A provider-neutral governance layer designed to keep AI proposals separate from execution authority. The engineering focus is explicit authority, evidence, human approval where required, hard execution boundaries, single-use permits, recovery and forensic evidence.
The design treats the AI as a proposer, not the authority. Permission to act is carried through a controlled path and bound to the exact governed action.
github:repository:read; older active passport state must be re-provisioned or recreated to carry that scope.The public description stays at property level: what was demonstrated, what boundary was exercised and what remains unproven.
Execution receipts and their integrity state were hardened so recovery does not depend on one process lifetime. Receipt verification remains fail-closed after restart and state reconstruction.
The Decision Centre restart path was hardened so a consequential action waiting for human review can retain the context needed to validate the later decision rather than relying on ephemeral process state.
The external-network/container evidence gap was exercised with a bounded GitHub repository read through the governed path inside a Linux OCI container.
The latest readiness audit supports bounded controlled-pilot work, with GREEN-only operation and AMBER/RED fail-closed behaviour in the accepted pilot posture.
The underlying Governor repository remains private; these are the implementation concerns the current assurance work is built around.
| Engineering concern | Current evidence | What it supports |
|---|---|---|
| Governance lifecycle | Constitution, authority/evidence decision and governed-action lifecycle | Separates recommendation from authority and gives unknown/missing evidence explicit fail-closed outcomes. |
| Human authority | Decision Centre review context and restart/recovery tests | Consequential actions can remain AWAITING_HUMAN without approval becoming detached from the governed action after restart. |
| Hard execution boundary | Decision/execution bridge, Hard Tool Gateway and permit controls | Approval is not itself execution; a separate controlled path authorises the exact action. |
| Receipt integrity | Persistent receipt key/state, verification, reconstruction and replay controls | Execution evidence survives restart and rejects corrupted or unverifiable state. |
| Agent Passport | Persistent lifecycle, reconstruction, revocation and action-admission evidence | Agent identity/scope is an enforceable runtime input rather than descriptive metadata. |
| External action | Linux OCI governed GitHub repository read | Demonstrates the governance path around a real bounded external network action in a relevant containerised environment. |
| Verifier | Separately-run verification process with trusted local key custody | Provides a second verification pass over retained evidence; it is not claimed as third-party, externally anchored or independent-key-custody assurance. |
The current published checkpoint comes from the latest full safe-suite run rather than an older frozen count.
These constraints are part of the evidence, not footnotes to hide.
The authoritative production Constitution activation, reconstruction and rollback path is not yet evidenced to the level required for a higher-readiness claim.
The current accepted pilot posture does not claim a completed production backup-and-restore capability.
The GitHub demonstration depends on external API/network availability. The bounded Gate 9 path did not use credentials.
Gate 9 proves its scoped external-action path; it does not by itself re-prove every Governor component or the complete Constitution lifecycle.
The verifier is a separately-run process using trusted local key custody. It is not third-party verification, externally anchored verification or independent-key-custody verification.
Local Windows storage adapters still require a Windows execution host. Linux OCI evidence should not be presented as proof that Windows-specific adapters run in Linux.
The automated suite is strong, but test volume is not a substitute for the missing Constitution lifecycle proof.