[junixlabs]

The direction from #46, built. Research first, because the last two days established that
this project's favourite mistake is rebuilding something that already exists.

What the research changed

Prior art	What it already solves	What TraceOS does instead of rebuilding it
ADR / MADR, adr-tools, Log4brains	authoring and superseding decision records	cites one by locator; adds no format. The gap the literature names is that "ADRs are often disconnected from the artifacts they influence" and no tool "notices when an accepted decision no longer matches the code"
Drift (architectural erosion action)	AST symbol tracking, layer violations, drift adr	does not model behavior, and states its own limit as "structural risk, not architectural goodness". No overlap with claims about what a system does
OpenSLO	how to read an indicator from a data source	an Outcome's runtime evidence cites such a definition; TraceOS defines no query language
in-toto attestation	subject + typed predicate + signed envelope	the shape this project's observation log approximates. Named in the issues as the answer to "who says supports"

INV-028 — Intent is verified by provenance, never by truth

intents:
  - id: intent.confidence-must-be-able-to-fall
    statement: confidence has to drop without anyone editing the model
    record: { kind: decision, locator: "docs/decisions/003-confidence-is-derived.md#Decision" }

A Flow declares realizes: [intent.x]. Nothing can establish that a sentence is really
why something was built; what can be established is whether it names the frozen record
(§6.2.1) that asked, whether that record still resolves, and whether it was superseded —
so supersession reuses INV-014 unchanged.

A model that verified Intent by reading the code would be circular: the code is the thing
the Intent explains.

FLOW_WITHOUT_INTENT is info and never gates. Most behavior predates anyone writing the
decision down, and a gate demanding otherwise would be satisfied by invented intents —
worse than none, for the same reason a rubber-stamped observation is worse than a missing
one.

INV-027 — an Outcome declares the Assertion that checks it

outcomes:
  - { id: purchase.confirmed, states: [...], verified_by: assert.purchase.confirms-order }

This is the only place in the model where reality can contradict it. Intent and
Behavior are both statements, and two statements disagree only about words. An Outcome can
be measured, so OUTCOME_REFUTED is the first machine-produced evidence that a claim is
wrong rather than merely stale — the distinction #42 and #45 established that
nothing in this project, or in the peer system built on the opposite principle, could make.

Finding	Level
OUTCOME_REFUTED	error → integrity INVALID
OUTCOME_CHECK_UNKNOWN	error
OUTCOME_NEVER_CHECKED	warn
OUTCOME_NOT_VERIFIABLE	warn

An Outcome with no check is reported, never failed. Silence is what is forbidden: an
unverifiable Outcome and a verified one must not read the same (INV-025).

INV-018 is split, not weakened. Is the running system healthy stays out of scope
permanently. Did the declared outcome occur is verification, not monitoring. §6.4.1 draws
the line by subject, and says so where a reader would otherwise infer permission to build
an APM.

Also fixed, found while building

validate_observation_refs lost its return in a merge and returned None. The entire
suite passed — because validate() with a real Git was only ever reached through the
CLI. There is now a test that runs the validator against a real repository, and it fails
when the return is removed.

Checks

• 39/39 groups, 181/181 assertions. New: inv_outcome_can_be_refuted (6) and
  INV-028 intent is provenance (2), plus the validator-with-git test.
• Falsified three ways: stubbing the refutation check, swapping latest observation for
  first, and removing the lost return. Each fails the suite.
• 28 invariants defined, cited by a skill, traceable in the engine, listed in Appendix A.
• check_locators 38/38 (the four Intent records resolve); ratchet exit 0, discharged by
  reading the six symbols it named.
• Both reference models dogfood it: examples/traceos-itself cites its own ADRs;
  examples/ecommerce deliberately cites records it does not ship, so the unresolved state
  is visible rather than hidden — which is how most real models start.