Wiki · Architecture & Decisions
Phase 5 — RESULTS
How to read this page
Three ways to read this page. Precise is the document itself, exactly as it is written in the repository. Plain and Clear were written for this website to help you meet that document — they are about it. They are not it, and they are not evidence.
This is the design record of the part of the estate whose job is to stop the rest of it claiming more than it has measured. It runs to architecture notes, numbered decision records, phase plans, and the results written after each phase ran.
It is for anyone curious how a decision was actually reached — what was considered, what was refused, and what the refusal cost. The decision records are the most durable part: each names one choice, the alternatives, and the consequence accepted in exchange. The failure-modes page is worth the detour, because it states each refusal as something you could go and test rather than as a promise.
Read the architecture page first. It opens by declaring itself part design and part built, which sets the tone for the whole section. Then the first decision record, then whichever phase interests you — read as a pair, the plan and the results page written afterwards, including the phases where a premise turned out to be wrong and the receipt says so.
What it is not: a description of running software, and not a complete record. Three documents from this area were withheld from publication, because they describe private infrastructure or the operator declined them; they are listed as withheld rather than quietly dropped, so you can see that they exist.
Your browser cannot switch reading levels, so the document itself is shown.
Precise — the source document
This is the document. Rendered from the repository at the commit above, with nothing rewritten for the web. A gate re-renders it on every deploy and fails the build if a single byte differs.
Status: EXECUTED 2026-07-26 · Plan: PHASE-5.md
Repo: UNI.Minecraft gen2-runtime — 8c7940c (5.0) · 1ee1533 (5.1) · 915bfbb (5.2–5.6)
Receipts: docs/receipts/control-plane/phase5_*
Bound honoured: no row written to evidence/gates.ndjson · no P-level moved · mc_test.exs untouched · mix.exs unchanged · GAIA LAW intact.
0. Headline — item 5.0 earned its place on the first attempt, and the fleet answered a question I had got wrong
Phase 5 opened by checking three premises against a live read before building on them, because four had been wrong on contact, one per phase.
One premise was false, and so was the plan's own fallback for it. Then the operator stabilised L2 and instructed both approaches — and the false premise became true for a reason that is mechanically checkable rather than hopeful.
Control Plane suite 238 tests, 0 failures Full suite 792 tests, 0 failures
Gaia 12 PASS / 0 FAIL · 11 seats · 10 drift signals · lint 0 violations
1. Disposition
| # | item | disposition |
|---|---|---|
| 5.0 | check three premises first | DONE. Two confirmed, one false — and the fallback false too. §2 |
| 5.1 | Witness — an anchor the writer cannot reach |
DONE. Phase 4's tamper attack now fails. §3 |
| 5.2 | the first real Control Plane ledger | DONE. Seven entries, its own history, adverse results included. §4 |
| 5.3 | gaia_lint proven to bite before the seat |
DONE. Inverse-polarity check, 10 violations across 5 checks. §5 |
| 5.4 | a Gaia seat projecting the ledger verbatim | DONE, after my premise check turned out incomplete. §6 |
| 5.5 | the seat surfaces the residual, two-sided | DONE. Two like-for-like drift signals, one deliberately absent. §7 |
| 5.6 | inherited mix format |
STANDING KNOWN-FAIL, unchanged, lib/sp/brain/language.ex untouched. |
2. ADVERSE — a premise was false, and so was its pre-registered fallback
PHASE-5.md §0.1 assumed a second machine could hold an anchor the writer cannot
reach. docs/GAIA.md had already said otherwise, months earlier:
the default target is the colony host — the only box THINKER can ssh-write unattended (node2 is chronically unreachable; MCP writes are approval-gated). That is a second failure domain, not a fully independent custodian.
And the plan's fallback — "fall back to a signed anchor" — was also false: a signature is only as good as its key's custody, and the key would live on the writer's machine. A signature the writer can produce is not a witness. That is a fifth premise wrong on contact, and the first where the fallback was wrong too.
3. Item 5.1 — the operator stabilised L2, and the answer changed
Measured from THINKER, with a negative control, because a refusal alone proves nothing:
offbox:node2 port22=OPEN writer_can_write=false "Permission denied (publickey,password)"
control:chip port22=OPEN writer_can_write=true
git head=8c7940cc branch=gen2-runtime
node2 is L2 — the registry already carried mcp_limb: "uni-lab-79740c".
Reachable to read, refused to write. The chip accepting the same key is what
turns node2's refusal into evidence rather than a broken probe.
A distinction the fleet forced, found before the red run
Item 5.1 was planned around "cannot reach", which collapses two properties:
- unforgeable — the writer cannot write there at all. node2.
- tamper-evident — the writer can, but visibly, and prior history survives elsewhere. git.
Under a single strict rule, git + L2 would be one independent custodian and
would not corroborate — contradicting my own test. So corroboration requires
two distinct domains AND at least one unforgeable custodian. git + L2
corroborates; git + chip does not.
Phase 4's tamper attack now fails. Truncate the store, re-anchor to the
truncated state, and Store.attest/1 still passes — that has not changed. The
witness is what convicts it.
The claim is tamper_evident and there is deliberately nothing stronger.
node2's refusal is a current configuration fact, not a structural law; one key
in its authorized_keys ends it silently, so the probe re-measures every capture.
Two more of mine, recorded
- I broke
gaia-no-ip-literalby hardcoding three addresses in the probe — the exact trap that gate exists for, since a stale literal once pointed the Door at a dead host while the colony was live. Rewritten to name boxes and read their planes from the registry at runtime. - A test was wrong while the code was right. It asserted that a custodian with
a different head and a shorter length is
:forked. With real anchors a genuinely lagging custodian always has a different head — the head at its own length. Length decides. Corrected with the reasoning, not silently flipped.
4. Item 5.2 — capability became practice
Phase 4 gave this body a store and it never used one. Seven entries now record what the programme actually did: every phase, its red and green commits, its receipt, and its adverse result.
What makes "real" mean something is that the tests reach outside the file: every commit named must exist in git; every piece of evidence must exist and rehash to the recorded digest; the ledger records its own construction; and a test asserts the adverse results are present, because a ledger of only green ones is a highlight reel.
Anchor: head 94485ef7…, length 7, attests clean, corroborated across git and
offbox.
5. Item 5.3 — the lint was proven to bite before the seat existed
A lint never seen to fail is a lint nobody has tested; "0 violations" then means
"it ran". verify_lint_bites.cjs runs gaia_lint against a committed summarizing
fixture with inverse polarity — a PASS there is a FAILURE here.
10 violations across 5 checks, including the forbidden token in the signal id, so a seat cannot smuggle a rollup in by naming it. GAIA LAW is mechanically enforced.
6. ADVERSE — my premise-3 check was incomplete, and the system caught it
Premise 3 found three declaration sites, because it read the verification
gate's requirements. There is a fourth: sig.cjs's SEATS allowlist, which
refuses at construction. The seat threw on first render.
The seat pattern is stricter than my check credited, not weaker — but the check was still incomplete, and an incomplete premise check is the thing item 5.0 exists to prevent. Recorded so the next seat starts from four.
7. Item 5.5 — two drift signals, one deliberately absent
drift.control_plane_anchor_git— anchor in the working tree vs atHEAD. Like-for-like, object against object, so unlike four of the slice-1 pairings this one can converge andequal=truewill mean what a reader thinks.drift.control_plane_anchor_offbox— relationabsent, deliberately. Placing the anchor on node2 needs an approval-gated write: a co-sign the writer cannot produce, which is exactly what makes node2 a witness. "Not yet placed" is the honest state, and faking it would destroy the property it reports.
8. Falsifiers
| item | falsifier | fired? |
|---|---|---|
| 5.0 | an item is built on an unchecked premise | no — and the check caught the false one |
| 5.1 | the tamper attack still succeeds, or the witness lives where the writer can rewrite it | no |
| 5.2 | the ledger is a demo fixture, or written by hand | no |
| 5.3 | the lint passes a summarizing fixture | no |
| 5.4 | any Gaia-derived count, rank, rollup or verdict appears | no — lint 0 violations |
| 5.5 | a disagreement renders as a single true/false | no |
| 5.6 | the reformat is buried inside an evidence commit | no — not done at all |
9. Verification
| command | result |
|---|---|
mix test |
PASS — 792 tests, 4 doctests, 0 failures |
mix test test/sp/control_plane |
PASS — 238 tests, 0 failures |
mix format --check-formatted — Control Plane |
PASS |
mix format --check-formatted — repo-wide |
standing known-fail, item 5.6 |
git diff mix.exs |
empty |
evidence/gates.ndjson |
964ea25c… unchanged |
verify_gaia.cjs |
PASS — 12 checks, 11 seats, 10 drift signals |
gaia_lint.cjs |
PASS — 0 violations |
verify_lint_bites.cjs |
PASS — the lint refuses a summarizing seat on every check |
mc_test.exs · language.ex |
untouched |
10. Standing state
P8 = FULL_PARITY = false, first unsatisfied rung P4, irreducibly external.
nursery-fenced-red-stocked remains FAIL, falsified 2026-07-19.
No verdict has been authored about any real scientific claim. The Control
Plane now records its own history; it has adjudicated nothing.
11. Next act
PHASE-6.md — rooms, airlocks and keys. Phase 5 is complete only
because that plan exists (ORCHESTRATE-RULES.md §1).
sha256 4907eaa8a7a63b0b — of the original file, so what was ingested stays checkable.
Plain — written for this website, not the source document
This records the fifth phase, and its headline is that the item which checks premises before building on them earned its place on the first attempt.
One premise was false — and so was the plan's own fallback for it. The plan had assumed a second machine could hold an anchor the writer cannot reach; an existing document had said months earlier that this machine was a second failure domain rather than a fully independent custodian. The fallback, signing the anchor instead, was false too, because the key would live on the writer's own machine, and a signature the writer can produce is not a witness.
What changed the answer was the operator stabilising another machine. It is measured with a negative control, because a refusal on its own shows nothing.
The claim that results is stated as tamper-evident and deliberately nothing stronger, because the refusal that makes it work is a current configuration fact rather than a structural law, and is re-measured on every capture.
Plain · written 2026-08-01 by claude-opus-5 · not yet checked by a person · about the document whose sha256 is 4907eaa8a7a63b0b
Clear — written for this website, not the source document
This page reports the fifth phase against its plan, written down beforehand, naming the commits, the receipts recording what was run, and the bound honoured.
The headline: the item which checks premises before building on them earned its place immediately. One premise was false, and so was the plan's fallback. Then the operator stabilised another machine, and the false premise became true for a reason that is mechanically checkable, not hopeful.
The adverse section is precise about the failure. The plan had assumed a second machine could hold an anchor the writer cannot reach. An existing document had said, months earlier, that the usual target is the only box the writer can write to unattended — a second failure domain, not a fully independent custodian. The fallback of signing the anchor was false too: a signature is only as good as its key's custody, and the key would live on the writer's machine, so a signature the writer can produce is not a witness.
The witness section reports a live measurement taken with a negative control, because a refusal on its own shows nothing. One machine is reachable to read and refuses to write, while another accepts the same key — which turns the refusal into evidence rather than a broken probe. The phase then draws a distinction the situation forced: between a custodian the writer cannot write to at all, and one the writer can write to but only visibly, with prior history surviving elsewhere. Corroboration is defined as needing two distinct domains and at least one of the stronger kind. The claim is stated as tamper-evident and nothing stronger, because the refusal is a current configuration fact rather than a structural law, and one added key would end it silently — so the probe re-measures on every capture.
Two further self-reported errors are recorded. The author broke a standing gate by hard-coding addresses in the probe — the exact trap that gate exists for — and rewrote it to read them at runtime. And a test was wrong while the code was right: it assumed a lagging custodian would have a different head as well as a shorter length, when a genuinely lagging one always has a different head. It was corrected with the reasoning, not silently flipped.
The ledger item — the list only added to — is reported as capability becoming practice. Several entries now record what the programme actually did, each with its commits, its receipt and its adverse result. What makes the word real mean something: the tests reach outside the file. Every commit named must exist. Every piece of evidence must rehash to the recorded digest. And a test asserts the adverse results are present, because a ledger of only green ones is a highlight reel.
The linter was shown to bite before the seat existed, using a committed summarising fixture checked with inverse polarity, so a pass there is a failure here. A further adverse result records that the author's own premise check had been incomplete: it found three declaration sites where there are four, and the seat threw on first render. The pattern is stricter than the check credited, but an incomplete premise check is what the first item exists to prevent.
Two drift signals close the work, one deliberately marked absent, because placing the anchor needs an approval the writer cannot produce — which is what makes that machine a witness. Tables of failure signs and verification follow, ending with the same sentence as earlier phases: no verdict has been authored about any real scientific claim.
Clear · written 2026-08-01 by claude-opus-5 · not yet checked by a person · about the document whose sha256 is 4907eaa8a7a63b0b