0:00 · certification key

Two axes. One bounded claim.

D5 DESIGN · independently reimplementable from the tracked package.
E6 EVIDENCE · independently reproduced by a separate clean-context reviewer.

Project-local evaluation labels—not external accreditation or a production-readiness guarantee.

0:05 · architecture

One service. Two surfaces.
One honest boundary.

REST and MCP share RecommendationService. Guarded read-only upstreams feed strict policy enforcement; SQLite atomically reserves session budget.

Certified v0 boundary: one active replica and one same-machine SQLite locking domain.

0:10 · live CLI

Audited partner-aware recommendations

The annotation pane stays separate from the live terminal. Partner policy audit and cruise exclusion remain fully visible.

0:55 · dependency failure

Fail closed, then recover

Three failures open the circuit; the fourth request fails fast. Cleanup and a half-open success prove recovery.

1:40 · final slot

The check and write are one transaction

The unobstructed pytest capture shows the cross-process proof: grants `[0,1]` and persisted usage equals the cap.

2:35 · AI pushback

A plausible shortcut can still violate the invariant

The unsafe AI suggestion reads “remaining,” returns control, then increments in another query. Two processes can both see the final slot.

Never build or claim distributed guarantees that have not been engineered and verified.

2:40 · certified integration

Council discovered. One lead resolved.

A read-only Grok council inspected five PR conflicts. One lead writer serialized the fixes, preserved immutable Gate 6 history, and merged only after 132 tests and the offline bootstrap passed.

D5 design remains independently reimplementable; E6 evidence remains independently reproduced. There is no D6 tier.