Evidence graph

Every platform, artifact name and installation URL is derived from one model, and a projection that disagrees with it is refused claim · guaranteed

• specified_by → source:docs/DISTRIBUTION.md
• implemented_by → impl:apps/majordomus-cli/src/distribution/mod.rs
• proved_by → test:test/cases/84_distribution_model.sh

The documented one-line install command is composed from the model's parts, and a document that states a different one fails the suite claim · guaranteed

• specified_by → source:docs/INSTALL.md
• implemented_by → impl:apps/majordomus-cli/src/distribution/mod.rs
• proved_by → test:test/cases/84_distribution_model.sh

The installer verifies an artifact's digest and inspects its archive before anything is unpacked, and any failure leaves the previous installation working claim · guaranteed

• specified_by → source:docs/INSTALL.md
• implemented_by → impl:share/install/install.sh.in
• proved_by → test:test/cases/85_installer.sh

A release publishes an artifact for every supported target or it is not published claim · guaranteed

• specified_by → source:docs/DISTRIBUTION.md
• implemented_by → impl:scripts/release-record
• proved_by → test:test/cases/87_release_pipeline.sh

The install command this project advertises is fetched and run from the published site every night and on request, and the run that asked for it is red while it does not install a working tool claim · guaranteed

• specified_by → source:docs/DISTRIBUTION.md
• implemented_by → impl:scripts/ci/install-check
• proved_by → test:test/cases/97_install_gate.sh

A release archive carries every path once and carries nothing but files and directories claim · guaranteed

• specified_by → source:docs/DISTRIBUTION.md
• implemented_by → impl:scripts/release-package
• proved_by → test:test/cases/87b_release_archive_shape.sh

The canonical policy is parsed and rejected if it contains an unknown key claim · guaranteed

• specified_by → source:docs/SCHEMAS.md
• implemented_by → impl:lib/common.sh
• proved_by → test:test/cases/00_yaml_flatten.sh

Every profile is parsed, its unknown keys rejected, and the default profile proven to exist claim · guaranteed

• specified_by → source:docs/SCHEMAS.md
• implemented_by → impl:lib/doctor.sh
• proved_by → test:test/cases/02_doctor_basic.sh

Every enforcement the policy declares is reconciled against what actually runs claim · guaranteed

• specified_by → source:docs/DESIGN.md
• implemented_by → impl:lib/doctor.sh
• proved_by → test:test/cases/03_update.sh

Exit codes are a contract, and no code means "warn and continue" claim · guaranteed

• specified_by → source:docs/CLI.md
• implemented_by → impl:lib/common.sh
• proved_by → test:test/cases/03_update.sh

Provider instruction files are generated from the one policy, deterministically claim · guaranteed

• specified_by → source:docs/DESIGN.md
• implemented_by → impl:lib/update.sh
• proved_by → test:test/cases/03_update.sh

Every generated instruction file carries its own stamp, and a hand edit is detected claim · guaranteed

• specified_by → source:docs/SCHEMAS.md
• implemented_by → impl:lib/update.sh
• proved_by → test:test/cases/03_update.sh

A projection can own only the region between its markers, leaving the rest of the file untouched claim · guaranteed

• specified_by → source:docs/SCHEMAS.md
• implemented_by → impl:lib/update.sh
• proved_by → test:test/cases/13_region_projection.sh

Wiring is found in a hook or in any subhook of the directory that hook dispatches to claim · guaranteed

• specified_by → source:docs/CLI.md
• implemented_by → impl:lib/doctor.sh
• proved_by → test:test/cases/14_wiring_dispatcher.sh

Every rule the tool enforces is declared once, as a rule object in the repository's effective set, and doctor proves each one is reached by the command that claims to run it claim · guaranteed

• specified_by → source:docs/DOCTRINE.md
• implemented_by → impl:lib/doctrine.sh
• proved_by → test:test/cases/18_doctrine_wiring.sh

A doctrine's class is what decides whether a violation stops the command, not a label beside it claim · guaranteed

• specified_by → source:docs/DOCTRINE.md
• implemented_by → impl:lib/doctrine.sh
• proved_by → test:test/cases/17_doctrine_enforcement.sh

Every line of the append-only ledger is a well-formed event, and a malformed line is a failure rather than a skipped record claim · guaranteed

• specified_by → source:docs/DOCTRINE.md
• implemented_by → impl:lib/check.sh
• proved_by → test:test/cases/22_history.sh

A decision record without a task, a head and a reason is reported, and does not block claim · advisory

• specified_by → source:docs/DOCTRINE.md
• implemented_by → impl:lib/check.sh
• proved_by → test:test/cases/21_decision_question.sh

An entry in the questions store that does not parse blocks acceptance exactly as an unresolved question does claim · guaranteed

• specified_by → source:docs/DOCTRINE.md
• implemented_by → impl:lib/check.sh
• proved_by → test:test/cases/21_decision_question.sh

A declared provider hook captures the person's raw prompts below the model, and doctor proves it by running it claim · guaranteed

• specified_by → source:docs/DOCTRINE.md
• implemented_by → impl:lib/capture.sh
• proved_by → test:test/cases/29_prompt_capture.sh

A captured prompt names the episode it belongs to or records that none could be resolved; the archive is private, bounded and free of credential material claim · guaranteed

• specified_by → source:docs/DOCTRINE.md
• implemented_by → impl:lib/capture.sh
• proved_by → test:test/cases/140_prompt_continuity.sh

Every repository-local prompt asset renders, and an unknown token is a failure claim · guaranteed

• specified_by → source:docs/DOCTRINE.md
• implemented_by → impl:lib/prompt.sh
• proved_by → test:test/cases/24_prompt_search.sh

A use case or application cannot name a command, doctrine or claim that does not exist, and the two catalogues cannot disagree about which applies to which claim · guaranteed

• specified_by → source:docs/DOCTRINE.md
• implemented_by → impl:lib/usecase.sh
• proved_by → test:test/cases/28_catalogue.sh

A hand-edited instruction file is never silently overwritten claim · guaranteed

• specified_by → source:docs/CLI.md
• implemented_by → impl:lib/update.sh
• proved_by → test:test/cases/03_update.sh

An archive that lost the file modes fails rather than travelling claim · guaranteed

• specified_by → source:docs/ARCHIVE.md
• implemented_by → impl:lib/archive.sh
• proved_by → test:test/cases/130_archive.sh

The always-loaded instruction file has a line budget with a failing check claim · guaranteed

• specified_by → source:share/skeleton/policy.yaml
• implemented_by → impl:lib/update.sh
• proved_by → test:test/cases/03_update.sh

Every repository-relative reference in the always-loaded file is proven to resolve claim · guaranteed

• specified_by → source:docs/DESIGN.md
• implemented_by → impl:lib/doctor.sh
• proved_by → test:test/cases/03_update.sh

A hardcoded count in the always-loaded file is a failure claim · guaranteed

• specified_by → source:docs/DESIGN.md
• implemented_by → impl:lib/doctor.sh
• proved_by → test:test/cases/03_update.sh

The append-only ledger and handover store have retention caps that are checked claim · guaranteed

• specified_by → source:share/skeleton/policy.yaml
• implemented_by → impl:lib/doctor.sh
• proved_by → test:test/cases/02_doctor_basic.sh

Installing into a repository that already has an installation is refused claim · guaranteed

• specified_by → source:docs/CLI.md
• implemented_by → impl:lib/init.sh
• proved_by → test:test/cases/01_init.sh

Every finding carries the command that reproduces it claim · guaranteed

• specified_by → source:docs/DESIGN.md
• implemented_by → impl:lib/common.sh
• proved_by → test:test/cases/02_doctor_basic.sh

The shell tool performs no network call, evaluates no generated text and deletes nothing recursively; its one declared request is the loopback peer probe claim · guaranteed

• specified_by → source:docs/DESIGN.md
• implemented_by → impl:bin/majordomus
• proved_by → test:test/cases/08_no_forbidden_constructs.sh

A task is started with a declared file scope and a profile, and only one task is active per checkout claim · guaranteed

• specified_by → source:docs/CLI.md
• implemented_by → impl:lib/start.sh
• proved_by → test:test/cases/04_start_check.sh

Identity fields on every state record are computed from git and never authored claim · guaranteed

• specified_by → source:docs/SCHEMAS.md
• implemented_by → impl:lib/start.sh
• proved_by → test:test/cases/04_start_check.sh

check reports whether state, scope, blockers and checkpoint age are consistent right now claim · guaranteed

• specified_by → source:docs/CLI.md
• implemented_by → impl:lib/check.sh
• proved_by → test:test/cases/04_start_check.sh

A touched file outside the claimed scope is a failure, not a warning claim · guaranteed

• specified_by → source:docs/DESIGN.md
• implemented_by → impl:lib/check.sh
• proved_by → test:test/cases/04_start_check.sh

State read back is labelled exact, advanced, diverged or different_context against git claim · guaranteed

• specified_by → source:docs/SCHEMAS.md
• implemented_by → impl:lib/common.sh
• proved_by → test:test/cases/04_start_check.sh

Overlap between parallel workers is computed on claimed paths in both containment directions claim · guaranteed

• specified_by → source:docs/DESIGN.md
• implemented_by → impl:lib/check.sh
• proved_by → test:test/cases/04_start_check.sh

watch reports policy, projection, state, scope, handover, verification, staleness and retention drift claim · guaranteed

• specified_by → source:docs/DESIGN.md
• implemented_by → impl:lib/watch.sh
• proved_by → test:test/cases/07_watch.sh

handover writes an append-only record with computed front matter and required sections claim · guaranteed

• specified_by → source:docs/SCHEMAS.md
• implemented_by → impl:lib/handover.sh
• proved_by → test:test/cases/05_handover.sh

A handover is a state record, not a transcript - its required sections must be present and non-empty, a placeholder body is refused, and its identity is computed and refused when written into the body; a transcript pasted into a section is not detected claim · guaranteed

• specified_by → source:docs/DESIGN.md
• implemented_by → impl:lib/handover.sh
• proved_by → test:test/cases/05_handover.sh

finish evaluates the finish contract line by line and refuses when any line is unmet claim · guaranteed

• specified_by → source:docs/CLI.md
• implemented_by → impl:lib/finish.sh
• proved_by → test:test/cases/06_finish.sh

every refused finish appends a task.refused event naming the outcome claimed, the unmet count and the doctrines that refused, and finish --check writes none claim · guaranteed

• specified_by → source:share/events.yaml
• implemented_by → impl:lib/finish.sh
• proved_by → test:test/cases/06_finish.sh

An outcome is a value from a closed vocabulary, not free text claim · guaranteed

• specified_by → source:docs/SCHEMAS.md
• implemented_by → impl:lib/finish.sh
• proved_by → test:test/cases/06_finish.sh

Capability class, reasoning effort, output verbosity, context and verification are five independent axes claim · advisory

• specified_by → source:share/skeleton/profiles/implementation.yaml
• implemented_by → impl:lib/update.sh
• proved_by → test:test/cases/03_update.sh

A profile names a capability class rather than a vendor model claim · advisory

• specified_by → source:share/skeleton/profiles/deep-work.yaml
• implemented_by → impl:lib/update.sh
• proved_by → test:test/cases/03_update.sh

A profile declares which context a worker should load and no more claim · advisory

• specified_by → source:share/skeleton/profiles/routine.yaml
• implemented_by → impl:lib/check.sh
• proved_by → test:test/cases/04_start_check.sh

Escalating reasoning effort after repeated blocked attempts is recorded rather than assumed claim · advisory

• specified_by → source:share/skeleton/profiles/debugging.yaml
• implemented_by → impl:lib/update.sh
• proved_by → test:test/cases/03_update.sh

A profile sets how often a worker should checkpoint, and a stale task is reported claim · advisory

• specified_by → source:share/skeleton/policy.yaml
• implemented_by → impl:lib/check.sh
• proved_by → test:test/cases/04_start_check.sh

The context a worker is given is assembled from durable state in authority order, and what a profile excludes is excluded claim · guaranteed

• specified_by → source:docs/CONTINUITY.md
• implemented_by → impl:lib/context.sh
• proved_by → test:test/cases/23_context.sh

The assembled context obeys a line budget, and every section it drops is named with its reason claim · guaranteed

• specified_by → source:share/skeleton/policy.yaml
• implemented_by → impl:lib/context.sh
• proved_by → test:test/cases/23_context.sh

A checkpoint is a capped progress record with computed identity, and a body over the cap is refused rather than truncated claim · guaranteed

• specified_by → source:docs/SCHEMAS.md
• implemented_by → impl:lib/checkpoint.sh
• proved_by → test:test/cases/20_checkpoint.sh

The right prior record is resolved by worktree and branch, and an unrelated one is never offered claim · guaranteed

• specified_by → source:docs/CONTINUITY.md
• implemented_by → impl:lib/common.sh
• proved_by → test:test/cases/23_context.sh

The ledger is readable back as operational history, filtered by task, event and time claim · guaranteed

• specified_by → source:docs/CLI.md
• implemented_by → impl:lib/history.sh
• proved_by → test:test/cases/22_history.sh

Rotating the ledger archives the oldest lines and never deletes them claim · guaranteed

• specified_by → source:docs/SCHEMAS.md
• implemented_by → impl:lib/history.sh
• proved_by → test:test/cases/22_history.sh

A decision is recorded with its reason and its task, and is superseded by a later entry rather than edited claim · guaranteed

• specified_by → source:docs/SCHEMAS.md
• implemented_by → impl:lib/decision.sh
• proved_by → test:test/cases/21_decision_question.sh

An unresolved question blocks acceptance, and an entry the gate cannot parse is a failure rather than a silent pass claim · guaranteed

• specified_by → source:docs/SCHEMAS.md
• implemented_by → impl:lib/question.sh
• proved_by → test:test/cases/21_decision_question.sh

A repository-local prompt renders against a closed set of state tokens, and an unknown token is an error claim · guaranteed

• specified_by → source:docs/SCHEMAS.md
• implemented_by → impl:lib/prompt.sh
• proved_by → test:test/cases/24_prompt_search.sh

Durable records are searchable literally, across kinds, without an index claim · guaranteed

• specified_by → source:docs/CLI.md
• implemented_by → impl:lib/search.sh
• proved_by → test:test/cases/24_prompt_search.sh

Every continuity store is proven reachable through its own command, not merely present on disk claim · guaranteed

• specified_by → source:docs/CLI.md
• implemented_by → impl:lib/doctor.sh
• proved_by → test:test/cases/25_continuity_lifecycle.sh

The context that applies to a path is composed from the layer's scoped documents, root to target, in one deterministic order with provenance, and a tree that does not validate resolves nothing claim · guaranteed

• specified_by → source:docs/CLI.md
• implemented_by → impl:lib/context_docs.sh
• proved_by → test:test/cases/69_context_documents.sh

Every directory of the layer carries a context document, the exemption is declared by the contract that governs the subtree, and a descendant may narrow that requirement but never weaken it claim · guaranteed

• specified_by → source:docs/CONTEXT.md
• implemented_by → impl:lib/context_docs.sh
• proved_by → test:test/cases/69_context_documents.sh

The impact of a change set on the scoped context is reported from git — the documents, the scopes below them, moves with their ancestry, tracked sources to review, and stale projections — and an unrelated change reports nothing claim · guaranteed

• specified_by → source:docs/CLI.md
• implemented_by → impl:lib/context_docs.sh
• proved_by → test:test/cases/70_context_impact.sh

The repository's AI layer is one directory whose manifest names every section, readable without the tool claim · guaranteed

• specified_by → source:docs/SCHEMAS.md
• implemented_by → impl:lib/init.sh
• proved_by → test:test/cases/01_init.sh

A layer installed with --personal is one person's own in a shared repository: it changes no tracked file, no .gitignore line and nothing git status shows, and the command that makes the claim verifies it claim · guaranteed

• specified_by → source:docs/INSTALL.md
• implemented_by → impl:lib/common.sh
• proved_by → test:test/cases/2979_a_personal_layer_changes_nothing_shared.sh

Checkout-local state lives under .ai/local/, is ignored by git, and is absent on a fresh clone or worktree claim · guaranteed

• specified_by → source:docs/SCHEMAS.md
• implemented_by → impl:lib/common.sh
• proved_by → test:test/cases/01_init.sh

The rule baseline is vendored into the repository with a manifest naming every file and its hash, and a hand edit is detected and refused claim · guaranteed

• specified_by → source:docs/DOCTRINE.md
• implemented_by → impl:lib/rules.sh
• proved_by → test:test/cases/67_rule_dag.sh

The effective rule set is resolved as a dependency graph in a deterministic order, and a set that does not resolve is applied by nothing claim · guaranteed

• specified_by → source:docs/DOCTRINE.md
• implemented_by → impl:lib/rules.sh
• proved_by → test:test/cases/67_rule_dag.sh

Provider instruction files are thin bootstraps that point at the AI layer and carry no rule of their own claim · guaranteed

• specified_by → source:docs/DESIGN.md
• implemented_by → impl:lib/update.sh
• proved_by → test:test/cases/03_update.sh

A repository on the pre-.ai layout is migrated once, explicitly, with a previewed plan and a verified backup of its local state, and the command is idempotent afterwards claim · guaranteed

• specified_by → source:docs/CLI.md
• implemented_by → impl:lib/migrate.sh
• proved_by → test:test/cases/66_migrate_legacy.sh

The tool runs read-only from any location, and two locations of one version agree about one repository claim · guaranteed

• specified_by → source:docs/DESIGN.md
• implemented_by → impl:lib/common.sh
• proved_by → test:test/cases/65_tool_root_independence.sh

A task will know which commits it produced, rather than inferring them from a range claim · planned

• specified_by → source:docs/CONTINUITY.md

What the tool knows about itself is written once and derived everywhere else, and a second copy is a test failure claim · guaranteed

• specified_by → source:docs/CONCEPTS.md
• implemented_by → impl:lib/doctor.sh
• proved_by → test:test/cases/28_no_hardcoded_values.sh

The public command surface is declared, and reconciled against the dispatcher claim · guaranteed

• specified_by → source:docs/DYNAMICITY.md
• implemented_by → impl:share/commands.yaml
• proved_by → test:test/cases/30_command_registry.sh

Every public command has a behavioural test and a negative test, computed rather than remembered claim · guaranteed

• specified_by → source:docs/DYNAMICITY.md
• implemented_by → impl:test/cases/31_command_coverage.sh
• proved_by → test:test/cases/31_command_coverage.sh

The ledger's event vocabulary is closed, on the way in and on the way out claim · guaranteed

• specified_by → source:docs/SCHEMAS.md
• implemented_by → impl:lib/common.sh
• proved_by → test:test/cases/33_event_registry.sh

Ranked or semantic retrieval over durable records is deliberately not implemented claim · rejected

• specified_by → source:docs/CONTINUITY.md

A task record names the checkout it belongs to, and another checkout is never held to its scope claim · guaranteed

• specified_by → source:docs/SCHEMAS.md
• implemented_by → impl:lib/check.sh
• proved_by → test:test/cases/27_foreign_task.sh

A blocking question keeps blocking after the work is handed to a new task claim · guaranteed

• specified_by → source:docs/CONTINUITY.md
• implemented_by → impl:lib/check.sh
• proved_by → test:test/cases/50_blocker_across_handover.sh

Opt-in runtime adapters will clamp read size, output size and fan-out from profile-derived limits claim · planned

• specified_by → source:docs/DESIGN.md

Execution telemetry will be recorded once a provider exposes it honestly claim · planned

• specified_by → source:docs/DESIGN.md

What the context compiler selects, out of what it judged relevant, is counted in tokens of a named tokenizer and recorded, never estimated claim · guaranteed

• specified_by → source:docs/ECONOMICS.md
• implemented_by → impl:apps/majordomus-cli/src/economics/context.rs
• proved_by → test:test/cases/430_economics.sh

A quantity about tokens, context or cost typed into hand-written prose is refused, and a claim bound to a metric cannot be guaranteed while its evidence does not stand claim · guaranteed

• specified_by → source:docs/ECONOMICS.md
• implemented_by → impl:apps/majordomus-cli/src/economics/claims.rs
• proved_by → test:test/cases/431_economics_claims_gated.sh

Majordomus will state a total-token change only from matched, verified runs that meet the methodology's publication rule claim · planned

• specified_by → source:docs/ECONOMICS.md

Cost per accepted outcome will be reported from measured data only claim · planned

• specified_by → source:docs/DESIGN.md

Routing recommendations will be derived from measured cost and outcome data claim · planned

• specified_by → source:docs/DESIGN.md

One policy will be shared across repositories and workers claim · planned

• specified_by → source:docs/DESIGN.md

A task record has no dependencies; sequencing between sessions is not represented claim · rejected

• specified_by → source:docs/DESIGN.md

Milestones and issues are canonical repository files, and a key nobody reads is an error claim · guaranteed

• specified_by → source:docs/SCHEMAS.md
• implemented_by → impl:lib/project.sh
• proved_by → test:test/cases/40_project_model.sh

Issue and milestone status is derived from recorded facts and is stored nowhere claim · guaranteed

• specified_by → source:docs/PLANNING.md
• implemented_by → impl:lib/project.awk
• proved_by → test:test/cases/41_project_status.sh

A cycle, a self-dependency and a dependency on an issue that does not exist are each refused by name claim · guaranteed

• specified_by → source:docs/PLANNING.md
• implemented_by → impl:lib/project.awk
• proved_by → test:test/cases/42_dag_waves.sh

Execution waves are computed from the graph, and issues in one wave that touch the same paths are reported as serialised claim · guaranteed

• specified_by → source:docs/PLANNING.md
• implemented_by → impl:lib/project.awk
• proved_by → test:test/cases/42_dag_waves.sh

An issue cannot be completed while a required piece of evidence is missing claim · guaranteed

• specified_by → source:docs/PLANNING.md
• implemented_by → impl:lib/plan.sh
• proved_by → test:test/cases/41_project_status.sh

The roadmap is derived from milestone state, and no document may be a second authority for it claim · guaranteed

• specified_by → source:docs/ROADMAP.md
• implemented_by → impl:lib/doctor.sh
• proved_by → test:test/cases/49_roadmap_doctrine.sh

GitHub milestones and issues are generated from the canonical model, and a hand-edited generated region is reported rather than overwritten claim · guaranteed

• specified_by → source:docs/PLANNING.md
• implemented_by → impl:scripts/github-sync
• proved_by → test:test/cases/45_github_projection.sh

A projection that stops being applied turns a build red, and a gate that cannot reach GitHub reports that it cannot rather than passing claim · guaranteed

• specified_by → source:docs/PLANNING.md
• implemented_by → impl:scripts/ci/github-check
• proved_by → test:test/cases/97_github_gate.sh

A pull request that edits a projected plan record is not refused because GitHub does not show the edit yet, and the trunk is refused for it once a declared window has passed claim · guaranteed

• specified_by → source:docs/PLANNING.md
• implemented_by → impl:scripts/ci/github-check
• proved_by → test:test/cases/1038_a_head_is_judged_against_what_it_changes.sh

An intent's stage is derived from the milestones that realise it and each criterion from the evidence ledger, and it is satisfied only while every criterion has a current passing run claim · guaranteed

• specified_by → source:docs/PLANNING.md
• implemented_by → impl:apps/majordomus-cli/src/intent.rs
• proved_by → test:test/cases/367_an_intent_is_satisfied_only_by_evidence.sh

An intent whose criterion names evidence that resolves to nothing is refused by name claim · guaranteed

• specified_by → source:docs/PLANNING.md
• implemented_by → impl:apps/majordomus-cli/src/intent.rs
• proved_by → test:test/cases/367_an_intent_is_satisfied_only_by_evidence.sh

Once work exists under an intent, a criterion no issue serves, an issue under its milestones that serves nothing and a link to a criterion that does not exist are each refused by name claim · guaranteed

• specified_by → source:docs/PLANNING.md
• implemented_by → impl:apps/majordomus-cli/src/intent_plan.rs
• proved_by → test:test/cases/386_a_plan_is_held_to_its_intent.sh

A gap that leaves a criterion unanswered is refused, and an issue serving an intent that started without a critique or while a blocking finding is open fails intent validation claim · guaranteed

• specified_by → source:docs/PLANNING.md
• implemented_by → impl:apps/majordomus-cli/src/intent_review.rs
• proved_by → test:test/cases/386_a_plan_is_held_to_its_intent.sh

The work realising an intent is joined across sessions, providers and handovers, and an intent whose milestones are all closed while a criterion's evidence fails is refused naming that criterion claim · guaranteed

• specified_by → source:docs/PLANNING.md
• implemented_by → impl:apps/majordomus-cli/src/intent_realization.rs
• proved_by → test:test/cases/388_an_intent_is_realised_across_providers_and_held_to_reality.sh

Asked before work on an issue, `intent preflight` names the intents the issue serves with the governance that applies, or refuses naming the cause claim · guaranteed

• specified_by → source:docs/PLANNING.md
• implemented_by → impl:apps/majordomus-cli/src/intent.rs
• proved_by → test:apps/majordomus-cli/tests/intent.rs

The Cockpit shows every intent with its derived stage at /cockpit/intents, and one intent's criteria, evidence, serving issues and realising work at /cockpit/intents/<id> claim · guaranteed

• specified_by → source:docs/COCKPIT.md
• implemented_by → impl:apps/majordomus-cli/src/cockpit/intents.rs
• proved_by → test:apps/majordomus-cli/tests/intent_realization.rs

A task that names the issue or the intent it serves is briefed with what that intent asks of the work, and a handover tells the next worker when the intent moved claim · guaranteed

• specified_by → source:docs/PLANNING.md
• implemented_by → impl:lib/intent_binding.sh
• proved_by → test:test/cases/960_a_task_starts_bound_to_what_it_serves.sh

Where the policy requires binding, starting an issue or a task that serves an intent with no critique, or with a blocking finding open, is refused when it is started rather than reported afterwards claim · guaranteed

• specified_by → source:docs/PLANNING.md
• implemented_by → impl:apps/majordomus-cli/src/intent_binding.rs
• proved_by → test:test/cases/962_plan_start_asks_the_binding_in_both_engines.sh

A milestone will be closed on GitHub only once the intents it realises are satisfied claim · planned

• specified_by → source:docs/PLANNING.md

A criterion settled by a command or by a deployment will be met by recorded evidence claim · planned

• specified_by → source:docs/PLANNING.md

The Rust executable serves the repository's AI layer to an MCP client over stdio, with protocol frames alone on stdout claim · guaranteed

• specified_by → source:docs/MCP.md
• implemented_by → impl:apps/majordomus-cli/src/mcp/protocol.rs
• proved_by → test:test/cases/72_rust_mcp.sh

What the MCP server serves is decided by the manifest, the declared source classes and each file's front matter, so an object added to the layer is served with no change to the executable claim · guaranteed

• specified_by → source:docs/MCP.md
• implemented_by → impl:apps/majordomus-cli/src/index.rs
• proved_by → test:test/cases/72_rust_mcp.sh

A file of the layer the MCP server cannot read is excluded with a diagnostic naming its path and the index says it is degraded, never silently smaller claim · guaranteed

• specified_by → source:docs/MCP.md
• implemented_by → impl:apps/majordomus-cli/src/index.rs
• proved_by → test:test/cases/72_rust_mcp.sh

Every capability of the Rust executable is defined once, and the registry refuses a duplicate id or a colliding projection name, naming both parties claim · guaranteed

• specified_by → source:docs/CAPABILITIES.md
• implemented_by → impl:apps/majordomus-cli/src/capability/registry.rs
• proved_by → test:apps/majordomus-cli/tests/registry.rs

MCP, HTTP, OpenAPI, Swagger UI, the capabilities commands and the generated reference are derived from the registry, and a change to one definition reaches every one of them claim · guaranteed

• specified_by → source:docs/CAPABILITIES.md
• implemented_by → impl:apps/majordomus-cli/src/http/openapi.rs
• proved_by → test:test/cases/76_capabilities_projections.sh

How each declarative kind is read and which keys it may carry is data read at run time, and a repository adds a kind with its JSON Schema without a code change claim · guaranteed

• specified_by → source:docs/CAPABILITIES.md
• implemented_by → impl:apps/majordomus-cli/src/metadata/mod.rs
• proved_by → test:test/cases/76_capabilities_projections.sh

Every generated artifact declares the document it projects, the encoding it is written in, the schema its content satisfies and its source, and a structured document is written in every encoding it is committed in from one value claim · guaranteed

• specified_by → source:docs/CAPABILITIES.md
• implemented_by → impl:apps/majordomus-cli/src/generate.rs
• proved_by → test:test/cases/52_generated_artifact_typing.sh

The committed projections, the OpenAPI document, the capability reference and the allow-lists, are regenerated from the registry and the schemas, and generate --check refuses a stale one claim · guaranteed

• specified_by → source:docs/CAPABILITIES.md
• implemented_by → impl:apps/majordomus-cli/src/generate.rs
• proved_by → test:test/cases/76_capabilities_projections.sh

One shared server serves a checkout: the first majordomus mcp binds loopback HTTP with Swagger UI and MCP over HTTP beside its stdio session and logs the URL, every later client of that checkout attaches to it, and it ends when the last client leaves claim · guaranteed

• specified_by → source:docs/MCP.md
• implemented_by → impl:apps/majordomus-cli/src/lease.rs
• proved_by → test:test/cases/90_mcp_shared_server.sh

Nothing a client leaves behind locks another client out of the shared server; a corrupt, empty, stale or abandoned lease is taken over and named, a client that cannot share is served alone with the reason logged, and a signal removes the lease before the server dies claim · guaranteed

• specified_by → source:docs/MCP.md
• implemented_by → impl:apps/majordomus-cli/src/lease.rs
• proved_by → test:apps/majordomus-cli/tests/mcp_shared.rs

A server whose lease was taken over says so on the endpoint every reader probes, refuses to take on a new client, and reports that what its health describes is another process; the sessions it already had continue and it ends with them claim · guaranteed

• specified_by → source:docs/MCP.md
• implemented_by → impl:apps/majordomus-cli/src/lease.rs
• proved_by → test:apps/majordomus-cli/tests/lease_lost.rs

Every client attached to a checkout's server is a peer named by its own initialize, and majordomus_peers lists every worker of the repository - its own board and the board of every other checkout, each peer stamped with the worktree it is working in - while majordomus_announce tells the others what it is working on and which paths it expects to touch claim · guaranteed

• specified_by → source:docs/MCP.md
• implemented_by → impl:apps/majordomus-cli/src/peers.rs
• proved_by → test:test/cases/250_the_board_is_repository_wide.sh

An MCP client opened in the repository starts the server itself, through the client configurations at the root and bin/majordomus-mcp, without ever building the executable claim · guaranteed

• specified_by → source:docs/MCP.md
• implemented_by → impl:bin/majordomus-mcp
• proved_by → test:test/cases/90_mcp_shared_server.sh

A client that starts the MCP server from a checkout whose executable is missing or stale is served by the installed release when it is of this tree's generation and told so, and is otherwise refused with exit 12 naming the explicit build; nothing is built claim · guaranteed

• specified_by → source:docs/MCP.md
• implemented_by → impl:bin/majordomus-cli
• proved_by → test:test/cases/3177_a_client_always_gets_a_server.sh

A bare claude in a supervised repository starts with the repository's session-start prompt as its first message, and a run with an argument, outside such a repository, with the opt-out, or with a prompt that cannot be rendered is left exactly as it was claim · guaranteed

• specified_by → source:docs/MCP.md
• implemented_by → impl:share/shell/session-start.sh
• proved_by → test:test/cases/3221_a_bare_session_start_joins_the_cluster.sh

A tag with a pre-release part is published as a prerelease, recorded on the prerelease channel, and never resolved as the stable release, so an unpinned installer and a node that follows stable keep the highest stable version claim · guaranteed

• specified_by → source:docs/DISTRIBUTION.md
• implemented_by → impl:scripts/release-record
• proved_by → test:test/cases/3179_a_prerelease_is_never_published_as_stable.sh

A majordomus:// URI resolves the same way through the MCP resource read, the majordomus_get tool and the HTTP object route, and majordomus://repository answers repository.info as a JSON document tagged builtin claim · guaranteed

• specified_by → source:docs/MCP.md
• implemented_by → impl:apps/majordomus-cli/src/capability/builtin/objects.rs
• proved_by → test:apps/majordomus-cli/tests/http_serve.rs

Every gate the Rust executable must pass is one script, scripts/rust-check, and CI runs that script on every change that can reach the crate claim · guaranteed

• specified_by → source:.ai/repo/rules/project/rust-cli-evidence.v1.md
• implemented_by → impl:scripts/rust-check
• proved_by → test:test/cases/77_rust_evidence.sh

Coverage of the Rust crate is measured with test code out of the denominator, on every change that can affect the crate and on every push to master, and the build fails under the floor in scripts/rust-coverage-threshold or under the session/continuity domain's own floor in scripts/session-coverage-threshold claim · guaranteed

• specified_by → source:.ai/repo/rules/project/rust-cli-evidence.v1.md
• implemented_by → impl:scripts/rust-coverage
• proved_by → test:test/cases/77_rust_evidence.sh

The paths of the Rust executable that scale with the repository carry criterion benchmarks that build on every push, and every executable capability declares its benchmark policy, required or waived for a typed reason claim · guaranteed

• specified_by → source:.ai/repo/rules/project/rust-cli-evidence.v1.md
• implemented_by → impl:apps/majordomus-cli/benches/projections.rs
• proved_by → test:test/cases/77_rust_evidence.sh

A capability of the Rust executable is declared once and composed into its module, the root composes modules, and the registry refuses a capability outside its module's namespace claim · guaranteed

• specified_by → source:docs/CAPABILITIES.md
• implemented_by → impl:apps/majordomus-cli/src/capability/module.rs
• proved_by → test:apps/majordomus-cli/tests/registry.rs

Every externally callable operation of the Rust executable is a benchmark target with a denominator generated from the registry, and a missing case fails the structural check claim · guaranteed

• specified_by → source:docs/CAPABILITIES.md
• implemented_by → impl:apps/majordomus-cli/src/bench/coverage.rs
• proved_by → test:apps/majordomus-cli/tests/bench_units.rs

After startup, no MCP or HTTP request of the Rust executable scans the repository, builds the index or the registry, derives a schema or builds a projection, and perf.counters proves it claim · guaranteed

• specified_by → source:docs/CAPABILITIES.md
• implemented_by → impl:apps/majordomus-cli/src/perf.rs
• proved_by → test:test/cases/91_canonical_architecture.sh

A cached capability of the Rust executable answers the same value uncached, cold and warm, a hit runs no handler, errors and commands are never cached, and the key carries the registry fingerprint claim · guaranteed

• specified_by → source:docs/CAPABILITIES.md
• implemented_by → impl:apps/majordomus-cli/src/capability/executor.rs
• proved_by → test:apps/majordomus-cli/tests/executor.rs

The provider bootstraps the policy declares (AGENTS.md, CLAUDE.md, GEMINI.md, ...) are a target of majordomus generate, rendered from the policy and the provider templates byte for byte as the shell tool renders them, and generate --check refuses a hand-edited or stale one in CI claim · guaranteed

• specified_by → source:docs/CAPABILITIES.md
• implemented_by → impl:apps/majordomus-cli/src/providers.rs
• proved_by → test:test/cases/93_rust_provider_projections.sh

The site's Registry page is rendered from site/data/registry/registry.json, a dataset majordomus generate site derives from the registry and the index with their fingerprints, and generate --check refuses a stale one in CI claim · guaranteed

• specified_by → source:docs/CAPABILITIES.md
• implemented_by → impl:apps/majordomus-cli/src/site.rs
• proved_by → test:apps/majordomus-cli/tests/projections.rs

A change runs the gates its paths can affect, decided by one model of what affects what, and a change to the pipeline itself or a path the model does not know runs every gate claim · guaranteed

• specified_by → source:.ai/repo/ci/gates.yaml
• implemented_by → impl:scripts/ci-plan
• proved_by → test:test/cases/94_ci_plan.sh

The verdict status is green only when planning succeeded and every gate the plan selected ran in a job that succeeded; a failed or cancelled job, a selected gate whose job was skipped, or a plan that selected nothing is red claim · guaranteed

• specified_by → source:docs/CI.md
• implemented_by → impl:scripts/ci/verdict
• proved_by → test:test/cases/94_ci_plan.sh

No pull request can be merged into the default branch while the verdict status is red, because a branch rule requires it claim · planned

• specified_by → source:docs/CI.md

The behavioural suite runs a bounded number of cases at a time with the serial runner's semantics, a case that writes into the checkout declares itself exclusive and runs alone, and the parallel phase fails naming the paths when the checkout changed under it claim · guaranteed

• specified_by → source:docs/CI.md
• implemented_by → impl:test/run.sh
• proved_by → test:test/cases/94_ci_plan.sh

The Rust executable the rust gate built is published as an artifact with its provenance, and every Rust case drives the executable MAJORDOMUS_BIN names instead of building one claim · guaranteed

• specified_by → source:docs/CI.md
• implemented_by → impl:scripts/rust-check
• proved_by → test:test/cases/401_the_rust_artifact_carries_its_provenance.sh

Publication is gated on everything that can make the published site wrong and waits for nothing else; the checks that decide whether a change may merge run beside it on the same commit, not in front of it claim · guaranteed

• specified_by → source:docs/GITHUB_PAGES_PERFORMANCE.md
• implemented_by → impl:.github/workflows/pages.yml
• proved_by → test:test/cases/97_pages_fast_path.sh

The OpenAPI document is inferred, the tags are the modules, the examples are the benchmark cases, the responses are the router's statuses by kind, the prose is the one text every projection shares, and the site's API reference is rendered from the committed document claim · guaranteed

• specified_by → source:docs/CAPABILITIES.md
• implemented_by → impl:apps/majordomus-cli/src/http/openapi.rs
• proved_by → test:test/cases/92_openapi_reference.sh

What a worker reads of the repository is declared once in .ai/repo/scope.yaml, out wins over in, and the Rust executable discovers, indexes and serves nothing outside it claim · guaranteed

• specified_by → source:docs/SCOPE.md
• implemented_by → impl:apps/majordomus-cli/src/scope.rs
• proved_by → test:test/cases/93_scope_policy.sh

Every public command is named and run by an active use case, a guaranteed claim or an MCP tool without one is a named gap, and the policy says which gaps fail doctor, check and finish claim · guaranteed

• specified_by → source:docs/USE_CASES.md
• implemented_by → impl:lib/usecase.sh
• proved_by → test:test/cases/94_use_cases.sh

A use case's scenario executes against the real tool in a disposable repository, every step's exit code and output are asserted, and the normalised evidence is what the site shows claim · guaranteed

• specified_by → source:docs/USE_CASES.md
• implemented_by → impl:lib/usecase.sh
• proved_by → test:test/cases/94_use_cases.sh

From the files a change touched, the tool names the commands, rules, use cases, scenarios and behavioural cases affected, and scaffolds a draft for a capability no use case covers claim · guaranteed

• specified_by → source:docs/USE_CASES.md
• implemented_by → impl:lib/usecase.sh
• proved_by → test:test/cases/94_use_cases.sh

A live scenario may only run commands share/commands.yaml declares read-only, names no setup, and asserts an obligation only where something owes one; every other shape is refused by usecase validate with exit 10 claim · guaranteed

• specified_by → source:docs/USE_CASES.md
• implemented_by → impl:lib/usecase.sh
• proved_by → test:test/cases/359_live_scenarios.sh

A live scenario is not selected by a bare usecase run, its evidence is written under the ignored local half, and it never raises a command to covered; an undischarged obligation is reported unmet, never failed claim · guaranteed

• specified_by → source:docs/USE_CASES.md
• implemented_by → impl:lib/usecase.sh
• proved_by → test:test/cases/359_live_scenarios.sh

The site is deployed by one script, scripts/site-deploy, from a terminal or from the publication workflow; it refuses a dirty tree, a commit master does not contain and a build that is not HEAD's, pushes site/public to gh-pages with the source commit named, and pushes nothing when the output is unchanged claim · guaranteed

• specified_by → source:docs/GITHUB_PAGES_ARCHITECTURE.md
• implemented_by → impl:scripts/site-deploy
• proved_by → test:test/cases/96_site_deploy.sh

A commit whose derived data is behind its canonical inputs is refused before it exists, and a repository that unwires that gate is a doctor failure claim · guaranteed

• specified_by → source:docs/GITHUB_PAGES_ARCHITECTURE.md
• implemented_by → impl:scripts/pages
• proved_by → test:test/cases/56_derived_current_gate.sh

The site's pages about the Rust executable (one per module, one per capability, the command line, the MCP surface, the benchmarks, the executable's own narrative) are derived from the registry manifest and the registry dataset the executable generates, nothing names a capability by hand, and a capability that joins or leaves the registry gains or loses its page, its index entries and its links from the generators alone claim · guaranteed

• specified_by → source:docs/GITHUB_PAGES_ARCHITECTURE.md
• implemented_by → impl:scripts/lib/executable-site.jq
• proved_by → test:test/cases/95_executable_reference.sh

Every committed derived artifact of the repository is regenerated by one command in dependency order and checked by one read-only command that names every stale artifact, a second regeneration on a clean tree changes nothing, and no derived file records the commit it lands in claim · guaranteed

• specified_by → source:docs/GITHUB_PAGES_ARCHITECTURE.md
• implemented_by → impl:scripts/derive
• proved_by → test:test/cases/400_derivation_is_one_graph.sh

A skill is one directory under the layer's skills section holding SKILL.md, discovered by the source class `skill` the shell tool and the Rust executable both read, so that adding the file is the whole registration and the catalogue, the command, doctor, MCP and the site all derive from it claim · guaranteed

• specified_by → source:docs/SCHEMAS.md
• implemented_by → impl:lib/skills.sh
• proved_by → test:test/cases/95_skills.sh

A task that declares obligations reaches the outcome completed only when each one has evidence recorded against it, and evidence taken over files that have since changed, or at a commit the branch has since left, no longer discharges anything claim · guaranteed

• specified_by → source:docs/CLI.md
• implemented_by → impl:lib/evidence.sh
• proved_by → test:test/cases/103_obligations.sh

An obligation whose fact the tool can hold is established live rather than recorded — a clean tree, a remote-tracking ref that reaches the head, a trunk that reaches it, a published site that serves it — and a hand-recorded line neither discharges it nor rescues it claim · guaranteed

• specified_by → source:docs/CLI.md
• implemented_by → impl:lib/evidence.sh
• proved_by → test:test/cases/103_obligations.sh

Every skill is validated against the allow-list generated from its schema, its directory, its sections and its references, a violation names the file and every reason, and a repository with no skills is reported rather than passed claim · guaranteed

• specified_by → source:docs/CLI.md
• implemented_by → impl:lib/skills.sh
• proved_by → test:test/cases/95_skills.sh

The website's skills section is rendered from the skills catalogue, one page per skill carrying the skill's own body and examples, and a removed or renamed skill leaves no page, entry or link behind claim · guaranteed

• specified_by → source:docs/GITHUB_PAGES_ARCHITECTURE.md
• implemented_by → impl:scripts/generate-site-data
• proved_by → test:test/cases/95_skills.sh

An operational moment is one file under the layer, discovered rather than registered, and answered by the command line, the HTTP API, the OpenAPI document, MCP, the derived graph and the website with nothing else changed claim · guaranteed

• specified_by → source:docs/WHY.md
• implemented_by → impl:apps/majordomus-cli/src/why.rs
• proved_by → test:apps/majordomus-cli/tests/why.rs

Every reference a moment makes resolves against the thing it names, and one that does not is an error carrying the nearest candidate claim · guaranteed

• specified_by → source:docs/WHY.md
• implemented_by → impl:apps/majordomus-cli/src/why.rs
• proved_by → test:apps/majordomus-cli/tests/why.rs

A diagnosis of a reader's own symptoms is deterministic counting over the catalogue's metadata, and every recommendation names the moments that produced it claim · guaranteed

• specified_by → source:docs/WHY.md
• implemented_by → impl:apps/majordomus-cli/src/why.rs
• proved_by → test:apps/majordomus-cli/tests/why.rs

A closed execution episode is a shared object of the layer, written by the tool from git and the ledger, valid against a contract that admits no conversation and no absolute path, and discovered rather than registered claim · guaranteed

• specified_by → source:docs/SCHEMAS.md
• implemented_by → impl:lib/session.sh
• proved_by → test:test/cases/63_session_records.sh

A provider hook opens the episode below the model and hands the worker what the last one left, records what a compaction is about to discard, and closes the episode with a continuation record beside its envelope claim · guaranteed

• specified_by → source:docs/DOCTRINE.md
• implemented_by → impl:lib/session_context.sh
• proved_by → test:test/cases/54_session_lifecycle_hooks.sh

The session subsystem has a reading of itself — every open episode of the store and not only the one the pointer follows, the episodes that can no longer close themselves, the commit the serving process is answering about, and what each provider's adapter declares claim · guaranteed

• specified_by → source:docs/CONTINUITY.md
• implemented_by → impl:apps/majordomus-cli/src/capability/builtin/lifecycle.rs
• proved_by → test:test/cases/171_session_observability.sh

A client with no provider hooks gets an execution episode from the MCP connection, resumes its own after a crash, and never has its prompt claimed to be captured claim · guaranteed

• specified_by → source:docs/MCP.md
• implemented_by → impl:apps/majordomus-cli/src/episodes.rs
• proved_by → test:test/cases/200_generic_mcp_episode.sh

What each provider can do about the session lifecycle, prompt capture, driving a browser beside this server and reporting what a session consumed is one declaration with a citation per cell, every surface projects it, and no provider the declaration names goes unreported claim · guaranteed

• specified_by → source:docs/CONCEPTS.md
• implemented_by → impl:share/providers.yaml
• proved_by → test:test/cases/200_generic_mcp_episode.sh

An architecture decision is one file under the layer's adrs section, validated against the decision contract, with an identity nothing else claims, reciprocal supersession, and every reference it makes resolving claim · guaranteed

• specified_by → source:docs/SCHEMAS.md
• implemented_by → impl:lib/adr.sh
• proved_by → test:test/cases/99_adr.sh

A decision states what it put in force as typed references, each one validated, and the reverse direction — what a rule, a document, an implementation or a case was decided by — is read from the knowledge graph rather than written down a second time claim · guaranteed

• specified_by → source:docs/SCHEMAS.md
• implemented_by → impl:lib/adr.sh
• proved_by → test:test/cases/99_adr.sh

majordomus adr propose writes a decision with status proposed and refuses to write any other status, allocates its identity under a lock so concurrent workers never collide, and records what the decision was derived from claim · guaranteed

• specified_by → source:docs/SCHEMAS.md
• implemented_by → impl:lib/adr.sh
• proved_by → test:test/cases/99_adr.sh

Every command of the Rust executable's command line carries a summary, help on every argument and, where it runs, at least one example, the root carries a long description, and every example shown to a reader is executed against the built executable claim · guaranteed

• specified_by → source:.ai/repo/rules/project/rust-cli-evidence.v1.md
• implemented_by → impl:apps/majordomus-cli/src/cli.rs
• proved_by → test:apps/majordomus-cli/tests/cli_examples.rs

Every web surface is declared once at its producer and resolved into one topology, from which the router, the landing page and the machine-readable index are each projected claim · guaranteed

• specified_by → source:.ai/repo/adrs/0013-every-web-surface-is-discovered-from-its-producer-resolved-o.md
• implemented_by → impl:apps/majordomus-cli/src/web/model.rs
• proved_by → test:test/cases/89_web_surface.sh

/docs serves this repository's documentation and /swagger serves the Swagger UI, and neither may take the other's mount claim · guaranteed

• specified_by → source:.ai/repo/rules/project/web-surface-declared-once.v1.md
• implemented_by → impl:apps/majordomus-cli/src/web/discover.rs
• proved_by → test:test/cases/89_web_surface.sh

The crate's rustdoc is a web surface at /rustdoc declared by discovery from the crate, present in the topology, its committed projection and the home page whether or not its producer has run, and a running server answers /rustdoc/ from the tree its producer wrote claim · guaranteed

• specified_by → source:docs/RUSTDOC.md
• implemented_by → impl:apps/majordomus-cli/src/web/discover.rs
• proved_by → test:test/cases/488_rustdoc_discoverable.sh

The site build composes every published static surface into its output at that surface's mount, read from the committed topology with no surface named by hand, and refuses, naming the producer, when a published surface's artifact is absent claim · guaranteed

• specified_by → source:docs/RUSTDOC.md
• implemented_by → impl:scripts/site-build
• proved_by → test:test/cases/486_rustdoc_composition.sh

The crate's rustdoc is published at /rustdoc with the site, built from the commit the site names, and is never committed claim · guaranteed

• specified_by → source:docs/RUSTDOC.md
• implemented_by → impl:scripts/site-deploy
• proved_by → test:test/cases/489_rustdoc_deploy.sh

Every item the crate exports has its rustdoc page at the route derived from its path and kind, no item page exists without its item, and a module added to the crate becomes a required page with no list edited claim · guaranteed

• specified_by → source:docs/RUSTDOC.md
• implemented_by → impl:apps/majordomus-cli/src/quality/rustdoc.rs
• proved_by → test:test/cases/490_rustdoc_new_module.sh

A rustdoc tree built from another commit than the one it is checked or deployed as is refused, by the integrity check before publication and by the public verification after it claim · guaranteed

• specified_by → source:docs/RUSTDOC.md
• implemented_by → impl:scripts/pages
• proved_by → test:test/cases/487_rustdoc_staleness.sh

Every builtin module's page on the site links the page the crate's reference documents that module on, from the one module-to-page mapping the rustdoc check holds the published tree to, and only in a build that composed the reference claim · guaranteed

• specified_by → source:docs/RUSTDOC.md
• implemented_by → impl:apps/majordomus-cli/src/site.rs
• proved_by → test:test/cases/492_rustdoc_module_links.sh

A branch's worktree path is derived from git identity and the branch name alone — the primary checkout's sibling named with -wt, then the branch with its hierarchy kept — and is the same answer from every directory of every worktree, with nothing registered or configured claim · guaranteed

• specified_by → source:docs/WORKTREES.md
• implemented_by → impl:apps/majordomus-cli/src/worktree/path.rs
• proved_by → test:test/cases/96_worktree_topology.sh

A misplaced worktree is brought to its canonical path with its modified, staged, unstaged and untracked work intact, verified by a fingerprint taken before and after the move, and a step is reported as moved only when the two are equal claim · guaranteed

• specified_by → source:docs/WORKTREES.md
• implemented_by → impl:apps/majordomus-cli/src/worktree/migrate.rs
• proved_by → test:test/cases/96_worktree_topology.sh

A product feature is one file under the layer, discovered rather than registered, and answered by the command line, the HTTP API, the OpenAPI document, MCP, the derived graph, the capability matrix and the website's homepage and feature pages with nothing else changed claim · guaranteed

• specified_by → source:docs/PRODUCT.md
• implemented_by → impl:apps/majordomus-cli/src/product.rs
• proved_by → test:test/cases/97_product_features.sh

The product is filed under a few domains declared once as files of the layer; a feature names exactly one, and every domain's members, interfaces, guarantees and use cases are derived from the features that name it, so a stable feature cannot be left out of the product map without the model refusing it claim · guaranteed

• specified_by → source:docs/PRODUCT.md
• implemented_by → impl:apps/majordomus-cli/src/product.rs
• proved_by → test:test/cases/800_product_domains.sh

Which interfaces a feature is exposed through, what stands behind it and what it answers are derived from the registries that own those facts, never authored, and a source file that writes one down is refused by its schema claim · guaranteed

• specified_by → source:docs/PRODUCT.md
• implemented_by → impl:apps/majordomus-cli/src/product.rs
• proved_by → test:apps/majordomus-cli/tests/product.rs

Every reference a feature makes resolves against the registry that owns it, and one that does not is an error naming the file, the key and the nearest candidate rather than a page linking to nothing claim · guaranteed

• specified_by → source:docs/PRODUCT.md
• implemented_by → impl:apps/majordomus-cli/src/product.rs
• proved_by → test:apps/majordomus-cli/tests/product.rs

The dataset the website is rendered from carries only fields an allow-list names, so a feature's prose, a machine path or a field nobody allowed cannot reach a published page claim · guaranteed

• specified_by → source:docs/PRODUCT.md
• implemented_by → impl:apps/majordomus-cli/src/site.rs
• proved_by → test:apps/majordomus-cli/tests/product.rs

The website's homepage and feature pages name no feature, module, command, provider or count of their own, and a stale product dataset is refused by the pre-commit hook and by the rust gate before it can be merged claim · guaranteed

• specified_by → source:docs/GITHUB_PAGES_ARCHITECTURE.md
• implemented_by → impl:site/templates/index.html
• proved_by → test:test/cases/400_derivation_is_one_graph.sh

A capability added to the registry appears in the Cockpit's listing, navigation and search and on a page of its own with a form generated from its schema, without one line of the Cockpit being edited claim · guaranteed

• specified_by → source:docs/COCKPIT.md
• implemented_by → impl:apps/majordomus-cli/src/cockpit/mod.rs
• proved_by → test:apps/majordomus-cli/tests/cockpit.rs

The UI's dashboard at /ui links every capability it read to that capability's page, serves under the Cockpit's security policy, and never waits for the pull-request queue, which is a page and a fragment of its own claim · guaranteed

• specified_by → source:docs/MAJORDOMUS_UI.md
• implemented_by → impl:apps/majordomus-cli/src/ui/dashboard.rs
• proved_by → test:apps/majordomus-cli/tests/ui_surface.rs

The Observatory at /ui/observatory and /ui/kiosk shows a scene only when the capabilities it requires answered with something to draw, or, for a scene of the mesh where no mesh runs, when the repository carries a recording of it, which it labels a replay; a scene without either carries no model and states the source's reason, on a server and in the published snapshot alike claim · guaranteed

• specified_by → source:docs/MAJORDOMUS_UI.md
• implemented_by → impl:apps/majordomus-cli/src/ui/observatory.rs
• proved_by → test:test/cases/3011_the_observatory_draws_nothing_it_did_not_read.sh

A deployment object that breaks its closed contract, whether by a key the contract does not have, another schema version, a missing field, an interface, port, machine count or health route that could not work, a provider the contract does not know or a provider address that is not https, a value that reads as a credential or an identity two files claim, is refused by doctor with the reason named claim · guaranteed

• specified_by → source:.ai/repo/rules/vendor/majordomus/rules/deployment-contract.v2.md
• implemented_by → impl:lib/deployment.sh
• proved_by → test:test/cases/84_deployment_contract.sh

A claim's proof is an execution that was recorded with the commit it ran against, not a test path that resolves claim · guaranteed

• specified_by → source:docs/EVIDENCE.md
• implemented_by → impl:apps/majordomus-cli/src/evidence/mod.rs
• proved_by → test:test/cases/124_evidence.sh

CI records every test it ran with the commit and the run it happened in, and the site publishes the tracked ledger's verdict at that commit as current only when CI's run of the published commit measured clean trees and nothing was absent, refused or failed; otherwise as stale with its distance or its failures, as unknown with its reasons, or as unavailable with the reason claim · guaranteed

• specified_by → source:docs/EVIDENCE.md
• implemented_by → impl:scripts/ci/evidence-collect
• proved_by → test:test/cases/357_ci_records_evidence.sh

Every rule names what proves it, and every path it names is in the tree claim · guaranteed

• specified_by → source:docs/DOCTRINE.md
• implemented_by → impl:scripts/ci/rule-proof-check
• proved_by → test:test/cases/125_rule_proof.sh

Every claim, rule, feature, command, capability, MCP tool and use case the repository declares is an evidence subject whose members and tests are derived from declarations that already exist, and a committed subject index that differs from that derivation is refused claim · guaranteed

• specified_by → source:docs/EVIDENCE.md
• implemented_by → impl:apps/majordomus-cli/src/evidence/subject.rs
• proved_by → test:test/cases/507_evidence_subjects_are_derived.sh

The behavioural and negative tests the subject index names for a command are exactly the ones its command page lists, both read from the first coverage and negative header of each case claim · guaranteed

• specified_by → source:docs/EVIDENCE.md
• implemented_by → impl:apps/majordomus-cli/src/evidence/subject.rs
• proved_by → test:test/cases/507_evidence_subjects_are_derived.sh

A rule that no program can express says so in its own front matter, with the reason, and is counted apart from every rule that has a gate claim · guaranteed

• specified_by → source:docs/DOCTRINE.md
• implemented_by → impl:scripts/ci/rule-proof-check
• proved_by → test:test/cases/125_rule_proof.sh

A rule's proof state is derived from the tree and the ledger together, and a mechanism that refuses violations is never reported as a run that passed claim · guaranteed

• specified_by → source:docs/DOCTRINE.md
• implemented_by → impl:apps/majordomus-cli/src/rules/mod.rs
• proved_by → test:test/cases/133_rule_graph.sh

Every authored file in this repository is spelled in English, and a proper noun, a test fixture or a published translation that is not carries its reason beside the check claim · guaranteed

• specified_by → source:docs/DOCTRINE.md
• implemented_by → impl:scripts/ci/english-only-check
• proved_by → test:test/cases/138_governance_gates.sh

A page of the published site written in a reader's language is declared with that language and a reason, and is refused unless the page declares the same language itself claim · guaranteed

• specified_by → source:.ai/repo/rules/project/english-only.v4.md
• implemented_by → impl:scripts/ci/english-only-check
• proved_by → test:test/cases/403_published_translation.sh

Every finding a command reports names the command that reproduces it claim · guaranteed

• specified_by → source:docs/DOCTRINE.md
• implemented_by → impl:scripts/ci/finding-reproduce-check
• proved_by → test:test/cases/138_governance_gates.sh

A run recorded against this commit and a run whose inputs merely have not changed since are reported as different states, never as one claim · guaranteed

• specified_by → source:docs/EVIDENCE.md
• implemented_by → impl:apps/majordomus-cli/src/evidence/mod.rs
• proved_by → test:test/cases/124_evidence.sh

Recording one test's result never erases the evidence recorded for any other test claim · guaranteed

• specified_by → source:docs/EVIDENCE.md
• implemented_by → impl:apps/majordomus-cli/src/evidence/ledger.rs
• proved_by → test:test/cases/124_evidence.sh

Every claim names the test meant to settle it and every test names the claims it is meant to settle, from one derivation claim · guaranteed

• specified_by → source:docs/EVIDENCE.md
• implemented_by → impl:apps/majordomus-cli/src/capability/builtin/evidence.rs
• proved_by → test:test/cases/124_evidence.sh

A claim that declares a guarantee no recorded run supports is named by a gate rather than displayed as guaranteed claim · guaranteed

• specified_by → source:docs/EVIDENCE.md
• implemented_by → impl:scripts/evidence-check
• proved_by → test:test/cases/124_evidence.sh

A claim reads proven only when its passing run was recorded on a commit the presented revision contains, nothing but the evidence ledger changed between the two, and neither the recorded tree nor the presented tree was dirty; a run on a commit the presented revision does not contain reads stale; a named revision is judged by the ledger committed in it, and a clean failing run of the same test that the checkout holds uncommitted, recorded between the two, caps it at stale claim · guaranteed

• specified_by → source:docs/EVIDENCE.md
• implemented_by → impl:apps/majordomus-cli/src/evidence/freshness.rs
• proved_by → test:test/cases/502_evidence_is_judged_at_the_presented_revision.sh

A test that declined to run reads not_run with a detail saying it declined, never proven and never failing, and a test that errored or timed out reads failing claim · guaranteed

• specified_by → source:docs/EVIDENCE.md
• implemented_by → impl:apps/majordomus-cli/src/evidence/freshness.rs
• proved_by → test:test/cases/502_evidence_is_judged_at_the_presented_revision.sh

A rule with a failing test reads failing whatever its other tests say, so a blocking rule whose tests are one failing and one not run is still a finding claim · guaranteed

• specified_by → source:docs/EVIDENCE.md
• implemented_by → impl:apps/majordomus-cli/src/evidence/freshness.rs
• proved_by → test:test/cases/502_evidence_is_judged_at_the_presented_revision.sh

No mesh discovery socket opens until the repository commits an enabled mesh declaration, and a disabled or absent declaration is reported as the reason, not an error claim · guaranteed

• specified_by → source:docs/MESH.md
• implemented_by → impl:apps/majordomus-cli/src/shared.rs
• proved_by → test:apps/majordomus-cli/tests/mesh.rs

Every discovery observation converges into one bounded registry, deduplicated by node and runtime identity across sources, replay-protected per instance, and every surface projects that registry and holds no peers of its own claim · guaranteed

• specified_by → source:docs/MESH.md
• implemented_by → impl:apps/majordomus-cli/src/mesh/registry.rs
• proved_by → test:apps/majordomus-cli/tests/mesh.rs

Two runtimes of one repository link only through a signed, replay-protected handshake that checks protocol, repository identity and trust, and every refusal is typed and visible claim · guaranteed

• specified_by → source:.ai/repo/rules/project/mesh-cooperation-is-authenticated.v1.md
• implemented_by → impl:apps/majordomus-cli/src/mesh/cooperation.rs
• proved_by → test:apps/majordomus-cli/tests/mesh_cooperation.rs

An exclusive claim made on one runtime excludes an overlapping claim on every linked runtime, and concurrent claims resolve to one named winner everywhere claim · guaranteed

• specified_by → source:.ai/repo/rules/project/mesh-cooperation-is-authenticated.v1.md
• implemented_by → impl:apps/majordomus-cli/src/mesh/state.rs
• proved_by → test:apps/majordomus-cli/tests/mesh_cooperation.rs

Runtimes serving different repositories never form a cooperative link, even when they discover each other claim · guaranteed

• specified_by → source:.ai/repo/rules/project/mesh-cooperation-is-authenticated.v1.md
• implemented_by → impl:apps/majordomus-cli/src/mesh/repository.rs
• proved_by → test:apps/majordomus-cli/tests/mesh_cooperation.rs

A runtime that stops beating — crashed, killed or partitioned — expires on its peers within the declared expiry, its claims stop excluding, and its restart reconnects as the same runtime without a duplicate claim · guaranteed

• specified_by → source:docs/MESH.md
• implemented_by → impl:apps/majordomus-cli/src/mesh/cooperation.rs
• proved_by → test:apps/majordomus-cli/tests/mesh_cooperation.rs

Runtimes linked only through a relay converge on one state digest, each event held once, with no replication loop claim · guaranteed

• specified_by → source:docs/MESH.md
• implemented_by → impl:apps/majordomus-cli/src/mesh/journal.rs
• proved_by → test:apps/majordomus-cli/tests/mesh_cooperation.rs

Compacting the cooperation journal changes nothing live — a handover nobody has taken keeps its stream for a bounded retention, who took a handover and who answered a review stay with them, and a compacted runtime that beats again is fetched again whole claim · guaranteed

• specified_by → source:docs/MESH.md
• implemented_by → impl:apps/majordomus-cli/src/mesh/journal.rs
• proved_by → test:test/cases/493_mesh_compaction_keeps_what_is_live.sh

Separate Linux nodes on a real network discover each other by multicast, link, share claims and handovers, and recover from a partition and a crash, in a lab CI runs claim · guaranteed

• specified_by → source:docs/MESH.md
• implemented_by → impl:test/mesh-lab/run
• proved_by → test:test/cases/414_mesh_lab_evidence.sh

A discovered node gains no execution and no authorization from being heard; only signed traffic from a linked node may change mesh state, and trust labels records under an explicit policy that defaults to deny_unknown claim · guaranteed

• specified_by → source:.ai/repo/rules/project/mesh-is-observation-not-authority.v1.md
• implemented_by → impl:apps/majordomus-cli/src/mesh/trust.rs
• proved_by → test:apps/majordomus-cli/tests/mesh.rs

An enabled mesh declaration whose shared server did not activate the mesh is a failed `runtime` check of `mesh doctor` (exit 10) carrying the server's reason, and a `Mesh: DECLARED ENABLED BUT NOT ACTIVE` line in the session-start briefing — never a quiet off; and this repository's committed declaration is tracked, enabled, allowlists the fleet and names a hub claim · guaranteed

• specified_by → source:docs/MESH.md
• implemented_by → impl:apps/majordomus-cli/src/mesh/doctor.rs
• proved_by → test:test/cases/494_the_mesh_is_declared_and_held.sh

The inbound admissions a mesh declaration implies on a machine — the multicast group's port, the declared hub ports whose address is the machine's, the server's port beyond loopback — are derived from the declaration by `majordomus mesh firewall`, which names the host's firewall backend, the commands that admit them and the firewall's own verdict, exits 10 when a rule is observed missing or the kernel logged a drop toward those ports, and whose `apply` runs the commands only as root and never over HTTP or MCP; `mesh doctor` carries the same verdict as its `firewall` check claim · guaranteed

• specified_by → source:docs/MESH.md
• implemented_by → impl:apps/majordomus-cli/src/mesh/firewall.rs
• proved_by → test:test/cases/495_the_firewall_admits_the_mesh.sh

Vendors and models are declared once in share/models.yaml, and the CLI, HTTP, OpenAPI, MCP and Cockpit render that one declaration with no model name of their own claim · guaranteed

• specified_by → source:docs/MODELS.md
• implemented_by → impl:apps/majordomus-cli/src/models/mod.rs
• proved_by → test:test/cases/131_models.sh

A routing decision names why the selected model was selected and, for every excluded model, the first check it failed — the same answer for the same question, with no hidden state claim · guaranteed

• specified_by → source:docs/MODELS.md
• implemented_by → impl:apps/majordomus-cli/src/models/mod.rs
• proved_by → test:test/cases/131_models.sh

The model catalogue reports whether a vendor's named credential variable is set and can carry no secret value — the schema has no field one could hide in claim · guaranteed

• specified_by → source:docs/MODELS.md
• implemented_by → impl:apps/majordomus-cli/src/models/mod.rs
• proved_by → test:test/cases/131_models.sh

A provider's end event and its compaction event derive the knowledge the episode produced into candidate records under the tracked tree, from the ledger and git and never from a conversation, whether or not a task is active, and record that they did so in the ledger claim · guaranteed

• specified_by → source:docs/KNOWLEDGE.md
• implemented_by → impl:lib/knowledge.sh
• proved_by → test:test/cases/563_knowledge_is_derived_at_the_boundary.sh

A second derivation over the same evidence writes nothing, says so, and leaves the working tree unchanged; the record id is derived from the episode and a digest of the evidence so the same fact always lands in the same file claim · guaranteed

• specified_by → source:docs/KNOWLEDGE.md
• implemented_by → impl:lib/knowledge.sh
• proved_by → test:test/cases/564_knowledge_derivation_is_idempotent.sh

A policy switch that is off derives nothing and says so; a derivation that fails inside a provider hook is recorded as provider.event.failed and the hook still exits 0 claim · guaranteed

• specified_by → source:docs/KNOWLEDGE.md
• implemented_by → impl:lib/capture.sh
• proved_by → test:test/cases/565_knowledge_switch_and_failure_leave_evidence.sh

Every knowledge record is schema-valid with no unknown key, uniquely identified, evidenced when verified, resolves every reference it names, and carries no conversation; check, doctor and `majordomus knowledge check` refuse a record that is not claim · guaranteed

• specified_by → source:docs/KNOWLEDGE.md
• implemented_by → impl:lib/knowledge.sh
• proved_by → test:test/cases/707_knowledge_check_refuses_malformed_records.sh

A repository in which episodes close and no knowledge derivation follows within the stale threshold is reported as a stopped writer by doctor and watch, and the finding clears when a derivation is written claim · guaranteed

• specified_by → source:docs/KNOWLEDGE.md
• implemented_by → impl:lib/knowledge.sh
• proved_by → test:test/cases/708_health_sees_a_stopped_knowledge_writer.sh

verified is written only by promote with evidence on stdin or by a person editing the file, never by the deriver; promotion moves the record to curated/ and rejection supersedes it with a reason, each leaving a ledger line claim · guaranteed

• specified_by → source:docs/KNOWLEDGE.md
• implemented_by → impl:lib/knowledge.sh
• proved_by → test:test/cases/709_knowledge_promotion_is_an_act.sh

knowledge observe records one observation.recorded ledger line with its kind, subject, statement and typed evidence references, inside an open episode, inside a task or outside one, and refuses any other shape, or the absence of an episode, without writing claim · guaranteed

• specified_by → source:docs/KNOWLEDGE.md
• implemented_by → impl:lib/knowledge.sh
• proved_by → test:test/cases/980_a_session_records_what_it_observed.sh

Each observation an episode recorded becomes, at that episode's end and with no model, a candidate of its own that says what it is about, and knowledge candidates groups the records about one subject with the episodes behind them; an episode that observed nothing records that it found nothing claim · guaranteed

• specified_by → source:docs/KNOWLEDGE.md
• implemented_by → impl:lib/knowledge.sh
• proved_by → test:test/cases/981_an_observation_becomes_a_grouped_candidate.sh

Every candidate derived from an observation carries a route — platform, enforcement, generator, documentation or project — derived from its subject's structure and never from its wording, and in a repository that adopted the tool its own share/ routes project claim · guaranteed

• specified_by → source:docs/KNOWLEDGE.md
• implemented_by → impl:lib/knowledge.sh
• proved_by → test:test/cases/982_a_candidate_is_routed_by_what_it_is_about.sh

The start briefing names the candidates awaiting review on this branch, count and ids, bounded and within the briefing budget, and prints their absence rather than omitting it claim · guaranteed

• specified_by → source:docs/KNOWLEDGE.md
• implemented_by → impl:lib/derive.sh
• proved_by → test:test/cases/710_briefing_names_the_candidates.sh

More candidates than the policy cap, or a candidate older than the policy age, is an advisory doctor finding that names them; both numbers are declared once in the policy claim · guaranteed

• specified_by → source:docs/KNOWLEDGE.md
• implemented_by → impl:lib/knowledge.sh
• proved_by → test:test/cases/711_candidates_are_reviewed_not_accumulated.sh

The candidates awaiting review, one record by id with its references resolved, and the derivation status of the checkout are one declaration each and answer with the same content over the command line, HTTP and MCP claim · guaranteed

• specified_by → source:docs/KNOWLEDGE.md
• implemented_by → impl:apps/majordomus-cli/src/capability/builtin/knowledge_base.rs
• proved_by → test:apps/majordomus-cli/tests/knowledge_base.rs

Every executable line, function and region a change adds or touches in the Rust crate must be covered by a test; a change that leaves new code uncovered is refused, and untouched legacy debt is left alone claim · guaranteed

• specified_by → source:docs/COVERAGE.md
• implemented_by → impl:scripts/rust-coverage
• proved_by → test:test/cases/132_coverage_differential.sh

A commit message that does not satisfy the repository's declared commit policy is refused at the moment it is written, and the history's existing debt is recorded and may not grow claim · guaranteed

• specified_by → source:docs/COMMIT.md
• implemented_by → impl:apps/majordomus-cli/src/commit/verdict.rs
• proved_by → test:test/cases/274_commit_policy.sh

The scope vocabulary a commit is judged against is learned from this repository's own history rather than kept in a table, so a subsystem committed today is in the vocabulary today and a scope outside it is a warning rather than a refusal claim · guaranteed

• specified_by → source:docs/COMMIT.md
• implemented_by → impl:apps/majordomus-cli/src/commit/scopes.rs
• proved_by → test:test/cases/274_commit_policy.sh

A commit plan carries a fingerprint of the repository, the worktree, HEAD and the exact change set it was derived from, so a plan acted on after the tree moved is refused with the reason rather than applied claim · guaranteed

• specified_by → source:docs/COMMIT.md
• implemented_by → impl:apps/majordomus-cli/src/commit/plan.rs
• proved_by → test:test/cases/274_commit_policy.sh

A crate test binary that ran no test or only a filtered subset is recorded as a skip, one with a failed test as a failure and one that printed no result as an error, whatever colour codes its output carries, and what no claim can name yet is listed as dropped claim · guaranteed

• specified_by → source:docs/EVIDENCE.md
• implemented_by → impl:apps/majordomus-cli/src/evidence/record.rs
• proved_by → test:test/cases/506_a_crate_binary_that_ran_nothing_is_not_a_pass.sh

A recorded execution carries the commit and the tree that its run's own measurement stated, a measurement that names the report it belongs to and never hides a tracked change; a measurement of another commit or another report is refused, a local measurement that names no report is refused, a CI report without a measurement is refused, and a report recorded without one carries an unknown tree, which never reads proven claim · guaranteed

• specified_by → source:docs/EVIDENCE.md
• implemented_by → impl:apps/majordomus-cli/src/evidence/record.rs
• proved_by → test:test/cases/505_a_recording_carries_what_its_run_measured.sh

Every recording yields a run record naming its commit, the tree each report's run measured, its totals and what was absent, dropped or unknown, and a coverage summary joins it only bound to the commit and tree it was measured on claim · guaranteed

• specified_by → source:docs/EVIDENCE.md
• implemented_by → impl:apps/majordomus-cli/src/evidence/run.rs
• proved_by → test:test/cases/505_a_recording_carries_what_its_run_measured.sh

A recording made with --ledger local writes only the ignored local ledger, changes no tracked file and moves no verdict claim · guaranteed

• specified_by → source:docs/EVIDENCE.md
• implemented_by → impl:apps/majordomus-cli/src/evidence/ledger.rs
• proved_by → test:test/cases/505_a_recording_carries_what_its_run_measured.sh

A test case that declines to run is reported as a skip and recorded as one, so the evidence ledger can never read a case that asserted nothing as the proof of the claim it names claim · guaranteed

• specified_by → source:docs/EVIDENCE.md
• implemented_by → impl:test/run.sh
• proved_by → test:test/cases/413_a_skipped_case_is_not_a_proof.sh

Majordomus reasons, decides, implements and validates with no advisor at all: absent advisors are reported as ordinary state, material uncertainty gets a structured local review, and the conclusion claims no independent review claim · guaranteed

• specified_by → source:docs/REASONING.md
• implemented_by → impl:apps/majordomus-cli/src/reasoning/policy.rs
• proved_by → test:test/cases/730_reasoning_works_with_no_advisor.sh

Every advisor transport is held to one contract — typed failures, deadlines, cancellation, normalised answers, reported usage, redacted secrets — proven against fakes with no network, model or credential claim · guaranteed

• specified_by → source:docs/REASONING.md
• implemented_by → impl:scripts/lib/advisors/contract.mjs
• proved_by → test:test/cases/731_advisor_transport_contract.sh

Advisors that disagree never decide by count: a conclusion is refused while a disagreement on its assessment is unsettled, a resolution needs evidence, and every answer received must be weighed claim · guaranteed

• specified_by → source:docs/REASONING.md
• implemented_by → impl:apps/majordomus-cli/src/reasoning/store.rs
• proved_by → test:test/cases/732_disagreement_is_settled_by_evidence.sh

An advisor that times out, is rate limited, refuses its credential or answers malformed is recorded as exactly that, never blocks the work, opens a circuit that closes again after its cooldown, and never fails the session claim · guaranteed

• specified_by → source:docs/REASONING.md
• implemented_by → impl:apps/majordomus-cli/src/reasoning/availability.rs
• proved_by → test:test/cases/733_advisor_failure_and_recovery.sh

A decision and its provenance survive the session: the next session finds them in its context and handover, reuses a standing conclusion instead of consulting again, and reopens it only on new evidence claim · guaranteed

• specified_by → source:docs/REASONING.md
• implemented_by → impl:apps/majordomus-cli/src/reasoning/state.rs
• proved_by → test:test/cases/734_reasoning_survives_the_session.sh

Advisors are declared once, in share/advisors.yaml, by reference to the provider table and the model catalogue; a new advisor reaches the command line, the policy, HTTP, OpenAPI, MCP and the Cockpit with no consumer edited claim · guaranteed

• specified_by → source:docs/REASONING.md
• implemented_by → impl:share/advisors.yaml
• proved_by → test:test/cases/735_a_new_advisor_needs_no_consumer_edit.sh

A session cannot claim review it did not get: a consultation must name an advisor its recorded plan selected, a conclusion's review is computed, and reasoning check and doctor refuse a forged record, provider coupling, a model credential in CI and a refused claim in a document claim · guaranteed

• specified_by → source:docs/REASONING.md
• implemented_by → impl:apps/majordomus-cli/src/reasoning/check.rs
• proved_by → test:test/cases/736_reasoning_check_refuses_drift.sh

Whether a task added debt, left a branch or a worktree behind, or grew the backlog is answered by the done invariant from git, the debt baselines and the recorded forge observation, measured from where the task started; a reading that was not taken is unknown, never a pass claim · guaranteed

• specified_by → source:docs/CLI.md
• implemented_by → impl:apps/majordomus-cli/src/gates/closing.rs
• proved_by → test:test/cases/1037_the_closing_question_is_measured.sh

Every Mermaid diagram of the built site gets an id (diagram-<name>), the list of its nodes, the viewer's controls and a link for each node that is the identity of an object the site has a page for, all derived at build; a link to claim · guaranteed

• specified_by → source:docs/DIAGRAMS.md
• implemented_by → impl:scripts/lib/diagrams.mjs
• proved_by → test:test/cases/3006_diagrams_are_interactive_and_linkable.sh

.github/workflows/pages.yml implementation

• claim:site-deploys-from-verified-run implemented_by → this

apps/majordomus-cli/benches/projections.rs implementation

• claim:rust-hot-path-benchmarks implemented_by → this

apps/majordomus-cli/src/bench/coverage.rs implementation

• claim:benchmark-coverage-derived implemented_by → this

apps/majordomus-cli/src/capability/builtin/evidence.rs implementation

• claim:evidence-navigates-both-ways implemented_by → this

apps/majordomus-cli/src/capability/builtin/knowledge_base.rs implementation

• claim:knowledge-served-on-every-surface implemented_by → this

apps/majordomus-cli/src/capability/builtin/lifecycle.rs implementation

• claim:session-observability implemented_by → this

apps/majordomus-cli/src/capability/builtin/objects.rs implementation

• claim:mcp-uri-resolution implemented_by → this

apps/majordomus-cli/src/capability/executor.rs implementation

• claim:execution-cache-equivalence implemented_by → this

apps/majordomus-cli/src/capability/module.rs implementation

• claim:capability-modules implemented_by → this

apps/majordomus-cli/src/capability/registry.rs implementation

• claim:capability-registry implemented_by → this

apps/majordomus-cli/src/cli.rs implementation

• claim:cli-documentation-executable implemented_by → this

apps/majordomus-cli/src/cockpit/intents.rs implementation

• claim:intent-cockpit-pages implemented_by → this

apps/majordomus-cli/src/cockpit/mod.rs implementation

• claim:cockpit-is-a-projection-of-the-registry implemented_by → this

apps/majordomus-cli/src/commit/plan.rs implementation

• claim:commit-plan-is-refusable implemented_by → this

apps/majordomus-cli/src/commit/scopes.rs implementation

• claim:commit-scopes-are-learned implemented_by → this

apps/majordomus-cli/src/commit/verdict.rs implementation

• claim:commit-message-is-judged implemented_by → this

apps/majordomus-cli/src/distribution/mod.rs implementation

• claim:distribution-canonical-model implemented_by → this
• claim:install-command-is-derived implemented_by → this

apps/majordomus-cli/src/economics/claims.rs implementation

• claim:economics-claims-gated implemented_by → this

apps/majordomus-cli/src/economics/context.rs implementation

• claim:context-selection-counted implemented_by → this

apps/majordomus-cli/src/episodes.rs implementation

• claim:connection-episode implemented_by → this

apps/majordomus-cli/src/evidence/freshness.rs implementation

• claim:evidence-judged-at-the-presented-revision implemented_by → this
• claim:evidence-a-skip-is-not-run implemented_by → this
• claim:evidence-a-failure-outranks-an-absence implemented_by → this

apps/majordomus-cli/src/evidence/ledger.rs implementation

• claim:evidence-partial-run-preserves-the-rest implemented_by → this
• claim:evidence-local-recording-stays-local implemented_by → this

apps/majordomus-cli/src/evidence/mod.rs implementation

• claim:evidence-proof-is-an-execution implemented_by → this
• claim:evidence-currency-is-not-collapsed implemented_by → this

apps/majordomus-cli/src/evidence/record.rs implementation

• claim:evidence-a-crate-binary-that-ran-nothing-is-not-a-pass implemented_by → this
• claim:evidence-tree-is-measured-by-the-run implemented_by → this

apps/majordomus-cli/src/evidence/run.rs implementation

• claim:evidence-a-recording-is-a-typed-run implemented_by → this

apps/majordomus-cli/src/evidence/subject.rs implementation

• claim:evidence-subjects-are-derived implemented_by → this
• claim:evidence-subject-commands-agree-with-the-command-pages implemented_by → this

apps/majordomus-cli/src/gates/closing.rs implementation

• claim:the-closing-question-is-measured implemented_by → this

apps/majordomus-cli/src/generate.rs implementation

• claim:generated-artifacts-typed implemented_by → this
• claim:generated-projections-checked implemented_by → this

apps/majordomus-cli/src/http/openapi.rs implementation

• claim:interfaces-are-projections implemented_by → this
• claim:openapi-inferred implemented_by → this

apps/majordomus-cli/src/index.rs implementation

• claim:mcp-data-driven implemented_by → this
• claim:mcp-degraded-not-silent implemented_by → this

apps/majordomus-cli/src/intent.rs implementation

• claim:intent-stage-derived implemented_by → this
• claim:intent-links-resolve implemented_by → this
• claim:intent-preflight-names-the-intent implemented_by → this

apps/majordomus-cli/src/intent_binding.rs implementation

• claim:intent-refused-at-plan-start implemented_by → this

apps/majordomus-cli/src/intent_plan.rs implementation

• claim:intent-criteria-covered implemented_by → this

apps/majordomus-cli/src/intent_realization.rs implementation

• claim:intent-realization-held-to-evidence implemented_by → this

apps/majordomus-cli/src/intent_review.rs implementation

• claim:intent-plan-reviewed implemented_by → this

apps/majordomus-cli/src/lease.rs implementation

• claim:mcp-shared-server implemented_by → this
• claim:mcp-lease-resilience implemented_by → this
• claim:mcp-lease-lost implemented_by → this

apps/majordomus-cli/src/mcp/protocol.rs implementation

• claim:mcp-stdio-surface implemented_by → this

apps/majordomus-cli/src/mesh/cooperation.rs implementation

• claim:mesh-cooperation-links implemented_by → this
• claim:mesh-liveness-expiry implemented_by → this

apps/majordomus-cli/src/mesh/doctor.rs implementation

• claim:mesh-declared-is-held implemented_by → this

apps/majordomus-cli/src/mesh/firewall.rs implementation

• claim:mesh-firewall-is-derived implemented_by → this

apps/majordomus-cli/src/mesh/journal.rs implementation

• claim:mesh-three-runtime-convergence implemented_by → this
• claim:mesh-compaction-keeps-what-is-live implemented_by → this

apps/majordomus-cli/src/mesh/registry.rs implementation

• claim:mesh-one-registry implemented_by → this

apps/majordomus-cli/src/mesh/repository.rs implementation

• claim:mesh-repository-isolation implemented_by → this

apps/majordomus-cli/src/mesh/state.rs implementation

• claim:mesh-claims-cross-runtime implemented_by → this

apps/majordomus-cli/src/mesh/trust.rs implementation

• claim:mesh-observation-not-authority implemented_by → this

apps/majordomus-cli/src/metadata/mod.rs implementation

• claim:schema-driven-kinds implemented_by → this

apps/majordomus-cli/src/models/mod.rs implementation

• claim:models-one-declaration implemented_by → this
• claim:models-routing-explains-itself implemented_by → this
• claim:models-no-secret-fields implemented_by → this

apps/majordomus-cli/src/peers.rs implementation

• claim:mcp-peers implemented_by → this

apps/majordomus-cli/src/perf.rs implementation

• claim:hot-path-no-rebuild implemented_by → this

apps/majordomus-cli/src/product.rs implementation

• claim:product-features-discovered implemented_by → this
• claim:product-domains-derived implemented_by → this
• claim:product-surfaces-derived implemented_by → this
• claim:product-references-resolve implemented_by → this

apps/majordomus-cli/src/providers.rs implementation

• claim:provider-projections-one-renderer implemented_by → this

apps/majordomus-cli/src/quality/rustdoc.rs implementation

• claim:rustdoc-complete implemented_by → this

apps/majordomus-cli/src/reasoning/availability.rs implementation

• claim:advisor-failure-is-recorded-and-recovers implemented_by → this

apps/majordomus-cli/src/reasoning/check.rs implementation

• claim:review-is-never-fabricated implemented_by → this

apps/majordomus-cli/src/reasoning/policy.rs implementation

• claim:reasoning-works-with-no-advisor implemented_by → this

apps/majordomus-cli/src/reasoning/state.rs implementation

• claim:reasoning-survives-the-session implemented_by → this

apps/majordomus-cli/src/reasoning/store.rs implementation

• claim:advice-is-weighed-not-counted implemented_by → this

apps/majordomus-cli/src/rules/mod.rs implementation

• claim:rule-state-is-derived-from-what-ran implemented_by → this

apps/majordomus-cli/src/scope.rs implementation

• claim:scope-declared implemented_by → this

apps/majordomus-cli/src/shared.rs implementation

• claim:mesh-off-by-default implemented_by → this

apps/majordomus-cli/src/site.rs implementation

• claim:site-registry-dataset implemented_by → this
• claim:rustdoc-referenced implemented_by → this
• claim:product-projection-public-safe implemented_by → this

apps/majordomus-cli/src/ui/dashboard.rs implementation

• claim:ui-dashboard-cites-its-sources implemented_by → this

apps/majordomus-cli/src/ui/observatory.rs implementation

• claim:observatory-draws-nothing-it-did-not-read implemented_by → this

apps/majordomus-cli/src/web/discover.rs implementation

• claim:web-namespaces-reserved implemented_by → this
• claim:rustdoc-discoverable implemented_by → this

apps/majordomus-cli/src/web/model.rs implementation

• claim:web-surface-declared-once implemented_by → this

apps/majordomus-cli/src/why.rs implementation

• claim:why-catalogue-discovered implemented_by → this
• claim:why-references-resolve implemented_by → this
• claim:why-diagnosis-explainable implemented_by → this

apps/majordomus-cli/src/worktree/migrate.rs implementation

• claim:worktree-migration-lossless implemented_by → this

apps/majordomus-cli/src/worktree/path.rs implementation

• claim:worktree-topology-derived implemented_by → this

bin/majordomus implementation

• claim:no-network implemented_by → this

bin/majordomus-cli implementation

• claim:mcp-client-always-served implemented_by → this

bin/majordomus-mcp implementation

• claim:mcp-client-autostart implemented_by → this

lib/adr.sh implementation

• claim:adr-catalogue implemented_by → this
• claim:adr-traceability implemented_by → this
• claim:adr-propose implemented_by → this

lib/archive.sh implementation

• claim:archive-fidelity implemented_by → this

lib/capture.sh implementation

• claim:prompt-capture implemented_by → this
• claim:prompt-continuity implemented_by → this
• claim:knowledge-failure-is-recorded implemented_by → this

lib/check.sh implementation

• claim:ledger-integrity implemented_by → this
• claim:decision-attribution implemented_by → this
• claim:blocker-store implemented_by → this
• claim:consistency-check implemented_by → this
• claim:scope-enforcement implemented_by → this
• claim:overlap-report implemented_by → this
• claim:minimum-context implemented_by → this
• claim:checkpoint-interval implemented_by → this
• claim:worktree-ownership implemented_by → this
• claim:blocker-survives-handover implemented_by → this

lib/checkpoint.sh implementation

• claim:checkpoint-record implemented_by → this

lib/common.sh implementation

• claim:policy-parse implemented_by → this
• claim:exit-code-contract implemented_by → this
• claim:reproduce-command implemented_by → this
• claim:divergence-label implemented_by → this
• claim:record-resolution implemented_by → this
• claim:personal-layer-changes-nothing-shared implemented_by → this
• claim:local-state-ignored implemented_by → this
• claim:tool-location-independent implemented_by → this
• claim:event-vocabulary implemented_by → this

lib/context.sh implementation

• claim:context-assembly implemented_by → this
• claim:context-selection-budget implemented_by → this

lib/context_docs.sh implementation

• claim:context-documents implemented_by → this
• claim:context-coverage implemented_by → this
• claim:context-impact implemented_by → this

lib/decision.sh implementation

• claim:decision-record implemented_by → this

lib/deployment.sh implementation

• claim:deployment-contract-refuses-by-name implemented_by → this

lib/derive.sh implementation

• claim:briefing-names-candidates implemented_by → this

lib/doctor.sh implementation

• claim:profile-validate implemented_by → this
• claim:wiring-reconciliation implemented_by → this
• claim:dispatcher-wiring implemented_by → this
• claim:pointer-integrity implemented_by → this
• claim:no-counts-in-context implemented_by → this
• claim:retention-caps implemented_by → this
• claim:continuity-reachable implemented_by → this
• claim:derived-not-declared implemented_by → this
• claim:roadmap-derived implemented_by → this

lib/doctrine.sh implementation

• claim:doctrine-registry implemented_by → this
• claim:doctrine-class-decides implemented_by → this

lib/evidence.sh implementation

• claim:obligation-closure implemented_by → this
• claim:obligation-establishment implemented_by → this

lib/finish.sh implementation

• claim:finish-contract implemented_by → this
• claim:finish-refusal-is-recorded implemented_by → this
• claim:typed-outcome implemented_by → this

lib/handover.sh implementation

• claim:handover-record implemented_by → this
• claim:no-transcripts implemented_by → this

lib/history.sh implementation

• claim:history-ledger-read implemented_by → this
• claim:record-retention implemented_by → this

lib/init.sh implementation

• claim:init-refuses implemented_by → this
• claim:ai-layer-manifest implemented_by → this

lib/intent_binding.sh implementation

• claim:intent-in-session-context implemented_by → this

lib/knowledge.sh implementation

• claim:knowledge-derived-at-the-boundary implemented_by → this
• claim:knowledge-derivation-is-idempotent implemented_by → this
• claim:knowledge-integrity implemented_by → this
• claim:knowledge-writer-observed implemented_by → this
• claim:knowledge-promotion-is-an-act implemented_by → this
• claim:a-session-records-what-it-observed implemented_by → this
• claim:an-observation-becomes-a-grouped-candidate implemented_by → this
• claim:a-candidate-is-routed-by-what-it-is-about implemented_by → this
• claim:candidates-reviewed-not-accumulated implemented_by → this

lib/migrate.sh implementation

• claim:legacy-migration implemented_by → this

lib/plan.sh implementation

• claim:evidence-gates-done implemented_by → this

lib/project.awk implementation

• claim:project-status-derived implemented_by → this
• claim:dag-validation implemented_by → this
• claim:execution-waves implemented_by → this

lib/project.sh implementation

• claim:project-schema implemented_by → this

lib/prompt.sh implementation

• claim:prompt-assets implemented_by → this
• claim:prompt-asset implemented_by → this

lib/question.sh implementation

• claim:open-question-gate implemented_by → this

lib/rules.sh implementation

• claim:vendored-rule-package implemented_by → this
• claim:rule-resolution implemented_by → this

lib/search.sh implementation

• claim:record-search implemented_by → this

lib/session.sh implementation

• claim:session-records implemented_by → this

lib/session_context.sh implementation

• claim:session-lifecycle implemented_by → this

lib/skills.sh implementation

• claim:skill-catalogue implemented_by → this
• claim:skill-check implemented_by → this

lib/start.sh implementation

• claim:scoped-task implemented_by → this
• claim:git-identity implemented_by → this

lib/update.sh implementation

• claim:projection-generation implemented_by → this
• claim:projection-fingerprint implemented_by → this
• claim:region-projection implemented_by → this
• claim:no-silent-overwrite implemented_by → this
• claim:context-budget implemented_by → this
• claim:profile-axes implemented_by → this
• claim:capability-class implemented_by → this
• claim:effort-escalation implemented_by → this
• claim:bootstrap-chain implemented_by → this

lib/usecase.sh implementation

• claim:catalogue-resolves implemented_by → this
• claim:use-case-coverage implemented_by → this
• claim:use-case-evidence implemented_by → this
• claim:use-case-impact implemented_by → this
• claim:live-scenario-is-read-only implemented_by → this
• claim:live-scenario-evidence-is-local implemented_by → this

lib/watch.sh implementation

• claim:drift-watch implemented_by → this

scripts/ci-plan implementation

• claim:ci-planned-gates implemented_by → this

scripts/ci/english-only-check implementation

• claim:authored-files-are-english implemented_by → this
• claim:published-translation-is-declared implemented_by → this

scripts/ci/evidence-collect implementation

• claim:evidence-recorded-in-ci implemented_by → this

scripts/ci/finding-reproduce-check implementation

• claim:a-finding-names-how-to-see-it-again implemented_by → this

scripts/ci/github-check implementation

• claim:github-projection-gated implemented_by → this
• claim:projected-record-edit-is-landable implemented_by → this

scripts/ci/install-check implementation

• claim:advertised-install-command-works implemented_by → this

scripts/ci/rule-proof-check implementation

• claim:rule-proof-is-named-and-resolves implemented_by → this
• claim:rule-exemption-carries-its-reason implemented_by → this

scripts/ci/verdict implementation

• claim:ci-verdict implemented_by → this

scripts/derive implementation

• claim:derivation-one-graph implemented_by → this

scripts/evidence-check implementation

• claim:evidence-unsupported-guarantee-is-reported implemented_by → this

scripts/generate-site-data implementation

• claim:skill-site-projection implemented_by → this

scripts/github-sync implementation

• claim:github-projection implemented_by → this

scripts/lib/advisors/contract.mjs implementation

• claim:advisor-transports-share-one-contract implemented_by → this

scripts/lib/diagrams.mjs implementation

• claim:a-diagram-is-named-linked-and-addressable implemented_by → this

scripts/lib/executable-site.jq implementation

• claim:executable-reference-derived implemented_by → this

scripts/pages implementation

• claim:derived-data-current implemented_by → this
• claim:rustdoc-verified-live implemented_by → this

scripts/release-package implementation

• claim:release-archive-shape implemented_by → this

scripts/release-record implementation

• claim:release-is-complete-or-absent implemented_by → this
• claim:release-prerelease-channel implemented_by → this

scripts/rust-check implementation

• claim:rust-evidence-gates implemented_by → this
• claim:rust-binary-artifact implemented_by → this

scripts/rust-coverage implementation

• claim:rust-coverage-floor implemented_by → this
• claim:new-code-is-covered implemented_by → this

scripts/site-build implementation

• claim:rustdoc-composed-from-the-topology implemented_by → this

scripts/site-deploy implementation

• claim:site-deploy-one-path implemented_by → this
• claim:rustdoc-published implemented_by → this

share/advisors.yaml implementation

• claim:advisors-are-declared-once implemented_by → this

share/commands.yaml implementation

• claim:command-surface implemented_by → this

share/install/install.sh.in implementation

• claim:installer-verifies-before-installing implemented_by → this

share/providers.yaml implementation

• claim:provider-capability-evidence implemented_by → this

share/shell/session-start.sh implementation

• claim:session-start-prompt implemented_by → this

site/templates/index.html implementation

• claim:landing-page-is-a-projection implemented_by → this

test/cases/31_command_coverage.sh implementation

• claim:command-coverage implemented_by → this

test/mesh-lab/run implementation

• claim:mesh-network-acceptance implemented_by → this

test/run.sh implementation

• claim:suite-parallel implemented_by → this
• claim:a-skipped-case-is-not-a-proof implemented_by → this

.ai/repo/adrs/0013-every-web-surface-is-discovered-from-its-producer-resolved-o.md source

• claim:web-surface-declared-once specified_by → this

.ai/repo/ci/gates.yaml source

• claim:ci-planned-gates specified_by → this

.ai/repo/rules/project/english-only.v4.md source

• claim:published-translation-is-declared specified_by → this

.ai/repo/rules/project/mesh-cooperation-is-authenticated.v1.md source

• claim:mesh-cooperation-links specified_by → this
• claim:mesh-claims-cross-runtime specified_by → this
• claim:mesh-repository-isolation specified_by → this

.ai/repo/rules/project/mesh-is-observation-not-authority.v1.md source

• claim:mesh-observation-not-authority specified_by → this

.ai/repo/rules/project/rust-cli-evidence.v1.md source

• claim:rust-evidence-gates specified_by → this
• claim:rust-coverage-floor specified_by → this
• claim:rust-hot-path-benchmarks specified_by → this
• claim:cli-documentation-executable specified_by → this

.ai/repo/rules/project/web-surface-declared-once.v1.md source

• claim:web-namespaces-reserved specified_by → this

.ai/repo/rules/vendor/majordomus/rules/deployment-contract.v2.md source

• claim:deployment-contract-refuses-by-name specified_by → this

docs/ARCHIVE.md source

• claim:archive-fidelity specified_by → this

docs/CAPABILITIES.md source

• claim:capability-registry specified_by → this
• claim:interfaces-are-projections specified_by → this
• claim:schema-driven-kinds specified_by → this
• claim:generated-artifacts-typed specified_by → this
• claim:generated-projections-checked specified_by → this
• claim:capability-modules specified_by → this
• claim:benchmark-coverage-derived specified_by → this
• claim:hot-path-no-rebuild specified_by → this
• claim:execution-cache-equivalence specified_by → this
• claim:provider-projections-one-renderer specified_by → this
• claim:site-registry-dataset specified_by → this
• claim:openapi-inferred specified_by → this

docs/CI.md source

• claim:ci-verdict specified_by → this
• claim:ci-verdict-is-required specified_by → this
• claim:suite-parallel specified_by → this
• claim:rust-binary-artifact specified_by → this

docs/CLI.md source

• claim:exit-code-contract specified_by → this
• claim:dispatcher-wiring specified_by → this
• claim:no-silent-overwrite specified_by → this
• claim:init-refuses specified_by → this
• claim:scoped-task specified_by → this
• claim:consistency-check specified_by → this
• claim:finish-contract specified_by → this
• claim:history-ledger-read specified_by → this
• claim:record-search specified_by → this
• claim:continuity-reachable specified_by → this
• claim:context-documents specified_by → this
• claim:context-impact specified_by → this
• claim:legacy-migration specified_by → this
• claim:obligation-closure specified_by → this
• claim:obligation-establishment specified_by → this
• claim:skill-check specified_by → this
• claim:the-closing-question-is-measured specified_by → this

docs/COCKPIT.md source

• claim:intent-cockpit-pages specified_by → this
• claim:cockpit-is-a-projection-of-the-registry specified_by → this

docs/COMMIT.md source

• claim:commit-message-is-judged specified_by → this
• claim:commit-scopes-are-learned specified_by → this
• claim:commit-plan-is-refusable specified_by → this

docs/CONCEPTS.md source

• claim:derived-not-declared specified_by → this
• claim:provider-capability-evidence specified_by → this

docs/CONTEXT.md source

• claim:context-coverage specified_by → this

docs/CONTINUITY.md source

• claim:context-assembly specified_by → this
• claim:record-resolution specified_by → this
• claim:task-commit-attribution specified_by → this
• claim:semantic-retrieval specified_by → this
• claim:blocker-survives-handover specified_by → this
• claim:session-observability specified_by → this

docs/COVERAGE.md source

• claim:new-code-is-covered specified_by → this

docs/DESIGN.md source

• claim:wiring-reconciliation specified_by → this
• claim:projection-generation specified_by → this
• claim:pointer-integrity specified_by → this
• claim:no-counts-in-context specified_by → this
• claim:reproduce-command specified_by → this
• claim:no-network specified_by → this
• claim:scope-enforcement specified_by → this
• claim:overlap-report specified_by → this
• claim:drift-watch specified_by → this
• claim:no-transcripts specified_by → this
• claim:bootstrap-chain specified_by → this
• claim:tool-location-independent specified_by → this
• claim:runtime-adapters specified_by → this
• claim:telemetry specified_by → this
• claim:cost-per-outcome specified_by → this
• claim:routing specified_by → this
• claim:shared-policy specified_by → this
• claim:task-dependencies specified_by → this

docs/DIAGRAMS.md source

• claim:a-diagram-is-named-linked-and-addressable specified_by → this

docs/DISTRIBUTION.md source

• claim:distribution-canonical-model specified_by → this
• claim:release-is-complete-or-absent specified_by → this
• claim:advertised-install-command-works specified_by → this
• claim:release-archive-shape specified_by → this
• claim:release-prerelease-channel specified_by → this

docs/DOCTRINE.md source

• claim:doctrine-registry specified_by → this
• claim:doctrine-class-decides specified_by → this
• claim:ledger-integrity specified_by → this
• claim:decision-attribution specified_by → this
• claim:blocker-store specified_by → this
• claim:prompt-capture specified_by → this
• claim:prompt-continuity specified_by → this
• claim:prompt-assets specified_by → this
• claim:catalogue-resolves specified_by → this
• claim:vendored-rule-package specified_by → this
• claim:rule-resolution specified_by → this
• claim:session-lifecycle specified_by → this
• claim:rule-proof-is-named-and-resolves specified_by → this
• claim:rule-exemption-carries-its-reason specified_by → this
• claim:rule-state-is-derived-from-what-ran specified_by → this
• claim:authored-files-are-english specified_by → this
• claim:a-finding-names-how-to-see-it-again specified_by → this

docs/DYNAMICITY.md source

• claim:command-surface specified_by → this
• claim:command-coverage specified_by → this

docs/ECONOMICS.md source

• claim:context-selection-counted specified_by → this
• claim:economics-claims-gated specified_by → this
• claim:token-savings-measured specified_by → this

docs/EVIDENCE.md source

• claim:evidence-proof-is-an-execution specified_by → this
• claim:evidence-recorded-in-ci specified_by → this
• claim:evidence-subjects-are-derived specified_by → this
• claim:evidence-subject-commands-agree-with-the-command-pages specified_by → this
• claim:evidence-currency-is-not-collapsed specified_by → this
• claim:evidence-partial-run-preserves-the-rest specified_by → this
• claim:evidence-navigates-both-ways specified_by → this
• claim:evidence-unsupported-guarantee-is-reported specified_by → this
• claim:evidence-judged-at-the-presented-revision specified_by → this
• claim:evidence-a-skip-is-not-run specified_by → this
• claim:evidence-a-failure-outranks-an-absence specified_by → this
• claim:evidence-a-crate-binary-that-ran-nothing-is-not-a-pass specified_by → this
• claim:evidence-tree-is-measured-by-the-run specified_by → this
• claim:evidence-a-recording-is-a-typed-run specified_by → this
• claim:evidence-local-recording-stays-local specified_by → this
• claim:a-skipped-case-is-not-a-proof specified_by → this

docs/GITHUB_PAGES_ARCHITECTURE.md source

• claim:site-deploy-one-path specified_by → this
• claim:derived-data-current specified_by → this
• claim:executable-reference-derived specified_by → this
• claim:derivation-one-graph specified_by → this
• claim:skill-site-projection specified_by → this
• claim:landing-page-is-a-projection specified_by → this

docs/GITHUB_PAGES_PERFORMANCE.md source

• claim:site-deploys-from-verified-run specified_by → this

docs/INSTALL.md source

• claim:install-command-is-derived specified_by → this
• claim:installer-verifies-before-installing specified_by → this
• claim:personal-layer-changes-nothing-shared specified_by → this

docs/KNOWLEDGE.md source

• claim:knowledge-derived-at-the-boundary specified_by → this
• claim:knowledge-derivation-is-idempotent specified_by → this
• claim:knowledge-failure-is-recorded specified_by → this
• claim:knowledge-integrity specified_by → this
• claim:knowledge-writer-observed specified_by → this
• claim:knowledge-promotion-is-an-act specified_by → this
• claim:a-session-records-what-it-observed specified_by → this
• claim:an-observation-becomes-a-grouped-candidate specified_by → this
• claim:a-candidate-is-routed-by-what-it-is-about specified_by → this
• claim:briefing-names-candidates specified_by → this
• claim:candidates-reviewed-not-accumulated specified_by → this
• claim:knowledge-served-on-every-surface specified_by → this

docs/MAJORDOMUS_UI.md source

• claim:ui-dashboard-cites-its-sources specified_by → this
• claim:observatory-draws-nothing-it-did-not-read specified_by → this

docs/MCP.md source

• claim:mcp-stdio-surface specified_by → this
• claim:mcp-data-driven specified_by → this
• claim:mcp-degraded-not-silent specified_by → this
• claim:mcp-shared-server specified_by → this
• claim:mcp-lease-resilience specified_by → this
• claim:mcp-lease-lost specified_by → this
• claim:mcp-peers specified_by → this
• claim:mcp-client-autostart specified_by → this
• claim:mcp-client-always-served specified_by → this
• claim:session-start-prompt specified_by → this
• claim:mcp-uri-resolution specified_by → this
• claim:connection-episode specified_by → this

docs/MESH.md source

• claim:mesh-off-by-default specified_by → this
• claim:mesh-one-registry specified_by → this
• claim:mesh-liveness-expiry specified_by → this
• claim:mesh-three-runtime-convergence specified_by → this
• claim:mesh-compaction-keeps-what-is-live specified_by → this
• claim:mesh-network-acceptance specified_by → this
• claim:mesh-declared-is-held specified_by → this
• claim:mesh-firewall-is-derived specified_by → this

docs/MODELS.md source

• claim:models-one-declaration specified_by → this
• claim:models-routing-explains-itself specified_by → this
• claim:models-no-secret-fields specified_by → this

docs/PLANNING.md source

• claim:project-status-derived specified_by → this
• claim:dag-validation specified_by → this
• claim:execution-waves specified_by → this
• claim:evidence-gates-done specified_by → this
• claim:github-projection specified_by → this
• claim:github-projection-gated specified_by → this
• claim:projected-record-edit-is-landable specified_by → this
• claim:intent-stage-derived specified_by → this
• claim:intent-links-resolve specified_by → this
• claim:intent-criteria-covered specified_by → this
• claim:intent-plan-reviewed specified_by → this
• claim:intent-realization-held-to-evidence specified_by → this
• claim:intent-preflight-names-the-intent specified_by → this
• claim:intent-in-session-context specified_by → this
• claim:intent-refused-at-plan-start specified_by → this
• claim:intent-closes-github-milestones specified_by → this
• claim:intent-command-deployment-evidence specified_by → this

docs/PRODUCT.md source

• claim:product-features-discovered specified_by → this
• claim:product-domains-derived specified_by → this
• claim:product-surfaces-derived specified_by → this
• claim:product-references-resolve specified_by → this
• claim:product-projection-public-safe specified_by → this

docs/REASONING.md source

• claim:reasoning-works-with-no-advisor specified_by → this
• claim:advisor-transports-share-one-contract specified_by → this
• claim:advice-is-weighed-not-counted specified_by → this
• claim:advisor-failure-is-recorded-and-recovers specified_by → this
• claim:reasoning-survives-the-session specified_by → this
• claim:advisors-are-declared-once specified_by → this
• claim:review-is-never-fabricated specified_by → this

docs/ROADMAP.md source

• claim:roadmap-derived specified_by → this

docs/RUSTDOC.md source

• claim:rustdoc-discoverable specified_by → this
• claim:rustdoc-composed-from-the-topology specified_by → this
• claim:rustdoc-published specified_by → this
• claim:rustdoc-complete specified_by → this
• claim:rustdoc-verified-live specified_by → this
• claim:rustdoc-referenced specified_by → this

docs/SCHEMAS.md source

• claim:policy-parse specified_by → this
• claim:profile-validate specified_by → this
• claim:projection-fingerprint specified_by → this
• claim:region-projection specified_by → this
• claim:git-identity specified_by → this
• claim:divergence-label specified_by → this
• claim:handover-record specified_by → this
• claim:typed-outcome specified_by → this
• claim:checkpoint-record specified_by → this
• claim:record-retention specified_by → this
• claim:decision-record specified_by → this
• claim:open-question-gate specified_by → this
• claim:prompt-asset specified_by → this
• claim:ai-layer-manifest specified_by → this
• claim:local-state-ignored specified_by → this
• claim:event-vocabulary specified_by → this
• claim:worktree-ownership specified_by → this
• claim:project-schema specified_by → this
• claim:skill-catalogue specified_by → this
• claim:session-records specified_by → this
• claim:adr-catalogue specified_by → this
• claim:adr-traceability specified_by → this
• claim:adr-propose specified_by → this

docs/SCOPE.md source

• claim:scope-declared specified_by → this

docs/USE_CASES.md source

• claim:use-case-coverage specified_by → this
• claim:use-case-evidence specified_by → this
• claim:use-case-impact specified_by → this
• claim:live-scenario-is-read-only specified_by → this
• claim:live-scenario-evidence-is-local specified_by → this

docs/WHY.md source

• claim:why-catalogue-discovered specified_by → this
• claim:why-references-resolve specified_by → this
• claim:why-diagnosis-explainable specified_by → this

docs/WORKTREES.md source

• claim:worktree-topology-derived specified_by → this
• claim:worktree-migration-lossless specified_by → this

share/events.yaml source

• claim:finish-refusal-is-recorded specified_by → this

share/skeleton/policy.yaml source

• claim:context-budget specified_by → this
• claim:retention-caps specified_by → this
• claim:checkpoint-interval specified_by → this
• claim:context-selection-budget specified_by → this

share/skeleton/profiles/debugging.yaml source

• claim:effort-escalation specified_by → this

share/skeleton/profiles/deep-work.yaml source

• claim:capability-class specified_by → this

share/skeleton/profiles/implementation.yaml source

• claim:profile-axes specified_by → this

share/skeleton/profiles/routine.yaml source

• claim:minimum-context specified_by → this

apps/majordomus-cli/tests/bench_units.rs test

• claim:benchmark-coverage-derived proved_by → this

apps/majordomus-cli/tests/cli_examples.rs test

• claim:cli-documentation-executable proved_by → this

apps/majordomus-cli/tests/cockpit.rs test

• claim:cockpit-is-a-projection-of-the-registry proved_by → this

apps/majordomus-cli/tests/executor.rs test

• claim:execution-cache-equivalence proved_by → this

apps/majordomus-cli/tests/http_serve.rs test

• claim:mcp-uri-resolution proved_by → this

apps/majordomus-cli/tests/intent.rs test

• claim:intent-preflight-names-the-intent proved_by → this

apps/majordomus-cli/tests/intent_realization.rs test

• claim:intent-cockpit-pages proved_by → this

apps/majordomus-cli/tests/knowledge_base.rs test

• claim:knowledge-served-on-every-surface proved_by → this

apps/majordomus-cli/tests/lease_lost.rs test

• claim:mcp-lease-lost proved_by → this

apps/majordomus-cli/tests/mcp_shared.rs test

• claim:mcp-lease-resilience proved_by → this

apps/majordomus-cli/tests/mesh.rs test

• claim:mesh-off-by-default proved_by → this
• claim:mesh-one-registry proved_by → this
• claim:mesh-observation-not-authority proved_by → this

apps/majordomus-cli/tests/mesh_cooperation.rs test

• claim:mesh-cooperation-links proved_by → this
• claim:mesh-claims-cross-runtime proved_by → this
• claim:mesh-repository-isolation proved_by → this
• claim:mesh-liveness-expiry proved_by → this
• claim:mesh-three-runtime-convergence proved_by → this

apps/majordomus-cli/tests/product.rs test

• claim:product-surfaces-derived proved_by → this
• claim:product-references-resolve proved_by → this
• claim:product-projection-public-safe proved_by → this

apps/majordomus-cli/tests/projections.rs test

• claim:site-registry-dataset proved_by → this

apps/majordomus-cli/tests/registry.rs test

• claim:capability-registry proved_by → this
• claim:capability-modules proved_by → this

apps/majordomus-cli/tests/ui_surface.rs test

• claim:ui-dashboard-cites-its-sources proved_by → this

apps/majordomus-cli/tests/why.rs test

• claim:why-catalogue-discovered proved_by → this
• claim:why-references-resolve proved_by → this
• claim:why-diagnosis-explainable proved_by → this

test/cases/00_yaml_flatten.sh test

• claim:policy-parse proved_by → this

test/cases/01_init.sh test

• claim:init-refuses proved_by → this
• claim:ai-layer-manifest proved_by → this
• claim:local-state-ignored proved_by → this

test/cases/02_doctor_basic.sh test

• claim:profile-validate proved_by → this
• claim:retention-caps proved_by → this
• claim:reproduce-command proved_by → this

test/cases/03_update.sh test

• claim:wiring-reconciliation proved_by → this
• claim:exit-code-contract proved_by → this
• claim:projection-generation proved_by → this
• claim:projection-fingerprint proved_by → this
• claim:no-silent-overwrite proved_by → this
• claim:context-budget proved_by → this
• claim:pointer-integrity proved_by → this
• claim:no-counts-in-context proved_by → this
• claim:profile-axes proved_by → this
• claim:capability-class proved_by → this
• claim:effort-escalation proved_by → this
• claim:bootstrap-chain proved_by → this

test/cases/04_start_check.sh test

• claim:scoped-task proved_by → this
• claim:git-identity proved_by → this
• claim:consistency-check proved_by → this
• claim:scope-enforcement proved_by → this
• claim:divergence-label proved_by → this
• claim:overlap-report proved_by → this
• claim:minimum-context proved_by → this
• claim:checkpoint-interval proved_by → this

test/cases/05_handover.sh test

• claim:handover-record proved_by → this
• claim:no-transcripts proved_by → this

test/cases/06_finish.sh test

• claim:finish-contract proved_by → this
• claim:finish-refusal-is-recorded proved_by → this
• claim:typed-outcome proved_by → this

test/cases/07_watch.sh test

• claim:drift-watch proved_by → this

test/cases/08_no_forbidden_constructs.sh test

• claim:no-network proved_by → this

test/cases/1037_the_closing_question_is_measured.sh test

• claim:the-closing-question-is-measured proved_by → this

test/cases/1038_a_head_is_judged_against_what_it_changes.sh test

• claim:projected-record-edit-is-landable proved_by → this

test/cases/103_obligations.sh test

• claim:obligation-closure proved_by → this
• claim:obligation-establishment proved_by → this

test/cases/124_evidence.sh test

• claim:evidence-proof-is-an-execution proved_by → this
• claim:evidence-currency-is-not-collapsed proved_by → this
• claim:evidence-partial-run-preserves-the-rest proved_by → this
• claim:evidence-navigates-both-ways proved_by → this
• claim:evidence-unsupported-guarantee-is-reported proved_by → this

test/cases/125_rule_proof.sh test

• claim:rule-proof-is-named-and-resolves proved_by → this
• claim:rule-exemption-carries-its-reason proved_by → this

test/cases/130_archive.sh test

• claim:archive-fidelity proved_by → this

test/cases/131_models.sh test

• claim:models-one-declaration proved_by → this
• claim:models-routing-explains-itself proved_by → this
• claim:models-no-secret-fields proved_by → this

test/cases/132_coverage_differential.sh test

• claim:new-code-is-covered proved_by → this

test/cases/133_rule_graph.sh test

• claim:rule-state-is-derived-from-what-ran proved_by → this

test/cases/138_governance_gates.sh test

• claim:authored-files-are-english proved_by → this
• claim:a-finding-names-how-to-see-it-again proved_by → this

test/cases/13_region_projection.sh test

• claim:region-projection proved_by → this

test/cases/140_prompt_continuity.sh test

• claim:prompt-continuity proved_by → this

test/cases/14_wiring_dispatcher.sh test

• claim:dispatcher-wiring proved_by → this

test/cases/171_session_observability.sh test

• claim:session-observability proved_by → this

test/cases/17_doctrine_enforcement.sh test

• claim:doctrine-class-decides proved_by → this

test/cases/18_doctrine_wiring.sh test

• claim:doctrine-registry proved_by → this

test/cases/200_generic_mcp_episode.sh test

• claim:connection-episode proved_by → this
• claim:provider-capability-evidence proved_by → this

test/cases/20_checkpoint.sh test

• claim:checkpoint-record proved_by → this

test/cases/21_decision_question.sh test

• claim:decision-attribution proved_by → this
• claim:blocker-store proved_by → this
• claim:decision-record proved_by → this
• claim:open-question-gate proved_by → this

test/cases/22_history.sh test

• claim:ledger-integrity proved_by → this
• claim:history-ledger-read proved_by → this
• claim:record-retention proved_by → this

test/cases/23_context.sh test

• claim:context-assembly proved_by → this
• claim:context-selection-budget proved_by → this
• claim:record-resolution proved_by → this

test/cases/24_prompt_search.sh test

• claim:prompt-assets proved_by → this
• claim:prompt-asset proved_by → this
• claim:record-search proved_by → this

test/cases/250_the_board_is_repository_wide.sh test

• claim:mcp-peers proved_by → this

test/cases/25_continuity_lifecycle.sh test

• claim:continuity-reachable proved_by → this

test/cases/274_commit_policy.sh test

• claim:commit-message-is-judged proved_by → this
• claim:commit-scopes-are-learned proved_by → this
• claim:commit-plan-is-refusable proved_by → this

test/cases/27_foreign_task.sh test

• claim:worktree-ownership proved_by → this

test/cases/28_catalogue.sh test

• claim:catalogue-resolves proved_by → this

test/cases/28_no_hardcoded_values.sh test

• claim:derived-not-declared proved_by → this

test/cases/2979_a_personal_layer_changes_nothing_shared.sh test

• claim:personal-layer-changes-nothing-shared proved_by → this

test/cases/29_prompt_capture.sh test

• claim:prompt-capture proved_by → this

test/cases/3006_diagrams_are_interactive_and_linkable.sh test

• claim:a-diagram-is-named-linked-and-addressable proved_by → this

test/cases/3011_the_observatory_draws_nothing_it_did_not_read.sh test

• claim:observatory-draws-nothing-it-did-not-read proved_by → this

test/cases/30_command_registry.sh test

• claim:command-surface proved_by → this

test/cases/3177_a_client_always_gets_a_server.sh test

• claim:mcp-client-always-served proved_by → this

test/cases/3179_a_prerelease_is_never_published_as_stable.sh test

• claim:release-prerelease-channel proved_by → this

test/cases/31_command_coverage.sh test

• claim:command-coverage proved_by → this

test/cases/3221_a_bare_session_start_joins_the_cluster.sh test

• claim:session-start-prompt proved_by → this

test/cases/33_event_registry.sh test

• claim:event-vocabulary proved_by → this

test/cases/357_ci_records_evidence.sh test

• claim:evidence-recorded-in-ci proved_by → this

test/cases/359_live_scenarios.sh test

• claim:live-scenario-is-read-only proved_by → this
• claim:live-scenario-evidence-is-local proved_by → this

test/cases/367_an_intent_is_satisfied_only_by_evidence.sh test

• claim:intent-stage-derived proved_by → this
• claim:intent-links-resolve proved_by → this

test/cases/386_a_plan_is_held_to_its_intent.sh test

• claim:intent-criteria-covered proved_by → this
• claim:intent-plan-reviewed proved_by → this

test/cases/388_an_intent_is_realised_across_providers_and_held_to_reality.sh test

• claim:intent-realization-held-to-evidence proved_by → this

test/cases/400_derivation_is_one_graph.sh test

• claim:derivation-one-graph proved_by → this
• claim:landing-page-is-a-projection proved_by → this

test/cases/401_the_rust_artifact_carries_its_provenance.sh test

• claim:rust-binary-artifact proved_by → this

test/cases/403_published_translation.sh test

• claim:published-translation-is-declared proved_by → this

test/cases/40_project_model.sh test

• claim:project-schema proved_by → this

test/cases/413_a_skipped_case_is_not_a_proof.sh test

• claim:a-skipped-case-is-not-a-proof proved_by → this

test/cases/414_mesh_lab_evidence.sh test

• claim:mesh-network-acceptance proved_by → this

test/cases/41_project_status.sh test

• claim:project-status-derived proved_by → this
• claim:evidence-gates-done proved_by → this

test/cases/42_dag_waves.sh test

• claim:dag-validation proved_by → this
• claim:execution-waves proved_by → this

test/cases/430_economics.sh test

• claim:context-selection-counted proved_by → this

test/cases/431_economics_claims_gated.sh test

• claim:economics-claims-gated proved_by → this

test/cases/45_github_projection.sh test

• claim:github-projection proved_by → this

test/cases/486_rustdoc_composition.sh test

• claim:rustdoc-composed-from-the-topology proved_by → this

test/cases/487_rustdoc_staleness.sh test

• claim:rustdoc-verified-live proved_by → this

test/cases/488_rustdoc_discoverable.sh test

• claim:rustdoc-discoverable proved_by → this

test/cases/489_rustdoc_deploy.sh test

• claim:rustdoc-published proved_by → this

test/cases/490_rustdoc_new_module.sh test

• claim:rustdoc-complete proved_by → this

test/cases/492_rustdoc_module_links.sh test

• claim:rustdoc-referenced proved_by → this

test/cases/493_mesh_compaction_keeps_what_is_live.sh test

• claim:mesh-compaction-keeps-what-is-live proved_by → this

test/cases/494_the_mesh_is_declared_and_held.sh test

• claim:mesh-declared-is-held proved_by → this

test/cases/495_the_firewall_admits_the_mesh.sh test

• claim:mesh-firewall-is-derived proved_by → this

test/cases/49_roadmap_doctrine.sh test

• claim:roadmap-derived proved_by → this

test/cases/502_evidence_is_judged_at_the_presented_revision.sh test

• claim:evidence-judged-at-the-presented-revision proved_by → this
• claim:evidence-a-skip-is-not-run proved_by → this
• claim:evidence-a-failure-outranks-an-absence proved_by → this

test/cases/505_a_recording_carries_what_its_run_measured.sh test

• claim:evidence-tree-is-measured-by-the-run proved_by → this
• claim:evidence-a-recording-is-a-typed-run proved_by → this
• claim:evidence-local-recording-stays-local proved_by → this

test/cases/506_a_crate_binary_that_ran_nothing_is_not_a_pass.sh test

• claim:evidence-a-crate-binary-that-ran-nothing-is-not-a-pass proved_by → this

test/cases/507_evidence_subjects_are_derived.sh test

• claim:evidence-subjects-are-derived proved_by → this
• claim:evidence-subject-commands-agree-with-the-command-pages proved_by → this

test/cases/50_blocker_across_handover.sh test

• claim:blocker-survives-handover proved_by → this

test/cases/52_generated_artifact_typing.sh test

• claim:generated-artifacts-typed proved_by → this

test/cases/54_session_lifecycle_hooks.sh test

• claim:session-lifecycle proved_by → this

test/cases/563_knowledge_is_derived_at_the_boundary.sh test

• claim:knowledge-derived-at-the-boundary proved_by → this

test/cases/564_knowledge_derivation_is_idempotent.sh test

• claim:knowledge-derivation-is-idempotent proved_by → this

test/cases/565_knowledge_switch_and_failure_leave_evidence.sh test

• claim:knowledge-failure-is-recorded proved_by → this

test/cases/56_derived_current_gate.sh test

• claim:derived-data-current proved_by → this

test/cases/63_session_records.sh test

• claim:session-records proved_by → this

test/cases/65_tool_root_independence.sh test

• claim:tool-location-independent proved_by → this

test/cases/66_migrate_legacy.sh test

• claim:legacy-migration proved_by → this

test/cases/67_rule_dag.sh test

• claim:vendored-rule-package proved_by → this
• claim:rule-resolution proved_by → this

test/cases/69_context_documents.sh test

• claim:context-documents proved_by → this
• claim:context-coverage proved_by → this

test/cases/707_knowledge_check_refuses_malformed_records.sh test

• claim:knowledge-integrity proved_by → this

test/cases/708_health_sees_a_stopped_knowledge_writer.sh test

• claim:knowledge-writer-observed proved_by → this

test/cases/709_knowledge_promotion_is_an_act.sh test

• claim:knowledge-promotion-is-an-act proved_by → this

test/cases/70_context_impact.sh test

• claim:context-impact proved_by → this

test/cases/710_briefing_names_the_candidates.sh test

• claim:briefing-names-candidates proved_by → this

test/cases/711_candidates_are_reviewed_not_accumulated.sh test

• claim:candidates-reviewed-not-accumulated proved_by → this

test/cases/72_rust_mcp.sh test

• claim:mcp-stdio-surface proved_by → this
• claim:mcp-data-driven proved_by → this
• claim:mcp-degraded-not-silent proved_by → this

test/cases/730_reasoning_works_with_no_advisor.sh test

• claim:reasoning-works-with-no-advisor proved_by → this

test/cases/731_advisor_transport_contract.sh test

• claim:advisor-transports-share-one-contract proved_by → this

test/cases/732_disagreement_is_settled_by_evidence.sh test

• claim:advice-is-weighed-not-counted proved_by → this

test/cases/733_advisor_failure_and_recovery.sh test

• claim:advisor-failure-is-recorded-and-recovers proved_by → this

test/cases/734_reasoning_survives_the_session.sh test

• claim:reasoning-survives-the-session proved_by → this

test/cases/735_a_new_advisor_needs_no_consumer_edit.sh test

• claim:advisors-are-declared-once proved_by → this

test/cases/736_reasoning_check_refuses_drift.sh test

• claim:review-is-never-fabricated proved_by → this

test/cases/76_capabilities_projections.sh test

• claim:interfaces-are-projections proved_by → this
• claim:schema-driven-kinds proved_by → this
• claim:generated-projections-checked proved_by → this

test/cases/77_rust_evidence.sh test

• claim:rust-evidence-gates proved_by → this
• claim:rust-coverage-floor proved_by → this
• claim:rust-hot-path-benchmarks proved_by → this

test/cases/800_product_domains.sh test

• claim:product-domains-derived proved_by → this

test/cases/84_deployment_contract.sh test

• claim:deployment-contract-refuses-by-name proved_by → this

test/cases/84_distribution_model.sh test

• claim:distribution-canonical-model proved_by → this
• claim:install-command-is-derived proved_by → this

test/cases/85_installer.sh test

• claim:installer-verifies-before-installing proved_by → this

test/cases/87_release_pipeline.sh test

• claim:release-is-complete-or-absent proved_by → this

test/cases/87b_release_archive_shape.sh test

• claim:release-archive-shape proved_by → this

test/cases/89_web_surface.sh test

• claim:web-surface-declared-once proved_by → this
• claim:web-namespaces-reserved proved_by → this

test/cases/90_mcp_shared_server.sh test

• claim:mcp-shared-server proved_by → this
• claim:mcp-client-autostart proved_by → this

test/cases/91_canonical_architecture.sh test

• claim:hot-path-no-rebuild proved_by → this

test/cases/92_openapi_reference.sh test

• claim:openapi-inferred proved_by → this

test/cases/93_rust_provider_projections.sh test

• claim:provider-projections-one-renderer proved_by → this

test/cases/93_scope_policy.sh test

• claim:scope-declared proved_by → this

test/cases/94_ci_plan.sh test

• claim:ci-planned-gates proved_by → this
• claim:ci-verdict proved_by → this
• claim:suite-parallel proved_by → this

test/cases/94_use_cases.sh test

• claim:use-case-coverage proved_by → this
• claim:use-case-evidence proved_by → this
• claim:use-case-impact proved_by → this

test/cases/95_executable_reference.sh test

• claim:executable-reference-derived proved_by → this

test/cases/95_skills.sh test

• claim:skill-catalogue proved_by → this
• claim:skill-check proved_by → this
• claim:skill-site-projection proved_by → this

test/cases/960_a_task_starts_bound_to_what_it_serves.sh test

• claim:intent-in-session-context proved_by → this

test/cases/962_plan_start_asks_the_binding_in_both_engines.sh test

• claim:intent-refused-at-plan-start proved_by → this

test/cases/96_site_deploy.sh test

• claim:site-deploy-one-path proved_by → this

test/cases/96_worktree_topology.sh test

• claim:worktree-topology-derived proved_by → this
• claim:worktree-migration-lossless proved_by → this

test/cases/97_github_gate.sh test

• claim:github-projection-gated proved_by → this

test/cases/97_install_gate.sh test

• claim:advertised-install-command-works proved_by → this

test/cases/97_pages_fast_path.sh test

• claim:site-deploys-from-verified-run proved_by → this

test/cases/97_product_features.sh test

• claim:product-features-discovered proved_by → this

test/cases/980_a_session_records_what_it_observed.sh test

• claim:a-session-records-what-it-observed proved_by → this

test/cases/981_an_observation_becomes_a_grouped_candidate.sh test

• claim:an-observation-becomes-a-grouped-candidate proved_by → this

test/cases/982_a_candidate_is_routed_by_what_it_is_about.sh test

• claim:a-candidate-is-routed-by-what-it-is-about proved_by → this

test/cases/99_adr.sh test

• claim:adr-catalogue proved_by → this
• claim:adr-traceability proved_by → this
• claim:adr-propose proved_by → this