Google’s whitepaper drew the new software lifecycle in prose and diagrams: Agent = Model + Harness, specification as the bottleneck, verification as the differentiator, evals as the bar. It told you what the discipline looks like. The [&] Protocol stack ships the substrate — every one of those informal ideas turned into a composable, property-tested protocol with a verdict you can audit.
01 · The spectrum, restated
The whitepaper’s central move is a continuum — vibe coding on one end, agentic engineering on the other — where the only real axis is how outputs get verified. Drag the slider. Notice that the words change, but the question never does.
“Generation is mostly solved. The work that’s left is specification and verification — and the systems that hold them together.” — The New SDLC With Vibe Coding (Osmani, Saboo, Kartakis), Google, 2026
02 · Agent = Model + Harness
The whitepaper’s most quoted figure: swap the model, get marginal gains; swap the harness, move an agent from outside the Top 30 into the Top 5 — that result is on Terminal Bench 2.0, with no model change, and it’s worth checking rather than taking from us (Osmani, Agent Harness Engineering, April 2026). The intelligence is rented. The scaffold — instructions, tools, memory, orchestration, observability, governance — is what you actually build and own.
Rented intelligence. Interchangeable. The part you don’t control and shouldn’t over-invest in.
Instructions & rule files, tools & MCP servers, sandboxes, orchestration, hooks, observability — and the governance that decides what’s allowed to run.
Each harness layer becomes a named protocol with a schema and a conformance suite — not a folder of prompt files you hope still works next week.
03 · The open problems
The whitepaper wasn’t the end of it. In April 2026 Osmani followed up with Agent Harness Engineering, which closes by naming three things nobody has solved yet. That list is a better organising principle for this page than “here is our stack,” because it says what the stack is for — and it lets you grade us against someone else’s scorecard instead of one we wrote. These are attempts, not solutions. Every status below is the same label used in the maturity table.
Our answer is to remove the thing that needs orchestrating. TRVM is a distributed
interaction-calculus runtime: interaction-net reduction is confluent by construction, which licenses
schedule-independence, and a boundary-port discipline extends that across machines. Agents don’t take turns on a
shared tree — they reduce independently and their results merge as a content-addressed CRDT
(NF(A ∪ B)). Above it the chain is WRL describes ▸ Forge lowers ▸ TRVM reduces: WRL is the
world/topology language that says what is arranged where, and a world’s meaning is its hash. That last part
is the testable one — the same world lowered by WRL’s JavaScript spine and by Forge’s independent Python
implementation round-trips byte-exact, and on a shared tamper corpus both verifiers refuse all 15 and
agree on the name of every refusal. Two languages, two repos, same meaning.
swarm.js runs coordination-free across real isolated workers — correctness, not
throughput. §6.4 snapshot and §6.5 REF semantics are still unspecified.This is the one the stack was built for. PRISM scores trajectory as well as output and
reads any system’s PULSE manifest to discover its phases; Graphonomous’s learn phase folds the
outcome back as a Wilson-interval confidence update rather than a vibe. And Workbench /record
closes it on real data: drop in a Claude Code session transcript and it becomes a scored bundle — no model call, no
API key, nothing uploaded.
/record’s gates were shown to carry signal on one corpus.Static pre-configuration is exactly what a folder of rule files is. [&] makes capability a
declaration that composes (&, |>) and compiles down to MCP/A2A at the moment
it’s needed, rather than a fixed server list. Graphonomous supplies the context side: retrieval scored by
spreading activation, and κ-routing — topology decides how hard to think, so a cyclic knowledge region gets
deliberation and a tree gets a straight answer.
&body still has no runtime.The useful version of “we built a stack” is “someone named three unsolved problems and here is what we tried, with the failures attached.” If one of these three is later solved by somebody else, that’s the outcome we wanted — the problems matter more than our answers to them.
04 · The thesis
A whitepaper can say “set the bar at the eval, not the demo.” But a sentence isn’t a guarantee. The [&] stack takes each pillar of the new SDLC and reifies it as an algebra you can compile, compose, and machine-check — so the bar isn’t a slogan, it’s a verdict with a certificate.
Specification stops being a Markdown file you hope the agent read. It’s an algebra — 6 primitives (&memory &reason &time &space &body &govern), 2 operators — compiled from .ampersand.json and validated against a draft-2020-12 schema.
The whitepaper’s “context engineering” — static vs. dynamic, the cost knob — as a continual-learning knowledge graph with κ-routing, attention, and consolidation. Context isn’t stuffed into a prompt; it’s retrieved, scored, and learned from.
Google draws a verification loop — run, cluster failures, fix, regress, watch production. PULSE makes that loop a declarable artifact: retrieve · route · act · learn · consolidate, five canonical phases in a .pulse.json manifest, with typed cross-loop signals.
“An eval suite with a real rubric shows it works reliably.” PRISM is that suite as a protocol — bring-your-own-runtime benchmarking that scores both output and trajectory, reading any system’s PULSE manifest to discover its phases.
“Set the bar at the eval, not the demo” becomes an eight-rung modality ladder running feasible ▸ permitted ▸ best over an un-weakenable safety floor. Every decision ships a certificate. 210 property-tested laws at 2000 trials each — plus 3 declared open, printed in red by the suite itself.
If the harness is 90% of the agent, it deserves its own discipline. OS-008 (TRAAVIIS) is “the harness engineer that builds your harness” — pipeline enforcement, quality gates, and sprint contracts, sitting above generation.
05 · The mapping
This is the whole argument in one table. Left: what Google named. Right: where it lives in the [&] ecosystem.
Named is not the same as shipped — the maturity table in
For the builder ▸ Honesty grades every row
spec / in_tree / live_local / live_deployed, and two of them are
still spec. The novelty isn’t any single row — it’s that the rows compose with & and |>.
| The New SDLC concept (Google) | [&] stack realization | |
|---|---|---|
| Agent = Model + Harness — the harness is ~90% of the agent | → | OS-008TRAAVIIS harness protocolThe scaffold is itself specified, gated, and contract-bound — not an ad-hoc prompt folder. |
| Specification is the bottleneck — a spec + prototype from one conversation | → | [&]Composition algebra6 primitives · 2 operators · machine-checkable .ampersand.json, three SDKs. |
| Context engineering — static vs. dynamic, the cost knob | → | OS-001/2GraphonomousContinual-learning graph with κ-routing, attention & consolidation — context is retrieved, not stuffed. |
| The verification loop — run → cluster → fix → regress → watch prod | → | OS-010PULSE manifestFive canonical phases retrieve·route·act·learn·consolidate in declarable .pulse.json. |
| Output + trajectory evaluation — “you want both” | → | OS-009PRISM benchmarkBYOR cross-system measurement that scores the answer and the path taken to it. |
| CI/CD gates · “set the bar at the eval” | → | kernelbox-and-box governancefeasible ▸ permitted ▸ best over an un-weakenable floor; 210 property-tested laws; every verdict certified. |
| Authorization & guardrails — what the agent may actually do | → | OS-006delegaticAuthorization kernel: HMAC-signed AuthorizationBlocks, fresh auth on destructive edges. |
| Orchestrator — hand a goal to autonomous agents, review what comes back | → | north starThe dark-factory loopperceive → record → learn → crystallize → ship → replay → measure. Seven steps, closed locally. |
live_local — exercised end-to-end against real local substrates and a cross-process replay — not yet stitched across the deployed Fly.io machines (live_deployed). Three MCP services are live in production; the full deployed end-to-end pass is the next bar. Numbers above are the canonical counts from STACK_COMPLETION.md (2026-06-28).
Don’t take “composable” on faith — toggle a capability. The declaration, the compiled MCP/A2A targets, and the governance certificate all regenerate live. The payoff: because it’s a protocol, nothing here is bespoke — any [&]-aware tool reads the same file. Notice the certificate only appears once you compose in &govern.
Illustrative widget. The certificate shape mirrors box-and-box’s real output; the actual 210 property-tested laws run in the kernel — reproduce them with the command in For the builder ▸ Verify.
06 · The loop, named
The whitepaper sketches the feedback loop as an arrow diagram. PULSE turns that diagram into a typed manifest: five canonical phase kinds that any product in the ecosystem declares, so a benchmark like PRISM can read the loop directly instead of guessing at it.
Pull relevant prior context before reasoning — the read loop. “Don’t skip retrieval; prior context likely exists.”
Check topology. If knowledge is cyclic (κ>0), deliberate instead of answering reflexively.
Mutate the world / graph — under the governance floor that decides what’s permitted.
Report the outcome back. Close the feedback loop; update confidence with real evidence.
At loop boundaries, merge similar nodes and strengthen edges. Memory compounds.
07 · The loops underneath
The whitepaper’s diagrams stop at the arrow level. Underneath each phase of the loop is a named algorithm doing real work — graph topology, statistics, and algebra. This is where “agentic engineering” stops being a metaphor and becomes something you can prove.
In plain terms: if the facts an agent needs all point the same direction, it answers fast;
if they loop back on each other and contradict, it slows down and deliberates — and it decides which case it’s in by
looking at the shape of what it knows, not by guessing.
How: the route phase runs Tarjan’s strongly-connected-components
— a classic linear-time graph algorithm that finds every cluster of nodes that mutually reference each other — and
counts those cycles as κ, a cycle-complexity invariant.
Why it matters: “think harder on hard problems” stops being a vibe and becomes a measurable
property of the knowledge itself — the same input always routes the same way, and you can audit why.
κ and the routing decision recompute liveroute uses. Close a loop (e.g. add C→A) and the routing flips from answer to deliberate; nest a second loop and κ climbs again.
In plain terms: the system tracks not just whether something worked but how sure
it is — one success isn’t proof, ten in a row is — and it spends its next test where being more sure would help most.
How: every outcome reported to learn updates a node’s confidence as a
Wilson 95% score interval (z = 1.96) rather than a bare average, so the interval’s width is the
uncertainty; information_gain ranks which node a single new data point would tighten the most.
Why it matters: this is “set the bar at the eval” made quantitative — you don’t eval at random,
you eval exactly where it pays, and confidence is earned one outcome at a time instead of asserted.
The pieces don’t just sit next to each other — they compose as algebra, and the algebra is property-tested. Capabilities combine and pipe under stated laws; an uncertified step can’t hide inside a composite.
&none. Order- and duplicate-independent coalitions.id, not commutative. Any infeasible step collapses the whole pipeline to the absorbing zero 0̲ — utility can’t resurrect it.node test/laws.mjs && node test/compose-laws.mjs08 · The bar, as algebra
This is where the stack is genuinely novel. A demo shows an agent can work once; the whitepaper asks for a bar that proves it works reliably. box-and-box makes that bar a governance kernel — an eight-rung modality ladder that runs floor-then-gradient and emits an auditable certificate for every decision.
One composing bridge runs feasible ▸ permitted ▸ best over a floor you cannot weaken — utility can never
resurrect a forbidden branch. The output isn’t a vibe; it’s a structured verdict:
"verdict": "allow", "bridge": "feasible ▸ permitted ▸ best", "floor": "un-weakenable", // utility cannot override "rungs_checked": ["alethic","deontic","axiological"], "margin": 7, "confidence": 0.838, // epistemic rung, ~95% Wilson "cost_class": "poly", // resource rung, certified "law": "109 kernel + 101 compose, 2000 trials each", "open_gaps": ["CP5","CP6","CP7"] // declared, not hidden
And because the kernel is a pure library that composes, the bricks combine: retrieve |> certify |> govern
is a real pipeline (Graphonomous ▸ Weave ▸ box-and-box) — and an uncertified step collapses the whole composite to the
absorbing zero. The bar is structural, not aspirational.
09 · The endgame
The new SDLC’s far frontier is the orchestrator: hand a goal to autonomous agents and review what comes back. The stack’s north star is the dark factory — machines that perceive, learn, transfer skills to one another, and get measured. Seven steps, each owned by a shipped product, closing into a loop.
10 · The two endgames
Google’s “factory model” borrows its name from manufacturing’s dark factories — lights-out plants that run with no humans on the floor. The developer becomes an orchestrator who designs the eval, constraint, and context harness; autonomous agents build, test, and ship around the clock; humans define intent and review outcomes. The dark-factory loop above is that model, wired. But the stack also ships the deliberate inverse — a residency, not a factory.
| Dimension | ⚙ Dark factory | ◴ The Residency |
|---|---|---|
| Metaphor | lights-out manufacturing | an academic / artist residency |
| Optimizes for | throughput — code shipped 24/7 | epistemic quality — trustworthy findings with provenance |
| The human | defines intent, reviews outcomes off-floor | reads a legible board where agent “residents” deliberate |
| Trust posture | trust capable systems | verify the premise first (Gate 0) |
| Footprint | machines + orchestrator + cloud | one browser tab · sovereign · zero API cost |
| Memory | central episodic store (Graphonomous) | browser-local CRDT (G-Set + localStorage) |
| Code execution | cloud machines run the build directly | tiered: in-browser → local gateway (TRAAVIIS) → opt-in remote sandbox |
| Scaling path | add machines | P2P CRDT-merged sovereign residencies |
The whitepaper’s factory says “trust capable systems.” The Residency refuses to assume its own thesis: multi-agent deliberation can herd and amplify a confidently-wrong peer, so Gate 0 asks “does a board of residents actually beat a single agent?” — and nothing scales until that’s answered. That skepticism is the exact opposite of lights-out trust, and it’s the point.
A factory or a residency only becomes genuinely decentralized if computation can run on many machines without coordination and still agree. TRVM is that physics: a distributed interaction-calculus runtime whose confluence licenses schedule-independence (coordination-freedom across machines additionally rests on its boundary-port discipline), so results merge as a content-addressed CRDT. It’s why the Residency’s memory can be sovereign and still mergeable — and why a dark factory could be a mesh rather than a single orchestrator fanning out jobs.
A residency of browser-native agents can write findings, but the moment a resident needs to execute — run a test, exec a script, reproduce a result — you face the credential-vs-untrusted-code problem. The Hermes pattern (Nous Research, 2026) splits it in two: a gateway that holds the tokens and orchestrates (TRAAVIIS, the OS-008 harness engineer) and a disposable sandbox that runs the untrusted code — a VM, a Mac mini, a remote micro-sandbox. Files sync back as evidence, so an execution becomes a citable, provenance-bearing finding on the board — never raw trust.
ic32.wasm today; Pyodide for TRVM Python, WebContainers for JS. Runs in the tab — no gateway needed.
→Holds creds, shells real CLI on a local VM / Mac mini, governs each act, streams output back as evidence.
→Fly Sprites · E2B · Modal · Daytona — only for the autonomous distributed regime. Escalate when forced, not by default.
live_local with two stated gaps (§6.4 snapshot, §6.5 REF). The TRAAVIIS execution gateway is
decoupled now, wired later: textual findings need no code exec, so Tiers 1–2 are an architected interface, not a
shipped MVP feature. Today only Tier 0 (in-browser) runs. Neither is claimed as more than it is.
11 · The human in the loop
The whitepaper’s human is an orchestrator: define intent, set up the harness, review outcomes off-floor. That’s one posture. The stack ships three — and they differ in where the human stands relative to the work, which changes what “in the loop” actually costs.
The human defines intent and reviews outcomes after the agents finish — a checkpoint at the end of the pipeline. Throughput-optimal, but the human is a bottleneck: work pauses at the gate and you trust the system between gates. This is the whitepaper’s orchestrator.
The human reads a board where agent “residents” deliberate as it happens and adjudicates findings — claims that carry their own evidence and provenance. You don’t just see the output, you see how it became known. The human is a conductor, present but not blocking throughput.
The one that’s genuinely different. Interaction-net reduction is confluent by construction —
Lafont’s theorem, not our claim — and that confluence licenses schedule-independence for a
single net; coordination-freedom across machines additionally rests on TRVM’s boundary-port discipline.
Because results are therefore schedule-independent and
content-addressed, a human edit doesn’t lock the pipeline or race the agents — it merges.
The human branches, edits, and the result converges deterministically (NF(A ∪ B)), exactly like any other
node. No checkpoint, no bottleneck — the human is just another machine in a coordination-free mesh.
swarm.js runs coordination-free across real isolated
workers — but no parallel speedup has been demonstrated. “No coordination needed” is proven; “therefore
faster” is not, and we don’t claim it.
The whitepaper’s SDLC ships code: spec → generate → verify → deploy. The Residency runs a parallel SDLC whose artifact is a verified finding with provenance — “not just what is known, but how it became known.” Same discipline (spec-driven, verified, gated); different output.
claim · evidence · status · supersedes — deliberation as typed epistemic acts, not free-text chat. Structure is what makes a finding checkable, dedup-able and citable. It’s the spectrum’s “structured over vibes,” applied to knowledge.
Most agent systems store what they concluded; the Residency stores how it became known — aligned to the W3C PROV model. “Evidence engineering” is the layer beyond prompt / agent / workflow engineering, which are commoditizing.
Progress advances on evidence, not a calendar: Gate 0 (does the board beat a single agent?) → Gate 1 (reliability) → Gate 2 (governed, executed improvement). Each is cheap to abandon — the epistemic checkpoint discipline PRISM automates.
12 · The economics
The whitepaper’s cost curves cross over: vibe coding is cheap to start and then bleeds — prompting tax, token burn, maintenance tax, security risk. Agentic engineering costs more upfront and flattens. The stack’s bet is that protocols amortize the CapEx across every product: you pay for the floor once, then reuse it.
Curves are conceptual, not measured — they illustrate the shape of the argument (vibe’s convex tax vs. the stack’s amortized floor), not data from a study. The one number on the page that is measured is the governance kernel: 210 enforced laws at 2000 trials each, and 3 that are declared open — reproducible below.
13 · For the builder
No diagrams this time. The three things an engineer asks before adopting a stack: What are the actual files? Which design choices are worth stealing? And what's real versus aspirational?
// structural composition — [&] { "agent": "ResearchAgent", "capabilities": { "&memory.vector": { "provider": "pgvector" }, "&reason.argument": { "provider": "deliberatic", "config": { "governance": "evidence-first" } } }, "governance": { "hard": ["Never present unsupported conclusions as facts"], "escalate_when": { "confidence_below": 0.65 } }, "provenance": true }
pgvector→qdrant without touching the agent.// temporal loop — PULSE { "phases": [ { "kind": "retrieve" }, { "kind": "route", "invariant": "kappa_routing" }, { "kind": "act", "policy": "delegatic.check" }, { "kind": "learn" }, { "kind": "consolidate" } ], "nesting": { "inner_loops": [{ "trigger": "phase:route when kappa > 0" }] }, "connections": [{ "emit": "OutcomeSignal", "to": "prism.benchmark" }] }
# validate against the schema $ ./ampersand validate \ research-agent.ampersand.json ✓ valid · 2 capabilities # compile to MCP server config $ ./ampersand generate mcp \ research-agent.ampersand.json → mcp.servers.json # compile to A2A agent card $ ./ampersand generate a2a \ research-agent.ampersand.json → agent-card.json
Topology is a routing signal. The κ cycle-complexity of a subgraph tells you whether to answer fast (κ=0, acyclic) or deliberate (κ≥1, cyclic). A flat vector store throws that signal away.
210 laws × 2000 random trials each beat hand-picked fixtures. You assert "& is commutative and idempotent" once and the generator hunts the counterexample you'd never think to write.
MCP servers never call a model — the agent does all reasoning; servers are a deterministic substrate. Reproducible, cheap, testable. The intelligence lives in one place, not smeared across services.
Safety can't be averaged away by a high utility score, and utility can't resurrect a forbidden branch. feasible ▸ permitted ▸ best over an un-weakenable floor — every verdict ships a certificate.
Bring-your-own-runtime. Swap any layer — memory, reasoning, governance — and the rest still composes. PRISM is designed to benchmark anyone’s system, because it reads the PULSE manifest rather than your internals — but that is a claim about the interface, not evidence: no system we don’t own has been adapted in yet. External adaptation is the next proof, not a past one.
Browser-local CRDT board + a local harness = zero per-token API cost and full data sovereignty. Cloud is an opt-in sink you sync to, not a dependency you boot from.
| Layer | Status | What's real | Honest gap |
|---|---|---|---|
| [&] Protocol | in_tree | Schema, validator, MCP/A2A codegen, Elixir reference impl + CLI. | &body sensorimotor primitive has no runtime yet. |
| Graphonomous | live_deployed | κ-routing, Wilson frontiers, consolidation, MCP server, embedded SQLite. | Cloud sync is optional / single-node by default. |
| box-and-box | live_local | v0.10.0. 8-rung ladder, bridge, 210 enforced laws, certificates. Cross-process admission proven: the Node kernel decides, an Elixir BEAM actor acts only on permission, certificate retained to disk (13/13 assertions, permit + refuse paths). | 3 compose laws declared open: the Value.pi carrier (CP5–CP7). The coalition contract (CD6) was closed by ruling. Not npm-published at 1.0. Not deployed. |
| PULSE | live_deployed | v0.1.1 schema, 6 cross-loop tokens, reference manifests. | Manifest authoring is hand-written, no generator. |
| PRISM | live_deployed | 6-machine benchmark engine, reads PULSE manifests, Fly.io deploy. | No external/competitor system adapted in yet. |
| Delegatic | live_deployed | Policy checks gating the act phase, evidence-first governance. | In-memory ETS only — no persisted policy store. |
| OS-008 Harness | in_tree | Pipeline enforcement, quality gates, sprint contracts (TRAAVIIS CLI). | Orchestration loop is docs + site, not one binary. |
| Dark-factory loop | live_local | 7/7 steps run locally end-to-end. | Not yet stitched across deployed machines. |
| WRL | live_local | WallRiderLang Core 0.1.2 — an executable topology language whose meaning is a hash. 890 conformance checks, 0 failed; register 128 rows, model debt 0. Cross-implementation agreement is measured, not asserted: projection vectors round-trip byte-exact through Forge’s independent Python spine, and on a shared negative corpus both verifiers refuse all 15 tampers and agree on the name of every refusal — two languages, two repos. | The suite reports its own limit: 54 of the swept blocks are fragments, and a fragment’s non-acceptance is weak evidence until its capability ships. Not deployed; no outside consumer has driven the path. |
| TRVM | live_local | Coordination-free interaction-calculus runtime, conformance battery green across python · c · wasm · js. | §6.4 snapshot & §6.5 REF semantics unspecified. No demonstrated parallel speedup — the result proven is correctness, not throughput. |
Workbench /record | live_local | A real Claude Code transcript → scored SkillBundle, no model call and no API key. 210 MB indexed in 936 ms; every segment sealed twice — honest → 6/6 PASS, one capability withheld → no_hidden_capability + authority both FAIL. | Cloudflare Pages is a target, not a deploy. Gates shown to carry signal on n=1 corpus. |
| the-residency | live_local | Browser-native CRDT board, local harness, live corpus hydration. | Pre-Gate-0: the premise (board > single agent) is untested. |
| OS-007 | spec | Specification drafted. | Unbuilt. |
*.ampersand.json → add a *.pulse.json when you have a loop → point PRISM at the manifest when you want numbers → drop in box-and-box only where a decision must be governed. No big-bang rewrite. Each layer is useful alone.Every count on this page is a command away. These are the actual suites; the green lines are the real output captured from this repo, not a mock-up.
# the un-weakenable floor, proven $ cd AmpersandBoxDesign/box-and-box $ node test/laws.mjs \ && node test/compose-laws.mjs ✓ all 109 enforced kernel laws hold. known gaps (xfail): ✗ CP5 |> floor association-invariant — FALSIFIED @trial n ✗ CP6 no backward step survives |> — FALSIFIED @trial n ✗ CP7 &-order leaks to |> floor — FALSIFIED @trial n ✓ all 101 enforced CC2 compose laws hold — 100 suite + 1 anchor. · 3 known gap(s) still open # 109 kernel + 101 compose = 210 # 2000 random trials each
@trial n because the trial index is
different every run — the inputs are random, so your counterexample won’t be ours.)
Three compose laws are declared open — a single-slot Value.pi carrier lets |> re-association bypass the phase floor. They were found by the residency falsifier, they are written down in EVIDENCE/algebra-finding.md, and the build fails if one starts passing — that's the signal the carrier fix landed. A suite that only ever prints green isn't being run hard enough.# spec → schema → wire formats $ cd AmpersandBoxDesign/reference\ /elixir/ampersand_core $ mix deps.get && mix escript.build $ ./ampersand validate \ ../../../examples/\ research-agent.ampersand.json → schema-valid · 2 capabilities $ ./ampersand generate mcp <file> → mcp.servers.json
# continual-learning graph + MCP $ cd graphonomous $ mix compile --warnings-as-errors $ mix test $ mix format --check-formatted # κ-routing · Wilson frontiers · # consolidation · embedded SQLite
github.com/c-u-l8er/TRVM · the-residency · TRAAVIIS · ampersand-plugins (the Claude Code skills) · docs. The reproduction commands above run from the [&] monorepo. Verifiability is the whole point: if a count can’t be reproduced, treat it as a claim, not a fact.[&] has one rule that has kept it useful: it does not invent a wire format. It compiles into MCP and A2A rather than competing with them. The same rule applies one layer up — the evidence layer already has standards, and the right move is to emit them, not to replace them. And this is not an empty field: as of 2026 it is filling quickly, which we take as the category being real rather than as a threat.
Not competitors. ampersand generate mcp and generate a2a emit both from one
.ampersand.json. A capability declaration is upstream of a wire protocol.
The GenAI SIG is standardising agent spans, events and metrics. A PULSE phase is a natural span; the honest status is that we don’t emit OTel yet. It is the most obvious next interop win and it isn’t built.
The Residency’s findings carry provenance aligned to the PROV model — entities, activities, agents. Evidence that can’t be pointed at a standard shape is evidence nobody else can consume.
NIST’s AI Agent Standards Initiative (Feb 2026), the W3C Agent Identity Registry CG (Apr 2026) and CoSAI’s Agentic IAM are all now working the identity/authorization layer that Delegatic occupies.
Microsoft’s Agent Governance Toolkit, OPAQUE’s verifiable-governance standard, AOS Governance. AOS’s framing — a script, not a prompt, decides whether an action is permitted — is close to box-and-box’s. The difference we’d defend is the algebra: a ladder with stated laws that compose, not a policy checker.
Deontic policies for runtime governance, evidence-tracing/execution-provenance surveys, verifiable context governance. Our deontic rung is one rung of eight — the papers are neighbours, not rivals, and they’re ahead of us on formal write-up.
14 · What stays true
Past a crossover point, ad-hoc prompting costs 3–10× more per feature.
It multiplies both strengths and weaknesses of your existing engineering discipline.
Toward specification, evaluation, architectural judgment — not away from engineering.
.ampersand.json and sets the floor; the kernel proves the rest and ships the certificate.Google wrote the field guide to agentic engineering. The [&] stack is one attempt to build the instruments — a specification algebra, a memory graph, a temporal loop manifest, a benchmark, and a governance kernel that turns “set the bar at the eval” into a verdict you can audit. — ProjectAmp2 · the [&] Protocol ecosystem
15 · The ending this page has to have
A page arguing that verification beats demonstration cannot end by asking you to be impressed. So it ends with a kill switch for each claim. Every row below names the claim, its honest status, the command that exercises it, what you should see, and the specific observation that would falsify it. If you produce one of the things in the last column, the claim is dead and we want the counterexample.
Absence of evidence must remain distinguishable from evidence of absence, and every consequential transformation
must expose why it occurred.
— the [&] doctrine, as stated in ACADEMY.md §6e
That rule is why this table exists in the shape it does, and it wasn’t designed for this page — it was
noticed, after the same shape kept appearing in unrelated subsystems: a generator that refuses and says why,
an unrun arm that reports None rather than 0, a panel that carries a mock edge.
Both halves do work here. The first is why the row below reads 0 filed instead of being left out —
a zero and a blank look identical in a table and mean opposite things. The second is why the law counts are
now derived by the suites rather than typed by us, and why the three open laws print in red.
HELD rather
than refused because the corpus contradicted itself on a law count — 103 vs 116. That hold is the reason this
page now says 210 enforced and 3 declared-open: the refusal named a real defect, and it stayed unpublished until the
suites were made to derive their own totals. The log itself is still marked MOCK — the real format
with illustrative entries, counts not yet measured against a live crawl. Saying so is the same rule applied to the rule.| Claim | Status | Command | Expected | What kills it |
|---|---|---|---|---|
| The governance floor is un-weakenable and its laws hold | live_local | node test/laws.mjsnode test/compose-laws.mjs |
109 + 101 = 210 enforced green, 3 declared-open in red, exit 0 | A counterexample to any of the 210 — or an input where the floor is bypassed without one of CP5/CP6/CP7 firing. |
| Governance gates a foreign runtime, not just itself | live_local | bash test/integration/ |
13/13 — the Node kernel refuses, the Elixir actor does not act, certificate on disk | The BEAM actor performing the act on a refuse verdict, or a permit with no retained certificate. |
| A spec compiles to real wire formats | in_tree | ./ampersand generate mcp |
Schema-valid input → an mcp.servers.json a client actually accepts |
Output that no MCP client will load, or a valid declaration the generator can’t compile. |
| Proof gates carry signal — they don’t just say PASS | live_local | Workbench /record, drop in your own Claude Code transcript |
Honest run → 6/6 PASS; withhold one capability → no_hidden_capability + authority FAIL |
A transcript with a genuinely concealed capability that still seals 6/6. That’s the interesting attack. |
| A world means the same thing in two independent implementations | live_local | node test/conformance.mjs+ the shared negative corpus |
890 pass / 0 fail; projection vectors round-trip byte-exact through Forge’s Python spine; both verifiers refuse all 15 tampers and name each refusal identically | One implementation accepting a world the other refuses — or the two refusing the same tamper under different names. Either means the meaning isn’t really the hash. |
| Reduction is schedule-independent | live_local | make test · node runtime/js/swarm.js |
Same normal form across python · c · wasm · js; workers agree with no coordination | Two schedules reaching different normal forms on the same net. (Note we claim correctness, not speedup — a slow run falsifies nothing.) |
| The board beats a single agent | pre-Gate-0 | — | Nothing. This is untested. | Already open — Gate 0 exists precisely because deliberation can herd toward a confidently-wrong peer. We have n=1. |
| The derivation reproduces on a machine we don’t own | external · 0 filed | Boot a T&R image, then trvs doctor · trvs id |
The quoted sha256 matches, and trvs id derives the same identity we published — on hardware we have never touched |
A sha that doesn’t match, an identity that comes out different, or an image that won’t boot. This is the only row whose missing evidence can only come from a machine we don’t own — which is exactly why the count is 0 reports, 0 from real hardware, as of 11 August 2026. |
| PRISM benchmarks anyone’s system | design claim | Point it at a PULSE manifest you wrote | Runtime-independent by construction — it reads phases from the manifest | Nothing yet, and that’s the problem: no system we don’t own has been adapted in. Until one is, treat this row as design, not evidence. |
The table above is one page’s worth of a thesis that has its own home. ComputeDriven (computedriven.com) states it in a sentence this page has effectively been circling for fifteen sections:
Data driven keeps the result. Compute driven ships the derivation.
A claim is compute driven when the artifact carries enough — canonical input, executable semantics, a derived identity and its provenance — for an independent machine to derive the claim again. — computedriven.com
That is the same move as &-composition, the certificate, the PULSE manifest and the 890 cross-language
conformance checks — stated once, at the level of the artifact rather than the tool. It also carries the caveat this
page needs and doesn’t otherwise say out loud:
Its first proof object is T&R, a FreeBSD 15 distribution assembled from pkgbase and published as releases with quoted sha256 sums — an artifact rather than another protocol, which is why it appears here as a row in the table and not as a section of its own. And the boot report is the mechanism: ComputeDriven’s admitted last gap is that every measurement was taken on our machines, so joining it is defined as supplying the one thing we cannot supply ourselves — a second machine.
Most of this field asks you to trust a benchmark. The bar we’d rather be held to is the one in the last column — and the fastest way to help is to break a row. — if you falsify one, the counterexample belongs in the repo, not in a rebuttal
&body having a runtime.
External reproduction used to be a fourth; it now has a command and a kill condition — the boot-report row —
though a mechanism is not evidence and the count is still zero.
Adoption remains a separate open claim, and one boot report would not close it: reproducing an artifact is not
the same as depending on it. Someone building on this, integrating it, or using it for real work is a different
category of proof, and we have none of it.
A claim with no kill switch is a claim with no evidence — including ours.