| I0001Audit what actually plans work in this repository | done | M000 | p0 | nothing | 1 of 1 |
| I0002Define the canonical milestone and issue schema | done | M000 | p0 | nothing | 1 of 1 |
| I0003Implement the model loader and the status derivation engine | done | M000 | p0 | nothing | 1 of 1 |
| I0004Implement DAG validation and execution waves | done | M000 | p0 | nothing | 1 of 1 |
| I0005Implement the plan command surface | done | M000 | p0 | nothing | 1 of 1 |
| I0006Generate the Mermaid DAG from the graph | done | M000 | p1 | nothing | 1 of 1 |
| I0007Enforce the canonical model as doctrine | done | M000 | p1 | nothing | 1 of 1 |
| I0008Project the model to GitHub milestones and issues | done | M000 | p1 | nothing | 2 of 2 |
| I0009Project the model into the website | done | M000 | p1 | nothing | 1 of 1 |
| I0010Behavioural tests for schema, status, graph and command | done | M000 | p0 | nothing | 1 of 1 |
| I0011Cross-surface consistency and mutation tests | done | M000 | p0 | nothing | 2 of 2 |
| I0012Make CI refuse an invalid model or a stale projection | done | M000 | p1 | nothing | 1 of 1 |
| I0013Document the semantics and the dogfooding rule | done | M000 | p1 | nothing | 1 of 1 |
| I0014Make the worker instructions require the model | done | M000 | p0 | nothing | 1 of 1 |
| I0015Open the first real milestone and execute one issue through it | done | M000 | p0 | nothing | 1 of 1 |
| I0101Reproduce the escaped blocker as an executable case | done | M001 | p1 | nothing | 1 of 1 |
| I0102Decide whether a question transfers or the gate widens | done | M001 | p1 | nothing | 1 of 1 |
| I0103Implement the decision and prove it holds | done | M001 | p1 | nothing | 1 of 1 |
| I0104Move the claim from planned to guaranteed | done | M001 | p2 | nothing | 1 of 1 |
| I0701Reproduce the misattribution as an executable case | done | M002 | p1 | nothing | 1 of 1 |
| I0801Narrow the Clean Extraction Boundary and record what was adopted | done | M003 | p1 | nothing | 1 of 1 |
| I0802Specify the session record before writing one | done | M003 | p1 | nothing | 1 of 1 |
| I0803Open a session and report its status | done | M003 | p1 | nothing | 1 of 1 |
| I0804Close a session into an envelope derived from the ledger | done | M003 | p1 | nothing | 2 of 2 |
| I0805Read sessions back with a divergence label | done | M003 | p1 | nothing | 1 of 1 |
| I0806Make the session rules doctrines, with retention and archiving | done | M003 | p1 | nothing | 1 of 1 |
| I0807Discover knowledge sources from git, not from the filesystem | done | M003 | p1 | nothing | 1 of 1 |
| I0808Extract nodes with identities that survive a rebuild | done | M003 | p1 | nothing | 2 of 2 |
| I0809Record only edges that a file states, each with where it was observed | done | M003 | p1 | nothing | 2 of 2 |
| I0811Read-only knowledge lookup with an ordering that can be explained | done | M003 | p1 | nothing | 2 of 2 |
| I0814Give the worker a bounded slice of knowledge, not the knowledge base | done | M003 | p1 | nothing | 1 of 1 |
| I0817Phase timing and work counters behind MJ_TIMING | done | M004 | p0 | nothing | 1 of 1 |
| I0818The command registry is read in one pass | done | M004 | p0 | nothing | 1 of 1 |
| I0819The project model is loaded with one flatten per file and no per-file lookups | done | M004 | p0 | nothing | 1 of 1 |
| I0823majordomus bench: targets derived from the command registry | done | M004 | p0 | nothing | 1 of 1 |
| I0824Bench persists local runs and keeps a latest projection | done | M004 | p0 | nothing | 1 of 1 |
| I0825An explicit committed baseline | done | M004 | p0 | nothing | 1 of 1 |
| I0826bench --check refuses a regression by policy | done | M004 | p0 | nothing | 1 of 1 |
| I0827The benchmark policy block | done | M004 | p0 | nothing | 1 of 1 |
| I0829Performance doctrine as project rules | done | M004 | p0 | nothing | 1 of 1 |
| I0830docs/PERFORMANCE.md, README, CONTRIBUTING and CLI reference | done | M004 | p0 | nothing | 1 of 1 |
| I0833knowledge nodes and edges read each source once | done | M004 | p0 | nothing | 1 of 1 |
| I0836A synthetic repository generator for scaling cases | done | M004 | p0 | nothing | 1 of 1 |
| I0837Timing report as JSON | done | M004 | p0 | nothing | 1 of 1 |
| I0901The deployment description is a kind of the layer, not a provider file | done | fly-deployment | p0 | nothing | 4 of 4 |
| I0902The deployment object becomes typed Rust that refuses nonsense | done | fly-deployment | p0 | nothing | 3 of 3 |
| I0903Deployment reads are declared once and projected everywhere | done | fly-deployment | p0 | nothing | 4 of 4 |
| I0904The listen address is one fact with two projections | done | fly-deployment | p0 | nothing | 3 of 3 |
| I1001One typed graph composes the registries that already own their facts | done | capability-graph | p0 | nothing | 2 of 2 |
| I1002Relations are typed, inferred from stable identities, and never dangle | done | capability-graph | p0 | nothing | 2 of 2 |
| I1003Skills, rules, decisions, documents, use cases and benchmarks enter the graph as themselves | done | capability-graph | p0 | nothing | 2 of 2 |
| I1004Availability and visibility are metadata, not conditions in a template | done | capability-graph | p0 | nothing | 2 of 2 |
| I1005The graph is a generated artifact with a schema and no unsafe field | done | capability-graph | p0 | nothing | 3 of 3 |
| I1006The runtime reads the graph through the registry, like every other read | done | capability-graph | p1 | nothing | 2 of 2 |
| I1015A surface with no server behind it is not offered as if it had one | done | capability-graph | p0 | nothing | 2 of 2 |
| I1025The federated model and its two projections are an architecture decision | done | capability-graph | p1 | nothing | 1 of 1 |
| I1301A workspace is a declared object of the layer; only its content is local | done | external-workspaces | p0 | nothing | 4 of 4 |
| I1401The identity of a projected record is what the record carries, not what its title says | done | work-graph-github | p0 | nothing | 2 of 2 |
| I1402A finding says which of six states it found, and the state that could hide a person's edit is no longer one of them | done | work-graph-github | p1 | nothing | 2 of 2 |
| I1403Backfill the projection once, deliberately, and record what it created | done | work-graph-github | p0 | nothing | 1 of 1 |
| I1404The drift check is a gate, so a projection that stops being applied cannot stay silent | done | work-graph-github | p0 | nothing | 2 of 1 |
| I1405A pull request names the issue it realises, and the edge is derived rather than remembered | done | work-graph-github | p1 | nothing | 1 of 1 |
| I1406The plan's derivations are capabilities, so every surface reads the readiness the terminal reads | done | work-graph-github | p1 | nothing | 2 of 2 |
| I1407One issue travels the whole path and back, as an executable case | done | work-graph-github | p1 | nothing | 1 of 1 |
| I1408The documents stop claiming a projection nobody runs | done | work-graph-github | p2 | nothing | 1 of 1 |
| I1409Derived data stops hashing inputs it cannot control | done | derived-data-integrity | p1 | nothing | 3 of 3 |
| I1501An execution a person starts is an execution the server can see | done | development-runtime | p0 | nothing | 2 of 2 |
| I1502A server serving code that no longer exists stops calling itself ready | done | development-runtime | p0 | nothing | 2 of 2 |
| I1503A closed session is not closed a second time under the same identity | done | development-runtime | p0 | nothing | 2 of 2 |
| I1508The navigation is derived from the dispatcher, not kept beside it | done | development-runtime | p1 | nothing | 2 of 2 |
| I1509A detail page that pages nothing has outgrown the reason it pages nothing | done | development-runtime | p1 | nothing | 2 of 2 |
| I1510A gap the audit calls planned names a plan object that exists | done | development-runtime | p1 | nothing | 2 of 2 |
| I1511The documentation surface answers in a checkout that has not built the site | done | development-runtime | p2 | nothing | 1 of 1 |
| I1516The adapter composes a projected body in one place | done | work-graph-github | p0 | nothing | 2 of 2 |
| I1520A step that runs out of time says so itself | done | development-runtime | p1 | nothing | 2 of 2 |
| I1600The challenge is one recorded run, and every public surface replays it | done | public-proof | p1 | nothing | 3 of 3 |
| I1802Nothing runs Perl | done | automation | p1 | nothing | 1 of 1 |
| I1803New shell is refused without a declared exemption, and the migration inventory is tracked | done | automation | p1 | nothing | 1 of 1 |
| I1945The test-evidence decision and its plan are recorded | done | test-evidence | p1 | nothing | 2 of 2 |
| I1946The verdict words are status words of the design system | done | test-evidence | p1 | nothing | 1 of 1 |
| I1947Every feature reaches a test, and every use case has a feature | done | test-evidence | p1 | nothing | 2 of 2 |
| I1948Evidence is judged at the presented revision, by one freshness function | done | test-evidence | p1 | nothing | 3 of 3 |
| I1949CI evidence is recorded clean, and its report is the tracked ledger's verdict | done | test-evidence | p1 | nothing | 2 of 2 |
| I1950Text a run printed is redacted by one rule set | done | test-evidence | p1 | nothing | 1 of 1 |
| I1952Evidence subjects are derived once, in Rust | done | test-evidence | p1 | nothing | 2 of 2 |
| I1966The composed graph is whole or its generation refuses | done | capability-graph | p1 | nothing | 3 of 3 |
| I1967A reporter that sets a flag is a reporter | done | development-runtime | p2 | nothing | 1 of 1 |
| I1981A command's effect class is declared per subcommand and flag, and live scenarios judge the whole argv | done | adopter-upgrades | p0 | nothing | 4 of 2 |
| I1984Knowledge candidates never leave untracked files on a trunk that only pull requests change | done | adopter-upgrades | p1 | nothing | 2 of 2 |
| I1986The vendored rule package says nothing that is only true of this repository | done | adopter-upgrades | p2 | nothing | 2 of 2 |
| I1987A knowledge record's file provenance survives the file's deletion | done | adopter-upgrades | p2 | nothing | 1 of 1 |
| I1989init seeds a scope for the stack it finds, not for this repository's | done | adopter-upgrades | p3 | nothing | 1 of 1 |
| I1991A comment-only edit of the policy regenerates no bootstrap | done | adopter-upgrades | p3 | nothing | 1 of 1 |
| I1992A rebuild that fails consumes no change: the next request retries it | done | development-runtime | p2 | nothing | 1 of 1 |
| I1995Work a session left uncommitted in a worktree is named, not found by luck | done | development-runtime | p1 | nothing | 2 of 2 |
| I1996doctor does not fail an adopter on a check written for this repository | done | adopter-upgrades | p2 | nothing | 2 of 2 |
| I1998A health command in an unsupervised repository does not exit 0 | done | adopter-upgrades | p2 | nothing | 1 of 1 |
| I2054A tag does not turn every other pull request red until its record lands | done | development-runtime | p1 | nothing | 1 of 1 |
| I2073A worker records an observation in one command | done | a-session-leaves-what-it-observed | p1 | nothing | 1 of 1 |
| I2074An observation becomes a candidate that says what it is about, and reading groups recurrence | done | a-session-leaves-what-it-observed | p1 | nothing | 1 of 1 |
| I2075A candidate is routed by what it is about | done | a-session-leaves-what-it-observed | p1 | nothing | 1 of 1 |
| I2123A caller beyond loopback reads, and changes nothing it cannot authenticate | done | runtime-trust | p0 | nothing | 2 of 2 |
| I2124An event reloaded from disk meets the trust policy in force, and no stamp outruns the clock | done | runtime-trust | p0 | nothing | 1 of 1 |
| I2126A server busy with tool calls is never taken over as if it were dead | done | runtime-lifecycle | p1 | nothing | 1 of 1 |
| I2127A server that lost its lease hands its sessions on and ends | done | runtime-lifecycle | p1 | nothing | 2 of 2 |
| I2128A lease is removed only by the process that holds it, and serve stop stops the server in order | done | runtime-lifecycle | p1 | nothing | 3 of 3 |
| I2129The lease timings the policy declares are the ones the mcp and serve elections use | done | runtime-lifecycle | p2 | nothing | 1 of 1 |
| I2131A server in use through the Cockpit or HTTP is not stopped as idle, and a checkout keeps one address | done | runtime-lifecycle | p1 | nothing | 1 of 1 |
| I2133Every mesh input and answer has a bound, and a refused registration learns nothing | done | runtime-trust | p1 | nothing | 2 of 2 |
| I2134A key removed from the trust list loses its links without a restart, and a node key can be rotated | done | runtime-trust | p0 | nothing | 2 of 2 |
| I2135The trust root is read from the default branch, not from whatever the checkout holds | done | runtime-trust | p0 | nothing | 2 of 2 |
| I2137An accepted mesh event is on disk before it counts, and a damaged journal line is reported, never fused or dropped silently | done | mesh-journal-converges | p0 | nothing | 3 of 3 |
| I2139A sync message stays under the link bound whatever the marks weigh | done | mesh-journal-converges | p1 | nothing | 1 of 1 |
| I2145A tool call that may have run is never sent a second time | done | mcp-transports-are-reliable | p0 | nothing | 2 of 2 |
| I2147The MCP transports bound what they read and follow the Streamable HTTP rules they claim | done | mcp-transports-are-reliable | p2 | nothing | 3 of 3 |
| I2151A page served beside the write routes runs only script it shipped, and a rebinding host reads nothing | done | surfaces-never-disagree | p0 | nothing | 3 of 3 |
| I2156A slow or silent HTTP client cannot hold a server worker | done | failure-is-visible | p1 | nothing | 1 of 1 |
| I2157Ready means ready: a lost lease, a degraded layer or a failing mesh is not reported ready | done | failure-is-visible | p1 | nothing | 2 of 2 |
| I2161No answer, log line or mesh frame carries a credential the redactor knows | done | architecture-is-enforced | p1 | nothing | 1 of 1 |
| I2162A released archive, installed, serves a foreign repository over the shared server in CI | done | architecture-is-enforced | p1 | nothing | 2 of 2 |
| I2163A client never attaches to a server of another version without saying so, and a newer client replaces an older server | done | safe-self-update | p1 | nothing | 2 of 2 |
| I2165A released archive carries a provenance attestation the installer can check | done | safe-self-update | p1 | nothing | 2 of 2 |
| I2296The executor reopens a record pull request no run was started for | done | test-evidence | p1 | nothing | 2 of 2 |
| I2298A pull request stacked on one that landed merges on the verdict its head already has | done | test-evidence | p1 | nothing | 2 of 2 |
| I2300A head is judged against what it changes, not against GitHub's live state | done | work-graph-github | p1 | nothing | 2 of 2 |
| I2301Whether the work is done is answered by measurement: the done invariant asks about debt, what was left behind and the backlog | done | development-runtime | p1 | nothing | 2 of 2 |
| I2303A release publishes its metadata to the site before its record lands, and the site never goes back a release | done | test-evidence | p0 | nothing | 2 of 2 |
| I2396The CI critical path of 2026-10-10 is measured, recorded, and explained before anything is changed | done | test-evidence | p0 | nothing | 1 of 1 |
| I2398A derive offloaded to another machine waits its turn in a declared queue | done | development-runtime | p1 | nothing | 2 of 2 |
| I2399Every session briefs itself on an interval, without being asked | done | development-runtime | p1 | nothing | 2 of 2 |
| I2400A signal model and a fold join every source the server already records | done | everything-is-followed-in-one-stream | p1 | nothing | 1 of 1 |
| I2416The ci verdict asks every selected gate for a receipt, and a gate whose step never ran is red | done | test-evidence | p1 | nothing | 1 of 1 |
| I2460The overview asks its sources at once, so it costs its slowest source and not their sum | done | development-runtime | p1 | nothing | 2 of 2 |
| I2461majordomus ui is served at /ui as its own product, with screens composed from capabilities | done | development-runtime | p1 | nothing | 3 of 3 |
| I2462The UI has every screen, and its mesh is a graph whose nodes open an inspector | done | development-runtime | p1 | nothing | 2 of 2 |
| I2463A train of stacked pull requests is a typed object, served everywhere and drawn as a graph | done | development-runtime | p2 | nothing | 2 of 2 |
| I2464A path that holds a space is one path to the scope doctrine | done | adopter-upgrades | p1 | nothing | 1 of 1 |
| I2470The pull requests drain in the UI: a queue a reader narrows, inspects and follows to what each depends on | done | development-runtime | p1 | nothing | 2 of 2 |
| I2471The roadmap opens a milestone: what it holds, what can start, its critical path, and what it waits for | done | development-runtime | p1 | nothing | 2 of 2 |
| I2472How long CI takes is measured, from when each run started to when it completed, and the CI/CD screen draws it | done | development-runtime | p1 | nothing | 2 of 2 |
| I2473A pull request shows its trail: what the executor did to it, and the drain what the lane did lately | done | development-runtime | p1 | nothing | 2 of 2 |
| I2474The drain draws its merge throughput: each day's merges over the fortnight its trail ends on | done | development-runtime | p1 | nothing | 2 of 2 |
| I2475The issues are browsed: every issue of the plan by status, milestone, priority or text, each a link onward | done | development-runtime | p1 | nothing | 2 of 2 |
| I2476An intent opens what serves it: its statement, its criteria and their evidence, and the milestones and issues that serve it | done | development-runtime | p1 | nothing | 2 of 2 |
| I2477A claim opens its proof: what settles it, its last run, what changed since, how to see it again | done | development-runtime | p1 | nothing | 2 of 2 |
| I2478A rule opens its proof: what it states, the tests that prove it, what is missing, and the rules around it | done | development-runtime | p1 | nothing | 2 of 2 |
| I2481The UI links every entity it names, and says none where a source has no value | done | development-runtime | p1 | nothing | 1 of 1 |
| I2483The UI is published as a snapshot: read once at the published commit and carried by the site at /ui | done | development-runtime | p1 | nothing | 4 of 4 |
| I2486No screen waits for a source: a page shows the latest reading with its age, read again behind the reader | done | development-runtime | p0 | nothing | 4 of 4 |
| I2489A screen over its budget fails the build: the UI's latency budgets are benchmark policy, and bench --check holds them | done | development-runtime | p1 | nothing | 3 of 3 |
| I2491A personal layer changes nothing shared: init --personal and install.sh --personal keep the layer one person's own, verify it, and --shared hands it to the team | done | adopter-upgrades | p1 | nothing | 2 of 2 |
| I2495The Cockpit is published as a snapshot at /cockpit, and the UI's evidence links lead to it | done | development-runtime | p0 | nothing | 3 of 3 |
| I2664A run that has already failed is cancelled by itself, and a red on the trunk is fixed before anything else is prepared | done | M004 | p1 | nothing | 2 of 2 |
| I2678The public Observatory replays events that were recorded, and says it is a replay | done | development-runtime | p2 | nothing | 1 of 1 |
| I2679The Observatory follows a stream with a cursor instead of asking for its page again | done | development-runtime | p2 | nothing | 1 of 1 |
| I2680The Observatory's gates are closed with evidence: screenshots, measured frame rates, a soak, the recovery drills | done | development-runtime | p2 | nothing | 1 of 1 |
| I2707majordomus doctor reports a stale server, or says plainly that it checks governance only | done | failure-is-visible | p1 | nothing | 1 of 1 |
| I2710A release run never waits behind pull-request validates for a job slot | done | M004 | p0 | nothing | 1 of 1 |
| I2711The pages job judges production only after the deployment of its own commit has arrived | done | M004 | p0 | nothing | 1 of 1 |
| I2712release-check treats a tag whose release run is still going as pending, not as a missing record | done | development-runtime | p1 | nothing | 1 of 1 |
| I2715New public Rust code meets rust-quality before the structure job does | done | development-runtime | p1 | nothing | 1 of 1 |