Status and evidence
This page is the public entry point to the engineering status ledger. It exists so a capability claim can be checked instead of inferred from a diagram, a plan, or a changelog.
Claim rule
A claim becomes shipped-accepted only when the ledger records:
- A source entry point and commit.
- A test, benchmark, recovery drill, or hosted-acceptance artifact.
- The deployment profile and dependency assumptions.
- An owner and verification date.
- Known limitations and a review/expiry date.
If any of those are missing, the claim stays provisional, proposed, or unknown. A passing local test is not hosted evidence. A merged PR is not an acceptance record. An accepted contract shape is not a running implementation.
Status vocabulary
| Label | Ledger class | Meaning |
|---|---|---|
| IMPLEMENTED | shipped-local | Implemented and locally evidenced. Not hosted, HA, or production readiness. |
| PROVISIONAL | provisional | A seam or contract exists; evidence, review, or a gate remains open. |
| PROPOSED | design-intent | Specified or designed only. No runtime or acceptance evidence. |
| DEFERRED | deferred | Intentionally outside the current dependency set. |
| UNKNOWN | unknown | Evidence is missing or expired. Treat as unverified. |
The same vocabulary is used by page banners across the documentation.
Current baseline
| Area | Status | Must not be inferred |
|---|---|---|
| Auth and proxy foundations | IMPLEMENTED | Hosted HA or a measured proxy SLO. |
| Management API · tenant routes | IMPLEMENTED | Operator sessions, hosted readiness, generated-client completeness, or production integration. |
| Rate limiting | IMPLEMENTED | Hosted Redis HA or a measured latency SLO. |
| Provider routing, breakers, and fallback | IMPLEMENTED | A hosted provider-conformance matrix or streaming release soak. |
| Proxy p99 and benchmark gate (GAP-004) | PROVISIONAL | p99 ≤20 ms is a target, not a measured hosted SLO; the Go gate is mean-based. |
| Provider and tokenizer packages | IMPLEMENTED | A model name is a capability contract. |
| Memory substrate | IMPLEMENTED | Typed projections, deletion certification, or production isolation. |
| Context assembly | PROVISIONAL | Caller authentication and the deadline boundary are complete. |
| Extraction workers | PROVISIONAL | Queue durability, live model quality, or exactly-once projection effects. |
| MCP memory tools | PROVISIONAL | Logging-only audit is evidence-grade audit. |
| MCP operator gateway | IMPLEMENTED | PolicySnapshot resource evaluation, durable audit, hosted support, or operator readiness. |
| Budget, usage, and cost | PROVISIONAL | Complete extraction usage export, invoice reconciliation, or hosted enforcement evidence. |
| Evidence plane and relay | PROVISIONAL | A production sink, request authentication, tenant allowlist, or acknowledgement authority. |
| Operator Console · live reads | PROVISIONAL | Login, mutation surfaces, hosted two-tenant evidence, or full accessibility certification. |
| Operator Console · workflows | DEFERRED | Sessions, replay, incidents, directives, actions, drift, and cost views are fixture-only or deferred. |
| Streaming hardening | PROVISIONAL | Slow-client, bounded-buffer, leak, and provider-error soak evidence. |
| Production operations and recovery | PROPOSED | A production origin, passing RPO target, PITR proof, or E1–E4 release evidence. |
| DecisionService and GLiNER | PROPOSED | Any runtime, benchmark, registry, or acceptance evidence. |
| Graph, A2A, marketplace, sandbox | DEFERRED | Current dependencies or committed dates. |
Accepted contract shapes
Five G0 contract shapes were accepted on 2026-10-10 by Rick1330 acting across all owner roles. The accepted scope is contract text and safety semantics only; runtime seams remain provisional. No independent reviewer is named. Review or expiry is 2026-11-10, or earlier on a material profile or authority change.
The acceptance does not cover a repo-wide principal migration, durable budget reservation, provider manifests, typed memory lifecycle, MCP governance, control-plane effects, production ClickHouse delivery, hosted recovery, or exactly-once effects.
The honest short version
- Local implementations exist for auth, the proxy path, the Management API, rate limiting, provider routing, and the memory substrate.
- Context, extraction, MCP memory, budgets, evidence, streaming hardening, and live Console reads remain provisional.
- Console workflows remain deferred. Sessions, replay, incidents, directives, actions, drift, and cost views are fixture-only or route to a deferred state. The temporary
services/dashboardshell is not the canonical product. - No hosted p99 SLO exists. Do not repeat the 20 ms target as a measured result.
- Tenant isolation is defended in depth but not fully proven end-to-end.
- Typed memory lifecycle and a revision ledger are open (GAP-007).
- Production, HA, and restore claims are unsupported.
Evidence map
- Benchmarks — published local benchmark artifacts.
- Releases — changelog history.
- Security — fail-closed and isolation rules.
- Memory — what the substrate does and does not prove.
- Context assembly — provisional pipeline and limitations.
Engineering source: engineering/architecture-v2/00-status-and-evidence.md and engineering/architecture-v2/18-gap-register.md in the repository.