Work & continuity

Purpose

This component exists because the riskiest moment in agentic code work is the one that feels safest: the agent runs a few checks, sees no errors, and concludes that its work is finished and committed. Those are different facts. A clean preflight describes the state of the checks. It says nothing about whether a competing claim already owns the same path, whether the branch has moved under the agent, or whether the commit ever actually landed. The single question this module answers is narrow and concrete: what evidence has to hold before a unit of work is allowed to land, and is that evidence checkable rather than asserted?

The interesting design choice is that the module refuses to trust its own declared verdicts. Most fixtures pass when their inputs carry the right labels. It then perturbs the input one field at a time: a same-path claim conflict, a stale expected-parent hash, a checkpoint lane mutated into an unauthorised broad commit. A genuine check has to break under each of those and stay clear under harmless ones, such as a claim on an unrelated path. That asymmetry, not the bare pass, is the claim.

The result is deliberately bounded. A pass means the public fixture, the exported source bodies, and the negative cases together preserve the work-landing contract and that its discriminating tests still discriminate. It does not touch the live work log, the live work log, or Git, and it grants no authority to commit, checkpoint broadly, back up, or launch.

Abstract

mission_transaction_work_spine is the public Microcosm paper module for work-landing discipline. Its telos is to make the boundary between "a check looked clean" and "work is actually allowed to land" inspectable as source, fixture, result record, and test evidence rather than as chat confidence or status arithmetic.

The component validates a fixed public mission-transaction bundle: Work item rows, work log path claims, dependency unlocks, transaction plans, result record drains, completion projections, scoped mutation policy, checkpoint-lane decisions, copied internal control source modules, and metadata-only result records.

The result is intentionally narrow. A pass means the public fixture and exported bundle preserve the mission-transaction contract, its source-open body floor, and its negative cases. It does not mutate work log, work log, or Git; it does not certify arbitrary live completion; and it does not grant broad checkpoint, backup, launch, public sharing, provider, or whole-system authority.

Problem

Agentic code work fails most often at transaction boundaries, not at isolated syntax checks. Common false positives include:

• treating a clean preflight as a landed commit;
• ignoring a competing work log claim on the same path;
• accepting a claim whose expected parent no longer matches the repository;
• marking a downstream Work item ready without hard-dependency evidence;
• reading a dirty tree as a blocker for scoped commits while allowing broad staging without explicit operator authorization;
• writing result records that smuggle private ledger or provider bodies into a public artifact.

The module turns those failures into a deterministic replay. A cold reader can inspect which public rows are projections, which copied source bodies implement the checks, which negative cases must be observed, and which authority claims remain forbidden even when every validator passes.

Shape

flowchart TD Bundle["JSON bundle paper_module.mission_transaction_work_spine"] Fixture["First-wave fixture Work items, claims, deps, lanes, result records"] Bundle["Exported bundle work log, work log, checkpoint, scoped commit, preflight source bodies"] Snapshot["Real work log session snapshot active claims, heartbeat, source hash"] Runtime["Component runtime mission_transaction_work_spine.py"] R3["R3 replay verdict runtime-derived, not label-derived"] Result records["metadata-only result records refs, hashes, counts, limits"] Ceiling["Scope limit no live ledger, git, launch, or provider authority"] Bundle --> Runtime Fixture --> Runtime Bundle --> Runtime Snapshot --> Runtime Runtime --> R3 Runtime --> Result records R3 --> Ceiling Result records --> Ceiling

This Mermaid diagram is the reader flow. The generated lattice Mermaid remains available_from_capsule_edges, and the generated Atlas card remains linked_from_capsule_edges; both are derived from bundle and doctrine-lattice rows, not from this prose.

Technical Mechanism

The component exposes two validator paths.

The first-wave fixture command validates the local replay fixture and writes the canonical result record set:

PYTHONPATH=src python3 -m microcosm_core.organs.mission_transaction_work_spine run \
  --input fixtures/first_wave/mission_transaction_work_spine/input \
  --out receipts/first_wave/mission_transaction_work_spine

That path loads public fixture rows, validates dependency unlocks, claim preflight, scoped result record authority, private-marker rejection, preflight overclaim rejection, checkpoint lane policy, and the real active-claims snapshot.

The exported-bundle command validates source-open import and bundle replay:

PYTHONPATH=src python3 -m microcosm_core.organs.mission_transaction_work_spine \
  validate-mission-transaction-bundle \
  --input examples/mission_transaction_work_spine/exported_mission_transaction_bundle \
  --out receipts/first_wave/mission_transaction_work_spine

That path checks copied work log, work log, checkpoint, scoped-commit, and mission-preflight source modules by manifest, digest, anchor strings, secret-exclusion scan, and body_in_receipt: false. It also requires the real work log snapshot in the mission bundle. Commit da97bc6394 (Require real work log snapshot in mission bundle) landed the snapshot as a required bundle input; later source/test commits recomputed the snapshot verdict and bound the R3 claim to runtime evidence.

Prior Art Grounding

This component is the mission-transaction member of Microcosm's local work-landing family. Its closest sibling is durable_agent_work_landing_replay, which checks recorded landing rows, validation-before-commit ordering, HEAD movement, blocker capture, and work log completion evidence without performing live Git work. mission_transaction_work_spine narrows that pattern to the transaction preflight and work log seed-speed membrane: same-path claim conflicts, expected-parent mismatches, checkpoint-lane selection, dependency unlocks, result record drains, and session finalization posture.

It also supplies a source-import anchor used by adjacent public components such as concurrency_mission_control and macro_projection_import_protocol. Those links are structural evidence routes, not runtime invocation or launch-scope decision. The prior-art claim is therefore local and source-bounded: this paper module inherits the work-landing accounting shape, then tests the particular mission-transaction and work log session-snapshot boundary.

Data And Evidence Contract

The public evidence bundle is composed of source refs, hashes, rows, and result records. The source bodies live only in the exported bundle's source_modules/ tree; result records carry refs, counts, hashes, verdicts, and ceilings, not private or live internal control bodies.

• JSON bundle: core/paper_module_capsules.json::paper_modules[20:paper_module.mission_transaction_work_spine]
• Runtime locus: src/microcosm_core/organs/mission_transaction_work_spine.py
• Fixture input: fixtures/first_wave/mission_transaction_work_spine/input
• Exported bundle: examples/mission_transaction_work_spine/exported_mission_transaction_bundle
• Real snapshot: examples/mission_transaction_work_spine/exported_mission_transaction_bundle/real_work_ledger_active_claims_snapshot.json
• Fixture manifest: core/fixture_manifests/mission_transaction_work_spine.fixture_manifest.json
• Mechanism row: mechanism.mission_transaction_work_spine.validates_public_mission_transaction_bundle
• Standard: standards/std_microcosm_mission_transaction_work_spine.json

The result record floor includes preflight, dependency blocked, work landing attempt, claim preflight, scoped mutation, checkpoint lane, completion projection, dependency unlock scheduler, reconcile plan, and exported-bundle validation result records. The fields must preserve schema and component ids, validator id, command, status, observed and missing negative cases, error codes, scope boundary, secret-exclusion status, public work-landing status, body-import status, body_in_receipt: false, scope limit, and result record paths.

Discriminating Tests

The positive claim is not "the fixture passes." The positive claim is that the fixture accepts real-good evidence and rejects targeted perturbations.

• Real-good case: the real active-claims snapshot passes with R3 public_safe_real_work_ledger_session_snapshot_replay, a state/work_ledger/active_claims_snapshot.json source ref, a matching source hash, a bound session heartbeat, and five source-session claims.
• Same-path perturbation: adding a competing claim on the requested path blocks preflight through work_ledger_runtime.active_claim_collisions_for_paths and emits SAME_PATH_CLAIM_CONFLICT.
• Parent perturbation: changing the expected parent for a real claim blocks with EXPECTED_PARENT_MISMATCH; changing it back to the current parent clears.
• Disjoint perturbation: adding a claim on a disjoint path does not create a collision for the requested path, so the public preflight remains pass.
• Landing-row perturbation: mutating the checkpoint lane into an unauthorized broad checkpoint blocks with the checkpoint-lane violation floor.
• Private-body perturbation: a fixture row that carries live private work log body material is rejected, while source bodies copied into the public bundle remain outside result records.
• Overclaim perturbation: a clean preflight cannot claim that work is already landed.
• Dependency perturbations: dangling dependency refs and ready rows with incomplete hard dependencies remain blockers.

Focused regression coverage lives in tests/test_mission_transaction_work_spine.py. The R3 tests assert that the verdict is re-derived from runtime evidence, expected labels are not sufficient, source hashes are bound, mutated or stale snapshots are rejected, clear perturbations move the verdict, and body_in_receipt is false.

Reader Evidence Routing

Read this module as an evidence-accounting paper, not as a live controller.

1. Open the mechanism row and standard to see the required bundle fields: work items, claim table, dependency graph, transaction plan, result record drain, completion projection, scoped mutation policy, checkpoint lane policy, copied source imports, body import verification, scope boundary, and scope limit.
2. Inspect the real active-claims snapshot to see the source ref, source hash, snapshot time, source session id, owned paths, checkpoint lane case, runtime session, and metadata-only posture.
3. Read the focused tests to verify R3 is runtime-derived: same-path conflicts, stale parents, landing-row violations, disjoint paths, and equal-parent mutations are all discriminated.
4. Treat generated JSON, generated Mermaid, Atlas, public-site docs, and result records as projections or validator outputs.

Limits And Non-Claims

The module's useful claim is compact: public fixture rows, copied control source bodies, a real work log session snapshot replay, discriminating negative cases, metadata-only result records, and focused tests preserve the mission-transaction work spine at R3.

It may not claim live work log authority, live work log authority, live Git mutation, broad checkpoint authorization, private backup execution, current repository completion, source-file changes, provider behavior, browser UI state, launch-scope decision, publishing-scope decision, hosted-product readiness, or whole-system correctness.

Validation Result record Path

For this Markdown-only paper-module update, use non-mutating checks from repo root:

./repo-pytest tests/test_mission_transaction_work_spine.py \
  -q \
  --basetemp=/tmp/microcosm_mission_transaction_work_spine_pytest
./repo-python scripts/build_doctrine_projection.py --check-paper-module-corpus

For a source, bundle, or projection landing, run the owner lane from microcosm-substrate:

PYTHONPATH=src python3 scripts/build_doctrine_projection.py --check-paper-module-corpus
PYTHONPATH=src python3 scripts/build_doctrine_projection.py --check

Do not run --write from this Markdown-only lane.

Durable agent work-landing replay is the public work-spine component for showing how Microcosm treats agent work as a transaction instead of a chat claim. It binds owned-path claims, owner-native validation, scoped commit attempts, protected Git-metadata blockers, work log capture, work log finalizers, and seed reentry into a source-available replay contract.

The component is useful to a cold agent because it turns a landing claim into an evidence checklist: a row is not "landed" unless claimed paths, validation refs, commit-attempt refs, HEAD-before/after evidence, blocker capture, and ledger completion all line up in the recorded replay. It validates the replay contract and the negative fixtures. It does not perform the live landing itself.

Purpose

This component exists because an agent saying "I committed the fix" is cheap, and the claim is the part that tends to be wrong. The single question it answers is narrow: given a recorded landing attempt, does the evidence actually support the words used to describe it?

The approach worth noticing is that two ordinary-sounding rules are made into rejections rather than suggestions. A row that uses landed-commit language is rejected unless the recorded Git HEAD moved between before and after, so "I landed it" cannot stand on a HEAD that never advanced. A row on the commit path is rejected unless validation is recorded as preceding the commit attempt, so "it passed" cannot be back-filled after the fact. Those two checks, plus blocker capture for metadata-blocked rows and work log completion for every row, are what separate a transaction from a chat claim.

The replay is also source-backed rather than described from memory. The mechanics it checks rows against are not paraphrased; the actual source internal control files (work landing, mission preflight, scoped commit, the work log) are copied into the bundle by digest, so a reader can see which code the model was tested against. The component reads that evidence and rejects overclaims; it never runs Git, stages anything, or authorises a launch.

Shape

flowchart LR Fixture["Public replay fixture claimed rows, validation refs, commit attempts, blocker rows"] Source["Copied internal control source bodies work landing, preflight, scoped commit, work log"] Validator["durable_agent_work_landing_replay validator"] Mechanics["Replay mechanics claim before mutation, validate before commit, HEAD movement before landed language"] Negative["Negative floor live Git authority, missing completion, uncaptured blocker, private leakage"] Result record["Result records board, result, validation, sign-off; no live mutation authority"] Fixture --> Validator Source --> Validator Validator --> Mechanics Validator --> Negative Mechanics --> Result record Negative --> Result record

Public Contract

• The source pattern is durable_agent_work_landing_replay_compound.
• The fixture lives at fixtures/first_wave/durable_agent_work_landing_replay/input/.
• The runtime example lives at examples/durable_agent_work_landing_replay/exported_work_landing_replay_bundle/.
• The validator is microcosm_core.organs.durable_agent_work_landing_replay.
• The CLI command is microcosm durable-agent-work-landing-replay run-work-landing-bundle.
• The governing standard is standards/std_microcosm_durable_agent_work_landing_replay.json.
• The component model row is core/organ_atlas.json#durable_agent_work_landing_replay.
• The sign-off row is core/organ_registry.json#durable_agent_work_landing_replay.

Technical Mechanism

The replay fixture imports six source internal control bodies through examples/durable_agent_work_landing_replay/exported_work_landing_replay_bundle/source_module_manifest.json. Those bodies are copied into source_modules/ with digest provenance instead of being summarized from memory:

• system/lib/workitem_runtime_entrypoint.py
• system/lib/work_landing_status.py
• tools/meta/control/work_landing.py
• tools/meta/control/mission_transaction_preflight.py
• tools/meta/control/scoped_commit.py
• tools/meta/factory/work_ledger.py

The validator checks the replay rows against those source-backed mechanics rather than accepting a prose landing claim. validate_projection_protocol requires source pattern refs, projection result record refs, and public runtime refs. validate_landing_policy requires the scoped-commit, broad-checkpoint, metadata-blocked patch-bundle, and hard-stop lanes, with broad checkpointing kept behind explicit operator authorization and launch-scope decision kept false. validate_work_landing_runs enforces claim-before-mutation evidence, validation before commit attempt, HEAD movement before landed language, blocker capture before metadata-blocked completion, dirty-tree boundary evidence, and work log finalizer evidence.

The source-open body floor is enforced separately by validate_source_module_imports. The manifest must declare copied_non_secret_macro_body, body_in_receipt: false, exact-copy source-to-target relations, allowed public source material classes, expected digests, and required anchors inside each copied source body. That check keeps the reader claim tied to actual source internal control files while result records carry only refs, digests, counts, and verdicts.

The result builder merges projection-protocol, landing-policy, work-run, source-module, source-open-body, and secret-exclusion checks into one metadata-only result record set. The board result record records three claimed-path rows, two validation-before-commit mechanics, one metadata-blocked row, one landed-commit row, nine observed negative cases for the first-wave fixture, and zero authority for live Git mutation or launch.

Prior Art Grounding

This component is grounded in provenance and software supply-chain integrity patterns. The W3C PROV family provides a general model for entities, activities, and agents involved in producing an artifact. SLSA brings a similar concern to software builds: source, build process, provenance, and artifact integrity are tracked so consumers can reason about where an artifact came from and how it was produced.

Microcosm borrows that provenance posture for agent work landing: claimed paths, validation refs, commit attempts, HEAD-before/after evidence, blocker capture, Task/work log completion, and seed reentry are separate evidence fields. It does not perform a live Git landing or prove arbitrary commits outside the replay.

Reader Evidence Routing

Read the replay as an evidence-accounting component, not as a live landing controller. The board result record is the primary reader surface: it shows which claimed-path rows carried validation evidence, which rows were blocked by Git-metadata or dirty-tree constraints, and which rows had enough HEAD before/after evidence to use landed language.

Read the source-module manifest as provenance evidence for the imported control plane, not as a permission slip to mutate those source files. The manifest binds the copied bodies by digest and line count so a cold agent can see which mechanics the replay model was checked against.

Read negative cases as the authority floor. Rows that claim live Git mutation, broad checkpoint authority, missing work log completion, uncaptured blockers, launch-scope decision, or non-public paths/body export are supposed to fail. Passing those refusals is part of the positive claim.

Evidence Result records

• receipts/first_wave/durable_agent_work_landing_replay/durable_agent_work_landing_replay_result.json
• receipts/first_wave/durable_agent_work_landing_replay/durable_agent_work_landing_replay_board.json
• receipts/first_wave/durable_agent_work_landing_replay/durable_agent_work_landing_replay_validation_receipt.json
• result records/sign-off/first_wave/durable_agent_work_landing_replay_fixture_acceptance.json

Run the fixture result record refresh from microcosm-substrate with:

PYTHONPATH=src python3 -m microcosm_core.organs.durable_agent_work_landing_replay run --input fixtures/first_wave/durable_agent_work_landing_replay/input --out receipts/first_wave/durable_agent_work_landing_replay

Run the exported bundle validator without mutating durable result records with:

PYTHONPATH=src python3 -m microcosm_core.organs.durable_agent_work_landing_replay run-work-landing-bundle --input examples/durable_agent_work_landing_replay/exported_work_landing_replay_bundle --out /tmp/durable-agent-work-landing-replay

Named Proof Consumers

• First-wave runtime consumer: microcosm_core.organs.durable_agent_work_landing_replay run consumes the fixture input, writes result, board, validation, and optional sign-off result records, and observes the nine negative cases declared in EXPECTED_NEGATIVE_CASES.
• Exported-bundle consumer: microcosm_core.organs.durable_agent_work_landing_replay run-work-landing-bundle consumes the exported bundle without durable result record mutation, validates the source-module manifest, checks copied source-body digests and anchors, and emits the command card path used by runtime-shell demos.
• Scope limit consumer: standards/std_microcosm_durable_agent_work_landing_replay.json, the component AUTHORITY_CEILING, and the fixture negative cases keep live Git mutation, broad checkpoint authority, unrelated dirty-path staging, live Task/work log mutation, external model access, source-file changes, public sharing, launch, non-public body export, and whole-system correctness outside this module.

Negative Cases

The fixture rejects the nine named negative cases in core/fixture_manifests/durable_agent_work_landing_replay.fixture_manifest.json: missing validation evidence, validation recorded after a commit attempt, missing recorded completion, commit-landed language without a HEAD advance, live Git side-effect authority, missing dirty-tree boundary, uncaptured metadata blockers, overbroad distribution claims, and non-public path/body leakage.

Validation Result record Path

./repo-pytest tests/test_durable_agent_work_landing_replay.py -q --basetemp=/tmp/microcosm_durable_agent_work_landing_replay_pytest
./repo-python scripts/build_doctrine_projection.py --check-paper-module-corpus

Route Card

bridge_phase_continuity_runtime is the public, executable synthetic transport continuity membrane for detached bridge work. It lets a cold agent validate the disk-first observe/apply handoff without opening live bridge transport, model-output data, operator HUD/browser state, prompt-shelf bodies, private memory, or active phase runtime state.

Purpose

This paper module exists to make detached bridge continuity testable as a public fixture instead of a trust story about hidden agents or provider sessions. The component asks one bounded question: can a disk-first observe/apply handoff be represented by public synthetic transport inputs, validated through continuation, heartbeat, resource-pressure, resume, worker-skip, and completion result records, and kept below live bridge/provider/UI/source-file changes?

The important mechanism is not "run a bridge." It is a continuity membrane: every claim must pass through explicit packet fields, negative-case checks, metadata-only result record writes, and an scope limit that says heartbeat is liveness evidence, resume is resume evidence, and neither is proof that work landed.

First command:

microcosm bridge-phase-continuity-runtime run --input fixtures/second_wave/bridge_phase_continuity_runtime/input --out /tmp/microcosm-bridge-continuity

Prior Art Grounding

This runtime borrows from durable execution, workflow orchestration, leases, and provenance practice. Useful anchors include:

• Temporal, whose durable-execution model keeps workflow state resumable across process failure and retries.
• Apache Airflow DAGs, which separate task ordering and retry/timeout policy from task internals.
• Kubernetes Lease-based leader election, as a prior pattern for liveness evidence, lease renewal, and failover without confusing a heartbeat with work completion.
• W3C PROV, for provenance records that let readers evaluate how an output was produced.

Microcosm borrows the resumable-workflow, DAG, lease, and provenance shapes, but keeps the component to public synthetic observe/apply fixture sign-off. It does not run live bridge transport, use external model services, prove UI uptime, land work, change source files, or include launch operations.

Primary authority surfaces:

• Runtime: src/microcosm_core/organs/bridge_phase_continuity_runtime.py
• Standard: standards/std_microcosm_bridge_phase_continuity_runtime.json
• Fixture manifest: core/fixture_manifests/bridge_phase_continuity_runtime.fixture_manifest.json
• Source-module manifest: examples/macro_projection_import_protocol/exported_projection_import_bundle/observe_runtime_source_module_manifest.json
• Result record set: receipts/second_wave/bridge_phase_continuity_runtime/*.json

Shape

flowchart TD Inputs["Six synthetic transport inputs detached job, continuation packet, heartbeat rows, resource pressure, worker-skip result record, forbidden terms"] --> Transport["_validate_synthetic_transport_contract"] Transport --> Good{"Valid job? yielded to disk, packet not consumed, fresh heartbeat, phase and continuity match"} Good -->|"yes"| Accept["Positive path accepted"] Good -->|"no"| Refuse["Refusal floor: missing packet, missing fields, duplicate resume, heartbeat claims resume, stale heartbeat overclaim, dispatch blocked"] Refuse --> Codes["Concrete error codes"] Accept --> Fixture["_validate_fixture_contract source digests, completion finalizer, apply-failure rollback, public boundary"] Codes --> Fixture Fixture --> Scan["private_state scan fixture and transport inputs"] Scan --> Result records["Five metadata-only result records continuation, heartbeat, resource pressure, resume, completion transition"] Result records --> Gate{"Tracked result record-write gate"} Gate -->|"env set"| Written["Result records written"] Gate -->|"env absent"| Blocked["tracked_receipt_writes_blocked"] Written --> Ceiling["Scope limit: no live bridge transport, external model access, HUD/browser/private memory, source-file changes, launch, or whole-system proof"] Blocked --> Ceiling

The shape is the public continuity membrane: six synthetic transport inputs are checked for a single valid resumable job and against a refusal floor, the accepted and rejected paths both feed the fixture-contract and non-public-state checks, and only then are the five metadata-only result records written through the tracked-write gate. The result record roles delimit what a reader can trust.

Mechanism Pipeline

The runtime source locus is src/microcosm_core/organs/bridge_phase_continuity_runtime.py. Its public entry point run reads the fixture manifest, resolves public-relative fixture paths, and validates six synthetic transport inputs: detached_job.json, continuation_packet.json, heartbeat_rows.jsonl, resource_pressure.json, worker_skip_receipt.json, and private_state_forbidden_terms.json. JSONL heartbeat rows are streamed by _read_required_jsonl so malformed rows are findings, not a reason to ingest a whole live heartbeat body.

The central validator is _validate_synthetic_transport_contract. It separates five result record roles: continuation packet, heartbeat, resource pressure, resume result record, and completion transition. The implementation then writes the canonical result record set only through the result record-write gate. When the requested output is a tracked result record path and MICROCOSM_TRACKED_RECEIPT_WRITES=1 is absent, the component reports tracked_receipt_writes_blocked instead of silently refreshing tracked evidence.

The negative-case floor is source-declared in EXPECTED_NEGATIVE_CASES and validated from fixture contents. Missing continuation packets, missing required fields, duplicate resume attempts, heartbeat rows that claim resume authority, stale heartbeat overclaims, resource-pressure dispatch blocks, private HUD body leakage, resume-pass work-landing overclaims, and observe/apply validation rollback all become explicit error codes. A pass therefore means the fixture both accepted the positive path and observed the refusal floor.

Reader Evidence Routing

Reader evidence routes from this module to the runtime source locus, fixture manifest, source-module manifest, public result records, and focused regression. A diagram view and an atlas card are generated for this module. This page explains what a reader can infer from them.

What It Proves

The component proves a bounded public fixture contract:

• A yielded synthetic job can be resumed only through an explicit continuation packet.
• Missing packets, missing packet fields, and already consumed packets are rejected.
• Heartbeat rows stay liveness evidence only; fresh or stale heartbeat rows do not become resume authority or provider/UI uptime evidence.
• Resource pressure can block dispatch and must be recorded as a blocked decision.
• Resume success is resume-only; it does not establish work landed without the completion transition result record.
• Worker-skip result records dedupe a no-op without silently closing the claim.
• The fixture and result records stay metadata-only for private/live-state classes.

The reusable mechanism is not "subagents are good." It is the concrete continuity membrane that future agents can run before relying on observe/apply bridge resumption claims.

Source-Backed System

The runtime consumes seven public fixture inputs:

• observe_apply_session_fixture.json
• detached_job.json
• continuation_packet.json
• heartbeat_rows.jsonl
• resource_pressure.json
• worker_skip_receipt.json
• private_state_forbidden_terms.json

The fixture manifest declares five copied source body imports: codex_paths_body_import, markdown_routing_body_import, observe_memory_body_import, observe_surfaces_body_import, and observe_runtime_body_import. The component validates the copied target digests from observe_runtime_source_module_manifest.json; result record output keeps those bodies out of result records and records digest verdicts instead.

Result record Floor

A passing run writes five canonical result record roles:

• continuation_packet.json
• heartbeat.json
• resource_pressure.json
• resume_receipt.json
• closeout_transition.json

Each result record carries organ_id, fixture_id, validator_id, checker_id, status, continuation_packet_status, heartbeat_status, resource_pressure_decision, resume_once_status, duplicate_resume_rejection, worker_skip_receipt_status, private_state_scan, authority_ceiling, anti_claim, and the full result record path set.

The runtime also enforces tracked result record-write gating. A direct run to tracked result record paths without MICROCOSM_TRACKED_RECEIPT_WRITES=1 reports tracked_receipt_writes_blocked rather than mutating tracked evidence silently.

Negative Cases

The expected negative-case floor is source-declared in the runtime and manifest:

• missing_packet_duplicate_resume_and_resource_block
• continuation_packet_missing_required_fields
• heartbeat_claims_resume_authority
• bridge_packet_private_hud_body
• stale_heartbeat_overclaims_liveness
• resume_success_overclaims_work_landed
• apply_validation_failure_rolls_back_observe_promotion

The current result record error-code set includes MISSING_CONTINUATION_PACKET, MISSING_CONTINUATION_PACKET_FIELDS, CONTINUATION_PACKET_ALREADY_CONSUMED, HEARTBEAT_NOT_RESUME_AUTHORITY, STALE_HEARTBEAT_LIVENESS_CLAIM, RESOURCE_PRESSURE_DISPATCH_BLOCKED, BRIDGE_PACKET_PRIVATE_HUD_BODY, RESUME_PASS_OVERCLAIMS_WORK_LANDED, and OBSERVE_APPLY_VALIDATION_FAILED.

Validation Anchors

Focused tests:

./repo-pytest --host-pressure-policy=warn tests/test_bridge_phase_continuity_runtime.py

Source-form runtime:

cd microcosm-substrate && PYTHONPATH=src python3 -m microcosm_core.organs.bridge_phase_continuity_runtime run --input fixtures/second_wave/bridge_phase_continuity_runtime/input --out /tmp/microcosm-bridge-continuity

Compact card:

cd microcosm-substrate && PYTHONPATH=src python3 -m microcosm_core.organs.bridge_phase_continuity_runtime run --input fixtures/second_wave/bridge_phase_continuity_runtime/input --out /tmp/microcosm-bridge-continuity --card

Validation Result record Path

./repo-pytest --host-pressure-policy=warn tests/test_bridge_phase_continuity_runtime.py -q --basetemp=/tmp/microcosm_bridge_phase_continuity_runtime_pytest
./repo-python scripts/build_doctrine_projection.py --check-paper-module-corpus

concurrency_mission_control imports the real self-indexing-cognitive-system/src/idea_microcosm/concurrency_mission_control_specimen.py source builder plus its public provider-canary and work log bridge artifacts as exact source copies. The component runs the copied builder in a temporary public seed root, then checks the transaction failure matrix, authority membrane, and a public work log seed-speed topology fixture. The work log code body itself is consumed through the existing mission_transaction_work_spine source-body import surfaces rather than duplicated here.

The component is deliberately narrow: it demonstrates fail-closed transaction gating for synthetic multi-agent lanes, not private mission-control runtime, external model access, live scheduling, production concurrency safety, hosted orchestration, or launch-scope decision.

Purpose

When several agents work the same repository at once, the dangerous moment is not a crash. It is a quiet one: two lanes edit the same generated file, or one lane commits work whose owner has not finished, and nobody notices until the state is already wrong. This component exists to make that moment a checkable verdict rather than a judgement call.

The single question it answers is: given a dirty path and the live claim topology around it, is acting on that path safe, and if not, what must happen first? The answer is never "probably fine". Each case resolves to a named classification and one allowed action, so a lane can decide whether to proceed, hand off, or wait.

What is unusual is where the evidence comes from. Rather than re-implementing a scheduler, the component runs the real source mission-control builder over public synthetic lanes and reads a public snapshot of the work log's seed-speed topology: who holds which claim, whether their heartbeat is current, and where path claims collide. The most pointed part is the pair of classifier lenses. The closure-state lens then folds in validation, commitability, and residual evidence to say whether a piece of work is genuinely closed or only looks closed. Both lenses default to the cautious verdict when the evidence is thin, which is the behaviour the page is really about.

Prior Art Grounding

This component borrows from workflow DAGs, lease-based coordination, atomic commit protocols, and CI concurrency controls. Useful anchors include:

• Apache Airflow DAGs, for representing tasks, dependencies, retries, and scheduling separately from task internals.
• Kubernetes Lease-based leader election, as a prior pattern for lease holders, renewals, and failover-sensitive internal control coordination.
• IBM Research on two-phase commit, as a transaction-consistency pattern for distributed participants under failure.
• GitHub Actions workflow syntax, for declared workflow concurrency and job orchestration controls.

Microcosm borrows the DAG, lease, commit-gate, and workflow-concurrency shapes, but keeps the component to fail-closed synthetic multi-agent transaction gating. It does not claim private mission-control runtime, external model access, live scheduling, production concurrency safety, hosted orchestration, or launch.

Shape

flowchart LR Builder["Copied source builder run in temp seed root: mission board, bridges, result record"] Bridge["Public bridge artifacts provider canary and work log cap economy"] Seed["work log seed-speed snapshot claims, heartbeats, collisions, session cards"] subgraph Engines["Six engines (all must pass)"] Matrix["failure_matrix_gate conflict, duplicate run, dependency, lease, result record, finalizer visible"] Membrane["bridge_authority_membrane bridges green, authority-collapse zero, forbidden claims blocked"] SeedGate["work_ledger_seed_speed_gate heartbeat current, path claims collision-free"] SurfaceLens["generated_surface_claim_lens dirty generated file: owner live / stale / absent -> allowed action"] ClosureLens["closure_state_lens closed and committed, validation deferred, or open and unclassified"] end Negative["Negative floor missing seed root, blocked bridge, authority collapse, private runtime, claim collision"] Result record["metadata-only result records refs, digests, anchors, counts, verdicts; no session or proof bodies"] Builder --> Matrix Builder --> Membrane Bridge --> Membrane Seed --> SeedGate Seed --> SurfaceLens Seed --> ClosureLens Engines --> Negative Negative --> Result record

Engines

• mission_transaction_original_builder dynamically loads the copied source builder and emits the mission board, provider repair bridge, work-metabolism bridge, residual replay bridge, and result record.
• failure_matrix_gate checks that owner-path conflicts, duplicate command runs, dependency gaps, stale leases, missing result records, supervised-scope gaps, missing parent finalizers, and misanchored claims all remain visible.
• bridge_authority_membrane checks that bridge statuses are green while authority-collapse counters remain zero and forbidden claims stay blocked.
• work_ledger_seed_speed_gate checks that public session heartbeat, seed-speed status, mutation-check commands, multi-session/claim counts, and collision-free path-claim rows are present without exporting private work log session bodies.
• Each classification carries the single allowed action, so the verdict is what a lane should do, not just what it observed.
• closure_state_lens decides whether a unit of work is genuinely closed. It folds the generated-surface classification together with validation state, commitability, and any open residual, separating closed_and_committed from the cases that only look done: closed_validation_deferred (validation parked under host pressure), closed_uncommitted_authority (event authority exists but shared append logs are unsafe to stage), false_residual_stale (a residual left open against a passing generator check), or open_unclassified when the closure evidence is simply insufficient. The default is the last of these, so absent evidence never reads as success.

Reader Evidence Routing

Read this module as a coordination-evidence membrane, not as a live scheduler. Start with paper_modules/concurrency_mission_control.json for the full structured binding, then open standards/std_microcosm_concurrency_mission_control.json for required copied-body counts, negative cases, result record fields, and the public/private boundary.

Open core/fixture_manifests/concurrency_mission_control.fixture_manifest.json and examples/concurrency_mission_control/exported_concurrency_mission_control_bundle/source_module_manifest.json before inspecting copied source modules. The manifest floor names one source builder body and six public bridge artifacts; result record payloads should carry source refs, hashes, anchors, counts, verdicts, and omission result records, not body text.

Read the work log seed-speed topology as a public coordination fixture. It can show heartbeat participation, mutation-check commands, session and claim counts, and collision-free selected rows, but it cannot export private work log session bodies or authorize live scheduling.

Negative Cases

The fixture carries stable cases for missing seed roots, blocked provider bridges, authority-collapse claims, private runtime overclaims, and unresolved work log seed-speed claim collisions. If focused validation reports an exact-copy source-module body mismatch, route that repair through microcosm_exact_copy_refresh; do not treat this Markdown projection as source authority for copied source bodies.

Validation Result record Path

From microcosm-substrate, validate with throwaway result record outputs first:

A diagram view and navigation card are generated for this module from its declared component, mechanism, concept, principle, axiom, dependency, and code-locus relationships. Fixture and bundle passes prove only public fail-closed coordination evidence over the declared copied bodies and synthetic fixtures. Source-copy digest drift belongs to microcosm_exact_copy_refresh; shared lattice projection drift belongs to the live projection owner lane.