2.2 KiB
2.2 KiB
Foundation Exit audit — V1
Status is based on executed repository tests and Docker-stack verification on 2026-08-16.
| Criterion | Status | Evidence / gap |
|---|---|---|
| Cold agent can use repository artifacts | PASS | AGENTS.md, architecture documents, versioned task packets and devctl preflight. |
| Cross-owner DB write denied | PASS | tests/owner_acl/verify.ps1 proves continuity_role cannot write work.tasks. |
| Wrong-project mutation rejected | PASS | focus isolation tests and the remote WS-004 guarded commit harness. |
| Stale/revoked authority rejected | PASS | action-commit tests and live HTTP 409 checks in DEV-000017. |
| Duplicate/replay side effect prevention | PASS | isolated Test Executor applies by ActionIntentID once, injects lost ACK, and reconciles without mutation. |
| Future obligation survives engine loss | PASS | prospective-memory recovery and reproducible remote Continuity restart harness. |
| No-LLM continuity | PASS | DEV-000014 stopped cognitive worker while Core, Continuity and Commit remained available. |
| Two process topologies | PASS | in-process suites plus tests/topology_equivalence/verify-remote.ps1 for extracted runtimes. |
| Provider swap/fake | PASS | deterministic cognitive fake has no canonical mutation authority. |
| Declared/observed architecture | PASS | strengthened sentinel checks declared contract dependencies and implementation imports; discovered Commit→Identity drift was removed. |
| Semantic migration drill | PASS | Capability Health V1→V2 migration, rejection of V3 and projection rebuild. |
| Guardrails negative tests | PASS | negative self-tests cover infrastructure imports, cross-module implementation imports, undeclared contracts, protected-path task authority, and live DB ACL denial. |
Foundation conclusion
Foundation V1 is eligible for freeze. Creator session authentication was also completed as DEV-000019 and does not carry Authority.
Post-foundation product work is intentionally separate:
- Choose and specify the first real external operation before adding a production Executor credential.
- Build Creator API/UI only through validated Identity, Authority and Commit boundaries.
- Add exact diff-to-task scope comparison to promotion CI when the first Git baseline exists.