record the protocol-first control plane, superseding the headless retirement - #182
Merged
Merged
Conversation
…irement Drives workers over the vendors' own protocols and makes the terminal a view rather than the control surface, superseding the headless-retirement decision and amending the two that made a visible pane the control plane and defined a vendor turn boundary. Written from the outline, its addenda and the proof run's own record. The run was closed after row 5: rows 1, 4, 5 and 9 pass, row 3 fails, row 2 is proven on send and content but not on render, row 8 is inconclusive, and rows 6 and 7 never ran. Every claim is marked with the state it is actually in, per vendor and per row, because only claude has been run at all and one vendor's proof is not three vendors' evidence. Several things the first draft asserted did not survive being measured, and the document says so rather than quietly restating them: reconciliation is an audit of the journal's completeness and not a correctness mechanism, and its premise was wrong because the vendor's transcript is a superset of the stream by construction; a proposed detector for the unverifiable prompt-tool sentinel is withdrawn, since a denial with no matching ledger request is produced identically whether or not the sentinel is passed; and three of the five things listed as carried over unchanged are changed, each found by running a worker rather than by reading. The ledger records what the vendor raises, never every action a worker took: measured, a mutating tool call ran with nobody consulted under the pinned posture. That trade is recorded as decided, with the one init-verifiable pin carrying the authorization and a named trigger for reopening it. Leases keep leader-owned release, and the document states plainly that the dependency on a correct leader has no safety net in either direction, what it costs when it fails, and that the manual force-release is today's only recovery.
The run closed before anyone saw crew's own renderer produce its box, so "pending" claimed an open action that does not exist. The send and the content are proven; the render was never confirmed, and the coming functionality-1 demonstration is the next opportunity rather than an outstanding item from this run. Found by reading the ADR's evidence table against the proof run's own report, which had it right.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this decides
Crew drives workers over the vendors' own protocols; the terminal becomes a view rather than the
control surface. The decision is recorded with its evidence marked per vendor and per row, because
only claude has been driven this way at all — codex, copilot and omp are inferred and unverified,
and one vendor's proof is not three vendors' evidence. Where the drafting assumptions did not
survive being measured, the document says so rather than restating them: transcript reconciliation
is an audit of the journal's completeness and not a correctness mechanism, and its premise was wrong
because the vendor's transcript is a superset of the stream by construction; a proposed detector for
the unverifiable prompt-tool sentinel is withdrawn, since a denial with no matching ledger request
is produced identically whether or not the sentinel is passed; detection of a dropped event has
never been exercised against a real turn and rests on a unit test; and three of the five things an
earlier draft listed as carried over unchanged are changed, each found by running a worker rather
than by reading one. The approval ledger records what the vendor raises, never every action a
worker took — measured — and that trade is recorded as decided, with the one start-time-verifiable
pin carrying the authorization and a named condition for reopening it.
The write-once exception, applied once
ADR bodies are not edited. The single exception this repo allows is a superseded-by header, and it
becomes available only when the superseding decision exists. 0026 gains exactly that: a status line
and a superseded-by line naming this ADR, with the reason stated — the retired adapters are not
returning, and this is a fresh implementation against the current protocols rather than that code
restored. Nothing else in 0026 changes.
Index
Three rows updated (0025 and 0027 amended, 0026 superseded), one row added, and the interim
paragraph that described a pending decision replaced, since this commit is what resolves it. A
convention note is added for the next ADR that numbers its decision points: spell them in full, not
in the short form the marker guard matches.
Gate
check-markersexits 0 over 446 tracked files. The full workspace gate is not implicated and thatwas verified rather than assumed: nothing under
crates/,packages/orscripts/reads any fileunder
docs/at build or test time — noinclude_str!,read_to_string,readFileSyncorBun.fileagainst a docs path — so no suite compiles or opens these three files.check-markersisthe only gate that reads them. No generated artefact and no protocol type is touched.