Guaranteed capabilities

Declared deterministic and blocking, implemented, and naming the behavioural test that is to prove it. Whether a recorded run supports it is the evidence verdict, shown beside it.

declared status: guaranteed 232 claims declared0 supported by a recorded run

Every platform, artifact name and installation URL is derived from one model, and a projection that disagrees with it is refused

apps/majordomus-cli/src/distribution/mod.rs · test/cases/84_distribution_model.sh

recorded evidencerecorded evidence: not run
The documented one-line install command is composed from the model's parts, and a document that states a different one fails the suite

apps/majordomus-cli/src/distribution/mod.rs · test/cases/84_distribution_model.sh

recorded evidencerecorded evidence: not run
The installer verifies an artifact's digest and inspects its archive before anything is unpacked, and any failure leaves the previous installation working

share/install/install.sh.in · test/cases/85_installer.sh

recorded evidencerecorded evidence: not run
A release publishes an artifact for every supported target or it is not published

scripts/release-record · test/cases/87_release_pipeline.sh

recorded evidencerecorded evidence: not run
The install command this project advertises is fetched and run from the published site every night and on request, and the run that asked for it is red while it does not install a working tool

scripts/ci/install-check · test/cases/97_install_gate.sh

recorded evidencerecorded evidence: not run
A release archive carries every path once and carries nothing but files and directories

scripts/release-package · test/cases/87b_release_archive_shape.sh

recorded evidencerecorded evidence: not run
The canonical policy is parsed and rejected if it contains an unknown key

lib/common.sh · test/cases/00_yaml_flatten.sh

recorded evidencerecorded evidence: not run
Every profile is parsed, its unknown keys rejected, and the default profile proven to exist

lib/doctor.sh · test/cases/02_doctor_basic.sh

recorded evidencerecorded evidence: not run
Every enforcement the policy declares is reconciled against what actually runs

lib/doctor.sh · test/cases/03_update.sh

recorded evidencerecorded evidence: not run
Exit codes are a contract, and no code means "warn and continue"

lib/common.sh · test/cases/03_update.sh

recorded evidencerecorded evidence: not run
Provider instruction files are generated from the one policy, deterministically

lib/update.sh · test/cases/03_update.sh

recorded evidencerecorded evidence: not run
Every generated instruction file carries its own stamp, and a hand edit is detected

lib/update.sh · test/cases/03_update.sh

recorded evidencerecorded evidence: not run
A projection can own only the region between its markers, leaving the rest of the file untouched

lib/update.sh · test/cases/13_region_projection.sh

recorded evidencerecorded evidence: not run
Wiring is found in a hook or in any subhook of the directory that hook dispatches to

lib/doctor.sh · test/cases/14_wiring_dispatcher.sh

recorded evidencerecorded evidence: not run
Every rule the tool enforces is declared once, as a rule object in the repository's effective set, and doctor proves each one is reached by the command that claims to run it

lib/doctrine.sh · test/cases/18_doctrine_wiring.sh

recorded evidencerecorded evidence: not run
A doctrine's class is what decides whether a violation stops the command, not a label beside it

lib/doctrine.sh · test/cases/17_doctrine_enforcement.sh

recorded evidencerecorded evidence: not run
Every line of the append-only ledger is a well-formed event, and a malformed line is a failure rather than a skipped record

lib/check.sh · test/cases/22_history.sh

recorded evidencerecorded evidence: not run
An entry in the questions store that does not parse blocks acceptance exactly as an unresolved question does

lib/check.sh · test/cases/21_decision_question.sh

recorded evidencerecorded evidence: not run
A declared provider hook captures the person's raw prompts below the model, and doctor proves it by running it

lib/capture.sh · test/cases/29_prompt_capture.sh

recorded evidencerecorded evidence: not run
A captured prompt names the episode it belongs to or records that none could be resolved; the archive is private, bounded and free of credential material

lib/capture.sh · test/cases/140_prompt_continuity.sh

recorded evidencerecorded evidence: not run
Every repository-local prompt asset renders, and an unknown token is a failure

lib/prompt.sh · test/cases/24_prompt_search.sh

recorded evidencerecorded evidence: not run
A use case or application cannot name a command, doctrine or claim that does not exist, and the two catalogues cannot disagree about which applies to which

lib/usecase.sh · test/cases/28_catalogue.sh

recorded evidencerecorded evidence: not run
A hand-edited instruction file is never silently overwritten

lib/update.sh · test/cases/03_update.sh

recorded evidencerecorded evidence: not run
An archive that lost the file modes fails rather than travelling

lib/archive.sh · test/cases/130_archive.sh

recorded evidencerecorded evidence: stale
The always-loaded instruction file has a line budget with a failing check

lib/update.sh · test/cases/03_update.sh

recorded evidencerecorded evidence: not run
Every repository-relative reference in the always-loaded file is proven to resolve

lib/doctor.sh · test/cases/03_update.sh

recorded evidencerecorded evidence: not run
A hardcoded count in the always-loaded file is a failure

lib/doctor.sh · test/cases/03_update.sh

recorded evidencerecorded evidence: not run
The append-only ledger and handover store have retention caps that are checked

lib/doctor.sh · test/cases/02_doctor_basic.sh

recorded evidencerecorded evidence: not run
Installing into a repository that already has an installation is refused

lib/init.sh · test/cases/01_init.sh

recorded evidencerecorded evidence: not run
Every finding carries the command that reproduces it

lib/common.sh · test/cases/02_doctor_basic.sh

recorded evidencerecorded evidence: not run
The shell tool performs no network call, evaluates no generated text and deletes nothing recursively; its one declared request is the loopback peer probe

bin/majordomus · test/cases/08_no_forbidden_constructs.sh

recorded evidencerecorded evidence: not run
A task is started with a declared file scope and a profile, and only one task is active per checkout

lib/start.sh · test/cases/04_start_check.sh

recorded evidencerecorded evidence: not run
Identity fields on every state record are computed from git and never authored

lib/start.sh · test/cases/04_start_check.sh

recorded evidencerecorded evidence: not run
check reports whether state, scope, blockers and checkpoint age are consistent right now

lib/check.sh · test/cases/04_start_check.sh

recorded evidencerecorded evidence: not run
A touched file outside the claimed scope is a failure, not a warning

lib/check.sh · test/cases/04_start_check.sh

recorded evidencerecorded evidence: not run
State read back is labelled exact, advanced, diverged or different_context against git

lib/common.sh · test/cases/04_start_check.sh

recorded evidencerecorded evidence: not run
Overlap between parallel workers is computed on claimed paths in both containment directions

lib/check.sh · test/cases/04_start_check.sh

recorded evidencerecorded evidence: not run
watch reports policy, projection, state, scope, handover, verification, staleness and retention drift

lib/watch.sh · test/cases/07_watch.sh

recorded evidencerecorded evidence: not run
handover writes an append-only record with computed front matter and required sections

lib/handover.sh · test/cases/05_handover.sh

recorded evidencerecorded evidence: not run
A handover is a state record, not a transcript - its required sections must be present and non-empty, a placeholder body is refused, and its identity is computed and refused when written into the body; a transcript pasted into a section is not detected

lib/handover.sh · test/cases/05_handover.sh

recorded evidencerecorded evidence: not run
finish evaluates the finish contract line by line and refuses when any line is unmet

lib/finish.sh · test/cases/06_finish.sh

recorded evidencerecorded evidence: not run
every refused finish appends a task.refused event naming the outcome claimed, the unmet count and the doctrines that refused, and finish --check writes none

lib/finish.sh · test/cases/06_finish.sh

recorded evidencerecorded evidence: not run
An outcome is a value from a closed vocabulary, not free text

lib/finish.sh · test/cases/06_finish.sh

recorded evidencerecorded evidence: not run
The context a worker is given is assembled from durable state in authority order, and what a profile excludes is excluded

lib/context.sh · test/cases/23_context.sh

recorded evidencerecorded evidence: not run
The assembled context obeys a line budget, and every section it drops is named with its reason

lib/context.sh · test/cases/23_context.sh

recorded evidencerecorded evidence: not run
A checkpoint is a capped progress record with computed identity, and a body over the cap is refused rather than truncated

lib/checkpoint.sh · test/cases/20_checkpoint.sh

recorded evidencerecorded evidence: not run
The right prior record is resolved by worktree and branch, and an unrelated one is never offered

lib/common.sh · test/cases/23_context.sh

recorded evidencerecorded evidence: not run
The ledger is readable back as operational history, filtered by task, event and time

lib/history.sh · test/cases/22_history.sh

recorded evidencerecorded evidence: not run
Rotating the ledger archives the oldest lines and never deletes them

lib/history.sh · test/cases/22_history.sh

recorded evidencerecorded evidence: not run
A decision is recorded with its reason and its task, and is superseded by a later entry rather than edited

lib/decision.sh · test/cases/21_decision_question.sh

recorded evidencerecorded evidence: not run
An unresolved question blocks acceptance, and an entry the gate cannot parse is a failure rather than a silent pass

lib/question.sh · test/cases/21_decision_question.sh

recorded evidencerecorded evidence: not run
A repository-local prompt renders against a closed set of state tokens, and an unknown token is an error

lib/prompt.sh · test/cases/24_prompt_search.sh

recorded evidencerecorded evidence: not run
Durable records are searchable literally, across kinds, without an index

lib/search.sh · test/cases/24_prompt_search.sh

recorded evidencerecorded evidence: not run
Every continuity store is proven reachable through its own command, not merely present on disk

lib/doctor.sh · test/cases/25_continuity_lifecycle.sh

recorded evidencerecorded evidence: not run
The context that applies to a path is composed from the layer's scoped documents, root to target, in one deterministic order with provenance, and a tree that does not validate resolves nothing

lib/context_docs.sh · test/cases/69_context_documents.sh

recorded evidencerecorded evidence: not run
Every directory of the layer carries a context document, the exemption is declared by the contract that governs the subtree, and a descendant may narrow that requirement but never weaken it

lib/context_docs.sh · test/cases/69_context_documents.sh

recorded evidencerecorded evidence: not run
The impact of a change set on the scoped context is reported from git — the documents, the scopes below them, moves with their ancestry, tracked sources to review, and stale projections — and an unrelated change reports nothing

lib/context_docs.sh · test/cases/70_context_impact.sh

recorded evidencerecorded evidence: not run
The repository's AI layer is one directory whose manifest names every section, readable without the tool

lib/init.sh · test/cases/01_init.sh

recorded evidencerecorded evidence: not run
A layer installed with --personal is one person's own in a shared repository: it changes no tracked file, no .gitignore line and nothing git status shows, and the command that makes the claim verifies it

lib/common.sh · test/cases/2979_a_personal_layer_changes_nothing_shared.sh

recorded evidencerecorded evidence: not run
Checkout-local state lives under .ai/local/, is ignored by git, and is absent on a fresh clone or worktree

lib/common.sh · test/cases/01_init.sh

recorded evidencerecorded evidence: not run
The rule baseline is vendored into the repository with a manifest naming every file and its hash, and a hand edit is detected and refused

lib/rules.sh · test/cases/67_rule_dag.sh

recorded evidencerecorded evidence: not run
The effective rule set is resolved as a dependency graph in a deterministic order, and a set that does not resolve is applied by nothing

lib/rules.sh · test/cases/67_rule_dag.sh

recorded evidencerecorded evidence: not run
Provider instruction files are thin bootstraps that point at the AI layer and carry no rule of their own

lib/update.sh · test/cases/03_update.sh

recorded evidencerecorded evidence: not run
A repository on the pre-.ai layout is migrated once, explicitly, with a previewed plan and a verified backup of its local state, and the command is idempotent afterwards

lib/migrate.sh · test/cases/66_migrate_legacy.sh

recorded evidencerecorded evidence: not run
The tool runs read-only from any location, and two locations of one version agree about one repository

lib/common.sh · test/cases/65_tool_root_independence.sh

recorded evidencerecorded evidence: not run
What the tool knows about itself is written once and derived everywhere else, and a second copy is a test failure

lib/doctor.sh · test/cases/28_no_hardcoded_values.sh

recorded evidencerecorded evidence: not run
The public command surface is declared, and reconciled against the dispatcher

share/commands.yaml · test/cases/30_command_registry.sh

recorded evidencerecorded evidence: not run
Every public command has a behavioural test and a negative test, computed rather than remembered

test/cases/31_command_coverage.sh · test/cases/31_command_coverage.sh

recorded evidencerecorded evidence: not run
The ledger's event vocabulary is closed, on the way in and on the way out

lib/common.sh · test/cases/33_event_registry.sh

recorded evidencerecorded evidence: not run
A task record names the checkout it belongs to, and another checkout is never held to its scope

lib/check.sh · test/cases/27_foreign_task.sh

recorded evidencerecorded evidence: not run
A blocking question keeps blocking after the work is handed to a new task

lib/check.sh · test/cases/50_blocker_across_handover.sh

recorded evidencerecorded evidence: not run
What the context compiler selects, out of what it judged relevant, is counted in tokens of a named tokenizer and recorded, never estimated

apps/majordomus-cli/src/economics/context.rs · test/cases/430_economics.sh

recorded evidencerecorded evidence: not run
A quantity about tokens, context or cost typed into hand-written prose is refused, and a claim bound to a metric cannot be guaranteed while its evidence does not stand

apps/majordomus-cli/src/economics/claims.rs · test/cases/431_economics_claims_gated.sh

recorded evidencerecorded evidence: not run
Milestones and issues are canonical repository files, and a key nobody reads is an error

lib/project.sh · test/cases/40_project_model.sh

recorded evidencerecorded evidence: not run
Issue and milestone status is derived from recorded facts and is stored nowhere

lib/project.awk · test/cases/41_project_status.sh

recorded evidencerecorded evidence: not run
A cycle, a self-dependency and a dependency on an issue that does not exist are each refused by name

lib/project.awk · test/cases/42_dag_waves.sh

recorded evidencerecorded evidence: not run
Execution waves are computed from the graph, and issues in one wave that touch the same paths are reported as serialised

lib/project.awk · test/cases/42_dag_waves.sh

recorded evidencerecorded evidence: not run
An issue cannot be completed while a required piece of evidence is missing

lib/plan.sh · test/cases/41_project_status.sh

recorded evidencerecorded evidence: not run
The roadmap is derived from milestone state, and no document may be a second authority for it

lib/doctor.sh · test/cases/49_roadmap_doctrine.sh

recorded evidencerecorded evidence: not run
GitHub milestones and issues are generated from the canonical model, and a hand-edited generated region is reported rather than overwritten

scripts/github-sync · test/cases/45_github_projection.sh

recorded evidencerecorded evidence: not run
A projection that stops being applied turns a build red, and a gate that cannot reach GitHub reports that it cannot rather than passing

scripts/ci/github-check · test/cases/97_github_gate.sh

recorded evidencerecorded evidence: not run
A pull request that edits a projected plan record is not refused because GitHub does not show the edit yet, and the trunk is refused for it once a declared window has passed

scripts/ci/github-check · test/cases/1038_a_head_is_judged_against_what_it_changes.sh

recorded evidencerecorded evidence: not run
An intent's stage is derived from the milestones that realise it and each criterion from the evidence ledger, and it is satisfied only while every criterion has a current passing run

apps/majordomus-cli/src/intent.rs · test/cases/367_an_intent_is_satisfied_only_by_evidence.sh

recorded evidencerecorded evidence: stale
An intent whose criterion names evidence that resolves to nothing is refused by name

apps/majordomus-cli/src/intent.rs · test/cases/367_an_intent_is_satisfied_only_by_evidence.sh

recorded evidencerecorded evidence: stale
Once work exists under an intent, a criterion no issue serves, an issue under its milestones that serves nothing and a link to a criterion that does not exist are each refused by name

apps/majordomus-cli/src/intent_plan.rs · test/cases/386_a_plan_is_held_to_its_intent.sh

recorded evidencerecorded evidence: stale
A gap that leaves a criterion unanswered is refused, and an issue serving an intent that started without a critique or while a blocking finding is open fails intent validation

apps/majordomus-cli/src/intent_review.rs · test/cases/386_a_plan_is_held_to_its_intent.sh

recorded evidencerecorded evidence: stale
The work realising an intent is joined across sessions, providers and handovers, and an intent whose milestones are all closed while a criterion's evidence fails is refused naming that criterion

apps/majordomus-cli/src/intent_realization.rs · test/cases/388_an_intent_is_realised_across_providers_and_held_to_reality.sh

recorded evidencerecorded evidence: stale
Asked before work on an issue, `intent preflight` names the intents the issue serves with the governance that applies, or refuses naming the cause

apps/majordomus-cli/src/intent.rs · apps/majordomus-cli/tests/intent.rs

recorded evidencerecorded evidence: stale
The Cockpit shows every intent with its derived stage at /cockpit/intents, and one intent's criteria, evidence, serving issues and realising work at /cockpit/intents/<id>

apps/majordomus-cli/src/cockpit/intents.rs · apps/majordomus-cli/tests/intent_realization.rs

recorded evidencerecorded evidence: stale
A task that names the issue or the intent it serves is briefed with what that intent asks of the work, and a handover tells the next worker when the intent moved

lib/intent_binding.sh · test/cases/960_a_task_starts_bound_to_what_it_serves.sh

recorded evidencerecorded evidence: not run
Where the policy requires binding, starting an issue or a task that serves an intent with no critique, or with a blocking finding open, is refused when it is started rather than reported afterwards

apps/majordomus-cli/src/intent_binding.rs · test/cases/962_plan_start_asks_the_binding_in_both_engines.sh

recorded evidencerecorded evidence: not run
The Rust executable serves the repository's AI layer to an MCP client over stdio, with protocol frames alone on stdout

apps/majordomus-cli/src/mcp/protocol.rs · test/cases/72_rust_mcp.sh

recorded evidencerecorded evidence: not run
What the MCP server serves is decided by the manifest, the declared source classes and each file's front matter, so an object added to the layer is served with no change to the executable

apps/majordomus-cli/src/index.rs · test/cases/72_rust_mcp.sh

recorded evidencerecorded evidence: not run
A file of the layer the MCP server cannot read is excluded with a diagnostic naming its path and the index says it is degraded, never silently smaller

apps/majordomus-cli/src/index.rs · test/cases/72_rust_mcp.sh

recorded evidencerecorded evidence: not run
Every capability of the Rust executable is defined once, and the registry refuses a duplicate id or a colliding projection name, naming both parties

apps/majordomus-cli/src/capability/registry.rs · apps/majordomus-cli/tests/registry.rs

recorded evidencerecorded evidence: not run
MCP, HTTP, OpenAPI, Swagger UI, the capabilities commands and the generated reference are derived from the registry, and a change to one definition reaches every one of them

apps/majordomus-cli/src/http/openapi.rs · test/cases/76_capabilities_projections.sh

recorded evidencerecorded evidence: not run
How each declarative kind is read and which keys it may carry is data read at run time, and a repository adds a kind with its JSON Schema without a code change

apps/majordomus-cli/src/metadata/mod.rs · test/cases/76_capabilities_projections.sh

recorded evidencerecorded evidence: not run
Every generated artifact declares the document it projects, the encoding it is written in, the schema its content satisfies and its source, and a structured document is written in every encoding it is committed in from one value

apps/majordomus-cli/src/generate.rs · test/cases/52_generated_artifact_typing.sh

recorded evidencerecorded evidence: not run
The committed projections, the OpenAPI document, the capability reference and the allow-lists, are regenerated from the registry and the schemas, and generate --check refuses a stale one

apps/majordomus-cli/src/generate.rs · test/cases/76_capabilities_projections.sh

recorded evidencerecorded evidence: not run
One shared server serves a checkout: the first majordomus mcp binds loopback HTTP with Swagger UI and MCP over HTTP beside its stdio session and logs the URL, every later client of that checkout attaches to it, and it ends when the last client leaves

apps/majordomus-cli/src/lease.rs · test/cases/90_mcp_shared_server.sh

recorded evidencerecorded evidence: not run
Nothing a client leaves behind locks another client out of the shared server; a corrupt, empty, stale or abandoned lease is taken over and named, a client that cannot share is served alone with the reason logged, and a signal removes the lease before the server dies

apps/majordomus-cli/src/lease.rs · apps/majordomus-cli/tests/mcp_shared.rs

recorded evidencerecorded evidence: not run
A server whose lease was taken over says so on the endpoint every reader probes, refuses to take on a new client, and reports that what its health describes is another process; the sessions it already had continue and it ends with them

apps/majordomus-cli/src/lease.rs · apps/majordomus-cli/tests/lease_lost.rs

recorded evidencerecorded evidence: not run
Every client attached to a checkout's server is a peer named by its own initialize, and majordomus_peers lists every worker of the repository - its own board and the board of every other checkout, each peer stamped with the worktree it is working in - while majordomus_announce tells the others what it is working on and which paths it expects to touch

apps/majordomus-cli/src/peers.rs · test/cases/250_the_board_is_repository_wide.sh

recorded evidencerecorded evidence: not run
An MCP client opened in the repository starts the server itself, through the client configurations at the root and bin/majordomus-mcp, without ever building the executable

bin/majordomus-mcp · test/cases/90_mcp_shared_server.sh

recorded evidencerecorded evidence: not run
A client that starts the MCP server from a checkout whose executable is missing or stale is served by the installed release when it is of this tree's generation and told so, and is otherwise refused with exit 12 naming the explicit build; nothing is built

bin/majordomus-cli · test/cases/3177_a_client_always_gets_a_server.sh

recorded evidencerecorded evidence: not run
A bare claude in a supervised repository starts with the repository's session-start prompt as its first message, and a run with an argument, outside such a repository, with the opt-out, or with a prompt that cannot be rendered is left exactly as it was

share/shell/session-start.sh · test/cases/3221_a_bare_session_start_joins_the_cluster.sh

recorded evidencerecorded evidence: not run
A tag with a pre-release part is published as a prerelease, recorded on the prerelease channel, and never resolved as the stable release, so an unpinned installer and a node that follows stable keep the highest stable version

scripts/release-record · test/cases/3179_a_prerelease_is_never_published_as_stable.sh

recorded evidencerecorded evidence: not run
A majordomus:// URI resolves the same way through the MCP resource read, the majordomus_get tool and the HTTP object route, and majordomus://repository answers repository.info as a JSON document tagged builtin

apps/majordomus-cli/src/capability/builtin/objects.rs · apps/majordomus-cli/tests/http_serve.rs

recorded evidencerecorded evidence: not run
Every gate the Rust executable must pass is one script, scripts/rust-check, and CI runs that script on every change that can reach the crate

scripts/rust-check · test/cases/77_rust_evidence.sh

recorded evidencerecorded evidence: not run
Coverage of the Rust crate is measured with test code out of the denominator, on every change that can affect the crate and on every push to master, and the build fails under the floor in scripts/rust-coverage-threshold or under the session/continuity domain's own floor in scripts/session-coverage-threshold

scripts/rust-coverage · test/cases/77_rust_evidence.sh

recorded evidencerecorded evidence: not run
The paths of the Rust executable that scale with the repository carry criterion benchmarks that build on every push, and every executable capability declares its benchmark policy, required or waived for a typed reason

apps/majordomus-cli/benches/projections.rs · test/cases/77_rust_evidence.sh

recorded evidencerecorded evidence: not run
A capability of the Rust executable is declared once and composed into its module, the root composes modules, and the registry refuses a capability outside its module's namespace

apps/majordomus-cli/src/capability/module.rs · apps/majordomus-cli/tests/registry.rs

recorded evidencerecorded evidence: not run
Every externally callable operation of the Rust executable is a benchmark target with a denominator generated from the registry, and a missing case fails the structural check

apps/majordomus-cli/src/bench/coverage.rs · apps/majordomus-cli/tests/bench_units.rs

recorded evidencerecorded evidence: not run
After startup, no MCP or HTTP request of the Rust executable scans the repository, builds the index or the registry, derives a schema or builds a projection, and perf.counters proves it

apps/majordomus-cli/src/perf.rs · test/cases/91_canonical_architecture.sh

recorded evidencerecorded evidence: not run
A cached capability of the Rust executable answers the same value uncached, cold and warm, a hit runs no handler, errors and commands are never cached, and the key carries the registry fingerprint

apps/majordomus-cli/src/capability/executor.rs · apps/majordomus-cli/tests/executor.rs

recorded evidencerecorded evidence: not run
The provider bootstraps the policy declares (AGENTS.md, CLAUDE.md, GEMINI.md, ...) are a target of majordomus generate, rendered from the policy and the provider templates byte for byte as the shell tool renders them, and generate --check refuses a hand-edited or stale one in CI

apps/majordomus-cli/src/providers.rs · test/cases/93_rust_provider_projections.sh

recorded evidencerecorded evidence: not run
The site's Registry page is rendered from site/data/registry/registry.json, a dataset majordomus generate site derives from the registry and the index with their fingerprints, and generate --check refuses a stale one in CI

apps/majordomus-cli/src/site.rs · apps/majordomus-cli/tests/projections.rs

recorded evidencerecorded evidence: not run
A change runs the gates its paths can affect, decided by one model of what affects what, and a change to the pipeline itself or a path the model does not know runs every gate

scripts/ci-plan · test/cases/94_ci_plan.sh

recorded evidencerecorded evidence: not run
The verdict status is green only when planning succeeded and every gate the plan selected ran in a job that succeeded; a failed or cancelled job, a selected gate whose job was skipped, or a plan that selected nothing is red

scripts/ci/verdict · test/cases/94_ci_plan.sh

recorded evidencerecorded evidence: not run
The behavioural suite runs a bounded number of cases at a time with the serial runner's semantics, a case that writes into the checkout declares itself exclusive and runs alone, and the parallel phase fails naming the paths when the checkout changed under it

test/run.sh · test/cases/94_ci_plan.sh

recorded evidencerecorded evidence: not run
The Rust executable the rust gate built is published as an artifact with its provenance, and every Rust case drives the executable MAJORDOMUS_BIN names instead of building one

scripts/rust-check · test/cases/401_the_rust_artifact_carries_its_provenance.sh

recorded evidencerecorded evidence: not run
Publication is gated on everything that can make the published site wrong and waits for nothing else; the checks that decide whether a change may merge run beside it on the same commit, not in front of it

.github/workflows/pages.yml · test/cases/97_pages_fast_path.sh

recorded evidencerecorded evidence: not run
The OpenAPI document is inferred, the tags are the modules, the examples are the benchmark cases, the responses are the router's statuses by kind, the prose is the one text every projection shares, and the site's API reference is rendered from the committed document

apps/majordomus-cli/src/http/openapi.rs · test/cases/92_openapi_reference.sh

recorded evidencerecorded evidence: not run
What a worker reads of the repository is declared once in .ai/repo/scope.yaml, out wins over in, and the Rust executable discovers, indexes and serves nothing outside it

apps/majordomus-cli/src/scope.rs · test/cases/93_scope_policy.sh

recorded evidencerecorded evidence: not run
Every public command is named and run by an active use case, a guaranteed claim or an MCP tool without one is a named gap, and the policy says which gaps fail doctor, check and finish

lib/usecase.sh · test/cases/94_use_cases.sh

recorded evidencerecorded evidence: not run
A use case's scenario executes against the real tool in a disposable repository, every step's exit code and output are asserted, and the normalised evidence is what the site shows

lib/usecase.sh · test/cases/94_use_cases.sh

recorded evidencerecorded evidence: not run
From the files a change touched, the tool names the commands, rules, use cases, scenarios and behavioural cases affected, and scaffolds a draft for a capability no use case covers

lib/usecase.sh · test/cases/94_use_cases.sh

recorded evidencerecorded evidence: not run
A live scenario may only run commands share/commands.yaml declares read-only, names no setup, and asserts an obligation only where something owes one; every other shape is refused by usecase validate with exit 10

lib/usecase.sh · test/cases/359_live_scenarios.sh

recorded evidencerecorded evidence: not run
A live scenario is not selected by a bare usecase run, its evidence is written under the ignored local half, and it never raises a command to covered; an undischarged obligation is reported unmet, never failed

lib/usecase.sh · test/cases/359_live_scenarios.sh

recorded evidencerecorded evidence: not run
The site is deployed by one script, scripts/site-deploy, from a terminal or from the publication workflow; it refuses a dirty tree, a commit master does not contain and a build that is not HEAD's, pushes site/public to gh-pages with the source commit named, and pushes nothing when the output is unchanged

scripts/site-deploy · test/cases/96_site_deploy.sh

recorded evidencerecorded evidence: not run
A commit whose derived data is behind its canonical inputs is refused before it exists, and a repository that unwires that gate is a doctor failure

scripts/pages · test/cases/56_derived_current_gate.sh

recorded evidencerecorded evidence: not run
The site's pages about the Rust executable (one per module, one per capability, the command line, the MCP surface, the benchmarks, the executable's own narrative) are derived from the registry manifest and the registry dataset the executable generates, nothing names a capability by hand, and a capability that joins or leaves the registry gains or loses its page, its index entries and its links from the generators alone

scripts/lib/executable-site.jq · test/cases/95_executable_reference.sh

recorded evidencerecorded evidence: not run
Every committed derived artifact of the repository is regenerated by one command in dependency order and checked by one read-only command that names every stale artifact, a second regeneration on a clean tree changes nothing, and no derived file records the commit it lands in

scripts/derive · test/cases/400_derivation_is_one_graph.sh

recorded evidencerecorded evidence: not run
A skill is one directory under the layer's skills section holding SKILL.md, discovered by the source class `skill` the shell tool and the Rust executable both read, so that adding the file is the whole registration and the catalogue, the command, doctor, MCP and the site all derive from it

lib/skills.sh · test/cases/95_skills.sh

recorded evidencerecorded evidence: not run
A task that declares obligations reaches the outcome completed only when each one has evidence recorded against it, and evidence taken over files that have since changed, or at a commit the branch has since left, no longer discharges anything

lib/evidence.sh · test/cases/103_obligations.sh

recorded evidencerecorded evidence: not run
An obligation whose fact the tool can hold is established live rather than recorded — a clean tree, a remote-tracking ref that reaches the head, a trunk that reaches it, a published site that serves it — and a hand-recorded line neither discharges it nor rescues it

lib/evidence.sh · test/cases/103_obligations.sh

recorded evidencerecorded evidence: not run
Every skill is validated against the allow-list generated from its schema, its directory, its sections and its references, a violation names the file and every reason, and a repository with no skills is reported rather than passed

lib/skills.sh · test/cases/95_skills.sh

recorded evidencerecorded evidence: not run
The website's skills section is rendered from the skills catalogue, one page per skill carrying the skill's own body and examples, and a removed or renamed skill leaves no page, entry or link behind

scripts/generate-site-data · test/cases/95_skills.sh

recorded evidencerecorded evidence: not run
An operational moment is one file under the layer, discovered rather than registered, and answered by the command line, the HTTP API, the OpenAPI document, MCP, the derived graph and the website with nothing else changed

apps/majordomus-cli/src/why.rs · apps/majordomus-cli/tests/why.rs

recorded evidencerecorded evidence: not run
Every reference a moment makes resolves against the thing it names, and one that does not is an error carrying the nearest candidate

apps/majordomus-cli/src/why.rs · apps/majordomus-cli/tests/why.rs

recorded evidencerecorded evidence: not run
A diagnosis of a reader's own symptoms is deterministic counting over the catalogue's metadata, and every recommendation names the moments that produced it

apps/majordomus-cli/src/why.rs · apps/majordomus-cli/tests/why.rs

recorded evidencerecorded evidence: not run
A closed execution episode is a shared object of the layer, written by the tool from git and the ledger, valid against a contract that admits no conversation and no absolute path, and discovered rather than registered

lib/session.sh · test/cases/63_session_records.sh

recorded evidencerecorded evidence: not run
A provider hook opens the episode below the model and hands the worker what the last one left, records what a compaction is about to discard, and closes the episode with a continuation record beside its envelope

lib/session_context.sh · test/cases/54_session_lifecycle_hooks.sh

recorded evidencerecorded evidence: not run
The session subsystem has a reading of itself — every open episode of the store and not only the one the pointer follows, the episodes that can no longer close themselves, the commit the serving process is answering about, and what each provider's adapter declares

apps/majordomus-cli/src/capability/builtin/lifecycle.rs · test/cases/171_session_observability.sh

recorded evidencerecorded evidence: not run
A client with no provider hooks gets an execution episode from the MCP connection, resumes its own after a crash, and never has its prompt claimed to be captured

apps/majordomus-cli/src/episodes.rs · test/cases/200_generic_mcp_episode.sh

recorded evidencerecorded evidence: not run
What each provider can do about the session lifecycle, prompt capture, driving a browser beside this server and reporting what a session consumed is one declaration with a citation per cell, every surface projects it, and no provider the declaration names goes unreported

share/providers.yaml · test/cases/200_generic_mcp_episode.sh

recorded evidencerecorded evidence: not run
An architecture decision is one file under the layer's adrs section, validated against the decision contract, with an identity nothing else claims, reciprocal supersession, and every reference it makes resolving

lib/adr.sh · test/cases/99_adr.sh

recorded evidencerecorded evidence: not run
A decision states what it put in force as typed references, each one validated, and the reverse direction — what a rule, a document, an implementation or a case was decided by — is read from the knowledge graph rather than written down a second time

lib/adr.sh · test/cases/99_adr.sh

recorded evidencerecorded evidence: not run
majordomus adr propose writes a decision with status proposed and refuses to write any other status, allocates its identity under a lock so concurrent workers never collide, and records what the decision was derived from

lib/adr.sh · test/cases/99_adr.sh

recorded evidencerecorded evidence: not run
Every command of the Rust executable's command line carries a summary, help on every argument and, where it runs, at least one example, the root carries a long description, and every example shown to a reader is executed against the built executable

apps/majordomus-cli/src/cli.rs · apps/majordomus-cli/tests/cli_examples.rs

recorded evidencerecorded evidence: not run
Every web surface is declared once at its producer and resolved into one topology, from which the router, the landing page and the machine-readable index are each projected

apps/majordomus-cli/src/web/model.rs · test/cases/89_web_surface.sh

recorded evidencerecorded evidence: not run
/docs serves this repository's documentation and /swagger serves the Swagger UI, and neither may take the other's mount

apps/majordomus-cli/src/web/discover.rs · test/cases/89_web_surface.sh

recorded evidencerecorded evidence: not run
The crate's rustdoc is a web surface at /rustdoc declared by discovery from the crate, present in the topology, its committed projection and the home page whether or not its producer has run, and a running server answers /rustdoc/ from the tree its producer wrote

apps/majordomus-cli/src/web/discover.rs · test/cases/488_rustdoc_discoverable.sh

recorded evidencerecorded evidence: not run
The site build composes every published static surface into its output at that surface's mount, read from the committed topology with no surface named by hand, and refuses, naming the producer, when a published surface's artifact is absent

scripts/site-build · test/cases/486_rustdoc_composition.sh

recorded evidencerecorded evidence: not run
The crate's rustdoc is published at /rustdoc with the site, built from the commit the site names, and is never committed

scripts/site-deploy · test/cases/489_rustdoc_deploy.sh

recorded evidencerecorded evidence: not run
Every item the crate exports has its rustdoc page at the route derived from its path and kind, no item page exists without its item, and a module added to the crate becomes a required page with no list edited

apps/majordomus-cli/src/quality/rustdoc.rs · test/cases/490_rustdoc_new_module.sh

recorded evidencerecorded evidence: not run
A rustdoc tree built from another commit than the one it is checked or deployed as is refused, by the integrity check before publication and by the public verification after it

scripts/pages · test/cases/487_rustdoc_staleness.sh

recorded evidencerecorded evidence: not run
Every builtin module's page on the site links the page the crate's reference documents that module on, from the one module-to-page mapping the rustdoc check holds the published tree to, and only in a build that composed the reference

apps/majordomus-cli/src/site.rs · test/cases/492_rustdoc_module_links.sh

recorded evidencerecorded evidence: not run
A branch's worktree path is derived from git identity and the branch name alone — the primary checkout's sibling named with -wt, then the branch with its hierarchy kept — and is the same answer from every directory of every worktree, with nothing registered or configured

apps/majordomus-cli/src/worktree/path.rs · test/cases/96_worktree_topology.sh

recorded evidencerecorded evidence: not run
A misplaced worktree is brought to its canonical path with its modified, staged, unstaged and untracked work intact, verified by a fingerprint taken before and after the move, and a step is reported as moved only when the two are equal

apps/majordomus-cli/src/worktree/migrate.rs · test/cases/96_worktree_topology.sh

recorded evidencerecorded evidence: not run
A product feature is one file under the layer, discovered rather than registered, and answered by the command line, the HTTP API, the OpenAPI document, MCP, the derived graph, the capability matrix and the website's homepage and feature pages with nothing else changed

apps/majordomus-cli/src/product.rs · test/cases/97_product_features.sh

recorded evidencerecorded evidence: not run
The product is filed under a few domains declared once as files of the layer; a feature names exactly one, and every domain's members, interfaces, guarantees and use cases are derived from the features that name it, so a stable feature cannot be left out of the product map without the model refusing it

apps/majordomus-cli/src/product.rs · test/cases/800_product_domains.sh

recorded evidencerecorded evidence: not run
Which interfaces a feature is exposed through, what stands behind it and what it answers are derived from the registries that own those facts, never authored, and a source file that writes one down is refused by its schema

apps/majordomus-cli/src/product.rs · apps/majordomus-cli/tests/product.rs

recorded evidencerecorded evidence: not run
Every reference a feature makes resolves against the registry that owns it, and one that does not is an error naming the file, the key and the nearest candidate rather than a page linking to nothing

apps/majordomus-cli/src/product.rs · apps/majordomus-cli/tests/product.rs

recorded evidencerecorded evidence: not run
The dataset the website is rendered from carries only fields an allow-list names, so a feature's prose, a machine path or a field nobody allowed cannot reach a published page

apps/majordomus-cli/src/site.rs · apps/majordomus-cli/tests/product.rs

recorded evidencerecorded evidence: not run
The website's homepage and feature pages name no feature, module, command, provider or count of their own, and a stale product dataset is refused by the pre-commit hook and by the rust gate before it can be merged

site/templates/index.html · test/cases/400_derivation_is_one_graph.sh

recorded evidencerecorded evidence: not run
A capability added to the registry appears in the Cockpit's listing, navigation and search and on a page of its own with a form generated from its schema, without one line of the Cockpit being edited

apps/majordomus-cli/src/cockpit/mod.rs · apps/majordomus-cli/tests/cockpit.rs

recorded evidencerecorded evidence: not run
The UI's dashboard at /ui links every capability it read to that capability's page, serves under the Cockpit's security policy, and never waits for the pull-request queue, which is a page and a fragment of its own

apps/majordomus-cli/src/ui/dashboard.rs · apps/majordomus-cli/tests/ui_surface.rs

recorded evidencerecorded evidence: not run
The Observatory at /ui/observatory and /ui/kiosk shows a scene only when the capabilities it requires answered with something to draw, or, for a scene of the mesh where no mesh runs, when the repository carries a recording of it, which it labels a replay; a scene without either carries no model and states the source's reason, on a server and in the published snapshot alike

apps/majordomus-cli/src/ui/observatory.rs · test/cases/3011_the_observatory_draws_nothing_it_did_not_read.sh

recorded evidencerecorded evidence: not run
A deployment object that breaks its closed contract, whether by a key the contract does not have, another schema version, a missing field, an interface, port, machine count or health route that could not work, a provider the contract does not know or a provider address that is not https, a value that reads as a credential or an identity two files claim, is refused by doctor with the reason named

lib/deployment.sh · test/cases/84_deployment_contract.sh

recorded evidencerecorded evidence: not run
A claim's proof is an execution that was recorded with the commit it ran against, not a test path that resolves

apps/majordomus-cli/src/evidence/mod.rs · test/cases/124_evidence.sh

recorded evidencerecorded evidence: stale
CI records every test it ran with the commit and the run it happened in, and the site publishes the tracked ledger's verdict at that commit as current only when CI's run of the published commit measured clean trees and nothing was absent, refused or failed; otherwise as stale with its distance or its failures, as unknown with its reasons, or as unavailable with the reason

scripts/ci/evidence-collect · test/cases/357_ci_records_evidence.sh

recorded evidencerecorded evidence: not run
Every rule names what proves it, and every path it names is in the tree

scripts/ci/rule-proof-check · test/cases/125_rule_proof.sh

recorded evidencerecorded evidence: stale
Every claim, rule, feature, command, capability, MCP tool and use case the repository declares is an evidence subject whose members and tests are derived from declarations that already exist, and a committed subject index that differs from that derivation is refused

apps/majordomus-cli/src/evidence/subject.rs · test/cases/507_evidence_subjects_are_derived.sh

recorded evidencerecorded evidence: not run
The behavioural and negative tests the subject index names for a command are exactly the ones its command page lists, both read from the first coverage and negative header of each case

apps/majordomus-cli/src/evidence/subject.rs · test/cases/507_evidence_subjects_are_derived.sh

recorded evidencerecorded evidence: not run
A rule that no program can express says so in its own front matter, with the reason, and is counted apart from every rule that has a gate

scripts/ci/rule-proof-check · test/cases/125_rule_proof.sh

recorded evidencerecorded evidence: stale
A rule's proof state is derived from the tree and the ledger together, and a mechanism that refuses violations is never reported as a run that passed

apps/majordomus-cli/src/rules/mod.rs · test/cases/133_rule_graph.sh

recorded evidencerecorded evidence: stale
Every authored file in this repository is spelled in English, and a proper noun, a test fixture or a published translation that is not carries its reason beside the check

scripts/ci/english-only-check · test/cases/138_governance_gates.sh

recorded evidencerecorded evidence: stale
A page of the published site written in a reader's language is declared with that language and a reason, and is refused unless the page declares the same language itself

scripts/ci/english-only-check · test/cases/403_published_translation.sh

recorded evidencerecorded evidence: not run
Every finding a command reports names the command that reproduces it

scripts/ci/finding-reproduce-check · test/cases/138_governance_gates.sh

recorded evidencerecorded evidence: stale
A run recorded against this commit and a run whose inputs merely have not changed since are reported as different states, never as one

apps/majordomus-cli/src/evidence/mod.rs · test/cases/124_evidence.sh

recorded evidencerecorded evidence: stale
Recording one test's result never erases the evidence recorded for any other test

apps/majordomus-cli/src/evidence/ledger.rs · test/cases/124_evidence.sh

recorded evidencerecorded evidence: stale
Every claim names the test meant to settle it and every test names the claims it is meant to settle, from one derivation

apps/majordomus-cli/src/capability/builtin/evidence.rs · test/cases/124_evidence.sh

recorded evidencerecorded evidence: stale
A claim that declares a guarantee no recorded run supports is named by a gate rather than displayed as guaranteed

scripts/evidence-check · test/cases/124_evidence.sh

recorded evidencerecorded evidence: stale
A claim reads proven only when its passing run was recorded on a commit the presented revision contains, nothing but the evidence ledger changed between the two, and neither the recorded tree nor the presented tree was dirty; a run on a commit the presented revision does not contain reads stale; a named revision is judged by the ledger committed in it, and a clean failing run of the same test that the checkout holds uncommitted, recorded between the two, caps it at stale

apps/majordomus-cli/src/evidence/freshness.rs · test/cases/502_evidence_is_judged_at_the_presented_revision.sh

recorded evidencerecorded evidence: not run
A test that declined to run reads not_run with a detail saying it declined, never proven and never failing, and a test that errored or timed out reads failing

apps/majordomus-cli/src/evidence/freshness.rs · test/cases/502_evidence_is_judged_at_the_presented_revision.sh

recorded evidencerecorded evidence: not run
A rule with a failing test reads failing whatever its other tests say, so a blocking rule whose tests are one failing and one not run is still a finding

apps/majordomus-cli/src/evidence/freshness.rs · test/cases/502_evidence_is_judged_at_the_presented_revision.sh

recorded evidencerecorded evidence: not run
No mesh discovery socket opens until the repository commits an enabled mesh declaration, and a disabled or absent declaration is reported as the reason, not an error

apps/majordomus-cli/src/shared.rs · apps/majordomus-cli/tests/mesh.rs

recorded evidencerecorded evidence: not run
Every discovery observation converges into one bounded registry, deduplicated by node and runtime identity across sources, replay-protected per instance, and every surface projects that registry and holds no peers of its own

apps/majordomus-cli/src/mesh/registry.rs · apps/majordomus-cli/tests/mesh.rs

recorded evidencerecorded evidence: not run
Two runtimes of one repository link only through a signed, replay-protected handshake that checks protocol, repository identity and trust, and every refusal is typed and visible

apps/majordomus-cli/src/mesh/cooperation.rs · apps/majordomus-cli/tests/mesh_cooperation.rs

recorded evidencerecorded evidence: not run
An exclusive claim made on one runtime excludes an overlapping claim on every linked runtime, and concurrent claims resolve to one named winner everywhere

apps/majordomus-cli/src/mesh/state.rs · apps/majordomus-cli/tests/mesh_cooperation.rs

recorded evidencerecorded evidence: not run
Runtimes serving different repositories never form a cooperative link, even when they discover each other

apps/majordomus-cli/src/mesh/repository.rs · apps/majordomus-cli/tests/mesh_cooperation.rs

recorded evidencerecorded evidence: not run
A runtime that stops beating — crashed, killed or partitioned — expires on its peers within the declared expiry, its claims stop excluding, and its restart reconnects as the same runtime without a duplicate

apps/majordomus-cli/src/mesh/cooperation.rs · apps/majordomus-cli/tests/mesh_cooperation.rs

recorded evidencerecorded evidence: not run
Runtimes linked only through a relay converge on one state digest, each event held once, with no replication loop

apps/majordomus-cli/src/mesh/journal.rs · apps/majordomus-cli/tests/mesh_cooperation.rs

recorded evidencerecorded evidence: not run
Compacting the cooperation journal changes nothing live — a handover nobody has taken keeps its stream for a bounded retention, who took a handover and who answered a review stay with them, and a compacted runtime that beats again is fetched again whole

apps/majordomus-cli/src/mesh/journal.rs · test/cases/493_mesh_compaction_keeps_what_is_live.sh

recorded evidencerecorded evidence: not run
Separate Linux nodes on a real network discover each other by multicast, link, share claims and handovers, and recover from a partition and a crash, in a lab CI runs

test/mesh-lab/run · test/cases/414_mesh_lab_evidence.sh

recorded evidencerecorded evidence: not run
A discovered node gains no execution and no authorization from being heard; only signed traffic from a linked node may change mesh state, and trust labels records under an explicit policy that defaults to deny_unknown

apps/majordomus-cli/src/mesh/trust.rs · apps/majordomus-cli/tests/mesh.rs

recorded evidencerecorded evidence: not run
An enabled mesh declaration whose shared server did not activate the mesh is a failed `runtime` check of `mesh doctor` (exit 10) carrying the server's reason, and a `Mesh: DECLARED ENABLED BUT NOT ACTIVE` line in the session-start briefing — never a quiet off; and this repository's committed declaration is tracked, enabled, allowlists the fleet and names a hub

apps/majordomus-cli/src/mesh/doctor.rs · test/cases/494_the_mesh_is_declared_and_held.sh

recorded evidencerecorded evidence: not run
The inbound admissions a mesh declaration implies on a machine — the multicast group's port, the declared hub ports whose address is the machine's, the server's port beyond loopback — are derived from the declaration by `majordomus mesh firewall`, which names the host's firewall backend, the commands that admit them and the firewall's own verdict, exits 10 when a rule is observed missing or the kernel logged a drop toward those ports, and whose `apply` runs the commands only as root and never over HTTP or MCP; `mesh doctor` carries the same verdict as its `firewall` check

apps/majordomus-cli/src/mesh/firewall.rs · test/cases/495_the_firewall_admits_the_mesh.sh

recorded evidencerecorded evidence: not run
Vendors and models are declared once in share/models.yaml, and the CLI, HTTP, OpenAPI, MCP and Cockpit render that one declaration with no model name of their own

apps/majordomus-cli/src/models/mod.rs · test/cases/131_models.sh

recorded evidencerecorded evidence: not run
A routing decision names why the selected model was selected and, for every excluded model, the first check it failed — the same answer for the same question, with no hidden state

apps/majordomus-cli/src/models/mod.rs · test/cases/131_models.sh

recorded evidencerecorded evidence: not run
The model catalogue reports whether a vendor's named credential variable is set and can carry no secret value — the schema has no field one could hide in

apps/majordomus-cli/src/models/mod.rs · test/cases/131_models.sh

recorded evidencerecorded evidence: not run
A provider's end event and its compaction event derive the knowledge the episode produced into candidate records under the tracked tree, from the ledger and git and never from a conversation, whether or not a task is active, and record that they did so in the ledger

lib/knowledge.sh · test/cases/563_knowledge_is_derived_at_the_boundary.sh

recorded evidencerecorded evidence: not run
A second derivation over the same evidence writes nothing, says so, and leaves the working tree unchanged; the record id is derived from the episode and a digest of the evidence so the same fact always lands in the same file

lib/knowledge.sh · test/cases/564_knowledge_derivation_is_idempotent.sh

recorded evidencerecorded evidence: not run
A policy switch that is off derives nothing and says so; a derivation that fails inside a provider hook is recorded as provider.event.failed and the hook still exits 0

lib/capture.sh · test/cases/565_knowledge_switch_and_failure_leave_evidence.sh

recorded evidencerecorded evidence: not run
Every knowledge record is schema-valid with no unknown key, uniquely identified, evidenced when verified, resolves every reference it names, and carries no conversation; check, doctor and `majordomus knowledge check` refuse a record that is not

lib/knowledge.sh · test/cases/707_knowledge_check_refuses_malformed_records.sh

recorded evidencerecorded evidence: not run
A repository in which episodes close and no knowledge derivation follows within the stale threshold is reported as a stopped writer by doctor and watch, and the finding clears when a derivation is written

lib/knowledge.sh · test/cases/708_health_sees_a_stopped_knowledge_writer.sh

recorded evidencerecorded evidence: not run
verified is written only by promote with evidence on stdin or by a person editing the file, never by the deriver; promotion moves the record to curated/ and rejection supersedes it with a reason, each leaving a ledger line

lib/knowledge.sh · test/cases/709_knowledge_promotion_is_an_act.sh

recorded evidencerecorded evidence: not run
knowledge observe records one observation.recorded ledger line with its kind, subject, statement and typed evidence references, inside an open episode, inside a task or outside one, and refuses any other shape, or the absence of an episode, without writing

lib/knowledge.sh · test/cases/980_a_session_records_what_it_observed.sh

recorded evidencerecorded evidence: not run
Each observation an episode recorded becomes, at that episode's end and with no model, a candidate of its own that says what it is about, and knowledge candidates groups the records about one subject with the episodes behind them; an episode that observed nothing records that it found nothing

lib/knowledge.sh · test/cases/981_an_observation_becomes_a_grouped_candidate.sh

recorded evidencerecorded evidence: not run
Every candidate derived from an observation carries a route — platform, enforcement, generator, documentation or project — derived from its subject's structure and never from its wording, and in a repository that adopted the tool its own share/ routes project

lib/knowledge.sh · test/cases/982_a_candidate_is_routed_by_what_it_is_about.sh

recorded evidencerecorded evidence: not run
The start briefing names the candidates awaiting review on this branch, count and ids, bounded and within the briefing budget, and prints their absence rather than omitting it

lib/derive.sh · test/cases/710_briefing_names_the_candidates.sh

recorded evidencerecorded evidence: not run
More candidates than the policy cap, or a candidate older than the policy age, is an advisory doctor finding that names them; both numbers are declared once in the policy

lib/knowledge.sh · test/cases/711_candidates_are_reviewed_not_accumulated.sh

recorded evidencerecorded evidence: not run
The candidates awaiting review, one record by id with its references resolved, and the derivation status of the checkout are one declaration each and answer with the same content over the command line, HTTP and MCP

apps/majordomus-cli/src/capability/builtin/knowledge_base.rs · apps/majordomus-cli/tests/knowledge_base.rs

recorded evidencerecorded evidence: not run
Every executable line, function and region a change adds or touches in the Rust crate must be covered by a test; a change that leaves new code uncovered is refused, and untouched legacy debt is left alone

scripts/rust-coverage · test/cases/132_coverage_differential.sh

recorded evidencerecorded evidence: not run
A commit message that does not satisfy the repository's declared commit policy is refused at the moment it is written, and the history's existing debt is recorded and may not grow

apps/majordomus-cli/src/commit/verdict.rs · test/cases/274_commit_policy.sh

recorded evidencerecorded evidence: stale
The scope vocabulary a commit is judged against is learned from this repository's own history rather than kept in a table, so a subsystem committed today is in the vocabulary today and a scope outside it is a warning rather than a refusal

apps/majordomus-cli/src/commit/scopes.rs · test/cases/274_commit_policy.sh

recorded evidencerecorded evidence: stale
A commit plan carries a fingerprint of the repository, the worktree, HEAD and the exact change set it was derived from, so a plan acted on after the tree moved is refused with the reason rather than applied

apps/majordomus-cli/src/commit/plan.rs · test/cases/274_commit_policy.sh

recorded evidencerecorded evidence: stale
A crate test binary that ran no test or only a filtered subset is recorded as a skip, one with a failed test as a failure and one that printed no result as an error, whatever colour codes its output carries, and what no claim can name yet is listed as dropped

apps/majordomus-cli/src/evidence/record.rs · test/cases/506_a_crate_binary_that_ran_nothing_is_not_a_pass.sh

recorded evidencerecorded evidence: not run
A recorded execution carries the commit and the tree that its run's own measurement stated, a measurement that names the report it belongs to and never hides a tracked change; a measurement of another commit or another report is refused, a local measurement that names no report is refused, a CI report without a measurement is refused, and a report recorded without one carries an unknown tree, which never reads proven

apps/majordomus-cli/src/evidence/record.rs · test/cases/505_a_recording_carries_what_its_run_measured.sh

recorded evidencerecorded evidence: not run
Every recording yields a run record naming its commit, the tree each report's run measured, its totals and what was absent, dropped or unknown, and a coverage summary joins it only bound to the commit and tree it was measured on

apps/majordomus-cli/src/evidence/run.rs · test/cases/505_a_recording_carries_what_its_run_measured.sh

recorded evidencerecorded evidence: not run
A recording made with --ledger local writes only the ignored local ledger, changes no tracked file and moves no verdict

apps/majordomus-cli/src/evidence/ledger.rs · test/cases/505_a_recording_carries_what_its_run_measured.sh

recorded evidencerecorded evidence: not run
A test case that declines to run is reported as a skip and recorded as one, so the evidence ledger can never read a case that asserted nothing as the proof of the claim it names

test/run.sh · test/cases/413_a_skipped_case_is_not_a_proof.sh

recorded evidencerecorded evidence: not run
Majordomus reasons, decides, implements and validates with no advisor at all: absent advisors are reported as ordinary state, material uncertainty gets a structured local review, and the conclusion claims no independent review

apps/majordomus-cli/src/reasoning/policy.rs · test/cases/730_reasoning_works_with_no_advisor.sh

recorded evidencerecorded evidence: not run
Every advisor transport is held to one contract — typed failures, deadlines, cancellation, normalised answers, reported usage, redacted secrets — proven against fakes with no network, model or credential

scripts/lib/advisors/contract.mjs · test/cases/731_advisor_transport_contract.sh

recorded evidencerecorded evidence: not run
Advisors that disagree never decide by count: a conclusion is refused while a disagreement on its assessment is unsettled, a resolution needs evidence, and every answer received must be weighed

apps/majordomus-cli/src/reasoning/store.rs · test/cases/732_disagreement_is_settled_by_evidence.sh

recorded evidencerecorded evidence: not run
An advisor that times out, is rate limited, refuses its credential or answers malformed is recorded as exactly that, never blocks the work, opens a circuit that closes again after its cooldown, and never fails the session

apps/majordomus-cli/src/reasoning/availability.rs · test/cases/733_advisor_failure_and_recovery.sh

recorded evidencerecorded evidence: not run
A decision and its provenance survive the session: the next session finds them in its context and handover, reuses a standing conclusion instead of consulting again, and reopens it only on new evidence

apps/majordomus-cli/src/reasoning/state.rs · test/cases/734_reasoning_survives_the_session.sh

recorded evidencerecorded evidence: not run
Advisors are declared once, in share/advisors.yaml, by reference to the provider table and the model catalogue; a new advisor reaches the command line, the policy, HTTP, OpenAPI, MCP and the Cockpit with no consumer edited

share/advisors.yaml · test/cases/735_a_new_advisor_needs_no_consumer_edit.sh

recorded evidencerecorded evidence: not run
A session cannot claim review it did not get: a consultation must name an advisor its recorded plan selected, a conclusion's review is computed, and reasoning check and doctor refuse a forged record, provider coupling, a model credential in CI and a refused claim in a document

apps/majordomus-cli/src/reasoning/check.rs · test/cases/736_reasoning_check_refuses_drift.sh

recorded evidencerecorded evidence: not run
Whether a task added debt, left a branch or a worktree behind, or grew the backlog is answered by the done invariant from git, the debt baselines and the recorded forge observation, measured from where the task started; a reading that was not taken is unknown, never a pass

apps/majordomus-cli/src/gates/closing.rs · test/cases/1037_the_closing_question_is_measured.sh

recorded evidencerecorded evidence: not run
Every Mermaid diagram of the built site gets an id (diagram-<name>), the list of its nodes, the viewer's controls and a link for each node that is the identity of an object the site has a page for, all derived at build; a link to

scripts/lib/diagrams.mjs · test/cases/3006_diagrams_are_interactive_and_linkable.sh

recorded evidencerecorded evidence: not run

← The full matrix

Guaranteed capabilities

Every platform, artifact name and installation URL is derived from one model, and a projection that disagrees with it is refused

The documented one-line install command is composed from the model's parts, and a document that states a different one fails the suite

The installer verifies an artifact's digest and inspects its archive before anything is unpacked, and any failure leaves the previous installation working

A release publishes an artifact for every supported target or it is not published

The install command this project advertises is fetched and run from the published site every night and on request, and the run that asked for it is red while it does not install a working tool

A release archive carries every path once and carries nothing but files and directories

The canonical policy is parsed and rejected if it contains an unknown key

Every profile is parsed, its unknown keys rejected, and the default profile proven to exist

Every enforcement the policy declares is reconciled against what actually runs

Exit codes are a contract, and no code means "warn and continue"

Provider instruction files are generated from the one policy, deterministically

Every generated instruction file carries its own stamp, and a hand edit is detected

A projection can own only the region between its markers, leaving the rest of the file untouched

Wiring is found in a hook or in any subhook of the directory that hook dispatches to

Every rule the tool enforces is declared once, as a rule object in the repository's effective set, and doctor proves each one is reached by the command that claims to run it

A doctrine's class is what decides whether a violation stops the command, not a label beside it

Every line of the append-only ledger is a well-formed event, and a malformed line is a failure rather than a skipped record

An entry in the questions store that does not parse blocks acceptance exactly as an unresolved question does

A declared provider hook captures the person's raw prompts below the model, and doctor proves it by running it

A captured prompt names the episode it belongs to or records that none could be resolved; the archive is private, bounded and free of credential material

Every repository-local prompt asset renders, and an unknown token is a failure

A use case or application cannot name a command, doctrine or claim that does not exist, and the two catalogues cannot disagree about which applies to which

A hand-edited instruction file is never silently overwritten

An archive that lost the file modes fails rather than travelling

The always-loaded instruction file has a line budget with a failing check

Every repository-relative reference in the always-loaded file is proven to resolve

A hardcoded count in the always-loaded file is a failure

The append-only ledger and handover store have retention caps that are checked

Installing into a repository that already has an installation is refused

Every finding carries the command that reproduces it

The shell tool performs no network call, evaluates no generated text and deletes nothing recursively; its one declared request is the loopback peer probe

A task is started with a declared file scope and a profile, and only one task is active per checkout

Identity fields on every state record are computed from git and never authored

check reports whether state, scope, blockers and checkpoint age are consistent right now

A touched file outside the claimed scope is a failure, not a warning

State read back is labelled exact, advanced, diverged or different_context against git

Overlap between parallel workers is computed on claimed paths in both containment directions

watch reports policy, projection, state, scope, handover, verification, staleness and retention drift

handover writes an append-only record with computed front matter and required sections

A handover is a state record, not a transcript - its required sections must be present and non-empty, a placeholder body is refused, and its identity is computed and refused when written into the body; a transcript pasted into a section is not detected

finish evaluates the finish contract line by line and refuses when any line is unmet

every refused finish appends a task.refused event naming the outcome claimed, the unmet count and the doctrines that refused, and finish --check writes none

An outcome is a value from a closed vocabulary, not free text

The context a worker is given is assembled from durable state in authority order, and what a profile excludes is excluded

The assembled context obeys a line budget, and every section it drops is named with its reason

A checkpoint is a capped progress record with computed identity, and a body over the cap is refused rather than truncated

The right prior record is resolved by worktree and branch, and an unrelated one is never offered

The ledger is readable back as operational history, filtered by task, event and time

Rotating the ledger archives the oldest lines and never deletes them

A decision is recorded with its reason and its task, and is superseded by a later entry rather than edited

An unresolved question blocks acceptance, and an entry the gate cannot parse is a failure rather than a silent pass

A repository-local prompt renders against a closed set of state tokens, and an unknown token is an error

Durable records are searchable literally, across kinds, without an index

Every continuity store is proven reachable through its own command, not merely present on disk

The context that applies to a path is composed from the layer's scoped documents, root to target, in one deterministic order with provenance, and a tree that does not validate resolves nothing

Every directory of the layer carries a context document, the exemption is declared by the contract that governs the subtree, and a descendant may narrow that requirement but never weaken it

The impact of a change set on the scoped context is reported from git — the documents, the scopes below them, moves with their ancestry, tracked sources to review, and stale projections — and an unrelated change reports nothing

The repository's AI layer is one directory whose manifest names every section, readable without the tool

A layer installed with --personal is one person's own in a shared repository: it changes no tracked file, no .gitignore line and nothing git status shows, and the command that makes the claim verifies it

Checkout-local state lives under .ai/local/, is ignored by git, and is absent on a fresh clone or worktree

The rule baseline is vendored into the repository with a manifest naming every file and its hash, and a hand edit is detected and refused

The effective rule set is resolved as a dependency graph in a deterministic order, and a set that does not resolve is applied by nothing

Provider instruction files are thin bootstraps that point at the AI layer and carry no rule of their own

A repository on the pre-.ai layout is migrated once, explicitly, with a previewed plan and a verified backup of its local state, and the command is idempotent afterwards

The tool runs read-only from any location, and two locations of one version agree about one repository

What the tool knows about itself is written once and derived everywhere else, and a second copy is a test failure

The public command surface is declared, and reconciled against the dispatcher

Every public command has a behavioural test and a negative test, computed rather than remembered

The ledger's event vocabulary is closed, on the way in and on the way out

A task record names the checkout it belongs to, and another checkout is never held to its scope

A blocking question keeps blocking after the work is handed to a new task

What the context compiler selects, out of what it judged relevant, is counted in tokens of a named tokenizer and recorded, never estimated

A quantity about tokens, context or cost typed into hand-written prose is refused, and a claim bound to a metric cannot be guaranteed while its evidence does not stand

Milestones and issues are canonical repository files, and a key nobody reads is an error

Issue and milestone status is derived from recorded facts and is stored nowhere

A cycle, a self-dependency and a dependency on an issue that does not exist are each refused by name

Execution waves are computed from the graph, and issues in one wave that touch the same paths are reported as serialised

An issue cannot be completed while a required piece of evidence is missing

The roadmap is derived from milestone state, and no document may be a second authority for it