The complete build record.

The corpus outgrew the daemon quietly, and the bill arrived all at once: a restart on real state read the entire database and took most of an hour to come back, which makes every upgrade an outage and every crash a gamble — and the watchdog meant to catch a wedged daemon turned out to have a failure mode of its own. So the campaign inverted the roadmap. Before any new ability, the substrate itself had to become boring: restart cost bounded by a hard budget that never scales with data, a watchdog whose authority comes from the supervisor rather than from the daemon’s opinion of itself, integrity verification that runs while the daemon is already serving, and recovery that leaves receipts instead of folklore. Everything else the fleet wants to build stands on this being true.

Ability activated An owner can stop, upgrade or lose the daemon without planning around it: Sophia comes back serving in seconds rather than in proportion to how much she knows, verifies her own integrity while already answering, survives her heaviest background work under a strict external watchdog, and a crash leaves the data safe behind a tamper-evident journal with a governed path back to writes.

4 of 7 waves landed. The measured ruling, the watchdog authority fix, the serve-first restart architecture and the converged census are on the main branch and running live. The chunked verification and one-pass checkpoint work is merged and validated against the live daemon, and lands publicly in one consolidated deploy; the four-primitive consolidation is approved architecture landing in reviewed slices behind it. The endgame is stated once and holds everywhere: restart cost must never again scale with the size of what Sophia knows. And the payoff has a name — governed context delivery, the next arc, exists only because this one is true.

Everything else on this page builds the substrate; this is the arc the substrate was built for. Sophia cannot force a model to be smarter than it is. What she can own is the delivery boundary: select the state relevant to a declared question, keep provenance, authority, correction, temporal and contradiction semantics intact across the hand-off, compute exact facts where a deterministic graph operation can replace model search, say out loud whether the supplied evidence is complete, fail closed when coverage cannot be established — and record precisely what the model received before it answered. And the reason this is not one more retrieval feature: a bundle like that cannot be bolted onto an ordinary store. Certifying provenance requires a journaled write history; surfacing the correction that outranks a claim requires supersession the database itself enforces; stating what was NOT delivered requires a coverage denominator the system actually computes. Retrieval over an unverified store can assemble plausible context — it cannot sign for it. The model keeps interpretation; the substrate keeps the evidence; the receipt is the boundary between them.

Ability activated An agent can ask a declared question and receive a compiled fact bundle instead of a search result: every fact bound to its supporting records, provenance and authority preserved, corrections and contradictions surfaced rather than flattened, deterministic graph operations computed exactly instead of guessed — with a statement of whether the evidence is complete, and a receipt recording exactly what the model was given before it made a claim. No ordinary retrieval stack can honestly issue those receipts: they exist only because the state layer underneath is journaled, verified and supersession-aware.

0 of 4 gates landed. Nothing in this arc is on the public main branch yet, and the rail says so: the implementation is complete and has passed its commit-by-commit reviews, and it stays dark until the knowledge graph it compiles from proves its accuracy in live use. The pilot evidence is bounded and synthetic, and this page treats it that way. The claim being made is precise — this is what the substrate buys, and it is nearly ready to be proven — and it is never the claim that it works today.

The project had already mined code into evidence-bound claims and left them switched off — a layer that existed but nothing read. R1 turns that foundation into a verified graph: exact source sites become receipt-backed edges, receipts invalidate when their source or resolver changes, and the research path answers only from admitted evidence. A false “resolved” edge remains worse than an honest “unresolved” one. The graph is now on the main branch and running against the real repository under a reversible canary; default promotion still waits for the graph to survive the work it was built for.

Ability activated An agent can ask what a codebase does and receive an inspectable path through exact symbols, source sites and resolved edges — or a precise instruction to open source when the graph cannot prove the answer, never a plausible story disguised as structure.

7 of 9 milestones landed. R1 and both productization rounds are on the main branch: shared vocabulary, verified research, correctable claims, the reversible canary, receipt-backed resolved edges, and bounded reads under complete checkout authority. Live dogfood has already found and fixed the overview path that could kill the daemon, and has opened the next honest gaps around checkout identity, research usefulness and bounded reads. The canary remains deliberate; the accuracy proof and fresh mining runs are what everything downstream — including governed context delivery — now waits on.

The broker could already issue a durable lease, but the owner could not yet govern the thing it created. A human-facing agent name still did too much work: identity, role, target and authority could collapse into one string, while migration from existing harness keys had no safe product path. Phase C separates those concerns into workspaces, profiles, leases, Seat Names, connections and receipts — then makes every owner transition versioned, audited and reversible. It landed beside the verified code graph under one integration gate because both features depend on the same promise: the agent asking a question must be the exact durable party the system says it is.

Ability activated An owner can run many agents as stable seats inside durable workspaces: identity survives credential rotation and daemon restarts, authority stays scoped to the workspace, and explicit handoffs carry the work across fresh connections without pretending the new process remembers the old one.

6 of 7 phases landed. The contract, authority core, owner controls, canonical targeting, handoffs, migration/recovery path, exact-tip live seal and now the trusted presence provider with its native tray are on the main branch. The owner product graduates in bounded phases: managed launch was held false while browser presence was the only presence available, and the operating-system provider it was waiting for now exists. The next evidence comes from using it on the real fleet.

The incident was small enough to be embarrassing: “landing, but waiting on the final baseline” read as “landing has started” when the truth was “verification is still running.” Better wording would have fixed that sentence and none of the ones after it. The real fault is the substrate — the current state of a piece of work is scattered across several messages, later messages quietly supersede earlier ones with nothing marking which is current, and a reader has to infer cause and order from timestamps and tone. So the fleet is doing to its own coordination what it already did to its knowledge: state stops being something you reconstruct from prose, and becomes something the system derives from an append-only log of typed events. Posts stay — as commentary. They stop being the place the truth lives.

Ability activated Agents can act on one causally ordered state of the work: stale writers lose, terminal outcomes stay terminal, and “what is true now?” no longer depends on interpreting the latest sentence in chat.

9 of 10 waves landed. Everything except the cutover is on the main branch: the contract, the engine (core, heads and evidence classes), the readable and writable surfaces, and now a work-contract protocol whose events carry durable identity — with reply threading held to the same standard as everything else. What remains is the cutover, where posts stop being the source of truth and become commentary on it. That step is deliberately last — the ledger has to be trustworthy to read AND write before the fleet is asked to run on it.

The ask sounds simple: let Sophia, with explicit permission, point spare model capacity at whatever it most needs to learn. Everything hard about it is in the word “authority.” So the design splits the machine along a trust boundary and refuses to blur it: Sophia owns policy, queues, leases, evidence and truth; a separate local Runner — planned in Rust precisely because its correctness is about owning OS resources, not application data — holds provider credentials and processes; and the workers themselves receive only an expiring, non-delegating sliver of authority that dies with the job. Model output stays untrusted no matter who produced it. Each gate below must survive an adversarial panel before the next may begin, and the record keeps the failures.

Ability activated An owner can turn spare model capacity into a governed learning fleet: disposable workers get only the task-sized authority they need, while their output still has to earn promotion into shared truth.

4 of 6 gates landed. H0, H1, the Runner’s contract boundary and now H2 are on the main branch, each through an adversarial panel — H0 needed three rounds to survive one. H2 means the worker lifecycle exists end to end and is deliberately dark: the signed canary ran, the authorities expire, and nothing spawns unattended until the owner has a room to govern it from.

The fleet got honest machinery months before its owner got an honest view of it. This arc rebuilds the product’s face from first principles, and the first principle is a covenant: the window never invents status. Everything rendered derives from a named substrate and says what class of evidence it is — observed, agent-asserted, or derived — and how old; silence renders as unknown, never as a green dot; an agent’s claim about itself is labelled as exactly that. The second principle is that old interfaces do not get to haunt new ones: both previous shells died by owner attestation behind manifest tests that make their return a build failure, not a regression to notice.

Ability activated The owner can see what the system knows, what the fleet is doing and where intervention is required — then curate, retire or govern it without translating raw protocol objects or trusting invented status.

5 of 6 units landed. U0 through U4 are on the main branch, each through independent panel seats. The accepted prototype now governs the shell, Today, Work, Knowledge, entity Overview and a workspace-first Agents room. What remains is narrower and explicit: Sources and Settings still need the same evidence-first composition, so the arc stays open. The owner drove the running window live against a copy of his own data before any of it merged.

Users have talked to Sophia from the first pairing code — the agent, the memory, the tools all carry her name — while the daemon, the package, the service files and sixty-seven environment variables answered to the project’s old working title. Before the first public release is exactly when a rename is cheapest: there is nobody to migrate yet except the fleet itself. The surface was measured before anything moved — every file, every wire header, every path a running install depends on — and the rules were written down first: forward-only, no history rewritten, and every slice leaves a daemon that boots.

Ability activated A user can install, run, recover and connect to one coherent product identity while the state migration remains forward-only, restart-safe and compatible with installations created under the old name.

5 of 7 slices landed. The whole runnable surface — shim, package, data move, wire, strings — landed as one reviewed stack and now runs live: the project’s own install answers to sophia-daemon, and its state directory made the move under the single-owner lock on the first boot. The docs and the repository name remain, deliberately last.

An agent finished its work and asked for review. The act of asking hid the request: posting the closeout archived the channel the request lived in, and an archived channel is not in the reviewer’s inbox. Nothing errored. The closeout was clean, the inbox was quiet, and an agent waited on a verdict that could not arrive. That opened a worse question — where ELSE does this system report success it never actually observed? — and the answers were worse than the incident. One question is now being put to every layer: did you look, and at what? A code change must prove it. A scan must prove it. A search must prove it. An agent that says it is blocked must be able to be answered.

Ability activated An orchestrator can tell the difference between offline, idle, working, blocked and gone — then route or escalate from evidence instead of guessing from a green dot or a message count.

6 of 9 phases landed. Five phases are on the main branch. Two of them landed while this page was being rebuilt to track it — one of those was caught by the watch that now guards it, an hour after the watch was written. Which is the whole argument for no longer typing these by hand. The rest are named, not started.

Orient is the first thing an agent calls when it wakes with no memory of yesterday, which makes it the one surface that cannot afford to bluff. The rebuild gives it a fixed, structural order for what is urgent; forbids it from recommending a tool the calling agent cannot actually reach; and requires it to name why any part of its answer is missing rather than return an empty section and let the reader assume the best. It composes what other subsystems already own and may not re-derive their state — a second implementation of the truth is a second thing that can be wrong.

Ability activated A brand-new agent can recover the work, corrections, obligations, available tools and right next move in one bounded handshake instead of spending its first context window reconstructing yesterday.

3 of 7 arcs landed. Arcs 0–2 are on the main branch. Arc 2 landed with its own invariant gates — the coordination boundary is enforced by tests that fail when it is crossed, not by a paragraph asking nicely.

MCP defines what an agent may call; skills define how and when it should act. Sophia governs both sides of that boundary. Its operating methods are authored once as a capability graph and executable workflow contracts, compiled into native routers for each supported agent tool, and checked against the live tool surface. This matters because a skill body is instructions another agent loads and obeys: distributing one creates an instruction-supply-chain and prompt-injection boundary, not merely a packaging task. The runtime can now distinguish a matching installed release from missing, drifted, replayed or manually loaded material. It still refuses to confuse that evidence with cryptographic attestation or proof that a model followed the method.

Ability activated Sophia can give every supported agent the same reviewed operating method, reject workflows that exceed their declared capability, verify a matching installed release at session start, and expose drift or missing activation without letting a skill widen the agent’s authority.

9 of 10 waves landed. The governed pack is live across Claude Code and Codex, all twelve routers have been dogfooded against the real daemon, and the runtime now exposes matching, degraded and unattested installation state without changing ordinary tool authorization. The remaining security arc is narrower and explicit: sign releases, verify them cryptographically, and keep behavioral observation separate from proof of artifact and activation.

Mined code gained a semantic layer: claims about what a symbol does, not merely where it lives. Four rounds of review went into it, and almost none of them argued about what the layer could do — they argued about what it is allowed to ASSERT. The final gate now makes that boundary executable: only admitted, evidence-bound claims may speak as verified knowledge, and insufficient coverage must fall back to source. Product rollout remains a separate concern in Verified Retrieval, where a completed trust foundation cannot be rounded up to universal coverage.

Ability activated Sophia can retain semantic knowledge about code between agents without granting free-form model prose the authority of parser evidence — and a human correction can permanently outrank the model’s earlier interpretation.

All 5 rounds landed. All four trust rounds and the executable read gate are on the main branch. The layer remains governed by the reversible rollout in Verified Retrieval; completing this foundation means the policy exists and is enforced, not that every repository has enough admitted claims to answer every question.

The incident was mundane, and that is the point. Under memory pressure, a second copy of the daemon — an accidental duplicate, started by hand — kept holding the encrypted state database’s lock after it had stopped serving, and ignored every polite request to stop. The managed service behind it could not get in: it hit the busy database eleven times, restarting into the same wall, until something finally killed the wedged process. Nothing was malicious and nothing was even a bug in the ordinary sense — two well-behaved daemons simply both believed they were in charge, and the system had no way to say that only one may be. So ownership stops being an assumption and becomes something the kernel enforces: at most one process holds the lock, it holds it explicitly, a supervisor can see who holds it, and anyone who cannot get it fails fast and loudly instead of storming the door. On top of that single guarantee, an identity broker can finally give each agent workspace a durable place in the system that survives a restart.

Ability activated Sophia can preserve an agent workspace across daemon restarts without ever letting two daemon processes issue competing identities or touch the encrypted state at once.

All 5 waves landed. The five waves are on the main branch: the frozen invariant, the kernel lock, the identity broker, durable leases, and the daemon wiring — the identity-broker integration independently verified against an exact commit by a second review seat. The guarantee is deliberately scoped and stated rather than overclaimed: it holds under an explicit, owner-ratified threat model — the accidental same-user duplicate that caused the incident — and where the boundary of that model sits is written down and accepted on the record, not implied to be absolute. The owner-facing product that governs those identities has now landed as the separate Workspace Identity arc above; its staged dogfood remains in progress.

A retrieval layer that quietly serves stale or duplicated material is worse than one that returns nothing, because it is confidently wrong and nobody can tell. Three findings, each one a way the corpus had drifted away from the truth it claimed to hold — and each fixed at the chokepoint rather than at the reader.

Ability activated Every connected agent can work from the current corpus instead of rediscovering that search ranked a retired revision or counted the fleet’s working copies as new knowledge.

All 3 fixes landed. All three are on the main branch. The retirements are reversible — an undo that cannot be undone is a deletion with better manners.

Two agents sat blocked on each other for twenty-five minutes. Neither was broken and neither was idle — each was politely waiting, and nothing in the system could say so out loud. From inside a deadlock it looks exactly like patience. Everything here follows from that: a count is telemetry, and telemetry is not a signal.

Ability activated Separate models can operate as one accountable team: addressed handoffs arrive, declared waits become obligations, closeouts carry machine-readable proof, and deadlocks become visible while they can still be broken.

All 3 arcs landed. All three on the main branch. The liveness surface publishes its own blind spot: half the definition of an orphaned wait needs a registry that does not exist yet, so every response says so rather than returning an empty list and calling it all-clear.

A skill is not data: it is instructions another agent loads and obeys, delivered automatically, with the system’s own authority behind it. Any agent holding a full-access key could publish one — which made it a standing cross-agent injection channel that nobody had noticed, because it looked like a content feature.

Ability activated Sophia can let agents draft reusable operating knowledge without letting any agent silently publish instructions that every other agent will load and obey; activation remains a human authority decision at the storage chokepoint.

All 3 rounds landed. Three rounds of adversarial review, each one hardening the last. The honest limit is stated on the product page: the defence is human approval, not content inspection — nothing scans a skill body for hostile prose.