The work and evidence path
A goal becomes a bounded Work Unit, a worker produces a candidate and a self-report, an independent verifier produces evidence about that self-report, and a human integrates. The two dashed rules mark where a stage's output stops being able to speak for the next one.
experiments/two_attempt_orchestrator.py and the WorkUnit, ResultManifest, and VerificationResult schemas.| worker success | ≠ | acceptance |
| verifier recommendation | ≠ | merge authority |
| CI success | ≠ | independent human approval |
| benchmark fixture | ≠ | scientific outcome |
Attempts fail independently
The orchestrator is a control-plane MVP, not a worker runtime — it executes no candidate code. Each attempt reaches exactly one of four terminal states, and a failure in one attempt never aborts the others. The three tokens below travel at the same time to show that isolation.
control_failures, which sets the run to completed_with_failures. Only verified carries a recommendation of accept_candidate or reject_candidate. Source: orchestrate() in experiments/two_attempt_orchestrator.py.Every run report declares the same authority block, and all four values are constant:
"authority": {
"canonical_state_write": false,
"git_push": false,
"merge": false,
"automatic_candidate_selection": false
}
A verified, accepted candidate therefore still changes nothing on its own.
Zero project spend, enforced fail-closed
Repository policy is applied first and acts as a hard ceiling. A Work Unit may tighten the spend constraint but can never relax it, so a task cannot ask its way into authority the project does not have. Watch the paid token: it reaches the gate and stops.
paid exists in the offer schema for interoperability and testing only. Repository policy disables it, so it never becomes an eligible offer. Donated capacity must additionally be opt-in, and must stay voluntary, visible, capped, and easy to stop. Source: config/compute-policy.json and experiments/local_compute_offer.py.The one check that always runs
Every other workflow in the repository is path-filtered, so none of them runs on every pull request. PR Gate is deliberately unfiltered so it can serve as the single stable required check on main — a required check that never runs would leave a pull request permanently blocked.
argv only. The link step runs tools/idkgraph_link_check.py inline and fails on any finding outside tests/fixtures/, where negative fixtures are seeded deliberately. Source: .github/workflows/pr-gate.yml.Where the authority actually lives
These renderings add no new contract. Where a diagram and a schema disagree, the machine-readable schema is authoritative.