workflow-self-recursive: Conceptual Architecture

August 31, 2026 · View on GitHub

workflow-self-recursive: Conceptual Architecture

1. Metadata and Authority

Field	Value
Document identity	`concept.identity.001`
Publication status	`WORKING_REVIEW_CANDIDATE`; prior bounded review, translation, and fresh-reader closure apply to earlier bytes only. The 2026-08-23 user review approved the Intake/TaskPrompt/Action-finish calibration. The 2026-08-24 corrective addendum and 2026-08-25 #93 closure passed deterministic Iteration 3 qualification; exact publication binding remains a separate requirement before promotion.
Authority after promotion	Sole versionless conceptual authority for workflow-self-recursive
Current structure authority	GitHub issues #45 execution.delivery, #46 execution.observation, and #47 execution.runner; this candidate calibrates the conceptual structure to those decisions
Normative language	English
Translation	`agent-architecture.zh-CN.md` is a non-normative tracking translation. English is the sole semantic authority. Whenever an English section changes, its Chinese counterpart is retranslated from the current English section and replaced as a whole; Chinese maintenance does not preserve or incrementally evolve prior Chinese wording.
Confirmed intent	`EE-BRIEF`, SHA-256 `52773b19a4ca112d0fb8699c14885b30d0b5fdc1c61b6747e426b568175a4ba9`
Confirmed direction	`EE-SKELETON`, SHA-256 `73b3481a099983b57ee9e1dd512c6ed23823f0d045085f9ef585db70be13949a`
Feasibility	SD-06 aggregate, SHA-256 `c70303892e2d68f95e83b12c84940d9f3e41dad6f7a1e269b376da69e4adbf6e`; `FEASIBILITY_CONFIRMED`
Workflow Package import intent and direction	`EE-WORKFLOW-IMPORT-BRIEF` SHA-256 `7c9b1064084cf5f256f27bc5efd021bed0374910e1430586eebeb695344d4c6d`; `EE-WORKFLOW-IMPORT-SKELETON` SHA-256 `86a2a61a324d9bb7ca90108b433ded2f883bc91d9f60dadee87ac7d11feb8e46`
Workflow Package import feasibility	`EE-WORKFLOW-IMPORT-SD06-APPLICATION`; SHA-256 `c6714b9c850536273a00b929559f6d71b8ff2c8aeb1f2aaf8054c14c53ca5795`; `FEASIBILITY_CONFIRMED` within recorded environments and limitations
Targeted simplification authority	`EE-WORKFLOW-IMPORT-MVP-SIMPLIFICATION-RR`; removes mechanisms only, adds no feasibility question, and authorizes bounded affected review
Historical large-workflow review lineage	Problem–Solution, Architecture, and Quality review results from the larger Workflow-import design remain historical evidence for unchanged content only.
Historical large-workflow Finding accounting	`EE-WORKFLOW-IMPORT-SD10-AGGREGATION` is historical and is not the Finding account for this targeted simplification.
Historical design-parameter and handoff closure	`EE-WORKFLOW-IMPORT-SD12-CLOSURE-HANDOFF`; SHA-256 `60f24178d3a2f8991d6af2f974e4ed03d35aedc0064d9d253b3773e732e18ea7`; `SUCCEEDED`
Historical large-workflow Fresh Reader lineage	`EE-WORKFLOW-IMPORT-SD13-FRESH-READER-RESULT` applies to prior bytes and remains historical.
Historical controlled integration authority	`EE-WORKFLOW-IMPORT-SD14-REVISION-REQUEST`; SHA-256 `135ab9647fc6e30318735eff3cef858853cec75f47704e6eaaabd13ecbc59b2e`; deterministic report SHA-256 `1eda28b1c73a8b7d931ab58207d34796173a06bf20cdfae0e17accb2a3a3dc18`; applies to the prior large Workflow-import integration
Bounded affected reviews	Problem–Solution SHA-256 `807863cb6c7887eccdb2720df5ace0afd8e4833f763a029928f44ed1e30e92ae`; Architecture SHA-256 `b220e1114d166cc5a55e34635f847ac2c1af0cf1777bb9c6a6c08dbadf5cdf98`; Quality SHA-256 `b64927087758a987a1f5a4d461035c379970ad84af57133714462ea19ac22f77`; converged on two treatment groups
Unified bounded treatment	`EE-WORKFLOW-IMPORT-MVP-SIMPLIFICATION-SD10-TREATMENT`; SHA-256 `da22b3356aa34c3bcf6e3977a3277ef5b0d9c1e8beef35f4fe0db7dd5e72caf6`
Prior focused bounded recheck	`EE-WORKFLOW-IMPORT-MVP-SIMPLIFICATION-SD10-BOUNDED-RECHECK`; SHA-256 `1b5664afd796910beb8b505bbaadd889fbb7fb098b02c141abb27cdba4e74955`; `CLOSED_FIXED`; open Findings `0`; applies to earlier bytes only
Prior translation and fresh-reader closure	Whole-section translation parity SHA-256 `3c236a404392e1d496e33d4adcdd70000d0db2a2453dcbd7df40813612f77c20`; fresh-reader result SHA-256 `1062561d35422bfacfa7e430f381e5fb25a5a2a911fe8daa5e3499eac5fc2a75`; translation treatment SHA-256 `927a02c6d88eba3571e39c010681b8b47dc956e9a8bafea6812aa9cda91c5d14`; focused recheck SHA-256 `6777175a4e78e363d24ddc3f6bc657b66e9f5a6c2e9fd0042dd210705035c18e`; applies to earlier bytes only. Current bounded calibration was user-approved on 2026-08-23 and remains pending fresh deterministic parity/publication binding
Exact publication binding	The external publication set/application record must bind this byte stream and the companion canonical Execution byte stream by SHA-256, record the applicable fresh-reader and deterministic-verification evidence, and prove exact installation. This document intentionally declares no self-digest or companion digest.

This document owns product purpose, the product-System split, stable concepts, dependency direction, and cross-System invariants. It does not own System Module internals, Observation fact semantics, wire profile, interaction flow, metric reading rules, or physical representation. Those are owned by the Execution System Design, Evidence System Design, Observation Catalog, OTel Observation Profile, Execution–Evidence Interaction Contract, and Metric Catalog within their stated scopes.

2. Product Purpose and Context

workflow-self-recursive exists to run valuable agent Workflows through a small host-neutral execution seam and make what actually happened inspectable. The first release is a trusted, local, first-party, free/open-source preview for an individual or small team. Its immediate target is two logical Workflows—Implementation and System Design—hosted first by DeepSeek Harness (DSH). The deployment does not accept hostile tenants or untrusted operators, and the initial GitHub Workflow repository is public.

The product has two Systems:

Execution resolves and prepares one exact open-standard Workflow Package, creates an immutable Delivery Manifest from that resolved Package, coordinates one current Runner Delivery per canonical worktree, and emits bounded facts without depending on Evidence.
Evidence is an optional, separately deployable loopback-only data service that accepts supported OTLP facts, projects truthful causal and factual state, and exposes the versioned read-only query API used by BI and Evolution consumers.

Runtime is not a third product System or a peer subsystem. In the current architecture, Runner itself is Execution module M02 and owns runtime interaction; it privately composes a replaceable Workflow Host and configured Provider Adapters. LangGraph and DSH are current private implementation selections, not product-System or Runner identities. Only if multiple Runner implementations become necessary should M02 be promoted into a Runner abstraction, with each concrete implementation receiving a distinct name. Runner may retain private pause/resume and custody-reacquisition behavior without making those capabilities public Execution semantics.

flowchart LR
    U["User"] --> H["DSH host/plugin"]
    subgraph X["Execution System — embedded per repository/workspace"]
      Core["Execution Core"] --> D["M01 Delivery<br/>admission / binding / lifecycle"]
      D -->|"admitted activation"| Core
      Core --> R["M02 Runner<br/>execution"]
      Core --> O["M03 Delivery Observation"]
    end
    H --> Core
    S["Configured public GitHub Release or alternate Source Adapter"] -->|"one Package Source Adapter"| Core
    O -. "optional best-effort OTLP" .-> E["Evidence System<br/>loopback data service"]
    E --> P[("PostgreSQL")]
    P --> Q["read-only query API"]
    Q --> B["BI / Evolution consumers"]

Execution and Evidence share no database. Evidence never reads a worktree, Runtime checkpoint, or hidden Workflow state. Execution never reads Evidence to decide progress or outcome.

A host-neutral selector such as name@version, name@latest, or bare name enters Execution directly or through Intake. Delivery (M01) first canonicalizes the worktree and attempts the existing exclusive admission. CONTENDED returns immediately, and RECOVERY follows the stored Manifest; neither path resolves or downloads the new selector. Only M01 NEW resolves a local ResolvedWorkflowPackage. A valid local exact or sticky-latest hit avoids the network; a miss fetches one Package from the installation's single configured Source Adapter. The default Adapter reads the public Workflow Package GitHub repository/release; an installation may instead select one explicit alternate Adapter. A request never selects, overrides, or falls back between Sources. The Package is staged, checked for format, required resources, declared relationships, exact version/digest, and Runner/DSH compatibility, then published as READY. Any failure releases the ordinary Delivery holder and returns before Delivery creation. Success supplies the exact Package value used to construct and persist the Delivery Manifest before DSH effect.

GitHub and an explicitly configured alternate Source are private Adapters, not product Systems or alternate semantic paths. The DSH Intake plugin and Execution Release contain no Workflow Package content. There is no automatic source/version fallback, ambient resource completion, authentication/authorization subsystem, hostile-Package defense, or production download/recovery platform in the preview.

3. Stable Concepts

Concept	Meaning	Semantic owner
Delivery	One attempt to fulfill one task-level instruction; a DSH retry after valid closure is a new Delivery	Concept; lifecycle detail in Execution
Task	Grouping identity across related Deliveries; never a retry/correlation authority	Concept
Logical Workflow	Versioned business/control meaning independent of a Runner implementation	Concept and its Workflow Contract
Workflow implementation	Exact Runner-specific realization of one logical Workflow	Execution binding
Runner	Execution module M02 and its exact configuration/implementation identity	Execution binding; native state remains Runner-owned
Workflow Package	Versioned owner-declared closure of Workflow Definition, Actions, routes/Roles, Prompts, Skills, model/tool/Driver/session bindings, schemas, validators, conformance, identities, and authority under the Agent Ops open Workflow model	Workflow composition authority and Package owner; validated by Execution
Workflow Package Snapshot	Composition-level meaning of one immutable exact Package closure and its required relationships/resources; the preview may represent this directly by the resolved Package value rather than a separate proof or capability identity chain	Workflow composition authority; resolved by Execution
Workflow selector	Generic user input naming a Package and optional version; bare name and `latest` request sticky-local latest, while an exact version requests that version only	Host/Intake supplies; Execution interprets
TaskPrompt	Host-neutral triggering-turn text plus immutable attachment references; no host-native session/message object or prompt command parameter	Host/Intake supplies; M01 snapshots and binds only for `NEW`
Intake session binding	Exclusive zero-or-one presentation relationship between one active Delivery and one host conversation session; different sessions may serve different worktrees concurrently	Intake Adapter owns private binding; Execution owns Delivery truth
Resolved Workflow Package	Simple immutable value containing `name`, `exactVersion`, `packageDigest`, `localPath`, and `workflowId` after local resolution, ordinary validation, and Runner compatibility checks	Delivery (M01)
Execution installation configuration	One closed, versioned, canonical, deeply immutable non-secret value used by every embedding and Intake Adapter	Execution-level support; loaded once by Bootstrap
Delivery configuration projection	Config-only, non-secret snapshot of the Runner/Host, Provider/model/base URL, workspace/resource and required control inputs that may bind a Delivery; it contains no Package	Execution-level support; projected before M01 binding
Delivery Manifest	Immutable binding of Delivery/task, exact resolved Workflow Package, canonical worktree, TaskPrompt identity/attachment snapshot digests and Delivery configuration projection; it excludes Intake binding, installation identity, Observation configuration, bodies and secrets	Execution
Runner result	Runner-owned bounded terminal truth; distinct from Delivery lifecycle disposition and telemetry status	Runner (M02), validated/finalized by Delivery (M01)
Observation	Versioned, allow-listed, content-minimized fact represented through standard-first OTel/OTLP	Producer side in Execution; admission side in Evidence
Accepted observation	Immutable first accepted identity and provenance after atomic initial projection	Evidence
Factual projection	Causal Trace relations and compatible, completeness-bearing contributions/aggregates	Evidence
Span identity	Exact `(trace_id, span_id)` tuple; neither component alone identifies a Span globally	Evidence Admission/Projection; transported by OTel
Objective review graph	Distinct Review, Finding, Artifact, Fix, Recheck, Invocation, iteration and Role identities joined only by typed endpoints	Workflow owners; mapped by Execution and admitted/projected by Evidence
Finding assertion	One bounded, non-empty, privacy-safe human-readable factual summary plus a Finding-specific scope identity	Source review lens; mapped verbatim by Execution and admitted/projected without inference by Evidence
Finding affected target	Exactly one typed `ARTIFACT`, `SECTION`, `COMPONENT`, or `REQUIREMENT` target per Finding observation; multi-target Findings repeat the complete assertion once per target edge	Source review lens; target identity owned by its source authority
Version-local Role identity	Role identity within one Workflow/family version; display name is not identity	Workflow Contract; transported by Execution
Role lineage identity	Owner-defined family-scoped identity relating Role versions across Workflow versions; distinct from local Role identity	Workflow Contract; admitted/projected by Evidence

The MVP keeps three direct Evaluation/BI inputs as owner facts, not Observation-derived interpretations: Delivery elapsed time is the complete start-to-terminal measurement supplied by the Runner/Execution result owner; reached stage is the exact furthest terminal stage supplied by the Workflow owner; canonical model identity is the provider-scoped model identity supplied by Provider ownership and is meaningful for model-call attribution only. Observation may encode and transport these facts as C55, C56, and C57, but does not order stages, calculate elapsed time, canonicalize an alias, or otherwise take over their meaning.

Identity axes remain distinct. A Delivery ID is not a Trace ID; a logical Workflow ID is not an implementation ID; a task ID is not a retry token; an opaque Runtime correlation is not public Workflow state. A selector or configured source is not Package identity; sticky latest is not an exact binding; a GitHub Release, asset, tag, or commit is not Core canonical identity; a resolved Package is not Delivery identity; and DSH Session identity is not public Workflow state.

4. Cross-System Invariants

Admit, then prepare before Delivery creation. Execution first canonicalizes the worktree and attempts existing exclusive Delivery admission. Only NEW resolves one exact, locally READY Workflow Package and performs ordinary Package and selected-Runtime validation before Delivery Manifest persistence, Runtime, Session, or worktree effect. A preparation failure releases the holder and is a typed pre-Delivery result, not a Delivery outcome.
One Runner current Delivery per canonical worktree, with immediate rejection. CONTENDED returns without waiting, queueing, preemption, Package Store/source access, or creating a Delivery. RECOVERY follows only the stored Manifest and ignores the new selector.
No mutable Execution history. Execution stores only the current Runner slot. Valid clear removes mutable working state, while the immutable Runner settlement, preserved result/publication disposition, and owner retirement facts survive under their owning boundaries; accepted Evidence remains optional and downstream.
Runtime truth stays authoritative. Execution validates identity and shape but does not reinterpret Workflow outcome. Evidence records; it does not adjudicate.
Observation is optional and non-controlling. Disablement, refusal, sampling, or tail loss cannot change execution.
Missing is never zero. Final, lower-bound, unavailable, and not-applicable states remain distinct through admission, projection, and query.
Accepted facts are immutable. Event ID and Span (trace_id, span_id) identities deduplicate; conflicting content does not overwrite; required initial projection and acceptance are atomic.
Only compatible facts aggregate. Kind, unit, source, source identity, currency, semantic version, and eligibility must agree.
Content is minimized. Prompt, message, tool argument/result, source, credential, and error bodies do not cross the Observation seam.
Human inspection is factual. The preview does not grade, rank, recommend, infer causality, or automatically modify Workflow behavior.
Systems remain independently usable. Execution works without Evidence; Evidence accepts any conforming producer and does not become Execution storage.
Native lifecycle stays private. Runner Host checkpoints, DSH Provider sessions and pause/resume details remain inside Runner.
Local-first exact resolution. A valid local exact or sticky-latest hit makes no remote call. A miss may use only the configured source; no source/version fallback or ambient completion is allowed.
No binding drift. latest or bare-name selection is resolved to exactVersion before the Manifest is created. Later alias or Release changes affect only later Deliveries.
Simple Store visibility. STAGING content is never a cache hit. Initial-fill failure returns to MISSING; refresh staging is private side state that leaves the prior READY Package and sticky alias visible until a validated replacement is ready. The preview performs no automatic eviction.
Trusted-preview restraint. Authentication, authorization, signing, sandboxing, hostile-input defense, multi-user coordination, concurrent Package correctness, distributed locking, HA, failover, and production-grade Package recovery are outside the current design. They reopen design only when deployment trust, exposure, scale, or DSH capability changes.
Intake binding is session-scoped. One host conversation binds at most one Delivery, one active Delivery binds at most one session, and different sessions may serve different worktrees concurrently. Zero bound sessions is the valid DETACHED recovery condition. Restart restores an exact valid binding or leaves the Delivery detached; it never guesses a winner.
Action interaction completion stays Action-owned. An ordinary answer does not end a multi-turn Action. A target-free finish request is resolved through the current session binding, resumes the same Action, and advances only through a validated structured completion.

5. Authority and Dependency Direction

Concept
  ├── Execution: selector resolution, Package validation, Delivery binding,
  │              current-slot lifecycle, Runner, Observation producer
  ├── Evidence: admission, factual projection, read-only query API
  └── Contract: physical cross-System representation only

Host/Intake → Execution Core
Execution Core → Delivery (M01) → private Source/Store Adapters
Delivery (M01) → admitted activation → Runner (M02)
Execution Core → Delivery Observation → OTel/OTLP → Evidence Admission
Evidence Admission → Factual Projection → read-only Query API → BI/Evolution consumers

The Workflow Package owner owns Package content and relationships. Installation configuration selects exactly one Package Source, defaulting to the public Workflow Package GitHub repository/release or explicitly selecting one alternate Adapter. Delivery (M01) alone interprets selectors, resolves and validates Packages, owns Source/Store, performs worktree admission, persists current-slot/Manifest state, and projects the admitted activation. Runner (M02) owns execution of that activation. The Runner Workflow Host owns private Workflow/thread/checkpoint state; the configured DSH Provider Adapter owns only its native Provider session. The Runner Lifecycle Coordinator owns immutable terminal settlement. Delivery Observation alone maps outbound facts; Evidence Admission alone decides acceptance. Configuration, factories, and Bootstrap support the whole Execution System rather than belonging to M01, M02, M03, or an Intake Adapter. Bootstrap is the sole production assembly owner.

Dependencies point toward owner-defined meaning. Source Adapters transport Package bytes but do not define Package identity or construct Manifests. The Store never chooses another source/version. DSH cannot repair an incomplete Package from ambient defaults. Evidence cannot command Execution. No Contract or downstream implementation may add a second semantic writer.

6. Scope and Non-goals

The preview includes generic Workflow selection, exact/sticky-latest local-first resolution through exactly one configured Source, a default public GitHub download path or one explicitly configured alternate Adapter, ordinary Package format/required-file/relationship/version/digest validation, DSH compatibility validation, MISSING/STAGING/READY local storage, exact Manifest creation before DSH effect, immediate exclusive Delivery admission, current-slot recovery, truthful terminal results, optional factual Observation, one canonical installation configuration, one production Bootstrap, a host-neutral Core package, and a replaceable Intake contract. The DSH Intake plugin is the first Intake distribution, not the only Execution distribution.

The preview assumes trusted local deployment for an individual or small team, public first-party Workflow hosting, and no concurrent Package-management correctness requirement. Its concurrency defense is limited to existing one-current-Delivery exclusivity: inability to acquire it returns CONTENDED immediately.

Non-goals are authentication, authorization, RBAC, credentials for the public Package path, signing, supply-chain assurance, malicious-Package or prompt-injection defense, sandboxing, multi-user coordination, concurrent cache writers, fairness, waiting/queueing, distributed locking, Package transaction or proof protocols, automated eviction, mirrors, retry orchestration, HA, automatic failover/upgrade, registry federation, marketplace, ranking, recommendation, grading, causal inference, remote multi-user deployment, Evidence control feedback, physical Evidence schema, public DSH resume, and runner redesign.

Format, required-resource, relationship, version, and digest checks defend against ordinary faults and configuration mistakes; they are not a security subsystem. Any future move to an untrusted source, shared remote service, credential-bearing private repository, hostile tenant, concurrent Package writer, or stronger DSH security capability requires a new Concept/System Design decision before adding those mechanisms.

7. Evolution, Publication, and Legacy Isolation

After atomic promotion, the active semantic authority is the versionless English Concept, the two in-place English System Designs, the frozen and published English Observation and Execution–Evidence Contracts within their declared scopes, and the human metric reading specification. Current Observation machine-package claims are validator-only; production and cross-implementation conformance remain unproven. Chinese files are complete, faithful, non-normative tracking translations published as companions where they exist; they never become independent semantic authorities. Each changed English section replaces its corresponding Chinese section as a whole. Versioned legacy Concept files and obsolete target-design documents are removed; Git history owns provenance.

Legacy material is an explicitly imperfect dependency graph, not a self-consistent bundle. Exact A machine artifacts remain byte-preserved; sixteen B-legacy prose/entrypoint successors identify the material as legacy and keep A-to-B test reads executable. The frozen six-suite Python baseline is 67 tests with two known EFCR digest-mismatch failures: expected bb216407325e10cebd2e3a1de7b69b77d0fe9246a5b28a48d3825d0229818226, actual 5feb18f414b8f87a2cf72ccd239e43f80a4c45201e9b2da5b84633699221525c; the Node Execution baseline is 158/0. These results are quarantined legacy evidence, never a Contract or conformance proof. The publication Gate permits only those two named baseline failures and rejects any additional or different failure. A downstream authorized physical cutover must replace/remove or repair the complete graph and establish a new baseline.

The Observation and Execution–Evidence Contracts are frozen and published. Their current machine package supports validator-only claims; production emitter/acceptor integration and cross-implementation conformance remain downstream evidence work.

Evidence is planned to move to its own public repository and return as a submodule. The exact repository, commit, release process, and MIT-versus-Apache-2.0 choice remain downstream product/repository decisions; they do not change the two-System boundary.

8. Quality and Acceptance

Quality	Required outcome	Design mechanism	Evidence state
Reliability	Evidence outage cannot affect Delivery outcome	one-way best-effort seam, no receipt/outbox	feasibility confirmed; production fixtures downstream
Recovery	unknown Runner start remains blocking; no blind retry	existing durable launch disposition and exact recovery	concept.fixture.001 rebinding
Consistency	no accepted/projection half-state or double contribution	one PostgreSQL transaction and stable identity	concept.fixture.003 rebinding
Privacy	prohibited bodies never cross the Observation seam	producer allow-list/redaction plus admission validation	concept.fixture.002 rebinding; production proof downstream
Portability	Host and Provider implementations vary behind one Core-owned Runner seam	Adapter-private lifecycle, opaque projections	design fixed; implementation qualification downstream
Authority singularity	one active graph, no co-active legacy authority	versionless root, in-place Systems, quarantine	deterministic publication proof required
Translation fidelity	Chinese conveys the complete English meaning	stable anchors and whole-section retranslation from English	review and deterministic proof required
Honest lifecycle	candidate/legacy artifacts cannot masquerade as conformance	lifecycle status, fixed/open matrix, conformance gate	Contracts published; production integration proof downstream
Workflow Package exactness	a Delivery uses one validated exact Package and does not drift	`ResolvedWorkflowPackage` copied into immutable Manifest	implementation plan
Workflow import responsiveness	contention/recovery avoid Package work; valid `NEW` local exact/latest hit makes zero remote call	M01-first admission, then local-first Store; no wait/queue	implementation plan
Workflow import fault containment	invalid selector, download, validation, cache, compatibility, or Manifest failure creates no Delivery	typed early return at the owning phase	implementation plan
Package evolvability	contributed Packages from either configured Source variant use the common Package Source seam without Core name changes	open Package model and private Source Adapters	paired fixture feasibility confirmed
Resource efficiency	preview uses one asset and retains `READY` Packages without automated eviction	`MISSING/STAGING/READY` Store	implementation plan
Trusted-preview security	no production security mechanism is required inside the confirmed trusted/public-source context	format and identity checks only; explicit reopen triggers	accepted product boundary

Owner-complete acceptance register

The Concept owns this cross-document trace metadata; linked System anchors remain the sole semantic owners. evidence_state is restricted to DESIGN_EVIDENCE_AVAILABLE | IMPLEMENTATION_PLAN | SPIKE_REQUIRED | RUNTIME_HANDOFF; planned work is never presented as passed evidence and none of these states proves physical conformance.

acceptance_id	problem_or_goal_ids	scenario_ids	design_driver_ids	decision_or_mechanism_ids	expected_outcome	threshold	verification_method	evidence_state	evidence_reference	owner	return_location	reopen_condition
`concept.acceptance.001`	`problem`	`runner.scenario.01`	`constraints`	`execution.milestone.01`, `execution.milestone.02`, `concept.decision.004`	exact valid binding runs once; after `NEW` admission, Package preparation may affect only Source/Store before Manifest persistence; invalid binding has no Runtime/worktree/Delivery effect	zero Runtime, Session, worktree, Manifest, Delivery-outcome, or Observation effect before successful Manifest persistence; no fallback	positive/negative binding fixture with Source/Store and Runtime/worktree spies	`DESIGN_EVIDENCE_AVAILABLE`	concept.fixture.001 rebinding plus Workflow-import ordering plan	Execution Core validation owner	`docs/systems/execution/project-execution-system.md#ee-execution-7`	fallback, late binding, Package work on `CONTENDED`/`RECOVERY`, or Runtime/worktree/Delivery effect before Manifest persistence
`concept.acceptance.002`	`problem`	`execution.scenario.13`	`constraints`	`execution.module.001`	a second host receives `CONTENDED`	zero Delivery/Manifest/start/slot/worktree effect	two-process fixture	`DESIGN_EVIDENCE_AVAILABLE`	concept.fixture.001 rebinding	Delivery (M01) validation owner	`docs/systems/execution/project-execution-system.md#ee-execution-7`	multiple writers or admission bypass
`concept.acceptance.003`	`problem`	`execution.scenario.14`, `runner.scenario.09`	`risks`, `constraints`	`execution.milestone.02`, `START_UNCERTAIN`, `RESULT_UNRESOLVED`, `reconcileOrClose`	unresolved state remains occupied until conclusive inspection reconciles it or exact administrative authorization abandons/clears it; abandonment creates no Runner outcome/history and only a new Delivery may retry	no timeout/steal, fabricated outcome/history, same-Delivery retry, or clear-before-inspection	crash/lost-handle/malformed-result/stale-current authorization fixtures	`IMPLEMENTATION_PLAN`	`concept.obligation.002`	Delivery (M01) implementation owner	`docs/systems/execution/project-execution-system.md#ee-execution-14`	any unresolved state clears without conclusive inspection and current authorization
`concept.acceptance.004`	`problem`	`runner.scenario.01`, `runner.scenario.04`	`acceptance`, `constraints`	`observation.contract.003`, `execution.milestone.01`, `execution.milestone.02`	outcomes are exactly `COMPLETED`, `INCOMPLETE`, `FAILED`, `CANCELLED`; conclusive non-start is distinct `START_FAILED`	five mutually distinct categories; no fabricated Runner outcome	five-category and mismatch fixtures	`RUNTIME_HANDOFF`	`concept.obligation.001`, `concept.obligation.002`	current interaction/profile publication owner	`docs/contracts/observation/otel-observation-profile.md#otel-profile-3`	launch disposition, Runner outcome, or OTel status collapses
`concept.acceptance.005`	`problem`		`acceptance`, `quality`	`observation.contract.002`, `observation.contract.012`, `execution.milestone.03`, `evidence.milestone.01`, `evidence.milestone.02`	both closed Workflow-family profiles represent tests/coverage/review/Fresh Reader/verification/activity and objective review/artifact/invocation/recheck relations; Review summary, Finding, Fix, and Recheck use complete base-plus-variant shapes; every Finding includes one bounded privacy-safe factual summary, one Finding-specific scope and one typed artifact/section/component/requirement target; distinct local Role/lineage identity is preserved and scores/inferences are omitted	every confirmed family fact/edge maps once; every Review-family observation satisfies exactly one complete named shape; every Finding target edge has the complete assertion and typed endpoints; zero body/map escape hatch, prohibited inference, partial projection, or name/order-derived relation	both-family semantic and complete-shape matrices, ordinary Finding/Fix/Recheck/Recheck-summary/multi-target examples, endpoint-requiredness, bounded-content/privacy, lineage, idempotency/conflict, and prohibited-field fixtures	`IMPLEMENTATION_PLAN`	`concept.obligation.001`, `concept.obligation.003`, `concept.obligation.004`	Delivery Observation implementation owner	`docs/systems/execution/project-execution-system.md#ee-execution-14`	a family fact/edge or complete Review variant is unrepresentable, Finding content/target is lost or inferred, lineage conflates, or any RED-to-GREEN/scenario/design/reviewer-effectiveness inference appears
`concept.acceptance.006`	`problem`	`evidence.scenario.01`	`constraints`, `quality`	`execution.milestone.03`, `evidence.path.03`	disabled/refused/timed-out/tail-loss Evidence leaves outcome and slot path unchanged	zero receipt/outbox/control dependency	loss/refusal fixtures	`DESIGN_EVIDENCE_AVAILABLE`	concept.fixture.002 rebinding	Delivery Observation validation owner	`docs/systems/execution/project-execution-system.md#ee-execution-10`	any receipt, durable retry/outbox, or control dependency appears
`concept.acceptance.007`	`problem`	`evidence.scenario.01`, `evidence.scenario.02`	`quality`, `risks`	`observation.contract.006`, `execution.milestone.03`, `evidence.milestone.01`	prohibited bodies never enter exported or accepted facts	zero prompt/message/tool/source/credential/error bodies	marker scans and negative fixtures	`DESIGN_EVIDENCE_AVAILABLE`	concept.fixture.002/003 rebinding; production proof remains `concept.obligation.003/004`	Evidence privacy validation owner	`docs/systems/evidence/evidence-system.md#ee-evidence-10`	arbitrary envelope/body or unsafe diagnostic is admitted
`concept.acceptance.008`	`problem`	`evidence.scenario.02`, `evidence.scenario.04`	`quality`, `constraints`	`observation.contract.009`, `observation.contract.010`, `evidence.milestone.02`	final zero, lower bound, unavailable, and not-applicable remain distinct; incompatible groups never sum	no missing-as-zero or implicit conversion	truth/grouping fixtures	`DESIGN_EVIDENCE_AVAILABLE`	concept.fixture.003 rebinding	Factual Projection validation owner	`docs/systems/evidence/evidence-system.md#ee-evidence-8`	inference, implicit conversion, or state collapse
`concept.acceptance.009`	`problem`	`evidence.scenario.03`	`constraints`, `quality`	`observation.contract.008`, `evidence.milestone.01`, `evidence.milestone.02`	Event identity is `agentops.event.id`; Span identity is exactly `(trace_id, span_id)`; same-identity/same-digest repeat is a no-op, conflict rejects without overwrite, and accepted identity plus initial projection are atomic	zero duplicate contribution, overwrite, cross-Trace Span-ID collision, or half-state	Event and Span new/identical/conflicting duplicate plus ambiguity fixtures	`DESIGN_EVIDENCE_AVAILABLE`	concept.fixture.003 rebinding plus affected deterministic Span-identity check; implementation proof downstream	Evidence Admission validation owner	`docs/systems/evidence/evidence-system.md#ee-evidence-7`	`span_id` or Trace ID alone becomes Span key, duplicate contributes twice, conflict overwrites, or accepted/projection half-state appears
`concept.acceptance.010`	`problem`	`evidence.scenario.05`	`quality`	`evidence.milestone.02`, `evidence.milestone.03`	Evidence query API returns recorded facts, provenance, completeness, compatibility and recorded edges only; BI views preserve those meanings	zero score, rank, recommendation, hidden formula, completeness rewrite, or causal inference	query API golden fixtures plus BI consumer contract fixtures	`IMPLEMENTATION_PLAN`	`concept.obligation.004` plus #53/#54	Evidence query API implementation owner; BI view owners for consumer presentation	`docs/systems/evidence/evidence-system.md#ee-evidence-14`	API or presentation introduces a formula, rewrite, or inference
`concept.acceptance.011`	`problem`	`evidence.scenario.02`, `evidence.scenario.05`	`constraints`, `quality`	`observation.contract.011`, `evidence.milestone.01`, `evidence.milestone.02`, `evidence.milestone.03`	Raw, accepted identity/provenance, Trace, and factual projection expire independently; expired Trace becomes explicit unavailable detail	four independently testable lifecycle classes	retention/expiry fixtures	`RUNTIME_HANDOFF`	`concept.obligation.006`	Evidence lifecycle validation owner	`docs/systems/evidence/evidence-system.md#ee-evidence-14`	coupled deletion, reconstruction, or history rewrite
`concept.acceptance.012`	`problem`	`runner.scenario.10`	`constraints`, `quality`	`execution.milestone.02`	no native DSH/runner type crosses the Core Interface; runner privately retains resume and DSH remains no-resume	zero public resume/native-type leak	type scan and contrasting lifecycle fixture	`IMPLEMENTATION_PLAN`	`concept.obligation.002`	Execution Core implementation owner	`docs/systems/execution/project-execution-system.md#ee-execution-14`	public resume or native type crosses the Core Interface
`concept.acceptance.013`	`problem`	`evidence.scenario.05`	`context`, `quality`	`evidence.milestone.01`, `evidence.milestone.03`	loopback ingest/query need no app-level auth; Evidence exposes no UI, database, raw, or write route; user-facing listener and anonymous Viewer policy belong to `bi.serving`	Evidence data service is loopback-only and API read-only	listener/method/route/negative reachability fixtures; #55 serving fixtures	`IMPLEMENTATION_PLAN`	`concept.obligation.004` plus #55	Evidence data-service implementation owner; `bi.serving` owner for user-facing access	`docs/systems/evidence/evidence-system.md#ee-evidence-14`	remote/multi-user Evidence exposure, database/raw/write access, or UI hosting appears
`concept.acceptance.014`	`problem`	`scenarios`	`acceptance`	`concept.decision.014`, `concept.decision.017`, `concept.decision.018`	34 exact writes and 2 deletions publish atomically; A bytes stay unchanged; Python remains exactly 67/2 named baseline failures and Node 158/0; legacy is not co-active authority	zero post-review byte drift, new/different failure, active legacy edge, or retained legacy Concept path	SD-08 overlay/link/parity/baseline verification	`DESIGN_EVIDENCE_AVAILABLE`	external publication set/application record and affected SD-08 result	publication verification owner	`docs/agent-architecture.md#ee-concept-7`	any threshold condition is violated before publication
`concept.acceptance.015`	`scope`	`scenarios`		`concept.obligation.007`	public Evidence has one repository authority and the parent pins one reviewed submodule commit	one repository authority and one pinned commit; no cross-repository transaction	repository identity/release/commit/submodule-link proof	`RUNTIME_HANDOFF`	`concept.obligation.007`	Evidence repository release owner	`docs/systems/evidence/evidence-system.md#ee-evidence-14`	duplicate authority, unpinned code, or a cross-repository transaction becomes necessary
`concept.acceptance.016`	`open`	`scenarios`		`concept.obligation.008`	the public Evidence release uses one approved MIT or Apache-2.0 license with matching notices	one approved license and matching LICENSE/NOTICE bytes	recorded decision plus exact LICENSE/NOTICE review	`RUNTIME_HANDOFF`	`concept.obligation.008`	Product license decision owner	`docs/agent-architecture.md#ee-concept-7`	neither allowed license is compatible or multiple conflicting licenses are required
`concept.acceptance.017`	`problem`	`evidence.scenario.01`, `evidence.scenario.02`–`evidence.scenario.05`	`constraints`, `quality`, `acceptance`	`observation.contract.002`, `observation.contract.006`–`012`, `concept.decision.005`, `concept.decision.019`	independent Execution and Evidence implementers derive exact pins/carriers, ten EventNames, 57 common + 10 Implementation + 6 System Design fields, complete Review-family base-plus-variant requiredness, bounded Finding assertion and typed affected-target relations, local/lineage pairing, native usage and Span identity without re-deciding them	exact 10 EventNames and 57/10/6/73 unique counts; every registry row has nine columns; every Review-family record matches one complete named shape and every multi-target Finding yields one complete assertion per typed target edge; zero sibling-family/fixture/prohibited fields, disposition Event, partial projection, or inferred target; exact endpoint/usage/Span/target-edge duplicate rules	deterministic registry/table/parity/link/semantic-coverage and complete-shape scan plus ordinary Finding/Fix/Recheck/Recheck-summary/multi-target positive and malformed/privacy/duplicate negative fixtures, concept.fixture.002 binding, and preserved Span/usage examples	`DESIGN_EVIDENCE_AVAILABLE`	concept.fixture.002 PASS and rebinding, with rebuilt green lineage assertions under corrected threshold, `RR-OTEL-CONTRACT-003`, affected/full SD-08 result	Observation-profile Design validation owner	`docs/contracts/observation/otel-observation-profile.md#otel-profile-11`	implementation needs another carrier/EventName/field meaning, cannot preserve a complete variant/typed edge/identity, or changes usage/missingness/privacy
`concept.acceptance.item.001`	`problem`	`execution.scenario.00`, `execution.scenario.11`	host neutrality	generic Core operation; private source and Runner boundaries	one selector/task call contains no host/DSH/source-native type	zero native-field leak	schema/type scan and contrasting Adapter fixture	`IMPLEMENTATION_PLAN`	`concept.obligation.010`, `011`	Execution implementation owner	Execution Design acceptance	native type or host choreography crosses Core
`concept.acceptance.item.002`	`problem`	`execution.scenario.01`, `execution.scenario.03`, `execution.scenario.09`	exactness/local-first	resolved exact Package and sticky alias	local hit makes no remote call; later alias movement cannot alter a Delivery	zero source calls and binding drift	source spy and alias-movement fixture	`IMPLEMENTATION_PLAN`	`concept.obligation.011`, `013`	Delivery Binding implementation owner	Execution Design acceptance	remote access on valid hit, re-resolution, or drift
`concept.acceptance.item.003`	`problem`	`execution.scenario.02`, `execution.scenario.04`, `execution.scenario.12`	one source/no fallback	one public GitHub fetch, private `STAGING`, publish `READY`	failure preserves prior `READY` truth and creates no Delivery	zero fallback; `STAGING` never resolves	Adapter and failed-fetch/publish fixtures	`IMPLEMENTATION_PLAN`	`concept.obligation.012`, `013`	Source/Store owners	Execution Design acceptance	fallback, partial hit, or prior-ready loss
`concept.acceptance.item.004`	`problem`	`execution.scenario.05`, `execution.scenario.08`	common open path	installation-selected GitHub/alternate private Adapters at one seam	protected and contributed conforming Packages use one validation path from the one configured Source	zero request override, allow-list, bypass, hidden fallback, embedded initial Package, or native leak	paired configured-Adapter/contribution fixture	`DESIGN_EVIDENCE_AVAILABLE`	execution.fixture.004; `concept.obligation.012`	Package/release owners	Execution Design acceptance	second semantic path, rewrite, allow-list, embedded content, or fallback
`concept.acceptance.item.005`	`problem`	`execution.scenario.06`, `execution.scenario.07`	pre-Delivery early return	M01-first admission, ordinary M01 validation, and simple Manifest construction	only `NEW` performs selector/Package/version/digest/compatibility/cache validation; failure releases the ordinary holder and creates no Manifest, Delivery, Runner/Provider effect, or Observation	zero M01/Source/Store call on `CONTENDED`/`RECOVERY`; zero Delivery outcome before Manifest creation	admission/M01/Source/Store spies plus typed M01/Core negative fixtures	`IMPLEMENTATION_PLAN`	`concept.obligation.010`, `011`	Execution Core owner	Execution Design acceptance	validation precedes `NEW`, holder is not released, or pre-Delivery failure becomes a Delivery outcome/Observation or transaction/proof lifecycle
`concept.acceptance.item.006`	`problem`	all `execution.scenario.*`	simple exclusive admission	Delivery (M01) admission before request Package work	occupied worktree returns `CONTENDED` and recovery follows the stored binding, both with zero new-selector Package work	zero wait, preemption, Source/Store/M01 call, or new-Delivery effect on `CONTENDED`/`RECOVERY`	admission spies and stored-Manifest recovery fixtures	`IMPLEMENTATION_PLAN`	`concept.obligation.011`	Delivery (M01) owner	Execution Design acceptance	preparation precedes admission, multiple current Deliveries, waiting, or recovery uses new selector
`concept.acceptance.item.007`	`problem`	`execution.scenario.09`, `execution.scenario.10`	exact DSH/no ambient	Manifest-bound Package and Adapter-first validation	DSH uses only bound local Package; missing/unsupported resources reject before native effect	zero ambient completion or pre-validation effect	production projection/no-default negatives	`IMPLEMENTATION_PLAN`	execution.fixture.001; `concept.obligation.014`	DSH Adapter owner	Execution Design acceptance	rewrite, ambient substitution, post-effect reject, or native leak
`concept.acceptance.item.008`	`problem`	`execution.scenario.07`, `execution.scenario.12`	Observation non-control	Package preparation remains pre-Delivery	preparation/Manifest rejection is never a Delivery outcome or Observation	zero pre-Delivery telemetry	telemetry-exclusion/exporter fixtures	`IMPLEMENTATION_PLAN`	`concept.obligation.011`	Delivery Observation owner	Execution Design acceptance	Observation controls or reclassifies pre-Delivery result

Lifecycle-specific acceptance refinements below are normative parts of the named existing acceptance identities, not new acceptance IDs:

acceptance_id	Required deterministic refinement	Verification refinement	Reopen refinement
`concept.acceptance.005`	C17 field presence is the record-observable selector on ordinary/Recheck summary: `0` is recorded zero, a positive value is recorded count, and omission is no count fact; Event, assertion `(C18,C51)`, target edge, status `(C18,C51,C12)`, target-specific Fix and Recheck remain separate domains with unchanged atomic reuse/append semantics	OTel Profile §7.6 bilingual ordinary/Recheck zero, positive, absence and exact-retry positives; invalid type/range, Finding carrier and partial-state negatives; no impossible “reported but missing” Admission fixture	any zero/absence collapse, consumer inference of producer intent, invalid C17 partial landing, C27/lifecycle identity regression, or assertion/status mutation
`concept.acceptance.017`	independent implementers derive C17 counted/no-count form from field presence alone, plus the unchanged identities, invariant/allowed-change matrix, compatible-reuse effects and distinct Evidence landings	deterministic EN/ZH C17 registry/shape/example/Admission/query parity plus unchanged lifecycle and C09/assertion/target/endpoint conflict scans	any C17 presence outcome or identity/conflict/no-op effect remains implementation-defined

Downstream obligation register

obligation_id	owner	affected_design_identities	semantic_dependency	required_evidence	current_evidence_state	suggested_consumer	return_location	design_reopen_condition
`concept.obligation.001`	current Observation/interaction publication owner	`observation.contract.001..012`, `concept.acceptance.004`, `concept.acceptance.005`, `concept.acceptance.009`, `concept.acceptance.017`	physically encode the adopted exact pins/carriers, ten EventNames, 57+10+6 registries, complete Review-family base-plus-variant shapes, bounded Finding assertion and typed target relations, lineage pair, native usage, Span identity, interaction, and truth/privacy rules without creating a second semantic owner	machine schema/package, physical limits/budgets including the Finding-summary bound, encoded registries, complete-shape/relationship/multi-target/privacy/usage/Span fixture groups, validators, version policy and publication record	Contract `1.0.0` is frozen and published with validator-only evidence; production and cross-implementation conformance are unproven	Contract implementation workflow	`docs/contracts/observation/otel-observation-profile.md#otel-profile-11`	physical representation cannot preserve the adopted complete shapes, bounded Finding fact, target/owner/identity meaning, interaction semantics, or any claimant lacks applicable proof
`concept.obligation.002`	Execution Core implementation owner	`execution.milestone.01`, `execution.milestone.02`, `concept.decision.004`, `concept.acceptance.001..004`, `concept.acceptance.012`	one Core Interface; per-worktree custody; exact unresolved-state path; Runner-private execution lifecycle plus Delivery current-slot lifecycle	code plus binding/contention/crash/unresolved/inspection/authorization/no-history/native-isolation fixtures	Iteration 3 production implementation and qualification evidence are recorded in the implementation result	Execution implementation workflow	`docs/systems/execution/project-execution-system.md#ee-execution-14`	bypass, multiple writers, auto-clear, fabricated history/outcome, public resume, or native leak
`concept.obligation.003`	Delivery Observation implementation owner	`execution.milestone.03`, `observation.contract.006`, `observation.contract.007`, `concept.acceptance.005..007`, `concept.acceptance.009`, `concept.acceptance.017`	implement the adopted Core-owned, allow-listed, one-way best-effort profile by selecting one exact complete shape before emission and copying the bounded Finding assertion, Finding-specific scope and one typed target edge without reselecting family fields, usage truth or identity	production code/exact lock plus complete-shape mapping, ordinary Finding/Fix/Recheck/Recheck-summary/multi-target relationship, bounded-content/privacy, lineage/usage/Span-identity, allow-list, sampling, disable/loss/refusal and dual-emitter-absence fixtures	Iteration 3 production emitter, producer-role, outage and privacy evidence are complete; formal cross-implementation conformance remains unclaimed	Execution observation implementation workflow	`docs/systems/execution/project-execution-system.md#ee-execution-14`	mapping deviation, incomplete variant, missing/mutated Finding fact or typed edge, unit conflation, dual emitter, privacy leak, identity conflation, receipt/outbox or control coupling
`concept.obligation.004`	Evidence data-service implementation owner	`evidence.milestone.01..03`, `observation.contract.008..012`, `concept.acceptance.005`, `concept.acceptance.007..010`, `concept.acceptance.013`, `concept.acceptance.017`	atomic Event/Span first-write admission validates one exact complete shape and atomically projects the verbatim bounded Finding assertion and typed target edge, compatible native usage, plus a versioned read-only query API on a loopback-only data service	code/migrations plus Event/Span/target-edge atomicity and idempotency, complete-shape/relationship/multi-target/privacy/usage/truth/query conflict, method/route negative-reachability, and backup fixtures	concept.fixture.003 proves the pinned transaction/truth prototype only; application is absent	Evidence implementation workflow	`docs/systems/evidence/evidence-system.md#ee-evidence-14`	partial projection, mutable accepted fact, duplicate Span or target contribution, conflict overwrite, missing/mutated Finding assertion or edge, unit conflation, inference, database/raw/write/UI exposure, or topology change
`concept.obligation.005`	Execution performance validation owner	`execution.milestone.02`, `execution.milestone.03`, `evidence.path.03`, `concept.acceptance.001`, `concept.acceptance.006`, `concept.decision.004`, `concept.decision.005`	serial custody and best-effort Observation must remain operationally bounded without changing semantics	bounded workload measurements for admission/start/finalize latency, exporter queue/drop, and resource use	no numeric SLO/default is fixed; no production measurement exists	Execution validation workflow	`docs/systems/execution/project-execution-system.md#ee-execution-14`	measured bounds require another writer, durable outbox, new Module, or semantic threshold change
`concept.obligation.006`	Evidence lifecycle validation owner	`evidence.milestone.01..03`, `observation.contract.011`, `concept.acceptance.011`	four Evidence lifecycle classes stay independently addressable and factual truth is not rewritten	bounded ingest/growth/query/expiry/retention/backup measurements and expiry fixtures	no numeric capacity/retention default is fixed; no production measurement exists	Evidence validation workflow	`docs/systems/evidence/evidence-system.md#ee-evidence-14`	measurements require coupled deletion, history rewrite, new Module, or topology change
`concept.obligation.007`	Evidence repository release owner	`evidence.milestone.01..03`, `concept.acceptance.015`	one public Evidence authority; parent repository pins one reviewed submodule commit; no cross-repository transaction	repository identity, initial commit, CI/release proof, and parent submodule-link proof	public repository/submodule does not yet exist	Evidence repository release workflow	`docs/systems/evidence/evidence-system.md#ee-evidence-14`	duplicate authority, unpinned code, or cross-repository transaction becomes necessary
`concept.obligation.008`	Product license decision owner	`concept.acceptance.016`	the public Evidence release uses one approved MIT or Apache-2.0 license with matching notices	recorded license decision plus exact LICENSE/NOTICE review	license family is constrained but selection/approval is open	product release workflow	`docs/agent-architecture.md#ee-concept-7`	neither allowed license is legally compatible or multiple conflicting licenses are required
`concept.obligation.009`	Legacy physical cutover owner	`concept.decision.015`, `concept.decision.016`, `concept.decision.017`, `concept.decision.018`, `concept.acceptance.014`	quarantined legacy machine evidence stays non-authoritative until an atomic downstream physical cutover	exact A 257-member byte subset and 16 B-legacy successors; complete inventory and atomic replacement/removal or authorized repair; new digests; fresh Python/Node test baseline	quarantined known-red legacy evidence: Python 67/2 named baseline failures and Node 158/0; not conformance	legacy Contract implementation workflow	legacy physical cutover packet, pending downstream rebinding	partial cutover, hidden active edge, any new/different failure, or known failure mislabeled PASS
`concept.obligation.010`	Workflow/Execution representation owner	resolved Package and simple Manifest; `concept.acceptance.item.001`, `005`, `007`	preserve exact Package fields, phase-correct errors, and exact activation without proof/capability/transaction state	physical fields, validators, valid/invalid binding fixtures	Iteration 3 M01 representation and binding corpus complete	Contract/implementation guidance	Concept register and Execution Design	reopen on re-resolution, ambient completion, native leak, or pre-Delivery failure becoming Delivery outcome
`concept.obligation.011`	Execution Core implementation owner	`execution.milestone.01..03` and all `execution.scenario.*`	one prepare operation, simple Store, Manifest-before-DSH, immediate contention, unchanged Observation, plus only the RED-bounded internal Action-finish input distinction and Section 10 pre-effect start-correlation acknowledgement	Interface-level import/contention/Manifest/DSH/result/privacy/Action-finish/start-correlation fixtures	Iteration 3 Core/M01/M03/Intake implementation and qualification complete	Execution implementation guidance	Execution Design	reopen on bypass, drift, wait/queue, pre-Delivery outcome/Observation, ambient completion, public Runner change, or any Runner delta beyond the two approved distinctions
`concept.obligation.012`	product/repository/plugin/Package release owners	independent Workflow Package GitHub host, configured alternate common path, contribution	publish versioned initial Package assets independently from Execution/Core and DSH Intake artifacts; govern contributions and protect the initial corpus	repository, separate Release/assets, descriptors/digests, contribution and no-embedding evidence	publication absent	repository/plugin release guidance	Concept and Execution Designs	reopen on mutable/ambiguous/incomplete asset, embedded content, allow-list, rewrite, bypass, or fallback
`concept.obligation.013`	Local Store implementation owner	exact/latest and `MISSING/STAGING/READY`	local-first, non-addressable candidate staging, initial failure→`MISSING`, refresh failure preserves prior `READY`+alias, alias-after-new-ready, no eviction	Store Interface initial-fill and refresh hit/miss/staging/ready/conflict/failure fixtures	Iteration 3 Store implementation and failure corpus complete	Store implementation guidance	Execution Design	reopen on partial visibility, prior-ready/alias loss, required concurrent writers, or required eviction
`concept.obligation.014`	DSH Adapter/provider qualification owner	exact activation/no ambient; `concept.acceptance.item.007`	select production bindings and project complete Packages before effect	protected/contributed behavior and provider/no-default/result evidence	DSH `0.1.1-rc.2` production path, protected/contributed projection and no-ambient qualification complete	Runner guidance	Execution Design	reopen on rewrite, ambient substitution, post-effect rejection, missing capability, or native leak
`concept.obligation.015`	operations validation owner	source/cache resource use	choose bounded fetch/cache settings without fallback, queueing, eviction, auth, or production recovery semantics	ordinary-fault/resource observations	no numeric defaults fixed	validation/operations guidance	Execution Design	return only if measured facts require changed ownership/Interface or trust/scale context

Normative obligation refinements: concept.obligation.001 must physically encode C17 presence/absence as counted/no-count form, preserve C27 and the six identity domains, and package bilingual zero/positive/absence/retry and type/range/carrier/atomic negatives; reopen if absence needs an out-of-band discriminator or zero cannot remain distinct. concept.obligation.003 must prove typed owner count→exact C17 and no fact→omission without malformed emission; reopen on another selector or assertion mutation. concept.obligation.004 must prove presence-only Admission, exact count/no-count landing/query, no partial Review/count effect, and all unchanged lifecycle no-op/append semantics; reopen on producer-intent inference, synthesized zero/UNAVAILABLE, partial effect or conflated storage.

Design acceptance requires every row above to have one semantic owner, an evidence state, a durable return and an explicit reopen condition; each System must remain independently usable, the cross-System seam must agree, all owner links must resolve, and the active authority graph must exclude removed or quarantined material as co-active authority. Implementation acceptance remains owned by downstream Contract, implementation, operations, repository, and license owners.

9. Decision Register

ID	Decision
`concept.decision.001`	Embeddable Execution plus separately deployed optional Evidence
`concept.decision.002`	Three deep Modules per System
`concept.decision.003`	Runner owns execution truth and hides native lifecycle; Delivery owns admission/current-slot/Manifest lifecycle
`concept.decision.004`	Custody first; one current slot; exact NEW/RECOVERY split; no Execution history
`concept.decision.005`	Standard-first, allow-listed, best-effort Observation
`concept.decision.006`	Evidence Projection owns completeness and compatibility eligibility
`concept.decision.007`	First accepted write wins; no correction/recompute platform
`concept.decision.008`	Accepted identity and required initial projections commit atomically
`concept.decision.009`	Bounded Adapter protobuf is the sole designed current factual emitter
`concept.decision.010`	Canonical worktree identity is derived/revalidated before custody/effect
`concept.decision.011`	Raw, accepted identity, Trace, and factual projections have independent lifecycles
`concept.decision.012`	Evidence is a loopback-only data service whose sole external read boundary is the versioned read-only query API; it hosts no UI or presentation proxy, and PostgreSQL is not externally exposed
`concept.decision.013`	Persisted pre-start state closes only with conclusive non-start or exact authorized abandonment
`concept.decision.014`	Publish exactly seven bilingual authority pairs with one semantic owner each
`concept.decision.015`	Preserve exact A machine bytes and revise exact B-legacy successors as one honestly quarantined dependency graph; do not call it closed or passing
`concept.decision.016`	physical conformance requires published schema, registry, fixtures, and validation
`concept.decision.017`	Publication uses the frozen 67/2 Python and 158/0 Node baseline-result/delta Gate; only the two named legacy failures are permitted
`concept.decision.018`	The EFCR digest mismatch and two frozen historical authority literals remain quarantined legacy/non-conformance evidence
`concept.decision.019`	Adopt the Observation semantics encoded by frozen, published Profile `1.0.0`; Profile `0.3.0` is non-resolving legacy history only. The exact OTel/OTLP/semconv pins, ten EventNames and closed 57-common/10-Implementation/6-System-Design registries include owner-supplied C55–C57; Review summary, Finding, Fix and Recheck use complete named base-plus-variant shapes; every Finding carries a bounded privacy-safe factual summary, a Finding-specific scope and one typed artifact/section/component/requirement target, with one complete record per multi-target edge; the typed review graph, source-scoped native usage and Span tuple identity are fixed; `agentops.role.lineage.id` pairs with local Role ID on existing `role.lineage`, while administrative disposition stays outside the first wire profile
`concept.decision.020`	Workflow Packages conform to one open Agent Ops composition model; admission is based on exact closure and current Runner compatibility, not Package ownership/name.
`concept.decision.021`	Canonical worktree admission occurs first. `CONTENDED` and `RECOVERY` perform no new-selector Package work; only `NEW` resolves and validates the Package before Delivery Manifest creation. Any preparation failure releases the ordinary holder and returns before a Delivery exists.
`concept.decision.022`	Bare name means sticky-local latest; exact/latest local hits avoid remote access; every successful result freezes `name`, `exactVersion`, `packageDigest`, `localPath`, and `workflowId` for the new Delivery.
`concept.decision.023`	One canonical installation configuration selects exactly one Source: the default public GitHub repository/release Adapter or one explicit alternate Adapter. Requests cannot select or override Source. Resolution uses no source/version/ambient fallback; source choice is configuration, not an authorization/capability protocol.
`concept.decision.024`	The Workflow Package GitHub repository/release is the first Package host and independently owns versioned Package assets. The DSH Intake plugin and Execution Release do not embed initial Package content. Alternate native Source types stay private behind the same seam.
`concept.decision.025`	The preview Store exposes only `MISSING` and `READY` to resolution while candidate `STAGING` stays private/non-addressable. Initial failure leaves `MISSING`; refresh failure leaves the prior `READY` Package and alias unchanged; refresh success publishes the new exact Package before changing the alias. There is no automatic eviction, Package transaction lifecycle, Prepared hold, proof identity, or commit-resolution subsystem. DSH state remains Adapter-owned; Runner changes are limited to the RED-bounded internal Action-finish input distinction and Section 10 pre-effect start-correlation acknowledgement.
`concept.decision.026`	Configuration, factories, and Bootstrap are Execution-level support. One canonical config produces distinct installation identity, config-only Delivery configuration projection identity, and Package-dependent Delivery binding identity. Bootstrap alone owns production assembly, recovery readiness, rollback, and reverse shutdown.
`concept.decision.027`	Execution exposes one host-neutral Core request/result contract. Intake is replaceable; the first DSH Intake plugin owns only presentation and installation lifecycle calls. Intake DSH and Runner-owned execution DSH use distinct Context, service registry, session namespace, and persistence roots while shutdown cascades through one installation lifecycle.
`concept.decision.028`	Create consumes the triggering turn as a host-neutral `TaskPrompt`; prompt text is not a command parameter, attachments become Execution-owned immutable snapshots only on `NEW`, and `CONTENDED`/`RECOVERY` ignore the new turn.
`concept.decision.029`	Intake exclusivity is per host conversation session, not installation-global. Session/Delivery binding is exclusive and zero-or-one for an active Delivery; restart restores an exact valid mapping or marks the Delivery detached/recoverable.
`concept.decision.030`	The target-free Action-finish command means finish requested, not Action completed. The current Action owns closure and only validated `workflow_complete` advances the Workflow; the approved Runner reopen is limited to representing that internal interaction distinction.

The detailed behavior and verification obligations follow in the three owned documents linked above.

10. Iteration 3 Corrective Product Boundary

This section is a bounded addendum for the interactive Intake and independently releasable Workflow Package outcomes. It supersedes only the earlier statements that Runner is unchanged beyond Action-finish and that the first GitHub mechanism is repository-release-wide. All other ownership, lifecycle, trust, recovery, and non-goal decisions remain active.

Host-neutral presentation and real UI

Execution Core owns a closed, versioned, host-neutral presentation event vocabulary. Intake owns transport and host rendering only. For interactive commands, the DSH adapter submits the exact command and attachments as a native user message in a host-owned turn, then consumes that turn at pre-step before any DSH-I model request. Its keyed command view replaces the generic one-line renderer and presents each native command lifecycle once, with a friendly projection and copyable bounded technical details; it does not fabricate an assistant/model message or a duplicate immediate command row. The resulting non-blank conversation is isolated from a later New Session and remains separately reopenable. Delivery inventory/status remain read-only Session projections and do not replace workspace navigation. The closed event kinds are command accepted, Delivery running, Delivery list (including a real empty list), Delivery status, Action output, Action input request, terminal result, and bounded error. Unknown or malformed envelopes fail closed as a bounded WSR error without echoing rejected bytes, and Core remains independent of DSH types.

Browser-visible rendering through the locked DSH web client is the product oracle. RPC and session-history inspection are auxiliary transport and durability evidence, not substitutes for visible UI evidence.

Delivery-owned start truth

The observed gap between persisted start uncertainty and later terminal result authorizes one internal Runner-to-Delivery correlation acknowledgement. Before the first Host or Action effect, Runner durably records the exact Delivery/Manifest/activation-correlated start fact, Delivery validates it and durably changes START_UNCERTAIN to RUNNING_CORRELATED, and Runner records the acknowledgement. Exact replay is idempotent; mismatched correlation fails closed. Observation receives only a later non-controlling best-effort copy. This does not alter the public Runtime operations, terminal result ownership, retirement, settlement, or other Runner semantics.

Trusted route authority projection

For the trusted local MVP, admitted Workflow route modes project to workspace authority without interpreting human-readable target text as a path: any read route grants root-and-descendants read, any write route grants root-and-descendants write, and execute grants no workspace-file authority. Exact admitted Host operations remain the only execution authority. Canonical-worktree containment, relative-path validation, symlink escape rejection, signed authority digest, and Custody post-attempt validation remain mandatory. This addendum does not change the Workflow Contract or DSL.

Package independence and first proof Package

GitHub Source resolution operates on package-version records rather than a repository-wide latest release. New releases are package-scoped, contain exactly one Package, and use deterministic package-qualified tags and assets. Exact and latest selection share one bounded release-enumeration and normalization path; duplicate package-version records are invalid, stable latest excludes prereleases, local-first sticky resolution remains, and no source, version, tag, or ambient fallback is introduced. The already published two-Package 0.3.0 initial cohort remains byte-for-byte read-only and is normalized by that same path as a compatibility record, not copied, rewritten, or treated as fallback.

hello-world-workflow@0.1.0 is the first non-initial proof Package. It owns one model-backed Action, requests no tools or workspace authority, consumes the immutable TaskPrompt text and attachment snapshots through generic Execution projection, and completes with a structured successful result. Execution may add that generic prompt/attachment projection but cannot add Workflow-specific behavior, a prompt command parameter, or ambient environment/secret access.

Bounded return conditions

Return for human ruling before implementation if evidence requires a public Runtime change, another Runner semantic change, a frozen Workflow Contract/DSL change, DSH source modification, mutation or republication of either initial Package, fallback, target-text path interpretation, a second configured Source, fabricated assistant history, or broader migration/security/concurrency semantics. The executable details and RED/GREEN oracles are owned by the Execution Design corrective addendum.