SUCCESSOR Ω acceptance and evidence matrix
This matrix was recorded before implementation of the final proof path. Source baseline: 5b4cebb309a83a7a6749d8911d8bf96a1921e042, published as source-v2.0.0-baseline.1. A source release is not a production admission.
The release mandate is α-AGI Ascension → SUCCESSOR Ω: bounded work, executable discovery, honest comparison and portable knowledge, with independently controlled proof and authority. IDs below preserve the mandate's acceptance cases. Implementation coverage and achieved evidence are separate.
How to read the record
- PENDING: required behavior has not yet been checked against named implementation and test evidence.
- LOCAL: a named local test passed; its scope does not establish independent proof or production operation.
- PARTIAL: local evidence covers only part of the requirement; the missing part remains explicit.
- BLOCKED: a required check failed or could not run. It remains a gate.
- EXTERNAL: independent custody, production credentials, real worker/network commissioning or accountable admission is required.
Record commands, environment and exit status in the release dossier, alongside the generated checkout revision, working-tree state and source digest. The release PR identifies the final head. A passing fixture test cannot change EXTERNAL to independently evaluated. Do not infer completion from a file, function name, documentation or successful website deployment. When a row has multiple obligations, do not mark the whole row LOCAL unless all local obligations are exercised.
Required behavior
| ID | Required acceptance behavior | Implementation / test evidence | Status |
|---|---|---|---|
| G01 | Valid constitution compiles; missing rights, baseline, acceptance owner or enforceable limits has a typed diagnostic | src/domain.mjs, src/compiler.mjs; test/domain.test.mjs, test/compiler.test.mjs; Draft-07 schema checked with Ajv |
LOCAL for compile eligibility; declared rights/rollback still require runtime evidence |
| G02 | Semantic edits invalidate approvals/results; legacy v1 normalized digest remains compatible; changed outer mission needs renewed admission | apps/orchestrator/__tests__/successorComputerWork.test.ts: normalized v1 compatibility, outer-metadata stripping denied, changed envelope denied; legacy computer-work regression suite |
LOCAL for adapter; general dependent-proof checks tracked under P01/P03 |
| G03 | Circular acceptance, unbounded iteration, missing critical coverage or required rollback fails compilation | test/compiler.test.mjs: cycles, invalid edges, critical coverage, rights, rollback, budgets and permission expansion; bounded schema sizes/retries |
LOCAL for supported acyclic graphs; reported cut sets are nonexhaustive coverer groups |
| G04 | Rights loss or expired evidence invalidates only dependent claims/work/authority with an explanation | src/institution.mjs, compiler/authority modules and test/institution.test.mjs: actual compiled invoice registration, mission-qualified closure, linked proof suspension and denial of newly signed work after upstream rights loss |
LOCAL; re-registration cannot reset revocation |
| R01 | Wrong-role/unknown signers, claimant self-approval and replayed nonces are rejected | src/signatures.mjs, src/authority.mjs, test/proof-runtime.test.mjs: purpose/role/principal, credential reuse, current trust, nonce and dual-control checks |
LOCAL for configured trust; real principals must be provisioned independently |
| R02 | Relabeling the same claimant credentials cannot establish independent custody | test/proof-runtime.test.mjs: same-key identity relabeling rejected; fixture cannot claim independent qualification |
LOCAL protocol checks / EXTERNAL custody |
| R03 | Candidate cannot read protected cases/labels/scorer secrets/release keys; exposure impairs proof | test/proof-runtime.test.mjs: exposure declarations impair proof; repository fixtures are public |
PARTIAL / EXTERNAL: real process/storage/key isolation requires commissioning |
| D01 | Search creates distinct executable candidates, records rejected hypotheses and respects resource bounds | src/discovery.mjs, src/workbenches.mjs, test/discovery.test.mjs: 8 guard/coefficient candidates, restricted interpreter, explicit formation/search/evaluation budgets |
LOCAL; offline enumeration is not a live neural model |
| D02 | A counterexample falsifies WORLD and updates dependent POLICY/claim eligibility | test/discovery.test.mjs, test/journeys.test.mjs: executable prediction counterexamples and critical-miss policy ineligibility retained in pack |
LOCAL for workbench; runtime propagation tracked under G04 |
| D03 | Higher mean accuracy with excessive critical misses fails; stronger comparator can erase Alpha | Measured fixture patch 54/60 with 6 critical misses is rejected; synthesis and stronger comparator both 60/60. test/examination.test.mjs freezes and reruns the actual systems, yielding a signed I0 FAIL with comparator mean gain zero |
LOCAL synthetic result, not the source book's counts or independent proof |
| D04 | Shared-cause evidence is not independent votes; changed outcome frequencies change advantage/risk | test/discovery.test.mjs: two correlated positives retain probability 5/6; unfavorable-frequency shift lowers unchanged-policy value 30 to 14 |
LOCAL conditional calculations |
| P01 | Complete release/protocol/comparator/memory bindings verify; tampering and unknown trust roots fail | test/proof-runtime.test.mjs: exact bindings, changed roster, cross-mission context, byte tampering and internally contradictory signed PASS reports rejected. test/examination.test.mjs verifies all 16 actual WORLD component commitments and rejects altered programs/measurements |
LOCAL integrity/semantic verification, not empirical truth |
| P02 | Fixture, stale, contaminated, conditional or insufficient evidence cannot create independent PASS or authority | test/proof-runtime.test.mjs: fixture, expiry, conditions and undersampling denied for independent qualification. Actual WORLD I0 FAIL also denies independent admission and exports no private keys |
LOCAL |
| P03 | Undeclared adaptation, cross-case leakage or material provider change impairs proof or requires a new release | test/proof-runtime.test.mjs: reported adaptation/leakage/provider change creates impaired insufficient evidence and cannot authorize effects |
LOCAL declared-signal handling / EXTERNAL detection and custody |
| P04 | Evaluation reports intervals, hard gates, costs, interventions and all attempts under a declared stopping rule | src/proof.mjs, test/proof-runtime.test.mjs: bounded one-sided comparison bounds, full cost fields, critical-risk ceiling, correlation groups and durable failed/abandoned attempts. Actual WORLD examination records its authored tariff, nominal sampling assumptions and measured interpreter latency |
LOCAL fixed-sample protocol; statistical validity conditional on independent groups, real costs remain unestablished in the public fixture |
| A01 | Expired, revoked, wrong-target or wrong-release authority is denied at the effect boundary | test/proof-runtime.test.mjs: actual fixture-driver denials; A3 registered assurance and A4 dual controls checked |
LOCAL fixture / EXTERNAL live worker |
| A02 | Revocation between proposal/dispatch prevents an effect; in-flight unknown outcomes require reconciliation | test/proof-runtime.test.mjs, orchestrator bridge tests: pre-dispatch revocation blocks driver/network call; unknown outcomes persist across restart and reconcile by stable ID |
LOCAL; revocation after committed dispatch is an in-flight event |
| A03 | Concurrent jobs/retries respect aggregate reserved budgets; restart/duplicate dispatch does not repeat effects/payment | test/proof-runtime.test.mjs: aggregate reservations, parallel requests, duplicate IDs/cross-job nonce reuse and restart; no commissioned payment driver |
LOCAL fixture effects; economic execution remains separate |
| A04 | Lost monitoring or failed cleanup/rollback blocks further effects until explicit recovery | test/proof-runtime.test.mjs: unavailable assurance denies dispatch; failed cleanup stops subsequent progression |
LOCAL fixture / EXTERNAL worker containment |
| E01 | Synthetic invoice yields HOLD_AND_ESCALATE with source evidence; no money or vendor/bank mutation | src/invoice.mjs, test/invoice.test.mjs: 10 source-bound jobs, hold/clean/missing evidence cases, instruction-as-data checks |
LOCAL; unsigned fixture receipts await human review |
| E02 | A valid FAIL evaluation deliverable may be accepted/paid without passing or admitting its candidate | test/v2/JobRegistry.test.js successful lifecycle: original FAIL report accepted against frozen accurate-report criteria, actually paid on local chain, candidate failed/unadmitted and authority null |
LOCAL actual fixture-chain lifecycle; not mainnet or independent mission proof |
| E03 | Wrong chain/token/decimals, ambiguous funding and incomplete deployment configuration fail; settlement invariants remain | Orchestrator bridge tests and actual local-chain reconciliation bind original specification/deliverable hashes, configured registry/token/chain, payout/finalization, canonical block and confirmations | LOCAL configured RPC; no contract/economic rule changes |
| K01 | Chronicle replay is deterministic; amendments preserve originals; tampering/gaps are exposed | src/store.mjs, test/store-pack.test.mjs: replay, version/event conflicts, atomic rollback, multiple connections, retained-head truncation detection and negative-knowledge amendments |
LOCAL; independently retained checkpoint required for truncation claims |
| K02 | Export/restore preserves permitted knowledge/history but no active authority, secrets or descendant proof | src/pack.mjs, test/store-pack.test.mjs, test/journeys.test.mjs: permitted fixture programs, counterexamples and history survive; restore/descendant authority empty and proof absent |
LOCAL for supported JSON fixture artifacts; arbitrary secret detection is not claimed |
| K03 | Unsafe paths, malicious archives, unsupported schemas, excess objects, injected instructions and automatic code execution fail | src/pack.mjs, store/pack and journey tests: JSON-only bounded data, tampering/unsafe paths/credential fields/unsupported fields rejected; public export matches recomputed permitted fixtures |
LOCAL supported JSON path; no archive extraction, imported execution or generic secret-detection claim |
| K04 | Clean restore and declared supplier substitution pass bounded compatibility checks; new supplier needs fresh proof/admission | Discovery/journey tests substitute residual-median estimation for enumeration and reexecute 60 cases; test/cli.test.mjs runs/restores in a clean directory with a separate CLI process |
LOCAL algorithm substitution and clean-directory replay; no external-provider portability claim |
| W01 | Critical journeys work with keyboard, EN/FR, mobile/desktop, reduced motion and project-prefix routing | test/pages/successor.test.mjs, scripts/pages/successor-qa.mjs: semantic parity, keyboard paths, mobile FR, reduced motion, forced colors, accessibility and project prefix |
LOCAL browser/structure checks |
| W02 | Input edits/races invalidate stale exports/claims; untrusted content is safe; fixture labels stay visible | New Pages tests pass for stale asynchronous results, content escaping/inert restored text and denied independent status; browser workbench edits clear prior exports | LOCAL |
| W03 | Existing demos/routes/catalog/flowcharts remain; source diagrams parse/render | Combined-tree rebuild produces 76 demo pages, 353 guides and 267 preserved diagrams; site regression passes 60/60. Browser report covers 48 checks with no diagram failures; source audit passes 504 diagrams and one template target. The stale copied package asset is resolved by the rebuild | LOCAL for built routes and diagrams; deployed Pages revision is a separate check |
| O01 | Worker/provider timeout, restart, revoked credentials or missing artifacts produce bounded failure evidence without secrets | Proof/runtime, proposer and orchestrator bridge tests exercise denial, unknown-outcome restart, bounded provider errors and no automatic retry | LOCAL test adapters / EXTERNAL actual provider commissioning |
| O02 | Failed/blocked checks remain visible; missing external credentials or skipped critical checks are never commissioning passes | test/proof-runtime.test.mjs: live dispatch hard-disabled even when request claims commissioning; this matrix and platform readiness retain external gates |
LOCAL behavior; exact final release dossier still required |
Separate commissioning gates
The local release cannot supply an independent examiner, protected real cases, trusted maintainer or evaluator keys, organizational authorization, provider accounts, professional authority or a deployed worker's actual controls. Track these as separately owned evidence objects with review dates, never fixture substitutes. Existing production readiness gates remain in force, including dependency/security review, signing trust, network configuration, validator recovery and provider migration.
Each release report must identify what runs, what was measured, negative findings, unrun/failed checks, exact commit and remaining external actions. A rejected challenger is a valid mission outcome; an incomplete required test is not a passing release gate.
Validation evidence
Source/test paths in this matrix are relative to packages/successor-core/ unless explicitly stated. Use Node 22.23.3, npm 10.8.2 and locked dependencies. The generated release report's checkout.revision, working-tree state and sourceDigest identify what ran; the release dossier supplies exact commands, exits and final PR head. Intermediate working-tree counts are not a final release certificate and must not be added across overlapping suites.
| Validation command or suite | Evidence scope |
|---|---|
npm run successor:test |
Domain/schema, sealed graph, SEIZE, actual discovery/journeys/examination, proof/runtime, registered dependencies, persistence, packs and CLI |
node --test packages/successor-core/test/examination.test.mjs |
Complete actual WORLD freeze, all 60 reexecuted public cases, signed no-advantage I0 FAIL, tamper rejection, no private keys and denied independent admission; three focused tests passed during adapter review |
npm run successor:verify |
Three local journeys, actual WORLD examination, dependency impairment, fixture action/revocation and knowledge restore/descendant invariants |
npm run build:orchestrator, compiled successor and legacy computer-work test suites |
New outer mission/work-order enforcement plus retained task-v1 behavior |
npx hardhat test --no-compile test/v2/JobRegistry.test.js --grep 'runs successful job lifecycle' |
Actual local-chain settlement of a correctly completed FAIL evaluation without candidate promotion |
| Existing contract, size, documentation, site and diagram gates | Repository compatibility and exact built-asset checks; separate from independent examination or commissioning |
SEIZE records are unsigned commitments: ELEVATE references a candidate digest and grants no authority. The examination adapter separately verifies the complete frozen system. Domain role identifiers do not authenticate a caller. Public export verifies supported fixture identity, source bytes, seals and recomputed results; it rejects customer content or altered metrics relabeled as a public fixture.
Comparison intervals are separate one-sided bounds; the lower bound drives the advantage decision, with no joint two-sided confidence claim. The WORLD fixture explicitly records that independent empirical sampling and real deployment cost are unestablished. Its source commitment and local fixture signature do not authenticate historical execution or external provenance.
Store/pack and institution checks cover real compiled dependencies, fresh-lease denial after source revocation, clean-directory CLI restore, symlink state paths, malformed knowledge expiry, known credential aliases and modified lineage. Live worker isolation, independent custody and production authorization remain outside this local evidence.