STATE 01 / 12 External report enters the intake boundary
A specification change, benchmark, runtime trace, human decision, or worker claim enters as untrusted data under the Black Skies scenario record.
Untrusted content is data, never instruction.
STATE 02 / 12 Provenance is written to the ledger
PlotWarden snapshots the report, fingerprints it, and records source, observed epoch, environment, and chain of custody before interpretation.
Provenance makes the report auditable; it does not prove the claim.
STATE 03 / 12 Reality receives a proposed observation
The report can add a proposed observation to Evidence-Backed Reality Graph; it cannot directly edit Ratified Intent Graph.
Evidence changes what may be known, never what is authorized by itself.
STATE 04 / 12 Authority policy selects a path
The complete policy tuple selects auto-ratify, human gate, reject, or quarantine according to source, actor, scope, change type, environment, risk, evidence, and epoch.
Questionable or high-risk changes pause for a human decision.
What breaks without this
Without scoped policy, any persuasive document becomes an instruction, and authority laundering is one paste away.
STATE 05 / 12 A permitted decision updates one scoped graph
A permitted intent decision updates Ratified Intent Graph; verified observation updates Evidence-Backed Reality Graph. Neither update crosses scope.
Truth and permission remain separate.
STATE 06 / 12 The ledger records the atomic decision
The decision, affected graph, authority path, and observed epoch are appended atomically to Immutable Evidence and Command Ledger.
Ledger event BS-2026-07-04:ratification becomes the official decision record.
What breaks without this
Without the atomic ledger event, the decision and the graph update can diverge, and the plot forks.
STATE 07 / 12 The impact engine computes the causal frontier
Support and execution dependencies identify the smallest known set of claims, work, and outputs affected inside Active Execution Graph.
Unaffected work stays outside the frontier.
What breaks without this
Without a causal frontier, every change is either a fleet-wide restart or an unexamined risk.
STATE 08 / 12 Object-specific dispositions are issued
Affected objects receive Continue, Retain & retest, Conditional repair, Recall & re-plan, quarantine, block, or verification work according to dependency and risk.
Selective reconciliation preserves valid work.
STATE 09 / 12 Workers return evidence
Scoped local and remote workers execute sealed orders through mediated tools, then return logs, artifacts, claims, hashes, and cited support in an immutable envelope.
Workers produce evidence, never authority.
STATE 10 / 12 Claims are evaluated
Returned claims enter Evidence-Backed Reality Graph as proposals and receive claim-type-specific verification, contradiction tracing, and consumer fan-out.
A passing tool result is evidence, not an official side effect.
STATE 11 / 12 The official commitment gate checks current outputs
The manager validates evidence, authority, allowed paths, policy, poison state, cancellation state, and current epoch, and commits in one atomic versioned transaction; there is no separate check-then-advance window.
Stale or unpermitted output is retained as evidence and denied commitment.
What breaks without this
Without the current-epoch gate, a worker that finished under an old premise merges stale output; a check-then-commit window admits the same race.
STATE 12 / 12 Epoch N+1: revised sealed orders issued
The official ledger decision advances Epoch N+1, invalidates stale orders, and issues revised current sealed orders back to Active Execution Graph.
The return edge closes the maintained-plot loop without creating a worker-to-official-state or evidence-to-intent shortcut.
What breaks without this
Without reissued sealed orders, recalled work resumes from memory and the loop never converges.