Catalog, topic-query links and Arca local/observed projections before pagination; P090-008b freezes exact signed selection through paid dispatch and restart. The 2026-09-06 four-state disclosure matrix closes the declaration/catalog scope: complete, partial, withheld and unknown values survive signed admission, immutable revision retention and Rust/Python projections. Sixteen schema-gated receiving-policy cases cover provider allow-list checks under deny/warn/allow and known-denial precedence; valid resealed substitutions without a new offer signature refuse. Realized result carriage and remote resolution remain P090-008a. Acceptance target: signed offers carry the separate posture contract with assertion owner, exact scope/generation, processing-boundary ref, open provider characteristics, and disclosure state. Catalog queries support locality, provider allow/deny, explicit boundary matching, and unknown policy; corpus/model-class is compatibility-only and no closed domain-profile repertoire is introduced.
P090-008a	Carry realized provenance through the generic remote-procurement result path.	P090-003, P090-008	partial	Current receiver checkpoint adds a content-bound V2 wrapper, all-boundary Schema Gate, authenticated buyer AD admission, optional buyer result-policy assessment, durable carrier/trace retention and replay/restart regression. Arca retains exact artifact bytes. New remote purchases freeze scoped offer posture at host selection time; receiving comparison preserves peer-attested strength and fails before closeout on missing, non-local or unrelated evidence. Paid replay/restart regression proves independence from later catalog generations. Dator now durably binds the unchanged role source before normalization and final result bytes before AD delivery; bounded retries and database restart reuse frozen identity/profile without executing the role again. Authenticated Python-to-daemon preparation is tested with deterministic role and AD doubles. P090-008c now passes real supervised role/schema admission, explicit AD allowlists and WSS delivery to Arca after restart, with exact bytes and one paid release. External descriptor resolution remains pending; this row is not done. A compatible service-order.result revision or immutable sidecar ref binds the producer descriptor without extending V1 in place; Dator stamps or preserves the producer value, Artifact Delivery carries it opaquely with its own source/digest evidence, and Arca verifies, preserves, and applies buyer policy without reinterpreting sender-relative locality. Missing, stripped, substituted, unrelated-boundary, and replay cases have negative fixtures.
P090-009	Make Corpus validate offer posture against delivered provenance and preserve it in outputs.	P090-006, P090-008, P090-008a	partial	P090-009a/b/c close the inline draft, signed publication, AD receiving-policy and frozen-offer comparison paths with durable replay. General contribution-to-synthesis aggregation and remote descriptor resolution remain separate work; signed publication of admitted Agent ancestry does not prove that every Room contribution was consumed.
P090-010	Add Room scoped posture, per-contribution provenance, read-model aggregates, and policy/UI projection.	P090-006, P090-003	partial	P090-010a closes contribution carriage, independent receiving policy and sender-relative badges. P090-010b adds subject-owned signed declarations, bounded validity and monotone generation, durable recovery and separate declared/observed UI. Delegated runtime-binding issuers and additional captured-product/carrier profiles remain open; identity, membership and authority are unchanged.
P090-011	Add federated projection and verification semantics.	P090-003, P090-010	partial	P090-011a implements signed minimal inline Room projection with subject-key verification, source identity, sender-relative locality/egress and incomplete disclosure preserved. P090-012c verifies mutation, stripping and restart through local WSS. Additional adapters and delegated issuer profiles require separate qualification; unresolved external descriptors remain refused. Peer authenticity never becomes receiver-observed execution.
P090-012	Retain end-to-end multi-node acceptance and synchronize evidence-backed documentation.	P090-004 through P090-011	partial	The bounded Codex-over-stdio producer-to-Agent slice is retained on three distinct physical hosts. Fresh run federation-run:story-012-physical-three-host-three-node-codex-reviewer:20260904T154427Z and restarted run federation-run:story-012-physical-three-host-three-node-codex-reviewer:20260904T160513Z both pass all ten Story assertions, exact DNS effects, post-effect revalidation, complete traces, cleanup, and the exact profile-defined three-host claim. The fresh run's aggregate and Story-report SHA-256 values are 5512af53ccd2376e723197ffe5762fd50bf186b2aaf3dcc0cd63be6112e6a861 and 574426784b9762df4e8530dd5c9565614b46633c0d558e45fe734e4bb4b8858a; the restarted run's corresponding values are 12848bc6cf487100cf29cfbe3eb2f8d29b1aeee731ca4207794b6b49a6089a4c and 25ae2c316f596a87e822df9a50ce28081eee724a511286d97cc161ad73aaa4ee, and its report retains the final controller sidecar ref. Completion still requires the full matrix: local MLX/llama, OpenAI via local sidecar, mixed join, cache/replay, redaction, Assistant warning, Corpus filtering, Room aggregation, peer projection, stripping refusal, and hidden-cascade limitation, with all owning documents and ledgers synchronized.

Workflow and Whisper translator slice

Reconcile historical inventory notes before extending the remaining translators. P090-004c already closes admitted producer refusals; P090-006b/006c/009d already close the scoped controller input and synthesis joins. Their generalized parent rows remain partial, but those checkpoints are not outstanding blockers.

ID	Work item	Status	Completion gate
P090-006d	Preserve host-owned result ancestry outside Workflow/JSON-e/Flow values.	in-progress	A content-bound immutable sidecar survives projection, call failure and retained-result replay. Host adapters supply evidence independently of template values. Unknown calls remain incomplete; the parent budget refuses before further I/O. Canonical join remains in inference-provenance-core.
P090-006d1	Recover exact committed Flow call sources before aggregation.	done	Host-scoped recovery key pins exact configuration/input/evidence and clock. Conditional intent precedes dispatch; source commit precedes verification/join. Restart reuses committed sources, rechecks admission before new effects, and fences unresolved dispatch. The five-command generic-workflow gate passed on 2026-09-21: partial writes, mixed/unknown parents, substitution/stripping, source retained on aggregate overflow, concurrent claims, no repeat inference/charge/publication and real local HTTP restart. Does not close deferred continuation, decision-authority adapters or the all-port parent task.
P090-006e	Carry redaction ancestry through Whisper preparation and retained drafts.	in-progress	Opt-in observed preparation verifies the exact wrapper and commits the private draft/result pair atomically, fences the whole source snapshot, bounds retention and verifies SQLite reopen. Manual writes clear the source association. Private sync seals the retained wrapper under a descriptor-addressed key; deterministic replay verifies exact payload and key reuse. Determinism of the transformer does not prove inference-free inputs. Actual Sensorium source admission, terminal recovery and full Memarium transport/recovery qualification remain open.
P090-012d	Gate the Workflow/Whisper carriers.	in-progress	The five-command inventory set covers mutation, stripping, missing parents, mixed sources, failure, bounds, SQLite reopen and real local daemon HTTP extraction. Remaining current-port and deferred/publication cases must be added before promotion. Retained-result replay is not workflow redispatch or recovery of arbitrary external effects.

Operator scope decision (2026-09-20): cover all currently available Flow capabilities, not only a small admitted redaction or Inquirium profile. The shared collector already reserves evidence independently of values for every call/decision. Typed extraction covers direct Inquirium, nested Flow and Agent passage/controller sources; unintegrated ports remain explicitly unknown. This is an implementation checkpoint, not permission to mark the generic translator complete while known source metadata still awaits an adapter. The workflow.step.completed.publish adapter now atomically retains the exact request and host-owned sidecar under the dispatch key, with a minimal read projection and restart regression. Nested dispatch carries exact input evidence outside template values. The prospective collector checks both parent count and inline composition limits before further calls; a larger received proof still refuses binding rather than dropping or weakening prior evidence. The P090-006d1 checkpoint adds a separate, bounded host-owned source journal before aggregation. It preserves the source when the aggregate cannot fit; it does not promise that an oversized aggregate becomes representable.

Recovery decision (2026-09-21): an explicit recovery key is scoped by caller and Flow identity, with immutable configuration/input/evidence binding and clock. A committed source is replayable; an unresolved intent is not permission to dispatch again. Current authority applies before new effects. A retained decision verdict cannot become current authority, so decision-offer recovery requires a dedicated adapter. Deferred observations remain deferred. Private source retention conveys no export authority and is not an exactly-once claim for arbitrary effects. Node owns the mechanism and executable matrix in docs/integration/middleware/MIDDLEWARE-RESULT-PROVENANCE.md.

Review checkpoint (2026-09-21): Node review 282 hardened malformed publication readback and safe recovery diagnostics, and qualified exact replay at the fixed Whisper journal capacity. Capacity and time retention remain independent; diagnostics do not authorize redispatch or expose private provider errors. Disposition and executable evidence are recorded in node:docs/evidence/inference-provenance/P090-WORKFLOW-WHISPER-REVIEW-282.md. This does not promote the still-open translator parent rows.

Whisper now pins draft provenance by an explicit journal association, cleared even by an identical manual write. Its product sync seals the retained wrapper into a separate Personal fact keyed by descriptor identity. Deterministic tests cover reopen, exact payload/key reuse and refusal before any host I/O; complete Memarium transport/recovery acceptance remains open.

The remaining work includes other publication/source adapters, broader source resolvers, deferred continuation and terminal/restart matrices. The current private append-only result journal and Whisper projection do not claim a complete temporal migration of the older intake store.

Room disclosure slice (2026-09-20)

This checkpoint reuses P090-006b/006c/009d; it does not reopen their supplied-input or synthesis implementation. A participant declaration is a signed control message, separate from a contribution and from membership. The first profile requires the Room subject itself to name the signing did:key; delegated assertion issuers need a separately admitted authority contract. The existing invite-message operator API carries the declaration, with exact Room/subject, generation and bounded validity. It grants no execution or publication authority.

New signed inference messages use an explicit V4 carrier. Its signature binds the message coordinates and the minimally disclosed declaration or contribution. Receiver verification establishes only peer-attested authenticity, never receiver-local execution or independent verification of sender claims. Durable observations retain the signed value; replay binds the entire assertion, not only contribution text. Old V2/V3 traffic remains distinguishable and cannot impersonate a signed V4 replay. Unresolved external descriptors remain refused.

V4 is a per-message authenticity contract, not sticky sender-version negotiation: a later message from the same subject may still use V2/V3. V3 contribution evidence remains transport-bound and cannot become a signed posture declaration. The current Corpus receiving policy evaluates descriptor characteristics, not a minimum carrier/signature version, so the same contribution characteristics can receive the same admission decision in V3 and V4. That decision admits content, not membership, execution, publication grants or host-observed evidence. Stripping a V4 assertion cannot pass as an exact signed replay, but requiring signatures on all future messages would need an explicit receiver policy and compatibility contract; it is not claimed by this profile.

ID	Work item	Depends on	Status	Done criteria / evidence
P090-010b	Signed scoped participant declarations and separate declared/observed Room view.	P090-010a	done	Exact subject/Room binding, monotone declaration generation, half-open validity, durable replay and UI separation; expired or missing declarations never imply local execution.
P090-011a	Signed minimally disclosed inline Room federation projection.	P090-010b	done	Sender-owned signature and receiver verification bind exact message and projection; withheld providers, non-local/mixed/unknown and sender boundaries survive without membership or evidence-strength promotion.
P090-012c	Shared Room disclosure regression gate.	P090-010b, P090-011a	done	The six-command Node gate check-inference-provenance-inventory.py --verify room passes; schema, core, daemon and UI checks cover mutation, stripping, replay, receiver restart, expiry and independent receiving policy. Local deterministic/WSS evidence is distinct from fresh physical-host acceptance.

Active result-lifecycle slice (2026-09-05)

ID	Work item	Depends on	Status	Done criteria / evidence
P090-004a	Carry scoped generate/embed execution results through response projection, translation, cache/restart and Agent invocation preflight.	P090-003a, current P090-004 and P090-006 foundations	done	Runtime-owned dispatch facts travel with their exact result; the compatible shared inquirium.response.v2 envelope preserves operation-specific V1 payloads. Generate-backed summarize/transform retains inference parents and rebinds failure operation identity. Embedding cache separates historical execution/usage from retrieval/charge and refuses corrupt bound entries. The operation-specific inventory gate passes terminal dispatch-state tests, actual HTTP translation/trace checks, scoped Agent/external-runtime preflight and session-free refusal, L1/reopened-SQLite corruption negatives, and a four-passage daemon restart with exact non-local/withheld ancestry and no duplicate Agent charge. This is local deterministic evidence, not a new physical Story-012 run. Parent P090-004/006/006a remain partial for all-operation/public/consumer coverage.

The shared response envelope is a carriage contract, not a universal output ontology: the operation owner still validates the enclosed result. This reuses the exact-result sidecar and canonical join instead of copying provenance semantics into each translator. Legacy response-only cache entries remain in their existing namespace and are not upgraded into stronger evidence.

Producer-to-consumer implementation passage (2026-09-05)

The following ordered checkpoints implement the operator-approved next passage. Each checkpoint requires implementation review, refusal/replay tests, executable inventory evidence and documentation synchronization before completion. They do not replace the parent completion criteria or claim new physical acceptance.

ID	Work item	Status	Completion gate
P090-004b	Complete producer terminal coverage, public V2 selection, ordinary Inquirium Agent carriage, batch/training and artifact/deferred preservation.	done	Closed for the ten currently admitted operations and existing producer profiles by P090-004b1/004b2/004b2a/004b3/004b4 plus the P090-004c terminal gate. Exact source evidence, ordinary text-controller accounting and artifact publication remain separate durable transitions; replay never reexecutes or charges twice. Existing V1 success projections remain available, while explicit V2 never silently falls back. The final local gate covers refusal, received/ambiguous failure, sinks and recovery; generalized profiles/effect joins remain in P090-004/006, not this scoped aggregate.
P090-007a	Implement Assistant preflight disclosure and realized result carriage through response, transcript, trace and UI.	done	Exact authenticated preview/execute, independent sensitive-input acknowledgement, under-lock revalidation, V2 success/refusal and transcript-owned replay are implemented. A durable keyed attempt fence precedes model I/O and refuses automatic redispatch after uncertain completion, including after restart; it is not a rebuildable index. Metadata-only preflight refusals do not invent execution. HTTP, UI/feed and executable inventory cover this inline consumer path. Finalized synchronous-text repair is now covered separately by P090-007b; physical acceptance is not claimed.
P090-009a	Implement offer/catalog posture, generic procurement carriage and Corpus result validation in dependency order.	done	Shared host policy filters before pagination; selected declarations and actual evidence remain distinct. Generic result V2 and Corpus signed V2 enforce buyer policy and frozen offer comparison before accountable closeout/admission, retaining exact evidence through restart. P090-008c now supplies real supervised role/WSS-AD/Arca deployment proof for inline text. External descriptor resolution remains broader P090-008a work and is not certified by this checkpoint.
P090-010a	Preserve Room contribution provenance and derive participant read models.	done	Explicit V3 content-bound contribution evidence, minimal disclosure, four-boundary Schema Gate, WSS delivery/exact replay, evidence-aware sequence recovery and durable observation restart are implemented. Agent effects attach explicitly referenced owned durable sources, retaining incomplete ancestry instead of guessing. Independent receiving policy and bounded sender-relative participant badges preserve unknown and peer-attested strength; readiness frames do not count as inference. Scoped declarations and general federation projection remain P090-010/011; no new physical passage is claimed.
P090-009b	Sign provenance-bearing Corpus answer/publication V2 and persist it with the legacy view.	done	Exact answer, admitted draft lineage and publisher policy assessment share one signed envelope and one durable round transition. Shared V1 signature verification and all-four-boundary Schema Gate reject signature/content/sidecar substitution. The local daemon process passage covers V1 and explicit V2 publication, restart without the product, exact replay after a stricter policy change, and refusal of a new publication under that policy. Historical publications are not enriched. This is deterministic local acceptance, not physical federation evidence.
P090-009c	Apply the receiving Corpus policy to both procurement answers and local Agent publications.	done	Local publication and receiving-host policies are independent of signed producer assertions. Bid admission freezes the catalog-admitted declaration before ranking; named unresolved sources refuse, and later offer expiry or removal cannot invalidate the retained commitment; known violations override incomplete evidence and peer claims remain peer-attested. AD preserves the signed V2 within a 128 KiB materialization budget. Forty-nine Corpus host tests pass in the 2026-09-06 review, including receiving-daemon restart after stricter policy, exact replay and stripping refusal. Evaluation is durably recorded before refusal or admission. Existing candidate discovery remains bounded at 256, not an exhaustive catalog claim; no new physical federation acceptance is asserted.

V2 publication implementation decision (2026-09-06): use an outer corpus-reasoning-answer.v2 envelope around the unchanged signed V1 answer, with content-bound provenance and its own domain-separated signature. The outer signature binds the complete inner answer and evidence; an unsigned neighboring sidecar is insufficient. The receiving host still authenticates the accountable responder independently. New Agent publication consumes the previously admitted draft evidence, not current model configuration. Historical V1 publication remains V1 and is not retroactively enriched. Representation and receiving policy are explicit inputs, never inferred from topology or provider identity. The publication assessment exports only the exact policy digest and decision, not private provider allow/deny sets. Its signature makes the publisher accountable for the assertion; it cannot authorize consumption on another host. Full policy values remain in the publisher's durable local evidence. Receiving policy is independently configured and evaluated before admission or settlement.

Producer subcheckpoints keep the remaining durable work explicit:

Consumer review checkpoint (2026-09-06): historical Assistant V1 results retain principal/session/key-only replay without fabricated provenance; explicit V2 selection refuses unavailable historical evidence. Modern replay requires the exact request binding and sidecar together. A source-log-backed index replaces the fixed history ceiling; bounded catch-up commits progress, unknown unrelated record families are excluded before parsing, and owned corruption or excision still refuses. New preview/execute requests require an explicit turn id, and durable disclosure traces retain token bindings rather than credentials. Unknown and declared possible non-local execution have distinct consent wording. Direct External Runtime completion also preserves its durable producer V2 into Agent outcomes without inventing a controller step. These review corrections do not close the remaining consumer or producer tasks below. The finding-by-finding implementation record is node:docs/evidence/inference-provenance/P090-CONSUMER-REVIEW.md.

ID	Work item	Status	Completion gate
P090-004b1	Bind synchronous runtime results and select public V2 explicitly.	done	Eight-operation HTTP V1/V2 tests, malformed received-HTTP terminals, image publication/refusal ancestry, output mutation and catalog-change negatives, and fractional JSON roundtrip pass. This does not close source-artifact lineage or durable publication recovery.
P090-004b2	Preserve ordinary Inquirium Agent controller evidence through its durable source commit and recovery bridge.	done	Completed for the scoped synchronous text controller. CallInquirium requests V2 and commits its exact canonical source, step, trace and budget through Agent/Memarium. P090-004b2a covers 36 intent/commit refusal and lost-acknowledgement cases across successful and terminal results. Product-free daemon restart retains the exact Agent/Corpus outcome; absent completion remains fenced and does not authorize reinference. Batch, training and general artifact/deferred producers are outside this row.
P090-004b3	Separate batch/training execution commit from deferred status and artifact publication.	done	The 2026-09-09 immutable intent/result journal owns exact source commits; BDO is only a projection. Eighteen worker restart states cover both producers, three projection states and committed success/terminal versus ambiguous intent-only execution. Recovery works with runtime/input unavailable and never reinvokes. Local adapter tests exercise actual bounded batch execution, training success/cancellation and received HTTP 503 evidence. Owner-scoped keyset recovery drains 501 refused operations while leaving a foreign-owned operation untouched. The first batch profile composes one existing embedding invocation over immutable object/artifact leases, with a 1 MiB source budget; caller output, file/query and segmented batch profiles are not admitted. See node:docs/evidence/inference-provenance/P090-DURABLE-PRODUCERS.md; generalized producer coverage remains P090-004. H-1–H-14 review adds bounded shutdown, pending-only enqueue compensation and acknowledged recovery; six conflicting-context restart cases extend the matrix to 24 states.
P090-004b4	Retain artifact/effect sidecars and source ancestry across publication and restart.	done	The 2026-09-09 batch/training/image publication boundary verifies the immutable producer commit and destination bytes, commits a bound sidecar before descriptor visibility and replays exact publication without inference. Image replay retains exact bytes; editing joins known source-artifact ancestry and preserves absent ancestry as incomplete. Injected publication failure, seven intent/context faults, substitution, restart and repair are tested; sanitized publication refusals retain their execution parent durably. Unbound generic artifact effects refuse before other effects. Current output authority remains required. This closes the owned producer-artifact checkpoint, not general P090-006 effect joins or full P090 acceptance. H-1–H-14 review retains observed image terminals separately from failed commits, derives batch summaries only at publication and pins repeated-refusal idempotency.

P069-DOMAIN-005 is a separate workstream in this passage: optional thematic profile admission and lifecycle, not a prerequisite for provenance carriage. An exact profile revision requires receiving-host admission; endorsement cannot compel it, and general prose outcomes remain valid without such a profile. Federated projection (P090-011), remaining inventory consumers and full multi-node acceptance (P090-012) keep their independent completion gates.

Consumer implementation checkpoints preserve three independent inputs: a signed offer declaration, the delivered producer descriptor, and receiving-host policy. P090-009a first implements a shared, provider-neutral consumption-policy value and pure evaluation for locality, explicit processing-boundary matching, provider allow/deny and incomplete evidence. Catalog, Corpus and Room reuse that evaluation; policy never rewrites evidence. A known violation dominates a warning about missing evidence. The offer migration may use the existing signed policy_annotations extension as a characteristic sidecar, bound to the exact offer id, sequence and accountable signer; this does not add a V1 top-level field or change the compatibility-only meaning of corpus/model-class. Wire result carriage now uses the compatible service-order.result.v2 receiving contract: the unchanged V1 result plus mandatory provenance whose subject binds the JCS result digest and whose assertion owner is the selected provider node. The host still authenticates AD source and request/workflow correlation independently. Buyer request/output-constraints.inference/policy is an explicit terminal acceptance rule, not preflight egress authority; absence retains V1 behavior without claiming local execution. Warnings and exact carriers survive durable execution/trace replay. External refs refuse until a bounded authenticated resolver is available. The approved 2026-10-11 draft V2 amendment supplies a bounded local resolver for descriptors delivered in the same authenticated AD artifact; arbitrary external acquisition is still outside this profile. The producer checkpoint below adds the bridge across normalization. P090-008c closes the inline deployment role/AD admission gate; external descriptor resolution still keeps P090-008a partial.

The producer bridge uses an explicit service-dispatch-result.v2 wrapper for the unchanged role product and content-bound source descriptor. A bounded, data-only service.order.result.prepare host capability reuses the Rust JCS and DAG composition implementation to derive service-order.result.v2 from the final normalized V1 result. It does not authenticate the role, observe inference, persist a commit, deliver artifacts, or authorize settlement. Dator owns those source/commit boundaries; absent legacy evidence stays incomplete and unknown. The source boundary and observation time survive derivation without relabeling. Before delivery Dator freezes the result bytes and digest in its existing request-keyed durable journal. Delivery retry is bounded and generation-fenced; it cannot invoke the role again. Interrupted execution without a result commit remains ambiguous and requires reconciliation, not blind execution retry.

Portable-object decision (2026-10-11): optional execution/provenance-objects in the draft dispatch/result V2 contracts carries at most three distinct exact canonical external descriptors (signed answer, dispatch and terminal result), each above the 16 KiB inline threshold and at most 64 KiB, for at most 192 KiB total. Inline-only V2 omits the field unchanged. Reference-bearing result admission requires the matching object, verified by digest, size and full reachable-DAG semantics. The existing authenticated AD artifact binds all packet bytes; the signed synthesis binds its final carrier. Addresses grant no source-access authority and the resolver has no network or provider-CAS fallback. Publication selects disclosure before signing; packaging cannot redact, reseal or truncate it. Buyer policy assesses the resolved root, never treating an external carrier's absent inline value as missing evidence. Pure preparation and durable completion keep the source DAG and packet through replay. This is a bounded contract/implementation extension, not a renewed P090-008c native claim or completed P090-008a/009 remote-resolution scope.

Native follow-up (2026-10-12): clean-source P094 run s13-1791759358-87f640 retained four actual passage manifests, products, DAG roots and corresponding charge receipts, including unchanged Solver state after restart/adoption. The final graph measured 15 nodes, 17 ordered edges and 29,047 canonical bytes. The attempt failed before repair and recipe delivery, so it adds no native portable-object admission or buyer replay claim. Its failed report and exact scope are retained in node:docs/audits/P094-2026-10-12-GUIDED-RECOVERY-FAILURE.md; P090's procurement completion boundaries remain unchanged.

Ordinary-controller recovery checkpoint: an intent fences dispatch before I/O; one atomic Memarium completion then binds the exact Inquirium source, Step, trace and budget. Recovery validates and projects this committed value without reconstructing decisions or repeating inference. P090-004b2/004b2a close the scoped synchronous-text gate with a 36-case journal matrix and separate daemon restart evidence. Intent-only and legacy source-only histories remain refused: neither contains a complete decision from which safe replay can be derived.

Corpus draft checkpoint: corpus-agent-answer-draft.v2 preserves the admitted Agent outcome, not merely its prose or legacy projection. The descriptor subject is the JCS identity of {draft, source/outcome}; the original draft identity and classification are unchanged. Derived evidence retains the parent observation time and sender processing boundary. Round ownership, source admission, Room membership and publication authority remain independently checked host facts. The V1 and V2 draft views share one existing round snapshot; evidence is checked on export and both log/checkpoint recovery. Exact replay precedes current Agent or product lookup. Historical absence is not backfilled from a live runtime. Newly accepted legacy outcomes carry explicit unknown evidence. Existing HTTP draft and answer projections remain V1, with the V2 draft exposed separately in authenticated round inspection. A separately signed V2 publication must cover the outcome and its evidence before claiming end-to-end Corpus carriage; a V1 answer signature does not authenticate the adjacent draft sidecar.

Python catalog consumers reuse the pure Rust policy through the data-only, host-local inference.policy.evaluate capability. Declared and realized inputs are distinct variants, requests bind unique subjects, and assessment grants no execution or publication authority. Catalog filtering precedes pagination, preserves the query in topic links, and refuses unavailable/over-budget evaluation. Scope: 32 subjects per request, 2 MiB per evaluation, 4096 scanned catalog rows and a 20-second assessment deadline.

Producer checkpoint: public capability POST routes select the compatible inquirium.response.v2 envelope explicitly with response-schema=inquirium.response.v2; absence retains V1. Selection changes neither execution authority nor routing. Unknown, duplicate and unavailable versions refuse before execution, with no silent downgrade. Current HTTP evidence covers generate, embed, classify, rerank, summarize, transform, image-generate and image-edit. Image publication derives its response or refusal from the content-bound runtime execution parent without consulting current configuration. Classify/rerank carry the exact runtime-bound result into traces, and invalid received classify, rerank and image HTTP responses preserve dispatched/unknown terminal evidence. Fractional embedding roundtrip tests protect canonical result identity across serialization. These checks close a producer subpiece, not P090-004b as a whole. Ordinary synchronous-text Inquirium Agent controller recovery is covered by P090-004b2/004b2a. The 2026-09-09 P090-004b3/004b4 checkpoint adds durable batch/training execution and image/artifact publication, with an executable restart/refusal gate. Generalized producer profiles, wider admission/refusal coverage and general effect joins remain separate open work.

The same-day H-1–H-14 review hardens this checkpoint: producer shutdown has a bounded drain, queue refusal compensates only unclaimed pending operations, and recovery completion is acknowledged by the worker rather than inferred from enqueue. Six additional restart cases distinguish context-binding refusal from ambiguous execution. A known image terminal survives in the typed error/V2 response when result persistence fails, without claiming durable retention or authorizing reinference. Batch summaries bind to the published artifact, and repeated publication refusals retain one exact source-named pointer. See node:docs/evidence/inference-provenance/P090-DURABLE-PRODUCERS-H-REVIEW.md; scope and whole-P090 status are unchanged.

Durable result to informed consumption and publication (2026-09-06)

Review hardening: immutable signed offer admission validates before append and distinguishes exact replay from conflicting signed bytes at the same sequence (HTTP 409), including unchanged catalog projections. Assistant completion checks keyless session excision without synthetic keys and reports bounded replay-index catch-up as retryable HTTP 503, separately from publication failure. Dator's committed-publication polling backs off to 60 seconds on idle/error passes and logs once per continuous failure episode. These corrections preserve the scoped completion criteria below; they do not close broader producer/disclosure work.

Operator-approved scope: synchronous text/prose results through the existing Inquirium and external Agent runtime paths, inline descriptors, Assistant and the offer/procurement/Corpus publication path. No new model, thematic interpreter or Sensorium capability is required. Assistant has no dependency on Corpus publication. Earlier scoped done checkpoints remain valid; the following work adds recovery and deployment guarantees rather than reopening their contracts.

ID	Work item	Status	Completion gate
P090-004b2a	Reconcile committed ordinary-controller results and interrupted step/accounting projections.	done	Done for synchronous text. A 36-case matrix crosses completed/denied/invalid/unsafe/unavailable/failed results with intent/commit write refusal and lost acknowledgement. Exact Agent, binding, actor, request, source, step and budget survive restart; contradictory source refuses, terminal artifacts are not publishable, and replay appends no new charge or fact. Intent-only and uncommitted execution remain fenced.
P090-007b	Recover Assistant post-processing and terminal-result publication.	done	Done for the finalized synchronous text path. Real HTTP restart tests cover trace, budget, turn/result projection and completion-reference failures, terminal transport failure and rejected controls. Committed plans retain exact source, response, HTTP class and charge; missing completion remains fenced with no blind redispatch. Session excision and original request authentication precede recovery. Recovery of uncommitted provider output is not claimed.
P090-008b	Bind policy-aware selection and dispatch to an exact signed offer revision.	done	Signed admission archives, dispatch and Corpus snapshots retain exact original revisions. Paid-order tests cover catalog replacement, strict unknown refusal before reservation, independent result assessment and restart. The connected deployment uses the provider participant signer and explicit unknown/warn policy, retains its signed selection through WSS result admission, and accounts for one release independently of inference. Unsigned or unavailable declaration sources gain no fabricated signature or local posture.
P090-008c	Admit and exercise the inline Dator role-to-AD-to-Arca result profile.	done	Real supervised role/P080 V2/Inquirium/Dator/WSS-AD/Arca passage passes with restart, exact bytes/digest in both result journals, one role/model invocation and one paid release. Missing/wrong runtime grants cause zero model calls. Repairs require actual AD completion rather than a deferred handle, preserve retryable admission attempts with same-key fencing, and automatically resume only committed Dator publications. This is deterministic local two-identity evidence; inbound dispatch and pending workflow are explicit fixture preconditions. External descriptor resolution and physical federation remain outside this row.
P090-008d	Resolve retained local Agent/Corpus passage descriptors without broadening source access.	in-progress	Operator-approved 2026-10-08 scope: immutable canonical bytes in the existing private object store precede owner facts; inline/reference thresholds, descriptor size, depth and node limits stay unchanged. Pure composition preserves exact ordered parents. Local resolver and Agent restart/replay regressions cover missing, substituted and noncanonical bytes, exact source/manifest binding and no repeated charge. Guided repair exposed an accidental controller inline-only guard on the passage manifest and loss of the live claim on same-process reload; the passage carrier contract and exact-input claim preservation are repaired, without restoring claims after restart or enabling controller references. Composed guided real-MLX repair remains open. No network fetch, peer fallback, generic public reference endpoint or remote procurement qualification is admitted; P090-008a remains partial.
P090-012a	Gate the scoped durable consumption/publication passage.	done	The executable durable-consumption-publication inventory claim passes the aggregate controller/Assistant failure matrices, signed selection, policy/catalog/UI, signed Corpus publication and real supervised role/Inquirium/Dator/WSS-AD/Arca restart checks. It also tests transport-independent non-local external execution, conservative absence, both receiver-policy inputs and independent Assistant behavior. Runtime calls, logical publications, admissions, inference charges and order release are checked separately. Explicit input/workflow fixture preconditions and deterministic HTTP inference bound this to local synchronous text and inline descriptors. No new Room dependency, physical passage or full-P090 completion is claimed.

Recovery means finishing an already admitted durable transition, not undoing inference or making an uncertain external call exactly-once. A missing result commit after possible execution requires explicit reconciliation/refusal. A receiver's refusal can withhold order closeout but cannot erase the cost or fact of producer execution. Persist repairable intents in the owning fact/journal plane; never infer original authorization, timestamps or evidence from current configuration. Tests and code review precede each status promotion.

Dependency graph

graph TD
    A[P090-001 initial semantic audit] --> AI[P090-001a carrier inventory and migration plan]
    AI --> B[P090-002 semantic acceptance]
    B --> C[P090-003 schema and pure join]
    C --> I[P090-004 Inquirium producer]
    C --> X[P090-005 external-runtime producer]
    I --> G[P090-006 Agent propagation]
    X --> G
    I --> T[P090-006a translator no-drop gates]
    G --> T
    I --> H[P090-007 Assistant disclosure]
    C --> O[P090-008 offer and catalog posture]
    O --> P[P090-008a procurement carriage]
    C --> P
    G --> K[P090-009 Corpus validation]
    O --> K
    P --> K
    G --> R[P090-010 Room carriage]
    C --> R
    C --> F[P090-011 federated projection]
    R --> F
    I --> Z[P090-012 end-to-end acceptance and sync]
    X --> Z
    G --> Z
    T --> Z
    H --> Z
    P --> Z
    K --> Z
    F --> Z

Current producer terminal closure (P090-004c)

The next bounded checkpoint covers the ten currently admitted operations: generate, embed, batch.embed, classify, rerank, summarize, transform, image.generate, image.edit and train.adapt. It does not admit new batch sources, trainer profiles, models or descriptor resolution. Authentication and malformed request ingress are not inference outcomes. A valid invocation refused before dispatch records proven non-dispatch; an attempted invocation with no trustworthy response retains uncertainty. Known result evidence must survive a later sink failure in the returned terminal without claiming successful persistence.

Task	Scope	Status	Completion evidence
P090-004c1	Inventory admitted operations, terminal boundaries and exclusions independently of downstream consumers.	done	inquirium-core owns the admitted-operation list; the daemon test-only conformance module owns the six-boundary vocabulary. A new operation variant fails coverage until it declares its boundaries. The daemon matrix names one proof, one stated exclusion, or one named gap for each of the sixty cells, and its audit accumulates findings instead of stopping at the first. Negative controls prove the audit refuses a dropped operation, a dropped boundary, a duplicate row, an unnamed exclusion and a renamed proof. Request-layer outcomes are recorded separately and may not be spelled like a boundary.
P090-004c2	Preserve sanitized pre-dispatch refusals without inventing execution or authority.	done	The supervisor binder covers all ten operation identities with not-dispatched/not-applicable/none, withholding private causes and preserving an existing terminal. Intrinsic shape validation precedes operational limits and admission; malformed HTTP input never mints an inference outcome. Actual selection-refusal endpoints retain exact terminal/provenance traces and stable image replay. Generate-backed summarize/transform preserve non-dispatch through relabelling. Resource-profile, current preflight, lease/grant admission and deferred worker refusal/restart tests pass. The two fully qualified constructor sites remain a structural guard, not an alias-proof authority theorem.
P090-004c3	Preserve terminal observations across partial persistence/publication failures.	done	All eight synchronous HTTP trace-sink failures preserve the exact known V2 result. Image byte/commit faults and corrupt committed-byte replay retain execution ancestry without reinference. Pre-dispatch image-edit refusal does not merge unconsumed source ancestry; unresolved post-dispatch ancestry preserves the known component and marks the aggregate incomplete. Both deferred workers commit and replay valid refusals. Preparation precedes running and dispatch intent; a pre-dispatch refusal uses one atomic refusal-intent/result pointer, so interruption before BDO projection does not invent possible dispatch. A one-byte result-object budget proves that failed source retention records a separate sanitized owner-journal fact, survives restart and leaves execution fenced; BDO diagnostic digests alone do not retain observation bytes. The 24-state source/projection recovery matrix and artifact refusal/replay proofs pass. No failure fact grants publication.
P090-004c4	Run the common producer conformance gate and synchronize component evidence.	done	The 2026-09-13 scoped promotion command --require admitted-inquirium-producers passes: sixty cells and thirty-one fully qualified named proofs, all executed in the same bounded run. The manifest refuses missing/truncated output, duplicates and wrong-owner tests; nineteen Python negative controls pass. Core (159 tests), host (74 tests), supervisor and actual HTTP/deferred/image regressions are green. All-target Clippy for core/host/daemon passes with -D warnings; canonical schema validation, mirror equality and documentation build pass. P063/P064, Solution 044, the Node ledger and readiness snapshot reflect this local checkpoint. An empty gap list alone still does not establish completion; the remaining P090 inventory is not promoted.
P090-004c5	Withhold ambient model-store authority from library-test daemons, following the existing acceptance-child and process-test isolation pattern.	done	The explicit for_test_data_dir fixture selects a test-owned model root through ordinary configuration precedence, without changing production semantics under cfg(test). The explicit-input regression covers both an operator {slot} template and an ordinary model path without accessing either; the ordinary constructor still receives the actual environment. The gate forces a nonempty environment template for this exact test, so build-time environment suppression cannot pass vacuously. Tests neither mutate the shared process environment nor give Rust template-expansion authority. Explicit model-store tests can supply isolated roots. Resolution remains in acceptance: configured_slot_path validates the single placeholder and root_from_environment refuses a conflicting supplied slot. Production runtime paths remain literal.

Review checkpoint: 2026-09-13. Statuses above describe the verified local worktree, not a released implementation or a new physical acceptance passage. P090-004c5 addresses test-infrastructure hygiene discovered during this slice, not an inference semantic requirement. Keeping its discovery reference here does not make it part of the producer contract; implementation ownership remains with the Node test harness. No row is promoted merely by documenting its criterion.

Supplied-input and synthesis checkpoint (2026-09-13)

This checkpoint tracks implementation of the adopted P090-006/006a to P090-009 sequence. An input manifest is an observation by the composing host of the exact material supplied at its execution boundary. It is not a model's declaration of attention, a citation list, or proof that all supplied material influenced the result. Source resolution and access checks precede retention and dispatch. Private input bytes remain in owner-controlled storage; metadata commitments do not grant publication or access to the underlying material.

Task	Scope	Status	Completion evidence
P090-006b	Host-owned, bounded, ordered supplied-input manifests independent of citations and evidence refs.	done	Contract, four-boundary Schema Gate, authenticated owner resolution, classification checks and exact UTF-8 materialization implemented. Current resolvers admit same-Agent controller products and classified turns in the active bound Room. Every real inference controller action retains its request/input commitment; omitted refs do not select a legacy bypass. Both adapter edges and real controller HTTP/process invocation pass the shared gate.
P090-006c	Durable input ancestry through Agent products, effects and outcomes.	done	Scoped controller manifests bind source-family execution commits and survive prefix recovery; removing the manifest refuses recovery. Exact source frames, recursive policy/redaction and missing ancestry are preserved through products, effect derivation and outcomes. The shared gate verifies committed replay without another charge and preserves intent-only refusal rather than granting redispatch. Generalized source/effect profiles remain outside this checkpoint.
P090-009d	Bind signed Corpus synthesis to its supplied contributions and synthesis execution.	done	Existing signed V2 derivation retains exact parent compositions and the private manifest commitment. Signature tampering and receiver restart after policy change pass without repeat publication. The shared producer/consumer gate is green; private manifests are not published and no new physical deliberation is claimed.
P090-012b	Executable supplied-input to signed-synthesis closure gate.	done	Node's named supplied-input-synthesis checkpoint passes all thirteen tests across five commands: missing parent, mixed/non-local, policy/redaction, both adapter edges, substitution/stripping, controller/effect recovery, signed receiver replay and actual daemon HTTP/restart. The process fixture separately bounds executable warmup without widening runtime readiness. Scoped all-target Clippy, canonical schemas and docs build pass. This closes the bounded controller checkpoint, not every P090 carrier or physical acceptance.

Cross-boundary composition must preserve the source's processing boundary. The current single-boundary join is not authority to rename a foreign descriptor's boundary or reinterpret its locality from the Chair's viewpoint. Decision (accepted 2026-09-13): retain multiple source boundaries alongside the synthesis execution. The rejected alternative was a same-boundary-only checkpoint. A bounded composition retains the exact parent descriptors, their own boundary references and the completeness assertion. Its enclosing descriptor remains relative to the composing host: a foreign inference contributes unknown locality and egress in that view, never a renamed local observation. The foreign source's known non-local or mixed observation remains available in its original frame. Receiving policy examines the retained sources too; a known provider denial must not disappear behind an unknown boundary. Redaction traverses the composition without dropping parents or strengthening their evidence. Existing single-boundary joins keep their refusal contract; the explicit composition operation is separate. Bounded depth, parent count and canonical byte limits apply before publication; overflow refuses rather than silently truncating or externalizing evidence.

Review clarification (2026-09-13): a retained manifest pins content, not future access rights. Pending continuation rechecks current Room authority separately from immutable input retrieval. Repeated product bytes require an unambiguous source occurrence (provenance/ref), not first-match selection. Room event retention measures actual serialized bytes; broker reads are minimally disclosed and bounded by their projected size. Peer assertions remain peer assertions. The owner controller sidecar is named supplied/input-manifest and is not a redactable recovery record: publish a separately projected carrier instead. Composition validation includes exact evidence derivation, and Schema Gate's semantic checks enforce total ancestry depth and size beyond JSON Schema. The Node review records individual F-01–F-16 dispositions and scoped evidence in node:docs/evidence/inference-provenance/P090-SUPPLIED-INPUT-REVIEW.md; broad P090 status is unchanged.

Next Actions

Approved follow-up: bounded provenance DAG (2026-10-08)

DAG contract decision and scoped checkpoint (2026-10-09)

inference-provenance-dag.v1 carries one explicit root/digest and the complete reachable nodes map. Each key is SHA-256/base64url of the exact JCS node bytes, including its flat sealed source assertion, ordered parent digest occurrences and optional parent-set/complete. Shared ancestors have one node; repeated edges remain repeated and ordered. A source node has no composition edges; a composition node carries an explicit complete or incomplete parent set, including the empty set. Missing information is not a local assertion.

Node addresses are distinct from assertion source/projection identifiers. A composition assertion commits its immediate source identifiers, while the node digest additionally commits the ordered edges. The outer provenance descriptor commits the entire graph and must match the root assertion in every semantic field. Only source/projection identities differ between this outer graph carrier and its flat root assertion. An authenticated outer carrier therefore binds both the summary and the exact ancestry, not just a detached graph root.

V1 graph budgets are 64 unique nodes (root included), 512 edge occurrences, 16 direct parents, depth 32 (root included) and 64 KiB of canonical graph bytes. The existing outer descriptor's 64-KiB limit also applies independently. Graph depth counts accountable source/product/effect composition nodes, not human turns; its new budget is distinct from the unchanged historical tree depth of eight. All records must be reachable. Missing/substituted nodes, detached nodes, cycles, incompatible source summaries and budget overflow refuse; no pruning, implicit acquisition or partial successful graph is admitted. Cross-boundary composition retains original frames and an unknown owner-relative summary; the ordinary single-boundary join still refuses foreign active sources.

Projection rewrites disclosed node bytes and therefore node digests and edges, but preserves source identities, ordered relations, completeness limitations and non-local/unknown facts. It has a new graph root and carrier digest; it is not the source graph under an unchanged content address. Independent receiving policy visits all retained source assertions, so a known denial cannot disappear behind an unknown aggregate. A digest or local reference grants no access.

The local owner stores and verifies the complete canonical graph-bearing descriptor as one immutable object before publishing its reference. There is no network resolver. Existing nested descriptors remain valid historical records; they are not silently converted or assigned new source identities. Joining an old nested composition into the new format requires a separately admitted migration; fresh multi-turn passages use the DAG. historical-composition-requires-migration is a typed refusal, not permission to discard ancestry or relabel it unknown. There is no implemented migration or opaque-history bridge. Operators must finish or explicitly stop active Agent chains and P094 loops using nested products before upgrading, then start new DAG work without those parents. Exact committed historical replay is unchanged; restarting does not enable a new continuation. This changes newly produced composition representation, not the semantics of an already signed carrier.

Before dispatch, Agent admits the exact deduplicated known parent closure plus a host-owned growth allowance of three nodes, 32 edges, three levels and 8 KiB. Each missing source reserves another unknown node, edge and 4 KiB; the direct parent limit permits at most 15 inputs, reserving the sixteenth slot for the execution not yet observed. The resulting graph must fit the admitted growth as well as the global budgets. An observed overrun refuses publication while retaining producer evidence, never claiming that dispatch did not happen. This bounded profile does not promise that arbitrary eight-turn content fits. Inline-only convenience helpers refuse oversized results; owner preparation returns exact bytes for retention before any fact. Profile-reserve refusal carries growth-reservation-exceeded and its axis/size details, separately from a hard dag.bytes bound failure. The inventory binds the measured canonical graph and descriptor sizes for all eight fixture passages. This calibrates the deterministic profile only, not real MLX workloads. Corpus signs the carrier after final root refresh; substituting an otherwise valid pre-refresh carrier invalidates that signature without changing ancestors.

The historical 2026-10-08 tree measurement motivated this separately approved contract slice, not truncation or higher historical budgets. Local object-store references alone solve the inline threshold, not the full tree ceilings. The earlier synthetic eight-passage all-prior-input tree composition retained 1,773 / 3,721 / 7,617 / 15,409 / 30,993 / 62,161 canonical bytes across its first six products and refuses the seventh at the ancestry budget. This is a measured contract limit, not a full real-model run or a worst-case admission proof.

Task	Status	Scope and completion evidence
P090-006f1	done	Draft inference-provenance-dag.v1 freezes exact JCS node addresses, distinct source identities, ordered edge occurrences and one reachable root. Canonical and Node schemas mirror the 64-node/512-edge/16-parent/depth-32/64-KiB graph budgets; exact closure, non-strengthening selective disclosure and typed refusals are enforced by the pure core. Historical signed tree bytes are unchanged. This is implementation, not formal contract acceptance.
P090-006f2	done	Pure composition deduplicates byte-identical ancestors without losing order, multiplicity or original source frames. Duplicate keys, cycles, detached/missing/substituted nodes and unjustified summaries refuse. The existing private owner object store verifies exact canonical bytes, size, digest and closure; an explicit resolver is installed before recovery and at Corpus's four Schema Gate boundaries. Default unresolved-reference refusal and no remote acquisition remain intact.
P090-006f3	done	Bounded controller/Flow products, effects, AgentOutcome and signed Corpus synthesis preserve the admitted graph. Inquirium's derived-result translation retains exact shared parent assertions for subsequent Agent DAG composition, rather than a summary-only join. Pre-dispatch capacity admits exact ancestry plus bounded growth, including missing-source unknown nodes; actual growth must fit too. Owners retain bytes before referencing facts. The eight-passage fixture proves V2-first partial-write repair, restart, exact product/outcome/effect replay and unchanged spending; signed Corpus recovery preserves publication once without reselecting an expired bid. Arbitrary producer profiles and historical tree migration are not implied.
P090-012e	done	bounded-provenance-dag passes six commands and 326 tests, with fifteen required crate/target/module-qualified proofs, including the Inquirium translation-to-Agent shared-parent edge. Two distinct Solver/Reviewer Agent owners execute eight deterministic passages retaining 16 nodes and 37 ordered edges; the exact inventory-bound final graph is 41,218 B and outer descriptor 44,487 B, with a largest measured passage delta of 6,358 B within the 8-KiB reserve. Pure/owner gates cover mixed/non-local/unknown, shared ancestors, redaction, substitution/missing parents, typed historical-migration and reserve refusals, the 15-input boundary, every growth axis, exact local bytes and restart without second execution, charge or publication. Signed synthesis rejects the pre-refresh root before and after restart. Agent/Corpus core suites, 31 inventory negative controls, scoped all-target Clippy, canonical schema validation and docs build pass. This is local owner/runtime evidence, not real-model, physical federation or independent HIL acceptance.

The historical nested contract remains unchanged and fail-closed. This separate DAG slice qualifies the bounded eight-passage owner/runtime profile, not every eight-turn workload, a real-model guided repair, or all of P090-006/006a.

P094 integration review (2026-10-11): the deterministic adoption process proof compares Corpus's neutral manifest reference with the exact host-retained agent.passage-input-manifest.v1 fact written before the Solver/Reviewer product. Restart and adoption replay preserve the original Solver manifest, product, graph nodes and producer charge; the fresh Reviewer's resolved graph retains those same source nodes. Recipe history now resolves only exact owner-local descriptor bytes and carries signed authority epochs and candidate adoptions separately from the immutable order origin. These are composed owner/process checks, not a clean-source real-MLX adoption or market qualification. P094-012c5/012c6/023e remain open until that separate proof.

Follow-up	Status	Required boundary
P090-006f4	todo	Design owner-local storage of individually addressed nodes and root-referenced closures, avoiding repeated whole-graph retention across products/effects/outcomes. Preserve exact signing, ordered multiplicity, bounded reachable closure, selective disclosure, authority and restart/GC semantics. Current carriers intentionally still contain the complete closure; this is not remote acquisition or implicit historical migration.

1. Explicitly inventory any additional admitted batch/training profiles before extending execution. P090-004b and P090-004c1–P090-004c5 are complete for the ten current operations; preserve their promotion gate rather than reopening those bounded producer tasks. The bounded batch/training journal and image/artifact recovery checkpoints P090-004b3/004b4 are complete; do not repeat them or completed registry, scoped preflight, synchronous-controller, Assistant, offer-selection and signed Corpus work. Source commits, publication and BDO projections remain distinct. New file/query/segmented batch profiles need their own bounded execution and recovery proof, not a broader claim from the present gate.
2. Preserve the completed bounded P090-006b/006c/009d/012b controller checkpoint. Extend remaining P090-006/006a source/effect profiles and translator-inventory entries only with their owning resolver and executable no-drop/recovery proof. Do not repeat the pure contract, rebase foreign locality or treat supplied material as proof of model attention. Full contribution-to-synthesis generality is not established by this text path. Complete the approved all-current-Flow scope in P090-006d/006e/012d: finish remaining source/effect and decision-authority adapters, deferred continuation and cross-transport recovery selection, then qualify Whisper terminals and full Memarium transport/recovery. Completed P090-006d1 preserves exact sources when aggregation fails, including inline-budget overflow, and replays committed calls without redispatch. It does not make an oversized aggregate representable or authorize retry of an uncertain effect. Atomic workflow-step publication and sealed private observation sync now have deterministic regression coverage. The new sidecar/collector and private result-reopen checkpoint are implemented; neither an unknown placeholder nor rereading committed bytes closes these remaining lifecycle boundaries.
3. Preserve the P090-010b/011a/012c signed inline Room checkpoint. Extend delegated assertion issuers, additional carrier adapters or captured-product profiles only with their explicit admission and replay proof. The current Node issuer signs its own Room subject; neither a declaration nor a remote signature grants membership or upgrades peer evidence. A guided declaration editor can reuse the authenticated data API without inventing runtime claims.
4. Preserve the completed local-only DAG descriptor resolution for the retained Agent/Corpus passage path: preserve exact parents, store canonical bytes before committing a reference, verify digest/size and source binding on replay, and recheck current source access. Reuse the existing object store; no HTTP/peer acquisition, public arbitrary ref lookup, implicit access grant, ancestry truncation or inline-limit increase. Substitution, missing-object and owner/runtime restart gates are complete. Separately qualify a real-model guided repair on the DAG; this checkpoint does not close remote procurement resolution or promote the earlier unknown repair turn. Design and implement bounded, authenticated external descriptor resolution for P090-008a before admitting external references. Until then reject them explicitly; retain the completed inline procurement path unchanged. Complete broader Assistant disclosure variants and guided policy UX in their own owning rows.
5. Extend P090-012 acceptance only as the corresponding producers and consumers pass their gates. Synchronize component trackers, the Node ledger and readiness evidence, distinguishing deterministic local tests from retained physical multi-host runs. Neither this passage nor the completed P090-005/008 closes all of P090.