Proposal 094: Operator Task Packs for Bounded Problem Solving¶

Based on:

Story 013: An Operator Task Pack Repairs qmail Local Delivery in a Disposable VM, the accepted qmail reference story and acceptance contract (P094-002).
Proposal 093: Package-Scoped Private Capabilities, when a future task pack exports new callable package behaviour. Version 1 of this proposal composes registered host capabilities and does not depend on P093.

Status¶

draft

This proposal defines a candidate contract and implementation sequence. Names of new schemas, Rust crates, routes, and DTOs below are design candidates, not claims about currently registered schemas or implemented APIs. Existing P069, P071, P083, P085, P088, P090, and P091 mechanisms are antecedents, not evidence that this composition already exists.

Date¶

2026-09-25

Executive Summary¶

An Orbiplex operator should be able to install a reviewed package that says, in effect:

This node is prepared to deliberate about a bounded class of problems, advertise that readiness, run experiments in a pinned Sensorium environment, verify results, and restore the environment afterwards.

Today the required mechanisms exist separately. Corpus can describe a domain-general deliberation. Agent and Inquirium can execute bounded reasoning. Sensorium Workbench can run exact command profiles and patches in an isolated environment. Sensorium Interfaces can expose observations and actuators through explicit grants and leases. P085 can install, validate, activate, revoke, and roll back a signed operator experiment package. The Service Offer Catalog can advertise services. What is missing is a small, cross-domain contract that composes those mechanisms into one operator-understandable product without becoming a second authority system.

This proposal introduces an operator task pack. Its portable core is an immutable, signed set of exact references and digests carried as a semantic entry in an existing P085 package. A separate local binding selects machine-local paths, image variants, runtime choices, publication identity, pricing, and human-in-the-loop policy. A resolved task plan is therefore the intersection of:

the portable package ceiling;
current local operator intent;
current host capability, grant, lease, revocation, and resource state.

The pack never turns prose into ambient shell authority. Prose may describe the goal, constraints, and requested outcome of a deliberation. Every observation and effect still crosses its existing typed boundary. Commands are admitted by exact Workbench command profiles, patches by artifact-backed patch policy, and interactive operations by current Sensorium Interface grants and leases. Missing authority, substituted content, stale bindings, unavailable verifiers, and runtime egress not explicitly admitted all refuse.

The first complete exemplar is a qmail problem-solving pack. It prepares a pinned VM, admits read-only inspection first, permits only reviewed qmail configuration and service operations, verifies local delivery and the absence of an open relay, and tears down or recreates the VM as rollback. The qmail example validates a domain-independent contract; qmail semantics do not enter the shared core.

Problem Statement¶

Mechanisms exist, but the operator must compose them by hand¶

An operator can already configure a Workbench command profile, prepare a VM, activate an experiment package, configure Corpus, select an inference flow, and publish a service offer. These are separate acts with separate identifiers and failure modes. Their correctness depends on the operator manually preserving relationships such as:

the advertised thematic profile matching the one admitted by Corpus;
the VM image matching the command and verifier assumptions;
the inference flow staying within the package and local resource ceilings;
the current command profiles matching the exact scripts or executables tested by the package author;
publication being withdrawn when activation, operator authority, or local readiness disappears;
a verifier observing the intended result without gaining mutation authority;
rollback being possible after a partially completed experiment.

This is excessive cognitive load for a reusable operator product. It also encourages configuration by convention: matching strings, local paths, and prose become an implicit contract that no single boundary validates.

Prose is useful evidence, not executable authority¶

A request such as "configure qmail to accept mail from the local host" is a valid problem statement. It is not a safe execution plan. It leaves unresolved:

which qmail installation and operating system are in scope;
which files and service manager may be changed;
whether networking is disabled, isolated, or externally reachable;
which commands can inspect or mutate state;
what "accept mail" means operationally;
how to prove the node did not create an open relay;
which state must be retained as evidence;
how to restore the environment after failure.

The system must preserve the expressiveness of prose while compiling effects into a closed, inspectable plan. A model may propose a plan, but only host-owned validators and current grants may admit it.

A task pack must not become a new plugin framework¶

P085 already owns signed package ingress and activation. P069 owns thematic semantics. P071 owns Workbench command and patch execution. P083 owns interactive observation and actuation. P072 and P024 own host and delegated authority. A task pack that reimplements any of these would create a parallel authority path and make revocation ambiguous.

The missing layer is composition: exact identities, compatibility, local binding, readiness, publication coordination, and evidence linkage.

Goals¶

Let an operator install one signed package describing a bounded problem-solving capability across Corpus, Agent, Inquirium, Workbench, and Sensorium Interfaces.
Preserve a domain-general Corpus contract: programming, mail administration, scientific analysis, media work, and other domains use the same composition model.
Separate portable package facts from machine-local operator choices and transient execution authority.
Produce an inspectable readiness result explaining exactly why a task profile is or is not publishable or runnable, led by one decisive blocker and its next operator action.
Keep operator-authored configuration to choices that have no safe default. Digests, generations, capability lists, and portable facts are derived, never hand-copied.
Create ordinary Service Offer Catalog entries without making package activation itself a publication action.
Compile prose and model proposals into a closed experiment plan made from exact, registered action kinds.
Recheck mutable authority and revocation at every effect boundary.
Reuse P085 lifecycle, Bounded Deferred Operations, Replay Scheduler, Artifact Delivery, Host-Owned Module Store, Schema Gate, and existing domain stores.
Make refusal, verification, rollback, and degraded operation first-class.
Provide one complete qmail exemplar and acceptance profile before general promotion.

Non-Goals¶

A general package manager, shell-script marketplace, or universal plugin framework.
Treating natural-language instructions, model output, package signatures, or service offers as execution authority.
Defining qmail-specific semantics in shared Node crates.
Installing interpreters, system packages, VM images, or models implicitly during package activation.
Allowing a task pack to mint primitive capabilities, passports, grants, leases, or operator bindings.
Replacing Corpus thematic profiles, Workbench command profiles, Sensorium Interface descriptors, or P085 activation records with task-pack-local equivalents.
Publishing automatically when a package becomes active.
Hiding local pricing, resource, privacy, HIL, or egress decisions inside the portable package.
Full autonomous remediation of the operator's host. Version 1 runs experiments only inside explicitly bound Sensorium environments.
Defining package-scoped callable capabilities. P093 owns that optional future surface.

Terminology¶

Task pack – a signed P085 package containing one or more task-profile semantic entries and their immutable assets.
Task profile – the portable, content-addressed composition contract for one class of problems.
Local binding – host-owned operator configuration that maps a task profile to local environments, runtimes, publication identity, limits, and HIL policy.
Resolved task plan – immutable result of intersecting the task profile, current package activation, local binding, capability state, and current runtime inventory.
Readiness – prompt-free host evaluation of whether a profile is currently installable, publishable, runnable, verifiable, and rollback-capable.
Candidate plan – untrusted Agent or model output naming closed action kinds and profile refs; it carries no digests, capabilities, effect classes, HIL flags, or binding identity.
Experiment plan – host-validated plan derived from a candidate: every step carries its exact profile digest, derived effect class, and derived HIL requirement. No free-form command string is executable merely because it appears in a plan.
Contained environment – an exclusive, disposable Sensorium environment instance that satisfies the containment predicate in Containment, rollback, and uncertain outcomes. Recovery is classified for the instance as a resource, not for each change inside it.
Effective value – the result of narrowing one axis (HIL, network, limits, impact class, runtime selection) across the portable, local, and current-use layers, recorded with the layer that decided it.
Verifier – read-only or otherwise explicitly constrained observer whose result is evidence consumed by a host-owned evaluator.
Offer draft – unsigned, non-public projection assembled from the portable profile and local binding before ordinary Service Offer signing and publication.
Task run – one causally linked deliberation and experiment attempt under an exact resolved task plan.

Resolved Decisions¶

Recorded on 2026-09-25.

Carrier. Version 1 task profiles are P085 semantic entries. The existing operator-experiment-package.v1 remains the portable container. No parallel package lifecycle is introduced.
Schema stability. The first slice does not modify the P085 package schema. The package's existing semantic-entry tuple binds the task profile by exact domain, ref, revision, implementation, and digest. If implementation proves that envelope insufficient, a versioned P085 contract change is required rather than a hidden sidecar convention.
One schema, many domains. The shared task profile describes composition and exact artifact identities. Domain meaning stays in thematic profiles, command profiles, interface descriptors, verifier contracts, and package assets owned by their domains.
Portable/local split. Machine paths, credentials, live endpoints, provider identity, pricing, local runtime choice, current grants, and current leases are never portable task-profile authority. They belong to the local binding or current runtime.
No prose execution. Prose is admitted as a problem statement or reasoning input. It may propose actions, but it cannot name arbitrary shell commands or widen an allowed action.
No free-form shell. Version 1 experiment plans use a closed action algebra whose process and service operations resolve to exact Workbench command profiles. Support scripts are immutable package assets with pinned digests and narrow command profiles.
Current-use fencing. Activation generation, operator binding, task-profile digest, local-binding digest, capabilities, grants, leases, revocations, command profiles, image identity, verifier identity, and resource ceilings are rechecked before every effect.
Publication is separate. Activation can make a profile locally resolvable. It cannot advertise it. Ordinary host-owned Service Offer creation, signing, and publication remains a distinct operator action.
Withdrawal is monotone locally. Once local readiness or authority disappears, new local admission refuses immediately. Catalog withdrawal is reconciled asynchronously and remains operator-visible; catalog lag never restores local authority.
Network default. Runtime network access uses the Workbench environment network/profile vocabulary and is none or isolated: an explicitly isolated backend network with no uplink, NAT, or default route. egress-allowlisted and any other external egress require a separately reviewed capability and runtime contract; the task pack cannot create it. The per-process network policy of a command profile is a different layer and not this axis.
Verifier separation. A verifier emits bounded observations. A host-owned evaluator decides pass or fail. A verifier that requires mutation must use an explicit action profile and cannot be presented as read-only verification.
Rollback preference. Teardown and recreation from a pinned image or prepared system is preferred over reverse mutation. An exact bounded rollback profile is allowed where recreation is impractical.
Storage. P085 remains the source of truth for package lifecycle. Domain owners retain task-run, Agent, Corpus, Workbench, and Interface facts. A task-pack service may build projections and causal links but must not duplicate those logs.
No hidden fallback. A missing profile, image, runtime, command profile, verifier, grant, or lease refuses. The host must not silently substitute a similar local resource.
Qmail first. The first acceptance pack targets local qmail administration in a pinned VM and proves that no qmail-specific branch exists in the shared core.
Derived, not declared, effect semantics. A step's capability, effect class, and HIL requirement are derived from owner-owned sources: the Sensorium action-semantics map, the command profile's effect mode, the patch policy, and the Interface descriptor. A candidate plan cannot state them; a model claiming read-only for a mutating command would otherwise invert trust. Where an owner's effect source is missing, the derivation takes the more restrictive value (mutation) instead of guessing. A missing action-semantics row has no restrictive default, because no capability can be derived: pack-fact derivation fails and conformance does not pass.
Version 1 recovery scope. The first slice admits only observation steps and contained-mutation steps inside a contained environment. The environment instance, not each change inside it, carries the P080 class ephemeral-revertible, through a dated, additive amendment of middleware-component-contract.v1 adding resource kind isolated-environment with the typed disposer environment.destroy (P094-018; clarified on 2026-09-27: the amendment extends closed enums without changing any existing declaration, so it needs no new schema version). Any other effect, including every Interface actuation, refuses with plan/recovery-class-not-admitted until P094-017 admits it under the P080 recovery contract and P093 outcome semantics. Version 1 therefore needs no per-step domain reconciliation, but it still needs one owner reconciliation: the environment owner must durably confirm destruction before a run with an uncertain step terminalizes.
One narrowing rule per axis algebra. Every value that appears on more than one layer belongs to an axis with an explicit algebra: meet for restriction axes, member for set-valued choices, and bounded-by for the impact-class check. None relies on declaration order or a derived Ord. A local binding that states a less restrictive value than the portable ceiling is refused, not silently clamped; current-use state may narrow further without refusal.
Operators do not author digests or generations. The bind operation fills the accepted task-profile digest from the current package. Activation generation is a current-use fact and never appears in the binding, so reactivation and P085 rollback do not stale operator configuration. A changed profile digest blocks the binding until the operator reviews a ceiling diff and re-accepts it.
Pause is reversible; revoke is terminal. A binding may be paused: new runs refuse, withdrawal of its offer is requested, and a running run stops at its next step boundary and has its instance destroyed. Resuming requires no reinstallation, activation, or rebinding. P085 revocation remains the terminal stop.
Observation is enforced, never declared. A step or verifier counts as observation only when the Workbench enforces its command profile's effect/mode: observation. A pack author's declaration is not accepted as an interim substitute, even though a signed author is more trusted than a model: a mislabelled verifier could repair the system and fake success, and a mislabelled mutation would bypass HIL. Until the owner enforcement exists (P094-019b), the affected profiles are blocked in readiness, not weakened.

Recorded on 2026-09-27, resolving review question Q-01 of P094-006a:

Binding changes need current operator authority, through a lighter contract. A binding is configuration, not execution authority, yet its environment, profile and limits shape every later run. Who may change it and whether it may be used now are therefore separate questions: the second stays with P085 and the current-use fence. Creating a binding, resuming it, accepting a changed profile, changing its parameters, and an ordinary pause each name an exact node-operator-binding, which the host verifies as current with the P085 operator-authority check, the same one that gates P085 activation and session activation. No second local trust vocabulary exists. The change does not repeat the P085 activation ceremony: it carries no detached signature and no plan digest. Authority and the expected binding revision are checked when the change is committed, not only when a diff or preview was computed. Every committed change is recorded as operator-task-binding-change.v1 with the verified actor, the operator binding, and the binding revision before and after it. Readiness, inspection and a profile-change review need only read access. Preparing a binding document offline is allowed and grants nothing by itself.
Emergency pause is a separate host-local channel, not a fallback. Losing or revoking the operator binding must not take from the node owner the ability to restrict the node. An explicit, authenticated host-local route accepts operator-task-binding-emergency-pause.v1, which can only pause, needs no operator binding and no expected revision, and is recorded with the host-local actor. An ordinary request that fails authorization is refused; the host never retries it as an emergency pause.
Changing configuration never transfers activation. A new legitimate operator may change a binding, but does not thereby take over a package activation issued under a predecessor's operator binding. Readiness keeps reporting operator/binding-lost for that activation until it is reissued under current authority.
A binding revision fences mutation history, not just its current value. Accepted during the P094-006c review on 2026-09-27: the host stores binding/revision, starting at 1 and incrementing on every effective change, including emergency pause. It is part of local-binding/digest. A pause/resume/ pause cycle therefore cannot make an old resume request current again (ABA). The counter is never caller-supplied; no-op retries do not advance it. Legacy records without it retain their digest until their first change assigns 1. This supersedes the earlier exclusion of all binding revision counters, not the exclusion of package activation generation or duplicated portable facts.
Portable roots are explicitly mapped by the local binding. workspace/root/ref selects the local Workbench root; optional workspace/profile/root-ref names the portable root used by the pack's command profiles and patch policy. Absence means identity mapping, not discovery or a wildcard. The mapping participates in the binding digest, is retained by the run instance across restart, and cannot be changed by replaying allocation. One binding maps one root; multi-root mappings are outside V1. Owner admission still checks the original portable profile and its digest, never a rewritten profile. P094-011 should use the explicit mapping for workspace-root:qmail-lab to guest-root:qmail.

Recorded on 2026-10-04, resolving the local acceptance review:

A derived instance identity grants no aggregate resource authority. The identity tuple (workspace/ref, template/root-ref, instance/key) uses 1–256 Unicode scalar values per member, without NUL, consistently in the owner schema, Workbench and Rust. Its JCS content address commits to exact UTF-8 strings, including escaped characters. The owner also enforces operator-configured instances/max per template: default 1, integer range 1–64, on the Workbench root entry. Allocation and quota admission share the broker's cross-process lock. Replay spends no new capacity; uncertain, failed, expired, quarantined and destroying instances retain their slot until durable destruction. Legacy unknown identities count conservatively. The instance witness and consumer's run limit can neither raise this ceiling nor replace per-VM limits. This is not a global host quota or a cumulative lifetime-run limit.
An inference carrier and a domain document are distinct contracts. The current passage's output-schema/ref names inquirium.generate.response.v1. The Corpus adapter validates that completed carrier and extracts exactly one JSON text document, then admits the candidate or verdict against its domain contract at import. It does not claim the domain schema itself was pinned by the passage. Prompt-layer commitments reuse one pure host builder. The Agent owner recomputes and verifies a proposed binding/digest before admission and on recovery; inspection reports that verified retained value, not an unchecked claim.
Acceptance evidence names exact source and measured transitions. The local launcher refuses a dirty source tree, retains an immutable Git GC root plus commit/tree, and checks source drift before promotion. A repository-owned annotator derives run/date and the digest of exact raw report bytes; historical import changes no measured assertions. V2 reports retain run-bound destruction confirmations for the positive and independent denial passages. A binding pause/resume before any run is not proof of active-run pause. The native retry fixture records and forwards its admitted 1,000 ms unchanged; it does not qualify a 30-second budget. Atomic report publication and failure handling preserve the primary failure. Disposal follows owned-process quiescence and validates both ordinary and quarantine resource identities.

Accepted by the operator on 2026-10-04, before the real-model passage:

Solver-authored patch material is inert publication input. operator-task-experiment-draft.v1 carries the existing candidate and bounded operator-task-patch.v1 attachments. An attachment carries exactly one representation: patch for the existing binary/deletion document, or write-only patch/text for exact resulting UTF-8 file contents. The latter names the same policy, roots and relative paths; the host mechanically encodes content/text bytes into the unchanged patch owner contract. It neither selects content nor normalizes Unicode or line endings. Both representations share the same decoded byte ceiling. Each attachment names one patch step by step/id; that step must explicitly name draft-patch:<step/id>. This local name is not an artifact address or execution authority. The host validates all attachments, their exact step/policy relation and total decoded byte budget before storing any; it replaces only those local names with owner-derived content addresses. The final candidate retains the existing candidate/plan grammar. The publication binds the original retained Agent product to that normalized candidate and its exact patch refs. Its public response admits optional authored/patches bindings (step id, content-addressed ref and canonical size), never inline patch bytes or newly inferred historical authorship. A Reviewer reads verified patch material alongside the candidate, within the ordinary evidence budget. Storage is not policy approval: current publication authority, independent review, plan compilation, Workbench admission and HIL remain separate gates. Replay reuses exact source bytes and content-addressed artifacts; it neither authors repair bytes nor invokes a model or Workbench. A publication and its authored patch bytes commit in the same SQLite transaction; failed insertion or commit exposes neither partial material nor a publication. Material shares its publication's bounded retention, and pruning an unreferenced publication removes its material. Manually installed patch artifacts keep their existing owner and lifetime. Publication quotas count normalized candidate and authored patch bytes. No generic shell, direct model filesystem access, fixture answer injection or operator-prepublished expected repair is introduced.
Task-pack evidence selection distinguishes regeneration from independent review. The Solver's next proposal retains the published proposal/review/decision history for critique-driven regeneration. An independent Reviewer's position supplies its exact current candidate and proposal, plus actual prior executions and their observation/result artifacts, all required within existing bounds. Earlier opinions are not the current Reviewer's model input; they remain available as immutable Room facts and in the loop's history. No evidence is presented as an instruction, and no content is silently truncated. This is the P094 task-pack profile's contextual selection, not a universal restriction on Corpus deliberation roles or on what Room members may read. The real-model harness follows rejected/regeneration verdicts within the admitted four-cycle, eight-passage ceiling, preserving every signed review and actual counter. Only separately reviewed and admitted candidates execute; an empty or malformed verdict remains a refusal, never a default approval.

Review clarifications on 2026-10-04:

Patch target uniqueness is local; step order is semantic. Within one patch, each (root/ref, path) is unique. Distinct, uniquely named candidate steps may revisit the same target in declared order, including replacing earlier bytes. This is not parallel last-writer-wins execution. Every step remains separately subject to policy admission, current-use fencing and HIL; publication grants none of them. The shared decoded-byte ceiling counts all attachments, including repeated targets.
Candidate material is an owner-local evidence projection, not another candidate contract. Every candidate, including an observation with empty patches, uses corpus-task-pack-candidate-material.local.v1. It contains candidate, review/phase, ordered patches entries (step/id, patch/ref, patch, review/targets), source/product-ref and source/product-digest. The host builds this wrapper from the retained publication and verified patch bytes; no caller can submit it as trusted source material. It is not a public wire family and requires no canonical interoperability schema. The existing recursive passage projection renders UTF-8 */base64 fields as */text without changing retained source bytes; the manifest binds the projection and source identities. Binary content remains base64. Inline patch text is data, never new authority or instructions. The host derives review/phase from all actual steps: a nonempty set of observation steps is observation; any process, patch, service-control or actuation step is effects. Empty material refuses. This label is not policy admission, safety, verifier success or a host-selected verdict. The independent Reviewer must still inspect the exact steps and evidence. The existing chain-inspection carrier validates this owner-generated shape and its phase/step agreement; this adds no standalone material family or caller admission. Its raw-candidate branch retains historical validation.
Independent review is bounded, not an unbounded history guarantee. Current candidate/proposal and required prior executions with their artifacts must all fit the package's 32 KiB projection and the owner's 32-item manifest bound. Their size grows with the admitted cycles. A larger required set explicitly refuses before Reviewer inference; it is never truncated or replaced by a host-authored summary. Supporting longer loops requires a separately admitted projection/profile, not an implicit budget increase. This does not constrain other Corpus domains or Room read APIs.
Zero product fee requires a durable producer receipt. Agent product budget/used is the incremental commit delta, not total inference usage. Inquirium is the sole token/cost accounting owner, and product commit checks its receipt for the exact Agent, request and runtime against both durable ledgers. Missing or malformed token usage is charged by the existing preflight estimate with an explicit estimated kind; it never becomes free inference or invented provider metering. Native MLX qualification must retain each fresh Solver/Reviewer Agent's before/after token and cost snapshots, one durable charge, and unchanged totals after exact replay, daemon restart, post-restart replay and the completion restart, separately from loop counters. Exact execution replay occurs while the loop-owned use remains current; a stopped loop never regains execution authority for qualification. Its final restart only inspects retained accounting. Unknown model price is not proof of free execution or invented price metering. The native replay checkpoint follows durable experiment admission and confirmed allocation, while each-step HIL holds the first guest step. It does not qualify an unadmitted proposal across loss of the ephemeral Room turn; retaining its minimal admission witness is separately P094-023b1.

Implementation decisions adopted on 2026-10-04 for the resumable federated slice:

Admission evidence survives; authority does not revive. The Corpus Room owner retains a minimal witness of an actually admitted participant turn: query, Room, turn, participant, assignment, turn number, kind, class, source-message ref/digest and admission time. It contains no conversation body. The witness and accepted-message observation commit atomically in the existing Corpus store, with exact idempotency and conflicting-replay refusal. Storage is bounded per Room and per node; cleanup only removes witnesses after their Room deadline and the audit-retention interval. Recovery does not recreate a live session, floor lease, membership or permission. New publication, admission and execution still recheck their current owner authority. The original turn expiry bounds its initial publication, not a renewed permission granted by reading its historical witness.
An ordinary offer carries a typed task identity, not local authority. The existing namespaced policy_annotations extension point carries a closed operator-task/profile object with the exact task-profile/ref and task-profile/digest. Its canonical contract and negative vectors precede publication. No local binding, private P093 capability, VM root or HIL credential is advertised. The operator approves exact draft bytes and the ordinary signed Service Offer owner publishes them. Activation and enabling a binding alone never publish. Withdrawal is a durable, recoverable intent; pause, revocation or a changed profile closes local request admission before the advertisement can be withdrawn remotely.
A remote order and a provider-owned experiment round are distinct. A requester discovers and selects an ordinary signed offer. The provider admits its exact signed revision and task-profile identity before opening a bounded local Corpus round, explicitly linked to that order. Local Solver and independent Reviewer Agents participate in that round under the provider's current package use, budgets and HIL. The requester acquires no private package capability or VM authority. The verified recipe returns through ordinary signed Corpus publication with P090 execution evidence; declared offer posture never substitutes for observed execution.
Qualification proceeds from refusal and recovery to native federation. Deterministic tests first prove missing/substituted witnesses, partial commits, stale authority, withdrawal recovery and exact replay. The native Story 013 profile then uses two physical hosts and restarts the provider after proposal/review publication but before experiment admission. It must pass the seven verifier checks, preserve Agent accounting and immutable publications, return a verified recipe, refuse stale offers after revocation and retain confirmed disposal. This does not qualify a third-host Reviewer, the P091 binding migration, generic Agent input manifests, all P093 recovery or proposal-wide/alpha completion.
Dator resolves named publication policies before draft approval. Adopted by the operator on 2026-10-04: explicit Dator configuration maps own the named price and availability policies. P094 selects the two refs its local binding names; neither the package nor an incoming order can supply policy values or install a policy. The draft retains exact resolved values and canonical digests. Publication rechecks the current binding, authority and policy revisions, and requires approval of that exact draft. No default price, availability, provider or automatic publication is inferred from activation. P091 migration of the configuration source remains separate. The optional typed service-offer.v1 annotation is an additive pre-release amendment, not a new permission or a claimed whole-proposal completion.
A remote order queues work; the local operator opens its round. Adopted on 2026-10-04: Dator retains the exact admitted remote order and selected signed offer revision before execution. The provider operator explicitly links that order to one exact provider-owned Corpus round. The existing task-pack coordinator then runs Solver and independent Reviewer under the currently admitted binding, budgets and local loop. Publishing an offer does not grant automatic loop creation, Chair decisions or HIL consent. The federated acceptance profile performs these operator actions explicitly and records the order/round link. Restart resumes retained observations and delivery; it neither replaces the round nor repeats inference. Automatic operation, if later admitted, requires a separate operator opt-in contract.

Admission refinement for Decision 41 (2026-10-11): absence of current owner evidence is not a negative authority fact. A locked passport signer, failed host exchange or unavailable owner storage yields retryable Artifact Delivery admission without committing a queue source or dispatch receipt. Exact recovery rechecks current authority within the original delivery deadline; it does not republish an offer, execute a task or revive an already terminal delivery. Explicit policy, evidence and revocation refusals remain permanent. Owner/channel regressions do not qualify the pending composed native operator path.

A local Agora relay is an explicit backend, not simulated federation. Adopted by the operator on 2026-10-05: this slice may use the existing SQLite relay through an explicitly configured local backend. It preserves signed record verification, deduplication, query, subscription, subject indexing, topic authority and retention. Its receipt proves local durable admission only; it does not assert Matrix forwarding or federation. Missing Matrix credentials do not implicitly select this backend. The two-host acceptance must separately prove actual remote discovery and order/result transport. Private local publication capabilities remain inaccessible to the requester.

Implementation refinement for Decision 42 (2026-10-05): P074 may narrow the operator's configured topology to the profile's explicit participating slots. This preserves each selected host fact; it is not an operator configuration rewrite or automatic host fallback. The orchestrator pins the original raw bytes and projected topology, and each host reproduces that projection from its own bounded source snapshot and the pinned scenario. Drift refuses before execution. The physical market proof still needs distinct observed failure domains and ordinary HTTPS discovery plus peer Artifact Delivery for all domain payloads.

Implementation refinement for Decision 41 (2026-10-04): the task-pack recipe is a mechanical projection of the provider's admitted, verified execution and its exact retained candidate/patch bytes, not another inferred claim of success. The provider operator explicitly approves its publication after verification. Corpus signs the bounded outcome and preserves the realized provenance of the Solver/Reviewer products it used. Dator retains that exact dispatch product and uses the existing P090 result-preparation and Artifact Delivery recovery path; delivery retry has no executor entry point. This is a task-pack outcome policy, not a universal Corpus ontology or permission to automate Chair/HIL acts. Publication consumes the loop's exact succeeded conclusion; it does not require or restore an open execution loop after verification. Current operator, binding and package authority still fence a new publication independently. Repairing a partial completion commit may read an already signed publication after loop closure or a later binding pause, but cannot sign another result.

Control-plane recovery refinement (2026-10-05): offer publication/withdrawal and committed order delivery use schema-validated P055 registrations with a 24-hour horizon from their immutable acceptance/publication timestamp. Exact replay does not register again or renew that horizon. Expiration stops further owner RPCs; it cannot extend an offer, order, loop, lease or operator grant. Even a completed publication continues to observe loss of its current local authority and may derive a separately bounded withdrawal intent. Immutable completion identity and delivery-operation identity are distinct; inspection and cleanup must not treat a product ref as a deferred-operation id.

Review clarification on 2026-10-05:

Signed review presence is not patch review coverage. For a new task-pack repair, the Reviewer must make structured claims for each exact patch and its file targets/resulting-content digests, linked to its findings. The host compares those claims with owner-retained material before signing an accepted review, at experiment admission (also for imported signed chains), and again before publishing a verified recipe. It does not infer acceptance or argumentative quality from natural-language phrases. Operator approval remains an accountable assessment of the reasoning, not a bypass of the coverage gate. Vocabulary such as qmail domains belongs to the admitted acceptance profile, never the Corpus core. The existing UTF-8 passage projection remains the only decoder; source bytes and digests do not change. The earlier physical report s13-1791194095-ddff55 retains valid execution and transport evidence, but its repair finding concerns only observation. It cannot qualify this stronger independent-review claim. Requalification requires a fresh source-pinned run; historical evidence is not rewritten.
Qualification scope is a report fact. The real-model report V2 names its exact local or two-physical-host market profile and evidence class. The qualifier derives its obligations from those fields; a CLI profile is only a consistency assertion. The physical profile explicitly excludes the separate independent-hil-denial-no-mutation passage, naming the local real MLX profile that qualifies it. Neither a common schema nor a CLI switch may silently widen a report's claim.
Recipe transport is explicitly bounded by the complete answer carrier. The present market slice places canonical operator-task-verified-recipe.v1 JSON in signed Corpus V2 answer/text. Its owner admits at most 65,536 UTF-8 bytes for the whole recipe, including base64 expansion, signed history and source assertions. The package's 1 MiB decoded patch ceiling is not a market delivery ceiling; even a roughly 48 KiB patch can exceed this carrier once overhead is included. Oversize preview/publication refuses before any signed publication, never truncates. A separately typed AD recipe artifact with a digest/reference in the answer is future work, not supplied by this slice.
Witness exhaustion and expiration are explicit refusals, not retries of inference. The owner retains a witness for 24 hours after its admitted Room deadline (8 KiB, 256 per Room, 4,096 per Node). At capacity a new observation/witness transaction refuses with turn-witness/capacity-room or turn-witness/capacity-node (Corpus conflict); no active witness is evicted and an existing identical checkpoint can still replay. Runtime lookup checks the exact deadline even before physical pruning and after restart: turn-witness/expired is a Corpus conflict. A missing witness refuses admission as missing evidence. No missing/expired evidence is reconstructed, redispatched or given a renewed budget, lease or session. Already committed immutable products remain readable; a fresh round needs fresh current authority. The raw audit lookup is distinct from use-time admission and never renews retention. Operators need not wait on a hidden infinite retry loop to discover either refusal.

Native proof compatibility note (2026-10-05): P094-011f and P094-013c already reference the fresh 2026-10-04.review.image-qualification and 2026-10-04.review.active-pause reports on immutable source 05bd494b, not the earlier 11e13a47. The later market snapshot b67f1917 changes Corpus, Agora and order/publication seams, not sensorium-virt-core, sensorium-virt-host, the Workbench, native task run/step owners, operator_task_pack_workbench.rs, sensorium_virt_integration.rs, their image/pause launchers or vm.rs (verified by exact Git path comparison). Those native source-pinned proofs retain their original scope; they do not prove the new repair-review coverage gate or borrow its later source pin. The current vm.rs fixture refactor only delegates retention of the same two deterministic patches to a shared test helper. It changes neither the image steps nor the active-pause path; current VM owner code and image/pause launchers are unchanged. This is a scoped non-interference argument, not a fresh native image/pause run on the later review source. The later process-fixture restart waiter also accounts for sequential channel shutdown windows instead of an insufficient ten-second outer timer (50 seconds for the market's four children, maximum 60). It changes no native effect, verification or authority rule and still requires a successful graceful exit; it does not reinterpret the earlier image/pause outcomes as a new drain proof.

Authority and Ownership¶

Ownership matrix¶

Concern	Owner	Task-pack role
Package signature, install, activation, revoke, rollback	P085 operator-extension service	Carries exact task-profile and asset bindings.
Thematic role and deliberation semantics	Corpus/P069	Supplies exact thematic profile and role/overlay refs.
Passage lifecycle and effects proposed by an Agent	Agent/P073	Executes only under its ordinary grants, budgets, and HIL rules.
Inference invocation and model/runtime ceilings	Inquirium/P064 and P085 reusable flows	Resolves exact flow and intersects package/local/runtime ceilings.
Command and patch execution	Sensorium Workbench/P071	Admits exact command or patch profiles and records results.
Interactive observation and actuation	Sensorium Interfaces/P083	Requires current descriptor, grant, control session, and lease.
Capability authority	Capability Registry/P072 and passports/P024	Remains the only origin of host and delegated authority.
VM image and prepared-system identity	Sensorium Virt contracts	Supplies exact image, provenance, guest-agent, and prepared-state evidence.
Service discovery	Service Offer Catalog	Publishes an ordinary signed offer derived from an operator-approved draft.
Large immutable assets	Artifact Delivery/object store/P088	Transfers content-addressed images, fixtures, scripts, and corpora.
Local source composition	P091	Supplies explainable local bindings without becoming authority.
Composition and readiness	P094	Validates exact cross-domain linkage and produces immutable resolved plans.

Three distinct layers¶

portable task profile
        | exact refs/digests and package ceilings
        v
local operator binding
        | local paths, variants, prices, HIL and narrower limits
        v
current-use admission
        | activation, grants, leases, revocation, inventory and budgets
        v
resolved task plan -> existing domain owners execute their own operations

No layer can widen the one above it. The local binding may choose among explicitly admitted variants or narrow limits. Current-use admission may only narrow or refuse.

Portable material forbidden from carrying authority¶

A task profile must not contain:

secrets, tokens, private keys, passwords, or decryption material;
machine-local absolute paths;
live network endpoints or DHCP-derived addresses;
node, participant, or organization identifiers presented as implicit authority;
operator signatures or node-operator bindings;
current grants, leases, sessions, or capability passports;
a pre-signed Service Offer tied to a local provider identity;
arbitrary shell source or an unbounded command string;
an instruction to enable external network egress;
an ambient model or runtime selector without a closed package ceiling.

These values either belong to an admitted local source, are resolved at current use, or remain unavailable.

Contract Family¶

All names in this section are proposed. Every ingress crosses Schema Gate before semantic validation. Schemas close security-significant objects with additionalProperties: false; extension fields, where deliberately allowed, are namespaced and byte bounded.

Registered schema family¶

The contracts below are registered as draft schemas in doc/schemas/ (operator-task-common.v1 plus one thin schema per contract) with positive and negative vectors, and Node's Schema Gate validates them (P094-003a); the host evidence contract operator-task-pack-facts-evidence.v1 joined them with P094-005b, and the operator route contracts (operator-task-pack-conformance-run.v1 and its result, operator-task-binding-create.v1, operator-task-binding-state.v1, operator-task-profile-change.v1 and its result, and operator-task-refusal.v1) with P094-006a. P094-006c added current operator authority and the expected revision to the change requests, operator-task-binding-emergency-pause.v1, and the audit fact operator-task-binding-change.v1. P094-012 added the operator read projections operator-task-binding-list.v1 and operator-task-binding-inspection.v1. The JSON examples in this section are illustrative; the schemas are authoritative for the exact shape. The refusal table later in this proposal is the source of truth for the refusal vocabulary, and a drift check keeps the schema enum equal to it.

`operator-task-profile.v1`¶

The profile is a portable, immutable composition contract. It contains identifiers and digests, not the referenced large content.

{
  "schema": "operator-task-profile.v1",
  "schema/v": 1,
  "profile/ref": "operator-task-profile:qmail-local-administration",
  "profile/revision": 1,
  "thematic-profile": {
    "domain": "corpus",
    "entry/ref": "corpus-profile:qmail-administration",
    "entry/revision": 1,
    "implementation/ref": "corpus-profile-implementation:qmail-v1",
    "entry/digest": "sha256:THEMATIC_PROFILE_DIGEST"
  },
  "catalog": {
    "service/type": "orbiplex.problem-solving",
    "offer-template/ref": "operator-task-offer-template:qmail-v1",
    "offer-template/digest": "sha256:OFFER_TEMPLATE_DIGEST",
    "taxonomy/ref": "taxonomy:qmail-administration-v1",
    "taxonomy/digest": "sha256:TAXONOMY_DIGEST",
    "topics": ["mail/qmail", "mail/local-delivery", "mail/relay-policy"]
  },
  "deliberation": {
    "inference-flow/ref": "qmail-task-pack-steps",
    "inference-flow/digest": "sha256:FLOW_DIGEST",
    "agent-policy/ref": "agent-policy:qmail-experiment-v1",
    "agent-policy/digest": "sha256:AGENT_POLICY_DIGEST",
    "roles": ["requester", "solver", "reviewer"],
    "limits": {
      "max/passages": 18,
      "max/experiments": 6,
      "max/wall-time-ms": 1800000
    }
  },
  "environment": {
    "image-variants": [
      {
        "variant/ref": "image-variant:qmail-debian13-amd64",
        "image-manifest/ref": "sensorium-virt-image:qmail-debian13-amd64-v1",
        "image-manifest/digest": "sha256:IMAGE_MANIFEST_DIGEST"
      }
    ],
    "prepared-system/ref": "prepared-system:qmail-v1",
    "prepared-system/digest": "sha256:PREPARED_SYSTEM_DIGEST",
    "runtime-network/ceiling": "none",
    "impact-class/max": "test"
  },
  "workbench": {
    "command-profiles": [
      {
        "ref": "sensorium-command-profile:qmail-showctl-v1",
        "digest": "sha256:COMMAND_PROFILE_DIGEST"
      }
    ],
    "patch-policy/ref": "sensorium-patch-policy:qmail-control-files-v1",
    "patch-policy/digest": "sha256:PATCH_POLICY_DIGEST"
  },
  "interfaces": {
    "observation-descriptors": [],
    "actuation-descriptors": []
  },
  "experiment": {
    "input-schema/ref": "schema:operator-task-qmail-input.v1",
    "input-schema/digest": "sha256:INPUT_SCHEMA_DIGEST",
    "candidate-schema/ref": "schema:operator-task-experiment-candidate.v1",
    "candidate-schema/digest": "sha256:CANDIDATE_SCHEMA_DIGEST",
    "first-step/class": "observation",
    "hil/mode": "each-mutation"
  },
  "verifier": {
    "ref": "operator-task-verifier:qmail-local-delivery-v1",
    "digest": "sha256:VERIFIER_DIGEST",
    "command-profile/ref": "sensorium-command-profile:qmail-verify-v1",
    "command-profile/digest": "sha256:VERIFY_COMMAND_PROFILE_DIGEST",
    "result-schema/ref": "schema:operator-task-verifier-result.v1",
    "result-schema/digest": "sha256:VERIFY_RESULT_SCHEMA_DIGEST"
  },
  "rollback": {
    "mode": "recreate-prepared-system",
    "ref": "operator-task-rollback:qmail-v1",
    "digest": "sha256:ROLLBACK_DIGEST"
  },
  "required-capability/ids": [
    "sensorium.workbench.terminal",
    "sensorium.workbench.file",
    "sensorium.workbench.patch",
    "sensorium.virt.host"
  ],
  "resource-envelope/ref": "resource-envelope:qmail-experiment-v1",
  "resource-envelope/digest": "sha256:RESOURCE_ENVELOPE_DIGEST",
  "refusal-corpus/ref": "refusal-corpus:qmail-task-pack-v1",
  "refusal-corpus/digest": "sha256:REFUSAL_CORPUS_DIGEST"
}

deliberation.inference-flow/ref is the id of an orbiplex.json_e_flow.v1 Flow in its owner's grammar (flowId: lowercase ASCII letters and digits with single ., _ or - separators, 1–128 bytes), not a prefix:name ref. One identifier names the Flow document, its configuration, its P085 registration and an Agent's binding to it; an actor ref derived from it never becomes another Flow id, and a prefixed value is refused, never stripped. Its digest is the delivered Flow document's (JCS v1 of the JSON object), which the host compares with the Flow it loaded. The contracts that name an asset as its profile slot does (conformance requests, pack-facts evidence, readiness evidence) accept a ref or that Flow id.

Every digest and the required-capability/ids list above are build outputs, not hand-authored values; see Authoring and binding tooling. The profile does not restate the package's operational/class, which P085 defines as a caution floor composed by max with every participating source's impact class. It answers a different question: environment.impact-class/max names the highest environment impact class for which the pack is qualified. The two are not merged: the first raises caution, the second refuses an environment. A profile that admits more than one image variant lets the local binding choose one; with exactly one variant, the binding carries no image choice.

The semantic-entry registration binds this file using domain operator-task-profile. Its exact tuple (domain, entry/ref, entry/revision, implementation/ref, entry/digest) supplies the canonical profile identity. The payload therefore does not contain its own digest or its containing package digest; either would create a circular content-addressing dependency. Registration does not activate, bind, publish, or execute the profile. The profile bytes are an immutable package asset that the package does not store. Following the P085 pattern for package-owned content, the caller supplies the profile, and the host admits it only when the registration's entry/digest equals SHA-256 over the supplied profile's JCS v1 canonical JSON and a current activation authorizes the entry (P085-045); the admitted profile inherits the package's operational class. The tuple is not a substitute for carrying or validating the referenced payload.

The containing P085 manifest must list a superset of every profile required-capability/ids value in its own required-capability/ids, and must bind every package-owned reusable inference flow used by the profile. Mismatch is package conformance failure, not a reason to infer or copy the missing declaration. The profile's resource-envelope/ref names the task resource envelope, a package asset that the profile pins by ref and digest and conformance checks like every other asset. It is not an operator Inquirium envelope: the manifest's resource-envelope/refs name only operator-signed operator-resource-envelope.v1 envelopes the package declares a dependency on, which activation requires to be current under the activating operator, and the task resource envelope is never copied into that list.

`operator-task-local-binding.v1`¶

The local binding is host-owned and source-aware. It is a P091-resolved projection, not a portable package asset and not authority by itself.

{
  "schema": "operator-task-local-binding.v1",
  "schema/v": 1,
  "binding/ref": "operator-task-local-binding:qmail-on-workbench-a",
  "binding/state": "enabled",
  "package/ref": "extension-package:qmail-operator-pack",
  "task-profile/ref": "operator-task-profile:qmail-local-administration",
  "task-profile/digest": "sha256:PROFILE_DIGEST",
  "workspace": {
    "root/ref": "workspace-root:qmail-lab",
    "backend/ref": "sensorium-virt-backend:cloud-hypervisor-system.v1"
  },
  "inference": {
    "model-profile/ref": "model-profile:qwen-coder-local",
    "runtime/ref": "model-runtime:local-openai-compatible"
  },
  "publication": {
    "enabled": true,
    "provider/participant-ref": "participant:LOCAL_PROVIDER",
    "price-policy/ref": "price-policy:qmail-lab-v1",
    "availability-policy/ref": "availability-policy:qmail-lab-v1"
  },
  "safety": {
    "hil/mode": "each-mutation",
    "runtime-network": "none",
    "max/concurrent-runs": 1
  }
}

The binding contains only choices the profile leaves open. It cannot restate a portable fact such as the prepared-system ref, the single image variant, or the verifier: such fields are not representable, so a package upgrade cannot leave a stale copy behind.

Field ownership is explicit:

Operator choices without a safe default: workspace root and backend, and the inference model/runtime when the flow's package ceiling admits more than one. A binding lacking one of them is refused with local-binding/incomplete.
Operator choices with a safe default: safety values default to the most restrictive admissible value (strictest HIL, runtime network none, one concurrent run); publication.enabled defaults to false; binding/state defaults to enabled. The operator widens a default only by an explicit edit, which inspection foregrounds as widening.
Host-filled on bind or re-accept: task-profile/digest, copied from the current package's resolved semantic entry. The operator never types a digest.
Host-filled on mutation: binding/revision, a monotone JSON-safe counter included in the binding digest, per Resolved Decision 25.
Absent by design: activation generation and the local binding digest itself. The generation is read at resolution and recorded in the resolved plan and run facts; the binding digest is computed from the canonical resolved binding, including its mutation revision.

The stored binding may use stable logical roots such as workspace-root:qmail-lab. workspace/backend/ref names the Sensorium Virt backend by its capability descriptor's id, sensorium-virt-backend:<backend/id>, and the Workbench root named by workspace/root/ref must use that backend as its executor (P094-008a). Decision 26 maps the portable pack root through workspace/profile/root-ref; this is a local operator choice, not authority supplied by a candidate plan. Resolution to an absolute local path happens inside the owning Workbench or environment provider and is omitted from portable inspection and remote status.

Binding changes and their authority¶

Resolved Decisions 22 to 24 separate who may change a binding from whether it may be used now. The gate depends on the operation:

Operation	Gate
Create a binding (it starts `enabled`)	a current, exactly verified operator binding
Resume, accept a changed profile, change parameters	the same
Pause	the same; additionally the host-local emergency channel
Readiness, inspection, profile-change review	read access; no operator binding
Prepare a binding document offline	allowed; grants nothing and starts nothing

A change request names operator/binding-ref; the state and profile-acceptance requests also name local-binding/expected-digest, the revision they were prepared against, as readiness or the review reported it; tooling copies it from that read, so the operator still never types a digest (Resolved Decision 19). Creation expects no binding under the ref, and an exact replay returns the stored binding. The host commits a change in this order, under one mutation guard shared with operator-binding revocation, supersession and deletion:

validate the request against its contract;
read the stored binding and compute the changed one;
if the outcome already holds, return the stored binding and record nothing;
verify the operator binding as current through the P085 authority check, else refuse with operator/binding-lost;
compare the stored revision with the expected one, else refuse with local-binding/revision-stale;
advance the host mutation revision (refuse exhaustion before writing), then use the combined binding port: retain operator-task-binding-change.v1 as the closed redacted audit value in its P091 intent (not a separate change sidecar) and commit the selected writable source through P091 intent → rename + sync → outcome. A read-only source returns an exact not-applied proposal instead, without another binding copy.

A fact whose write fails leaves the binding unchanged. A fact whose binding write then fails is only an authorized attempt; it does not prove a committed transition and never authorizes automatic replay. A binding file alone is not a historical receipt: the P094-006b adapter checks the durable P091 outcome and exact acquired target bytes before consumption. Explicit recovery records old/new/third/no-op observations without replacing bytes or renewing authority. The former provisional file store's attempt-only history is not retroactively promoted.

The emergency pause skips steps 4 and 5 and records actor/kind: host-local. It is reached only through its own route and contract; nothing in an ordinary request selects it.

Scenario: an operator reviews a changed profile, the review reports the current local-binding/digest, and the operator accepts with that digest. Meanwhile a second operator session pauses the binding. The acceptance refuses with local-binding/revision-stale; the operator reviews again, now against the paused revision, and accepts. When the operator binding is later revoked, the node owner can still stop the binding with an emergency pause, while resuming it waits for a current operator binding and readiness keeps showing operator/binding-lost for the old activation.

Narrowing axes¶

One table governs every value that exists on more than one layer. Each axis names its algebra; inspection shows the effective value and the layer that decided it.

Axis	Portable	Local binding	Current use	Algebra
HIL mode	`experiment.hil/mode`	`safety.hil/mode`	current host policy, for example risk-raised HIL from the P085 caution class	`meet`; `each-step` restricts more than `each-mutation`
Runtime network	`environment.runtime-network/ceiling`	`safety.runtime-network`	environment inventory	`meet`; `none` restricts more than `isolated`
Deliberation limits	`deliberation.limits`	optional narrower `deliberation.limits`	remaining Agent and Inquirium budgets	`meet` by `min` per limit
Concurrency	resource envelope	`safety.max/concurrent-runs`	capacity reservation	`meet` by `min`, minimum 1
Model and runtime	package ceiling of the reusable flow	`inference` selection	runtime inventory	`member`
Image variant	`environment.image-variants`	selection when more than one	image inventory	`member`
Impact class	`environment.impact-class/max`	–	effective `impact/class` of the bound Workbench environment	`bounded-by` under the P085 risk order `research < experimental < test < production < critical`

meet takes the more restrictive value through an explicit per-axis rank or min. member requires the choice to be admitted by the portable set and present in current inventory. bounded-by does not choose a value: the environment keeps its own class, and the check refuses with environment/impact-class-exceeded when that class ranks above the pack's qualification. Impact class and restriction are different algebras and share no ordering code.

Version 1 closes HIL to two modes; plan-level approval is a deferred extension. A local value less restrictive than its ceiling refuses with local-binding/outside-package-ceiling naming the axis; current-use narrowing is recorded but does not refuse unless the result is empty, which refuses with run/budget-exhausted.

The P085 operator attention budget is not an axis. The effective HIL mode decides whether a step needs a question; a separate attention gate then decides whether that question is delivered, grouped, deferred, or denied, and only the operator's answer approves. When no question can currently be delivered, readiness reports the effects stage as degraded with hil/attention-unavailable.

`operator-task-readiness.v1`¶

Readiness is an explainable projection of one local binding, not a grant:

{
  "schema": "operator-task-readiness.v1",
  "schema/v": 1,
  "binding/ref": "operator-task-local-binding:qmail-on-workbench-a",
  "local-binding/digest": "sha256:LOCAL_BINDING_DIGEST",
  "task-profile/ref": "operator-task-profile:qmail-local-administration",
  "task-profile/digest": "sha256:PROFILE_DIGEST",
  "activation/generation": 7,
  "evaluated-at": "2026-09-25T12:00:00Z",
  "stages": {
    "package": {"state": "ready", "evidence/refs": ["audit:package-7"]},
    "binding": {"state": "ready", "evidence/refs": ["config:qmail-on-workbench-a"]},
    "environment": {"state": "ready", "evidence/refs": ["image:verified"]},
    "deliberation": {"state": "ready", "evidence/refs": ["flow:conformant"]},
    "effects": {"state": "ready", "evidence/refs": ["command-profiles:current"]},
    "verification": {"state": "ready", "evidence/refs": ["verifier:current"]},
    "rollback": {"state": "ready", "evidence/refs": ["recreate:available"]},
    "publication": {"state": "blocked", "refusal/code": "publication/policy-missing"}
  },
  "blockers": [
    {
      "stage": "publication",
      "refusal/code": "publication/policy-missing",
      "next-action": "edit-binding"
    }
  ],
  "advertisement": {"state": "none"},
  "runnable": true,
  "publishable": false
}

Each stage is ready, degraded, blocked, not-applicable, or not-evaluated:

degraded means usable under a narrower effective value than the binding requested, for example reduced concurrency; it carries a code and never masks blocked;
not-applicable means the binding does not use the stage; in Version 1 only publication can be not applicable, when publication.enabled is false, and any other stage assessed as not applicable is a contradiction that refuses;
not-evaluated means a stage it depends on is blocked. package precedes binding; both precede the five execution stages; all precede publication. One root cause therefore produces one blocker, not a cascade.

Two effect-mode checks are static, so readiness catches them before any deliberation is spent:

a profile whose first-step/class is observation needs at least one admitted command profile with Workbench-enforced effect/mode: observation; otherwise the effects stage is blocked with workbench/effect-mode-missing;
the verifier's command profile must have Workbench-enforced effect/mode: observation; otherwise the verification stage is blocked with verifier/effect-mode-missing.

The run-time refusal plan/first-step-not-observation remains for a candidate that ignores an observation profile that does exist.

The derived fields follow closed rules:

runnable holds when package, binding, environment, deliberation, effects, verification, and rollback are each ready or degraded, and binding/state is enabled; a paused binding blocks the binding stage with local-binding/paused, unless that stage is already blocked for another reason, which stays the root cause;
deliberation is ready when a deliberation can start now: the package registers exactly the profile's Flow and agent policy, the P085 fence admits the Flow's use, and the runtime the binding selects is routable (P094-020);
publishable holds when runnable holds and publication is ready;
blockers lists every blocked stage in stage order; the first entry is the decisive blocker, and its next-action comes from the refusal table, not from prose;
advertisement.state is none, publication-pending, committed, or withdrawal-pending, projected from the publication facts.

Readiness cannot conceal an omitted or unknown stage. It is computed on read from current snapshots by the pure resolver and is not persisted; only slow inventory facts, such as image presence, are cached by their owners with an observation time.

`operator-task-offer-draft.v1`¶

An offer draft combines package-owned descriptive facts with local price, availability, provider identity, and accepted policy annotations. It is unsigned and non-public. The ordinary catalog host validates it, emits the canonical Service Offer, obtains the required signature, and publishes it through the existing path.

The resulting Service Offer carries its exact task-profile identity in the typed policy_annotations["operator-task/profile"] member (Decision 37). Receiver admission compares the exact profile ref and digest before accepting a task request. The annotation is descriptive signed data, not execution authority.

`operator-task-experiment-candidate.v1` and `operator-task-experiment-plan.v1`¶

Two shapes separate untrusted proposal from admitted plan. The Agent or model emits a candidate; the host validates it and emits the plan. A profile may bind a task-specific candidate schema that narrows the shared one, for example by closing the admitted kinds or argument shapes; it may not widen it.

Action kinds and their operations are closed:

Kind	Owner	Candidate names	Host derives
`observe`	Workbench	command-profile ref and arguments	digest; capability from the action-semantics map; class `observation` only if the profile's owner-enforced effect mode is `observation`, otherwise refused as not an observation
`observe`	Sensorium Interface	descriptor ref and operation `read` or `subscribe`	digest; operation must be in the descriptor's `access/modes`; capability from the map; class `observation`; current grant
`process`	Workbench	command-profile ref and arguments	digest; capability from the map; class from the profile's effect mode, `mutation` when absent
`patch`	Workbench	patch-policy ref and patch artifact ref	digest; capability from the map; class `mutation`; bounded target set from the patch policy
`service-control`	Workbench	command-profile ref and action	digest; capability from the map; class `mutation`; no ambient service-manager shell
`actuate`	Sensorium Interface	descriptor ref, operation `invoke`, and `method/name`	digest; capability from the map; outside containment, so refused in Version 1

Interface management operations, such as grants, control sessions, and leases, are host and operator operations, never candidate operations. A mutation becomes contained-mutation only when the bound environment is contained; otherwise it refuses with plan/recovery-class-not-admitted.

A candidate names only refs that occur in the resolved task plan. It never carries digests, capabilities, effect classes, HIL flags, binding identity, or activation generation; those fields are not representable in its schema, which also keeps the model's output small:

{
  "schema": "operator-task-experiment-candidate.v1",
  "schema/v": 1,
  "steps": [
    {
      "step/id": "inspect-qmail",
      "kind": "observe",
      "profile/ref": "sensorium-command-profile:qmail-showctl-v1",
      "arguments": []
    },
    {
      "step/id": "apply-control-patch",
      "kind": "patch",
      "profile/ref": "sensorium-patch-policy:qmail-control-files-v1",
      "patch/ref": "artifact:sha256:PATCH_DIGEST"
    }
  ]
}

The host stores the patch bytes as a content-addressed artifact before validation. The validated plan stamps identity and derived facts:

{
  "schema": "operator-task-experiment-plan.v1",
  "schema/v": 1,
  "plan/ref": "operator-task-plan:run-01",
  "candidate/digest": "sha256:CANDIDATE_DIGEST",
  "task-profile/digest": "sha256:PROFILE_DIGEST",
  "local-binding/digest": "sha256:LOCAL_BINDING_DIGEST",
  "activation/generation": 7,
  "steps": [
    {
      "step/id": "inspect-qmail",
      "kind": "observe",
      "profile/ref": "sensorium-command-profile:qmail-showctl-v1",
      "profile/digest": "sha256:COMMAND_PROFILE_DIGEST",
      "arguments": [],
      "capability/id": "sensorium.workbench.terminal",
      "effect/class": "observation",
      "effect/source": "owner-enforced",
      "hil/required": false
    },
    {
      "step/id": "apply-control-patch",
      "kind": "patch",
      "profile/ref": "sensorium-patch-policy:qmail-control-files-v1",
      "profile/digest": "sha256:PATCH_POLICY_DIGEST",
      "patch/ref": "artifact:sha256:PATCH_DIGEST",
      "capability/id": "sensorium.workbench.patch",
      "effect/class": "contained-mutation",
      "effect/source": "owner-enforced",
      "hil/required": true
    }
  ]
}

In Version 1, effect/class is observation or contained-mutation. The recovery of a contained-mutation is the environment's environment.destroy disposer; the step is not separately classified under P080. hil/required is a pure function of the effective HIL mode and the class: each-step requires HIL for every step, each-mutation for every step whose class is not observation. Validation refuses a candidate whose ref is outside the resolved plan (plan/outside-profile), whose first step is not of the profile's first-step/class (plan/first-step-not-observation), or whose derived class is outside the Version 1 recovery scope (plan/recovery-class-not-admitted). A triple without an action-semantics row is plan/unknown-action-kind, and an observation of an owner-declared mutation is plan/outside-profile. A missing owner source refuses with the owner's code: workbench/command-profile-missing for a command profile or patch policy without an exact owner source, interface/grant-missing for a descriptor without one, since no grant can name an absent descriptor, and workbench/effect-mode-missing for an observation whose Workbench enforcement is not attested. The stamped capability/id is what the current-use fence checks. effect/source is owner-enforced when the class comes from an owner contract, or missing-source-default when the owner source is absent and the step fell back to mutation. Inspection and HIL requests show it, so a question about an apparently read-only command explains itself.

The host validates the whole plan before the first effect, then rechecks each step at use. A valid earlier step does not authorize a later one. A changed replay under the same idempotency key is a terminal conflict.

`operator-task-experiment-result.v1`¶

The result links existing domain evidence rather than copying raw transcripts:

exact task-profile, local-binding, activation-generation, and plan digests;
Agent passage and Corpus deliberation refs;
Workbench directive/result refs;
Interface receipt refs where applicable;
verifier result and host evaluation refs;
rollback outcome;
bounded timings, resource accounting, and typed refusals;
disclosure metadata indicating which fields may enter a Service Offer or operator diagnostic.

Prompts, secrets, raw VM files, command stdout containing private material, and model chain-of-thought are not copied into the shared result.

The run outcome is verified, verification-failed, refused, cancelled, or unknown; a refused run names its refusal code, and a verified or failed run links the verifier result and host evaluation. Each step is completed, refused, unknown, or not-run. The rollback outcome is destroyed, which requires the owner's destruction confirmation, or rollback-pending while that confirmation is outstanding.

`operator-task-conformance-report.v1`¶

Conformance binds the exact task-profile digest, package digest, implementation digest, schema set, sensorium-action-semantics.v1 map digest, refusal corpus, fixture set, runtime identity, and result. The profile does not pin the map: when the owner revises it, the report stops being current and readiness shows package/conformance-missing with run-conformance, so a map revision costs one conformance run, not a repackaged pack. It distinguishes:

structural schema validity;
cross-reference and digest validity;
compatibility and inventory validity;
refusal-corpus result;
positive dry-run result;
optional full environment acceptance result.

Each result is passed, failed, or not-run; only the environment acceptance may remain not-run in a passing report.

Only a current fully passing report may satisfy activation or publication policy where the profile marks conformance as required.

`operator-task-pack-facts-evidence.v1`¶

The cross-reference part of conformance is host evidence, not an author's claim. For every task profile a package binds, the host recomputes the pack facts from the asset bytes supplied with the conformance request and from owner-published sources, and records operator-task-pack-facts-evidence.v1. It binds the P085 package ref and digest (the package's lowercase-hex artifact digest), the profile ref, revision and digest, and the host's action-semantics map ref, revision and digest; it lists every recomputed asset digest with the rule that produced it (owner or jcs-v1), the admitted triples and the derived capability list, and each mismatch against the authored profile and manifest. It carries no asset bytes, secrets or local paths. P085 stores it as domain conformance evidence (P085-046): the package's conformance report cannot be recorded, and its activation authorizes no use, until the evidence for every bound profile passes. Task admission additionally requires the evidence to be current under the host's map, so a revised map makes it stale. P085 rechecks the evidence byte ceiling and canonical digest on read, including after restart and before activation use; a corrupt retained document fails closed.

Digest rules are owner rules where an owner publishes one: the Workbench command profile (the validated whole document, so fields its typed view lacks, such as network, stay addressed), the Workbench patch policy, and the registry's semantic-entry header for the thematic profile. Every other slot uses SHA-256 over JCS v1 canonical JSON until its owner publishes a rule. Command profiles pass the full owner JSON Schema at the import boundary before typed validation and digesting: binding omitted fields into a digest alone does not establish that their values are valid. Interface descriptors have no owner adapter on the host yet, so a profile naming one refuses conformance rather than guess. The map is the owners' published default, and capabilities no row yields come from the Workbench's published VM-environment requirements (sensorium.virt.host, sensorium.workbench.file), never from the author.

Owner-side contracts this proposal requires¶

P094 consumes, but does not own, several contracts that do not exist yet. Each belongs to its domain owner and is registered through that owner's review, not as a P094 sidecar:

Contract	Owner	Purpose	Tracker
`sensorium-patch-policy.v1` (new)	Sensorium Workbench	Closed path set, file size, ownership, mode, and accepted content shape for patch admission. Today only patch artifacts and stage/apply results exist. Mirrored in the P071 tracker.	`P094-003b`, `P094-008`
`sensorium-command-profile.v1` effect mode (optional field, amended in place)	Sensorium Workbench	`effect/mode: observation \\| mutation`. `observation` is enforced by the Workbench, not trusted as a label. Absent means `mutation`. The contract is done; enforcement is `P094-019b`. Mirrored in the P071 tracker.	`P094-019a`, `P094-019b`
`sensorium-action-semantics.v1` (new)	Sensorium Workbench and Interfaces	Versioned map from `(owner, kind, operation)` to a registered capability id and to the effect-class rule: fixed, from the command profile's effect mode, or from the descriptor. Mirrored in the P071 tracker; Interface rows co-owned with P083.	`P094-003b`, `P094-008`
`sensorium-virt-image-manifest.v1` `guest/effect-modes` (optional field, additive)	Sensorium Virt	The effect modes the image's guest agent enforces, written by the image builder; absent means mutation only. Readiness reads it to decide whether observation is enforceable (`P094-008a`).	`P094-008a`
`sensorium-virt-prepared-system.v1` (promoted) and `sensorium-virt-image-manifest.v1` `prepared-system/digest` (optional field, additive)	Sensorium Virt	The closed prepared-system shape the image builder already read (files pinned by content digest and mode, absent paths, bounded claims, `prepared-system:` ref), promoted unchanged so existing manifests keep their digests; its content address is SHA-256 over JCS v1. The image manifest binds it, and conformance requires every admitted image to bind exactly the profile's prepared system (`P094-008c`).	`P094-008c`
P080 `isolated-environment` resource kind (extension)	P080 with Sensorium Virt as implementer	`ephemeral-revertible` host-local resource with typed idempotent disposer `environment.destroy` and durable destruction confirmation.	`P094-018`
Typed experiment proposal (revision of `corpus-reasoning-experiment-proposal.v1`)	Corpus (P069)	A proposal envelope that names its candidate artifact's type as well as its ref and digest, and the target it is meant for: for a task pack, the exact task profile and local binding. The current envelope promises `inquirium.candidate-plan.v1`, so a task-pack candidate may not ride in it.	`P094-022a`
Task-pack review and execution records	Corpus (P069)	A review verdict over exactly the proposed candidate's bytes (approve, reject, or request a correction that yields a new candidate), and the record through which an executed run's result is published back to the Room.	`P094-022a`

Until an owner contract exists, the dependent P094 behaviour refuses or takes the more restrictive derivation; P094 never supplies the missing semantics itself.

Lifecycle and State Transitions¶

The task-pack status of one binding is a projection over facts owned by existing services, not one mutable enum stored as a second source of truth. The projection takes the first row whose condition holds, top to bottom:

Projection	Holds when (owner facts)	New runs	Offer
`revoked`	P085 revocation of the package, or of the profile's semantic entry	refuse, terminal	withdrawal requested until committed
`draining`	binding `paused`, activation superseded, or readiness lost while runs are still admitted	refuse	withdrawal requested until committed
`paused`	binding `paused` and no admitted runs remain	refuse with `local-binding/paused`	withdrawn
`advertised`	runnable binding with a committed, not withdrawn offer	admit	committed
`bound`	runnable binding, no committed offer	admit local runs	none, or draft pending approval
`activated`	current P085 activation, binding missing or not runnable	refuse with the decisive blocker	none
`installed`	package stored, not currently active, or conformance not passing	refuse	none

publishable is a readiness field, not a lifecycle state. Leaving draining or paused by resuming the binding or restoring readiness requires no reinstallation or reactivation. revoked is terminal under P085; only a new P085 install and activation can make a profile resolvable again.

Exact retry of a lifecycle operation is idempotent. Reuse of an idempotency key with a different digest is a terminal conflict. Timeout after an effect's durable admission point is unknown until owner reconciliation; it is never treated as safe refusal.

Resolution and Admission Logic¶

Pure resolution¶

The pure resolver receives values, not live services:

resolve(task profile,
        package activation snapshot,
        local binding,
        capability snapshot,
        runtime inventory,
        policy ceilings)
  -> ResolvedTaskPlan | TaskPackRefusal

Resolution performs:

schema and canonical digest verification;
exact package semantic-entry binding verification;
activation generation and operator-binding comparison;
exact cross-reference and implementation availability checks;
local choice containment under portable ceilings, one narrowing axis at a time;
capability and resource intersection;
readiness stage derivation;
construction of one immutable plan containing no unresolved alternatives.

The resolver does not read files, contact peers, open databases, start VMs, or mutate stores. Effectful providers obtain the facts, call the resolver, and recheck current mutable authority before use.

Current-use fence¶

Before every effect, the owning host verifies at least:

package digest, activation generation, and current operator binding;
task-profile and local-binding digests, and binding/state still enabled; a paused binding stops a run at the next step boundary, while host-owned environment rollback still runs;
package and implementation revocation;
required base capabilities and restrictions;
Agent grant and budget state;
Workbench command or patch profile digest;
Sensorium Interface grant, control session, and lease where used;
image/prepared-system and guest-agent identity, and the containment predicate;
runtime network ceiling;
verifier identity and declared non-mutation property;
task-run cancellation, expiry, and remaining aggregate budgets.

A cache may accelerate lookup but cannot replace this fence. Cache invalidation is advisory; current authority checks are normative.

Refusal vocabulary¶

The implementation uses a closed typed refusal enum. One table gives every code its readiness stage, retry class, and next operator action; readiness blockers, run results, CLI, and UI all project this table and author no separate explanation. Stage run marks codes that arise only while validating or executing a run and never appear as readiness blockers.

Retry classes are closed: terminal (the same request never succeeds), after-operator-action, after-deferred-operation (a bounded host operation such as image preparation must finish), after-owner-reconcile (an owning domain must change or reconcile state that the operator cannot change locally), and transient.

Code	Stage	Retry class	Next action
`package/not-active`	package	after-operator-action	`activate-package`
`package/conformance-missing`	package	after-operator-action	`run-conformance`
`package/profile-digest-mismatch`	package	terminal	`inspect-package`
`operator/binding-lost`	package	after-operator-action	`rebind-operator`
`local-binding/missing`	binding	after-operator-action	`create-binding`
`local-binding/incomplete`	binding	after-operator-action	`edit-binding`
`local-binding/outside-package-ceiling`	binding	after-operator-action	`edit-binding`
`local-binding/profile-changed`	binding	after-operator-action	`review-profile-change`
`local-binding/conflict`	binding	after-operator-action	`resolve-binding-sources`
`local-binding/paused`	binding	after-operator-action	`resume-binding`
`local-binding/revision-stale`	binding	after-operator-action	`edit-binding`
`environment/image-mismatch`	environment	terminal	`inspect-environment`
`environment/prepared-system-unavailable`	environment	after-deferred-operation	`prepare-environment`
`environment/runtime-egress-denied`	environment	after-operator-action	`edit-binding`
`environment/impact-class-exceeded`	environment	after-operator-action	`edit-binding`
`environment/not-contained`	environment	after-operator-action	`edit-binding`
`deliberation/flow-unavailable`	deliberation	after-operator-action	`inspect-deliberation`
`capability/missing`	effects	after-operator-action	`grant-capability`
`capability/revoked`	effects	after-operator-action	`inspect-capability`
`workbench/command-profile-missing`	effects	after-operator-action	`inspect-effects`
`workbench/effect-mode-missing`	effects	after-owner-reconcile	`inspect-effects`
`interface/grant-missing`	effects	after-operator-action	`grant-interface`
`hil/attention-unavailable`	effects	transient	`inspect-attention-budget`
`verifier/unavailable`	verification	after-operator-action	`inspect-verification`
`verifier/effect-mode-missing`	verification	after-owner-reconcile	`inspect-verification`
`rollback/unavailable`	rollback	after-deferred-operation	`prepare-environment`
`rollback/destroy-unconfirmed`	rollback	after-owner-reconcile	`inspect-environment`
`publication/policy-missing`	publication	after-operator-action	`edit-binding`
`publication/disabled`	publication	after-operator-action	`edit-binding`
`offer/withdrawal-pending`	publication	after-owner-reconcile	`none`
`package/generation-stale`	run	terminal	`start-new-run`
`plan/unknown-action-kind`	run	terminal	`none`
`plan/outside-profile`	run	terminal	`none`
`plan/first-step-not-observation`	run	terminal	`none`
`plan/recovery-class-not-admitted`	run	terminal	`none`
`plan/changed-replay`	run	terminal	`none`
`workbench/patch-outside-policy`	run	terminal	`none`
`interface/lease-lost`	run	after-owner-reconcile	`start-new-run`
`hil/denied`	run	terminal	`none`
`hil/expired`	run	after-operator-action	`start-new-run`
`delegation/missing`	run	terminal	`none`
`delegation/revoked`	run	after-operator-action	`none`
`delegation/expired`	run	after-operator-action	`none`
`delegation/substituted`	run	terminal	`none`
`delegation/outside-scope`	run	terminal	`none`
`verifier/check-missing`	run	terminal	`inspect-verification`
`verifier/mutation-not-admitted`	run	terminal	`inspect-verification`
`verifier/timeout`	run	transient	`retry-verification`
`run/cancelled`	run	terminal	`none`
`run/budget-exhausted`	run	terminal	`start-new-run`

A next action is a pointer to an operator operation, never an automatic action. The host does not act on it. inspect-capability leads to the revocation fact and its issuer; a revocation is resolved by that authority, never overridden by a new local grant. retry-verification is admitted only for a verifier whose command profile is Workbench-enforced observation, in the unchanged instance, within the run deadline, and up to the verifier contract's bounded retry count; the host may perform those bounded retries itself before reporting the code. When they are exhausted, the run terminalizes, the instance is destroyed, and the operator starts a new run. local-binding/revision-stale arises only when a binding change is committed against an older revision and is never a readiness blocker. publication/disabled is reported only when a publication request is made for a binding with publication off; readiness shows that stage as not-applicable instead.

Unknown codes fail schema validation. A drift check compares this table with the enum. Operator diagnostics may add bounded refs and digests but never raw secrets, prompts, signatures, absolute paths, or private payloads.

Service Offer Publication¶

Activation and publication remain separate for both safety and operator comprehension. The publication flow is:

resolve current task readiness;
produce an unsigned offer draft;
show portable facts separately from local price, availability, and provider facts;
obtain an authenticated operator action and ordinary signing authority;
publish through the existing catalog path;
retain the returned offer and publication refs in the task projection;
reconcile withdrawal when activation or publishability disappears, or the binding is paused.

The offer describes readiness to solve a class of problems. It does not promise that every future request will be admitted. Request admission still checks current capacity, price policy, thematic-profile compatibility, trust, sanctions, grants, revocations, and the exact task-profile digest.

Experiment Semantics¶

Prose-to-plan boundary¶

Natural language can supply:

desired outcome;
relevant facts and constraints;
explanation requested from the solver;
acceptance criteria that map to a registered verifier schema.

Natural language cannot directly supply:

an executable path;
shell syntax;
environment variables;
filesystem roots;
network destinations;
capability identifiers treated as already granted;
HIL bypass;
verifier success.

Agent or model output is parsed as an operator-task-experiment-candidate.v1. Schema Gate rejects unknown action kinds and fields. The task resolver checks that every action is contained by the exact task profile and local binding. The owning Workbench or Interface boundary then performs its ordinary authorization again.

Corpus experiment execution¶

When a task is deliberated in a Corpus Room, the task pack is the executor of the Room's admitted experiment, not a path beside it. Authority stays with its owners:

Owner	Decides
Corpus (P069)	the proposal, the review, the chair decision, provenance, and publication of the result
P094	candidate validation, deterministic compilation, run admission and the run lifecycle
Workbench and Sensorium Virt	enforcement of each concrete effect and of isolation

A chair decision admits an experiment; it grants no effect. Package activation, a current operator binding and HIL remain required. When the operator is also the chair, the two decisions stay separate facts.

Executor selection. Corpus's deterministic-host-compiler executor mode does not mean P094 by itself. The daemon selects an implementation from the admitted artifact type and the executor's binding; the first implementation is the task pack. Any other combination is refused; nothing falls back to the P083 control path.
Exact bytes. The typed proposal binds the candidate's type, ref and digest and the target task profile and binding. Review and chair decision cover exactly those bytes. A correction produces a new candidate that needs its own review; an earlier approval never carries over to it.
Provenance is a verified relation. The executor adapter checks that query, Room, proposal, candidate, roles and passages belong together before it compiles. A candidate is published from a committed Agent product, never from client bytes: the product's passage has a current Corpus inference-Flow binding naming exactly the author's turn (query, Room, participant, role assignment, turn number), no wider in class, and the candidate is the canonical form of the product's kept bytes. The record keeps the passage ref. A client cannot attach deliberation refs to an operator-supplied plan and obtain the status "admitted by Corpus". The operator's manual path stays legal, without that attribution and without counting as deliberation evidence.
Publication. The result is a host-signed Corpus fact bound to the exact Room, query, proposal, plan and run and to the digests of its result and evidence. It is not an utterance: the host publishes it without becoming a Room participant, and no Room event kind carries it, since Corpus owns its meaning. Corpus serves the record, and the artifacts it names, to a reader with the current right to read the Room: a current member holding observe in an unexpired Room. The host's signature proves origin; it grants no reader access. Publication has a durable, idempotent identity. Published means available to entitled readers, not read by every participant; a live notification may follow as a signal, never as the only carrier of the evidence.
Durable handoff. The relation admitted proposal → plan → run → result → publication in the Room is recorded. A retry of the same proposal finds the existing run instead of starting another. A crash after execution but before publication retries the publication, never the effect. Changed content under the same identity is a conflict. Recovering an existing run, its record or its publication needs no new authority; compiling or admitting a run needs a current authorization of the chain. A run admitted just before a crash is found by its ref, known from the plan and the run key, and is never admitted twice.
Observation lifecycle. Plans stay immutable, and each run's instance is destroyed when it concludes. Observation is its own run; the repair is a later run on a fresh instance from the same pinned image and prepared system. Evidence names its instance, so observations of an earlier instance are never presented as the current state of the next, and the repair plan checks its own preconditions again. An observation run that does not pass the target verifier is the expected outcome of that experiment, not an integration failure.

Evidence, envelopes and the experiment loop¶

Three things stay apart: what an Agent saw, what it proposed, and what was allowed.

Evidence is explicit input. The requester's Flow names the exact records and artifacts the next passage needs, by ref and digest. The host reads them as the Agent's Room subject: current membership with observe, classification, and whether the selected runtime may receive them. Inquirium materializes the content through the local prompt-assembly policy (content/ref layers resolved by the host), within byte and token limits. Before inference the host fixes an immutable evidence manifest: the execution and result refs, the chosen artifacts, the source instance of each, and the identifier and revision of the projection applied. Its digest binds the passage to that evidence through the passage's input/digest, and its ref stays in the passage lineage; if the passage input needs a field for it, that is an explicit revision of the Agent contract. latest may select evidence but is never left unresolved in an input.

Passage	Receives
solver	the verifier result, the relevant observations, and the history of earlier proposals and refusals
reviewer	the exact candidate under review and the same base evidence

No private chain of thought is passed on. Terminal output is untrusted data, never an instruction. A missing required artifact, a digest mismatch or an exceeded limit blocks the passage; an optional artifact left out is named as left out, and evidence is never cut silently.

Adapters produce the envelopes. The model produces a candidate or a verdict; a Corpus adapter of the host produces the signed fact.

Fact	Content from	Built and signed by
proposal v2	the solver's committed product	the Corpus adapter of the solver's node
review v4	the reviewer's committed product	the Corpus adapter of the reviewer's node
Chair decision v2	the explicit decision of the entitled Chair	the Corpus adapter of the Chair's node
execution record	the P094 run result	the host that ran it

The adapter checks the product, its passage, the Flow binding, the role and the exact turn. The model chooses no author, signing node, authority or generation: the host derives them from admitted facts and narrows expiry to the current authority. A node's signature says that this node attests this participant's decision; no model holds a node key, and a requester never signs for a remote solver or reviewer. An operator who is also the Chair performs two acts: the Corpus decision admitting exactly the reviewed experiment, and the HIL approval of each mutation of the run. The first never creates the second. A changed candidate needs a new review and a new decision, never a repackaged signature.

The pack's Flow acts in an authorized context. It executes steps in the authorized context of a participant or of the round's coordinator; it grants no role, opens no turn and creates no turn binding. Turn scheduling stays Corpus and Room mechanics. A participant step runs in one exact turn, with that participant's Agent and current inference-Flow binding: the solver's passage, the candidate's publication and the proposal in the Implementer's turn; the reviewer's passage and the review in the Reviewer's. A coordinator step runs for the round: admission of a closed proposal → review → Chair decision chain, and authorized reads of positions and results. One Flow document may serve both, with typed inputs and separate grants; solver and reviewer keep their own Agents, roles, bindings, products and prompt overlays. A position read routes the next step and authorizes nothing: every mutation checks its facts and authority again, and a call outside the caller's role is refused by the host.

The loop belongs to the requester. The requester's durable Corpus Flow drives the deliberation; P094 runs one admitted experiment at a time and never decides on its own to try again. Story 013 runs:

unsafe candidate → reviewer rejects → no run
observation → review → Chair → run on VM₁ → verification-failed → evidence
repair candidate → review → Chair → HIL → run on VM₂ → verification passes

VM₂ comes from the same pinned image and prepared system but is a new instance; VM₁'s evidence describes a historical state, and the repair checks its preconditions again.

The loop keeps separate counters for proposal-review cycles, passages per role and admitted runs. A rejected proposal consumes inference but no VM; an exact replay takes no new slot. Effective limits are the meet of package, binding and the owners' remaining budgets (see Narrowing axes). The deadline covers the whole process, human waiting included; waiting for HIL consumes no active inference time. Expired authority needs an explicit renewal, never an automatic TTL extension. The loop stops on success, an exhausted budget, cancellation or a terminal safety refusal. unknown is not a failed hypothesis and never starts another effect by itself.

Proposed limits for the deterministic profile, not yet measured:

Counter	Limit
proposal-review cycles	4
admitted runs	2 (observation and repair)
solver passages	4, regenerations included
reviewer passages	4, regenerations included

The portable deliberation.limits bound passages (max/passages), admitted runs (max/experiments) and wall time. Revision P094-023c adds max/cycles, max/solver-passages and max/reviewer-passages, all optional and narrowed by min like the others. When a pack leaves a role counter unstated, it equals max/passages; unstated cycles equal the solver's passages, since every proposal needs one.

The host keeps the loop as an append-only Corpus log on the node that owns the round (corpus-task-pack-loop.v1). An operator opens it for one binding; the host fixes its limits (package, binding and host caps) and its deadline (one wall time from the opening). The host charges the loop at the natural transitions, each under one key:

a claimed passage, by its participant's role;
a signed proposal, which opens its cycle;
an admitted experiment, which spends its run and requires the loop.

A new step of an admitted run needs the loop neither stopped nor past its deadline. A published run concludes in the loop. Only an operator renews a deadline, by at most one wall time, or cancels the loop.

Participant steps that publish a candidate or author a review consume only a committed product of the exact Agent inference-Flow binding named by their current Corpus context, not merely a product of the same Agent and turn. Participant contexts also revalidate their Agent's packaged Flow through the P085 use fence and package-owned Corpus role/overlay ceilings; a current task binding's package does not revive an Agent Flow binding from an earlier activation generation. The position projection coalesces repeated evidence refs before its 32-item bound; requiredness takes precedence and a kind or digest conflict refuses. More than 32 distinct required items refuse the projection. Only optional items may be omitted, and deduplication is not an omission.

Support scripts¶

A task pack may include support scripts only as immutable content-addressed artifacts. Each executable script must have:

an exact digest and executable identity;
a narrow Workbench command profile;
a closed argument schema;
explicit filesystem roots and environment policy;
time, output-byte, process, and resource limits;
a Workbench-enforced effect mode; without one, the script is a mutation;
positive and refusal fixtures;
no implicit network access.

The task profile refers to that command profile. It does not embed or concatenate shell fragments at runtime.

Verification¶

The verifier runs after the last admitted mutation and before success is committed. Its result contains bounded observations and named checks. The host evaluator verifies the result schema and required check set. Missing checks, unknown checks, digest mismatch, timeout, mutation outside the verifier profile, or an unavailable verifier refuse success.

Verification evidence is not equivalent to universal truth. It means only that the exact verifier observed the exact prepared environment under the recorded plan.

Containment, rollback, and uncertain outcomes¶

An environment instance is contained when all of the following hold at admission and are rechecked before each step:

it is an exclusive instance created for this run from the pinned image and prepared system, never reused across runs or shared with another tenant;
it has no writable host share or shared mount; read-only inputs are content-addressed;
its effective runtime network is none;
the run uses no Interface actuation and no credential that carries authority outside the instance;
its owner exposes the idempotent environment.destroy disposer with durable destruction confirmation (P094-018).

A binding whose environment cannot be contained, for example one selecting isolated network, is blocked for mutating profiles with environment/not-contained. Version 1 does not attempt to prove that an isolated network reaches nothing outside the instance.

Preferred rollback destroys the instance and recreates it from the pinned image and prepared-system contract. Where state must survive, an exact rollback profile may restore declared files or service state; such a profile is outside the Version 1 recovery scope. Compensation is an explicit admitted operation, not inferred Agent authority.

If a transport or host crashes after an effect admission point, that step's outcome is unknown. Version 1 does not reconcile the step with a domain owner, but it does reconcile the environment:

the run enters rollback-pending, and the step stays recorded as unknown;
the host issues environment.destroy for the exact instance;
the run terminalizes only after the environment owner durably confirms destruction;
restart recovery re-issues the idempotent disposer for every run whose destruction is unconfirmed;
while destruction stays unconfirmed beyond its bound, the rollback stage is blocked with rollback/destroy-unconfirmed, so the binding admits no new run.

The step is never repeated, and a run never resumes inside a recreated instance; a new run starts from the baseline in a fresh instance. When P094-017 admits other recovery classes, recovery consults the owning domain's idempotency and recovery contract under P080 and P093 semantics and still never blindly repeats the effect.

qmail Reference Pack¶

The qmail pack is an exemplar, not a special case in the shared implementation. Story 013 is its accepted acceptance contract: roles, concrete fixture, verifier checks, refusal cases, retained evidence, and the local and federated profiles.

Advertised scope¶

The initial thematic profile covers:

qmail configuration diagnosis;
local delivery and queue diagnosis;
bounded changes to reviewed qmail control files;
local SMTP injection and delivery verification;
relay-policy review and verification.

It does not advertise Internet-facing deployment, DNS provisioning, TLS certificate management, spam filtering, arbitrary package installation, or host repair.

Prepared environment¶

The package binds:

one Debian-based amd64 image manifest with build provenance and guest-agent identity;
one prepared-system manifest proving the expected qmail installation and baseline files;
runtime-network/ceiling: none for the first acceptance profile;
fixture mailboxes and test messages as content-addressed artifacts;
absence claims for files or listeners that would invalidate the baseline.

Image acquisition and preparation may happen before a task run. Runtime egress does not follow from the ability to acquire an image.

Command and patch profiles¶

Candidate command profiles include:

qmail-showctl for normalized configuration observation;
qmail-qread for queue observation;
exact service-status observation;
bounded local SMTP injection against the prepared instance;
verifier-only listener and relay checks;
exact service restart or reload actions where the prepared environment requires them.

The patch policy may admit only declared files such as control/locals, control/rcpthosts, control/defaultdomain, and their prepared-system equivalents. It must constrain file size, path set, ownership, mode, and accepted content shape. It must not admit arbitrary writes below /etc or an unrestricted editor command.

Required execution order¶

Every qmail step derives observation or contained-mutation; the pack needs no recovery class beyond the Version 1 scope. Its observation steps and verifier rely on command profiles whose Workbench-enforced effect mode is observation.

inspect the baseline without mutation;
produce a typed diagnosis and candidate plan;
validate the whole plan against profile and local binding;
request HIL for every mutation in the first profile;
apply one bounded mutation at a time;
observe service and queue state;
inject a local test message;
run the exact verifier;
emit a result linking the deliberation, plan, effects, and verifier evidence;
tear down or recreate the VM.

Verifier checks¶

The first verifier requires all of:

the qmail service is healthy under the prepared service manager;
a local test message is accepted and reaches the expected local mailbox or queue state;
the listener scope matches the profile;
relay attempts outside the admitted local policy are rejected;
no unexpected qmail control files changed;
runtime network remained within the declared ceiling;
the verifier itself performed no mutation outside its exact profile.

Implementation Recommendations¶

This section is informative design guidance. Implementers must still follow node:DEV-GUIDELINES.md and the owning contracts.

Strata¶

L0: `operator-task-pack-core`¶

A small pure Rust crate should own data and deterministic logic:

DTOs for task profiles, local bindings, inventory snapshots, readiness, resolved plans, action plans, and typed refusals;
semantic validation after Schema Gate;
exact digest and cross-reference checks;
ceiling intersection;
compatibility and readiness resolution;
action containment validation;
no Axum, Tokio runtime, SQLite, filesystem, process, clock, randomness, network, or daemon dependency.

Illustrative shape:

#[derive(Clone, Debug, Eq, PartialEq)]
pub struct ExactRef<T> {
    pub reference: T,
    pub digest: Sha256Digest,
}

#[derive(Clone, Debug, Eq, PartialEq)]
pub struct ArtifactRef(String);

#[derive(Clone, Debug, Eq, PartialEq)]
pub struct TaskProfileRef(String);

#[derive(Clone, Debug, Eq, PartialEq)]
pub struct PackageRef(String);

#[derive(Clone, Debug, Eq, PartialEq)]
pub enum TaskAction {
    Observe(ObserveAction),
    Process(ProcessAction),
    Patch(PatchAction),
    ServiceControl(ServiceControlAction),
    Actuate(ActuateAction),
}

#[derive(Clone, Debug, Eq, PartialEq)]
pub struct ResolvedTaskPlan {
    pub task_profile: ExactRef<TaskProfileRef>,
    pub package: ExactRef<PackageRef>,
    pub local_binding_digest: Sha256Digest,
    pub activation_generation: u64,
    pub deliberation: ResolvedDeliberation,
    pub environment: ResolvedEnvironment,
    pub admitted_actions: Vec<AdmittedActionProfile>,
    pub verifier: ResolvedVerifier,
    pub rollback: ResolvedRollback,
    pub effective_limits: EffectiveTaskLimits,
}

pub fn resolve_task_plan(
    input: &TaskResolutionInput,
) -> Result<ResolvedTaskPlan, TaskPackRefusal>;

pub fn validate_experiment_plan(
    resolved: &ResolvedTaskPlan,
    candidate: &ExperimentPlan,
) -> Result<ValidatedExperimentPlan, TaskPackRefusal>;

pub fn build_offer_draft(
    resolved: &ResolvedTaskPlan,
    publication: &ResolvedPublicationBinding,
) -> Result<OfferDraft, TaskPackRefusal>;

pub fn derive_readiness(
    input: &TaskResolutionInput,
) -> TaskReadiness;

Derived step facts are typed so that no call site can take them from the candidate:

#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub enum StepClass {
    /// Owner-enforced observation: Interface read/subscribe, or a command profile
    /// whose Workbench-enforced effect mode is `observation`.
    Observation,
    /// Mutation inside a contained environment; recovery is the instance's
    /// `environment.destroy` disposer, not a per-step P080 class.
    ContainedMutation,
    /// Any other effect. Version 1 refuses it (`plan/recovery-class-not-admitted`);
    /// mapping it to P080 classes belongs to `P094-017`.
    Uncontained,
}

#[derive(Clone, Debug, Eq, PartialEq)]
pub struct ValidatedStep {
    pub step_id: StepId,
    /// Exact ref and digest resolved from the plan, not copied from the candidate.
    pub action: TaskAction,
    /// From the owner-owned `sensorium-action-semantics.v1` map.
    pub capability: CapabilityId,
    /// From the map's effect rule and the owner source it names; `mutation` when the
    /// owner source is absent, then contained or not by the environment predicate.
    pub class: StepClass,
    /// `OwnerEnforced` or `MissingSourceDefault`; shown to the operator.
    pub class_source: EffectSource,
    /// `hil_required(effective_hil_mode, class)`; never read from input.
    pub hil_required: bool,
}

The refusal table is one exhaustive match, so a new code cannot compile without a stage, retry class, and next action:

#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub struct RefusalSpec {
    pub stage: RefusalStage,
    pub retry: RetryClass,
    pub next_action: NextAction,
}

impl TaskPackRefusalCode {
    pub const fn spec(self) -> RefusalSpec {
        use RefusalStage as S;
        use RetryClass as R;
        use NextAction as N;
        match self {
            Self::PackageNotActive => RefusalSpec { stage: S::Package, retry: R::AfterOperatorAction, next_action: N::ActivatePackage },
            Self::PlanOutsideProfile => RefusalSpec { stage: S::Run, retry: R::Terminal, next_action: N::None },
            // every other variant, with no wildcard arm
        }
    }
}

Each axis algebra is a separate, explicit operation. None relies on a derived Ord, because declaration order is an accident of the source and impact class is not a restriction order:

/// Restriction axes: HIL mode, runtime network, limits, concurrency.
pub trait RestrictionAxis: Copy + Eq {
    const AXIS: AxisName;
    /// The more restrictive of two values. Enums implement it through an explicit
    /// rank table; numeric limits through `min`.
    fn meet(self, other: Self) -> Self;
}

#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub struct Effective<T> {
    pub value: T,
    pub decided_by: Layer, // Portable | Local | CurrentUse
}

/// Refuses when `local.meet(ceiling) != local`, i.e. the binding asks for more than the
/// ceiling; current use may only narrow.
pub fn meet_layers<T: RestrictionAxis>(
    ceiling: T,
    local: Option<T>,
    current: Option<T>,
) -> Result<Effective<T>, TaskPackRefusal>;

/// Set-valued choices: model/runtime and image variant.
pub fn member<T: Copy + Eq>(
    admitted: &[T],
    local: Option<T>,
    available: &[T],
) -> Result<Effective<T>, TaskPackRefusal>;

/// Impact class is checked, not chosen: the environment keeps its own class.
/// `risk_rank` is an explicit table of the P085 order.
pub fn bounded_by_impact_max(
    environment: ImpactClass,
    max: ImpactClass,
) -> Result<ImpactClass, TaskPackRefusal>;

Security-significant variants use exhaustive enums. Unknown wire values are rejected, not mapped to permissive defaults. Conversion errors retain field context and a stable typed refusal.

L1: host composition service¶

Start by extending the existing operator-extension host only if it can retain a narrow contract. Mint a separate operator-task-pack-service crate only when independent lifecycle, testing, or a second consumer creates contract pressure. Do not create a crate merely to move files.

The host layer obtains snapshots and delegates effects through consumer-side ports:

pub trait TaskCatalogPort: Send + Sync {
    fn request_publish(
        &self,
        request: PublishOfferRequest,
    ) -> Result<DeferredOperationRef, TaskHostError>;

    fn request_withdraw(
        &self,
        request: WithdrawOfferRequest,
    ) -> Result<DeferredOperationRef, TaskHostError>;
}

pub trait TaskEnvironmentPort: Send + Sync {
    fn inventory(&self, request: EnvironmentInventoryRequest)
        -> Result<EnvironmentInventory, TaskHostError>;

    fn request_prepare(
        &self,
        request: PrepareEnvironmentRequest,
    ) -> Result<DeferredOperationRef, TaskHostError>;
}

pub trait TaskExperimentPort: Send + Sync {
    fn submit_validated_plan(
        &self,
        plan: ValidatedExperimentPlan,
    ) -> Result<TaskRunRef, TaskHostError>;
}

pub trait TaskAuditPort: Send + Sync {
    fn append_fact(&self, fact: TaskAuditFact) -> Result<(), TaskHostError>;
}

These ports are deliberately task-oriented but not domain-authoritative. Catalog, Workbench, Agent, and Interface implementations still validate their own contracts. The task host cannot reach their stores directly or infer success from transport completion.

Avoid a god orchestrator. The host builds an immutable plan, submits typed operations to owners, and links returned refs. It does not interpret qmail, execute shell, sign offers, or mutate another domain's projection.

L2: daemon composition and HTTP¶

The daemon maps layered configuration into local-binding sources, constructs handles, registers routes, and owns lifecycle start/stop. HTTP routes perform authentication, body/query parsing, Schema Gate admission, and one host call. Domain logic does not move back into route handlers or EndpointRuntimeContext.

Candidate operator surfaces:

GET  /v1/operator/task-packs
GET  /v1/operator/task-packs/{profile_ref}
POST /v1/operator/task-bindings
GET  /v1/operator/task-bindings/{binding_ref}/readiness
GET  /v1/operator/task-bindings/{binding_ref}/profile-change
POST /v1/operator/task-bindings/{binding_ref}/accept-profile
POST /v1/operator/task-bindings/{binding_ref}/state
POST /v1/operator/task-bindings/{binding_ref}/emergency-pause
POST /v1/operator/task-bindings/{binding_ref}/offer-draft
POST /v1/operator/task-bindings/{binding_ref}/publish
POST /v1/operator/task-bindings/{binding_ref}/withdraw
POST /v1/operator/task-bindings/{binding_ref}/runs
GET  /v1/operator/task-runs/{run_ref}

Operational routes are keyed by binding, not by profile. One profile may have several bindings, for example two Workbench environments, and readiness, offers, and runs belong to exactly one of them. POST /task-bindings creates a binding with safe defaults and host-filled digests; profile-change returns the per-axis ceiling diff between the accepted and current profile digest; accept-profile records the new digest; state switches between enabled and paused; emergency-pause is the host-local channel of Binding changes and their authority.

These names remain candidates until their schemas and authorization are reviewed. Read surfaces expose metadata, refs, digests, stage states, and bounded refusals only.

Reuse of host primitives¶

Schema Gate validates every contract family member before semantic use.
P085 lifecycle owns package install, activation generation, operator binding, revocation, rollback, conformance, and refusal corpus.
Host-Owned Module Store may retain bounded local-binding projections, cursors, and operation refs. It must not become a second copy of domain event logs.
Bounded Deferred Operations execute image preparation, offer publication, withdrawal, and similarly slow host-owned operations.
Replay Scheduler reconciles interrupted publication, withdrawal, provisioning, and stale-readiness work with bounded retries and visible terminal states.
Artifact Delivery and P088 acquisition move large immutable images, fixture sets, support scripts, and refusal corpora by digest.
Temporal Storage Convention applies if the task host introduces new durable facts. Current projection tables are rebuildable; write paths append facts and update projections transactionally.
Shared HTTP runtime supplies timeout, byte, concurrency, redirect, and TLS bounds. No task-pack-specific unbounded client is added.

Configuration shape¶

P091 exposes the scoped collection of local bindings (P094-006b, 2026-10-06). Its Node configuration shape is:

{
  "operator_task_packs": {
    "enabled": true,
    "bindings": [
      {
        "source": {
          "type": "file",
          "path": "operator-task-packs/qmail-on-workbench-a.json"
        }
      }
    ]
  }
}

The configuration names sources only; the binding ref comes from the source content, so it is stated once. The path is local configuration, not portable package data. P091 source provenance must remain visible in inspection. A duplicate binding ref with unequal content is local-binding/conflict, not last-writer-wins.

With no explicit source list, the retained host-writable canonical files remain behind the same domain store port (P094-006a). The P091-backed adapter validates schemas on read and write, rechecks existing profile snapshots, and uses bounded descriptor-relative I/O below the data-dir without following links or opening special files. Read-only previews and pre-admission refusals do not create storage. A failure after admission may retain a journal intent; it does not imply rollback or a committed binding. Profile-change review includes full thematic and image identities, service type and rollback mode; acceptance rechecks every retained local deliberation ceiling. Readiness preserves a conformance failure of an existing activation as package/conformance-missing so its next action is conformance, not another activation attempt.

Binding-mutating routes (create, accept-profile, state) write through P091 only to a host-writable source. For an operator-owned read-only file they return the exact updated canonical binding and do not take effect until that file changes. Either way there is no hidden second copy.

The scoped deployed API adds GET …/extensions/task-packs/bindings/sources and POST …/extensions/task-packs/bindings/maintenance. Maintenance requires current local operator authority before acquisition: preview is read-only, adoption approves an exact expiring P091 plan for the existing bytes, and recovery classifies bytes without overwrite or renewed activation/run authority. Ordinary writes retain the domain attempt and shared temporal intent/outcome; an attempt alone is not a committed revision. Pending/conflicting outcomes block consumption. The bounded journal protects outcome capacity and refuses pressure; general history archival remains P091 work. The scoped EN/PL runbook is node:docs/operations/TASK-PACK-BINDINGS.md; the full P094 HOWTO stays 014.

Binding review decisions — 2026-10-06¶

Status: adopted and implemented in the scoped Unix P094-006b vertical.

The shared journal is the sole write-history authority. An authorized attempt resides in the intent; only committed, recovered-committed or no-op-content supports a committed-history view. Pending, not-committed and conflicting attempts do not. The production binding port exposes no raw put_binding or separate change append; historical sidecars remain attempts.
A known conflict after intent but before replacement has an immediate terminal outcome. Unknown I/O outcomes still require explicit content recovery.
Source inspection exposes node-wide journal pressure and warns at 80%, counting reserved pending outcomes. The 1,024-event ceiling permits at most 512 ordinary changes across all targets. At capacity new mutations refuse. No supported archive/rotation/reset exists yet; this known write-availability limitation remains in readiness, and general P091 history remains open. Never delete the journal to bypass it.
Replacement preserves existing UID, GID and ordinary access mode; inability to preserve ownership refuses before rename. New targets use 0600. Extended ACLs, xattrs and special mode bits are outside this scoped writer; an operator-managed read-only source is appropriate when they are needed.
adopt-migration is intentionally current exact-byte baseline approval, not identification or retroactive authorization of an unknown historical editor. Current operator authority, admitted source, raw bytes, exact plan and expiry are verified; task readiness and execution authority remain separate.

The trade-off is bounded, truthful history without pretending that no-op adoption recovers lost attribution or that a diagnostic warning supplies archival. The dated Node checkpoint records the tests and implementation details.

Authoring and binding tooling¶

Most cross-reference burden is mechanical and should never reach a human:

One derivation, two callers. A pure derive_pack_facts(assets) -> PackFacts computes every profile digest, the profile required-capability/ids by looking up each admitted (owner, kind, operation) in the versioned owner-owned sensorium-action-semantics.v1 map recorded by the conformance report, the manifest superset, and refusal-corpus coverage of registered codes. Author tooling writes its output into the package; conformance recomputes it and refuses any difference. The two can therefore not drift. The pure core computes no digest: each owner computes the content address of its asset, for example PatchPolicy::digest, and derivation fills and compares digests from that inventory. The admitted triples follow from the profile's content: command profiles admit observe, process and service-control, the verifier admits observe, a patch policy admits patch, and each descriptor admits its access modes. A capability no row yields, such as the host capability of a prepared system, comes from an owner's capability declaration naming a source the profile references, never from P094 code. Author tooling and conformance share derive_bundle_facts: both digest the same asset bytes under the same rules, so conformance can reproduce the facts without trusting the profile's declarations, and records operator-task-pack-facts-evidence.v1 with P085.
Bind fills, operator chooses. POST /task-bindings starts from safe defaults, fills task-profile/digest, and asks only for choices without a safe default.
Profile change as a diff. When a package upgrade changes the profile digest, the binding blocks with local-binding/profile-changed, and profile-change shows only axes and refs that differ, marking each as narrowing, widening, or substitution. Accept is one action; the operator does not edit digests.

Persistence and causal linkage¶

Prefer links over copies. If a task composition journal is needed, its facts should be small and causal:

task-binding-accepted
task-offer-publication-requested
task-offer-publication-committed
task-offer-withdrawal-requested
task-offer-withdrawal-committed
task-run-admitted
task-run-terminalized

Readiness evaluations are not journaled: readiness is recomputed on read, and a loss of readiness that matters is recorded where it has a consequence, as the cause carried by task-offer-withdrawal-requested or by a run's terminal refusal. Creating, pausing, resuming, and accepting a changed profile are binding changes. P094-006b binds new writable revisions to durable shared intent/outcome receipts. The daemon retains each authorized attempt as operator-task-binding-change.v1 – the change kind, the verified actor and operator binding, or the host-local actor of an emergency pause, and the binding digest before and after – ahead of the binding write. Such a fact is not by itself task-binding-accepted: the shared outcome must also be durable and the exact captured target bytes must match it. Legacy attempt-only facts remain historical; explicit no-op adoption does not claim that older attempts committed.

Each fact carries the task profile and local binding digests, activation generation, causation/correlation ids, and refs to owner-domain evidence. It does not duplicate prompts, VM output, offer bodies, grants, or Workbench results. If such a journal is introduced, replay-equivalence and as-of-retention behaviour follow Solution 028.

Concurrency, retries, and cancellation¶

Admission atomically reserves profile, operator, capacity, and aggregate resource budgets before starting an effect.
Per-profile and per-binding concurrency ceilings are explicit positive integers.
Idempotency keys bind exact request digests.
Retryability is data separate from error text.
Cancellation is monotone and checked between steps; it does not claim to undo an already admitted effect.
Timeout after the durable start point produces unknown until reconciled.
Revocation closes new admission synchronously and requests bounded termination or draining according to owner policy.
Background loops are bounded, power-policy aware where appropriate, restart-safe, and expose prompt-free status.

Security and privacy review checklist¶

Authorize before every effect, not only before plan creation.
Authorize binding changes and compare their expected revision when committing them, not when previewing them; never fall back from a refused change to the emergency pause.
Treat absent authority as denial and unknown enum members as invalid.
Never infer identity or authority from task labels, thematic topics, file names, or model prose.
Revalidate canonical paths inside the owning environment boundary.
Keep network none by default and make any wider mode independently visible.
Keep secrets in host-owned secret providers; task profiles carry only refs.
Redact command output and verifier details before operator or federated projection.
Never export chain-of-thought as task evidence.
Ensure diagnostics cannot enumerate private package assets or local absolute paths.
Test revocation, changed replay, stale generation, lost operator binding, verifier substitution, image substitution, and lease loss before testing the happy path.

Testing strategy¶

The implementation should begin with executable contracts and refusal-first tests:

schema fixtures for every proposed contract;
pure property tests proving ceiling intersection is monotone, commutative where applicable, idempotent, and never widens authority;
table tests for every readiness stage and refusal code, plus a drift check between the refusal table in this proposal, the schema enum, and TaskPackRefusalCode::spec;
candidate-to-plan tests proving that effect class and HIL requirement are unaffected by any candidate content, and that a wider local value refuses on each narrowing axis;
changed-replay and concurrent-revocation tests;
lifecycle replay tests across restart, including pause and resume;
Workbench tests proving unknown commands and out-of-policy patches refuse;
Interface tests proving lost grants or leases refuse at use;
verifier tests proving missing checks and mutation attempts refuse success;
crash-after-admission tests proving an unknown step recreates the environment and is never repeated;
publication tests proving activation does not publish and revocation or pause refuses locally before asynchronous withdrawal completes;
end-to-end qmail acceptance from clean package install through teardown and revoke.

No test may satisfy an authority assertion merely by inspecting source markers. It must reach the owning boundary and observe the admitted or refused result.

Failure Modes and Required Behaviour¶

Failure	Required behaviour
Package installs but task-profile semantic entry is unknown	Installation may remain inert; conformance/activation for the task profile refuses.
Local binding names a runtime outside the package ceiling	Terminal binding refusal; no fallback runtime.
A binding change names a revoked, stale, or non-local operator binding	`operator/binding-lost`; nothing is recorded or written, and the request is not retried as an emergency pause.
Two operator sessions change one binding concurrently	The later commit refuses with `local-binding/revision-stale`; the operator reviews the current revision and repeats the change.
The operator binding is lost while a binding must be stopped	The host-local emergency pause stops it without operator authority; resuming waits for a current operator binding.
Prepared image is unavailable	Readiness reports blocked; optional acquisition is an explicit deferred operation.
Model returns a shell command	Plan parsing or action containment refuses it unless it resolves to an exact admitted command profile.
Operator revokes package during a run	New steps refuse; current owner applies its bounded cancellation/draining policy; offer withdrawal is scheduled.
Catalog withdrawal fails temporarily	Local admission remains closed; status shows withdrawal pending and retries remain bounded.
Verifier times out	Task cannot succeed yet; bounded retry only for an observation-mode verifier in the unchanged instance, then terminalize, destroy, and start a new run.
Verifier mutates state unexpectedly	Refuse verification, record policy violation, and execute rollback policy if admitted.
Sensorium Interface lease expires between planning and actuation	Actuation refuses at use; no transparent lease renewal.
Same idempotency key carries changed plan bytes	Terminal `plan/changed-replay`.
Host restarts after an effect starts	Recover from owner-domain facts; never infer safe retry from missing response.
Task profile is compatible but local HIL is stricter	Stricter local HIL wins.
Offer remains cached by a peer after revocation	Provider refuses locally; signed offer validity and normal catalog reconciliation bound remote staleness.
Candidate names a ref outside the resolved plan or claims its own effect class	Terminal `plan/outside-profile`, or schema refusal for the unrepresentable field; nothing executes.
Operator denies or lets a HIL request expire	That step does not run; the run terminalizes with `hil/denied` or `hil/expired` and the instance is destroyed.
Package upgrade changes the task-profile digest	Binding blocks with `local-binding/profile-changed`; runs and publication refuse until the operator accepts the diff; the old offer is withdrawn.
Operator pauses a binding during a run	The run stops at the next step boundary, its instance is destroyed, and offer withdrawal is requested; resume needs no reactivation.
Step outcome is `unknown` after a crash in Version 1	The run enters `rollback-pending`; the host issues idempotent `environment.destroy`; the run terminalizes only after owner-confirmed destruction; the step is never repeated.
Environment destruction cannot be confirmed	`rollback` stage blocks with `rollback/destroy-unconfirmed`; the binding admits no new run; restart recovery keeps re-issuing the disposer.
Binding selects `isolated` network for a mutating profile	`environment/not-contained`; no mutation is admitted in Version 1.
Command profile lacks an owner-enforced effect mode	Readiness blocks statically with `workbench/effect-mode-missing` or `verifier/effect-mode-missing` where observation is required; other steps derive `mutation` with `effect/source: missing-source-default`.
Action-semantics map revised by its owner	Conformance report stops being current; readiness shows `package/conformance-missing` until conformance reruns.

Operator Experience¶

Guided operator closeout (2026-10-07)¶

The operator-approved UX slice closes the existing no-manual-digests promise, not a new authority model. Node UI and the scriptable CLI remain clients of owner contracts. A read-only preparation inventory composes retained package profiles, admitted workspace/image choices and registered model/runtime refs; absence is an actionable blocker, not permission to invent configuration. Creation still uses the existing binding owner and its restrictive defaults. The preview pins the exact reviewed material; stale choices require review.

Review closeout (2026-10-07): the guided UI retains only a request digest behind a bounded, five-minute opaque receipt. Commit reconstructs the request from choices and fresh owner inventory; substituted or expired previews refuse. Package lifecycle remains visible, malformed inventory is diagnostic rather than silently omitted, and compatible image/backend pairs come from verified manifest bytes. Optional inference choices are absent values, not empty-string sentinels. Inference aliases have matching Rust/schema printable-ASCII grammar. This is a draft contract addition (operator-task-binding-preparation.v1) and an explicit reference-grammar change in binding-create/local-binding, not only visual stabilization. At that review checkpoint, corpus-chair-mandate.v1 was a draft foundation without a runtime resolver. The continuation below adds the local resolver and explicit V4 Room carrier; it does not freeze delegated authority or supply additional runtime acceptance by itself. Formal V1 adoption remains a separate decision.

The operator explicitly approved extending this slice to preparation of a new local Corpus round from prose (2026-10-07), rather than requiring a pre-created round. Corpus owns the exact preview and explicit commit, question signing through the existing identity/signing owner, and the selected participants. Preparing a draft neither opens a loop nor appoints roles or grants Room membership. The client must not copy acceptance bootstrap identities, placeholder signatures or fabricated membership evidence. Existing rounds remain selectable; their authority is rechecked by the same owners.

The operator also approved a distinct local Chair mandate (2026-10-07). Local preparation must bind the current Node operator binding, not invent a capability-passport: reference. Delegated Chair authority remains a separate path requiring its real capability passport. Reading an old room or draft is not a renewal: the owner must recheck the applicable mandate before each new Chair operation. The new preparation boundary must name these alternatives explicitly; the accepted historical room-policy wire shapes are not silently reinterpreted. Implementation and runtime qualification of this boundary remain part of P094-012c3, not evidence already supplied by the harness.

Temporal clarification approved on 2026-10-08: Agent/Flow execution admission and signed downstream document validity are separate clocks. Proposal/review authoring must still validate the current producer binding before signing; document expiry is the earliest role, membership invitation/attestation, Room policy, parent document and optional requested expiry. It does not renew execution or extend Room authority. Chair/admission and replay recheck current operator, participant, package and use authority. Old signed bytes remain immutable. Owner chain inspection reports a decision window, not permission; expired chains remain inspectable without UI action controls. The real UI exposed this boundary: both distinct Agents completed their HIL-approved passages and cleanup, but a short Reviewer profile left only 345 ms after its signature for a Chair decision. That run qualifies no experiment or VM; the corrected path still needs fresh operator acceptance.

Subsequent checkpoint, 2026-10-08: the fresh b48 round completed the ordinary UI path through separate MLX Solver/Reviewer passages and HIL, retained-chain Chair approval, separate admission, native read-only qmail observation, verifier evaluation and confirmed destruction before signed execution publication. Run operator-task-run:sha256:0XHTGwaH7ZHEuc0_syaGEUranTXVysDH7qNEHVC4qJw and execution corpus-task-pack-execution:sha256:CtzXBn_w2yuBy-oDEmSx4p0MU4ZZX2zJwfLomF7PZCU both retain verification-failed: no repair was authorized or performed. Node's docs/audits/P094-2026-10-08-GUIDED-OBSERVATION.md records exact refs, cleanup/publication timing and the independent isolated-profile prerequisites. This development-worktree evidence supersedes the older no-VM observation, not historical signatures or clean-source acceptance reports. P094-012c5 remains in progress for full operator-path qualification; no marketplace, restart/replay, seven-check repair or alpha claim is added.

The subsequent fresh UI round retained its Reviewer's signed observation rejection rather than promoting favorable prose to consent. A second Solver stopped before binding/HIL/inference: its ten-minute profile exceeded the remaining signed membership window. Node now refuses this at preparation and fresh admission and again before spawn/binding, without silently shortening the approved profile or renewing authority. A separate shorter test profile must be explicitly selected. The old unknown terminal remains immutable; P094-012c5 remains in progress pending the real repair and replay proof.

Prerequisite checkpoint, 2026-10-10: the separately approved Reviewer-only package update completed signed import, owner conformance with scripted ports, current-operator generation-1 activation and guided UI creation of a distinct enabled/runnable binding. Node's docs/audits/P094-2026-10-09-FRESH-PREREQUISITES.md records the exact pins and authority boundaries. This neither requalifies the revised prompt on a real model nor renews any expired round or communication/model/VM grant. P094-012c5 remains in progress for the fresh guided repair and replay proof.

Two subsequent fresh rounds retained signed observation rejections without executing a VM. A uniform owner-local candidate-material wrapper now exposes the structural observation/effects phase without deciding the verdict. The fresh 3dea round completed both real MLX passages and cleanup, and its Reviewer accepted the observation. Chair inspection then exposed an omitted carrier-schema update; the canonical schema, Node mirror and four-boundary regressions now cover that wrapper. Both compiled clients must consume the updated contract. This is a calibration checkpoint, not a completed repair, restart/replay or operator-path qualification.

The subsequent ee1507 UI round completed another actual read-only observation, failed verification, confirmed destruction and signed execution publication. Its repair Solver reached real inference and HIL, but exact product ancestry exceeded the unchanged 16 KiB inline descriptor limit (17,490 bytes). The turn remains unknown with completed cleanup, not a repair success or an automatic retry candidate. P094-023e retains exact parent descriptors and currently refuses unresolved external ones. Completing this richer sequence therefore needed a separately admitted carriage/resolution extension and replay gates. The operator approved the local-only P090-008d continuation on 2026-10-08; bounded local storage and Agent restart/replay tests now pass with exact parents and no repeated charge. This does not qualify all downstream consumers or the composed real-MLX repair. Node's dated audit retains the earlier exact refs and failure boundary; the old unknown turn is not automatically redispatched. P094-012c5 remains in progress; no source ancestry is discarded, no limit is raised and no whole-P090 or full operator-path qualification is claimed.

Qualification boundary approved on 2026-10-07: package installation is a prerequisite, not part of the guided no-manual-request-JSON claim. The current slice does not add a P085 installation wizard. A fresh qualification profile uses an isolated local test federation and fresh identities; existing model and image bytes may be reused through their owners, but existing profile authority is not copied. Package signing, host-configured conformance and activation must be real prerequisite operations. The scripted P085 report in the Story 013 process fixture and the owner-refusal inventory gate cannot substitute for a deployable package runner. The fresh-profile check reached identity creation, local operator consent and the empty binding inventory; the operator then approved implementing a real runner before continuing. orbiplex-task-pack-conformance now computes all 13 refusal cases and seven positive controls using production owner semantics with scripted port inputs. It binds the exact package/assets, raw corpus and executable, and refuses incomplete or substituted inputs. This is not evidence of live HIL or VM execution, and does not promote process evidence to operator-path acceptance. On 2026-10-07 the fresh profile passed the real task-pack conformance endpoint and finalized package activation generation 1; Node UI showed that active package. Exact package, corpus, runtime and report pins are retained in Node's docs/operations/TASK-PACK-CONFORMANCE.md. This development-worktree checkpoint closes the prerequisite runner, not c5's operator task/VM qualification. The real UI then created an inventory-backed binding and owner preflight became runnable after actual MLX component conformance. Review corrected optional inference rendering, component route escaping and the flat participant choice shape (259 Node UI tests and all-target Clippy pass). The first diagnostic identity lacked stored mnemonic recovery material and could not export the bundle required before creating a second nym. That profile was retained and stopped; a new isolated identity created through the ordinary UI preserves the required recovery material. The operator completed protection and consent; the ordinary UI created both participant nyms and exported sealed recovery material. Real P085 activation and MLX conformance were repeated under the new operator, followed by UI binding creation and signed prose-to-local-round preparation. Actual invitation use exposed a 20-minute Room/15-minute attestation mismatch; the guided suggestion now uses the membership owner's ceiling, anchored to the retained preparation time rather than renewed by reading a page. Existing invitation deadlines and current-authority checks remain unchanged. Deadline and signed-round restart regressions pass, along with daemon Clippy and documentation schema/build gates. Explicit same-node AD invitation policy was still an infrastructure prerequisite; the wizard did not create it. After that bounded configuration, both participants completed actual UI invitation, join and readiness. UI opened the loop and admitted one Solver BDO; its distinct Agent reached awaiting-human with an independent notification. The first answer was refused before consent dispatch because the action ID was not percent-decoded; the question then expired. Reviewed decoding, expired UI and owner-driven timeout cleanup fixes pass the daemon/UI regressions and both task-turn process tests, including restart without repeated inference or charges. The real profile was restarted intact; the old question is shown as expired. Its turn had already terminated when the Room expired under the old binary, so its historical unknown outcome is retained, with completed cleanup and zero Agent spend/reservation. A fresh round and an independent new HIL decision are required. This recovery checkpoint does not qualify the passage. Review clarification (2026-10-08): a reconciled package invocation may be completed while its exact output is unavailable. The task-turn coordinator then retains unknown and cleanup, rather than treating the package completion as a successful contribution, advancing the loop or re-running inference. The old owner-refusal report does not qualify the current guided implementation; a fresh check-task-pack-refusals.py --verify is required for these source bytes. Role/overlay audit retains exact operator-preview approval separately from the built-in admission/rendering policy refs. No new real turn or UX acceptance completion is claimed by these review repairs.

The subsequent question expired under its separate five-minute HIL deadline; the selected ten-minute Agent lifetime did not renew it. Owner timeout retained turn-human-timeout, zero Agent spend and completed cleanup. The UI repair displays the exact deadline and countdown and redirects stale submissions to the unavailable question, including expiry racing with owner response, without retrying consent. These are presentation/recovery checks, not task acceptance. No task VM or complete Solver/Reviewer passage is qualified by these steps. The next human answer was retained and its Room-turn effect completed, although the UI returned a notification-version conflict afterwards. The reviewed repair separates owner consent from the inbox projection: no ambiguous POST retry, stale-version refusal before dispatch, and read-only recovery of the exact handled projection after owner success. It never reanswers the question. This turn separately terminated unknown while preparing inputs: the instruction commitment bypassed Inquirium's content resolver for a required temporal layer. The corrected path shares that resolver with execution; retained historical outcomes remain unchanged. Cleanup completed, but real passage/VM and full UX acceptance remain open and require a fresh authorized turn.

Continuation on 2026-10-08 local time found that the shipped package Flow lacked the task-document grammar supplied only by real-model test calibration. The ordinary Flow now reuses those same Solver/Reviewer instructions; acceptance asserts equality rather than replacing them. Python parity regressions pass and the Rust standalone Solver proof passes after its fixture recognizes those full instructions (rather than only the old role prefix). A distinct corrected package passed actual P085 conformance and activation. UI created a runnable binding, signed a fresh round and recorded both participants' limited membership/readiness. One Solver retry stopped unknown at Agent binding (HTTP 422), before HIL or inference. Owner cleanup completed; historical results and installations remain intact. No automatic second retry, VM execution or market publication is authorized; c5 stays in progress.

The next explicitly authorized UI retry admitted only answer, observe and speak for 15 minutes. It stalled before HIL in Agent creation. A process sample identified Memarium's post-append receipt lookup scanning roughly 756 MiB of unrelated Node journals. The implementation now reads the receipt's exact stream/sequence and checks record and domain identity before advancing; 60 Memarium runtime tests pass, including unrelated-stream corruption and exact idempotent replay after a later append. The independent Agent reaper page/batch limit mismatch is corrected without enlarging the operator read bound. These are owner-path repairs, not a completed real passage or a renewal of expired membership; guided/native qualification remains open.

On 2026-10-09 a fresh isolated profile repeated actual UI messaging onboarding, real MLX conformance, signed P085 activation and runnable binding preparation. Two explicitly approved test nyms were created without Room/VM/publication grants. After the local-round reply timed out, ordinary owner reads confirmed the original retained question and Room; no duplicate commit was sent. The recovery-export gate now exposes a typed public precondition and bounded fixed UI guidance without private owner error prose or creation retries. See Node docs/audits/P094-2026-10-09-FRESH-PREREQUISITES.md. This development checkpoint does not complete c5 or assert a fresh native repair or human HIL proof.

The subsequent human-approved communication-only invitation attempt retained Solver membership but failed inbox delivery because the isolated AD/INAC configuration still targeted the former Node. The initial edit affected only the generated control snapshot and did not repair the source; Reviewer was not dispatched. The actual configuration source was subsequently corrected without changing grants or transport budgets, and the owner-published runtime snapshot confirmed it after reload. Restart of the rebuilt daemon triggered a fresh macOS removable-volume prompt for DEV before MLX and the control API became available. The approved grant window expired during that wait; it is not extended by configuration repair, restart or read-side refresh. Successful delivery and participant passages remain unqualified, and c5 remains in progress. The human accepted the renewed DEV prompt; MLX and the API then started and the real UI returned to existing-key unlock. No permission gate was bypassed. The subsequent exact ec8e round has separately human-approved communication grants through 20:12:20 UTC; neither invitation is counted as delivered here. Reload exposed a status-SSE shutdown hang, diagnosed from the process sample. Disconnecting only the isolated UI allowed reload to finish at 20:08:22 UTC; this mitigation and the separate cooperative-stream lifecycle fix are not participant passage or full operator-path acceptance. The human subsequently unlocked existing keys; actual UI owner reads confirmed both grants had expired without dispatch. A real-loopback connected-status-client shutdown regression and strict daemon all-target Clippy pass; deployment qualification is separate. The Room's immutable total deadline subsequently expired too. The isolated old daemon exited normally during deployment of the new binary; the new MLX loader again waited at DEV file open. Narrow human DEV consent allowed MLX and the API to start at 20:25:11 UTC. A separate deployed direct status-SSE reload probe passes: the server closed the still-connected stream after 8,812 ms, and the restarted API returned after 27,038 ms. The first probe hit its own byte ceiling and its failed report remains retained; the corrected probe uses a separate report. This is deployed transport-lifecycle evidence, not UI-stream or task acceptance: the welcome/unlock page has no status stream. Existing-key unlock, new exact communication grants and later experiment authority remain distinct boundaries; the expired round is not extended.

After human unlock, actual UI signed the new 644b logical round. Exact human communication approval through 21:02:05 UTC was followed by delivered invites, joined and ready Solver/Reviewer, and Chair readiness. This qualifies the corrected AD/INAC invitation path, not participant inference or VM execution. The human then separately approved the five-minute Solver turn and delegated its exact communication HIL click. UI acknowledged the question; the retained operation is running / inputs-prepared, not a completed passage. The evidence names delegated confirmation, not independently answered human HIL. Solver and separately approved Reviewer subsequently completed actual MLX turns and owner-confirmed turn cleanup. Exact proposal and accept review bind the single read-only obs-1/qmail-showctl step. The human subsequently approved the exact Chair decision, clicked the separately approved observation-run admission and directly answered that step's HIL in the UI. The native run completed observation, concluded verification-failed, retained destruction confirmation and published the signed execution. Two passages, one cycle and one run are retained. Subsequent Solver preparation refused expired communication grants. The human separately approved epoch 1 and two fresh communication-only invitations; both participants joined and became ready under the unchanged logical-loop deadline and spending. Next-turn preparation then exposed a projection defect: an already completed observation incorrectly required adoption of its old plan, and its execution was absent from the new context's evidence selection. The correction preserves signed executions, artifacts and producer ancestry across the verified logical-round contexts without renewing old effect authority. A pending unexecuted candidate still requires separate adoption. This correction is not deployed browser qualification. See Node docs/audits/P094-2026-10-09-FRESH-PREREQUISITES.md for exact references and attribution. Full c5 and successful repair are not claimed.

The later fresh f7b0 logical round completed a separately approved Solver passage. After communication expiry pressure, the human separately approved epoch 1, fresh invitations and exact adoption of its observation-only candidate into context 92ed, without repeating Solver inference or charge. A separately approved Reviewer passage, with explicitly delegated communication HIL, retained its model product and 5,448-token charge. The model invented patch findings for the observation-only candidate and substituted a command-profile ref for an artifact ref; Schema Gate refused review authoring with HTTP 422. The package act has no-outcome; the turn retains unknown with completed cleanup, not a signed review or successful experiment. Two passages and zero runs are retained. This proves the malformed-output refusal on the real path, not repair acceptance, and does not close c5. Exact references and attribution are in the same dated Node audit; no automatic model retry or renewed authority is claimed.

Task	Scope	Status	Completion evidence
`P094-012c1`	Inventory-backed binding preparation	`in-progress`	Choose package, operator, workspace, image and inference without copying profiles, digests or generations. Advanced JSON remains available. Changed owner facts refuse stale submission.
`P094-012c2`	Guided preflight	`in-progress`	Node UI maps every current owner next-action to its responsible owner and a real link or explicit manual instruction. Rendering and exhaustive mapping tests pass; operator-path acceptance remains c5. Never claim readiness from UI state.
`P094-012c3`	Guided task operation	`in-progress`	Local-owner prose preview/commit, question signing, current operator Chair mandate and policy V4/invite V2 are implemented; the owner regression proves exact source replay after restart and refusal after operator revocation. The deterministic process checkpoint proves separate Solver/Reviewer Agents, independent HIL, restart and unchanged replay charges. Guided identity/invite/join/readiness, participant turns, read-only loop progress and exact Chair/admission clients are implemented. The latter bind all retained candidate/review/patch bytes and keep run admission separate from the Chair decision, HIL and publication. The Scheduler owns retained turn stages and cleanup, not the UI. Full real operator and refreshed native acceptance remain c5, not claimed here.
`P094-012c4`	Publication and maintenance review	`in-progress`	Human-readable offer terms and exact recipe patch replacement text, distinct confirmations, and P091 adoption/recovery forms are implemented. Recipe/order commitments are cross-checked. Task navigation and real operator acceptance remain open; no relay retargeting is implemented.
`P094-012c5`	Operator-path acceptance	`in-progress`	Installation is an explicit prerequisite (2026-10-07 decision), not a guided-installer claim. Exercise real clients and owners from an installed/conformant/active package without hand-authored request JSON or a harness installer. Real P085 activation, MLX conformance, UI identity/recovery, inventory-backed binding, problem-to-Room preparation and both participant memberships are qualified prerequisites. The 2026-10-08 b48 development-worktree checkpoint completed separate Solver/Reviewer/HIL passages, Chair approval, separate admission, native observation, verifier evaluation, confirmed destruction and signed execution publication, retaining `verification-failed`. The 2026-10-10 c7 development UI checkpoint additionally completes repair with seven passing checks, both VM destructions and signed result before `succeeded`, using explicitly delegated confirmations and one separately approved communication epoch. See Node `docs/audits/P094-2026-10-10-DELEGATION-REVIEW.md`. Full clean-source operator-path report and guided market-publication qualification remain open; keep these observations separate from scripted-port tests, independent human HIL and historical native reports.
`P094-012c5a`	Deployable offline P085 prerequisite runner	`done`	Approved and qualified 2026-10-07. The binary computes 13 refusal cases and seven positive controls through existing owners; five runner regressions, the full service suite (125 passes, one ignored native test), and all-target Clippy pass. Runtime input pins package/assets and executable; missing/unknown cases or changed expected outcomes cannot produce a passing report. The real profile's P085 conformance passed and activation finalized at generation 1; exact pins are in Node TASK-PACK-CONFORMANCE.md. Evidence class remains owner-semantics-with-scripted-ports, not native acceptance or c5 completion.
`P094-012c6`	Bounded between-cycle authority continuation	`in-progress`	Operator adopted signed communication epochs on 2026-10-08 and separate owner candidate adoption on 2026-10-09 (`P069-PREP-002`). Owner/API/UI preview, digest-bound commit/recovery and one cumulative loop/deadline are implemented. The signed adoption preserves the entire original Solver proposal/product/provenance, requires a fresh Reviewer and Chair decision, and binds the handoff and signed execution. Separately approved exact turn-scoped P093 bind/act uses cannot widen capability, input or logical deadline. No Solver turn, expired signature, budget or effect approval is fabricated or renewed. Contract/Schema Gate, immutable-store tests and a deterministic coordinator process proof qualify adoption/restart/replay through a distinct Reviewer and Chair with unchanged Solver charge and zero runs. The 2026-10-10 c7 development UI run qualifies completed observation -> approved epoch -> fresh real Solver/Reviewer -> verified repair with original counters/deadline. It does not qualify real-model adoption of an unfinished old Solver candidate or native fault/restart scenarios. The e236 repair Solver remains exact historical evidence, not a completed repair; its immutable total deadline expired on 2026-10-08. c5 is not complete.

Bounded loop delegation decision — 2026-10-10¶

The operator explicitly selected delegation for an entire already-open bounded Solver/Reviewer loop, including future owner-admitted plans, rather than only one precompiled experiment. The host preserves that choice in a signed operator-task-loop-mandate.v1; it is neither a blanket future consent nor a second execution engine. The signed payload pins the logical opening digest, node and operator binding, task binding/profile, package generation, exact admitted Agent profile digests, cumulative limits, expiry and a closed action set. New plans still require the existing compiler, accepted review, Chair, containment and current authority. The original opening deadline bounds the mandate even if an operator later renews the loop or its communication epoch.

Accepted review decision: withdrawal/expiry stops the delegate, not a human takeover. Stricter step modes wait for direct HIL. Whole-plan waits for a new direct consent committing to the same plan and supersedes/digest of the retained delegated consent; it cannot reset completed work, budgets or the original opening deadline. Missing/substituted evidence still refuses. Delegation refusals have their own codes, never an invented human denial.

whole-plan is an explicit new profile/binding HIL mode below each-mutation and each-step in the narrowing order. It requires consent to one exact run/plan/digest, including patch addresses, before VM allocation. It does not relax an existing profile's stricter floor. A loop mandate may derive exact plan consents; stricter modes additionally require separately delegated step confirmations. A recorded human denial/expiry is not overridden. These answers are delegated confirmations, not independent human HIL. Retained facts identify the actual local delegate, the human issuer, exact subject commitment, source mandate and original confirmation time. Qualification must keep direct human answering and authorized delegation distinct.

The local human unlocks the existing operator key through Identity. No password file, recovery phrase, private key export or secret-bearing mandate request is introduced. Preview and digest-bound commit are separate from unlock; a locked signer returns an explicit local-unlock action and cannot issue an unsigned grant. The owner applies domain framing to JCS bytes and verifies the resulting signature before retention. A durable tombstone fences new delegated admissions; in-flight outcomes, destruction and terminal reads require no renewed consent. Any current local operator can revoke, even after the original binding changes. Publication, configuration/identity changes, widening and membership renewal are excluded from the closed delegated action vocabulary.

Seven draft wire contracts cover payload, mandate, plan consent, confirmation, request, preview and status. A thin Node UI supports prepare/review/commit, local-unlock guidance, exact plan/patch review and revocation. Local clients request turns and admissions through the existing owners, not a new scheduler. The experiment-plan scope additionally permits the run driver to derive an exact plan consent automatically after explicit experiment admission and before allocation. The mandate UI discloses this; approve-run reuses the same serialized path rather than being mandatory for that derivation. Pending direct HIL becomes superseded only with an exact delegated receipt and durable step admission; it is not recorded as a human answer. Immutable retention is bounded (256 mandates/previews, 4,096 confirmations and 4,096 plan/link records); unsupported archival is a readiness limit. Revocation has a separate reserved slot and remains possible at capacity. These component and owner proofs do not upgrade historical native reports or complete c5.

Task	Scope	Status	Completion evidence
`P094-012c7`	One-loop revocable delegation and exact plan consent	`done`	Draft contracts, pure scope checks, owner-domain signature/current-use/revocation fences, exact run/step receipts and thin local UI are implemented. Separate owner tests prove direct denial, revocation/expiry takeover, partial writes and restart; they are not native fault injection. The separately authorized 2026-10-10 development UI loop completes four real local-MLX passages, two vfkit experiments, seven passing repair checks, confirmed destruction and signed Corpus result before `succeeded`. A separately approved communication epoch preserves the original mandate, deadline and counters; 21 confirmations retain the actual delegate and human issuer. See `node:docs/audits/P094-2026-10-10-DELEGATION-REVIEW.md`. This dirty-development checkpoint is not independent human HIL, clean-release acceptance, guided market publication or formal adoption of P094.

The successful delegation checkpoint uses one unchanged signed mandate and two communication contexts of the same logical loop. The initial observation concludes verification-failed; the subsequent reviewed repair concludes verified. Corpus publishes each execution only after confirmed destruction, and the loop stops succeeded with four passages, two cycles and two runs. Communication membership for epoch 1 is a separate human act; delegation does not renew it. No market publication, host-file mutation or third experiment was requested. Post-stage UI review makes answered communication references and context-scoped execution history explicit without expanding read authority. The separate guided-publication and proposal-adoption gaps remain open.

Attribution clarification (2026-10-08): the deterministic process checkpoint uses scripted operator-question answers, and the guided development UI runs use confirmations delegated by the human operator in the conversation. These exercise separate question owners, not independent human answering. The Node audit records actual answered_by accounts and answer timestamps. Future human-participation qualification must identify direct human answers or a scoped, timestamped human authorization of delegated confirmations.

Implementation continuation approved on 2026-10-07: complete c1–c5 through the real operator clients, with an explicit request-token CSRF checkpoint first. The work includes the current-owner Chair resolver and versioned Room boundary, exact preview/commit of a signed question and local round, P094-023e's neutral Agent passage manifest, and scoped P091 middleware configuration application and P093 local uncertain-result reconciliation. Each stage requires review, refusal and recovery tests before composed operator-path qualification. Existing P090 controller manifests are reused, not counted as newly implemented work. Configuration source commit is distinct from instance consumption; an unknown effect never grants redispatch. The UI remains a client, not a second execution or configuration owner. Native qualification must use the new P091-backed binding implementation; historical runs are not upgraded by inspection.

Formal V1 adoption and the disposition of P094-007b2 remain separate decisions. These clients neither implement relay retargeting nor silently renew authority, grants, leases or publication consent.

The primary view should answer four questions without requiring the operator to inspect every underlying subsystem:

What problem class does this pack claim to support?
Which portable and local facts make that claim concrete?
What is currently blocking publication or execution?
Which action would widen effects, network, cost, or retention?

The initial screen is one row per binding: lifecycle projection, the decisive blocker with its next action, and any effective value that differs from the binding's request. Drill-down uses stable refs into package activation, thematic profile, Workbench profiles, environment, verifier, rollback, and publication. It must not flatten all domain state into one giant status object.

Load-reducing rules:

One blocker first. Dependent stages report not-evaluated, so one cause yields one blocker and one next action.
Effective values with their decider. Each narrowing axis shows the effective value and the layer that set it, for example "network none – package ceiling", so the operator knows which layer to change or that no local change helps.
Widening is separate. Raising HIL laxity, network, concurrency, or limits and enabling publication are distinct confirmations naming the axis, never side effects of saving a binding.
Change review is a diff. A package upgrade presents only changed axes and refs, classified as narrowing, widening, or substitution.
HIL requests carry decision material. Each request shows the step, its derived effect class with its source, the exact target set or patch diff, and the rollback that would apply; model prose is at most secondary context. Delivery passes a separate attention gate: the P085 operator-attention-budget.v1 may deliver, group, defer, or deny a question but never approves, and it does not change the effective HIL mode. In each-mutation mode, distinct mutations are never merged into one approval.
Pause before revoke. The reversible stop is one action; revoke is presented as terminal.

The CLI and UI edit the same P091-backed local binding. Neither stores a hidden second configuration. Human-readable explanations are projections of structured refusal and provenance data, not separately authored truth.

Documentation Plan¶

After implementation and acceptance, add a bilingual operator HOWTO that walks through:

inspecting an installed task pack;
reviewing its refusal corpus and portable ceilings;
creating a local binding from safe defaults and reviewing a profile-change diff;
preparing the Sensorium environment;
validating readiness;
creating and signing an offer;
admitting one qmail request;
approving bounded mutations;
reading verification and rollback evidence;
pausing, resuming, withdrawing, and finally revoking the pack.

The full implemented EN/PL walkthrough is indexed by the operator task-pack HOWTO. Its owner-adjacent Node guides reuse existing commands and contracts, and the actual CLI parser checks identical examples in both languages. The scoped binding source/maintenance guide remains the detailed recovery reference. None of these guides documents candidate commands as if they were implemented.

Implementation Tracker¶

Status values: todo, in-progress, partial, done, deferred.

Work is sliced so that each milestone is useful on its own and the widest cross-domain change comes last:

M1 – inspect and dry-run. P094-002, P094-003a, P094-004a, P094-004b, P094-005a, P094-005b, P094-006a, P094-006b, P094-006c, and the read surfaces of P094-012. An operator installs a pack, creates a binding from safe defaults, reads readiness with its decisive blocker, and validates candidate plans with the pure core. Nothing executes.
M2 – local runs. P094-018, P094-019b, P094-008 to P094-011, P094-021, P094-013, and the run surfaces of P094-012. The operator is the requester; runs execute in the pinned VM under the Version 1 recovery scope. Nothing is published.
M3 – federated offer. P094-007, P094-016, and the publication surfaces of P094-012. A remote requester selects the offer.
M4 – promotion. P094-014 and P094-015.

P094-018 and P094-019b are owner work on the M2 critical path that does not depend on the P094 core; both were done during M1 (2026-09-27 and 2026-09-28). P094-008 now reads the owner's enforcement evidence for the bound environment. Readiness still blocks with workbench/effect-mode-missing when that evidence is unavailable or an observation-first profile has no admitted observation command; a verifier alone does not supply the first step. Real-backend readiness qualification stays in P094-013, and per-step containment revalidation stays in P094-012.

The 2026-09-28 follow-up review pins these distinctions with regressions, rejects a single empty patch line when its policy forbids it, aligns default-context validation with Workbench, and binds builder/owner digests with a shared UTF-16 key-order golden vector. Builder identity and path checks also match the owner. These are contract and readiness corrections, not a new VM acceptance result.

Publication is last because it is not needed to prove the authority boundary and adds asynchronous reconciliation that would otherwise slow every earlier test cycle.

ID	Work item	Depends on	Status	Done criteria / evidence
`P094-001`	Freeze ownership, portable/local/current-use separation, lifecycle, and authority invariants	–	`done`	This proposal records the resolved design, prohibited portable fields, owner matrix, no-prose-authority rule, no-free-form-shell rule, current-use fence, narrowing axes, derived effect semantics, Version 1 recovery scope, pause/revoke split, publication separation, verifier boundary, rollback preference, and qmail-first acceptance target. This is design completion only, not runtime implementation.
`P094-002`	Freeze the qmail reference story and acceptance contract	`001`	`done`	An accepted story names requester, solver, reviewer, thematic profile, prepared environment, bounded actions, mandatory HIL, verifier checks, rollback, refusal cases, and retained evidence without adding qmail branches to shared code. Evidence: Story 013, accepted on 2026-09-25, names the requester, solver, reviewer, and provider operator; the pinned qmail prepared system and its two-part misconfiguration; the admitted command and patch profiles; per-mutation HIL; seven verifier checks including the open-relay trap; destroy-and-recreate rollback; thirteen refusal cases; retained evidence; the substrate gates; and the local (`P094-013`) and federated (`P094-016`) profiles.
`P094-003a`	Register the P094-owned schema family with positive and negative fixtures	`001`	`done`	2026-09-26: `operator-task-common.v1` holds the shared definitions, including the closed refusal-code, stage, retry-class and next-action vocabularies; eight thin schemas cover the task profile, local binding, readiness, offer draft, experiment candidate, experiment plan, experiment result and conformance report. Positive qmail vectors from Story 013 and 34 negative vectors cover arbitrary shell, absolute POSIX and Windows portable paths, hidden egress, unknown actions, `manage` in a candidate, candidate-supplied digests, capabilities, effect classes, HIL flags and binding identity, restated portable facts and activation generation in a binding, missing digests, embedded secrets, a mutation claimed as observation, an observation from a missing owner source, a mutation without HIL, an uncontained class, readiness without a refusal code or a stage, derived readiness fields contradicting their stages, an unknown refusal code, an unconfirmed or contradictory destruction, a verified run whose verifier failed, a refusal code on success or missing on a refused step, a raw transcript, a signed draft, and a conformance report without the action-semantics digest. Node's Schema Gate registers the eight families, and `scripts/test_operator_task_refusal_codes.py` keeps the refusal table and the schema enum equal. Changed replay and actual verifier mutation are semantic refusals owned by `P094-004`, `P094-009` and `P094-010`.
`P094-003b`	Register the owner contracts P094 consumes	`001`	`done`	2026-09-26: `sensorium-patch-policy.v1` (line-oriented content shape per logical root and relative path) and `sensorium-action-semantics.v1` (the default map for the seven admitted triples) are registered with qmail vectors, schema-negative and semantic-negative vectors, mirrored in P071 Phase 6. `sensorium-actuation-core` owns their types: `PatchPolicy::validate` and `ActionSemanticsMap::validate` mirror the schema grammar and refuse what the schemas cannot express, such as a patch declared as a fixed observation, a repeated triple, or a line pattern with a backreference or lookaround; `PatchPolicy::digest` and `ActionSemanticsMap::digest` give the content addresses that plans and conformance reports record (SHA-256 over JCS v1, only for a valid document). Enforcement of the patch policy before staging is `P094-008`; registry admission of map capability ids belongs to the host that loads the map.
`P094-004a`	Implement the pure task-pack core without owner-dependent derivations	`003a`	`done`	2026-09-26: the daemon-free `operator-task-pack-core` crate provides DTOs for the eight contracts that round-trip the Story 013 vectors and re-serialize through Schema Gate; the refusal vocabulary generated from one table, tested equal to the schema enum; `meet_layers`, `member` and `bounded_by_impact_max` with explicit ranks and deciding layer, tested exhaustively over their domains; and `derive_readiness` with dependency order, `not-evaluated` propagation, one blocker per root cause, pause precedence and the closed `runnable`/`publishable` rules, whose outputs pass Schema Gate and reproduce the readiness vector. A dependency guard keeps the crate free of runtime, storage and effect crates.
`P094-004b`	Derive plans and pack facts from owner sources	`004a`, `003b`, `019a`	`done`	2026-09-26: `derive_plan` in `operator-task-pack-core` stamps capability, step class, effect source and HIL requirement on every candidate step from `OwnerSources`, the host's mapping of the action-semantics map, command-profile effects, the patch policy and Interface descriptors, with `mutation` as the missing-source default; the effective HIL mode is met with the profile's again, so a host can only make HIL stricter, and an ambiguous owner source resolves to none; it reproduces the Story 013 plan and reaches every plan refusal of the candidate table for its own reason. `derive_pack_facts` fills every profile digest from the owners' inventory, refusing one that is not a `sha256:` content address, derives `required-capability/ids` from the rows of the triples the profile admits plus owner capability declarations, states the P085 manifest requirements and reports refusal-corpus coverage; `PackFacts::check` names every digest, capability, manifest and structural difference, and reproduces the Story 013 profile. The core stays free of owner crates and computes no digest. Binding package-owned inference flows is checked with the P085 package facts in `P094-005a`. Follow-up audit, 2026-09-26: pack-fact derivation additionally requires exact command-profile, verifier-profile and patch-policy owner bindings before deriving capabilities; paused readiness validates the supplied stage evidence before applying the pause overlay. These are core-boundary repairs, not runtime completion.
`P094-005a`	Admit supplied task profiles from P085 packages	`004a`	`done`	2026-09-26: P085 resolves asset-pinned semantic entries (`P085-045`); `admit_task_profile` in `operator-task-pack-core` admits a supplied profile only when its package is installed and currently activated at the manifest's package digest, binds the profile's ref, revision and digest, the activation's operator binding is the current authority, the caller's generation is current, and the manifest lists the profile's capabilities and binds any package-owned inference flow at the same digest (2026-10-02: the task resource envelope is no longer required in the manifest's operator-envelope list; see the manifest rule above); it refuses with `package/not-active`, `package/profile-digest-mismatch`, `operator/binding-lost`, `package/generation-stale` or `package/conformance-missing`, and inherits the package's operational class. The new `operator-task-pack-service` crate composes Schema Gate, the JCS v1 profile digest, the P085 adapter and an operator-authority port, with no store of its own. Activation, rollback, revocation and restart are exercised at the P085 owner.
`P094-005b`	Recompute pack facts at package conformance	`004b`, `005a`	`done`	2026-09-27: `run_task_pack_conformance` in `operator-task-pack-service` takes each bound profile from a supplied asset bundle, requires its JCS v1 digest to be the pinned registration digest, digests every named asset itself (Workbench command profiles as whole validated documents, the patch policy and the thematic semantic-entry header by owner rules, other slots by JCS v1; Interface descriptors refuse as unsupported), takes the map and the Workbench VM-environment capabilities from their owners, and runs `derive_pack_facts` and `PackFacts::check`. A missing or malformed asset refuses without evidence; a mismatch records failing `operator-task-pack-facts-evidence.v1`. P085 domain conformance (`P085-046`) refuses the package's conformance report and every use of its activation until that evidence passes, and admission requires it to be current under the host map. Tests cover a correct pack, declared and omitted capabilities, a swapped policy, profile and command profile, a missing source, a missing map row, an unsupported descriptor and a later failing run. The daemon requires the domain; its P085 conformance route alone still refuses such packages, and `/v1/operator/extensions/task-packs/conformance` (`P094-006a`) carries the bundle end to end. Review regression coverage also rejects invalid schema/version/network and unknown command-profile fields before derivation; the full owner Schema Gate runs before the incomplete typed view.
`P094-006a`	Implement local binding, readiness, and inspection behind a store port	`004a`, `005a`	`done`	2026-09-27: `create_binding` fills the most restrictive safety defaults, publication off and the host profile digest, names missing choices (`local-binding/incomplete` with `missing/fields`), refuses a choice wider than the profile's ceiling, and treats an unequal binding under an existing ref as `local-binding/conflict`; pause and resume change only the state; `review_profile_change` returns a per-axis diff classified as narrowing, widening or substitution and accepts it in one step only when the binding still fits the new ceilings. Readiness is computed on read from the P085 entry, current pack-facts evidence under the host map, the operator authority and the binding, with one decisive blocker per root cause; execution stages whose owner adapters do not exist yet report the tabled blocker for that missing owner fact. Bindings and the verified copy of each accepted profile live behind `BindingStorePort`, implemented by the daemon as host-writable canonical files. The daemon exposes `/v1/operator/extensions/task-packs/bindings`, `…/bindings/state`, `…/bindings/profile-change` and `…/bindings/readiness`, and `…/conformance`, which reads the asset bundle from a host-admitted P085 import root without following links and runs the P085 runner only after the pack facts pass; every request and answer passes its `operator-task-*` contract, and refusals are `operator-task-refusal.v1`. Review regressions cover no-follow bounded storage and stored-schema checks, read-only previews, full identity/mode diffs, local deliberation ceiling acceptance, legacy-route refusal after passing conformance, and conformance-specific readiness blockers.
`P094-006b`	Back local bindings with P091	`006a`, P091 `003`/`004`	`done`	2026-10-06: P094-006b1–006b4 complete the scoped Unix binding vertical. The existing domain port consumes a bounded P091 source collection, exposes owner-scoped revisions/descriptors, refuses unequal duplicates, returns exact not-applied read-only proposals, and commits writable targets through the shared temporal single-file writer. Existing identities/counters are retained; migration is explicit no-op adoption. No other P091 owner/platform or whole-P094 acceptance claim.
`P094-006b1`	Acquire and explain the scoped binding collection	`006a`, P091 `003`/`004`	`done`	2026-10-06: configuration-core resolve_keyed_collection and daemon operator_task_pack_sources retain every equal contributor and exact source revision, validate LocalBinding at Schema Gate, reject unequal declarations and never materialize on reads. Eight named security fixtures cover scope, paths, sensitive losers/diffs, digest oracle and control dispatch.
`P094-006b2`	Commit binding revisions through the shared P091 writer	`006b1`, P091 `006`	`done`	2026-10-06: shared configuration_host::commit uses temporal-log intent/outcome facts, confined staging/rename/sync, a nonblocking writer lock and verified heads. Real subprocess interruption after intent, partial staging, rename and outcome plus old/new/third/no-op and quota/substitution tests pass. Outcome capacity is reserved; pending/conflicting targets are not consumed. General history archival remains P091.
`P094-006b3`	Adopt P091 behind binding operations	`006b2`	`done`	2026-10-06: BindingStorePort::commit_binding preserves current P085/revision gates and host counters. Sole exact host targets are writable; all other sources return operator-task-binding-proposal.v1 with not-applied and no second binding copy. Preview/adopt checks an exact five-minute P091 plan and current operator authority; recovery records bytes without overwrite or renewed authority. Profiles/assets/plans/patches/HIL/run stores are unchanged.
`P094-006b4`	Qualify scoped exposure and binding restart	`006b3`, P091 `005a`	`done`	2026-10-06: all eight named security fixtures pass before route/client exposure; the inventory checker requires each name and the bounded verification set requires nonzero tests. The 51 task-pack daemon tests include real P085 revocation and daemon restart; the subprocess commit suite proves partial-write/recovery without another effect. Four canonical contract families and positive/negative vectors, CLI source/maintenance commands and scoped EN/PL HOWTO are synchronized. P091 platform/general-adapter and whole-P094 scope remain open.
`P094-006c`	Commit binding changes under current operator authority	`006a`	`done`	2026-09-27, resolving review question Q-01 of `P094-006a` through Resolved Decisions 22 to 24. `operator-task-binding-create.v1`, `operator-task-binding-state.v1`, and an accepting `operator-task-profile-change.v1` name `operator/binding-ref`; the state and acceptance requests also name `local-binding/expected-digest`, and a review names neither and reports the current revision in its result. The service commits every change in one order – outcome check, P085 operator-binding verification through `ChangeAuthorityPort` (`operator/binding-lost`), revision comparison (`local-binding/revision-stale`), `operator-task-binding-change.v1` fact, binding write – and a change whose fact is not recorded does not take effect. The daemon verifies the operator binding with the same `exact_active_operator_binding_authority` check that gates P085 activation, under the process-wide mutation guard, and, at the original provisional checkpoint, stored each fact as a content-addressed file beside the binding. The 2026-10-06 P094-006b writer supersedes that duplicate store: the closed redacted attempt lives only in the shared intent and committed history derives from verified outcomes; legacy sidecars remain attempts. `operator-task-binding-emergency-pause.v1` on `/v1/operator/extensions/task-packs/bindings/emergency-pause`, behind the safe-mode route capability, pauses without operator authority and is recorded with the host-local actor. Tests cover recorded actors and revision chains, a lost operator binding that refuses every ordinary change while the emergency pause still stops the binding, a stale acceptance after a concurrent pause, a successor operator who configures without taking over the predecessor's activation, and a failed fact write; a daemon test drives the routes with a real operator binding before and after its revocation. The profile-change review still shares its route, and so its lifecycle capability, with acceptance; `P094-012` owns separating it. Review closeout: Decision 25 adds a host mutation revision to fence ABA, with legacy digest preservation, no-op and exhaustion tests. The mutation guard now also serializes operator-binding revocation, supersession and deletion; a concurrent-revocation regression pins that boundary. Failed binding writes retain only an attempt, never replay authority; transactional history remains P094-006b.
`P094-007`	Implement offer draft, signing, publication, and withdrawal reconciliation	`006a`	`done`	Decisions 37–38 and checkpoints `007a/b/c` are implemented. Activation never publishes. An authenticated operator approves an exact draft; ordinary Service Offer signing/publication commits it; revocation or pause closes local admission immediately and BDO/Replay Scheduler reconcile withdrawal. Local run `s13-1791156863-88b339` and physical run `s13-1791194095-ddff55` qualify the deployed publication/order/result path. The separate cached stale-order-after-revocation and fault matrix of `016` remain open.
`P094-008`	Resolve prepared systems, Workbench profiles, Interfaces, containment, and immutable assets	`003b`, `005a`, `018`, `019b`	`done`	2026-09-28: `P094-008a` to `P094-008d` are done; readiness checks the containment predicate at admission, and the per-step recheck with the same exported predicate belongs to the step fence of `P094-012`. Split into `P094-008a` to `P094-008d`, each useful alone. Together: exact image variant/prepared system, command/patch profiles, descriptor refs, scripts, fixtures, and acquisition refs resolve without fallback; the Workbench enforces patch policies and the `observation` effect mode; the containment predicate is checked at admission and before each step; substitution, unavailable inventory, wider runtime network, lost containment, or an environment impact class above `impact-class/max` refuses.
`P094-008a`	Keep verified assets and read Workbench and Sensorium Virt owner facts into readiness	`005b`, `018`, `019b`	`done`	2026-09-28. After a profile passes pack-fact conformance, the host keeps the verified document of every asset it names behind `TaskAssetPort`, compactly and content-addressed by slot and digest, before recording the passing evidence; readiness and runs resolve an asset only by exact slot digest and re-verify it with the same owner rule (`slot_digest`) on every read, and a missing asset is never substituted. `TaskEnvironmentPort` resolves `workspace/root/ref` and `workspace/backend/ref` (`sensorium-virt-backend:<backend/id>`) to the admitted backend's capability descriptor and image manifest: exactly one Workbench microVM root with that executor, and an enabled backend profile; nothing starts. `sensorium-virt-image-manifest.v1` gains the additive `guest/effect-modes`, which the image builder writes; absent means mutation only. Readiness now reads owner facts for four stages: environment (the admitted manifest is exactly the selected variant under the slot rule, else `environment/image-mismatch`; no environment, `environment/prepared-system-unavailable`; an `isolated` binding, `environment/not-contained`), effects (every command profile kept, else `workbench/command-profile-missing`; an observation-first profile or observation command needs a hardware-VM guest that enforces observation, else `workbench/effect-mode-missing`), verification (the verifier profile kept and an enforced observation, else `verifier/unavailable` or `verifier/effect-mode-missing`), and rollback (a hardware-VM backend with the `environment.destroy` disposer, else `rollback/unavailable`). Tests cover asset keeping and re-verification, six owner-fact scenarios with contract-valid evidence, Workbench root resolution, and the manifest field. Prepared-system binding, containment, network and impact class follow in `P094-008c`.
`P094-008b`	Enforce patch policies before staging	`008a`	`done`	2026-09-28. `PatchPolicy::admit_content` admits the complete resulting file of one staged write: the exact root and path must be a target admitting create or modify, the bytes UTF-8 within the target and policy byte bounds and the target line bound, and every line a full match of the target's anchored pattern (a final newline ends the last line); `admit_delete` admits a deletion. The Rust actuation companion exposes it as the bridge operation `patch-policy.admit`, answering the policy digest, the owner, group and mode the policy assigns, and the admitted operations. A Workbench `patch.stage` request may attach the policy pinned by `patch-policy/digest`; the Workbench admits the bytes before any reach the guest and refuses with `patch-outside-policy` or `patch-policy-invalid`; the guest's `target/existed` then selects `modify` or `create`, which the policy must admit; the receipt (`sensorium-workbench-patch-stage-result.v1`, additive fields) carries the digest and `patch/target`, and the digest joins the idempotent request. Readiness keeps effects blocked with `workbench/command-profile-missing` when the profile binds a patch policy the host does not keep, or names one without its digest. Tests cover target shape admission in the core, the bridge answer, five Workbench refusals before staging, the create/modify selection, idempotent conflict on a changed policy, and the readiness scenarios. No operation applies staged guest bytes yet; that apply must re-admit against the pinned policy and set exactly the assigned owner, group and mode.
`P094-008c`	Bind the prepared system and check containment	`008a`	`done`	2026-09-28. `sensorium-virt-prepared-system.v1` is registered as a Sensorium Virt owner contract (orbidocs schema, Schema Gate family, `PreparedSystem` with `validate_prepared_system` in `sensorium-virt-core`), keeping the exact shape the image builder already read and its `prepared-system:` refs; the builder's digest is exactly the Rust owner digest (SHA-256 over JCS v1), pinned by the same constant on both sides. `sensorium-virt-image-manifest.v1` gains the additive `prepared-system/digest`, which the image builder writes. Conformance digests the image-manifest and prepared-system slots by owner rules: the complete owner schema, then typed validation (a prepared system must name the slot ref), then the owner content address in the task-pack encoding; every image variant must bind exactly the profile's prepared system. The profile examples use `prepared-system:qmail-v1`. Readiness adds to the environment stage: the kept prepared system bound by the admitted manifest (else `environment/prepared-system-unavailable` or `environment/image-mismatch`), the Workbench root's operational impact class within `impact-class/max` (else `environment/impact-class-exceeded`), and the pure containment predicate `contained` (hardware VM, no writable host share, no credential injection, effective runtime network `none` offered by the backend, no Interface actuation, the `environment.destroy` disposer), else `environment/not-contained` with a `containment-breach:<name>` evidence ref. The predicate is exported for the step fence; run exclusivity stays with `P094-012`. Tests cover the owner type, the shared digest constant, builder path normalization, the manifest binding, conformance refusals (another or no prepared system, a foreign ref, a bad mode, a non-manifest, an explicit null), and every readiness blocker with contract-valid evidence.
`P094-008d`	Resolve Interface descriptors	`008a`	`done`	2026-09-28. Conformance digests Interface descriptors by owner rules instead of refusing them: an observation descriptor passes the complete `sensorium-interface-descriptor.v1` schema and `SensoriumInterfaceDescriptor::validate` under the host limits the Interface runtime uses, an actuation descriptor the `sensorium-interface-actuation-descriptor.v1` schema and its typed validation; each must carry the exact `interface/id` the profile names, is digested as SHA-256 over JCS v1 of the typed value, and contributes its access modes (`read`, `subscribe`, or `invoke`) as the owner source derivation reads. A passing profile keeps them like every other asset. Readiness blocks effects with `interface/grant-missing` for any observation descriptor until a grant adapter exists, and an actuation descriptor blocks the environment with `environment/not-contained` (`containment-breach:interface-actuation`, `P094-008c`). The conformance refusal `UnsupportedSource` is gone because no slot lacks an owner rule. A positive actuation-descriptor vector is added. Tests cover a passing profile with both descriptor kinds, both blockers, an observation-only profile, a foreign `interface/id` and a non-descriptor document.
`P094-009`	Implement the closed experiment-plan compiler and HIL boundary	`004b`, `008`	`done`	2026-09-28: `P094-009a` to `P094-009d` are done; the step fence that consumes approvals is `P094-012`, and the deliberation readiness adapter is `P094-020`. Prose/model output can only produce schema-valid candidates contained by the resolved plan. The host stamps digests, effect classes, and HIL requirements; every mutation reaches current HIL through the attention budget and owner authorization; arbitrary command strings, paths, endpoints, capability claims, HIL bypass, and classes outside the Version 1 scope refuse.
`P094-009a`	Compile candidates into immutable plans	`004b`, `008`	`done`	2026-09-28. `compile_plan` admits an untrusted candidate under the checked-in candidate contract and, in conjunction, the candidate schema the profile pins. That schema is compiled offline from the kept package asset: it may refer only to embedded contracts, and its patterns use the linear `regex` engine. Conformance now refuses a candidate schema that does not compile. Compilation requires every readiness stage a plan depends on except deliberation, which produces candidates, and publication. It rebuilds owner sources from kept assets. A declared observation counts as enforced only on a guest that enforces it. `derive_plan` stamps the plan under the effective HIL mode and the containment predicate. The plan ref is the content address of the candidate, profile and binding digests and the activation generation. Plans are inserted create-only, atomically; a different plan under the same ref is `plan/changed-replay`.
`P094-009b`	Admit patch artifacts before any question	`009a`	`done`	2026-09-28. `operator-task-patch.v1` is a closed patch written for exactly one patch policy: each file is either written as its complete resulting content or deleted. It is stored as `artifact:sha256:<base64url>`, bounded to 1 MiB of content in total. Compilation requires every patch a `patch` step names to be held and written for the step's policy. It admits every file with the Workbench owner's `PatchPolicy` rules and the policy's `patch/max-bytes` over the whole patch, else `workbench/patch-outside-policy`. The fixture candidate names the fixture patch by its real address.
`P094-009c`	Issue HIL requests and record operator decisions	`009a`	`done`	2026-09-28. Every plan step that requires HIL gets one immutable `operator-task-hil-request.v1`. It carries the decision material: the stamped step, the patch files with content digests, and the rollback mode. It is issued only for the binding revision the plan was compiled for, while that binding is enabled. The immutable request is stored before delivery through the P085 attention gate under `operator-task-step`, with its own grouping key. A create-only delivery receipt prevents repeated completed delivery; interrupted delivery retries the winning request with its original deadline and idempotent notification, including a grouped attention admission. Completed deferred/denied receipts are not retried automatically. `operator-task-hil-answer.v1` decides a request once, and only under a current operator binding. An expired request refuses with `hil/expired`, and a different second answer with `plan/changed-replay`. `step_approval` verifies the exact request/plan/generation/step and decision lineage, then gives the step fence `not-required`, `approved`, `pending`, `denied` or `expired`. Readiness degrades effects with `hil/attention-unavailable` when a covering budget is outside its window; a plan still compiles. Amended by `P094-010b` (2026-09-28): a request belongs to one admitted run. It carries `run/ref`, its ref is the content address of the run and the step, it derives plan and binding from the run's admission, and a concluded run issues no new request. `operator-task-hil-issue.v1` therefore names only `run/ref`, and `operator-task-hil-status.v1` reports it.
`P094-009d`	Store plans and expose plan and HIL routes	`009b`, `009c`	`done`	2026-09-28. The daemon file store keeps plans, patches, HIL requests, delivery receipts and decisions immutable. It files each under a hash of its ref and writes it create-only by linking a synced temporary file into place. Reads verify the contract and ref, and a patch must still hash to its address. Routes below `/v1/operator/extensions/task-packs/`: `POST patches`, `POST plans` (`operator-task-plan-compile.v1`), `GET plans?plan=`, `POST plans/hil` (`operator-task-hil-issue.v1` to `operator-task-hil-status.v1`), and `POST plans/hil/answer`. A shown HIL request becomes one high-priority operator notification keyed by its ref. The operator answers through the answer route; answering a P066 question directly is not wired yet.
`P094-010`	Implement verifier, rollback, refusal corpus, and Version 1 uncertain-outcome handling	`008`, `009`	`done`	2026-09-28: `P094-010a` to `P094-010e` are done in the task-pack service behind ports; the daemon adapter is `P094-021`. Verifier output is observation consumed by a host evaluator; missing checks and mutation refuse success; bounded verifier retry applies only in observation mode and the unchanged instance; destroy-and-recreate works after success, refusal, HIL denial, pause, and crash; an `unknown` step enters `rollback-pending`, terminalizes only after owner-confirmed destruction, is re-driven after restart, and is never repeated; refusal coverage of every registered code is recorded in the evidence, and every executable corpus case must refuse with its own code.
`P094-010a`	Record runs as append-only facts and admit them	`009`	`done`	2026-09-28. `operator-task-run-fact.v1` is one fact of one run at one sequence: `admitted`, `environment-allocated`, `step-started`, `step-outcome`, `verifier-evaluated`, `cancel-requested`, `concluded`, `destruction-confirmed`. `RunState` replays and admits each fact, so the store (`RunStorePort`, create-only per sequence) never holds a sequence the projection refuses; phases are `running`, `rollback-pending` and `terminal`. `admit_run` admits a stored plan only for the binding's current revision (`local-binding/revision-stale`) and activation generation (`package/generation-stale`) while the binding is ready for a run, and within `max/concurrent-runs` open runs (`run/budget-exhausted`); the run ref is the content address of the plan ref and a caller run key, so admission is idempotent. `request_cancel` is monotone. Follow-up review binds admission replay to the original binding and exact plan digest; an occupied transition sequence never grants execution ownership, even for identical bytes.
`P094-010b`	Drive runs one transition at a time behind a fence	`010a`	`done`	2026-09-28. `advance_run` performs at most one transition. Before any effect it rechecks the run gate (readiness except deliberation and publication, revision, generation) and the environment stage of the run's own instance; it allocates through `RunEnvironmentPort`, records `step-started` as the durable admission point before `StepExecutorPort` runs a step, and consults `step_approval` for HIL. A step in flight after a crash is recorded `unknown`, never repeated, and the run concludes `unknown`. HIL requests became run-bound (see `P094-009c`). The core refuses further work after a negative outcome or cancellation and refuses late step outcomes after conclusion.
`P094-010c`	Evaluate verifier observations on the host	`010b`	`done`	2026-09-28. `operator-task-verifier.v1` declares the checks a verifier must report, its time bound and `retry/max`; `operator-task-verifier-result.v1` is what one run observed, admitted in conjunction with the checked-in contract, the package's kept `verifier/result-schema` and the verifier ref. `judge_checks` requires every declared check exactly once (else `verifier/check-missing`); a timeout is retried up to `retry/max` (then `verifier/timeout`), a detected mutation refuses with `verifier/mutation-not-admitted` without retry, and no answer is `verifier/unavailable`. Each `operator-task-verifier-evaluation.v1` is stored create-only under its content address, and only a passed evaluation concludes a run `verified`. Conformance digests the verifier as a named contract. Recovery revalidates the evaluation schema and content address and binds it to the exact run, pinned verifier and stored result links.
`P094-010d`	Roll back by destruction and recover after restart	`010b`	`done`	2026-09-28. Every conclusion asks the environment owner to destroy the run's instance; a run is terminal only on owner confirmation (`destruction-confirmed`). `recover_runs` settles each interrupted run of a binding on its own from its facts alone: a step in flight concludes `unknown`, an unconfirmed destruction is requested again, and a failure is reported per run. A destruction unconfirmed for `DESTRUCTION_CONFIRMATION_BOUND` (ten minutes) blocks the rollback stage with `rollback/destroy-unconfirmed`, naming the run, so no further run is admitted and the fence stops runs in progress. Follow-up regression tests also cover a crash between recording a negative step outcome and its conclusion, and pending cancellation: both settle before plan lookup without further execution.
`P094-010e`	Run the refusal corpus in conformance	`010c`	`done`	2026-09-28. `operator-task-refusal-corpus.v1` lists up to 512 cases, each with a tabled code; a case with a candidate is executable. Conformance compiles each executable case under the most permissive host (contained, declared observations enforced) through the package candidate schema and derivation; a case refused with another code, or not refused, adds a `refusal-case` mismatch naming the case and fails the evidence. Cases without a candidate name refusals later layers prove. The evidence records `refusal-coverage {covered, uncovered}`, which never decides the result. A repeated case id refuses the corpus.
`P094-011`	Build the qmail task pack assets and local profile	`003a`, `003b`, `004b`	`done`	2026-09-29: `P094-011a` to `P094-011d` are done; the built image and its qualification in the guest are `P094-011e`. The pack lives in `node/tools/acceptance/story-013-qmail-task-pack/`. An author types no digest: `orbiplex-task-pack-author` derives every asset digest and capability list with `derive_bundle_facts` (the function conformance uses), the task-profile semantic entry, the inference-Flow registration and the P085 package, and writes a self-contained import root reproducibly. The pack ships the wrong qmail baseline and six command profiles with declared effect modes; observations include the verifier and its status mode, and mutations are the probe injection and `service qmail restart`. It also ships a patch policy for `locals`, `rcpthosts` and `defaultdomain`, a verifier with seven checks and a narrowed result schema, and a refusal corpus with the 13 Story 013 cases. The verifier is designed to judge relay with `qmail-smtpd` over stdin; host tests use a stand-in and reject both open-relay repairs. Independent review also rejects RCPT-only repairs and unrelated Maildir files, retains registered Flow documents in the export and validates the exported conformance request. The checked-in pack passes host conformance with its executable corpus cases. `tools/check-task-pack-domain-neutrality.py` shows the shared task-pack code names no domain. Signing is the operator's import signature (`P094-013`).
`P094-011e`	Build the qmail image and qualify the pack in the guest	`011`, `019b`, `021g`	`done`	2026-09-29, on Linux x86_64 with Cloud Hypervisor. Debian 13 ships no qmail, so `image/build_packages.py` in the pack builds notqmail 1.09 reproducibly and without root from the release tarball, pinned by digest and checked against a signature by the pinned signer, laid out as Debian's qmail was (`/var/lib/qmail`, `/etc/qmail`, `qmail-*` in `/usr/sbin`, `qmail.service`), next to the Debian `acl` package pinned by digest. The Cloud Hypervisor builder gains domain-neutral offline packages, a prepared system bound by the image manifest, a provision script and `guest/effect-modes`. The pack provisions the probe Maildir owned by the alias user with a default ACL, because qmail-local writes with umask 077, and declares only the `x86_64` Cloud Hypervisor variant. Probe injection is one SMTP session to the loopback listener, since the guest agent's no-new-privileges keeps `qmail-queue` from its setuid queue user. The domain-neutral `cloud_hypervisor_declared_guest_steps` test runs declared steps in one real guest and reports verbatim; the pack's `qualify_image.py` judges the report. The verifier fails the baseline and both open-relay states, and after the repair a fresh probe reaches the empty Maildir, all seven checks pass, systemd reports qmail live and the listener greets; every observation ran under the enforced sandbox. The author tool binds the built manifest. The passing summary is retained in the pack's `reports/`. The run engine path is `P094-013`. Independent follow-up tightens the qualifier's step-digest and ordered-result admission, rejects failed Maildir reads and duplicate verifier checks, and validates absent paths after provisioning. After these fixes the image was rebuilt with the corrected builder (manifest `sha256:19fc725a…`) and the revised qualifier passed all 20 steps in a real KVM guest (steps `sha256:06dac2c7…`, report `sha256:50e6c0c2…`); the retained summary records that run.
`P094-011f`	Build the vfkit arm64 image variant	`011e`	`done`	2026-10-04: the pinned offline arm64 builder creates Ubuntu 24.04/vfkit with the same prepared system, signed notqmail 1.09 and pinned ACL package. The first native failure exposed a production bootstrap defect: creating protocol state changed the mode of the existing qmail workspace mount. The runtime now preserves the image-owned workspace mode, with reaching regressions; no qmail-specific permission workaround is added. Fresh clean-source run `s13-1791110299-dcd341` passes all twenty image/open-relay steps, three timeout/exit/recovery observations and the actual host retry loop with unchanged 1,000 ms commands; all three native allocations are disposed. The profile now carries both admitted image variants. Exact commit/tree and an immutable acceptance ref are retained in `node:tools/acceptance/story-013-qmail-task-pack/reports/2026-10-04.image-qualification.macos-arm64.json`, with a verified private source bundle. Existing Linux/x86_64 reports remain unchanged. This is native image/mechanism evidence, not real-model deliberation. Review closeout: the fresh image proof is s13-1791134305-b2005e in `node:tools/acceptance/story-013-qmail-task-pack/reports/2026-10-04.review.image-qualification.macos-arm64.json`, on the same final clean source as the repeated pause and MLX profiles; no historical assertion is enriched.
`P094-012`	Add bounded operator API, CLI, and UI	`006a`, `006c`; runs `010`	`done`	2026-09-29, without publication (`P094-012b`). Read surfaces: `operator-task-binding-list.v1` (one row per binding with its decisive blocker and next action) and `operator-task-binding-inspection.v1` (each narrowing axis with its effective value and the layer that decided it, drill-down refs, the latest runs), projected in the pure core from the binding, its accepted profile, readiness and run facts and admitted by Schema Gate; `GET .../task-packs/bindings`, `.../bindings/inspection` and a read of a run's issued HIL requests with their decision material that issues and delivers nothing (`GET .../plans/hil`). The CLI `orbiplex-node-task-packs` is a thin client of these routes through the node's shared HTTP surface: it checks every request against its contract before sending, reads the revision before a pause, resume or profile acceptance and sends it, asks a separate `--confirm-widening AXIS` for each widened axis of a new binding, offers the emergency pause as its own command, renders refusals as their code and next action, and keeps no configuration. Node UI adds `/operator/task-packs`: the list, the drill-down with effective values and their deciders, pause and resume at the read revision, the emergency stop as a separate action, and a run page whose questions show step, effect class, patch targets and digests and rollback, each answered on its own. Every view projects the structured answer; no raw store is exposed. Review fixes (2026-09-30): the UI sends the revision the page showed, never a fresh read, so a binding changed or stopped after display refuses the change; UI and CLI show each question's exact action (profile and digest, quoted arguments, service action, operation, patch).
`P094-012b`	Complete the operator surfaces	`012`, `007`	`done`	Binding creation and profile-change acceptance in Node UI, with each widening confirmed separately; API/CLI/UI draft, publication, withdrawal and order inspection use the same owner contracts. Client construction tests and the deployed operator API flow in `s13-1791194095-ddff55` pass. This is not a claim of a manual browser acceptance session.
`P094-013`	Run local acceptance	`010`, `011`, `011e`, `012`, `021g`, `022b`, `023d3`, P093 local package-capability invocation	`done`	2026-10-03: a fresh Linux x86_64/KVM aggregate passes all fourteen checks; retained evidence is `node:tools/acceptance/story-013-qmail-task-pack/reports/2026-10-03.local-acceptance.linux-x86_64.json`, run `s13-1791061343-4fa7fe`. Corpus, Agent and managed Inquirium execute the real Room/Flow path with deterministic evidence-reactive inference; every VM effect uses the production run engine, closed profiles, portable-root mapping and conservative each-step HIL. The fresh positive passage rejects the unsafe proposal before any run, obtains an independently reviewed observation and its signed failed verification, then repairs a new VM only after that evidence reaches the Solver/Reviewer; all seven real qmail checks pass and the run is destroyed. A separate fresh daemon/Room/Agent/VM passage denies mutation HIL, retains `hil/denied` and confirms rollback without applying the repair. Each passage spends exactly six passages, three cycles and two runs; restart and exact replay retain publication and counters without new inference. Clean install/conformance/activation/default binding, binding pause/resume before any run (not active-run pause), unadmitted profile substitution and package revocation are also verified. Separate native tests prove detached-descendant quiescence on timeout, exit 124 as a non-timeout, recovery in the same VM, actual host verifier retry recovery/exhaustion at exactly two attempts each in one VM, and all twenty independent image/open-relay steps. Final promotion follows owned-cgroup quiescence and generated-disk disposal; original images, signed evidence and a private Git bundle of the tested source remain. The pinned current guest/image replaces no historical manifest or qualification. This closes Story 013's deterministic-inference/real-execution class, not real-model `013b`, federation `016`, autonomous discovery, whole-proposal completion or alpha readiness. Follow-up review on 2026-10-04 retains the exact source under `refs/acceptance/s13-1791061343-4fa7fe` and regenerates metadata with the repository annotator. The historical native retry proves the loop and attempt count, not enforcement of its nominal 30-second budget. A separate fresh V2 aggregate passed on 2026-10-04: `s13-1791075637-44213c`, retained in `node:tools/acceptance/story-013-qmail-task-pack/reports/2026-10-04.local-acceptance.linux-x86_64.json`. All fourteen checks pass with unchanged 1,000 ms admitted retry budgets and four run-bound destruction confirmations. Clean tested source commit `6f0d2aaec14f14e1a2b187629473a2084e570ce6` survives technical-branch removal under `refs/acceptance/s13-1791075637-44213c` and a verified private source bundle; owned processes quiesced before two disk copies (6 GiB) were reclaimed, and the remote checkout is clean again. The historical V1 report has not been promoted to these new assertions; active-run pause is separately open as `013c`.
`P094-013b`	Run the local profile with a real model	`013`, `011f`, `013b1`	`done`	2026-10-04: clean-source vfkit/MLX run `s13-1791125994-b84cc3` passes the local real-model profile. Separate fresh Solver/Reviewer Agents and sessions share one admitted managed MLX runtime. The Solver authors exact repair text after a reviewed observation and actual failed verifier; the independent Reviewer reads the current candidate and verified attachments plus execution evidence. The positive passage passes all seven qmail checks. A fresh second passage refuses mutation with `hil/denied` before any mutation starts; both retain exact restart/publication/budget replay, package revocation and confirmed per-run plus template destruction. Each passage uses two cycles, four Agent passages and two native runs, within unchanged four-cycle/eight-passage ceilings; two startup inferences are recorded separately. Report admission verifies model/runtime bytes, the prepared image, exact Flow and clean source before promotion. The report `node:tools/acceptance/story-013-qmail-task-pack/reports/2026-10-04.real-mlx.macos-arm64.json` pins commit `a1a034802aa4e734e905f78a0e16e2750664d3f1`, tree `a504f01162be6dba3a9f8e6649c169c8161af519` and an immutable acceptance ref; the complete-history private source bundle verifies. Safety traps remain separately qualified refusal cases, not an instruction that the real Solver invent one. This is local real-model/native evidence, not federation or whole-proposal/alpha completion. Review closeout: complete fresh run s13-1791134566-6ed803 passes in 404.41 seconds, with all seven exact verifier names and one durable producer charge for every one of eight fresh Agents. Their token/cost/time/step budgets remain unchanged on exact replay, daemon restart, restarted replay and completion restart. The replay checkpoint follows durable experiment admission and confirmed allocation, with the first each-step HIL still pending and no guest step started. Current evidence is `node:tools/acceptance/story-013-qmail-task-pack/reports/2026-10-04.review.real-mlx.macos-arm64.json`, source 05bd494b5521b52417da6fbec82a7eda141cb2c3 / tree ef4bd36b9c6b791797654d180ae59b92f5c522e9, retained GC ref and verified private bundle; image and pause use that exact source too. Unknown price is not measured free service; the nonzero-cost and missing-usage fixture proofs are separate. Pending proposal turn-witness recovery remains 023b1.
`P094-013c`	Qualify pause of an active native run	`013`, `012`	`done`	2026-10-04: fresh native vfkit run `s13-1791110411-367b28` pauses a live VM after a completed observation while the next mutation awaits HIL. The current-use fence retains `refused/local-binding/paused`, unchanged completed steps and the instance's destruction confirmation, not invented cancellation or unknown execution. Resume and daemon restart/replay preserve the exact run; the retained run journal proves one admission, and a stale plan refuses with `local-binding/revision-stale`. Workbench also confirms disposal of the template environment before promotion. The source commit/tree and immutable acceptance ref are retained in `node:tools/acceptance/story-013-qmail-task-pack/reports/2026-10-04.active-pause.macos-arm64.json`, with a verified private source bundle. This is active-run mechanism evidence, distinct from binding-only pause, unknown in-flight crash recovery, real-model deliberation and federation. Review closeout: fresh active-pause run s13-1791134416-bac780 repeats the proof on the same final source as image and MLX, retained in `node:tools/acceptance/story-013-qmail-task-pack/reports/2026-10-04.review.active-pause.macos-arm64.json`; the historical report remains unchanged.
`P094-013b1`	Admit typed Solver-authored patch material at candidate publication	`003a`, `009`, `022b`, `023b`	`done`	2026-10-04 (Decision 30): the closed bounded draft admits exactly one binary/deletion `patch` or write-only UTF-8 `patch/text` representation per exact step-local attachment. The existing patch owner mechanically encodes exact text, preserves Unicode/line endings, validates the shared decoded byte budget and derives refs before retention. Candidate publication binds the normalized inert material to the exact retained Agent product, checks quota before storage and exposes only authored ref/size bindings; independent review receives verified contents. Regressions cover malformed/oversized and both/neither forms, shared budgets, substituted/missing refs, quota and commit failures, publication authority and exact restart/replay. Clean-source real-model run `s13-1791125994-b84cc3` independently verifies model-authored repair, not selection of an operator-prepublished expected patch. No shell, direct Workbench authority or host-authored repair is added; compilation, current authority and HIL remain mandatory. Review closeout: material now commits in the publication owner's one SQLite transaction, without filesystem writes inside it, and cascades with publication retention. Compilation, execution, review and HIL share the read-only published-patch port; the reaching HIL regression uses no manual patch copy. The UTF-8 projection is verified end to end, the draft has five canonical negative vectors, and fresh real MLX run s13-1791134566-6ed803 proves authored material under the final receipt guard. Ordered steps may revisit a target; each patch's targets remain unique.
`P094-014`	Publish operator HOWTO and troubleshooting guidance	`013`, `016`	`done`	2026-10-07: complete Node EN/PL walkthroughs cover the ten implemented preparation/admission/HIL/verification/recovery/withdrawal stages. Actual effect-free CLI parsing verifies identical examples in both languages. Canonical HOWTO indexes link to those owner-adjacent guides; current authority, not-applied proposals, journal capacity and unsupported relay migration stay explicit. No invented installer, signing consent or retarget action is documented.
`P094-015`	Review, ledger, solution, and readiness synchronization	`014`	`partial`	2026-10-07: the scoped completion gate, per-piece review, HOWTO and ledger/solution/readiness synchronization are implemented. Exact owner tests and independently requalified historical native/physical reports are distinct. Whole-proposal promotion still needs an explicit acceptance/scope decision; P094-023e and P094-007b2 remain open, not silently deferred. The alpha-node proposal-wide blocker is unchanged.
`P094-015a`	Execute the Story 013 owner-refusal inventory	`013`, `016`	`done`	2026-10-07: node:docs/task-pack-refusal-inventory.v1.json maps all thirteen stable Story cases, twenty-six compound variants and every corpus entry to twenty-two exact owner proof identities. The bounded node:tools/check-task-pack-refusals.py gate requires passed non-ignored proofs and unchanged actual working-source digests, twenty-six exact post-assertion variant/outcome markers, plus shell-aware CLI HOWTO and registered HTTP method/path checks and separately requalified original market V3, active-pause and interruption V2 reports. Fifteen negative-control tests reject missing/renamed/zero-hit/substituted proof or source evidence. All current owner tests use scripted ports. The three native/physical reports predate P094-006b and do not qualify native composition with the P091 binding store. Retained qualification requires clean committed sources with Git-style executable-bit hashing; CI pins its canonical docs revision. Mechanism doubles do not claim new native/model runs, accounting or proposal adoption.
`P094-014a`	Publish and check the complete EN/PL operator walkthrough	`014`	`done`	2026-10-07: node:docs/operations/TASK-PACKS.md and TASK-PACKS.md reuse current package, binding, Corpus, Workbench and market API/CLI. Thirteen CLI tests include effect-free equality/parsing of both walkthroughs. Refusal next actions cover current authority, unknown/disposal and independent readback; binding history rotation and relay retarget/reopen remain unsupported. Review corrects the older guide's CLI name and GET recipe method.
`P094-016`	Run multi-node publication acceptance	`007`, `013`	`done`	Review closeout 2026-10-06: fixture `s13-1791237370-0f1a9e` and MLX `s13-1791236017-c73bf3` pass V3 on two physical hosts and the same retained source `210111be`. HTTPS/peer AD/vfkit, exact signed delivery, cached-order refusal, pinned withdrawal recovery, owner-measured zero resync and cleanup pass. `016b4` closes the evidence-label/measurement review; classes remain separate. Whole P094, unknown in-flight VM recovery and alpha remain separate.
`P094-017`	Admit effects outside a contained environment	`015`	`deferred`	Uncontained steps, including Interface actuation, are mapped to P080 classes (`transactional-withheld`, `compensatable`, `irreversible-external`) through owner sources and admitted only with the P080 recovery contract, P093 outcome and reconciliation semantics, and crash tests at every admission point.
`P094-019a`	Add the command-profile effect mode to the Workbench contract	`001`	`done`	2026-09-26: `sensorium-command-profile.v1` gained an optional `effect/mode: observation \\| mutation` in place (v1 was an unreleased draft), absent meaning `mutation`; `CommandProfile::declared_effect_mode` reads it, with a qmail observation vector and a negative vector. The declaration alone never makes a step an observation. Mirrored in P071 Phase 6.
`P094-019b`	Enforce the Workbench command-profile effect mode	`019a`	`done`	2026-09-28. The Workbench guest enforces a declared observation in two layers instead of trusting it. `spawn-process` carries `effect/mode: observation` with 1 to 8 workspace-relative `observation/roots` (`sensorium-virt.host.request.v1`); `orbiplex-workbench-guest` re-executes itself as a sandbox helper that enters new mount, IPC, network and UTS namespaces, remounts every mount read-only, adds private scratch and an empty read-only `/run`, sets `no_new_privs` and drops to uid and gid 65534 before `exec`, and it digests the declared roots before and after the step. A change refuses the step as `observation-effect-detected` with guest-execution evidence, taints the guest, and makes the host destroy the environment through `environment.destroy` (`P094-018`); a non-Linux guest refuses observation as `effect-mode-unenforceable` and a failed sandbox step as `observation-sandbox-failed`, both before anything runs. The refusal fixture is the real-vfkit deployment check `observation-enforced` (18 of 18 passed): on the pinned GNU/Linux guest an observation runs as uid 65534 with an empty `/run`, a write into a world-writable directory fails with `Read-only file system`, and the file never exists. Unit tests cover detection, taint, metadata and link handling, the refusal off Linux, and the host's destruction decision. `open-pty` stays a mutation, and reading this evidence into readiness belongs to `P094-008`.
`P094-020`	Read deliberation owner facts into readiness	`009`	`done`	2026-09-29. The deliberation stage is ready when a deliberation can start now; no Agent needs to exist, since Agent inference-Flow bindings belong to the session an operator starts. The pure `deliberation_readiness` requires the binding's package to register exactly the profile's Flow with exactly its agent policy, the P085 use fence to admit the Flow now (safe mode, package digest, activation generation, current operator binding, compatibility) and the effective runtime to be routable, and cites the Flow and the agent policy. An inference choice the registration does not admit is the binding's own `local-binding/incomplete` or `local-binding/outside-package-ceiling`, so it also blocks runs; an unusable Flow blocks only deliberation, and plan compilation still does not depend on it. `DeliberationOwnerPort` reads the owners; the daemon's `HostDeliberation` uses the same registration fence as an Agent's packaged Flow binding, now factored out of `ensure_inference_flow_use_at`, and the model runtime host's routable runtimes. Model quality and the remaining Agent and Inquirium budgets stay use-time facts.
`P094-021`	Adapt the run engine in the daemon	`010`, `019b`	`done`	2026-09-28: `P094-021a` to `P094-021f` are done. The owner operations come first, then the daemon. Runs execute through the Workbench in their own microVM instance, a background worker drives them off the request path, and restart recovery waits for older workers through a store lock. A concurrent test proves that recovery never reads a live step as interrupted. The end-to-end run on a real VM with the qmail image is acceptance evidence for `P094-013`. Decision 26 introduces digest-bound `workspace/profile/root-ref`, retained and fenced by the Workbench instance. The verifier retries only `observation-timeout-quiesced` with private helper proof, reaped PID namespace and unchanged roots; missing proof remains unknown. The fresh P094-013 aggregate qualifies that newer supervisor on Linux/KVM (2026-10-03).
`P094-021a`	Apply staged patches in the guest	`008b`	`done`	2026-09-28. The Sensorium Virt guest operation `patch-apply` (`sensorium-virt.host.request.v1`) takes 1 to 64 entries: a write of staged bytes with the owner, group and mode its policy assigns, or a deletion. It admits every entry before the first change: the stage of exactly that path, digest and length, a contained target, an existing owner and group, and a mode without special bits. It then installs each write through a synced temporary file and a rename, resolving each target again just before it changes. A refusal changed nothing; a failure after a change is `patch-apply-partial`, and the environment must be destroyed.
`P094-021b`	Run structured commands and install patches through the Workbench	`021a`	`done`	2026-09-28. The actuation companion's `command-profile.admit` admits an argv against a command profile pinned by digest and answers the owner's effect mode, timeout and output bound. The Workbench's `process/run` runs it through the guest `spawn-process` operation. A declared observation runs as a guest-enforced observation of the workspace with a plain grant; a mutation needs an operator-confirmed grant; a timeout that does not fit the host channel is refused. `patch/install` turns stages admitted under the pinned policy into one `patch-apply`. Answers are `completed`/`applied`, `refused` or `unknown` (`sensorium-workbench-process-run-result.v1`, `sensorium-workbench-patch-install-result.v1`) and are replayed under their idempotency key.
`P094-021c`	Allocate one Workbench instance per run	`021b`	`done`	2026-09-28. `environment/allocate` builds the microVM instance of one run from a configured root, keyed by instance key; its root ref is a content address, so a Workbench restart re-binds the live VM through the host's idempotent allocation. The store records an instance as `allocating` before its VM starts, so a failed start can still be torn down; one a restart cannot re-bind is `unbound`. A closed instance is never allocated again under its key. `environment/instance-status` describes an instance by key alone (`sensorium-workbench-instance.v1`). 2026-10-03 local qualification fixes the daemon's configured-root-only admission: the Workbench carries an `instance/source` identity witness, Rust recomputes the derived root and replay key, and admission still requires the original configured template, backend, exact limits and operational context. Missing or substituted witnesses refuse; the witness is retained across Workbench restart and confers no authority. Review on 2026-10-04 adopts Decision 27: tuple members use the same 256-character bound and Unicode/control JCS vectors; an operator-owned per-template `instances/max` (default 1, range 1–64) is checked under each backend broker's allocation lock. Concurrent allocation, full-capacity replay, restart and release-after-destruction tests pass for both vfkit and Cloud Hypervisor.
`P094-021d`	Serialize run operations and drive runs in the background	`010`	`done`	2026-09-28. `RunLocks` in the service gives one lock per run and one per binding. `recover_runs` reads and settles each run under its lock, so it never sees a live step in flight; a concurrent test with real recovery proves it, and it fails without the lock. The daemon's `RunWorker` holds an exclusive `flock` on the run store for its lifetime and recovers every binding first, retrying until that succeeds. It then drives each woken run until the run waits: HIL is rechecked for expiry, rollback and errors are retried after a delay, and a run has at most one pending look.
`P094-021e`	Implement the run ports over the Workbench	`021b`, `021c`, `021d`	`done`	2026-09-28. `WorkbenchRuns` implements the environment, step executor and verifier ports over the Workbench channel. Every answer is admitted by its Schema Gate family. Commands run `[executable, fixed_args..., arguments...]` of their kept profile, and service control appends its action. Patches are staged per file and installed once. Workbench refusals map to tabled codes through a data table; answered unknowns, detected observation effects and lost channels stay unknown. Destruction of an instance never allocated is confirmed. The daemon store keeps verifier evaluations create-only under their content address.
`P094-021f`	Expose run routes and start the worker with the daemon	`021e`	`done`	2026-09-28. `POST runs` (`operator-task-run-admit.v1`), `POST runs/cancel` (`operator-task-run-cancel.v1`) and `GET runs?run=` answer `operator-task-run-status.v1`. Admission holds the binding's lock and cancellation the run's; both wake the worker, and an answered HIL request wakes its run. No route advances a run, and without a worker no run is admitted. The daemon starts the worker with its host owners; when a step waits, the worker issues its HIL request. A route test shows a cancelled run concluded by the worker and left rollback-pending while no Workbench can destroy its instance.
`P094-022a`	Register the Corpus contracts of task-pack experiments	`009`, P069	`done`	2026-09-30. Canonical `corpus-reasoning-experiment-proposal.v2`, `corpus-reasoning-experiment-review.v4`, `corpus-reasoning-chair-experiment-decision.v2` and `corpus-experiment-task-pack-execution.v1`, synced and registered in Schema Gate, with typed DTOs in `corpus-core`. The pure `resolve_corpus_typed_experiment_gate` admits exactly the reviewed candidate with its target, and `validate_task_pack_execution_relation` requires a record to execute exactly the admitted proposal, review and decision. Each negative vector goes through the gate that owns it: the schema rejects a candidate of another type, a missing target, another executor, a replacement and outcomes without their facts (16 vectors); the record's own validation rejects evidence of another instance; the relation gate blocks a review of other bytes, an approval carried over to a corrected candidate and a decision over another review, each of which is sound alone. Fixtures are signed by a generator test and verified against it.
`P094-022b`	Execute admitted Corpus experiments as task-pack runs	`022a`, `010`, `021`	`done`	2026-09-30. A candidate is published into the Room from an Agent passage of its author's retained turn (`POST /v1/corpus/task-pack-candidates`). Admission (`POST /v1/corpus/rounds/{query}/task-pack-experiments`) selects the executor by artifact type and mode through host ceilings, with no fallback to P083. It checks the proposal against a current Implementer turn and the review against a current Reviewer turn, with current membership and invite-bound origins; the Chair is the Room's. The typed gate must admit exactly the reviewed candidate, which the proposal's own turn published. The chain and the first handoff fact are stored in one transaction. The handoff (`TaskPackHandoff` in `corpus-core`) records plan, run, execution record and publication at fixed positions. A retry compiles nothing already compiled and admits nothing already admitted: one run key per proposal. A P094 refusal before the run records nothing and resumes. A running run is only awaited; an `unknown` conclusion is recorded as unknown and never run again; after the record, only the publication is retried. The run worker's observer takes a terminal run on to its record, and after recovery it resumes only handoffs whose run exists. Step evidence is the Workbench's own answer, kept by content; the result carries its `deliberation` links and is kept by content. The host-signed `corpus-experiment-task-pack-execution.v1` is a Room fact readable by current members with `observe` (`GET .../task-pack-executions`, `.../task-pack-artifacts`). The contract now requires `result/digest` for every recorded run and a code only for `refused`. Small tests cover every interruption point, the negative verdict, the preserved failure codes and a changed target. Review fixes (2026-09-30): the candidate comes from a committed Agent product verified through its Corpus inference-Flow binding; recovery reconciles a run admitted before a crash and needs no authority, while new execution steps need a current one; historical records use the admission's chain validator; candidate bytes and their publication commit together within per-turn, per-query and byte limits, with retention for unreferenced publications; the HTTP envelopes are contracts (`corpus-task-pack-*`) and appear in the API inventory.
`P094-023a`	Bind explicit evidence input to passages	`022b`, P069, P071	`done`	2026-09-30. `POST /v1/corpus/rounds/{query}/passage-evidence` fixes a `corpus-passage-evidence-manifest.v1`: items by exact ref and digest (`latest` is refused by the contract), each published in the query or named by a published record, read as the Corpus inference-Flow binding's participant (current membership with `observe`), no wider in class than the binding allows, rendered by projection `corpus-task-pack-evidence` revision 1 (framed as untrusted data, `*/base64` output shown as text, nothing cut: a required item over the limit refuses, an optional one is named as left out), and kept by content address together with the manifest. The passage request names the manifest in `metadata["corpus/evidence-manifest"]`, which `input/digest` covers; only a manifest this host made for exactly the passage's current binding, query, Room and reader resolves. At invocation the host re-checks the reader, requires the passage input and the actual request to be at least as restrictive as the evidence (the rule layer selection uses), verifies the kept content against the manifest, and adds the content as a required prompt layer in the user role with an exact role binding, never promoted to an instruction role. Only after the actor and passage are admitted does it record `corpus-passage-evidence-binding.v1`, before the model runs; a replay must find the same binding and a second manifest for the passage is a conflict. Decoded output never replaces a field of the same name. Manifests are bounded per query and overall, and unbound ones are pruned after retention. `GET /v1/corpus/passage-evidence?passage=` shows the binding and manifest. Proposal and review history become evidence items with `023b`.
`P094-023e`	Carry a neutral passage input manifest in the Agent contract	`023a`	`in-progress`	The approved 2026-10-07 continuation implements `agent.passage-input-manifest.v1` without Room/task-pack vocabulary, durable passage-to-manifest binding and Corpus references to that same manifest. Core, Schema Gate and restart/substitution/no-extra-charge regressions pass. Composed process and guided operator qualification remain in progress; P071 and P083 are consumers, not authority owners.
`P094-023b`	Build Corpus envelopes from committed products	`022a`, `022b`, P069	`done`	2026-09-30. Three host adapters build, sign and record Room facts on the participant's own node. `POST .../task-pack-proposals` builds a proposal v2 from the solver's candidate publication (this node is the author's; a current Implementer role on the retained turn; the publication's Corpus inference-Flow binding is current). `POST .../task-pack-reviews` builds a review v4 from the reviewer's committed product, whose content is a `corpus-task-pack-review-verdict.v1`: the passage belongs to the named reviewer turn, the Reviewer role is current, and the passage was bound before inference to a review target (the proposal's ref and digest and the candidate's digest, fixed in its evidence manifest, with the candidate a required item), which must be exactly the proposal under review; the manifest digest becomes `evidence-state/digest`. `POST .../task-pack-chair-decisions` builds a decision v2 from an explicit decision of a current local operator binding on the node that owns the round and holds the Room's Chair; the decision closes the chain and grants no HIL. The host derives author, reviewer, Chair, signer, candidate, class and idempotency from admitted facts, and execution admission requires the current Flow binding, while the signed decision window narrows independently to role, membership, Room policy and answered document validity (2026-10-08 operator decision). Each fact is recorded under an identity key, and a retry answers the recorded fact only for the same query, provenance and intent, compared in the write transaction, so a racing writer with another intent gets a conflict; a Chair decides once per review, and the operator authority gate spans the check and the commit. Evidence items gain `candidate`, `proposal`, `review` and `decision`, which gives the solver the history of proposals and refusals. Adapters run on the node that holds the round; remote participants wait for the cross-node Room relay.
`P094-023b1`	Retain the minimal admitted Room-turn witness for pending proposal admission across restart	`023b`, `023a`, P070	`done`	2026-10-05: `023b1a/b` close the failed pre-admission boundary exposed on 2026-10-04. The host commits a minimal exact query/Room/turn/author/class/digest witness atomically with the observation, with 8 KiB per witness, 256 per Room, 4,096 per Node and a fixed audit horizon ending 24 hours after the admitted Room deadline. Missing, substituted, conflicting, expired, capacity and partial-commit regressions pass. The deterministic Room proof and clean-source real-MLX/vfkit local market run `s13-1791156863-88b339` restart after signed proposal/review but before experiment admission, with exact replay and no additional inference, publication or charge. Current operator, participant, package and use authority recheck independently; no live session, expired lease or execution authority is recreated. This is the minimal task-profile evidence seam, not a general durable Room history.
`P094-023c`	Drive the bounded experiment loop from the requester's Flow	`023a`, `023b`	`done`	2026-09-30. The loop the requester's Flow drives is an append-only Corpus log per query on the node that owns the round (`task_pack_loop` in `corpus-core`, contract `corpus-task-pack-loop.v1`): opening, charged passages, opened cycles, admitted runs, conclusions, renewals and cancellation. The host enforces it at the natural transitions, each charge under one key so a replay spends nothing: a claimed passage, named by its Agent and passage ref, spends `max/passages` and its role's counter (implementer → solver, reviewer → reviewer; the role comes from the binding's role assignment), and a retry must be the same charge; a signed proposal is recorded together with its cycle in one transaction, so a proposal the loop refuses is never kept; admission spends the run (and a cycle signed elsewhere) and requires the loop, which must still be current even on a retry. Each new handoff step (compiling, admitting a run) checks the loop again and holds a fence against cancellation until its fact is recorded. Renewals are bounded (64), so a loop holds at most 1366 facts. Every loop transaction first concludes admitted runs whose execution is published. Limits are the meet of the profile's `deliberation.limits`, the binding's and the host caps, runs also capped by experiments per round; `deliberation.limits` is revised with optional `max/cycles`, `max/solver-passages` and `max/reviewer-passages`. The deadline is one wall time from the opening, covers human waiting, and moves only by an operator's renewal of at most one wall time. `verified`, `unknown` and the terminal safety refusals stop the loop; `verification-failed`, `cancelled`, `hil/denied` and other refusals do not; an exhausted counter or a passed deadline refuses the next step. Routes open, renew, cancel and read the loop, each as a current local operator binding under the authority guard. The executable Flow that drives it and the qmail pack's per-role limits are `023d`.
`P094-023d`	Ship executable deliberation documents and the deterministic inference fixture	`011`, `020`, `023c`	`done`	2026-10-03: `023d1` to `023d3` are complete: executable package step documents and bounded host grants, managed evidence-reactive inference, and the live local fresh-Agent Solver/Reviewer sequence. Host-normalized requests reproduce the passage and binding digests. The initial two-Agent runtime feasibility proof is superseded by the process evidence of `023d3b`; real VM, real-model and federated acceptance remain separately scoped to `013`, `013b` and `016`.
`P094-023d1`	Expose Corpus task-pack steps to the pack's Flow	`023c`	`done`	2026-10-01. Host capabilities `corpus.task-pack.*`: position read, evidence preparation, candidate publication, proposal and review authoring (participant steps, bound to the caller's exact turn, Agent and binding) and experiment admission (a coordinator step for a closed chain; it grants no HIL and no Workbench access). A new grant family bounds a Flow to its pack's task profile; each call additionally checks the package's current activation and generation, the profile digest and the local binding, the query, Room, participant and binding, and the role the operation requires. The Chair decision and opening, renewing and cancelling the loop stay operator acts. The position projection names the phase with exact fact refs, counters, deadline and the reason for waiting or blocking, and tells waiting (for the Chair or a run), blocked (exhausted counters or an elapsed deadline; renewal moves only the deadline and replenishes no counter) and stopped apart; it carries no prompt or artifact content. JSON-e helper `sha256_jcs_b64u` (the shared JCS v1 primitive; `sha256_json` unchanged). Built: six registered capabilities and the `corpus_task_pack_grants` family; the step envelope `corpus-task-pack-step.request.v1` with a typed participant or coordinator context; `corpus-task-pack-chain.admit.request.v1`, by which the host assembles a recorded, closed chain from its own documents; and `corpus-task-pack-position.v1`, whose evidence selections are bounded to one preparation, keeping every required item and counting the optional ones left out. Each call checks, in order: the envelope, the static pairing of operation and context, the operator's loop, the P094 gate (current activation and generation, unblocked package and binding stages, the profile the grant names), the participant's binding, turn, Agent and role and that the Flow bound the Agent, and that the operation's request names exactly that context; then the Corpus route runs.
`P094-023d2`	Ship the pack's executable documents	`023d1`	`done`	One step Flow (`orbiplex.json_e_flow.v1`) registered as the pack's P085 inference Flow, with typed participant and coordinator inputs; each invocation makes at most one passage or one transition, and waiting for the Chair, HIL or a run returns a wait instead of polling. Restart recovers the position from facts, and a retry reuses the stable operation identity and an existing product instead of inferring again. Requests are rendered in the host's normalized form. The prompt policy with role overlays, the candidate and verdict output schemas and the agent policy; limits 4 cycles, 2 runs, 4 solver and 4 reviewer passages, with an explicit `max/passages` checked against the Agents' Flow bindings. One local runtime serves both Agents, a managed `http_local` adapter (`inquirium.generate` routes no `command_stdio` runtime); separate runtimes per role need a contract change, without weakening the one-runtime gate. Part 1 done (2026-10-01): `deliberation.inference-flow/ref` is a `flowId` in the JSON-e Flow owner's grammar, so the profile, Flow document, configuration, registration and Agent binding share one identifier; slot-ref contracts accept a ref or that Flow id; every loaded Flow carries the digest of its delivered source object (JCS v1, before defaults), and a packaged binding and each passage are admitted only while the Flow loaded under the id carries exactly the registered digest. Part 2 is the pack's step Flow and documents. Part 2 done (2026-10-01): the qmail pack's `inference-flow.json` is the executable step Flow `qmail-task-pack-steps`. `bind` makes the turn's own Agent Flow binding with one passage on a fresh Agent, so the passage number is always 1 and an identical retry replays. The scheduler spawns and consumer-binds that Agent before opening the turn, keeps the exact Agent and inputs through publication retries, then stops it at turn closure; Room participants and roles remain stable, and Corpus loop counters stay query-wide. Recovery reuses retained turn identities, never a replacement Agent. A second binding on a long-lived Agent is refused; the singleton rule, fresh turn Agents and recovery are pinned by runtime tests. Live scheduler integration remains `023d3`. `act` reads the position and routes by status and role to one step: propose (evidence if any, one solver passage, candidate, proposal), review (evidence bound to the target, one reviewer passage, review) or admit (the closed chain by refs); any other position answers `no-step`, never polling. Requests are rendered in the host's normalized form (passage `input/digest` and binding digest equal the host's). JSON-e helper `ref_digest`. Passages run under the Corpus overlay prompt policy; both Agents answer `inquirium.generate.response.v1`, with content checked by the Corpus adapters; limits are 4 cycles, 2 runs, 4 solver, 4 reviewer and 8 passages.
`P094-023d3`	Prove the step Flow with the deterministic fixture	`023d2`, P093 local package-capability invocation	`done`	2026-10-03: `P094-023d3a`, `P094-023d3b` and `P094-023d3b1` are complete. Ten unignored daemon process tests prove managed evidence-reactive Inquirium, a live local Room, fresh Solver/Reviewer Agents, actual admitted Agent Flow binding digests, locale-complete instruction commitments, signed proposal/review, rejection-before-run, a new independently reviewed observation, and exact replay after Agent stop without additional passages or budget. The P093 local A–E path supplies the callable package capability under the loop-approved use; the earlier missing-name blocker is historical. VM execution and native retry qualification are separately proven by `P094-013` (2026-10-03), while real-model inference and federation remain `P094-013b` and `P094-016`.
`P094-023d3a`	Prove the deterministic inference fixture and managed transport	`023d2`	`done`	2026-10-01. One managed `http_local` runtime serves solver and reviewer. Host-projection samples pin the parser; fixture transitions check exact proposal/candidate relations and a failed observation's named successful step output, including its source instance. Evidence never selects the task role. Malformed, ambiguous, oversized or inconsistent requests receive bounded, non-retryable HTTP 422 refusals. Signature and CAS verification remain the host's responsibility; sample documents are synthetic, not signed acceptance evidence. Pack admission and daemon transport tests cover all three solver candidates and reviewer rejection, without a live Room or passage claim.
`P094-023d3b`	Prove the live Room step sequence	`023d3a`	`done`	2026-10-03: ten unignored process tests are green. The full Solver/Reviewer cycle uses fresh Room-bound Agents and the actual P064 instruction commitment, including the admitted role overlay, host locale and retained evidence. Corpus signs the proposal and review; the open-relay proposal receives a signed rejection, and the typed critique gate refuses admission without creating a run. A new observation proposal needs its own new accepting review. Each Agent stops after publication, and exact package-invocation replay retains output and counters without another inference. The fixture explicitly admits the deterministic host compiler at all three operator ceilings; production defaults are unchanged. VM execution is separately proven by `P094-013` (2026-10-03).
`P094-023d3b1`	Read the admitted Agent binding and complete the solver passage	`023d3a`, P093 local A–E	`done`	2026-10-03: the unignored solver process test reads `binding/digest` from the validated `agent.status` inference-Flow inspection, checks the exact Flow, package and activation generation, then admits the Corpus binding. The passage runs through managed Inquirium and authors a signed proposal. The instruction commitment includes the host's P091 locale layer; the fixture uses the shared host transformation. Corpus consumes one JSON text document from the validated, completed retained `GenerateResponse`, not the carrier as a candidate or verdict. Missing/malformed inspection digests and bare, multiple or unsupported inference carriers refuse. The separate reviewer-sequence gate is completed by `023d3b`; VM acceptance is `013`.
`P094-018`	Extend P080 with the isolated-environment resource kind	`001`	`done`	2026-09-27. `middleware-component-contract.v1` admits `resource/kind: isolated-environment` with `dispose/operation: environment.destroy` under `ephemeral-revertible` and `host-local` scope, as a dated additive amendment (P080-046); the P080 recovery section, the schema and `middleware-runtime` validation agree and refuse a mismatched operation, kind or scope. Sensorium Virt implements the disposer as `environment.teardown` over a new `destroying` state of `sensorium-virt-recovery-record.v1`: every backend (`fixture-copy.v1`, `vfkit-system.v1`, `cloud-hypervisor-system.v1`) records it durably before the first destructive step, only `destroying` reaches `closed`, a completed destruction replays as confirmed, and start, recover, drain and allocation replay refuse a `destroying` record instead of quarantining it. Startup reconciliation completes every recorded destruction and reports `records/destroyed`; a record that can no longer prove its resource identity is quarantined, never returned to a live state. Tests cover the transition table, a removal interrupted mid-way on `fixture-copy`, and a destruction interrupted with a live VMM on the fake-vfkit and fake Cloud Hypervisor process harnesses. Real-VM deployment runs were not repeated. Review regressions also cover destruction interrupted during unrecorded-launch cleanup, refusal of unbound resource paths before teardown, record-only quarantine of an invalid destruction, and drained VMM identity validation.

| P094-018a | Recover the exact prepared root across ordinary Workbench restart | 018 | done | 2026-10-11: Node's tools/acceptance/story-013-qmail-task-pack/reports/2026-10-11.workbench-restart.macos-arm64.json pins Node c673942a and Orbidocs a16d958b under refs/acceptance/s13-1791682069-c0d204. A full supervised component restart preserves the same prepared-instance key, root, allocation plan and VMM PID/start marker without extra allocation or quarantine; guest inspection retains its exact digest. The retired terminal descriptor refuses and an explicit new connection succeeds. Teardown retains the owner's destruction receipt, process absence and released quota. Bad retained records have per-row isolation evidence. This closes the approved native vfkit scope, not guided MLX/market qualification or revival of historical quarantined roots. The earlier broker/group proof and fresh-key workaround keep their narrower historical meanings. |

Resumable Federated Slice — 2026-10-04¶

These checkpoints refine 023b1, 007, 012b and 016; they do not count the same capability twice. The bounded local evidence already recorded above remains valid and is not silently promoted to federation.

ID	Task	Depends on	Status	Closure gate
`P094-023b1a`	Persist the minimal admitted turn witness	`023b`	`done`	2026-10-05: owner store migration 14 commits exact observation/witness together; seven named `admitted_turn_witness_*` daemon regressions cover identity/substitution, partial-commit rollback, capacity without eviction, conflicting source and expiry. The additional restart-before-pruning and Node-wide-capacity negatives assert typed conflict codes; checkpoint replay never renews the fixed horizon. Retention ends 24 hours after the admitted Room deadline, with 8 KiB per witness, 256 per Room and 4,096 per Node. No live authority is reconstructed.
`P094-023b1b`	Qualify pending proposal admission after restart	`023b1a`	`done`	2026-10-05: `sequence::restart_before_experiment_admission_keeps_signed_turns_without_renewing_authority` and the clean-source real-MLX/vfkit local market run `s13-1791156863-88b339` preserve signed proposal and independent review before experiment admission. Exact replay adds no inference, publication or charge; current-use and stale-authority fences remain separate.
`P094-007a`	Freeze and validate ordinary offer task identity	`006a`	`done`	2026-10-05: the closed namespaced ordinary-offer task identity, canonical schemas/mirrors and positive/negative Schema Gate vectors pin exact profile and prepared-system digests. The publication owner derives the ordinary offer from the admitted profile/binding and rejects changed policy or source material; no private capability or local execution authority enters the offer. Pure publication proofs and six owner Schema Gate tests pass.
`P094-007b`	Commit operator-approved publication and recover withdrawal	`007a`	`done`	2026-10-05: exact draft approval, ordinary signer/catalog publication, immutable Dator journal, BDO/Scheduler withdrawal recovery and immediate local admission fences are implemented. Dator policy, source, retry/exhaustion and unrelated-witness negatives pass; clean-source real-MLX/vfkit local market run s13-1791156863-88b339 proves deployed signing/publication, exact replay and withdrawal after restart. Physical discovery/order/AD-result qualification is separately P094-016.
`P094-007b1`	Use an explicit local Agora SQLite backend	P035-local-sqlite-service	`done`	2026-10-05: Decision 42 is implemented using the existing signed relay/store/index/retention contracts; status distinguishes local durable admission from Matrix forwarding. Backend/configuration and restart tests pass. Real-MLX/vfkit local market run `s13-1791156863-88b339` proves deployed ordinary Dator offer signing/publication, exact replay and withdrawal after restart. It is local evidence, not the separate remote discovery/order/AD-result claim of `016`.
`P094-007b2`	Explicit owner recovery after relay migration or terminal destination refusal	`007b`	`todo`	Freeze authority and an auditable transition over the retained signed revision, old/new destinations and credential scope before adding a recovery API. No automatic retarget, journal deletion, attempt reset or reactivation of a revoked binding. Current pending recovery requires the original configured destination; terminal `destination-changed` cannot be reopened by restart. Preserve old routing and coordinate withdrawal with its owner until this exists.
`P094-007c`	Link an admitted remote order to the provider's local round	`007b`	`done`	Physical run `s13-1791194095-ddff55` pins the exact signed revision and task profile, enters Dator through peer AD, explicitly links a provider-owned round, and delivers the signed verified recipe under independent requester policy. Exact completion replay and accounting survive restart without re-execution.
`P094-007c1`	Retain exact queued order bytes and the explicit local link	`007b`	`done`	Dator source/dispatch receipt commit in one transaction; no automatic execution; host verifies admitted bytes, signed offer, current publication/binding and one unique provider-owned round. Source/substitution/restart tests and deployed physical run `s13-1791194095-ddff55` pass.
`P094-007c2`	Publish an operator-approved verified recipe through Corpus	`007c1`	`done`	Review requalification on 2026-10-05: fresh physical run `s13-1791203388-e6aa00` satisfies Decision 43 and `007c4`. Mechanically project exact verified execution/candidate/patch sources; retain Solver/Reviewer provenance; explicit local approval and signed V2 publication survive restart/replay without another inference, publication or charge. Four real passages, seven qmail checks and all four unchanged Agent charge receipts are retained. Historical observation-only repair findings are not promoted.
`P094-007c4`	Bind exact patch review coverage before admission and recipe publication	`007c2`	`done`	2026-10-05: structured signed file/content claims are compared with exact owner bytes before signing, experiment admission (including imports) and new recipe publication. Named substitution/missing/duplicate coverage tests pass. Fresh physical MLX run `s13-1791203388-e6aa00` links each of `locals`, `rcpthosts` and `defaultdomain` to its exact resulting digest and a finding naming that file and `example.test`. Host validation is mechanical; accountable reasoning remains with the operator/profile.
`P094-007c3`	Recover delivery of the committed task-order product	`007c2`	`done`	Dator freezes the host-admitted dispatch product before P090 preparation/AD; bounded background recovery resumes the same bytes and the requester independently validates them. Transaction/rollback/delivery-replay unit proofs and deployed physical AD admission in `s13-1791194095-ddff55` pass. No task execution from delivery retry; zero-price completion does not qualify paid settlement.
`P094-012b1`	Complete binding/profile and publication clients	`007b`	`done`	Node UI creates bindings and separately confirms each widening; API/CLI/UI inspect draft, publication, withdrawal and recovery without new authority. Client construction tests and the deployed operator API flow in `s13-1791194095-ddff55` pass; no separate manual browser proof is asserted.
`P094-016a`	Prove the federated profile deterministically	`007c`, `012b1`, `023b1b`	`done`	2026-10-06 review: fixture `s13-1791237370-0f1a9e`, clean retained source `210111be`, passes real Agora HTTPS, peer AD, Agent/Room/Corpus and vfkit with four template passages, two native runs and seven qmail checks. Fixture-owned check names do not claim independent model review. HIL/open-relay exclusions name local deterministic P094-013, not MLX. Exact delivery, cached-order refusal, pinned outage/restart, measured resync 0-to-0, unchanged synthetic accounting and cleanup pass. Lost ACK remains separately proved by `016a1`.
`P094-016a1`	Qualify cached-order revocation and immutable withdrawal recovery	`007b`, `007c`	`done`	2026-10-05: 94 Dator tests include revocation with an unchanged cached signed offer, no queue/worker effects, unavailable publication, lost acknowledgement, bounded backoff and exact signed replay after restart. `016b2` additionally measures the real peer AD refusal bound by exact request digest, unchanged Agent accounting and original BDO deadline. Lost ACK is a deterministic owner-port proof, not a physical-network fault injection.
`P094-016b`	Qualify two physical hosts with MLX and vfkit	`016a`, `013b`	`done`	2026-10-06 review: `s13-1791236017-c73bf3`, retained source `210111be`, requalifies MLX/vfkit exact review and seven qmail checks, peer delivery, cached-order refusal, outage/restart, pinned target/facts/deadline/accounting, measured zero resync and cleanup. Fixture `016a` passes the same source. Earlier reports keep dated scope; unknown in-flight recovery remains separate.
`P094-016b1`	Retain the positive physical market checkpoint without promoting the remaining fault matrix	`007c`, `012b1`, `023b1b`, `013b`	`done`	2026-10-05: run `s13-1791203388-e6aa00`, clean source `bfb23a92d7b8b1c3a4145dab058e4ffef41b186e`, tree `00652989131f1a0b05329e80f77bcc1cbf12057a`, immutable `refs/acceptance/s13-1791203388-e6aa00`. Report V2 owns profile `story-013-two-host-real-mlx-vfkit-market`, scope `exact-review-coverage-v2` and the explicit local-profile HIL-negative exclusion. Two distinct physical hosts; HTTPS Agora discovery; peer AD order/result; four real MLX passages/two native executions; exact signed patch/file/domain coverage and Corpus V2 recipe; independent buyer policy; zero-price completion; restart/replay with four unchanged charges; ordinary withdrawal/no new order; confirmed native/process/lease cleanup. Selective report: `node:tools/acceptance/story-013-qmail-task-pack/reports/2026-10-05.review.physical-market.real-mlx.macos-arm64.json`, SHA-256 `b80ac47ee593fcd25ebd3b9524714f75e54ac2cbe4cfa5d255de919d010fcbd4`. Historical reports retain only their original scope.
`P094-016b2`	Measure revocation and withdrawal outage/restart on two physical hosts	`016a1`, `016b1`	`done`	2026-10-05: `s13-1791209590-7ead33`, clean source `ab83ad6b0809ce6ef8225b2a992581ef1a9e5d64`, tree `b5c6cd7a4897c18456775aff8651d016454d96fe`, immutable `refs/acceptance/s13-1791209590-7ead33`. Additional scope `market-revocation-recovery-v1`: real Dator/peer AD refuses the exact new order from an unchanged cached signed offer after provider revocation while withdrawal returns HTTP 503. One provider order remains; withdrawal retry count advances 2 to 3 after restart, retaining exact signed/requested facts, original BDO identity/24-hour expiry and all four Agent budgets. Exact replay, later catalog withdrawal, seven qmail checks and native/process/credential/lease cleanup pass. Selective report `node:tools/acceptance/story-013-qmail-task-pack/reports/2026-10-05.revocation.physical-market.real-mlx.macos-arm64.json`, SHA-256 `1df6d2a9baba9b50bb3094f4d5ca1af5e3a73e84618007642506591c8bb36364`.

Runtime checkpoint (2026-10-05): the local market run above is qualified; the earlier HTTPS refusal is resolved after the operator admitted only the exact TLS helper in the still-enabled macOS Application Firewall. Verified HTTPS exchanges now pass on both hosts. Run s13-1791182999-84d6ea discovered the exact signed revision 0, but AD correctly refused its missing explicit request acceptor. Run s13-1791184991-32d4fc admitted the real peer request into Dator and linked its exact source, then refused a fixture role expiry outside the existing Room deadline. Run s13-1791186114-d8b561 completed four real passages and all seven qmail checks, then retained its signed recipe without delivery: Dator's completion-admission callback used an invalid host path. Run s13-1791187523-c6c885 passed that admission, then result delivery refused the missing operation in Arca's bundled channel report. These runs retain failed diagnostics with confirmed cleanup; none is promoted. Review added explicit Dator request/Arca V2 result acceptors, one shared strict nonnegative sequence validator, exact owner-bound AD refusal observation and a Room-clamped role deadline, the actual host-channel callback route and the bundled Arca result route. The runner also detects a failed opposite proof promptly. Ordinary Story 013 now has 32 passing tests and six explicit opt-in profiles; Arca has 91 passing tests, Dator 92 and the runner twelve. A later bootstrap refused a full requester disk before starting proofs; its lease was released after reclaiming only owner-verified inactive executable copies. Process, credential and lease cleanup now remain independent, and diagnostic failure classification survives cleanup failure without persisting private exception text. The earlier pending physical qualification is superseded by the qualified checkpoint 016b1 below. There is no TLS bypass, firewall disablement or SSH domain payload proxy. Every failed report remains failed; no historical bytes acquire new assertions.

Historical physical checkpoint (2026-10-05): s13-1791194095-ddff55 passes with distinct-physical-hosts and profile-defined evidence on self.local and turbo.local. Initial connection refusal recovered through the ordinary peer backoff, without resetting it. Result delivery completed in its first attempt. The profile explicitly admits a 60-second result AD exchange and a 65-second Dator host waiter, after an earlier run exhausted the local-only 10-second default during peer reconnection before push. This changes no shared default, Room expiry or deliberation ceiling. Four exact Agent charge receipts retain all replay/restart snapshots. The exported selective projection binds the exact private report digest ec168384b0367181099490d806cedc6e8570fce1e820af28946d9e985b420772 without private workflow plans, host paths or credentials. Successful promotion followed native destruction and process/credential/P074 lease cleanup. At that checkpoint 007c and 012b were done while 016a/b remained open; the later composed closeout below supersedes that gap, not whole P094 or alpha. This is ordinary HTTPS access to a local SQLite Agora relay, not Matrix federation. The 95 Story-013 tool tests, 20 ledger tests, five domain-neutrality tests, canonical schema validation and freshly regenerated strict documentation build pass. Review extends the domain guard to the new order, delivery, recipe and turn-witness owners; their test fixtures remain outside the production scan.

Fresh review-qualified physical checkpoint (2026-10-05): s13-1791203388-e6aa00 passes on clean source bfb23a92 with the exact signed patch/file/content claims and file/domain findings of Decision 43. Its V2 report owns the physical profile and explicit HIL-negative exclusion; the qualifier derives its obligations from that report, not a CLI switch. Four passages and two native executions preserve the observation-first failed baseline and repair; all seven checks pass. The exact recipe crosses peer AD and independent buyer policy, while pre-admission/completion restart and replay add no inference, publication or charge. Native destruction and process, credential and P074 lease cleanup complete before promotion. The new selective report binds private qualified bytes with digest 407ca0abf2b76d19a49905d6b202fb9743e7d3310b1c1444c41e0dc85e02a9f2. The two intervening runs remain failed diagnostics: the first exposed an outer restart waiter shorter than the configured sequential channel shutdown windows; the second correctly refused a premature repair after its Reviewer rejected the legitimate observation phase. The waiter now derives its bounded budget from configuration, and the profile explicitly distinguishes those phases. No gate, shared timeout, authority lifetime or deliberation ceiling was loosened. That checkpoint completed 007c2/007c4 and positive 016b1; the then-open 016a/b fault matrix is closed below. Whole P094 and alpha-node stay open.

Native interrupted-step recovery checkpoint (2026-10-06)¶

P094-013d qualifies the existing run, Workbench and Corpus owners, not a second recovery executor. A transport checkpoint withholds a real reply; it never fabricates a successful effect or destruction confirmation. The fixture stops old workers before restart and leaves the exact VM for owner reconciliation. Inference is deterministic: this is a native mechanism proof, not another real-model or federated deliberation claim.

The original report's native-interruption-owner-receipts-v1 qualification scope separates lifetime destruction observations from residual inventory cleanup. Already closed run instances are absent from the latter, not missing disposal evidence. Exact owner replies cover the observation, interrupted and fresh instances plus the remaining template; the run journal retains its destruction confirmation. The fresh HIL record is a historical pending checkpoint before cancellation, not reusable authorization. Selective export retains response commitments and removes helper PIDs. Historical reports without this scope are not implicitly upgraded to that receipt gate. The review gate native-interruption-publication-fence-v2 additionally requires the exact signed publication lists observed during rollback-pending and after the real destruction reply was withheld. Each must equal the prior execution in the final list, excluding the interrupted run. Only the final list includes the new signed unknown execution. This is measured publication visibility at the two named checkpoints, not a claim to continuously sampled publication times.

Replay authority decision (2026-10-06, clarification of P093 §12): replay is a new capability invocation, not unconditional access to a journal. Current caller, reach, overlay and grant checks precede retained-response lookup. After the loop stops and revokes its grant, even exact replay of an earlier successful request receives 403 grant-revoked-or-expired. Losing that response does not confer a new right to retrieve it. Separately authorized local inspection may expose the retained run/publication; invocation status reads under P093 R8a likewise require current authority. Retention and execution authority remain separate.

Boundary	Required outcome	Proof owner
Before step admission	No dispatch; current authority and HIL still apply	Existing driver fence and HIL negatives
`step-started`, after Workbench channel delivery but before patch-owner invocation	`unknown`, not inferred non-dispatch after host interruption	Native checkpoint inside Workbench; no daemon-to-Workbench request-loss claim
Real patch applied, reply lost before host outcome	Same `unknown`; never repeat patch, restart or probe	Native checkpoint after verified Workbench reply
Negative outcome retained, conclusion write lost	Settle the retained outcome without executing again	`a_recorded_negative_step_is_settled_after_a_failed_conclusion_write`
Conclusion retained, destruction unavailable	`rollback-pending`; no signed terminal publication yet	Native owner-transport refusal plus existing driver tests
Owner destroyed exact instance, confirmation reply lost	Idempotent owner reconciliation, no repeated uncertain step	Native destruction lost-ACK checkpoint
Destruction bound exceeded	`rollback/destroy-unconfirmed` blocks new admission	`an_unconfirmed_destruction_past_its_bound_admits_no_further_run` with explicit clock
Terminal restart/replay	Same signed `unknown`, run facts and budgets; no new inference, publication or charge	Native Room/Agent/Corpus readback and replay

Checkpoint	Scope	Status	Completion evidence
`P094-013d1`	Freeze boundaries and prove pure recovery invariants	`done`	2026-10-06: all 18 driver tests pass, including partial conclusion writes, interrupted-step recovery, per-run isolation and destruction bounds. Terminal replay appends no facts; only owner-confirmed destruction releases the rollback gate for a distinct fresh run. Six fault-transport tests prove immutable bounded observations, real owner replies, normal release, unwind abort and bounded timeout without fabricated success. The qualifier refuses missing, early or substituted pending publications. Scoped strict Clippy passes.
`P094-013d2`	Exercise deployed recovery and Corpus closure	`done`	2026-10-06: both native cases settle the interrupted patch as `unknown`, preserve the same instance and block publication until destruction is confirmed. Destruction transport first refuses, then loses a real owner reply; restart confirms it idempotently. Eight exact run facts, two signed publications including one unknown result, six unchanged Agent budgets/charge receipts and loop spending survive terminal restart. The stopped loop refuses capability replay with 403; a separate explicit operator admission gets a fresh instance and fresh HIL, then cancels without executing a step.
`P094-013d3`	Retain clean-source vfkit interruption evidence	`done`	Review run `s13-1791274752-58cf89` passes both boundaries and the publication-fence V2 gate on clean source `8b368be3bb11bb5eb07b73e46c376e7501112499`, tree `5fe20780e8f8ab5a8addd26c71c74194f2ec615b`. Its immutable acceptance ref and verified full-history private bundle retain the tested source. The repository exporter requalifies original and selectively disclosed report bytes, preserving pending publication snapshots, owner commitments, signatures and charges. Report: `node:tools/acceptance/story-013-qmail-task-pack/reports/2026-10-06.review.inflight-recovery.macos-arm64.json` (UTC date). The earlier receipt-only run/report remains historical, not retroactively upgraded.
`P094-013d`	Qualify native interrupted-step recovery	`done`	`013d1` through `013d3`; the native macOS arm64/vfkit interruption mechanism is qualified. This does not claim whole P094, alpha readiness, real-model fault injection or a multi-host interruption proof.

Review found a production vfkit recovery defect: a dead owned process could leave exact recorded sockets, causing startup reconciliation to fail before Workbench could dispose retained state. The owner now removes them only after validated record/resource/socket bindings, a dead recorded process and a definitive ConnectionRefused. A live listener, substituted inode, timeout or unavailable process observation is not stale-socket proof. All 24 vfkit lifecycle tests pass, including direct startup recovery and a substituted socket negative. No automatic recreation or redispatch is introduced.

Diagnostic attempts s13-1791242884-bfa75f, s13-1791243409-07bdf3 and s13-1791245486-410da3 remain failed. They exposed fixture address/authorization assumptions, the dead-socket defect and the incorrect assumption that middleware helpers share the daemon's process group. Retained failed state was subsequently disposed through the owner, not relabelled as a passing report. Review aborts held patches during unwinding, restores teardown transport and preserves private conformance inputs needed to restart failed fixtures. Cleanup captures exact PID/start-marker identities while the daemon is live; direct parentage admits its independently grouped middleware helper. All ownership checks precede destructive guards. Foreign helpers and substituted process incarnations are negative controls. The report gate also requires cleanup of both interrupted and fresh instances, fresh pending HIL and an applied receipt bound to the exact owner address. Fresh run s13-1791246760-f767f6 passes those executable review changes on source 2ea459ef in 416.11 seconds. Thirty-nine non-ignored Story 013 process tests, the 18 driver tests, 24 vfkit lifecycle tests, 115 acceptance Python tests and scoped strict Clippy pass. Earlier passing source pins remain historical checkpoints, not final-source evidence. Attempt s13-1791246065-4a2200 passed the Rust native cases but its launcher refused the incorrect requirement that residual inventory contain previously closed instances. Original report and status remain unchanged. The revised report retains their actual owner replies separately, with no reconstructed success or reclassification of the failed qualification.

Record-isolation review (2026-10-06): invalid record bindings, substituted sockets and unavailable process observations quarantine only that record with a typed diagnostic, preserving unproven resources and allowing other owned VMs to recover. A record-only quarantine remains protected from orphan cleanup across restart; a valid destruction intent remains retryable. Broker-wide persistence failure may still refuse reconciliation. Before stale-socket unlink, the owner rechecks the recorded device/inode commitment using actual filesystem metadata. This narrows the race; it is not atomic compare-and-unlink protection against a hostile concurrent process running under the same UID. The private owned state directory and broker lock exclude supported concurrent writers, not such an attacker. The 25 native lifecycle regressions include an invalid binding or substituted socket alongside a healthy VM, then a second restart without orphan cleanup of the quarantine.

Fresh review run s13-1791274752-58cf89 passes the publication-fence V2 gate on clean retained source 8b368be3 in 417.52 seconds. Both cases retain one prior signed execution at each pending-publication checkpoint and two executions only after confirmed destruction. Six unchanged Agent budgets/charge receipts, eight run facts and four exact lifetime destruction replies remain bound in each case. The 39 ordinary Story 013 process tests, 18 driver tests, 25 vfkit lifecycle tests, 118 acceptance Python tests and scoped strict Clippy pass. The orphaned, untracked 2026-10-05 export is preserved with unchanged bytes in its private run archive beside its verified source bundle; it is not a repository completion report. The earlier public receipt-only report retains its original scope.

Next Actions After the Physical Market Checkpoint¶

Unattended development rehearsal (2026-10-11): one separately authorized, isolated local-MLX/vfkit order completed four passages, same-root full restart, exact Solver adoption and one verified repair with seven checks and confirmed destruction. It did not exercise observation-first failed verification, and result publication failed at a 35,095-byte descriptor forced into the 16 KiB inline carrier. The original order/loop expired without renewal; the offer was withdrawn, prepared root closed and test services stopped. Node records the scope in docs/audits/P094-2026-10-11-UNATTENDED-RECOVERY.md. This is not composed operator qualification or promotion of 012c4/012c5/012c6/023e.

The operator separately approved bounded exact provenance objects over existing authenticated AD. Draft service-dispatch-result.v2 and service-order.result.v2 now carry at most three external descriptor objects (64 KiB each, 192 KiB total). They preserve the signed answer, dispatch and terminal DAG closures with exact digest/size checks and a buyer-local resolver, without remote acquisition, truncation, locality rebasing or replay inference/signing/charging. This amends the earlier external-object limitation in P090's procurement slice. Component and process regressions cannot retroactively qualify the expired native run; final-source UI delivery/replay/withdrawal remains pending. The operator has separately authorized exactly one new isolated run after clean-source gates; that authorization does not qualify the expired rehearsal or renew its limits.

Clean-source UI follow-up (2026-10-12): the single newly authorized run s13-1791759358-87f640 used Node 0d7d745c and Orbidocs 8b658624, retained under the same acceptance ref in each repository. All pre-run gates passed, including 6,861 workspace tests and clean owner refusal verification. The native run completed four actual MLX passages, exact Solver adoption after daemon restart, and one observation experiment with actual failed verification and confirmed destruction. Full Workbench restart preserved the same prepared root and VMM. The second Solver nevertheless repeated the observation-only candidate although its retained input contained the failed execution, result and stdout; the Reviewer accepted observation-only content. No verified repair or signed recipe delivery occurred. The loop expired with unchanged limits and its order is blocked. Twelve retained confirmation facts identify the test delegate and authorizing test operator; none is independent human HIL.

The failed continuation also exposed two implementation defects: after a new epoch selected no historical input, position projection demanded adoption of the rejected candidate, and the mandate UI depended on that blocked position. Post-run corrections recognize linked rejection across the verified logical history only as a route to fresh Solver generation, preserving counters, deadline and required execution evidence; accepting or pending historical candidates still need exact adoption. Mandate inspection/revocation no longer depends on an actionable position or model availability. Process regressions prove fresh Solver preparation after adoption, rejection, another epoch and restart without redispatch or an extra charge; they do not retrospectively qualify the native run. The exact offer was withdrawn through measured periodic buyer refresh without explicit resync; the mandate was revoked and the prepared VMM closed. Cleanup using owner APIs is not a UI completion claim. See node:docs/audits/P094-2026-10-12-GUIDED-RECOVERY-FAILURE.md and its retained failed report. The one-run authorization is consumed. Resolve the model/profile phase transition, re-pin and repeat affected gates, then obtain a new bounded authorization before another run. 012c4/012c5/012c6/023e stay in progress, 015 stays partial, and 018a retains only its separately qualified scope.

Observation-to-repair follow-up (2026-10-12, development): Node's read-only prompt audit reconstructs the historical caller request from retained owner inputs and the exact Flow, compares the host's input digest and instruction hash, verifies CAS bytes and unchanged evidence acceptance. It does not claim to capture final adapter messages, which this profile did not retain. Package instructions require deriving phase from the full execution history across fresh Agents/epochs; they require Reviewer rejection of a redundant observation-only candidate while allowing a concrete missing-data observation. Explicit temperature 0 removes the discrepancy between packaged Flow and calibration. Re-authoring, conformance, activation and a matching binding are required for the new Flow; existing package pins and signed products remain immutable.

A separately authorized small calibration uses a new isolated MLX-only profile: four cases twice (no observation, actual failed verifier, labelled incomplete evidence, repeated candidate), at most eight calls of 2,048 output tokens in ten minutes, plus at most two short startup/conformance calls. It has no VM, Agent admission, orders, signing or publication. Schema/normalization and package-local content checks do not prove native execution or independent human HIL. The measured run calibration-1791794431-3c698c is failed: eight calls and one 128-token probe in 45,318 ms. Initial/incomplete cases passed twice, but both complete failed-verifier Solvers repeated observation and both Reviewers accepted it despite shape validity. The metadata-only failed report and node:docs/audits/P094-2026-10-12-OBSERVATION-REPAIR-CALIBRATION.md bind the original private outputs and measured file/binary hashes, not clean native pins. That calibration omitted the Corpus developer role overlay; the Reviewer also copied the concrete accepting example. Post-run corrections remove that example and project the exact pack overlays through existing required/exact profile layers, with trace checks. They were not exercised by that first run and are not a new Corpus admission or proof of the sole failure cause. Calibration approval is consumed; additional calls require a new bounded approval. Neither source changes nor a passing model calibration close 012c4/012c5/012c6/023e or renew the consumed full-run authority. A new full UI qualification needs new clean paired source pins, affected gates and its own bounded authorization.

The separately approved second calibration attempt stopped at daemon configuration parsing before any startup probe or model dispatch. Its failed launcher report is not a model-content result. Module eligibility and complete daemon preflight are now regression-tested before process start; this correction does not qualify model behavior or authorize an automatic retry.

The third separately approved attempt calibration-1791800857-b2574a exercised the corrected complete preflight and exact required role overlays with the neutral Reviewer template. Eight calls and one probe completed in 44,638 ms; all eight documents were valid, but the same four content checks failed. Both complete failed-verifier Solvers repeated observation; both Reviewers accepted it despite recognizing completed showctl. The host trace preserved the role layers unchanged. These corrections are measured but insufficient, not proof of a sole cause or a completed native passage. The separate Node metadata report 2026-10-12.observation-repair-calibration.role-overlays.failed.real-mlx.macos-arm64.json binds this source without rewriting the first report. Supervised stop and scoped process inspection confirm cleanup. There were no VM/order/signing/publication operations; this approval is consumed too. No checkpoint or readiness promotion and no automatic new model attempt follows.

Adapter/phase review follow-up (2026-10-13, implementation and offline evidence): the exact retained Qwen3-Coder tokenizer preserves all four role sentinels, including developer. Across both repeats, first/third prompt-token counts are 1072/1261 (initial), 6907/7096 (failed verifier), 5704/5893 (incomplete), and 6471/6758 (Reviewer). Effective output was 2048, not truncated at the cap. Both Solver runs are input-insensitive; shape/content checks remain separate. The metadata-only 2026-10-13.calibration-boundary.offline.json binds model, template, exact historical usage and source hashes with zero inference calls. It does not fabricate historical final adapter capture or prove a sole model failure cause. New calibration shares the native pure prompt-layer constructor; the native order is role overlay, exact user evidence, then caller task, not an independently reconstructed calibration order. P064 now requires pinned offline role-render evidence for new local-package admission, including typed refusal for currently unsupported GGUF rendering; historical catalogs remain explicitly unverified. Actual post-mapping capture and offline private rendering use existing selective-disclosure authority, with only commitments/counts exported.

The accepted package-owned phase decision is carried by draft corpus-task-pack-phase-rule.v1 and corpus-task-pack-phase.v1; Corpus knows no qmail names. The host resolves the rule from the exact admitted prompt-policy asset and task profile. Only the latest verified execution of the same logical round controls eligibility, across Agents and communication epochs:

Owner facts	Phase	Candidate shape admitted before publication
No execution	`initial-observation`	Observation-only
`verified` plus an exact linked passing verifier evaluation, without refusal and with all reported checks passing	`goal-completed`	No further candidate
`verification-failed` plus an exact nonpassing verifier evaluation and every named same-instance observation completed with exit 0, nontruncated, nonempty UTF-8 output	`repair-eligible`	Contains a non-observation effect
Otherwise	`evidence-missing` with named gaps	Observation-only

Missing/substituted owner objects refuse, never infer a phase from prose. Revision-2 evidence retains the host phase even for an empty initial history; every basis source is exact, required and included. It provides short aliases, source summaries, current candidate first and separately labelled historical reviews, while retaining full documents without truncation. The existing 32 KiB projection budget remains hard. Revision 1 retains historical meaning. Flow selects separate phase templates. The owner checks every command's exact declared effect mode. Unknown/absent phases and goal-completed have an explicit no-step route, never the repair fallback. A missing owner rule can also refuse revision-2 evidence preparation before any model dispatch. The rule explicitly pins repair/observation-only: refuse: after eligibility, this bounded package does not allow observation-only diagnosis even after a failed repair. A future host-derived named-gap exception needs its own policy contract, not a model-authored exception. The owner checks every command's exact declared effect mode and refuses phase/observation-only-repeat or phase/repair-before-evidence before patches/publication; Reviewer critiques repair semantics, not eligibility. The new package and matching binding need re-authoring/conformance/activation before use. The deterministic fixture's revision-2 initial phase now proposes observation directly; historical safety trap qualification remains separate, not silently requalified by this change.

Pure table, owner-link, message-boundary, fold/refusal, fixture and Schema Gate tests are development evidence only. A new bounded model calibration and final clean-source native UI run remain open; no consumed approval is renewed and no 012c4/012c5/012c6/023e, 015 or alpha promotion follows. See node:docs/audits/P094-2026-10-12-OBSERVATION-REPAIR-CALIBRATION.md.

Review follow-up, 2026-10-14: new role proofs cover five ordered layouts per role, including the same native Corpus preamble/postamble shape. A rendered role remains only a rendering fact. A separate model-card/operator trained-role declaration and preferred Foldable target is deferred to a separately bounded calibration and policy slice; no training claim or priority change is inferred from sentinel preservation. P064 documents the deferred GGUF helper and conservative historical roles. Shared two-LF content joining is a behavior change; historical reports remain tied to their original source and joining, not renewed evidence for these changes.

Gated continuation decision, 2026-10-18: real model calibration and the full ordinary operator run require separate fresh approvals. To exercise repair inputs without a VM during calibration, the operator accepted exact retained evidence as labelled test data with scripted Corpus-history reads; the delivered Flow, actual Agent passage/neutral manifest/receipt and model adapter must remain real. This does not qualify current Room authority or another Workbench execution. The legacy direct-generate runner shares layers but bypasses Agent admission and cannot qualify this new gate. New full-Flow tests pin phase-specific requests, their input commitments and no-step before withheld dispatch; current owner tests and deterministic coordinator adoption/restart passed separately. Review removed an overly broad resolved-input seam: only primitive binding reads are replaceable under cfg(test); owner authority, role assembly and manifest creation are not injected. Generic FlowNode refusal/reopen tests are not collaborative calibration evidence. One input binding feeds evidence/charging, while product commit rechecks current authority; Corpus records only exact retained manifests. The operator accepted vehicle daemon-lib-test-harness for calibration only: clean paired source pins, test-binary digest/build profile/features snapshot and the delivered-daemon digest as reference are required. Private final adapter messages/rendered prompt and template commitments must bridge to the later delivered-binary UI run. Test-vehicle reports cannot qualify full-run authority, alpha readiness or performance. No production feature flag or history-import writer is added. The original profile's Corpus database is absent and the operator reports no known archive of its binding/accepted overlay; the suspected temporary file cleaner is not a verified cause. Do not reconstruct or re-sign those facts. Calibration must retain CollaborativeParticipant semantics. These are preparation evidence only: the historical-read connector and exact private capture still need preparation. Only fifteen-asset verification and twenty offline role probes (30-second renderer deadline) are newly authorized, without weights, generation, activation or conformance. No new model run, VM, publication, consumed-consent renewal or tracker promotion is implied. See node:docs/evidence/task-packs/2026-10-18-calibration-gate/README.md for the initial revisions, commands, substituted boundaries and remaining gates. The separately approved SCIE offline slice now provides a new digest-bound dispatcher ABI, fifteen verified assets and twenty preserved role/layout probes under the 30-second owner deadline. It closes only the P064 renderer gap, not this proposal's calibration/UI conditions. Private originals, exact test binary and development source snapshots are retained on the operator-selected durable volume; temporary scratch is not an archive. The historical missing-source boundary and separate calibration/full-run approvals remain unchanged. The 2026-10-19 review adds renderer protocol/source compatibility, actual server import preflight without weights, emitting-executable commitments and disposable private cache cleanup. These are component-tested corrections, not a new native measurement: pex.3 is a source candidate only and the immutable pex.2 result does not qualify the added checks. P064's renderer row is in progress pending a fresh bounded native preparation. Resolve compatibility before preparing collaborative inputs. The unsigned offline manifest still needs a separately approved signer/import/trust path; the lost historical issuer must not be reconstructed. The separately approved pex.3 attempt then passed reproducible builds, real server-import preflight and fifteen-asset verification, but failed in test-vehicle self-hashing before any role probe (the borrowed middleware helper's 128 MiB ceiling is smaller than the test executable). The cfg(test)-only correction leaves production policy unchanged. Zero probes completed and no retry, calibration, activation or full run is inferred. Preserve the failed attempt and obtain a fresh probe approval using the unchanged artifact and corrected test vehicle. That separately approved probe attempt passed: 15 assets, 20 preserved positional probes in 8085ms and 36608ms aggregate within 120s, with current renderer-source commitments and exact emitting/retained test-binary matching. Existing pex.3 build bytes/provenance were reused; no builds, model effects or retry occurred. Private originals/cleanup are on DEV; the failed attempt remains unchanged. This closes only the bounded P064 offline gate on retained development sources, not faithful collaborative inputs, semantic calibration, live authority, activation or this proposal's UI/market acceptance. Separate later approvals remain mandatory. P094-012c5/012c6/023e remain in progress; c5's guided market-publication condition is not removed by narrowing the next runtime run. P094-012c4, P094-007b2, whole-proposal adoption and alpha readiness remain separate. The 2026-10-19 preparation follow-up records a read-only eight-case calibration proposal with frozen limits and required fidelity/semantic/cleanup gates. Its checker cannot authorize execution or report readiness or qualification. The original GWuw6g binding/accepted overlay was not recovered. The operator approved new explicitly synthetic Corpus/Room facts and test participants, with retained observations labelled test data, not current or reconstructed operator authority. The cfg(test)-only fixture uses ordinary owner stores and current role/overlay validation; it cannot invent package-owned phase authority. The complete CollaborativeParticipant connector and private input bundle remain unqualified, so Stage A is partial. No generation, activation or conformance was performed. Do not promote these rows from a planning check or substitute the historical direct-generate runner. The inert eight-case source material is now fixed and digest-pinned, normalized through existing candidate/patch constructors and retained create-only with its emitting test executable commitment. It is not a final prompt, owner phase manifest or completed connector. P085 phase prerequisites still refuse; adding synthetic installed/active-package facts and a scripted conformance report to the cfg(test) fixture was proposed as a separate input-basis decision, not silently included in the Corpus/Room approval. Neither that seeding nor real activation, conformance or generation occurred at that checkpoint. The operator then separately approved only cfg(test) synthetic P085 prerequisites. The eight-case input connector now retains owner-derived phases, rev2 projections, neutral Agent manifests and the shared chat mapping on DEV, with explicit scripted-port attribution. Fresh fixture authority preserves the same message/manifest bytes; missing/substituted history, goal-completed and lost-session restart are checked without a model, and refused replay spends no second passage. This qualifies input construction only, not model dispatch, semantic calibration, live authority or a UI run. Unsigned model admission/activation, clean paired source and final adapter capture remain separate prerequisites. No tracker is promoted from this development bundle; P094-012c5/012c6/023e remain in progress. The next model-free development checkpoint implements passage/HTTP execution and a closed result qualifier with explicit scripted-transport attribution. Ordinary Agent products, neutral manifests, exact provenance, receipts and replay are checked without asserting model semantics or current operator authority. Missing provider usage may use the owner's estimate, but cannot qualify the exact render/token comparison. The current pex.3 ABI cannot inspect arbitrary captured messages; only code and tests for a narrow pex.4 offline inspection command were approved. No new runtime artifact, activation, conformance or model run occurred; the old package/plan/input bundle stays immutable and unready for execution. Prepared managed-runtime lifecycle integration, new artifact/input pinning and separate preparation/calibration/full-run approvals remain open. See the same Node checkpoint for tests, limits and exclusions. These rows and alpha readiness are not promoted by scripted transport or checker tests. The operator accepted preparation and calibration as separately approved phases in one test process: normal restore must not hide repeated conformance inside the zero-startup-generation calibration. Node's model-free controller now freezes eight distinct owner contexts and exact retained ready bytes, then gates each case on separate approval, continuity, expiry and cancellation. This is still partial Stage A: operational model preparation/report integration, actual new runtime/input pins and separate execution approvals remain open. Local test acknowledgements are neither operator mandates nor independent human HIL. The 2026-10-20 model-free implementation joins ordinary installed-model preparation, measured receipts, exact derived runtime–Flow bindings and closed session reporting. Ready validation precedes dispatch; the checker runs its binary-pinned private source closure and records failed setup/cleanup explicitly. The separate calibration acknowledgement precedes even that read-only checker. Late ready-construction failures retain their own cleanup fact without rewriting the preparation receipt. Fractional runtime defaults are preserved as exact owner-JCS bytes with a digest; the server cache's initially-empty fact and the offline-renderer-only cleanup scope are explicit, not a general cache-GC claim. The operator separately approved the managed default output ceiling of 2048 (default request 512), with canonical profile-local narrowing. Preparation uses bounded owner suboperations and an explicit elapsed-time postcheck, not a hard global deadline over asset I/O. No real model, activation or conformance was run. The new artifact/manifest/input proposal and separate preparation, calibration and full-run approvals remain gates. These implementation tests do not promote P094-012c5/012c6/023e, market-publication acceptance or alpha readiness; see the same Node checkpoint for current tests and remaining limits.

The subsequent operational-vehicle continuation supplies one opt-in test-binary entrypoint and a thin source/binary-pin-checking client for those same owners. Preparation and calibration acknowledgements remain distinct; EOF, cancellation, early/extra approvals and uncertain cleanup cannot authorize continuation. Exact owner byte witnesses preserve fractional provider metadata without inventing a Python canonicalizer or changing the model input. Dedicated ordinary installed, inactive model prerequisites and a built/verified pex.4 remain missing gates, followed by new separately approved preparation, calibration and full UI/market runs. Model-free integration tests do not qualify model semantics, current operator authority or human HIL and do not promote c5/c6/023e, P094-015 or alpha. The Node procedure is docs/operations/TASK-PACK-CALIBRATION.md.

Approved recovery/adoption/publication slice, implementation checkpoint (2026-10-11): the Workbench now validates each retained instance's exact host plan before exposing its prepared root, isolating bad rows without blocking other instances. The new native full-process restart runner is distinct from the historical broker-only proof and from the final guided UI qualification. The deterministic adoption process proof compares the actual pre-dispatch neutral Agent manifest with Corpus's binding and checks unchanged Solver manifest and charge after restart/replay. This is not real-model adoption. The native full-Workbench clean-source report in Node, tools/acceptance/story-013-qmail-task-pack/reports/2026-10-11.workbench-restart.macos-arm64.json, now passes on Node c673942a and Orbidocs a16d958b, separately pinned under refs/acceptance/s13-1791682069-c0d204 before allocation. One exact instance and VMM survive full component restart; compared plans and guest digests match, the old session descriptor is refused, and the destruction receipt confirms process absence and released quota. The report retains the typed quota refusal, not an inferred allocation count. P094-018a is done for this approved native scope. This is not real-model adoption or guided market acceptance. The clean-source owner gate also passes all 22 proofs and 26 variants without rerunning or strengthening the three older native/physical reports. Full workspace verification passes 6,831 tests with no failures and 30 explicit ignored tests, separate from the opt-in native restart proof.

Dator owns a bounded order collection (32 default, 64 maximum), stable keyset cursor, private-payload omission and per-row diagnostics. Thin UI review binds fresh owner snapshots; a new order link requires an open, unspent loop. The immutable link remains at the logical origin. Verified recipe history now includes signed authority/epochs and candidate/adoptions, empty without continuation. Fresh publication requires the activated current epoch and Chair, not expired origin authority; exact retained publication replay does not infer, sign or charge again. The recipe's unchanged 64 KiB carrier refuses excess history instead of truncating it. These are current draft-contract amendments.

The guided binding continuation now reads Dator's bounded policy-ref inventory only on explicit request. Ordinary preparation remains publication-off and has no Dator dependency. The provider identity is owner-derived; fresh inventory resolution and the UI review receipt bind the selected refs. Enabling this capability needs a separate widening confirmation and does not approve offer terms, a signature or publication. This amends the draft preparation contract, not the remaining clean-source operator-qualification status.

Publication recovery clarification (2026-10-11): host/signer unavailability is not evidence of policy loss. Only Dator's explicit policy-refusal response closes that fence; other owner responses retain bounded diagnostics rather than being relabelled publication/policy-missing. Automatic withdrawal now retains its original host-observed trigger, separate from the current fence. Historical automatic intents without this field keep their exact identity and report an unknown trigger; current readiness cannot establish the old cause. Restoring availability does not cancel a retained withdrawal. Without a prior Dator publication/destination fact, withdrawal refuses to invent the target; a fresh draft requires separate approval. This draft inspection-contract amendment and its component regressions are not new native publication evidence and do not promote 012c4/012c5 or the composed qualification.

The guided passage checkpoint collector now reads actual UI-created Agent IDs, matching the pre-product neutral manifest to the host-admitted input and the same Corpus link. It retains exact local provenance commitments, reachable DAG measurements and actual Agent spend for comparison after restart/replay. It is a read-only, private checkpoint tool, not a harness installer, semantic validator or composed operator-qualification report; these checkpoints do not promote the remaining tasks.

012c6, 023e and 012c1–012c5 remain in progress until their respective clean-source operator criteria pass. The remaining composed run uses installed/conformant/active package prerequisites, local MLX/vfkit on self.local, a second isolated buyer and explicitly local SQLite relay. It requires a real order before passages, unfinished-candidate adoption, fresh Reviewer/Chair, observation then repair, distinct publication approval, measured periodic Arca refresh and checked cleanup. Delegated receipts are not independent human HIL. Source commits and acceptance refs precede qualification; report commits follow it. Relay migration, store rotation and formal whole-P094 acceptance remain separate, and P094-015 stays partial.

Operator qualification prerequisite clarification (2026-10-11): an isolated buyer may read the explicitly public offer topic without receiving the provider's relay publication token. Arca defaults to authenticated reads; its opt-in public mode is confined to the configured relay/topic and leaves record, provider and inner offer verification intact. Writes remain authenticated, and oversized response pages are refused rather than truncated. Component tests establish this boundary, not a new completed market/operator checkpoint.

Approved guided buyer extension (2026-10-11): the operator selects an exact observed signed offer, enters problem text, reviews the buyer/terms/inference policy and separately approves one free task-pack recipe order. Arca prepares the existing normalized workflow plan; the host retains its module-scoped request address and exact plan, including terminal/deletion evidence across replay. Commit rechecks the current buyer, signed revision/digest and independent buyer policy. The host exposes only the current operator's public participant reference to Arca, not key, recovery or private identity metadata; this read grants no identity mutation, signing or purchase authority. No replacement provider, client execution engine, copied provider token or implicit provider loop/model/HIL/VM/publication authority is introduced. An uncertain submitting record or missing acknowledgement pauses for inspection; it is neither proof of refusal nor authority for redispatch. Startup may observe the same admitted purchase with configured auto-start disabled, not create a new plan. Inline Node-local draft contracts and component/disk-replay/UI tests support implementation only. P094-012c4/012c5 remain in progress until the composed clean-source native purchase, adoption, delivery and cleanup report.

Publication recovery decision (2026-10-05, accepted): retain the exact relay base URL (origin plus path prefix) and topic before the first publication effect; inherit that target for withdrawal, including a lost-ACK publication. Refuse a changed configured target instead of silently migrating the offer or reusing credentials at a historical address. Missing historical target evidence is not reconstructed from today's configuration. Separate closed retry class (transient, permanent, unknown) from reason codes: permanent refusals stop; transient outages and unknown acknowledgements reuse exact retained bytes within the existing attempt/deadline bounds. Restoring configuration or migration after a terminal refusal requires explicit operator recovery; this slice grants no automatic relay-migration authority.

Follow-up	Scope	Status	Completion evidence
`P094-016b4`	Distinguish fixture claims and measure manual replay at the catalog owner	`done`	2026-10-06: fixture `s13-1791237370-0f1a9e` and MLX `s13-1791236017-c73bf3` qualify `story-013-peer-market-v3` on source `210111be`. Correct fixture labels/deterministic exclusions, owner-measured resync 0-to-0 in one durable epoch, signed withdrawal digest and cleanup pass. Launcher and exporter require the current gate; replayed-record count is diagnostic. Tests cover startup/restart, failed manual control, both catalog consumers, identity substitution, HTTP framing and export size/gate refusals. Original historical reports are unchanged.
`P094-016b3`	Requalify pinned-target withdrawal and ordinary catalog refresh	`done`	2026-10-05: real-MLX run `s13-1791230693-3915ab` passes `market-revocation-recovery-v2` plus `catalog-periodic-withdrawal-v1`. One publication POST receives 503; no other requests reach the fault seam. Restart advances attempts 1 to 2 with the same target, signed facts, original BDO deadline and four Agent charges. Ordinary two-second Arca sync observes the exact signed withdrawal, with increasing applied count/completion time and zero explicit resync. Pagination cursors are diagnostic and may remain null or unchanged. Peer delivery, seven qmail checks and cleanup pass.

Review scope decisions (2026-10-05): the peer-market fixture deliberately starts with observation; it does not retest pre-run rejection of an open-relay candidate. That negative and independent HIL denial belong to the local deterministic P094-013 profile, named in its exclusions. Neither is borrowed from MLX. Template review proves byte/contract wiring, not independent critique. The new V3 report gate requires owner-measured resync counts in one durable epoch; the old zero constant proves only the harness's intended control path. records/applied counts reapplication and is diagnostic. Exact signed withdrawal identity/sequence/digest and a later replay completion establish convergence. publication/destination denotes Dator's configured transport address, including any proxy; it is not canonical relay identity. Unknown 5xx acknowledgements (other than explicit transient 503) may follow a commit; idempotent record replay remains bounded. These distinctions do not authorize relay migration; 007b2 separately tracks that missing operator transition.

Review closeout (2026-10-06; UTC run date 2026-10-05): fresh fixture s13-1791237370-0f1a9e and MLX s13-1791236017-c73bf3 pass on revision 210111be76b25be4e982ec12908e6771ca11c049, tree 7ce8b5d65cb506347701198cdcbbde40396558aa, each under its immutable refs/acceptance/<run-id>, with a verified private full-history source bundle. Both retain four passages/two native executions, seven qmail checks, exact withdrawal and zero manual resync measured by Arca in one unchanged epoch. Each fault seam records one publication POST returning 503 and zero other requests. Accounting/replay and native/process/credential/lease cleanup pass. The MLX token charges are 1,017, 2,227, 7,791 and 7,591; fixture usage is synthetic, and zero observed local cost is not paid-settlement evidence.

The strict V3 selective exports are:

node:tools/acceptance/story-013-qmail-task-pack/reports/2026-10-05.review-v3.physical-market.fixture.macos-arm64.json, SHA-256 59b048195c15f1e4fdc649bb190de84e0c97ed24ab05278537cd5e94c6d6a421;
node:tools/acceptance/story-013-qmail-task-pack/reports/2026-10-05.review-v3.physical-market.real-mlx.macos-arm64.json, SHA-256 d582c88ab6aba3c8f3ef5ec57fe9560b83a870eaaaa6a52786bd8a25e0ec1969.

The only post-run executable change separates the 512 KiB composite retention/export cap from the unchanged 256 KiB single-provider bound: the private MLX aggregate is 262,318 bytes. This loader/retention fix changes no model execution, host witness, qualification predicate or measured bytes. Boundary tests and current-gate reevaluation pass; it is not a new runtime source claim. Original report digests remain bound by the selective exports.

Diagnostic attempts remain failed: s13-1791235298-c4028d exposed missing Arca replay-owner initialization at service startup, corrected before both final runs with a fresh-start/restart regression. s13-1791236533-e9477e lost SSH control during the market tail. Its failed report was not rewritten; later owner cleanup/readback confirmed both leases released as failed, bootstrap credentials absent and no owned processes. The fresh retry supplies the passing evidence, not reinterpretation of that failed attempt.

Retained composed qualification (2026-10-05): fixture run s13-1791230227-4c71e7 and real-MLX run s13-1791230693-3915ab use the same clean source 4db6334062f712a88ca5b28be53fb3bb847b9684, tree 0c59622f3abfd1ab77f6333c8ec1396a0eb6d9ce. Each is retained under its own immutable refs/acceptance/<run-id>; removing the LAN technical branch does not remove either source anchor. Both complete four passages/two cycles and two native executions; only the fixture substitutes inference and records synthetic usage. The MLX run retains four measured token charges (1,017, 2,214, 7,772 and 7,567), unchanged through restart/replay and withdrawal recovery. Zero observed local cost is not a paid-settlement proof.

The selective reports, qualified again after privacy projection, are:

node:tools/acceptance/story-013-qmail-task-pack/reports/2026-10-05.periodic.physical-market.fixture.macos-arm64.json, SHA-256 fbc043e4a65395be2fd9dbb4b1e9f9ba2172e3149ab687fafb1a05cfe39cd043;
node:tools/acceptance/story-013-qmail-task-pack/reports/2026-10-05.periodic.physical-market.real-mlx.macos-arm64.json, SHA-256 141af435f9b853fca1b2f8a14a4b1fd98d16d44f285b553aaadfbdf261d1dd4a.

Review of the composed gate corrected endpoint/control-snapshot readiness and the pagination-cursor assumption described below. Review of the physical report checked both owners' withdrawal digest, per-path fault counts, exact charge receipts and destruction confirmations. Reports are emitted only after process, credential and P074 lease cleanup succeeds. No execution authority, model budget, TLS check or native timeout was widened.

Qualification attempt (2026-10-05): s13-1791229103-0fc771 used clean source 88cf7d75c39f7a88a52c2be26aad9d2170b4ff3f, tree 2d33794befdce3b28cd6d6e7578b8966dc3b0899, retained under its immutable refs/acceptance/ ref. The two-host fixture profile reached HTTPS discovery, but the buyer's peer listener did not complete TLS, including a host-local probe. The macOS firewall admitted previous executable paths, not this run's new daemon copy. This is diagnostic evidence, not a conformance checkpoint; process/credential/lease cleanup reports no unconfirmed owners. Operator network admission and fresh fixture/MLX runs were required. No TLS bypass, SSH product tunnel or relaxed peer failure threshold is admitted by this work. Local verification: 103 harness tests and 34 non-ignored Story 013 process tests pass, with seven explicit native/physical tests ignored in that suite; the process target also passes Clippy with warnings denied. Review corrected a fixture race between endpoint readiness and control snapshot publication.

The operator subsequently admitted incoming connections. The next run, s13-1791229786-96ab34, passed peer discovery, native observation/repair, delivery, stale-order refusal and withdrawal recovery but failed a new fixture assertion that treated Agora's pagination cursor as a monotonic replay marker. An exhausted page can legitimately return no cursor. Review corrected the gate to increasing applied count/completion time plus the exact signed withdrawal, with regressions for null and unchanged cursors. Neither interrupted run is promoted to passing evidence.

The V1 report's ten fault connections have no retained path attribution. Its catalog convergence follows explicit resync with periodic intervals held at 3,600 seconds. Preserve those observations without claiming ordinary periodic refresh or publication-only traffic isolation. The new fixture holds one destination from initial publication and faults publication POSTs only.

Review scope decision: exact-review-coverage-v2 requires exact patch/file claims and associated target/domain findings. Restart and probe are bound by the signed candidate and checked during admission/execution, but no separate review finding for either is required. This is not all-step critique coverage; any such extension needs a new named profile scope and corresponding claims.

Current revocation checkpoint (2026-10-05): 016a1/016b2 supersede the cached-order/withdrawal gaps in the preceding historical notes. The first attempt s13-1791208451-fa3684 remains failed diagnostic evidence: after successful refusal/recovery its fixture invoked a revoked package capability. The fresh passing run folds retained loop facts read-only instead. Public TLS bootstrap is now separate from listener readiness, preventing a startup race from temporary benchlisting (the existing peer-runtime quality/backoff state) before it can listen; no peer thresholds were relaxed. This is not denylisting. Review also binds refusal by the exact artifact digest, not by conflating the service order identity with its transport idempotency key. The then-remaining aggregate gap in 016a is closed by the later composed qualification above.

Preserve the executable owner-refusal inventory (P094-015a): all thirteen Story cases and twenty-six variants require exact passed test identities, not source markers or declared corpus coverage. Requalify the gate when an owner or contract changes; keep native/model/physical evidence at its original run/source and do not turn current doubles into new hardware proof.
Maintain the complete EN/PL HOWTO (P094-014/014a) with actual CLI parsing. Preserve scoped Unix binding no-op adoption/current-authority recovery, explicit not-applied proposals and the known node-wide journal capacity.
Keep the closed 016a/016b/016b3/016b4/016 evidence scopes distinct: fixture inference is not MLX, deterministic lost ACK is not physical fault injection, and exact patch/file critique does not add separate restart/probe findings.
P094-015 is partial: the code review/evidence/document synchronization is delivered, but whole-proposal acceptance and the V1 versus later-extension boundary are not yet adopted. Complete the approved P094-023e and guided operator c1–c5 qualification; keep P094-007b2 separate and retain the proposal-wide alpha-node blocker until the operator decides that boundary.
Design P094-007b2 separately before implementing any operator transition that reopens or redirects a terminally refused withdrawal after relay migration.
Preserve completed P094-012c7 development UI qualification: the exact signed mandate, actual delegate/human issuer, unchanged deadline/counters, seven passing repair checks, confirmed destruction and signed result before success. Keep revocation/takeover/restart owner proofs distinct from the live happy-path run. The dirty-development checkpoint does not qualify a clean release, independent human HIL or guided market publication; private history archival and finite write capacity remain explicit follow-up work.

P093 C+D review (2026-10-03): the callable local vertical is implemented, so the earlier missing-name observation in P094-023d3 is historical. Approval is still owned by the Corpus loop, not by its projected P093 use record: admission and status re-read the current loop, including recovered run conclusions. A stopped loop fences a stale approval left by a failed sync. At that checkpoint the coordinator/replay proof did not complete the ignored solver-turn test, reviewer sequence or real-VM acceptance. The subsequent 023d3b1 and 023d3b process proofs close the first two; the separate fresh 013 native aggregate closes the third. No tracker item is promoted by the C+D review alone.

P093 Stage E (2026-10-03) proves the local operator scenario in the same Story 013 process target: authored import, capability/provider/effect preview before activation, loop-approved coordinator use, replay/status, cancellation, signed revocation and retained prompt-free journal metadata. A host without the Flow refuses activation with flow-not-loaded / load-provider. Local diagnostics preserve admission codes and add one decisive cause/action; the operator types no capability id or digest. This closes Stage E of the P093 local vertical, not P094-023d3b1, the live solver/reviewer sequence or the VM evidence of P094-013.

The Stage E follow-up preserves successful owner lifecycle responses even when optional capability inspection is unavailable. The process proof additionally covers revocation while the loop is still open and operator requests without manual capability/contract handles. Journal retention never removes unresolved work; resynchronizing an old loop fact does not renew consent. Recreating an expired, retired use requires a newer explicit renewal by its approving operator.

P094-021 Follow-Up¶

ID	Task	Depends on	Status	Acceptance
`P094-021g`	Fence patch targets and operation kind at installation	`021a`, `021b`	`done`	2026-09-28; reviewed 2026-09-29. A patch write carries the operation its policy admitted at staging (`create` or `modify`, from `target/existed`), recorded by the Workbench with the stage and required by `sensorium-virt.host.request.v1`. The guest reaches each target's parent from the pinned workspace root one component at a time with `openat` and `O_NOFOLLOW`, pins it by descriptor and identity, and admits the target in the state the operation names. It commits only while walking the path again still reaches the pinned parent, and only through descriptor-relative atomic operations: `create` renames with `NOREPLACE`, `modify` exchanges with the target (`EXCHANGE`) and swaps back anything that is not a regular file, and a delete renames the file aside, checks its type and unlinks or restores it. A walk after the commit that no longer reaches the parent makes the result `patch-apply-partial`. New bytes and displaced objects use agent-owned `0700` scratch pinned by descriptor. Unsupported renames refuse with `patch-apply-unsupported` only before a target change; later failures, including restored replacements and unconfirmed cleanup, are `patch-apply-partial`. Adversarial tests replace a parent with a link or another directory, create a target before a `create`, delete a target or replace it with a link before a `modify`, and replace a deleted file with a directory; pre-rename conflicts refuse; conflicts detected after a rename require destruction even when restoration succeeds. Deterministic checkpoints cover post-rename metadata errors, scratch substitution and post-commit parent displacement. Parent checks do not prove absence of transient move-away-and-back races or protect against guest root.

The original P094-021a-f implementation is complete, and the independent-review hardening P094-021g is done (2026-09-28, reviewed 2026-09-29). New bytes and displaced objects now use an agent-owned, descriptor-pinned 0700 scratch directory on the target filesystem. Errors after the first target rename, even with successful restoration, and unconfirmed scratch cleanup require destruction. Unsupported renames are clean refusals only before any target change. The parent check detects displacement still visible at the check, not every transient move away and back; it does not claim protection against guest root. Deterministic test checkpoints cover metadata failure after displacement, scratch-name substitution and parent movement after commit. The real qmail VM run is qualified separately by P094-013 (2026-10-03); The separate 2026-10-04 MLX/vfkit run qualifies local real-model deliberation (P094-013b); federation remains P094-016.

P094-019b Review Qualification¶

The implementation now uses a private close-on-exec helper-status channel instead of trusting command stderr, bounds output draining by the process deadline, bounds tree traversal before allocation, and retains pending-observation taint across guest-agent restart. An unconfirmed timeout or unknown helper status fails closed with observation-outcome-unknown; the host also destroys on recovered taint, including inspection after a lost original response. Unit and process-conformance tests cover these paths. The original real-vfkit 18-check proof predates these fixes.

[x] Rebuild the Linux helper/image and repeat the real-vfkit deployment for the reviewed revision before treating that binary as deployment-qualified. On 2026-09-28 the revised helper was compiled, linted and unit-tested on Linux in the pinned builder image, which caught and fixed an ambiguous by_ref that only the Linux build sees, and a rebuilt image passed a fresh real-vfkit deployment with 18 of 18 checks, including observation-enforced.

P094-021 review adds a PID-namespace supervisor. Only an enforced observation whose process tree was killed/reaped and whose root digest is unchanged can return observation-timeout-quiesced; Workbench preserves this proof and the verifier adapter maps it to bounded retry/max. Transport loss, missing proof, or changed roots never qualify. The extra 1 s is cleanup grace, not command budget. This newer supervisor is not covered by the earlier vfkit report. P094-013 now qualifies it on Linux/KVM (2026-10-03): a detached descendant dies on timeout, exit 124 is not accepted as timeout proof, and another observation succeeds in the same VM. A separate native test reaches the actual host verifier loop, recovering and exhausting retry/max=1 with exactly two attempts each in one VM. Its passing document is a named protocol fixture, not qmail truth; seven real qmail checks belong to the independent run verifier.

Acceptance Criteria¶

P094 may be promoted only when:

P085 remains the sole package lifecycle and activation authority;
one package installs and activates without publishing or executing anything;
a local binding resolves to one immutable plan with no ambient alternatives;
an operator reaches a runnable binding by supplying only choices without a safe default, and never types a digest or activation generation;
every binding change except the host-local emergency pause is committed under a current operator binding and the expected revision, and is recorded with its actor;
reactivation or P085 rollback of the same profile leaves the binding valid, while a changed profile digest blocks it until the operator accepts the diff;
ordinary Service Offer publication binds the exact task profile and can be withdrawn;
a remote requester can select the offer and create a Corpus deliberation using prose;
no prose or model output becomes executable without a closed action profile, and no candidate content influences a step's effect class or HIL requirement;
the qmail scenario performs read-only inspection before mutation, deliberated in a real Corpus Room with a reviewer that can reject an unsafe proposal, and its report names the evidence class of its inference;
every mutation requires the configured HIL and current owner authorization;
the verifier proves local delivery and rejected relay under its exact contract;
VM teardown/recreation succeeds, and a crash after an effect admission point ends only after owner-confirmed destruction;
step capabilities and effect classes come only from owner-owned contracts, and a missing owner source yields the more restrictive derivation;
package revocation synchronously closes local admission and eventually withdraws the offer;
every refusal code has a stage, retry class, and next action, and readiness reports one decisive blocker per root cause;
restart, pause during a run, crash with an unknown step, changed replay, stale generation, substituted image/profile/verifier, lost grant/lease, HIL denial, exhausted budget, and unavailable rollback have reaching tests;
inspection and retained evidence contain no secret, raw prompt, chain-of-thought, private payload, or machine-local path leakage;
documentation describes only implemented surfaces and the implementation ledger identifies the evidence.

Open Questions¶

Service Offer binding. Resolved on 2026-10-04 by Decision 37: a closed operator-task/profile object in the existing namespaced policy annotations. Implementation and qualification remain tracked by P094-007.
Prepared-system schema. Resolved by P094-008c (2026-09-28): the existing acceptance fixture shape is promoted unchanged as sensorium-virt-prepared-system.v1, a Sensorium Virt owner contract, and the image manifest binds its digest.
Local-binding attestation. Version 1 treats the binding as a host-owned, source-aware projection protected by operator configuration and current-use checks. A later federated or transferable binding may require a signed artifact, but it must not be added merely for symmetry.
Multiple profiles per pack. The package format can carry multiple semantic entries. Acceptance must determine whether independent task profiles may share one environment and refusal corpus without obscuring their exact readiness.
Solver-authored patch material. Resolved on 2026-10-04 by the operator: adopt the typed publication seam in Decision 30 / P094-013b1. This permits real-model authorship of repair bytes without prepublishing the expected repair through the acceptance operator; implementation and measured MLX acceptance remain separate tracker claims.

Consequences¶

Positive¶

Operators configure a coherent product instead of manually preserving a graph of loosely related refs.
Corpus remains domain-general while task-specific semantics stay in package assets and owning contracts.
Natural-language deliberation remains useful without crossing the authority boundary.
Readiness and refusal become explainable before publication or execution, with one decisive blocker and a tabled next action instead of free-form diagnosis.
Operators author only choices without a safe default; digests, generations, and capability lists are derived, so upgrades and reactivations do not create manual re-binding work.
The Version 1 recovery scope removes per-step domain reconciliation from the first slice: an uncertain outcome costs one owner-confirmed environment destruction.
Reuse of P085, Workbench, Interfaces, BDO, Replay Scheduler, and temporal stores avoids a second control plane.
The qmail exemplar exercises non-programming operational work and exposes hidden assumptions in the current Story-012-centric composition.

Costs¶

Cross-domain conformance requires exact version and digest management.
Operators still make local decisions about environments, runtimes, price, HIL, and network; the pack organizes those decisions rather than eliminating them.
Publication and withdrawal add asynchronous reconciliation states.
Version 1 covers only tasks whose effects stay inside a contained environment; tasks that must change durable or external state, or use Interface actuation, wait for P094-017.
Workbench and P080 owners must first land four contract changes: patch policy, command-profile effect mode, the action-semantics map, and the isolated-environment resource kind.
A useful refusal corpus is substantial and must evolve with every new action kind.
Strict no-fallback behaviour may feel less convenient than ambient local tooling, but it keeps authority and evidence understandable.

Deferred extensions¶

package-defined callable behaviours through P093;
effects outside a contained environment, including Interface actuation (P094-017);
proving that an isolated network is contained;
plan-level HIL approval as a third, less restrictive HIL mode;
automatic acceptance of profile revisions that narrow every axis and substitute nothing;
externally networked task environments;
signed portable local-binding templates;
transferable prepared-system attestations across heterogeneous hypervisors;
task-pack composition from multiple signing authorities;
automated reputation projection for task-pack providers;
task classes requiring physical actuators beyond the first P083 integration.