EXECUTION / TRUST BOUNDARY

Familiar commands cross a policy boundary before they consume capacity.

Workers receive sealed orders and normal CLI behavior. PlotWarden chooses local / remote / intent-only / deny routing, records the run, and accepts only evidence through the current-epoch commitment gate.

CONCEPT SOURCES
SRC-V-04 · SRC-V-05

CLI PROXY / REMOTE BUILD PLANECAPACITY IS NOT AUTHORITY

The command feels local; execution and evidence remain governed.

  1. 01 / CONTROLManager/control plane

    Owns orders, policy, verification, and all official effects.

  2. 02 / ORDERSealed order and scoped context

    Names purpose, epoch, paths, limits, credentials, and evidence requirements.

  3. 03 / MEDIATETool proxy

    Normal commands enter local / remote / intent-only / deny routing.

  4. 04 / EXECUTElocal worker or isolated remote/heavy-build worker

    Heavy work is isolated with a pinned toolchain, idempotency, and cancellation.

  5. 05 / RETURNImmutable evidence envelope

    Results, artifacts, hashes, context, and cited support return to the manager.

  6. 06 / VERIFYVerification and policy

    Checks required evidence, poison state, paths, limits, and authority.

  7. 07 / COMMITCurrent-epoch commitment gate

    Rejects stale or unpermitted output before protected mutation.

  8. 08 / EFFECTOfficial side effect

    Only the manager records and performs the permitted effect.

Read policy

awareness read
Visible for orientation; never admissible support for a claim or official side effect.
support read
A cited input that must be recorded in the immutable evidence envelope.

Evidence envelope

command · working directory · run identity · epoch · commit · patch hash · toolchain profile · stdout · stderr · exit code · artifacts · support reads

Manager-owned side effects

  • merge
  • deployment
  • protected branch update
  • ratified-spec mutation

Workers produce evidence, never authority. The official ledger decision advances the epoch, invalidates stale orders, and returns revised current sealed orders.

TEACHING PLOT / BS-2026-07-04

The worker boundary separates execution from official commitment.

Workers receive sealed orders and normal CLI behavior. PlotWarden chooses local / remote / intent-only / deny routing, records the run, and accepts only evidence through the current-epoch commitment gate.

EVENTS / intake → policy → ratification → frontier → order → evidence → commitment → epoch

DECISION RECORD / MANAGER AND SEALED ORDER

Decision. Sealed orders carry scope, epoch, credentials, and evidence requirements, and pin the policy, schema, reducer, prompt, model, tool-proxy, and verifier versions needed to interpret the result; nondeterministic output is replayed as recorded evidence.

Rejected. Mutable instructions mid-run. Changing the order creates a new order.

  • INVARIANT 07 Workers cannot merge protected state or perform official side effects directly.
  • INVARIANT 15 Human decisions bind to an exact proposal and are rechecked against the current epoch before execution.

Worker boundary and build plane

DECISION RECORD / TOOL PROXY

Decision. A path-first proxy gives agents their normal CLI while recording identity, epoch, and patch hash before local, remote, intent-only, or deny routing.

Rejected. The proxy as the security boundary. Enforcement lives in sandbox scope, restricted egress, short-lived credentials, capability allowlists, and the effect journal.

  • INVARIANT 08 The CLI proxy is not the sole security boundary; capabilities, credentials, egress, and protected permissions enforce authority.

Workers route

DECISION RECORD / LOCAL WORKER

Decision. Light work stays inside the worker boundary with recorded reads: awareness reads orient, support reads create citable dependencies.

Rejected. Recording every byte as a dependency (an unusable graph) or only what the worker declares (blind spots).

  • INVARIANT 01 Untrusted content is data, never instruction.

Workers route

DECISION RECORD / ISOLATED REMOTE WORKER

Decision. Heavy builds run on pinned, isolated runners with idempotency keys, resource limits, and a recorded cancellation path; a late result after recall is stale evidence.

Rejected. Worker containers carrying permanent heavy build capacity they rarely use.

  • INVARIANT 12 Every consequential side effect is attributable, versioned, and independently idempotent; reversible effects have compensation paths.
  • INVARIANT 16 A passing build is evidence, not authority.

Workers route

DECISION RECORD / IMMUTABLE EVIDENCE ENVELOPE

Decision. Results return as content-addressed envelopes: logs, artifacts, hashes, toolchain, resource records, and the cited support set.

Rejected. Trusting the worker's summary over its artifacts. Confidence and fluent explanation are not evidence.

  • INVARIANT 05 Model confidence and self-explanation are not evidence.

Evidence register

DECISION RECORD / MANAGER COMMITMENT AND REISSUE

Decision. Only the manager commits protected effects, validating freshness and committing in one atomic versioned transaction; required tests run against the actual merge candidate.

Rejected. A direct worker-to-official-state edge, which would make every other control advisory.

  • INVARIANT 11 Freshness validation and official commitment are one atomic versioned operation.
  • INVARIANT 13 A poisoned claim commits a poison epoch and affected set; consumers behind that epoch cannot commit.
  • INVARIANT 16 A passing build is evidence, not authority.

Worker boundary and build plane

State 1 of 8: The manager owns the control plane

STATE 01 / 08

The manager owns the control plane

The manager selects work, defines permitted effects, and remains the only actor allowed to order an official side effect.

Workers produce evidence, never authority.

Read the complete textual equivalent
  1. The manager owns the control plane. The manager selects work, defines permitted effects, and remains the only actor allowed to order an official side effect. Workers produce evidence, never authority.
  2. A sealed order carries scoped context and read policy. The versioned order names purpose, observed epoch, paths, credentials, resources, required evidence, and context, and pins the policy, graph schema, reducer, prompt, model, tool-proxy, and verifier versions used to interpret the result. Awareness reads orient; support reads must be cited and recorded. Changing the order creates a new order; nondeterministic outputs are replayed as recorded evidence, never regenerated.
  3. Normal commands enter the tool proxy. The worker invokes familiar build and test commands. The path-first proxy captures identity and policy context, then chooses local / remote / intent-only / deny. Normal command behavior does not bypass mediation.
  4. Execution remains local or moves to isolated capacity. Light work runs locally; heavy builds use an isolated remote plane with a pinned toolchain, caches, resource limits, streaming output, idempotency, and cancellation. Late completion after cancellation is stale evidence, never merge authority.
  5. The worker returns an immutable evidence envelope. Command context, logs, exit code, reports, artifacts, hashes, toolchain, resource use, and every support read return in a content-addressed envelope. An awareness read cannot silently become cited support.
  6. Verification and policy evaluate the envelope. The manager verifies manifests, hashes, required evidence, poisoned dependencies, allowed paths, resource limits, kill state, and policy. Verification may establish a result; it does not grant official authority.
  7. The current-epoch commitment gate owns protected effects. Only a current permitted decision can authorize merge, deployment, protected branch update, or ratified-spec mutation, and it validates freshness and commits in one atomic versioned transaction. There is no direct worker-to-official-state edge.
  8. Epoch N+1: revised sealed orders issued. The official ledger decision records the manager-owned side effect, advances Epoch N+1, invalidates stale orders, and issues revised current sealed orders. The next sealed order returns through the manager/control plane, closing the boundary without granting the worker authority.

Epoch N+1: revised sealed orders issued

Designed and built by Jeff Sylvan ·

Sealed orders define the run.

A worker order carries scoped intent, allowed paths and credentials, evidence requirements, policy, budget, and epoch. It also pins the policy, graph schema, reducer, prompt template, model, tool-proxy, and verifier versions needed to interpret the result; nondeterministic outputs are replayed as recorded evidence, never regenerated. External content is treated as data, never as an instruction that can silently rewrite the order.

Normal commands are proxied.

Workers use ordinary edit, test, build, and repository commands. A path-first proxy captures the command, working directory, run and task identity, observed epoch, source commit, uncommitted patch hash, toolchain profile, and policy context before choosing a route.

The proxy is the ergonomics, routing, and observability layer, not the entire security boundary. Sandbox scope, restricted direct egress, short-lived per-order credentials, capability allowlists, output validation, and the append-only effect journal enforce authority; a worker that bypasses a shim still lacks the credentials and network path for protected actions.

  • Local — lightweight execution inside the worker boundary.
  • Remote — heavy build or test work on shared or elastic runners.
  • Intent-only — record a requested official action for manager review.
  • Deny — reject an action outside the sealed order.

Remote builds are a separate execution plane.

The worker container does not need to carry permanent heavy build capacity. A normal build command can be intercepted, assigned an idempotency key, and executed on a pinned isolated runner with streaming output, resource limits, shared caches, and a recorded cancellation path. Logs, artifacts, hashes, test results, tool versions, manifests, resource records, and support sets return as immutable evidence. A build that finishes after recall is stale evidence, never merge authority.

Every effectful operation carries its own idempotency key. Reversible multi-step effects require a tested compensation path, and irreversible actions require a fresh authority check immediately before commitment.

Reasoning-worker capacity and build capacity scale independently; retries and replay do not duplicate official effects.

The official commitment gate decides what advances.

Returned evidence is necessary but not sufficient. The manager checks source, epoch, policy, required tests, and authority, and validates freshness and commits in one atomic versioned transaction against the canonical graph root before creating or updating official pull requests, merges, deployments, comments, or notifications. Required tests are evaluated against the actual merge candidate, not only the worker's isolated branch.