Nishi Family › Compare › Capability Registry and Artifact Lifecycle
Nishi Compare · capabilities, evidence and delivery
Capability Registry and Artifact Lifecycle
Compare capabilities and delivery evidence. Source discovery, qualification, deployment and accepted outcomes are separate; an open contract names work still to verify.
One call answers where any unit stops on the chain source-built-promoted-registered-authorised-invoked -- and this page leads with the three ways that is weaker than it sounds. THREE censuses returned THREE DIFFERENT DENOMINATORS for the same estate and nothing joined them; CR1 nx_capsweep now does, gated 16/16 and bite-proven. But the join's first act was to indict one of the three: 2048 was never a population, it is the table cap WC_MAXT reached EXACTLY, and its own truncation counter is printed one section BEFORE the scan that would increment it, so it can only ever read as an all-clear. The honest count is a FLOOR of 2418 from enumerators that loop to exhaustion, and even that walks two of the estate's THREE artifact roots -- buildroot/_offc holds 73 more elfs nothing censuses. The estate still cannot state its unit count; it can now state the bound and name what is missing from it. Kind declaration is the figure this board published WRONG and corrected in the same session: the census prints 24 permil, 51 of 2048, but filed estate finding 1785467176 proves that counter tallies only the daemon and lib subset rather than declarations, and the emitter's own skip count puts declared registered tools at 646 of 1364 instead. And the in-toto attestation exporter is real, signed and live, but its subject is an evidence frame and NEVER an organ binary, so every promoted artifact ships unattested. Verdict: the MEASURING is genuinely ahead of the field on drift and dark-surface honesty; the INVENTORY and the ATTESTATION SUBJECT are where it is behind.
Overview
The purpose, declared position and evidence coverage of this domain. Source presence and completed acceptance are different measures.
Where we are. MEASURED 2026-08-28 by running every named organ in one session, nothing inherited. WHAT IS REAL: a per-unit lifecycle chain whose verdict is the weakest link (nx_catalog, six stages, LIVE with_gaps=0 on the probe); a serving-drift census that reconciles (distinct 1295, identical 1097, stale 140, BEHIND 122 versus AHEAD 18, nobuild 30, stagedptr 28, sum 1295) and that splits by REMEDY rather than by difference; an execution-surface census over five surfaces plus 937 fork edges (organs 2418, on_surface 1046, ref_only 113, dark 1259, sum 2418); a wiring census that publishes DARK 301 of 1364 registered AS AN UPPER BOUND with its two named reasons; an UNEXPOSED triage of 1005 promoted-but-callable-by-nobody artifacts that sums exactly (677 oracle plus 26 daemon plus 6 plan-invoked plus 296 unclassified); a capability-loss ruler wired into promote; and a live in-toto ITE-6 exporter with ed25519 and a Merkle signed tree head. WHAT IS NOT: nothing joins the three censuses, so the estate cannot state its own unit count; kind declaration coverage is a number this plan PUBLISHED WRONG and corrected the same session (the census prints 24 permil / 51 of 2048, but estate finding 1785467176 proved by controlled change that this counter tallies only the daemon and lib subset, and the emitter's own skip count puts declared registered tools at 646 of 1364); no bill of materials exists in any format (nx_absent over the corpus returns the token CycloneDX exactly twice, both inside a gate declaring the gap); no unit names an owner; and NO ORGAN BINARY IS EVER THE SUBJECT OF AN ATTESTATION.
Where we need to go. OPERATOR ASK (2026-08-28): a /compare for the thing that keeps track of files, capabilities, adoption, wiring and promotions, measured against August-2026 best practice. Strategy: the catalogue stays DERIVED from artifacts and is never converted into hand-authored per-unit files -- that is the property the field does not have and it is not tradeable. Everything owed is therefore an ADDITION at the edges: join the censuses so a unit count exists, make the attestation subject the artifact, serialise the inventory outward, and give every unit an owner. Each rung lands as an organ with a gate and a bite-proof, never as a document.
Research bar. Backstage software catalog, the catalogue and ownership bar is measured on the field's reference software catalog, tracking ownership and metadata for every component, with owner as a first-class required relation. Theirs: the working answer at 3000-plus companies, and its unit of record is a hand-authored descriptor file that can drift from the thing [backstagecat]. Ours: CR5 done means every Nishi unit resolves an owner from a declaration the ship verbs already read, with the UNOWNED count published rather than defaulted.
Research bar. SLSA Build track L1 to L3, the provenance bar is measured on graded levels over the provenance of a build, plus verification specified as a policy decision the consumer makes. Theirs: the field's bar, and it stops at the artifact: it grades how an artifact was produced and never whether that artifact is the one being served [slsa]. Ours: CR3 done means a promoted organ elf is the SUBJECT of a signed Statement, and CR6 done means an artifact that fails verification is refused rather than merely reported.
Research bar. CycloneDX and SPDX 3.0.1, the inventory interop bar is measured on the two standard bills of materials, one full-stack and one ISO-standard with a profile model [@cyclonedx]. Theirs: both are Best and we emit neither, in any format, anywhere [spdx3]. Ours: CR4 done means the joined census serialises to a document an outside verifier can consume without our tooling, with the fields we cannot fill printed as UNOBSERVABLE rather than omitted.
Research bar. OWASP Dependency-Track, the continuous-inventory bar is measured on a platform that ingests bills of materials and tracks an inventory OVER TIME rather than at one scan moment [@deptrack]. Theirs: the incumbent for continuous component analysis; our drift log already keeps a trend, so this bar is about the artifact, not the cadence. Ours: CR4 done means the emitted inventory is appended on the same daily beat the drift census already runs, so it is a trajectory and not a snapshot.
Research bar. Knip, the dead-surface bar is measured on finds unused files, dependencies and exports in a JavaScript and TypeScript project [@knip]. Theirs: the field's working answer to dead surface, and our wiring census is named after it, so the comparison is owed rather than optional. Ours: CR7 done means DARK collapses from an upper bound to a value, which is a claim Knip cannot make because it has no invocation evidence at all.
Research bar. OmniBOR Input Manifests, the build-inputs bar is measured on artifact identifiers plus a manifest of the exact inputs used to build each artifact. Theirs: the specification is the reference and its landing page carries no technical claim, which is why this board cites the spec and declares the landing mirror as a thin index [omniborsite]. Ours: CR3 done means our closure hash rides in the attestation predicate, so the inputs travel with the signature rather than beside it.
Business case
| Axis | Position | Figures | Decision |
|---|---|---|---|
| Investment | every rung is organ work against censuses that already run on a daily beat; there is no vendor, no subscription and no external service in the whole ladder | 15 u to a registry that states its unit count, attests its artifacts and can hand an outsider an inventory | the only BUY decision anywhere near this board is a hosted transparency log, and our Merkle witness already removes the need |
| Why it pays | the measured cost of not having it is already on the board: 1005 artifacts callable by nobody, 301 registered tools never called, 122 built-and-undeployed fixes indistinguishable from abandoned junk, and 18 served binaries the source cannot rebuild | each of those classes has cost a seat a full investigation more than once, and the estate has the receipts | a joined registry turns four separate rediscovery costs into one row lookup |
| Outward story | a catalogue that is DERIVED cannot drift from what it describes, which is the failure mode every declaration-based catalogue in the field carries | the honest counterweight is that a derived catalogue has no document to hand anyone, and CR4 is exactly that debt | the compare page publishes both halves rather than the flattering one |
Latest recorded release
No valid dated release entry is recorded for this domain.
Release entries describe recorded changes; they do not establish that every capability passed evaluation.
18 of 25 capability source symbols found|10 of them authored stronger-claims|7 open|coverage 720/1000|adoption 15 full / 3 partial
Evidence profile — what the gaps on this board actually are
Measured by nx_swcompare_evidence, read back by nx_evprofile_lib. Every figure is a count with its denominator — there is deliberately no score, no grade and no percentage anywhere in this band, because a stored scalar is a field a seat can edit and a counted partition is not.
evidence|grounded 17/17|unsupported 0|gates green 2/2|proven able to fail 2/2|never bitten 0|green at 0/0 0|open gaps 6|of them unnamed 0|of them proof withheld 0|flips ready 0
proven able to fail counts the gates that have a RECORDED RED — nx_gate_bite mutated the gate subject, rebuilt it, watched the gate go red, and that record is inside the shared TTL. never bitten is its complement over the same denominator: those gates ran and were green, and nothing has ever shown them able to detect anything, so their green is a statement about this run and not about the gate. green at 0/0 is a separate and much weaker observation — the gate printed GREEN on a zero denominator, so its own tooth counter says it examined nothing. A gate can be green, non-zero, and still never bitten; that is the common case and it is now visible instead of implied.
partition: grounded + unsupported = 17 vs present 17 · named + unnamed + withheld = 6 vs open 6 · both reconcile
liar-kill conj=GPQN · all four conjuncts held
graded document: BUILDROOT tree, 25015 bytes · gates map: BUILDROOT · stamped 36d 5h ago · STALE against the shared TTL of 604800s — this is evidence about a build nobody can vouch for now · source ../knowledge/status/evstamp_capregistry.verdict
| Gap class | What it is, and the work it names |
|---|---|
| STALE | This profile is older than the shared TTL, or its clock ran backwards. It is reported as unusable rather than as fresh, because being wrong in the direction of refusing is the safe direction. |
nx_swcompare_evidence capregistry itself and are not carried on the stamp, so this page names the classes and the producer names the rows. That split is stated rather than hidden: a count without a worklist is not actionable, and this band is honest about which half of that it is.Production map
Follow the dependencies, declared acceptance criteria and recorded priorities. Inspect source binding before treating a rank as executable work.
Ranking source binding: STALE_OR_INVALID_BINDING. Recorded priorities require current acceptance evidence and resource checks before execution.
Recorded ranking withheld
Retained ranking is not bound to the current plan and matrix: STALE_OR_INVALID_BINDING. Historical data remains retained. Refresh the ranking after resolving the input differences. Latest execution outcome is unverified.
Declared roadmap — contract, acceptance, executor, effort
| Rung | Closes with | Definition of done (pre-declared) | Executor | Est. |
|---|---|---|---|---|
| Whole-registry lifecycle join, one row per unit (CR1) | cat_sweep_all | emits ONE row per distinct unit carrying its stage, its surface and its drift class, reconciles the three census denominators explicitly, and PRINTS the residual rather than dropping it; refuses to publish a unit count if the partition does not sum | Organ | 2 u |
| Adopt the declaration backfill that is already BUILT and DARK (CR2) after CR1 | ok_declare_backfill | CORRECTED 2026-08-28 the day this plan was written: this is ADOPTION, not construction. nx_wirecensus already carries an evidence-only emit mode that proposes 718 rows against 1364 registered tools, skips everything already declared, and REFUSES to emit daemon rows because that is the one class where a wrong row is a rule 26 hazard. This rung adopts its output rather than building a second proposer, applies only the mechanically certain classes, and leaves the 296 UNCLASSIFIED a NAMED operator worklist. BLOCKED BY A MEASURED PRECONDITION, not a preference: those 718 rows are 18074 bytes and until the ok_kind_of_path cap fix on debt 1787938660 is BUILT and PROVEN, appending them pushes 15006 bytes of declarations past the reader that both ship verbs consult | Organ | 2 u |
| The attestation subject is the promoted artifact (CR3) | pv_build | LANDED 2026-08-29 as nx_provstmt + nx_provstmt_lib + nx_provstmt_gate, and it cost 1 u not the 3 sized, because the re-scope was right: the estate computes real provenance on every build and discards it, so this was a SERIALISATION. The organ re-hashes the LIVE artifact and refuses a mismatched receipt (proven both directions live), gate 16/16 with the wiring-order neg-control, bite-proven killed=1. STILL OWED FROM THIS RUNG, carried not hidden: the DSSE envelope (the Statement declares itself UNSIGNED in-band), and wiring the emit into the promote path so attestation is not caller-optional | Organ | 1 u |
| Bill of materials export from the joined census (CR4) after CR1 | ps_bom_emit | serialises CR1 output to a standard inventory document on the existing daily beat; a field we cannot fill prints UNOBSERVABLE and never an empty string; gate asserts the document round-trips and that its unit count equals CR1 | Organ | 2 u |
| Owner per unit (CR5) after CR1 | es_owner_of | every unit resolves an owner from a declaration both ship verbs already read; the UNOWNED count is published beside the total, so coverage cannot be inferred from silence | Organ | 2 u |
| Verification policy at the invoke boundary (CR6) after CR3 | cat_verify_policy | the lifecycle chain gains a VERIFIED axis and an artifact failing verification is REFUSED, not reported; the axis abstains as UNVERIFIABLE where no attestation exists, so absence can never read as a pass | Organ | 2 u |
| Close the DARK upper bound (CR7) | wc_dark_close | pre-ledger and root-minted capabilities are backfilled or aged out so DARK stops being a bound; the organ prints whether the bound is closed and refuses to drop the caveat while any pre-ledger mint remains | Organ | 1 u |
| Flat-format census and ratchet on the data plane (CR8) after CR1 | tm_format_census | A census organ partitions every data file under knowledge/, knowledge/status/ and the root by class (seg-store plane, tsv, jrnl, log, json, conf, other) with the partition summing to the file count, ratchets the flat count DOWN like nx_gate_fixture_ratchet_gate, publishes the migration order with per-file reader counts from the 709 source sites that name a .tsv literal, widens nx_sov_guard's scan set to knowledge/registry (138 live TSVs today, none allowlisted), and refuses a NEW flat writer at the ship gate. MEASURED 2026-09-02: registry tsv 138 live + 56 backup/scratch + 6 retired, status log 861 jrnl 117 json 12, root tsv 3 with two plane twins already present, planes 734+ (partial). Migration is nx_tsv_migrate per file, round-trip verified, readers repointed, source marked superseded. ACCEPT: the census partition sums; a planted new .tsv in a scanned dir turns the ratchet RED; retiring one file turns it GREEN and tightens the floor; the first four registry files named in the receipt are on planes with their readers repointed | Organ | 2 u |
Milestones
| Milestone | Rungs | Cumulative |
|---|---|---|
| M0 · The estate can state its own unit count | CR1 | 2 u |
| M1 · Nothing ships on a name guess and every unit has an owner | CR2,CR5 | 7 u |
| M2 · Every promoted artifact carries signed provenance | CR3 | 10 u |
| M3 · The inventory leaves the building | CR4 | 12 u |
| M4 · Unverified artifacts are refused and DARK is a value | CR6,CR7 | 15 u |
| M5 · The data plane speaks one format | CR8,CR9 | 18 u |
| Rung | Closes with | Definition of done (pre-declared) | Executor | Est. |
|---|---|---|---|---|
| The alias-masked count gets a floor and a beat, so the catalogue identity fix cannot silently regress (CR9) | ac_ratchet | nx_aliascensus is BUILT, PROMOTED at 31568 bytes, REGISTERED, AUTHORISED and INVOKED with selftest 7 of 7, and it is on NEITHER GATE SURFACE. Scope stated: the two surfaces below were enumerated exhaustively, the clock and cron and daemon planes were NOT, so this is proven for the gate surfaces and unproven elsewhere. MEASURED 2026-09-04 by reading both declaration files whole and reconciling their bytes: the name appears nowhere in knowledge/gateroster.conf (43103 bytes, 992 rows, the surface the beat runs) and nowhere in knowledge/organ_gate.conf (26796 bytes, 311 rows, the surface that pairs an organ with its gate). Its teeth are a selftest VERB rather than a _gate organ, and the roster admits gates, so nothing calls them on a clock. That is the gate-nobody-runs shape this very domain exists to measure, sitting on the guard for a sev-8 identity defect. The rung is one contract with one done-rule and not two: alias_masked may not RISE. ac_ratchet reads a floor from the status plane, exits RED on any rise and ratchets the floor DOWN when the count falls, and the row is admitted to the roster so it is evaluated without a seat. It is cheap because nothing new is measured -- the census already computes the number and already names the 24 -- so this is a floor plus a verdict plus a conf row, the same shape as the sprawl ratchets. WORKLIST IT INHERITS, already named by the organ rather than discovered later: 24 masked names including nx_fs and nx_https_get, each of which owns a real source that the catalogue used to replace with the alias target's bytes. TWO THINGS DELIBERATELY NOT BUNDLED HERE: retiring the 75 ALIAS-PURE rows is NOT this rung, because a pure alias is an honest entry point and SOURCE absent is the correct report for it, and the DRY extraction the organ's own header declares owed (its line and column and number helpers are the second copy in the estate, the first in nx_debt_triple, and the law fires at three) belongs to whoever writes the third | Organ | 1 u |
| Class | Count | Note |
|---|---|---|
| bars | 0 | sotabar rows on the plan |
| fresh | 0 | the bar month is the current month |
| attested | 0 | an older bar with a this-month barscan reporting no newer entry |
| stale | 0 | a this-month scan saw a newer month the bar ignores |
| unattested | 0 | nobody looked this month |
| malformed | 0 | a sotabar row missing a field |
| duplicate | 0 | bar ids an earlier row already carries |
| bars, summed | 0 | RECONCILED: the parts sum to the total 0 |
| current month | 2026-10 | the month every bar is judged against |
Inspect a rung and its prerequisites
Declared nodes 9. Rank input binding: STALE_OR_INVALID_BINDING. Dependency order is authored. Implementation, acceptance evidence, authority and resource readiness are unverified. No action is recommended or dispatched here.
Plan SHA-256 59b7aa3fe108c777540b60b0afa54e506c7ac181f0881e754973b4c87b5782aa. Target rows 0; role rows 0. Existing risks and release worklog retain their own scope; no node completion is inferred.
Runtime observation coverage: 0 of 9 rungs have current, identity-bound execution observations. Observation may report RED. Accepted completion remains unknown; source presence, qualification and deployment do not establish it.
Use Enter or Space on a rung to inspect its contract. Prerequisite links locate another rung in this list; open its summary to inspect it. Estimates are authored effort, not forecasts.
CR1 — Whole-registry lifecycle join, one row per unit
Prerequisites: None declared; this does not establish execution eligibility.
Contract:
cat_sweep_allAcceptance: emits ONE row per distinct unit carrying its stage, its surface and its drift class, reconciles the three census denominators explicitly, and PRINTS the residual rather than dropping it; refuses to publish a unit count if the partition does not sum
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt
, SHA-256. Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.CR2 — Adopt the declaration backfill that is already BUILT and DARK
Prerequisites: CR1 (acceptance unverified)
Contract:
ok_declare_backfillAcceptance: CORRECTED 2026-08-28 the day this plan was written: this is ADOPTION, not construction. nx_wirecensus already carries an evidence-only emit mode that proposes 718 rows against 1364 registered tools, skips everything already declared, and REFUSES to emit daemon rows because that is the one class where a wrong row is a rule 26 hazard. This rung adopts its output rather than building a second proposer, applies only the mechanically certain classes, and leaves the 296 UNCLASSIFIED a NAMED operator worklist. BLOCKED BY A MEASURED PRECONDITION, not a preference: those 718 rows are 18074 bytes and until the ok_kind_of_path cap fix on debt 1787938660 is BUILT and PROVEN, appending them pushes 15006 bytes of declarations past the reader that both ship verbs consult
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt
, SHA-256. Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.CR3 — The attestation subject is the promoted artifact
Prerequisites: None declared; this does not establish execution eligibility.
Contract:
pv_buildAcceptance: LANDED 2026-08-29 as nx_provstmt + nx_provstmt_lib + nx_provstmt_gate, and it cost 1 u not the 3 sized, because the re-scope was right: the estate computes real provenance on every build and discards it, so this was a SERIALISATION. The organ re-hashes the LIVE artifact and refuses a mismatched receipt (proven both directions live), gate 16/16 with the wiring-order neg-control, bite-proven killed=1. STILL OWED FROM THIS RUNG, carried not hidden: the DSSE envelope (the Statement declares itself UNSIGNED in-band), and wiring the emit into the promote path so attestation is not caller-optional
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt
, SHA-256. Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.CR4 — Bill of materials export from the joined census
Prerequisites: CR1 (acceptance unverified)
Contract:
ps_bom_emitAcceptance: serialises CR1 output to a standard inventory document on the existing daily beat; a field we cannot fill prints UNOBSERVABLE and never an empty string; gate asserts the document round-trips and that its unit count equals CR1
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt
, SHA-256. Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.CR5 — Owner per unit
Prerequisites: CR1 (acceptance unverified)
Contract:
es_owner_ofAcceptance: every unit resolves an owner from a declaration both ship verbs already read; the UNOWNED count is published beside the total, so coverage cannot be inferred from silence
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt
, SHA-256. Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.CR6 — Verification policy at the invoke boundary
Prerequisites: CR3 (acceptance unverified)
Contract:
cat_verify_policyAcceptance: the lifecycle chain gains a VERIFIED axis and an artifact failing verification is REFUSED, not reported; the axis abstains as UNVERIFIABLE where no attestation exists, so absence can never read as a pass
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt
, SHA-256. Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.CR7 — Close the DARK upper bound
Prerequisites: None declared; this does not establish execution eligibility.
Contract:
wc_dark_closeAcceptance: pre-ledger and root-minted capabilities are backfilled or aged out so DARK stops being a bound; the organ prints whether the bound is closed and refuses to drop the caveat while any pre-ledger mint remains
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt
, SHA-256. Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.CR8 — Flat-format census and ratchet on the data plane
Prerequisites: CR1 (acceptance unverified)
Contract:
tm_format_censusAcceptance: A census organ partitions every data file under knowledge/, knowledge/status/ and the root by class (seg-store plane, tsv, jrnl, log, json, conf, other) with the partition summing to the file count, ratchets the flat count DOWN like nx_gate_fixture_ratchet_gate, publishes the migration order with per-file reader counts from the 709 source sites that name a .tsv literal, widens nx_sov_guard's scan set to knowledge/registry (138 live TSVs today, none allowlisted), and refuses a NEW flat writer at the ship gate. MEASURED 2026-09-02: registry tsv 138 live + 56 backup/scratch + 6 retired, status log 861 jrnl 117 json 12, root tsv 3 with two plane twins already present, planes 734+ (partial). Migration is nx_tsv_migrate per file, round-trip verified, readers repointed, source marked superseded. ACCEPT: the census partition sums; a planted new .tsv in a scanned dir turns the ratchet RED; retiring one file turns it GREEN and tightens the floor; the first four registry files named in the receipt are on planes with their readers repointed
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt
, SHA-256. Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.CR9 — The alias-masked count gets a floor and a beat, so the catalogue identity fix cannot silently regress
Prerequisites: None declared; this does not establish execution eligibility.
Contract:
ac_ratchetAcceptance: nx_aliascensus is BUILT, PROMOTED at 31568 bytes, REGISTERED, AUTHORISED and INVOKED with selftest 7 of 7, and it is on NEITHER GATE SURFACE. Scope stated: the two surfaces below were enumerated exhaustively, the clock and cron and daemon planes were NOT, so this is proven for the gate surfaces and unproven elsewhere. MEASURED 2026-09-04 by reading both declaration files whole and reconciling their bytes: the name appears nowhere in knowledge/gateroster.conf (43103 bytes, 992 rows, the surface the beat runs) and nowhere in knowledge/organ_gate.conf (26796 bytes, 311 rows, the surface that pairs an organ with its gate). Its teeth are a selftest VERB rather than a _gate organ, and the roster admits gates, so nothing calls them on a clock. That is the gate-nobody-runs shape this very domain exists to measure, sitting on the guard for a sev-8 identity defect. The rung is one contract with one done-rule and not two: alias_masked may not RISE. ac_ratchet reads a floor from the status plane, exits RED on any rise and ratchets the floor DOWN when the count falls, and the row is admitted to the roster so it is evaluated without a seat. It is cheap because nothing new is measured -- the census already computes the number and already names the 24 -- so this is a floor plus a verdict plus a conf row, the same shape as the sprawl ratchets. WORKLIST IT INHERITS, already named by the organ rather than discovered later: 24 masked names including nx_fs and nx_https_get, each of which owns a real source that the catalogue used to replace with the alias target's bytes. TWO THINGS DELIBERATELY NOT BUNDLED HERE: retiring the 75 ALIAS-PURE rows is NOT this rung, because a pure alias is an honest entry point and SOURCE absent is the correct report for it, and the DRY extraction the organ's own header declares owed (its line and column and number helpers are the second copy in the estate, the first in nx_debt_triple, and the law fires at three) belongs to whoever writes the third
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt
, SHA-256. Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
Learning and practice paths
No structured learning path is declared for this plan. Existing research, roadmap and worklog remain available above.
Rung dossiers — every record that bears on a rung, in one place
nx_swcompare_evidence capregistry writes it beside its stamp); every gate below reads UNRECORDED until it runs.knowledge/organ_gate.conf read from this working directory (1 rows) and from the estate root (196 rows); rows in both counted once: 0; declarations read: 197. Every declaration in either copy counts, so a stub beside the publisher can never hide the root.CR1 Whole-registry lifecycle join, one row per unit · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW
| Contract | cat_sweep_all · executor Organ · 2 u · stands on nothing |
|---|---|
| Definition of done | emits ONE row per distinct unit carrying its stage, its surface and its drift class, reconciles the three census denominators explicitly, and PRINTS the residual rather than dropping it; refuses to publish a unit count if the partition does not sum |
| Matrix cell | NO-MATRIX-ROW — no matrix row carries cat_sweep_all; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish. |
| Gate | the gate join needs a matrix row: no organ is named for this rung |
| Work log | no log row names this rung yet |
CR2 Adopt the declaration backfill that is already BUILT and DARK · cell WATCHING · gate NO-GATE-DECLARED
| Contract | ok_declare_backfill · executor Organ · 2 u · stands on CR1 |
|---|---|
| Definition of done | CORRECTED 2026-08-28 the day this plan was written: this is ADOPTION, not construction. nx_wirecensus already carries an evidence-only emit mode that proposes 718 rows against 1364 registered tools, skips everything already declared, and REFUSES to emit daemon rows because that is the one class where a wrong row is a rule 26 hazard. This rung adopts its output rather than building a second proposer, applies only the mechanically certain classes, and leaves the 296 UNCLASSIFIED a NAMED operator worklist. BLOCKED BY A MEASURED PRECONDITION, not a preference: those 718 rows are 18074 bytes and until the ok_kind_of_path cap fix on debt 1787938660 is BUILT and PROVEN, appending them pushes 15006 bytes of declarations past the reader that both ship verbs consult |
| Matrix cell | The declaration backfill is BUILT AND DARK, and running it today would break the reader · runtime/nx_organkind.nx · WATCHING decl |
| Gate | NO-GATE-DECLARED — knowledge/organ_gate.conf carries no row for nx_organkind; declare nx_organkind TAB <gate> and the ship loop proves it and the verdict lands here. |
| Work log | no log row names this rung yet |
CR3 The attestation subject is the promoted artifact · cell PRESENT · gate NO-GATE-DECLARED
| Contract | pv_build · executor Organ · 1 u · stands on nothing |
|---|---|
| Definition of done | LANDED 2026-08-29 as nx_provstmt + nx_provstmt_lib + nx_provstmt_gate, and it cost 1 u not the 3 sized, because the re-scope was right: the estate computes real provenance on every build and discards it, so this was a SERIALISATION. The organ re-hashes the LIVE artifact and refuses a mismatched receipt (proven both directions live), gate 16/16 with the wiring-order neg-control, bite-proven killed=1. STILL OWED FROM THIS RUNG, carried not hidden: the DSSE envelope (the Statement declares itself UNSIGNED in-band), and wiring the emit into the promote path so attestation is not caller-optional |
| Matrix cell | Attest the promoted ORGAN, not only the evidence frame · runtime/_hdl_build/nx_provstmt_lib.nx · PRESENT decl |
| Gate | NO-GATE-DECLARED — knowledge/organ_gate.conf carries no row for nx_provstmt_lib; declare nx_provstmt_lib TAB <gate> and the ship loop proves it and the verdict lands here. |
| Work log | no log row names this rung yet |
CR4 Bill of materials export from the joined census · cell WATCHING · gate NO-GATE-DECLARED
| Contract | ps_bom_emit · executor Organ · 2 u · stands on CR1 |
|---|---|
| Definition of done | serialises CR1 output to a standard inventory document on the existing daily beat; a field we cannot fill prints UNOBSERVABLE and never an empty string; gate asserts the document round-trips and that its unit count equals CR1 |
| Matrix cell | Machine-readable inventory an outside verifier can read · runtime/nx_artifactdrift.nx · WATCHING decl |
| Gate | NO-GATE-DECLARED — knowledge/organ_gate.conf carries no row for nx_artifactdrift; declare nx_artifactdrift TAB <gate> and the ship loop proves it and the verdict lands here. |
| Work log | no log row names this rung yet |
CR5 Owner per unit · cell WATCHING · gate NO-GATE-DECLARED
| Contract | es_owner_of · executor Organ · 2 u · stands on CR1 |
|---|---|
| Definition of done | every unit resolves an owner from a declaration both ship verbs already read; the UNOWNED count is published beside the total, so coverage cannot be inferred from silence |
| Matrix cell | Every unit names an owner · runtime/nx_execsurface.nx · WATCHING decl |
| Gate | NO-GATE-DECLARED — knowledge/organ_gate.conf carries no row for nx_execsurface; declare nx_execsurface TAB <gate> and the ship loop proves it and the verdict lands here. |
| Work log | no log row names this rung yet |
CR6 Verification policy at the invoke boundary · cell WATCHING · gate UNRECORDED
| Contract | cat_verify_policy · executor Organ · 2 u · stands on CR3 |
|---|---|
| Definition of done | the lifecycle chain gains a VERIFIED axis and an artifact failing verification is REFUSED, not reported; the axis abstains as UNVERIFIABLE where no attestation exists, so absence can never read as a pass |
| Matrix cell | Refuse to run an artifact whose attestation does not verify · runtime/nx_catalog.nx · WATCHING decl |
| Gate | nx_catalog_name_gate_t394 · UNRECORDED — no recorded verdict for this gate (it is declared for the organ but the evidence referee's last run did not record it: it is not on this board's gates map, or the referee has not run since the per-gate record shipped)nx_catalog_producer_gate_t393 · UNRECORDED — no recorded verdict for this gate (it is declared for the organ but the evidence referee's last run did not record it: it is not on this board's gates map, or the referee has not run since the per-gate record shipped) |
| Work log | 2026-09-10 lesson Operator direction 2026-09-10: catalogue must be meaningful and usable by developers, average users and agents against dated current research. Stable capability identity and primitive/workflow/team relationships must support task-oriented discovery, callable input/output contracts, owner, dependencies, versions, side effects, permission scope, evidence freshness and separate installed/private/published/user-outcome status. Logical component independence does not require separate processes or calls. Serial, parallel and fused workflows must be chosen from dependencies and observed device resources, locality, contention and transfer/dispatch costs; preserve quality, publish observed latency/resource/correctness results and abstain when unmeasured. Beach is the proving workload. Current nx_catalog_lib cl_ladder48260B source review finds registration plus substring consent evidence plus any completed historical MCP call can classify LIVE; that is lifecycle evidence, not proof of current authorization or quality. Extend existing owners and CR6 verification work; no duplicate catalogue or automatic SOTA label. Research fetched through estate API: Arazzo1.1.0 dated2026-05-17, knowledge/fetched/rf_33f47cc3.raw237808B SHA8e2ea7d20accaef846080bca77d349b137414e66c94f015a002b290cbf79b538 describes workflow dependencies and outcomes; MCP official registry API knowledge/fetched/rf_bc4768fc.raw5615B SHA37989fc77551006d7fc3d34954c1f9d81a4edace8afc519d92b1c82a1b031dd9 describes versioned discovery, incremental synchronization and explicit status. Neither source establishes Nishi conformance or complete SOTA coverage; catalogue UX, ranking efficacy and execution-quality benchmark remain open. |
CR7 Close the DARK upper bound · cell WATCHING · gate NO-GATE-DECLARED
| Contract | wc_dark_close · executor Organ · 1 u · stands on nothing |
|---|---|
| Definition of done | pre-ledger and root-minted capabilities are backfilled or aged out so DARK stops being a bound; the organ prints whether the bound is closed and refuses to drop the caveat while any pre-ledger mint remains |
| Matrix cell | Close the DARK upper bound instead of quoting it forever · runtime/_hdl_build/nx_wirecensus_lib.nx · WATCHING decl |
| Gate | NO-GATE-DECLARED — knowledge/organ_gate.conf carries no row for nx_wirecensus_lib; declare nx_wirecensus_lib TAB <gate> and the ship loop proves it and the verdict lands here. |
| Work log | no log row names this rung yet |
CR8 Flat-format census and ratchet on the data plane · cell WATCHING · gate NO-GATE-DECLARED
| Contract | tm_format_census · executor Organ · 2 u · stands on CR1 |
|---|---|
| Definition of done | A census organ partitions every data file under knowledge/, knowledge/status/ and the root by class (seg-store plane, tsv, jrnl, log, json, conf, other) with the partition summing to the file count, ratchets the flat count DOWN like nx_gate_fixture_ratchet_gate, publishes the migration order with per-file reader counts from the 709 source sites that name a .tsv literal, widens nx_sov_guard's scan set to knowledge/registry (138 live TSVs today, none allowlisted), and refuses a NEW flat writer at the ship gate. MEASURED 2026-09-02: registry tsv 138 live + 56 backup/scratch + 6 retired, status log 861 jrnl 117 json 12, root tsv 3 with two plane twins already present, planes 734+ (partial). Migration is nx_tsv_migrate per file, round-trip verified, readers repointed, source marked superseded. ACCEPT: the census partition sums; a planted new .tsv in a scanned dir turns the ratchet RED; retiring one file turns it GREEN and tightens the floor; the first four registry files named in the receipt are on planes with their readers repointed |
| Matrix cell | DATA PLANE: third-party flat formats retired to the sovereign plane, ratcheted · runtime/_hdl_build/nx_tsv_migrate.nx · WATCHING decl |
| Gate | NO-GATE-DECLARED — knowledge/organ_gate.conf carries no row for nx_tsv_migrate; declare nx_tsv_migrate TAB <gate> and the ship loop proves it and the verdict lands here. |
| Work log | no log row names this rung yet |
CR9 The alias-masked count gets a floor and a beat, so the catalogue identity fix cannot silently regress · cell WATCHING · gate NO-GATE-DECLARED
| Contract | ac_ratchet · executor Organ · 1 u · stands on nothing |
|---|---|
| Definition of done | nx_aliascensus is BUILT, PROMOTED at 31568 bytes, REGISTERED, AUTHORISED and INVOKED with selftest 7 of 7, and it is on NEITHER GATE SURFACE. Scope stated: the two surfaces below were enumerated exhaustively, the clock and cron and daemon planes were NOT, so this is proven for the gate surfaces and unproven elsewhere. MEASURED 2026-09-04 by reading both declaration files whole and reconciling their bytes: the name appears nowhere in knowledge/gateroster.conf (43103 bytes, 992 rows, the surface the beat runs) and nowhere in knowledge/organ_gate.conf (26796 bytes, 311 rows, the surface that pairs an organ with its gate). Its teeth are a selftest VERB rather than a _gate organ, and the roster admits gates, so nothing calls them on a clock. That is the gate-nobody-runs shape this very domain exists to measure, sitting on the guard for a sev-8 identity defect. The rung is one contract with one done-rule and not two: alias_masked may not RISE. ac_ratchet reads a floor from the status plane, exits RED on any rise and ratchets the floor DOWN when the count falls, and the row is admitted to the roster so it is evaluated without a seat. It is cheap because nothing new is measured -- the census already computes the number and already names the 24 -- so this is a floor plus a verdict plus a conf row, the same shape as the sprawl ratchets. WORKLIST IT INHERITS, already named by the organ rather than discovered later: 24 masked names including nx_fs and nx_https_get, each of which owns a real source that the catalogue used to replace with the alias target's bytes. TWO THINGS DELIBERATELY NOT BUNDLED HERE: retiring the 75 ALIAS-PURE rows is NOT this rung, because a pure alias is an honest entry point and SOURCE absent is the correct report for it, and the DRY extraction the organ's own header declares owed (its line and column and number helpers are the second copy in the estate, the first in nx_debt_triple, and the law fires at three) belongs to whoever writes the third |
| Matrix cell | The alias-masked count is fenced by a ratchet, so the identity fix cannot silently regress · runtime/nx_aliascensus.nx · WATCHING decl |
| Gate | NO-GATE-DECLARED — knowledge/organ_gate.conf carries no row for nx_aliascensus; declare nx_aliascensus TAB <gate> and the ship loop proves it and the verdict lands here. |
| Work log | no log row names this rung yet |
dossiers=9 cells_joined=8 no_matrix_row=1 (sum 9) gates_recorded=0 gates_unrecorded=1 no_gate_declared=7 (sum 8 of cells_joined) evgates=UNSTAMPED
Capability comparisons
Compare the field, search individual capabilities and open their source and adoption evidence. Documented presence does not establish comparative quality.
Position map — centrality and distinctiveness
The four-quadrant map the field uses for brand strategy (Dawar and Bagga, HBR June 2015), re-derived from this matrix on every publish. Centrality is the share of the category's feature mass a player covers, each feature weighted by how many hold it; distinctiveness is the average lead over each rival on the rows the player holds; breadth is the depth-weighted share of the whole matrix (the bubble); depth is how deeply the rows held are held; momentum is the day-over-day move off the spine (green rising, red falling, grey until day two); the dashed path runs first day → previous day → today. Dividers are the category means. Axes are fitted to the field of play, so read the tick numerals, not the frame. Rival marks are documented presence, so a rival's position reads the record, never its quality. The picture grades its own readability below; the table beside it is the same data for a screen reader or a second method.
knowledge/compare/capregistry.cdmap (cut|x|y, cube|x|y|z); absent = the HBR defaultsbubble area = breadth · ring = momentum (green rising, red falling, grey until day two) · dashed = category means · axes fitted to the field of play: centrality 200–900, distinctiveness 200–800 of 0–1000 permil (the full range put every player in one corner)
readability of the 2D cut, self-graded by the layout ruler: label overlaps 0 · labels over marks 0 · off-canvas 0 · unresolved labels 0 · mark overlaps 0 (a fact of the data: two players that close are that close) · data spread 687 permil of the plot · quadrant words unseated 0
text contrast, measured with wcag2-ratio (floors from contrast.conf), light theme: labels 16.24 (floor 4.50) · notes 16.24 (floor 4.50) · quadrant words 5.89 (floor 4.50) · tick numerals 5.89 (floor 4.50) · axis titles 5.59 (floor 4.50) · dark theme: labels 13.78 (floor 4.50) · quadrant words 5.55 (floor 4.50) · axis titles 5.97 (floor 4.50) · dark classes under their floor 0 (one figure serves both themes: a dark shortfall is a token to fix, never a class to hide) · classes refused under their floor 0 (a refused class is not drawn; the scale classes are measured, never hidden) · export: SVG PNG (receipt, rendered by the estate's own rasteriser from this page)
readability of the 3D cube, self-graded by the layout ruler: label overlaps 0 · labels over marks 0 · off-canvas 0 · unresolved labels 0 · mark overlaps 1 (a fact of the data: two players that close are that close) · data spread 119 permil of the plot
10 panels over 5 registered axes, every pair once (the lower axis on x, the higher on y) · each panel fitted to its own field of play, first and last tick numerals shown · no labels in a small cut, the legend names the colours; the grade below reports the mark terms only (MM summed over the panels, spread averaged)
readability of the small multiples, self-graded by the layout ruler: label overlaps 0 · labels over marks 0 · off-canvas 0 · unresolved labels 0 · mark overlaps 6 (a fact of the data: two players that close are that close) · data spread 574 permil of the plot
| Player | Quadrant | centrality | distinctiveness | breadth | depth | momentum | Rows held | Days on spine | First seen |
|---|---|---|---|---|---|---|---|---|---|
| Nishi | Aspirational | 782 | 722 | 613 | 851 | 0 since 2026-09-23 | 18 | 10 | 2026-09-15 |
| Backstage | Unconventional | 500 | 453 | 240 | 666 | 0 since 2026-09-23 | 9 | 10 | 2026-09-15 |
| SLSA-in-toto | Peripheral | 456 | 416 | 186 | 666 | 0 since 2026-09-23 | 7 | 10 | 2026-09-15 |
| CycloneDX-DepTrack | Mainstream | 521 | 281 | 173 | 541 | 0 since 2026-09-23 | 8 | 10 | 2026-09-15 |
| OmniBOR | Peripheral | 347 | 270 | 106 | 666 | 0 since 2026-09-23 | 4 | 10 | 2026-09-15 |
| Day | Matrix rows reviewed | Players recorded |
|---|---|---|
| 2026-09-15 | 25 | 5 |
| 2026-09-16 | 25 | 5 |
| 2026-09-17 | 25 | 5 |
| 2026-09-18 | 25 | 5 |
| 2026-09-19 | 25 | 5 |
| 2026-09-20 | 25 | 5 |
| 2026-09-21 | 25 | 5 |
| 2026-09-22 | 25 | 5 |
| 2026-09-23 | 25 | 5 |
| 2026-10-08 | 25 | 5 |
players 5|matrix rows 25|feature mass 46|centrality mean 521|distinctiveness mean 428|axes 5|spine days 10 (shown 10)|rows written today 0|readability defects 2D 0 cube 0|spine knowledge/status/cdmap/capregistry.spine
Capability matrix — measured against source
◉ authored stronger claim; source present● present◐ partial○ absent? unassessed; excluded from relative comparison · click any capability for its evidence
Peer cell coverage: authored assessed 100, unassessed 0. Authored assessments are not verified outcomes.
No capabilities match this filter or search.
| Capability | Nishi | Backstage | SLSA-in-toto | CycloneDX-DepTrack | OmniBOR |
|---|---|---|---|---|---|
| DATA PLANE | |||||
third-party flat formats retired to the sovereign plane, ratchetedDARK —runtime/_hdl_build/nx_tsv_migrate.nx EXISTS but does not declare tm_format_census: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the comparewatch- plane row reads DARK until then. MEASURED 2026-09-02 per directory, each count with its coverage (receipt: knowledge/status/dataplane_format_census.txt): knowledge/registry holds 138 live .tsv registries plus 56 .tsv.* backup and scratch copies (38 of them assignment_queue.tsv.bak* -- a hand-rotated backup chain doing by hand what a plane's hist- twin does by construction) and 6 .superseded-by-sovereign-store markers (the migrator has retired 6); knowledge/status holds 861 .log, 117 .jrnl and 12 .json; the root keeps nishi_entitlements.tsv and nishi_uid_handle.tsv beside seg-store twins that already exist for both; 709 source sites in buildroot/runtime/_hdl_build name a .tsv literal (8777 files, coverage_complete=1), against 734+ seg-store manifests (a partial count, the root glob hit the shelltool budget). The estate's own law (no new tsv, 2026-07-18/07-20) has its guard (nx_sov_guard over tsv_allow.list) and its migrator (nx_tsv_migrate) -- but the allowlist names 16 files, NONE in knowledge/registry, so the guard's scan set does not cover the directory that holds the population. Measured cost of the flat class this same day: the resmon beat log blinded its own trend reader for 65 beats under a 1 MiB head-capped read, and the corpus carries 12 hand-rolled read_tail copies because every flat log grows its own parser. Contract: a census organ that partitions every data file by class (plane, tsv, jrnl, log, json, conf), ratchets the flat count DOWN, publishes the migration order by reader count, and refuses a NEW flat writer at the ship gate. Backstage catalogs YAML entities by declaration (Yes); SLSA and OmniBOR carry no data-plane opinion; CycloneDX is itself an interchange document (Part). rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind themPros none measured yetCons behind Backstage, CycloneDX-DepTrack; open contract; expected source declaration not established | ○ | ● | ○ | ◐ | ○ |
Six-stage lifecycle chain per unit and the weakest link is the verdictSource present; authored stronger claim:cat_one in runtime/nx_catalog.nx, verified at emit. MEASURED 2026-08-28 live: nx_catalog nx_wirecensus returns SOURCE 15849B, BUILT 42894B, PROMOTED 42894B, REGISTERED yes, AUTHORISED yes, INVOKED yes, VERDICT LIVE, names=1 with_gaps=0. The verdict is the WEAKEST link, so a unit that is built and promoted but callable by nobody cannot read as healthy. Backstage records an entity and its metadata but has no built-to-served chain to be weakest in. SLSA grades a BUILD track L1 to L3 and stops at the artifact, saying nothing about registration or invocation, so it is Part rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: LIVE — fully adopted (top of its ladder).Pros Source symbol found; stronger capability claim is authored; ahead of Backstage, SLSA-in-toto, CycloneDX-DepTrack, OmniBOR; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth) | ◉ | ○ | ◐ | ○ | ○ |
The catalogue row is DERIVED from the artifacts, never hand-declaredSource present; authored stronger claim:main in runtime/nx_catalog.nx, verified at emit. The unit of record in Backstage is a hand-written catalog-info.yaml carrying apiVersion backstage.io/v1alpha1 and kind Component, witnessed verbatim in the mirror [backstagedesc] -- a second artifact beside the thing, which can therefore drift from it. Ours STATs the real chain on every call, so the catalogue cannot disagree with the estate: there is nothing to keep in sync. The cost of our choice is stated in the SBOM row: a derived catalogue has no file an outsider can read Adoption: LIVE — fully adopted (top of its ladder).Pros Source symbol found; stronger capability claim is authored; ahead of Backstage, SLSA-in-toto, CycloneDX-DepTrack, OmniBOR; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth) | ◉ | ○ | ○ | ○ | ○ |
Is the binary we are serving the one the last build producedSource present; authored stronger claim:ps_same in runtime/nx_artifactdrift.nx, verified at emit. MEASURED from the durable trend log at epoch 1787869703: distinct 1295 identical 1097 stale 140 behind 122 ahead 18 nobuild 30 stagedptr 28, sum 1295, partition RECONCILES. The in-toto Statement spec says it in its own words in the mirror -- Subject artifacts are matched PURELY BY DIGEST [intoto] -- so an attestation can prove two files differ and can never tell you the wrong one is the one being served. That question needs a census of the serving root, which no rival column runs Adoption: RUN-BY:clock — fully adopted (top of its ladder).Pros Source symbol found; stronger capability claim is authored; ahead of Backstage, SLSA-in-toto, CycloneDX-DepTrack, OmniBOR; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth) | ◉ | ○ | ○ | ○ | ○ |
Drift split by REMEDY including the class where promoting DESTROYS capabilitySource present; authored stronger claim:ps_judge in runtime/nx_artifactdrift.nx, verified at emit. MEASURED same run: the 140 stale rows split BEHIND 122 (built and undeployed, promote is correct) versus AHEAD 18 (the SERVED binary carries code the source cannot rebuild, where promoting DELETES capability) versus RESIZED 0. Both partitions reconcile and the log carries the trend, not a level. No rival distinguishes these: a digest comparison reports DIFFERENT for both classes while the correct action is opposite in each Adoption: RUN-BY:clock — fully adopted (top of its ladder).Pros Source symbol found; stronger capability claim is authored; ahead of Backstage, SLSA-in-toto, CycloneDX-DepTrack, OmniBOR; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth) | ◉ | ○ | ○ | ○ | ○ |
An installed artifact without the execute bit is a separate axis, never folded into the partitionSource present; authored stronger claim:ps_execbit in runtime/nx_artifactdrift.nx, verified at emit. A binary can be byte-IDENTICAL and still inert, so folding INERT into the identical-stale partition would silently break the reconciliation. It is declared a separate axis for exactly that reason. This is not theoretical: a fleet supervisor once sat installed at mode 0644 for six days, unrunnable, masked by a live process running from the old inode. A digest-based rival cannot see mode at all Adoption: RUN-BY:clock — fully adopted (top of its ladder).Pros Source symbol found; stronger capability claim is authored; ahead of Backstage, SLSA-in-toto, CycloneDX-DepTrack, OmniBOR; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth) | ◉ | ○ | ○ | ○ | ○ |
Execution-surface census across five surfaces plus fork edgesSource present; authored stronger claim:es_on_surface in runtime/nx_execsurface.nx, verified at emit. MEASURED 2026-08-28: organs 2418 on_surface 1046 ref_only 113 dark 1259 sum 2418, partition RECONCILES, from clock 114, cron 61, daemon 43 and roster 677 rows plus the actlog, joined to 937 fork edges resolved over 19141 files at 3 hops. It answers WHICH surface runs a unit rather than whether a row exists somewhere. ENVELOPE CARRIED: plane_capture_full=0 on this run, so dark 1259 is an upper bound and is quoted as one Adoption: RUN-BY:clock — fully adopted (top of its ladder).Pros Source symbol found; stronger capability claim is authored; ahead of Backstage, SLSA-in-toto, CycloneDX-DepTrack, OmniBOR; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth) | ◉ | ○ | ○ | ○ | ○ |
Registered but never called, published as an UPPER BOUND with its reasonSource present; authored stronger claim:wc_dark in runtime/_hdl_build/nx_wirecensus_lib.nx, verified at emit. MEASURED 2026-08-28: registered 1364 authorised 1135 invoked 286 DARK 301 dark_permil 220 table_truncated 0. The organ prints the BOUND beside the number in its own output -- caps minted before the consent ledger existed never reach it, and seats log invocation voluntarily -- so the number cannot be read as exact by accident. A scorecard that reported 220 permil dark without that sentence would be the more confident and the less true instrument Adoption: LIB-WIRED importers=3 nonval=2 — fully adopted (top of its ladder).Pros Source symbol found; stronger capability claim is authored; ahead of Backstage, SLSA-in-toto, CycloneDX-DepTrack, OmniBOR; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth) | ◉ | ○ | ○ | ○ | ○ |
Promoted but exposed to nobody, triaged by remedy and the partition sumsSource present; authored stronger claim:wc_looks_oracle in runtime/_hdl_build/nx_wirecensus_lib.nx, verified at emit. MEASURED 2026-08-28: promoted 2048 registered 1319 declared-nontool 51 UNEXPOSED 1005, and the triage splits oracle-shaped 677 plus daemon-shaped 26 plus plan-invoked 6 plus UNCLASSIFIED 296, which sums to exactly 1005. The rescue pass is POSITIVE-ONLY by construction so a loose match can shrink the residue and can never retire a live organ, and UNCLASSIFIED still means UNKNOWN rather than dead. Dependency-Track inventories components it was given and is Part here rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: LIB-WIRED importers=3 nonval=2 — fully adopted (top of its ladder).Pros Source symbol found; stronger capability claim is authored; ahead of Backstage, SLSA-in-toto, CycloneDX-DepTrack, OmniBOR; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth) | ◉ | ○ | ○ | ◐ | ○ |
Adoption measured as EXTERNAL callers, self-references excluded by designMeasured:ad_is_adopted exists in runtime/_hdl_build/nx_adopt_lib.nx, verified at emit. The census walks the corpus twice rather than once per primitive, and a capability whose only callers are its own file scores ZERO external, so existence never counts as adoption. It further separates DEBT from PROVEN_UNWIRED, where the latter has gate-proven callers but zero production ones -- two states the field routinely merges into dead code. Knip and Dependency-Track cover the equivalent ground for package ecosystems and are Part rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: LIB-WIRED importers=1 nonval=1 — fully adopted (top of its ladder).Pros Implementing source symbol found; runtime acceptance separate; ahead of Backstage, SLSA-in-toto, CycloneDX-DepTrack, OmniBOR; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth) | ● | ○ | ○ | ◐ | ○ |
A promote must prove it loses no capability, and it NAMES each lossSource present; authored stronger claim:cd_show_lost in runtime/nx_contentdiff.nx, verified at emit. The ruler compares the candidate against the LIVE binary and prints every string run present in live and absent in the candidate, so the refusal arrives with a worklist rather than a score. Every automated rollback in the field fires on availability proxies -- error rate, latency, crash rate -- and Google's own canary service states plainly that it is not trying to establish absolute health, so a build that answers 200 to everything while having silently stopped doing something is invisible to all of them. LIMIT STATED: it compares STRING runs, so a code-only delta is invisible to it and size is the evidence there Adoption: RUN-BY:fork:nx_rebuild_drain — fully adopted (top of its ladder).Pros Source symbol found; stronger capability claim is authored; ahead of Backstage, SLSA-in-toto, CycloneDX-DepTrack, OmniBOR; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth) | ◉ | ○ | ○ | ○ | ○ |
Build identity covers the whole import closure, not one fileMeasured:chresolve exists in runtime/nx_closurehash.nx, verified at emit. The closure hash resolves every import transitively and digests the set, so a change inside a shared library changes the consumer's closure digest while its own source digest does not -- which is how a lib is PROVEN to be in a build. It refuses past 1024 closure entries rather than silently truncating. OmniBOR is Best and is the reason this row is not an exceed: its Input Manifests encode the exact inputs used to build an artifact as a first-class, embeddable, reproducible identifier [omnibor], which is the same idea specified for everyone rather than for us Adoption: RUN-BY:fork:nx_closurehash_gate — fully adopted (top of its ladder).Pros Implementing source symbol found; runtime acceptance separate; ahead of Backstage, SLSA-in-toto, CycloneDX-DepTrack; fully adopted on the estate ladderCons behind OmniBOR (leads) | ● | ○ | ◐ | ○ | ◉ |
Organ kind is DECLARED, never inferred from a name substringMeasured:ok_kind_of exists in runtime/nx_organkind.nx, verified at emit. The estate learned this the expensive way: a safety classifier keyed on the substring _gate read a DAEMON as a test and refused its deploy for weeks, and the conclusion recorded in the conf itself is that renaming a third time would be dodging classifiers by luck. Both ship verbs consult the declaration. THE NUMBER THIS ROW FIRST PUBLISHED WAS MISLABELLED AND IS CORRECTED HERE RATHER THAN QUIETLY DROPPED: the census prints declaration_coverage_permil 24 as though it were declaration coverage, but estate finding 1785467176 measured that counter by CONTROLLED CHANGE -- bulk-appending 170 suffix-derived oracle rows moved it not at all -- proving it tallies only the daemon and lib subset. The honest lower bound comes from a different instrument entirely: nx_wirecensus emit mode proposes 718 rows against 1364 registered tools and skips every row already present, so AT LEAST 646 registered tools are declared. The mechanism is right, its adoption is far better than this board first said, and the counter that told me otherwise is the defect. Backstage requires a kind on every entity and is Yes rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: LIB-WIRED importers=20 nonval=19 — fully adopted (top of its ladder).Pros Implementing source symbol found; runtime acceptance separate; ahead of SLSA-in-toto, CycloneDX-DepTrack, OmniBOR; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth) | ● | ● | ○ | ○ | ○ |
in-toto ITE-6 Statement export that external Sigstore and SLSA verifiers can consumeMeasured:main exists in runtime/_hdl_build/nx_coe_intoto.nx, verified at emit. LANDED and live: the exporter reads the latest ed25519-signed frame and the latest Merkle signed tree head and emits a Statement carrying _type https://in-toto.io/Statement/v1 with subject.digest.sha256, a transparency log root, an inclusion proof and a consistency proof, witnessed in knowledge/status/coe_intoto.json this session. SLSA and in-toto are Best because they authored the format; we interoperate with it rather than inventing a rival envelope. What the subject IS remains the gap, and it is the next row rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: REGISTERED-DARK — PARTIAL: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked).Pros Implementing source symbol found; runtime acceptance separate; ahead of Backstage, CycloneDX-DepTrack, OmniBORCons behind SLSA-in-toto (leads); not adopted yet: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked) | ● | ○ | ◉ | ○ | ○ |
Discovery drift audited without registering anythingMeasured:main exists in runtime/nx_toolreg_reconcile.nx, verified at emit. MEASURED 2026-08-28 with the check verb, which registers NOTHING and exits non-zero on drift: verdict RED with the full envelope printed -- drift 3, no-schema 3, scaffold 25, dup-schema 1, stale-desc 0, already-discoverable 1334, missing-row 156. The headline 3 is the actionable count and the seven buckets beside it are why a reader is not misled by it. Backstage and Dependency-Track both reconcile a catalogue against reality and are Yes rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: RUN-BY:clock — fully adopted (top of its ladder).Pros Implementing source symbol found; runtime acceptance separate; ahead of SLSA-in-toto, OmniBOR; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth) | ● | ● | ○ | ● | ○ |
Attest the promoted ORGAN, not only the evidence frameMeasured:pv_build exists in runtime/_hdl_build/nx_provstmt_lib.nx, verified at emit. LANDED 2026-08-29 at the full bar: nx_provstmt re-hashes the LIVE artifact and REFUSES when the receipt's digest differs -- proven BOTH directions on real data (the estate's first artifact-subject Statement written for nx_capsweep.elf with its actual build receipts, and a wrong-digest run answering ATTEST-REFUSED with both digests printed and NOTHING written). Gate 16/16 GREEN via /api/gate_run including the T13 wiring-order neg-control that catches cross-wired digest fields, BITE-PROVEN killed=1 not_reached=0 restore byte-identical. HONEST LIMITS, DECLARED: the Statement is UNSIGNED and says so in-band (the DSSE envelope is owed -- SLSA keeps c2 at Part); attestation is per-ship and caller-invoked, not yet wired into the promote path itself; and the organ's kind declaration is deferred until a sibling seat's dedupe of organ_kind.conf completes, so it currently promotes via the suffix fallback. WHAT WAS TRUE WHEN THIS ROW WAS A WATCH, kept as history: this was the largest honest gap on the board. The exporter's own header states its subject: subject.digest.sha256 is the content CID of a chain-of-evidence frame. MEASURED this session, the live artifact names subject nishi-coe-frame-333. NO ORGAN BINARY IS EVER A SUBJECT, so all 2048 promoted artifacts ship with no attestation at all while the machinery to attest them is built, signed, gated and running two directories away. THE CONTRACT: emit a Statement whose subject is the promoted elf with the digest that /api/promote already computes. RE-SCOPED 2026-08-29 AFTER READING THE BUILD LANE'S OWN RECEIPT, AND IT MAKES THIS RUNG MUCH CHEAPER THAN IT LOOKED: every /api/build response ALREADY CARRIES src_sha256, src_stable and closure_sha256, and /api/promote returns the live artifact sha256 after the rename. Those four fields are precisely SLSA build-provenance -- what source produced this artifact, whether that source was stable during the build, the digest of its whole transitive input closure, and the digest of the thing that actually went live. THE ESTATE COMPUTES REAL PROVENANCE ON EVERY BUILD AND DISCARDS IT AT THE END OF THE RESPONSE. So this rung is a SERIALISATION, not a measurement -- nothing new has to be measured, only bound to a subject and written down. The existing exporter is NOT the place for it: its predicate is entirely chain-of-evidence specific (frameHash, pillars, a Merkle inclusion proof) and its ed25519 publicKey is a hardcoded literal, so extending it would fork one predicate across two unrelated subjects. The shared part is only the Statement scaffolding, which is where the extraction belongs rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: LIB-WIRED importers=2 nonval=1 — fully adopted (top of its ladder).Pros Implementing source symbol found; runtime acceptance separate; ahead of Backstage; fully adopted on the estate ladderCons behind SLSA-in-toto (leads) | ● | ○ | ◉ | ● | ● |
Machine-readable inventory an outside verifier can readDARK —runtime/nx_artifactdrift.nx EXISTS but does not declare ps_bom_emit: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the comparewatch- plane row reads DARK until then. OPEN. MEASURED by nx_absent over buildroot/runtime with coverage_complete 1 and corpus_complete 1: the token CycloneDX occurs exactly TWICE in the entire source corpus and BOTH occurrences are inside nx_sovgit_census_gate declaring this as a gap in its own words -- no transitive dependency graph, no SBOM, no vuln, no provenance. CycloneDX is Best. The censuses already hold every field a bill of materials needs; nothing serialises them into a document an outsider can consume rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind themPros none measured yetCons behind Backstage, SLSA-in-toto, CycloneDX-DepTrack (leads), OmniBOR; open contract; expected source declaration not established | ○ | ● | ● | ◉ | ● |
Every unit names an ownerDARK —runtime/nx_execsurface.nx EXISTS but does not declare es_owner_of: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the comparewatch- plane row reads DARK until then. OPEN. Backstage is Best and it is not close: an owner is a required field on a Component, so an unowned entity cannot enter its catalogue. Our censuses can say a unit is dark and cannot say whose dark it is, which is why every dark list is adjudicated by whoever happens to read it. The drift census already carries an owner axis for IN-FLIGHT scratch detection, so the field exists and is scoped to one question rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind themPros none measured yetCons behind Backstage (leads), CycloneDX-DepTrack; open contract; expected source declaration not established | ○ | ◉ | ○ | ● | ○ |
Close the DARK upper bound instead of quoting it foreverDARK —runtime/_hdl_build/nx_wirecensus_lib.nx EXISTS but does not declare wc_dark_close: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the comparewatch- plane row reads DARK until then. OPEN, and the exceed is that no rival even has this problem because none of them measures invocation. DARK 301 is an upper bound for two NAMED reasons: caps minted before cap_consent.log existed, and caps minted with the root minter on the NAS rather than through the mint endpoint, neither of which reaches the ledger. THE CONTRACT: backfill or age out the pre-ledger mints so the bound collapses to a value. A bound quoted for long enough starts being read as a value by everyone except its authorPros none measured yetCons open contract; expected source declaration not established | ○ | ○ | ○ | ○ | ○ |
The declaration backfill is BUILT AND DARK, and running it today would break the readerDARK —runtime/nx_organkind.nx EXISTS but does not declare ok_declare_backfill: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the comparewatch- plane row reads DARK until then. OPEN, and the shape of this rung was CORRECTED the day it was written. It is not a build: nx_wirecensus already carries an emit mode that proposes organ_kind rows DERIVABLE FROM EVIDENCE and never guessed -- registered-in-allowlist means oneshot by construction, a terminal _gate suffix means oracle by the systems own gate_run rule -- and it refuses to emit DAEMON rows at all, because that is the single class where a wrong row is a rule 26 hazard. MEASURED 2026-08-28: it proposes 718 rows against 1364 registered tools, skipping every row already declared, so the work is ADOPTION not construction. THE REASON IT MUST NOT BE RUN YET IS THE ROW BELOW: those 718 rows are 18074 bytes and the readers cap was 65535 against a 62467-byte file, so appending them would have pushed 15006 bytes of declarations out of sight of the very verbs they exist to inform. The exceed is that the emitter refuses the dangerous direction by construction rather than by review rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind themPros none measured yetCons behind Backstage; open contract; expected source declaration not established | ○ | ● | ○ | ○ | ○ |
Refuse to run an artifact whose attestation does not verifyDARK —runtime/nx_catalog.nx EXISTS but does not declare cat_verify_policy: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the comparewatch- plane row reads DARK until then. OPEN and DELIBERATELY LAST in the ladder, because it is worthless before the attestation subject is the artifact. SLSA is Best: it specifies verification as a policy decision a consumer makes against provenance. Today the lifecycle chain reports what EXISTS and never what VERIFIES, so the catalogue's INVOKED axis records that something ran and never that it was entitled to. This rung must not land before ci_subject_artifact or it would verify a statement about a different object rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind themPros none measured yetCons behind SLSA-in-toto (leads); open contract; expected source declaration not established | ○ | ○ | ◉ | ○ | ○ |
One unit, three censuses, three denominators -- JOINED, and the estate can now state its own countSource present; authored stronger claim:main in runtime/nx_capsweep.nx, verified at emit. LANDED 2026-08-28, in the same session that found the gap. MEASURED ON REAL DATA at first run: units=2418 footer_organs=2418 on_surface=1159 registered=1374 reg_joined=1251 reg_residual=123 authorised=1142 invoked=292 table_truncated=0, partition RECONCILES, verdict GREEN, 66672 bytes of per-unit rows at knowledge/status/capsweep.tsv. WHAT THE CROSS-CHECK ACTUALLY PROVES, CORRECTED THE SAME SESSION AFTER A SIBLING SEAT CHALLENGED IT: units equals the surface census's own published organs total, and this board FIRST CALLED THAT TWO INSTRUMENTS AGREEING. IT IS NOT. Both numbers descend from ONE enumerator -- nx_execsurface builds its population by walking the serving root and _offc, then writes the rows AND the organs total from that same walk, and capsweep reads both out of that one file. So the match is a PARSE-INTEGRITY check over a single artifact: it proves the reader lost nothing the writer wrote, which is exactly the tooth that catches a dropped row, a footer miscounted as data, or a silent truncation -- and it proves NOTHING about whether 2418 is the true population. Independence is a property that must be established, never inferred from two numbers having different names. The genuinely cross-source figures on this row are the joined ones: registered comes from the allowlist, authorised from the consent ledger, invoked from the actlog, so reg_residual=123 IS a two-source claim even though the unit count is not. It COLLECTS NOTHING -- every input is an artifact another census already wrote -- because the moment it grows a collector it becomes a fourth ruler that can disagree with the three it joins. It REFUSES to print a count when the parts do not sum, and reg_residual=123 is the previously invisible class: registered tools the spine never saw, now a NAMED number instead of the gap between three denominators. A GATE IS STILL OWED and this row says so rather than implying a proof it does not have. Promoted sha 9628b0fd, registered callable, kind DECLARED oneshot rather than left to the suffix fallback. ORIGINAL FINDING, PRESERVED: The wiring census counts 2048 promoted artifacts, the surface census counts 2418 organs, the drift census counts 1295 registry rows. All three partitions RECONCILE INTERNALLY and every one is correct about its own subject, so nothing looks wrong -- and yet no reader can state how many distinct units the estate has, because nothing joins them per unit. The per-name chain exists and there is no whole-population pass that emits one row per unit and reconciles the three. Backstage gets a 3 because one catalogue with one entity set is precisely what it provides rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: REGISTERED-DARK — PARTIAL: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked).Pros Source symbol found; stronger capability claim is authored; ahead of Backstage, SLSA-in-toto, CycloneDX-DepTrack, OmniBORCons not adopted yet: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked) | ◉ | ◐ | ○ | ○ | ○ |
The reader that decides ship policy reads the WHOLE declaration fileMeasured:ok_kind_of_path exists in runtime/nx_organkind.nx, verified at emit. FOUND AND FIXED IN SOURCE 2026-08-28 WHILE WRITING THIS BOARD, AND DELIBERATELY NOT CLAIMED AS PROVEN. This function is what /api/promote consults (nx_mgmt_api.nx:3458) and it read at most OK_CONFBUF-1 = 65535 bytes with NO truncation check, against a declaration file measured at 62467 bytes -- 3068 bytes of headroom on a file that only grows. nx_organkind_gate T24 names the consequence exactly: past that cap a DECLARED DAEMON reads as UNDECLARED and the terminal-suffix fallback then makes a *_gate name PROMOTABLE, the one misfile rule 26 forbids, failing in the flattering direction with no error anywhere. The fix composes sys_read_file, which sizes from lseek END and cannot short-read, so the cap is REMOVED rather than raised; OK_CONFBUF is kept so a revert re-arms T24. STATE, STATED PLAINLY: the source edit landed under CAS but the build was refused by admission and ENQUEUED (BQ-nx_catalog reads queued), so this is UNBUILT and UNPROVEN, and the bite that would prove it -- a fixture conf past 65535 with a daemon row beyond the cap -- is owed on debt 1787938660. Backstage reads its whole catalogue and is Yes rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: LIB-WIRED importers=20 nonval=19 — fully adopted (top of its ladder).Pros Implementing source symbol found; runtime acceptance separate; ahead of SLSA-in-toto, CycloneDX-DepTrack, OmniBOR; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth) | ● | ● | ○ | ○ | ○ |
The name you asked for is the unit you get, and the alias class is partitioned rather than countedMeasured:ac_own_src exists in runtime/nx_aliascensus.nx, verified at emit. MEASURED 2026-09-04 and this row is the counterweight to the derived-not-declared row above, because it is that design's characteristic failure and it was ours. nx_catalog_lib cl_regresolve resolved a tool name through tool_allowlist.conf field 2, took the basename and stripped the .prev and .new and .elf and .sov suffix chain, and cl_ladder then keyed SOURCE and BUILT and STAGED on THAT, so the catalogue published another organ's bytes under the name you asked for. Root-fixed today and nx_catalog now prints a RESOLVED line naming which rule decided; nx_aliascensus is the tooth that keeps it fixed, and it partitions every registry row into SELF and ALIAS-MASKED and ALIAS-PURE and UNREADABLE with the sum reconciling to the rows read. THE ORGAN REPORTS rows 1588, self 1489, alias-masked 24, alias-pure 75, unreadable 0, sum 1588, selftest 7 of 7. INDEPENDENTLY RE-DERIVED FOR THIS ROW rather than inherited: reading the live 128128-byte registry at the nishihost root and applying the same strip-and-compare by hand gives 1592 rows, self 1493 and alias 99, and statting the two source roots the builder probes splits those 99 into exactly 24 masked and 75 pure, naming nx_fs and nx_https_get among the masked. The alias classes agree exactly; the plus-four in rows and self is registry growth since the census ran. The sharp distinction is the one no rival has to make: ALIAS-PURE is an honest entry point where SOURCE absent is the CORRECT report, while ALIAS-MASKED is a real artifact silently replaced, and reporting a complete four-rung lifecycle for a name that owns no files was the concrete harm. ac_own_src stats _hdl_build first then runtime, the builder's own probe order, which is what turned a declared floor of 20 into a measured 24. NOT AN EXCEED AND DELIBERATELY SCORED 0: Backstage cannot have this defect because its identity is DECLARED in a hand-authored descriptor carrying an explicit apiVersion and kind [backstagedesc], so there is no resolution step to get wrong, and that is precisely the cost of deriving a catalogue instead of declaring one. in-toto and CycloneDX and OmniBOR each key identity on a digest or a content-derived artifact identifier, so a name can never mask a unit for them either, but none of the three answers the question what are the bytes for name X at all, which is why all three read Part rather than Yes. HONEST LIMITS: the classifier is exact only over the two roots named above, a source elsewhere would read as ALIAS-PURE; and the guard is not yet on any beat, which is the open contract in the plan Adoption: REGISTERED-DARK — PARTIAL: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked).Pros Implementing source symbol found; runtime acceptance separate; ahead of SLSA-in-toto, CycloneDX-DepTrack, OmniBORCons not adopted yet: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked) | ● | ● | ◐ | ◐ | ◐ |
The alias-masked count is fenced by a ratchet, so the identity fix cannot silently regressDARK —runtime/nx_aliascensus.nx EXISTS but does not declare ac_ratchet: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the comparewatch- plane row reads DARK until then. OPEN CONTRACT for rung CR9. The census is LIVE and its partition reconciles at rows 1588 self 1489 alias_masked 24 alias_pure 75 unreadable 0, but nothing holds that 24 down: a new aliased row that masks a real source would raise it silently and the catalogue would go back to publishing another organ bytes under the name you asked for. Done when a baseline file carries the NAMES not merely the count, a rise names the offender, a fall tightens the floor, and a neg-control proves the baseline is never rewritten on a risePros none measured yetCons open contract; expected source declaration not established | ○ | ○ | ○ | ○ | ○ |
| Class | Count | Note |
|---|---|---|
| rows with rival marks | 16 | rows carrying a Yes, Best or Part in a rival column |
| cited | 2 | a reference mark resolves to a pinned mirror |
| uncited | 14 | an observation read, badged until a reference lands |
| rows, summed | 16 | RECONCILED: the parts sum to the total 16 |
Delivery and evidence
Inspect risks, technical debt, rendered observations, experiments and references. Read scope and limitations alongside every result.
Risk register
| Risk | Likelihood x impact | Mitigation |
|---|---|---|
| CR2 auto-declares a kind wrongly and a daemon is promoted as a oneshot | possible x high | only mechanically certain classes are applied, the 296 UNCLASSIFIED stay a human worklist, and the existing suffix fallback remains as the second opinion rather than being deleted |
| CR4 emits a bill of materials whose fields are guessed to satisfy a schema | probable x high | an unfillable field prints UNOBSERVABLE and the gate asserts the emitted unit count equals CR1 exactly, so a document that looks complete cannot be produced from an incomplete join |
| CR6 lands before CR3 and verifies a statement about a different object | possible x high | the dependency is declared in the rung row and the ladder places CR6 in M4 behind CR3 in M2; a verification axis over evidence-frame subjects would acquit every organ binary in the estate |
| CR1 publishes a unit count from a partition that does not sum | possible x medium | the done-rule refuses to publish a count unless the partition reconciles, which is the same refusal the three existing censuses already make individually |
| The joined registry becomes a second source of truth beside the artifacts | probable x medium | CR1 derives on every run and banks nothing a later run cannot recompute; if it ever needs a stored table, that table is a cache with a stamp and a staleness refusal, never a declaration |
Release history and work log
| When | Rung | Kind | Entry |
|---|---|---|---|
| 2026-09-10 | CR6 | lesson | Operator direction 2026-09-10: catalogue must be meaningful and usable by developers, average users and agents against dated current research. Stable capability identity and primitive/workflow/team relationships must support task-oriented discovery, callable input/output contracts, owner, dependencies, versions, side effects, permission scope, evidence freshness and separate installed/private/published/user-outcome status. Logical component independence does not require separate processes or calls. Serial, parallel and fused workflows must be chosen from dependencies and observed device resources, locality, contention and transfer/dispatch costs; preserve quality, publish observed latency/resource/correctness results and abstain when unmeasured. Beach is the proving workload. Current nx_catalog_lib cl_ladder48260B source review finds registration plus substring consent evidence plus any completed historical MCP call can classify LIVE; that is lifecycle evidence, not proof of current authorization or quality. Extend existing owners and CR6 verification work; no duplicate catalogue or automatic SOTA label. Research fetched through estate API: Arazzo1.1.0 dated2026-05-17, knowledge/fetched/rf_33f47cc3.raw237808B SHA8e2ea7d20accaef846080bca77d349b137414e66c94f015a002b290cbf79b538 describes workflow dependencies and outcomes; MCP official registry API knowledge/fetched/rf_bc4768fc.raw5615B SHA37989fc77551006d7fc3d34954c1f9d81a4edace8afc519d92b1c82a1b031dd9 describes versioned discovery, incremental synchronization and explicit status. Neither source establishes Nishi conformance or complete SOTA coverage; catalogue UX, ranking efficacy and execution-quality benchmark remain open. |
Person · product · place — not yet measured for this domain
knowledge/compare/capregistry.ppp (rows surface|nishi or c1..c4|label|url|connect naming OUR live surface and each rival's front door), run nx_ppp_probe domain capregistry, and this section fills itself on the next beat: the same ruler on both sides — privacy and CX (third-party hosts, tracker classes, cookies, security headers), design and longevity (design hygiene, computed WCAG contrast, render-blocking resources, unsized media, script weight, theme and motion queries), findability (landmarks, skip link, on-site search, breadcrumb, headings, internal links).The field — discovered, not chosen
Rows written by nx_field_discover from capregistry.seeds: the industry's own lists (Wikipedia wikitext, GitHub topics, awesome lists) read mechanically, every candidate counted across seeds. The matrix columns above are a SEAT'S pick; this band is the population they were picked from, and the stats line measures one against the other. A rival here is a lead, never a verdict — it earns a column when its capabilities are read and pinned.
| Class | Count | Note |
|---|---|---|
| seeds | 4 | |
| scanned | 4 | |
| fetched | 4 | |
| reused | 0 | |
| failed | 0 | |
| named | 4 | |
| candidates | 4 | |
| mentions | 4 | |
| capped | 0 |
| Rank | Rival | Seeds | Mentions | First seed | Kind | Link |
|---|---|---|---|---|---|---|
| 1 | Backstage | 1 | 1 | col0-backstage | named | https://backstage.io/docs/features/software-catalog/descriptor-format/ |
| 2 | SLSA-in-toto | 1 | 1 | col1-slsa | named | https://raw.githubusercontent.com/in-toto/attestation/main/spec/v1/statement.md |
| 3 | CycloneDX-DepTrack | 1 | 1 | col2-cyclonedx | named | https://cyclonedx.org/specification/overview/ |
| 4 | OmniBOR | 1 | 1 | col3-omnibor | named | https://raw.githubusercontent.com/omnibor/spec/main/spec/SPEC.md |
field candidates 4|shown 4 of 4|matrix columns in the field 4 of 4|discovered rivals with no column 0|malformed rows 0 (counted, never rendered)|read-capped 0
Exclusive and shared capabilities
This board grades 25 capabilities: 22 exclusive to it and 3 shared with other boards. Shared rows on this page: 3 = home here 0 + home elsewhere 0 + ambiguous 0 + undecided 3 + refused 0 (partition 3); undecided = unmapped 0 + unproven 3 + unevidenced 0; homonyms 1; since the previous census: new 0, resolved 0. Census FRESH age_s=7032.
| Capability | Organ | Boards grading it | Home | Rule | Evidence | Standing on this board |
|---|---|---|---|---|---|---|
| main | - | browser:runtime/_hdl_build/nx_uiq_perf.nx, graphviz:runtime/_hdl_build/nx_eco_graph_forest.nx, graphviz:runtime/_hdl_build/nx_eco_graph_png.nx, graphviz:runtime/_hdl_build/nx_eco_graph_forest.nx, graphviz:runtime/_hdl_build/nx_eco_graph_wiki.nx, familyatlas:runtime/_hdl_build/nx_eco_graph_png.nx, familyatlas:runtime/_hdl_build/nx_eco_graph_card.nx, ecosysdesign:runtime/_hdl_build/nx_eco_graph_arch.nx, typography:runtime/nx_font_ttf_emit.nx, koikatsu:runtime/_hdl_build/nx_retarget_emit.nx, pmdash:runtime/nx_dr_ocm_cli.nx, failmodes:runtime/nx_compare_refs_gate.nx, ecosystem:runtime/nx_compare_rank_fleet.nx, gen:runtime/_hdl_build/nx_gen_orchestrator_daemon.nx, capregistry:runtime/nx_catalog.nx, capregistry:runtime/_hdl_build/nx_coe_intoto.nx, capregistry:runtime/nx_toolreg_reconcile.nx, capregistry:runtime/nx_capsweep.nx, datavis:runtime/_hdl_build/nx_chartlay_gate.nx, speech:runtime/nx_voice_eval.nx | — | homonym | - | homonym |
| cd_show_lost | nx_contentdiff.nx | devmgmt, codequality, autodev, capregistry, codeeffectiveness | — | none | unproven | undecided |
| ps_judge | nx_artifactdrift.nx | devmgmt, capregistry, codeeffectiveness | — | none | unproven | undecided |
| cat_one | nx_catalog.nx | devmgmt, capregistry | — | none | unproven | undecided |
Gaps from the record — what the estate does that no board carries
The record census (nx_goalmap record) reads the invoked-tool population and every plan queue row and files each organ or directive that NO matrix, plan or gates row names. A row here is a callout the boards missed: adjudicate it onto a board or declare it infrastructure. Census state STALE (age 1396137 s), sources read 4 of 7 declared — a BLIND census is a FLOOR: unread sources can only add rows.
| kind | name | board | source | evidence |
|---|
rows shown 0|this board's directives 0|estate-wide un-boarded organs 452 (listed in full on /compare/ecosystem)|census rows 639|malformed 0 (counted, never rendered)
References
- [backstagedesc] Backstage. Software catalog descriptor format -- the entity descriptor is a hand-authored file the docs recommend naming catalog-info.yaml, carrying apiVersion backstage.io/v1alpha1 and kind Component. Witnessed verbatim in the mirror at line 11. publisher · read in our library
knowledge/fetched/cmp_capregistry_backstagedesc.html· pinh6d83af57702340a7f72f8796bfbfe07f67f95e0606f4b4c04b94edfc7ade4790· accessed 2026-08-28 · vendor-docGrounds: The derived-not-declared row: the field's unit of record is a second artifact beside the thing it describes. - [backstagecat] Backstage. Software catalog overview -- the catalog tracks ownership and metadata for every software component in an ecosystem, and ownership is modelled as a first-class relation rather than a tag. publisher · read in our library
knowledge/fetched/cmp_capregistry_backstagecat.html· pinh40b397cf9fc39c16173004fd2729ceceb4e58c402f373a4513429a2a5c99b598· accessed 2026-08-28 · vendor-docGrounds: The owner-per-unit watch row and the CR5 rung: the bar we are measured against on ownership. - [intoto] in-toto Attestation Framework. Statement layer specification v1 -- each subject element MUST have digest set, subjects are assumed immutable, and the spec states IMPORTANT subject artifacts are matched purely by digest regardless of content type. publisher · read in our library
knowledge/fetched/cmp_capregistry_intoto.md· pinhcbe684a18b812b8b613d9202eb43b2ea24477f91a2ad6ca5be935185a455ebea· accessed 2026-08-28 · published-standardGrounds: The serving-drift row: matching by digest is exactly why an attestation cannot answer which artifact is being served. - [slsa] SLSA. Security levels specification v1.1 -- the Build track defines L1 through L3 over provenance of the build, and verification is specified as a policy decision a consumer makes against that provenance. publisher · read in our library
knowledge/fetched/cmp_capregistry_slsa.html· pinh205e3c5341c380e2d24eb453a13f52bed8542eb9862cd533c0b9d1342f0fac7e· accessed 2026-08-28 · published-standardGrounds: The lifecycle-chain row and the CR6 verification-policy rung: the field's bar for build provenance and for consuming it. - [cyclonedx] OWASP CycloneDX. Specification overview -- a full-stack bill of materials standard covering software, hardware, services, vulnerabilities and formulation, with defined serialisations. publisher · read in our library
knowledge/fetched/cmp_capregistry_cyclonedx.html· pinh68bd1442218ac2051f33c6f8f694c61305ce50f54cb943ff777afbc350b1ecc8· accessed 2026-08-28 · published-standardGrounds: The SBOM export watch row and the CR2 rung: the format an outside verifier would expect to be handed. - [spdx3] Linux Foundation. SPDX specification v3.0.1 -- the ISO-standard bill of materials model, restructured in v3 around profiles so build and AI and security data ride the same document graph. publisher · read in our library
knowledge/fetched/cmp_capregistry_spdx3.html· pinha905ca11b54700955ba92b4dbdf9d35553852b82bfddf2fabc06cabc194e120a· accessed 2026-08-28 · published-standardGrounds: The CR2 rung: the second serialisation an inventory must not preclude, and the reason CR2 emits a model rather than one vendor format. - [deptrack] OWASP Dependency-Track. Documentation home -- a continuous component analysis platform that ingests bills of materials and tracks the inventory over time rather than at one scan moment. publisher · read in our library
knowledge/fetched/cmp_capregistry_deptrack.html· pinhc7299db22f17a688550e34c2f1ae4697324fb390d906a2af8826a3f74bb56e41· accessed 2026-08-28 · vendor-docGrounds: The adoption and unexposed-triage rows: the incumbent that consumes an inventory continuously, which is the column we score Part against. - [omnibor] OmniBOR. Specification v0.2 Draft -- defines two concepts that together enable consistent reproducible embeddable identification of software artifacts and the encoding of the exact inputs used to build them: Artifact Identifiers and Input Manifests. Quoted from section 2 of the mirror. publisher · read in our library
knowledge/fetched/cmp_capregistry_omnibor.md· pinhbeb2dd6f45c1de7582a41e7e8f176b284ee6bc1739e9e6334fb863db4e08fc47· accessed 2026-08-28 · published-standardGrounds: The build-closure identity row: OmniBOR is Best there and is why that row is not claimed as an exceed. - [omniborsite] OmniBOR project landing page. Fetched 2026-08-28 and probed for the token gitoid, which returned matches=0 over the fetched corpus with coverage_complete 1 -- so this mirror grounds NOTHING and is declared as a thin index only. publisher · read in our library
knowledge/fetched/cmp_capregistry_omnibor.html· pinhb7a195ed0e046d92e72447b14b940d890a4c4737e0233468369af23f63845855· accessed 2026-08-28 · mirrored-indexGrounds: The refs-hygiene note in this file: a mirror that could not ground its claim is declared rather than quietly reused. - [knip] Knip. Project documentation home -- finds unused files, dependencies and exports in a JavaScript and TypeScript project, the field's working answer to dead surface in a package ecosystem. publisher · read in our library
knowledge/fetched/cmp_capregistry_knip.html· pinh2ca000f15fd10f9a2b263d87f96414155ecf0dedbb057b73385a1a6665abd4b5· accessed 2026-08-28 · vendor-docGrounds: The adoption row: our wiring census names itself after this tool, so the comparison is owed rather than optional. - [scorecard] OpenSSF Scorecard. Check documentation -- the published per-repository check set including Binary-Artifacts, Branch-Protection, CI-Tests, Maintained and Pinned-Dependencies. publisher · read in our library
knowledge/fetched/cmp_capregistry_scorecard.md· pinhd1a667647fa408a706e6796a855edc918d1d6dad2d6f6f5aa37802837a66c7d8· accessed 2026-08-28 · published-standardGrounds: The scope note in capregistry.plan: fetched deliberately to record WHY Scorecard is not a column here, since it is the anchor rival of the instrument domain and its subject is repository practice rather than artifact lifecycle.
generated by nx_swcompare_matrix (sovereign NishiLang organ) from knowledge/compare/capregistry.matrix · source checks show implementation presence; runtime and user-outcome evidence are reported separately · JavaScript supports page controls