Eve charter completeness — ratified workflow inventory and runtime delivery contract

Decision date: 2026-09-07. Coverage status: RATIFIED. Capability-delivery status: OPEN. Decision owner: product operator (@GreyChimp). Coverage reviewer: QA Lead independent of the implementing agent.

This record expands the earlier planning seed into a source-bound, machine-validated inventory of every V1–V10 feature and architecture section, every atomic prose/list/table contract inside those sections, the Eve handbook and linked charter pages, the V1 release-scope runtime constants and exported enforcement behavior, all declared platforms with source-aware evidence boundaries, and every ruleset/cell closure. It remains deliberately separate from delivery: source coverage can be ratified while every required workflow stays blocked on its actual runtime and human acceptance evidence.

The authoritative machine record is docs/audits/eve-sota-charter-workflows/2026-09-07.json. It binds source checkout aed4613096997f2bf9311901b5c389109b2fc0c8, coverage digest 65e2da5816a9e0d4c01e82ec643409b96775ea7a09b1d8119f6163f09eebe96e, product-graph version pg1.0011c2769420+anchors.73b5caeca646+arch-docs.5c6b630076ba+curated.c93590754a1c+curation.3fa6a5b05785+docs.99fe6cd4b5b2+e2e.b97ee5f2e0c5+invocation.ca1517c748c1+routes.65cd1e8ec7cc+signals.a4f84918af74+todos.e608a9c72222+tours.8eac7609ac6f, and the 17-outcome scorecard. The semantic verifier re-parses the live sources; a stale file, missing linked detail page, unmapped atomic requirement, optionalized platform/runtime, deleted blocked workflow, missing quality target, or changed product graph fails closed.

Ratification boundary#

• confirmatory: approved by Independent Task 0.8 cadence, provenance, graph, and Task 13.1 evidence reviewer (receipt 23920eb64fbacef925d056114b6ab8ff25e25a7efaf5fc18aa4154634e435d9d).
• adversarial: approved by Independent adversarial semantic-delta, graph-provenance, and evidence-integrity reviewer (receipt d40b45ba3ae47a5bed623df41aa8f9843399572781d66104c0bc6da4091fcac6).

Ratification means the source denominator, mappings, owners, acceptance scenarios, and review boundary were independently checked. It does not mean a workflow is shipped. All 6626 required workflows remain in blockedWorkflowIds until tasks 11.8 and 12.8 join real runtime receipts, independent verification, scorecard results, and required human/domain acceptance. The 4 non-goal sections remain mapped to their exact source text; removing a requirement from the denominator is never a substitute for delivery.

Source coverage summary#

The inventory covers 363 source files, 27079 atomic requirements, 6626 required workflows, 4 explicit non-goal workflows, 108 source-bound platform declarations, and 19 source-bound ruleset/cell declarations. Navigation indexes are requirement-bearing, their complete detail directories are reconciled, all 2861 local Markdown links have an explicit inclusion or context boundary, and all 29 exported V1 runtime release contracts map to ordinary blocked workflows. The V5 five-category/six-cell source conflict is retained explicitly and resolved as six non-substitutable acceptance strata, including separate Galactic Squad and Hard Vacuum closures. Across V2/V4/V5, cell declarations are pairwise disjoint; the 43 requirements that genuinely span or name multiple cells are retained in the separately pinned shared-substrate denominator and cannot silently leak into a cell's acceptance count.

Release ownership and runtime denominator#

Each required workflow binds:

1. every atomic source requirement ID and source line range;
2. source-specific fixture inputs and expected outputs, negative and recovery cases, the runtime procedure, a real evidence-verifier command and artifact path, plus an exact oracle that forbids substitution by another workflow, ruleset, platform, or simulated runtime;
3. capability and runtime requirement IDs;
4. task owners and evidence boundaries;
5. applicable targets from the pre-registered scorecard; and
6. domain, independent QA, and operator review ownership plus an exact unblock condition.

Runtime delivery milestones#

Every required runtime still completes all six milestones below. Inventory or first light cannot stand in for later delivery.

1. Discover and bind: source requirement, owning domain, actual executable/service, version, prerequisites, protocol, target platforms, and artifact formats.
2. Audit and admit: authority, isolation, injection, privacy, model/runtime contract, negative controls, and every applicable cross-phase gate.
3. Implement the adapter: attributed leased authority, validated arguments, bounded progress, cancellation, idempotency, error handling, and recovery.
4. Deliver a complete workflow: operate the real runtime, save/reopen editable state, compile/export/package/run where applicable, and independently reconcile artifacts.
5. Prove breadth and recovery: independently authored strata, platforms/versions, timeout/cancel/dependency-loss/partial-completion/crash/restart/rollback controls, and scorecard measurement.
6. Accept and operate: human/domain review, distribution checks, observed operations, outcome feedback, current evidence, and every target met.

Task 5.13 owns the governed Unreal adapter; 5.14 owns real Unreal workflow acceptance; 5.15 owns the internal Maya/UGC runtime; 5.16 owns formal and computed-content engines; 5.17 owns voice, media, and companion simulation; 5.18 owns native/device/VR/TV platform delivery; and 5.19 owns additional creative applications. Tasks 11.8, 12.8, and 18.4 remain common owners of delivery, completeness admission, and clean-state remeasurement.

No closure with unresolved blockers#

No licence, credential, cloud-spend decision, runtime availability observation, release timing, risk waiver, or accepted limitation closes a required workflow. Each blocked row retains its owner and exact unblock condition. A verified alternative may replace a tool only when it preserves and passes the same source-bound outcome; it cannot erase the outcome. Source drift invalidates coverage ratification until an independent delta review updates the pinned source, requirement, workflow, ruleset, platform, and product-graph digests.

Evidence boundary#

• This record ratifies source coverage and workflow ownership only; it does not claim any required product capability, runtime, release, or charter workflow delivered.
• Every required workflow remains blocked until the actual runtime and human acceptance evidence passes tasks 11.8 and 12.8.
• Evidence acceptance fails closed unless trusted Ed25519 producer, human-approver, and independent-review public keys are provisioned by the host administrator at /etc/oshun/eve-sota-charter-trust-policy.json.
• The evidence CLI forbids inventory, workspace-root, and evidence-receipt path overrides and admits only the checked-in record plus each workflow's exact repository-root acceptance artifact after schema, digest, pin, live-source, and ratification validation. Each trusted key is authorized for exact producer IDs, producer roles, subject types, and workflow IDs; duplicate public keys under aliased key IDs are rejected, signatures bind the source checkout, coverage digest, workflow, subject, command, and observed result, all evidence timestamps are canonical ordered millisecond UTC values, and independent review requires distinct reviewer key material over the canonical digest of the complete retained evidence set. Ruleset Unreal observations additionally retain the content-hashed UE 5.5 FAutomatedTestPassResults index.json emitted at the command's report path; it must contain a nonempty, all-success test set whose FullTestPath values match the exact release-and-cell command prefix, with typed uniquely identified devices, canonical FDateTime ExportTextItem UTC test starts and event times ordered inside the signed execution/report/runtime/review interval, UE-width numeric bounds, unique nonzero artifacts, resolved event references, confined artifact paths backed by a signed content-hash manifest, device references, outcome counts, and aggregate duration reconciled within 0.001 seconds.
• Source drift invalidates this ratification until the delta is reviewed and the pinned coverage digest is deliberately updated.