Prove what your
AI agents did.

Better score ≠ safe candidate

Candidate admission requires composite-score improvement, real-efficiency improvement, and no protected-metric regression.

• P99 latency must not regress
• Error rate must not increase
• Throughput and cost efficiency must not fall
• Audit completeness must not fall
• Human override rate must not increase
• Previously passing SLA and zero-data-loss guarantees must not regress

QUBO / Ising needs formal encoding

Integer-based deterministic search can evaluate formally encoded QUBO/Ising problems. Natural-language hints without the required encoding do not become executable solver input.

Shard progress and whole-space proof are separate states; one shard cannot claim a global optimum before the full search boundary is established.

Optimizer result is not the final proof

Cinema uses Z3 to obtain a candidate, applies deterministic tie-breaking, then creates a separate proof obligation asking whether any assignment exists with strictly lower energy.

• UNSAT → VERIFIED_GLOBAL_OPTIMUM
• better witness found → COUNTEREXAMPLE_FOUND
• timeout → VERIFICATION_TIMEOUT

Only the UNSAT proof path yields verified=true for that bounded encoded problem.

Simulation cannot promote itself

The promotion boundary requires the approved plan hash, baseline/candidate commit binding, allowed paths, plan alignment, passed constraints/tests/build, objective improvement, required evidence, and independent Cinema proof.

Required evidence includes commit, metric, test output, and build output. Candidate commit and Cinema proof binding must agree before promotion can be authorized.

No evidence, no join

Parallel lanes move through an explicit state machine and must satisfy join requirements before the wave can complete.

Join checks require a joinable state, commit SHA, evidence, and no blockers. Missing evidence in one required lane can block the wave rather than silently merging partial success.

Executor and verifier have different powers

Remote Browser sessions bind to an approved plan, approved step, and agent identity. Mutation-capable controllers are separated from verifier-side observation.

Plaintext passwords, OTPs, API keys, passkeys, private keys, secrets, and MFA codes are not intended to travel through the model/evidence path. Delegation uses opaque references such as secret_ref and otp_ref.

Remote endpoints require HTTPS, reject localhost/private-address targets, validate DNS against SSRF-style private resolution, and seal session tokens with expiring AES-GCM protection.

Deploy success is not the end state

Production evidence feeds a monitoring decision while mutation authority remains separate.

Monitoring is observation-only; the canonical authority owns execution. An unbound provider or disabled production-deploy capability fails closed instead of being represented as deployment success.

Current rollback adapter scope is bounded to declared providers such as AWS, GCLOUD, and DOCKER with HTTPS endpoint requirements.

AI proposes the spare; deterministic infrastructure decides.

DSG-Agent-v0 can diagnose failures and call repair.synthesize to propose bounded repair candidates. The model has proposal-only authority.

Missing authoritative input fails closed. Repair identity and evidence are bound with canonical SHA-256 data; no direct model-to-provider repair path is allowed.

Management credentials, traces, and Realtime stay in separate boundaries.

Scoped Supabase PATs are management-plane credentials for the Management API / Supabase MCP only and are not Realtime user/session credentials.

Realtime subscriptions remain project/session authenticated with RLS, explicit schema/table selection, row filters, and selected-column minimization. Missing authoritative schema or permission data must fail closed rather than trigger speculative DDL/publication changes.