| I0202Resolve a task's effective limits and print them as data | blocked | runtime-adapters | p1 | I0201 | 0 of 1 |
| I0203Make enforcement opt-in, and prove a repository that declines is unaffected | blocked | runtime-adapters | p1 | I0202 | 0 of 1 |
| I0204Apply one derived limit for real and prove it changes what happens | blocked | runtime-adapters | p1 | I0203 | 0 of 2 |
| I0205Declare the clamp as a doctrine so the mapping and the adapter cannot drift | blocked | runtime-adapters | p2 | I0204 | 0 of 2 |
| I0206Publish the runtime-adapters claim with the test that proves it and the limits it does not cover | blocked | runtime-adapters | p2 | I0205 | 0 of 1 |
| I0301Define the execution record, including what an absence looks like | blocked | execution-telemetry | p2 | milestone:execution-telemetry | 0 of 1 |
| I0302Record telemetry a provider reports, and refuse anything it did not | blocked | execution-telemetry | p2 | I0301milestone:execution-telemetry | 0 of 1 |
| I0303Prove a silent provider produces an explicit absence, never a guess | blocked | execution-telemetry | p2 | I0302milestone:execution-telemetry | 0 of 1 |
| I0304Read the measurements back through the history surface, under a bound | blocked | execution-telemetry | p2 | I0303milestone:execution-telemetry | 0 of 1 |
| I0305Publish the telemetry claim and record what remains unmeasured | blocked | execution-telemetry | p3 | I0304milestone:execution-telemetry | 0 of 1 |
| I0401Define an accepted outcome, and join it to its measurements without storing the join | blocked | cost-per-accepted-outcome | p2 | milestone:cost-per-accepted-outcome | 0 of 1 |
| I0402Report cost only where measurement and acceptance both exist | blocked | cost-per-accepted-outcome | p2 | I0401milestone:cost-per-accepted-outcome | 0 of 1 |
| I0403Make a thin denominator say so rather than average it away | blocked | cost-per-accepted-outcome | p2 | I0402milestone:cost-per-accepted-outcome | 0 of 1 |
| I0404Publish the cost-per-outcome claim with its unit defined beside it | blocked | cost-per-accepted-outcome | p3 | I0403milestone:cost-per-accepted-outcome | 0 of 1 |
| I0501Group comparable work from what the records already carry | blocked | routing-recommendations | p3 | milestone:routing-recommendations | 0 of 1 |
| I0502Recommend a profile from measured cost, naming the measurements | blocked | routing-recommendations | p3 | I0501milestone:routing-recommendations | 0 of 1 |
| I0503Return no recommendation where the data is too thin, and say why | blocked | routing-recommendations | p3 | I0502milestone:routing-recommendations | 0 of 1 |
| I0504Prove the recommendation is advisory and publish it as such | blocked | routing-recommendations | p3 | I0503milestone:routing-recommendations | 0 of 2 |
| I0601Let a policy name a shared source it does not copy | blocked | shared-policy | p3 | milestone:shared-policy | 0 of 1 |
| I0602Make a local override explicit and prove it survives an update of the shared source | blocked | shared-policy | p3 | I0601milestone:shared-policy | 0 of 1 |
| I0603Report drift from the shared policy in one command | blocked | shared-policy | p3 | I0602milestone:shared-policy | 0 of 1 |
| I0604Prove the offline guarantee survives sharing | blocked | shared-policy | p3 | I0603milestone:shared-policy | 0 of 2 |
| I0605Publish the shared-policy claim and what sharing still cannot do | blocked | shared-policy | p3 | I0604milestone:shared-policy | 0 of 1 |
| I0703Implement the decision and prove it holds | blocked | M002 | p1 | I0702 | 0 of 2 |
| I0704Publish what attribution guarantees, and what it still cannot | blocked | M002 | p2 | I0703 | 0 of 1 |
| I0813A closed session becomes a node that points at its episode | blocked | M003 | p1 | I0812 | 0 of 1 |
| I0815Say what is now true in the claims, the documentation and the worker instructions | blocked | M003 | p1 | I0813 | 0 of 2 |
| I0816Prove the loop on a real issue, without a transcript | blocked | M003 | p1 | I0815 | 0 of 1 |
| I0822Every canonical file is flattened at most once per command | blocked | M004 | p0 | I0820 | 0 of 1 |
| I0828doctor under a declared budget, and the hook inherits it | blocked | M004 | p0 | I0820 | 0 of 1 |
| I0831Performance claims at their proven status | blocked | M004 | p0 | I0822 | 0 of 1 |
| I0834The test runner reports per-case time and the suite budget | blocked | M004 | p0 | I0828 | 0 of 1 |
| I0835CI runs the structural performance checks | blocked | M004 | p0 | I0822 | 0 of 1 |
| I0839watch inherits every doctor fix and its own budget | blocked | M004 | p0 | I0828 | 0 of 1 |
| I0840context and its subcommands under a second | blocked | M004 | p0 | I0820I0821 | 0 of 1 |
| I0841Cache equivalence proved by property-shaped cases | blocked | M004 | p0 | I0821 | 0 of 1 |
| I0842Before and after evidence for every optimisation | blocked | M004 | p0 | I0820I0832 | 0 of 1 |
| I0843The performance workflow is discoverable and complete | blocked | M004 | p0 | I0831I0835I0841I0842 | 0 of 1 |
| I0909The production image is a generated projection of the build specification | blocked | fly-deployment | p0 | I0905 | 0 of 4 |
| I0910The release profile is chosen by measurement, not by folklore | blocked | fly-deployment | p1 | I0909 | 0 of 2 |
| I0911A source change does not rebuild the world, and the context stays small | blocked | fly-deployment | p1 | I0909 | 0 of 3 |
| I0912The image serves the site the canonical pipeline produced | blocked | fly-deployment | p0 | I0909 | 0 of 3 |
| I0916The smoke suite is derived from the route registry, never written twice | blocked | fly-deployment | p0 | I0905I0914 | 0 of 4 |
| I0919Nothing secret and nothing local leaves in the image | blocked | fly-deployment | p0 | I0909 | 0 of 3 |
| I0920The image's dependencies are known and its advisories are policy | blocked | fly-deployment | p2 | I0909 | 0 of 4 |
| I0921Size is measured first and budgeted second | blocked | fly-deployment | p1 | I0910I0911 | 0 of 3 |
| I0923Cold start and endpoint cost are benchmark targets like everything else | blocked | fly-deployment | p1 | I0930 | 0 of 3 |
| I0925Every deployment rule is a check that runs | blocked | fly-deployment | p0 | I0915 | 0 of 3 |
| I0926The deployment documentation is generated and reachable | blocked | fly-deployment | p1 | I0913I0924 | 0 of 3 |
| I0928A pull request cannot merge a deployment that would not work | blocked | fly-deployment | p0 | I0919I0921I0930 | 0 of 2 |
| I0930The real image runs under the real limits before anything is deployed | blocked | fly-deployment | p0 | I0906I0909I0912 | 0 of 4 |
| I0932The milestone is accepted on its evidence | blocked | fly-deployment | p0 | I0920I0923I0925I0926I0927I0928I0929I0931 | 0 of 3 |
| I1008The two projections are proved to be the same model | blocked | capability-graph | p0 | I1007 | 0 of 1 |
| I1013Search over the graph, generated, with nothing to run | blocked | capability-graph | p2 | I1007 | 0 of 2 |
| I1014The relation view reads the graph and holds no data of its own | blocked | capability-graph | p2 | I1007 | 0 of 3 |
| I1016The Cockpit works on a phone and before JavaScript runs | blocked | capability-graph | p0 | I1009 | 0 of 3 |
| I1018The surface rules exist as checks, proved by making them fail | blocked | capability-graph | p0 | I1011 | 0 of 2 |
| I1019One skill runs the whole loop, and is itself in the graph | blocked | capability-graph | p2 | I1018 | 0 of 2 |
| I1020The graph's health is answered by the doctor that already answers everything else | blocked | capability-graph | p1 | I1007 | 0 of 2 |
| I1021A browser proves the interface, at the widths people use | blocked | capability-graph | p1 | I1014I1016 | 0 of 2 |
| I1022Drift in any derived surface fails the build | blocked | capability-graph | p0 | I1007 | 0 of 2 |
| I1024The interface has a weight, and it is measured | blocked | capability-graph | p2 | I1014 | 0 of 2 |
| I1026The architecture explains itself, from inside itself | blocked | capability-graph | p1 | I1012 | 0 of 2 |
| I1027A synthetic capability proves the architecture instead of describing it | blocked | capability-graph | p0 | I1018I1019 | 0 of 2 |
| I1028The inventories this replaces are removed, not left running beside it | blocked | capability-graph | p1 | I1009 | 0 of 2 |
| I1029The gate refuses what would silently break the interface | blocked | capability-graph | p1 | I1021I1022I1023 | 0 of 2 |
| I1030The milestone is accepted on its evidence | blocked | capability-graph | p0 | I1010I1013I1017I1020I1024I1026I1027I1028I1029 | 0 of 3 |
| I1102The two namespaces are a typed contract, not a habit | blocked | two-folder-integration | p0 | I1101 | 0 of 2 |
| I1103Whether a file is authored or derived is a field, not a naming convention | blocked | two-folder-integration | p0 | I1102 | 0 of 2 |
| I1104Both namespaces carry their contracts, all the way down | blocked | two-folder-integration | p1 | I1102 | 0 of 2 |
| I1105The repository is discovered once, into one model | blocked | two-folder-integration | p0 | I1101 | 0 of 2 |
| I1106The registries are views of the model, not separate discoveries | blocked | two-folder-integration | p0 | I1105 | 0 of 2 |
| I1107Discovery is deterministic, cached, and its cost is known | blocked | two-folder-integration | p1 | I1106 | 0 of 3 |
| I1108The desired integration is a value, and the plan is a diff | blocked | two-folder-integration | p0 | I1106 | 0 of 3 |
| I1109Everything placed outside the two namespaces is recorded, with what it was | blocked | two-folder-integration | p0 | I1108 | 0 of 2 |
| I1110The second run changes nothing, and a test says so | blocked | two-folder-integration | p0 | I1109 | 0 of 2 |
| I1111Uninstall gives back exactly what was taken | blocked | two-folder-integration | p0 | I1109 | 0 of 3 |
| I1112What touches the root is two small blocks, and they never change again | blocked | two-folder-integration | p0 | I1109 | 0 of 2 |
| I1113Entering a directory is local, bounded and silent about the network | blocked | two-folder-integration | p1 | I1112 | 0 of 2 |
| I1114A provider is an adapter over the model, and adding one is an implementation | blocked | two-folder-integration | p1 | I1112 | 0 of 2 |
| I1115Completion comes from the command model, not from a second list | blocked | two-folder-integration | p2 | I1114 | 0 of 1 |
| I1116This repository's own footprint moves, through the reconciler | blocked | two-folder-integration | p0 | I1110I1112 | 0 of 3 |
| I1117The hand-maintained lists are removed, not left running beside the derivation | blocked | two-folder-integration | p1 | I1106 | 0 of 2 |
| I1118Every invariant of this milestone is a rule with a check that runs | blocked | two-folder-integration | p0 | I1110I1116 | 0 of 3 |
| I1119The budgets are measured, and a regression fails rather than being noticed | blocked | two-folder-integration | p2 | I1113 | 0 of 2 |
| I1120A refusal says what to do about it | blocked | two-folder-integration | p1 | I1108 | 0 of 1 |
| I1121Every surface shows the integration from the one model | blocked | two-folder-integration | p1 | I1112 | 0 of 2 |
| I1122A foreign repository, adopted, upgraded and given back | blocked | two-folder-integration | p0 | I1110I1111I1116I1121 | 0 of 3 |
| I1123The milestone is accepted on its evidence | blocked | two-folder-integration | p0 | I1104I1107I1115I1117I1118I1119I1120I1122 | 0 of 3 |
| I1202One typed provider model reads the objects, and no code names a provider | blocked | web-sign-in | p0 | I1201 | 0 of 3 |
| I1203One flow serves every provider, and it refuses everything it did not start | blocked | web-sign-in | p0 | I1202 | 0 of 3 |
| I1204The session is signed, short, and revocable from the server | blocked | web-sign-in | p0 | I1203 | 0 of 3 |
| I1205Identity is resolved once, in the router, and every surface reads it from there | blocked | web-sign-in | p1 | I1204 | 0 of 2 |
| I1206What an anonymous reader may do is derived from the effect classification, not from a list | blocked | web-sign-in | p1 | I1205 | 0 of 3 |
| I1207No credential reaches any output, and hostile provider metadata renders safely | blocked | web-sign-in | p0 | I1204 | 0 of 3 |
| I1208Adding a provider is one file, removing one is one deletion, and both are executed rather than described | blocked | web-sign-in | p1 | I1202I1206 | 0 of 3 |
| I1303The store is bounded, measured and invisible to every published projection | blocked | external-workspaces | p0 | I1302 | 0 of 4 |
| I1304The browser transport is the one this repository already drives | blocked | external-workspaces | p0 | I1302 | 0 of 5 |
| I1305An observed contract has a fingerprint, a compatibility state and a fixture | blocked | external-workspaces | p1 | I1304 | 0 of 5 |
| I1306A sync resumes, repeats itself without harm, and says how fresh it is | blocked | external-workspaces | p1 | I1303I1305 | 0 of 4 |
| I1307The ChatGPT shape is mapped from evidence and never becomes the canonical model | blocked | external-workspaces | p1 | I1302I1305 | 0 of 4 |
| I1308The executable's share is one capability, shaped like continuity | blocked | external-workspaces | p1 | I1303 | 0 of 4 |
| I1309The boundaries this milestone asserts are gates, not sentences | blocked | external-workspaces | p0 | I1303I1308 | 0 of 5 |
| I1310The subsystem is documented where a person looks, and the plan is closed against the repository | blocked | external-workspaces | p2 | I1308I1309 | 0 of 4 |
| I1505A mutating capability leaves a durable event, and the ledger can be read back | blocked | development-runtime | p1 | I1504 | 0 of 2 |
| I1506The lifecycle commands become non-interactive capabilities | blocked | development-runtime | p1 | I1504I1505 | 0 of 2 |
| I1507Issues, milestones, sessions and peers reach the Cockpit as projections | blocked | development-runtime | p2 | I1505I1506 | 0 of 2 |
| I1801A scripted capability is a kind, discovered and registered, runnable and projected like any capability | blocked | automation | p1 | I1800 | 0 of 2 |
| I1804The first shell scripts become scripted capabilities over typed Rust | blocked | automation | p2 | I1801 | 0 of 1 |
| I1901An issue names the intent criterion it serves, and coverage is derived | blocked | intent-planning | p1 | I1900milestone:intent-planning | 0 of 2 |
| I1902The gap and the critique of an intent are typed records the plan is held to | blocked | intent-planning | p1 | I1901milestone:intent-planning | 0 of 2 |
| I1903The work realising an intent is joined across episodes, providers and handovers | blocked | intent-lifecycle | p1 | I1900 | 0 of 2 |
| I1953Evidence answers by subject, on every surface | blocked | test-evidence | p1 | I1951 | 0 of 2 |
| I1954Every runner reaches the ledger, through the recording branch | blocked | test-evidence | p1 | I1951 | 0 of 4 |
| I1955The evidence publication is an allow-listed projection | blocked | test-evidence | p1 | I1953 | 0 of 2 |
| I1956The Cockpit shows evidence by subject | blocked | test-evidence | p2 | I1953 | 0 of 1 |
| I1957Every test line is read, and a local run stays local | blocked | test-evidence | p2 | I1955 | 0 of 2 |
| I1958Evidence has one route per subject, and every panel is joined to its subject | blocked | test-evidence | p1 | I1955 | 0 of 2 |
| I1959The evidence publication is typed, bound to its build, and kept on gh-pages | blocked | test-evidence | p1 | I1955I1954 | 0 of 2 |
| I1960Every widget names its proof | blocked | test-evidence | p1 | I1958I1959 | 0 of 2 |
| I1961A deploy verifies the evidence routes it publishes | blocked | test-evidence | p1 | I1959I1958 | 0 of 1 |
| I1962The evidence gates read subject findings and widgets | blocked | test-evidence | p1 | I1960I1953 | 0 of 2 |
| I1963Evidence is tested end to end | blocked | test-evidence | p1 | I1960I1956I1959 | 0 of 3 |
| I1964The evidence reference is documented and held to the tree | blocked | test-evidence | p2 | I1962I1963 | 0 of 1 |
| I1982Plan stamps written before seals existed are re-sealed by a command that keeps their original times | blocked | adopter-upgrades | p1 | I1980 | 0 of 2 |
| I1983Upgrading the vendored rules reports or applies the policy and source keys those rules depend on | blocked | adopter-upgrades | p1 | I1980 | 0 of 1 |
| I2000What a piece of work serves is one derivation, with a revision | blocked | intent-bound-work | p1 | milestone:intent-bound-work | 0 of 4 |
| I2001start asks what the task serves and refuses a refused binding where the policy requires it | blocked | intent-bound-work | p1 | I2000milestone:intent-bound-work | 0 of 4 |
| I2002The context of a bound task says what the intent asks of this work | blocked | intent-bound-work | p1 | I2001milestone:intent-bound-work | 0 of 1 |
| I2003A handover pins the binding it was written under, and resolving it reports drift | blocked | intent-bound-work | p1 | I2001milestone:intent-bound-work | 0 of 1 |
| I2004plan start refuses an issue whose binding is refused, in both engines | blocked | intent-bound-work | p1 | I2000milestone:intent-bound-work | 0 of 1 |
| I2288A task is on the mesh while it works | blocked | every-session-joins-the-mesh | p0 | I2734 | 0 of 1 |
| I2289A task built off the mesh is refused | blocked | every-session-joins-the-mesh | p0 | I2288 | 0 of 1 |
| I2402majordomus monitor follows the stream from a terminal and a script | blocked | everything-is-followed-in-one-stream | p1 | I2401 | 0 of 1 |
| I2404The Cockpit shows the stream live | blocked | everything-is-followed-in-one-stream | p1 | I2401 | 0 of 1 |
| I2405Every session is told what happened since its last look | blocked | everything-is-followed-in-one-stream | p1 | I2401 | 0 of 1 |
| I2406The stream is documented where a reader looks | blocked | everything-is-followed-in-one-stream | p2 | I2402I2404 | 0 of 1 |
| I2407The monitor is released and deployed | blocked | everything-is-followed-in-one-stream | p1 | I2402I2404I2405I2406 | 0 of 1 |
| I2654A chart is held to its table by a gate, and the tables that are measured series are drawn | blocked | surfaces-never-disagree | p3 | I2653 | 0 of 2 |
| I2655The homepage decides whether it carries a derived figure, within its declared story and budget | blocked | surfaces-never-disagree | p3 | I2653 | 0 of 1 |
| I2656The diagram viewer serves the Cockpit and majordomus ui, and a node that is a repository file links to its source | blocked | surfaces-never-disagree | p3 | I2653 | 0 of 2 |
| I2671A provider offers its cache as a signed, expiring mesh record, and a stopped provider goes stale | blocked | development-runtime | p1 | I2670 | 0 of 2 |
| I2672The offers and the selection are one read, projected to CLI, MCP, HTTP and OpenAPI | blocked | development-runtime | p1 | I2670 | 0 of 1 |
| I2673The sccache client configuration is derived from the selected offer, local disk first | blocked | development-runtime | p1 | I2670I2672 | 0 of 2 |
| I2674A node is provisioned as an S3 cache provider, idempotently, with no secret in the repository | blocked | development-runtime | p1 | I2670 | 0 of 2 |
| I2675Build-cache health, headroom and hit statistics are visible where the mesh is | blocked | development-runtime | p2 | I2672 | 0 of 2 |
| I2676The build cache is verified and validated: failure paths, security and a real second-node hit | blocked | development-runtime | p1 | I2673I2674 | 0 of 2 |
| I2677The build cache is documented, governed by a rule and described on the site and the Pages | blocked | development-runtime | p2 | I2672 | 0 of 1 |
| I2703The mesh cooperation rule lists the hello checks in the order the code runs them, and a test names that order | blocked | runtime-trust | p1 | I2132 | 0 of 1 |
| I2721An enrolled mesh node follows the stable pointer by itself | blocked | safe-self-update | p0 | I2720 | 0 of 2 |
| I2722A hub activates a new version under its service manager, checks its health and rolls back by itself | blocked | safe-self-update | p0 | I2720 | 0 of 2 |
| I2724A node without a route to the site takes the archive from a peer and still verifies it itself | blocked | safe-self-update | p1 | I2720 | 0 of 1 |
| I2733A resumed mesh.events walk returns every event exactly once, across partitions | blocked | mesh-journal-converges | p2 | I2140 | 0 of 1 |
| I2735An edit no claim covers is refused | blocked | every-session-joins-the-mesh | p0 | I2289 | 0 of 2 |
| I2741Merged work the plan has not recorded is drift, and on the trunk past a window it is red | blocked | truthful-plan-surfaces | p0 | I2740 | 0 of 2 |
| I2743The public roadmap draws every milestone in the graph's order, each issue with its inferred delivery | blocked | truthful-plan-surfaces | p0 | I2740I2742 | 0 of 1 |
| I2744The UI roadmap reads delivery and the releases themselves, and its now is where work is | blocked | truthful-plan-surfaces | p0 | I2740 | 0 of 1 |
| I2748The drift already on the trunk is settled before the gate is made blocking | blocked | truthful-plan-surfaces | p0 | I2741 | 0 of 1 |
| I2787A build never lets the shared build directory's crate artifacts fill the disk | blocked | development-runtime | p0 | I2713 | 0 of 1 |