Cambium

1. Executive Summary

Cambium is not a memory system. It says so in its second paragraph — "Cambium does not provide a knowledge corpus, a RAG engine, or a default domain policy" — and the repository selects no profile of its own: the four governance placeholders in K00/03 are unfilled and no composed vocabulary ships. What it provides is the standard by which an operator and an LLM agent maintain a corpus over time, twelve deterministic scripts that check whether they did, and a filled reference profile under profiles/examples/agent-atlas/ that shows what the interface looks like answered.

It is in this atlas for the same reason TERSE Memory and MeMex Zero-RAG are: the durable thing is an adopter's Markdown vault, and what this repository contributes is the correction, provenance, staleness and evidence machinery around it — 67,280 lines of Python across 58 tools, 45,822 lines of tests, and 10,121 lines of normative kernel text across 164 modules, inspectable at a pinned commit. Read it as a governance layer, not a component. The scope caveat is real and is restated wherever a claim depends on it.

Its central idea is one this atlas keeps asking for and rarely finds: a check that refuses to return a pass it has not earned. Run against its own repository, check_freshness.py reports

Conclusion: NOTHING CHECKED — all 153 file(s) skipped for lack of a resolvable volatility… This is not evidence of freshness.

and exits 2. check_vocab.py exits 1 rather than assume a vocabulary when no profile has been composed, printing the command that would fix it. A green run that examined nothing is the most common way a quality gate lies, and two of these tools are built so that it cannot happen.

Its second idea is that passing a check must never promote a belief. The status standard is explicit: "File existence, a resolvable wiki link, the existence of an external checklist item, or a large page word count MUST NOT automatically change any status", and "A status MUST NOT be upgraded directly because the file exists, its length reaches a threshold, or automated checks pass." The scripts emit fail and candidate; a candidate feeds a human's maintenance list and changes nothing. The tools can block, and they cannot believe.

Its third is a genuinely governed write path. A concurrent batch produces a Coverage Delta and apply_delta.py merges it into the canonical ledger, because — in the script's own words — "the serial merge zone only executes deterministic actions… delta application is done by this script, not by an LLM hand-editing the large Ledger file." It is dry-run by default, re-parses the merged result before writing and aborts rather than write a ledger that no longer parses, writes atomically, and rejects a page whose batch does not match the delta's.

Reservations. The repository ships no corpus, so every claim about maintaining one over time is unexercised end to end. Supersession keeps the relationship and the reason and is keyed on a page rather than a value, so it is history rather than a tombstone. And most of the 10,121 kernel lines are MUST/MUST NOT prose addressed to an agent — the boundary between that prose and the tooling that can refuse is the main thing to measure before adopting.

Licensing is scoped and unusually careful: Apache-2.0 for everything under Tools/, CC-BY-4.0 for the standards and profile materials, spelled out per path in LICENSE.md.

2. Mental Model

A page's standing is four independent axes that a machine may lower and only a judgement may raise. The evidence ladder is the one this atlas cares about.

%% caption: the epistemic ladder from signal to validated, with supersession retaining the relationship and its reason, and deterministic checks that can only emit a candidate — nothing is promoted because a check passed
stateDiagram-v2
    [*] --> signal: intake from a source
    signal --> single_source: one source supports it
    single_source: single-source
    single_source --> corroborated: a second independent source
    corroborated --> validated: sufficient corroboration
    validated --> contested: new evidence conflicts
    contested --> superseded: an old conclusion is overturned
    validated --> superseded
    superseded: relationship and reason retained<br/><b>never silently deleted</b>

    note right of signal
        Deterministic checks emit fail
        or candidate. A candidate feeds
        a maintenance list and changes
        no axis. Nothing is promoted
        because a check passed.
    end note

authoring_status (unassessed → outline → drafted → reviewed) runs beside it and may be downgraded "when a regression, source invalidation, or major structural gap is found", together with a profile-registered readiness status and the user's own learning_status. The standard's instruction is that the four "MUST NOT be merged into a single status chain", with a worked example of a page that is reviewed, unbuilt, single-source and unlearned at once.

Separating "somebody checked the prose" from "the world supports the claim" is the distinction most systems in this atlas collapse into one confidence float. Here they are separate fields with separate owners and separate upgrade rules, and the upgrade rules are the point: automation can only ever move a page down.

3. Architecture

effective standard = domain-neutral kernel + exactly one selected profile

Twelve kernel modules K00–K12 carry the normative rules — scope and architecture, build execution, note types and ownership, content depth, terminology, knowledge intake and evolution, sources and accuracy, metadata and status, wiki links, writing, expression, quality assurance. Twelve runtime routes R01–R12 are execution paths, in a namespace deliberately kept independent of Kxx. Read Sets bound which sources a route may load. Runtime Cards are compiled shortcuts, and the ordering rule is stated plainly: "Normative source text always wins."

Tools/ is the enforceable part — 58 Python modules, 67,280 lines — led by the shared parser kblib.py (3,900 lines), the terminal-proof gate check_proof.py (2,867), stamp_cards.py (1,617), the governed writer apply_delta.py (1,069) and the vocabulary gate check_vocab.py (469). Schema templates cover the audit plan, coverage ledger and delta, execution defaults, progress ledger, receipts, residual-scan config, terminal proof and watermark.

Deployment and ergonomics

Python 3 and no dependencies — kblib.py implements a restricted YAML subset parser rather than taking a library, and the accepted subset is declared in each template: scalars, one-level lists, one-level flat maps; no anchors, no block scalars, no flow maps, no multi-document. Every script is a CLI over a vault root and runs immediately.

The adoption cost is not the tooling. It is filling in a profile: the standard is inert until an adopter answers the profile interface and composes a vocabulary, and until then check_vocab.py correctly declines to check anything.

4. Essential Implementation Paths

The middle of the guarantee, measured against a live host

The delivery mechanism above proves two of three things. The registry that governs it says which one it cannot: "A server can prove what it sent. It cannot prove what the host put in the model context." Between the server's send and the model's acknowledgement sits a host adapter that may deliver a tool result inline, truncate it, or spill it to a file — and no amount of hashing on either side sees that.

Tools/host-conformance.yaml is a registry of adapter builds that have demonstrated by test that a within-budget result arrives inline, and Tools/tests/host_conformance_probe.py is what earns an entry. Its design is the part to take.

Both controls are mandatory, and the positive one alone is defined as a failure. The positive control requires a payload of exactly minimum_bytes to arrive whole, "proven by the model reporting a nonce placed at its very end" — a tail nonce, so a truncated prefix cannot pass. The negative control requires a larger payload to be observed as externalized. The registry states the rule in one line: "A positive result alone is not a pass: a probe that cannot fail cannot certify." A probe whose negative control does not fire reports itself as failed rather than reporting success. This atlas asks for a positive control beside an absence assertion in every report it writes; this is the same argument turned on the instrument, and it is the only implementation of it in the corpus.

The measurement is dated, versioned, and produced a warning rather than a celebration. Against Claude Code 2.1.223 on 22 August 2026, 49,152 bytes arrived inline with the tail nonce intact, while 57,344 and 65,536 were both spilled to a persisted-output file with the nonce absent. So the adapter clears the 49,152-byte budget and the probe demonstrably detects the failure it rules out — and the commit records the consequence in the same breath: "the inline ceiling sits between 49152 and 57344 bytes, so the budget has no headroom above it."

An unmeasured adapter degrades rather than inherits. Registration binds a clientInfo name and an inclusive-exclusive version range, because "hosts update themselves underneath a passing registration, so evidence binds the build it ran against and an unlisted build degrades instead of inheriting a stale pass." Two more sentences bound the claim honestly: an absent adapter is degraded, and "that is a statement about measurement, not about quality"; and the version labels are "declared labels, not authentication." Evidence that expires when its subject changes, a default of degrade, and a refusal to confuse an unmeasured thing with a bad one — the same fail-closed instinct as the producer-era predicates above, pointed at a dependency that upgrades itself.

A record is judged by the contract that was in force when it was written

Tools/check_queue.py carries a family of predicates — one per contract change — that decide which shape a historical record was promised to have, keyed on the semantic version of the tool that produced it: _standards_adoption_profile_contract_required (1.3), _profile_inputs_required (1.4), _upstream_required (1.5), _owner_projection_required. Each reads the producer's version off the record and selects the legacy contract only for an exact version below its threshold.

The failure direction is the part worth copying. "An absent or malformed producer identity fails closed onto the current shape instead of becoming a way to erase the new binding." Schema-version leniency is normally an escape hatch — omit the version, get the old rules — and this closes it: a record that cannot say which era wrote it is judged by today's stricter contract, so a missing producer identity costs the writer rather than buying it an exemption.

The reading rule is stated in the same file: "Historical plans retain their recorded raw Gate closure. They are replayed under their producer era, not retroactively rewritten to the current leaf-to-owner projection." The current rules do not reach backwards and rewrite what an older run recorded, and an older record does not get to claim today's looser interpretation of a field it never carried.

And current state is separated from adoption history. .cambium/governance/standards_state.yaml holds one canonical record — state_revision, standards_version, status, effective_date, the selected profile manifest, the latest adoption receipt and the upstream source and revision — while .cambium/receipts/standards-adoptions.jsonl is the append-only history behind it. The compatibility bridge for adopters whose identity is still spread across the three task ledgers says what it will not do: migrate_standards_state.py "does not create an adoption, rewrite history, or read K00/03 as mutable state."

effective_date is a validity field sitting beside a record-time history, which is most of what a bi-temporal design needs. The mark is withheld because no read path queries it. The field is written, validated as YYYY-MM-DD and carried through the adoption plan; nothing takes an as-of date and asks what was in force then. The producer-era machinery reads the record axis and the validity axis is stored and inert, which is one half of the pair.

The obligation to read is not evidence that anything arrived

kernel/K13 Task Runtime and Execution Control/19 Card Context Activation and Read-back Delivery.md draws a distinction almost nothing in this corpus draws. A Task Contract names the routes, Cards, Read Sets and modules a worker is required or permitted to load — and the module's first paragraph refuses to let that stand as delivery: "The Task Contract says which routes, Cards, Read Sets, and modules are required or reachable; it is not evidence that a later Agent received them."

What supplies the evidence is a content-addressed Card Activation Bundle: full bytes plus hashes for the bootstrap Read Set and every selected Card, each Card's paired Read Set hash with source_hash equal to compiled_source_hash "so unacknowledged semantic drift blocks activation", and a card_bundle_sha256 stored in the admission receipt. The five-field reading plan is projected out of the contract and hashed separately as reading_plan_sha256, so the reading envelope has an identity independent of the contract that produced it. queued -> open recompiles the bundle from current bytes and requires exact equality; historical replay validates under the producer era rather than reinterpreting an opened batch with new Card bytes.

Delivery itself is bound to a session. The MCP server assigns one non-reused ID per initialized session, passes it to every child tool as CAMBIUM_EXECUTION_CONTEXT_ID, and records delivery_mode: host-context-injection, delivery_assurance: machine-delivered and execution_context_id: mcp:<session-id> on a successful admission — and "the same MCP session must consume the admission at queued -> open; another session receives a different ID and is refused." A direct CLI run still carries the whole bundle and records cli-tool-result and degraded, with the rule stated in the standard: a runtime "MUST NOT claim machine-enforced Card delivery from that degraded record."

The sentence that makes this worth copying is the one that gives ground. "This proves that the exact tool-result payload entered the named host session. It does not authenticate the human/Agent identity or prove cognition." And earlier: "this module does not claim that a model understood or obeyed either one." Every system in this atlas that injects memory into a prompt asserts, by silence, that the injection worked; this one separates the material was selected, the material entered this context, and the model acted on it into three claims, evidences the second, and declines the third in writing.

A run that checked nothing says so

check_freshness.py reads frontmatter, skips retired and merged pages, resolves a page's volatility from an explicit declaration or a domain mapping, and computes review_by as last_verified + interval — 120 days for fast, 365 for slow, never for stable. Overdue and never-verified pages become candidates.

The decision worth taking is in the docstring and then in the output:

"when every scanned file is skipped for lack of a resolvable volatility, the run reports NOTHING CHECKED as a candidate result — an all-skip run is not evidence of freshness."

Run against Cambium itself at this commit, that is exactly what happens: 153 files scanned, 153 skipped, overdue=0 and fresh=0 printed side by side, and a conclusion that refuses to be read as a pass.

Most staleness checks in this atlas would have printed overdue=0 and returned zero. The difference between "no page is overdue" and "no page could be assessed" is invisible in the first number and decisive for the operator, and this is the only tool in the corpus that reports it as a distinct outcome.

check_vocab.py applies the same principle one level up. With no composed vocabulary it does not fall back to a permissive default; it prints what is missing, prints the command that fixes it, and exits 1.

Candidates cannot promote

The result vocabulary is fail and candidate, and the freshness script states the consequence: "overdue and pending-first-verification pages are always result=candidate — they only feed the maintenance-run candidate list and never change any status axis of a page."

Read that against the status standard's ban on automated upgrades and the architecture is complete in one direction and deliberately absent in the other. A deterministic check can fail a batch and can nominate work. It cannot mark a page reviewed, cannot advance evidence_maturity, and cannot conclude that a page is fresh. Everything that raises a page's standing requires a judgement the tooling does not make.

This is the promotion between tiers gate written as a prohibition rather than as a mechanism, and it is a cleaner statement of it than most implementations manage — because the component that would be tempted to promote is the one explicitly denied the power.

The merge zone an LLM may not touch

apply_delta.py is the governed write path, and its safeguards each close a real failure:

• Dry run by default. --apply is required to write.
• Re-parse before write. The merged output is re-parsed with the restricted parser and the run aborts without writing if it no longer parses, so a merge cannot leave the canonical ledger unreadable.
• Atomic write via temp file and replace.
• Out-of-scope protection. A page whose next_batch or batch does not equal the delta's batch is rejected; --force overrides and records a per-page reason.
• Unknown keys applied but warned, because profile extensions may legitimately add them and the warning is the visibility hook.
• Receipts merged by appending, deduplicated, rewritten in the schema's block form rather than left as orphan list lines.

An agent proposing a structured delta that a deterministic script validates and applies is the governed write gateway in a filesystem rather than a database, and abort-on-unparseable is the part most implementations of that pattern leave out.

Evidence bound to the page

Coverage Ledger entries carry gate_receipts — ids of the form audit-check_links-20260721T000000Z-<fingerprint>-0001 — so the checks that certified a page travel with the page's entry rather than living only in a log. check_proof.py then enforces the terminal gate: completion requires the three open-guidance counts at zero, required_authoring_gaps=0, unverified_batches=0, unresolved_invalidations=0, a Terminal Proof with every field populated, and a route list that must include the bootstrap, audit-and-completion and targeted-audit routes because "this is terminal evidence".

A completion claim that must enumerate which routes and which cards produced it, and that fails on any empty field, is a stronger definition of "done" than most systems here have for "stored".

5. Memory Data Model

The unit is a Markdown page in the adopter's vault. Cambium owns its frontmatter vocabulary: type, domain, scope, level, depth, priority, the four status axes, evidence_maturity, prerequisites, aliases, last_verified, last_reviewed, volatility, lifecycle, source metadata and related. Machine-readable base values live in vocabulary-base.yaml; a profile may only append through registered extensions, and "Markdown prose remains the single canonical owner of field semantics" — the registries are projections, not a second source of rules.

Around the corpus sits a state layer, shipped as templates rather than instances: a Coverage Ledger of page-level status, a Progress Ledger of task and batch state with an explicit task state machine, Coverage Deltas, an audit plan, script receipts as JSONL, a residual-scan config, a watermark, and the Terminal Proof.

What is absent, measured against this atlas's rubric. There is no value-keyed rejection: supersession is a relationship between pages with a retained reason, which is history and not a guard against re-assertion. Validity time is not tracked apart from record time — last_verified and last_reviewed are when someone looked, not when the claim was true. And the Coverage Ledger's status fields are updated in place by apply_delta.py, so the ledger holds current standing and not its trajectory; the durable append-only material is the receipt register, which records verifications rather than mutations. That is the other half of the append-only audit pattern, and the half fewer systems build — but it is not the half the mark is for, so the mark is withheld.

6. Retrieval Mechanics

There is no retrieval engine, and the repository says so. What exists is a loading discipline: Read Sets define, per route, which sources an agent may read back, and Runtime Cards are compiled shortcuts for routine work with a stated precedence — when a Card is "incomplete, disputed, or insufficient for an exception", the agent reads back the Read Set and the kernel modules, and normative text wins.

Compiled-shortcut-with-authoritative-fallback is a real context-assembly pattern and the precedence rule is the load-bearing part; stamp_cards.py exists to keep the compiled artifacts traceable to their sources. But nothing here ranks, scores or filters memory, so most of this atlas's retrieval questions do not apply, and scope_enforced is withheld for the plain reason that there is no read path on which a scope key could be applied.

7. Write Mechanics

Writing is batched. A batch is "an independently accepted unit of work with its own manifest, dependencies, receipts, delta, and lifecycle"; an agent is an execution context, possibly several per batch; and a logical integrator "exclusively controls shared state, batch activation, queue changes, and serial merges". Concurrent workers produce isolated outputs and the integrator merges them one at a time, running global checks after each merge.

Single-writer-for-shared-state with isolated concurrent producers is the right shape for LLM workers, and stating that the concurrency cap is on batches rather than on agents is a distinction most designs blur.

Operational cost

The checks are pure Python over a filesystem — no model, no service, no network. check_links.py scanned 153 files and 1,171 links in under a second at this commit. The real cost is the standard: an adopter must answer a profile interface, compose a vocabulary, maintain ledgers and receipts, and route work through batches. Cambium is explicit that this is for corpora maintained over time, and the machinery would be absurd for anything smaller.

8. Agent Integration

No runtime, no MCP server, no framework binding. The integration surface is the kernel text an agent is expected to load and obey, plus CLI checks a human or a CI job runs. That places most of the standard's authority in the category this atlas records for MeMex Zero-RAG: invariants expressed as instructions to a model.

The difference, and it is material, is that Cambium moved a specific subset into executable form — vocabulary conformance, link integrity, duplicate detection, MOC coverage, residual content, profile validity, freshness, delta application and terminal-proof completeness are scripts, not sentences. Measuring that boundary is the most useful thing a prospective adopter can do, and this report's own attempt is in section 10.

9. Reliability, Safety, and Trust

Strengths:

• "Nothing checked" is a distinct result from "passed", in both the freshness and vocabulary checks, with the reasoning in the docstring and the refusal visible in the exit code.
• Automated checks may never raise a status, stated normatively and reflected in a result vocabulary with no promoting outcome.
• Four independent status axes, with an explicit prohibition on collapsing them and a worked example of their divergence.
• A deterministic merge zone an LLM is not permitted to hand-edit, dry-run by default, aborting rather than writing an unparseable ledger.
• Receipts bound to ledger entries, so the evidence for a page's standing travels with the page. The catalog behind them earns audit_log: one appended record per check and per state transition, carrying tool, tool version, target, a result asserted to be pass, fail or candidate, and the queue identity fields — so a refusal is filed in the same shape as a pass rather than leaving no trace, which is the asymmetry this atlas finds almost everywhere else. The transition applier binds its receipt to the post-transaction identity rather than to the bytes on disk, which is what makes it a record of the mutation and not of the run.
• A record is judged by the contract in force when it was written, and a record that cannot say which era wrote it is judged by the strictest one — see section 4.
• A terminal completion gate requiring enumerated routes, cards and zeroed counts, failing on any empty field.
• No dependencies, including a hand-written restricted parser whose accepted subset is declared in every template it reads.
• Scoped licensing stated per path rather than as one blanket claim.

Gaps:

• No corpus, so nothing is exercised end to end. The reference profile shows the interface answered and check_profile.py passes on it; what remains undemonstrated is everything downstream of a vault — vocabulary conformance, freshness, duplicates, MOC coverage, residual content, delta application.
• The kernel is prose. Most MUST and MUST NOT rules have no script, and the enforcement boundary is not written down anywhere as a list.
• Supersession is page-keyed with a retained reason, which prevents silent deletion and does not prevent re-assertion.
• Ledger status is updated in place, so the append-only material is the verification register rather than a mutation history.

10. Tests, Evals, and Benchmarks

Tools/tests/ contains 66 test modules and 45,822 lines — roughly seven lines of test for every ten lines of tool — covering the gate runtime, the governed writer, the queue lifecycle, profile admission, residual scanning, template parity, the CLI-contract compiler and the MCP server. I did not run them; the screen found one build-time Makefile and no dependency manifest of any kind, so nothing was installed.

There is no benchmark and nothing to benchmark; the outputs are conformance verdicts, not rankings.

Two suites are worth reading for their shape rather than their coverage. test_vocab_artifact_integrity.py is built around the project's own thesis that nothing was checkable must not read as everything passed, and its discriminating case says so directly: test_a_truncated_vocabulary_does_not_pass_the_same_page — a page that a real vocabulary flags as illegal must still fail when the vocabulary is truncated, rather than passing because the rule went missing. Three sibling cases pin the other ways an artifact can be vacuous: empty bytes, an empty field set, and unparseable bytes, each refused rather than skipped.

test_card_activation.py covers the delivery mechanism described in section 4 from the negative side in nine of its twelve cases: test_unregistered_extra_selected_card_path_is_rejected, test_embedded_byte_tampering_is_detected, test_r01_and_semantic_card_currency_fail_closed, test_open_consumes_only_the_same_machine_delivery_context and test_resume_refuses_card_bytes_that_drifted_after_open. A delivery-evidence mechanism whose tests are mostly about what must be refused is the right ratio for the claim it makes.

What can be measured is self-application, and it was, at this commit:

Two real passes, and they answer different questions. Every one of 1,171 wiki links across 153 interlinked kernel files resolves, so the standard's own corpus obeys its own K09 rule. And the reference profile binds all ten interface slots with no unfilled-template marker left, so the profile interface is answerable in practice rather than only in the abstract — with the tool's own caveat attached: "This checks structure, not whether the answers are good."

The three non-passes are the design working, and the third one is the sharpest. compose_vocab.py will not build a vocabulary from a validated example profile because the repository-level governance page is deliberately uninstantiated — adoption is a governance act, and the tool refuses to simulate one. So the boundary is not "no worked instance"; it is that the worked instance stops precisely where a real adopter's judgement would have to begin.

What that leaves unexercised is everything downstream of a composed vocabulary, which is most of what the standard is for: conformance, freshness, duplicates, MOC coverage, residual content, delta application, and the terminal proof.

11. For Your Own Build

Steal

• Make "nothing was checkable" a distinct outcome. A gate that returns green when every input was skipped is the most common way a quality signal lies, and the fix is one branch and one sentence of output.
• Deny your automation the power to promote. Let checks fail and nominate; require a judgement to raise standing. Written as a prohibition it survives contact with a contributor who wants to save a step.
• Split status into axes that cannot be merged, each with an owner and its own upgrade rule. A single confidence float hides the case where the prose was reviewed and the evidence is still one source.
• Let the model propose a delta and let a script apply it. Keep the serial merge zone deterministic, dry-run by default, and abort rather than write a state file that no longer parses.
• Bind receipts to the record. A page entry carrying the ids of the checks that certified it answers "why do we believe this is reviewed" without a join.
• Define completion as enumerated evidence. Requiring which routes and cards produced a result, with zeroed open counts, makes "done" falsifiable.
• Declare the parser subset you accept in the template of every file you parse, if you write your own parser to avoid a dependency.

Avoid

• Gating your own demonstration on an adoption you decline to make. The reference profile validates, and the vocabulary it would compose cannot be built, because compose_vocab.py requires the repository-level governance placeholders to be filled first. That is a defensible boundary and it means the half of the toolchain downstream of a vocabulary has no public passing run.
• Leaving the prose/script boundary undocumented. Twelve scripts beside twelve kernel modules invites a reader to assume the rules are enforced; a list of which MUST clauses have a check would cost a page and settle it.
• Treating supersession-with-a-reason as protection against re-assertion. It is history. Keyed on a page, it cannot stop the same conclusion arriving again under a new one.

Fit

Right for an operator maintaining a substantial, long-lived corpus with LLM agents who already feels the failure this standard is built around — that an agent will claim completion it cannot evidence. The batch model, the terminal proof and the governed merge are proportionate to that problem and to nothing smaller.

Wrong as a memory component. It stores nothing, retrieves nothing and ranks nothing, and adopting it means adopting a working method rather than adding a dependency. The honest way to read this report is that Cambium's two best ideas — a check that refuses to pass what it did not examine, and a toolchain forbidden to promote a belief — are worth copying into systems that do store, most of which have neither.

12. Open Questions

• Which kernel MUST clauses have a deterministic check and which do not? No list exists, and it is the number an adopter most needs.
• Is a value-keyed rejection compatible with the page-level supersession model, or does the corpus's unit rule it out?
• Does the Coverage Ledger's in-place update lose anything the receipt register does not recover?
• The reference profile binds every interface slot, and composing its vocabulary is blocked by the repo's own unfilled governance page. Is that ordering deliberate, or would a composed example vocabulary be shippable?
• check_proof.py is the largest script and the one gating completion. What would it take to test it?
• The freshness intervals (120 days, 365 days, stable never) are stated without derivation. What are they calibrated against?

Appendix: File Index

• Kernel: kernel/K00–K12, notably K06 Knowledge Intake and Evolution/ (source-to-knowledge pipeline, evidence maturity, supersession), K08 Metadata and Status/03 Status Axes.md, and K12 Quality Assurance/ (completion gate, audit evidence reuse and invalidation, terminal audit).
• Governed write: Tools/apply_delta.py.
• Refusal-to-pass checks: Tools/check_freshness.py, Tools/check_vocab.py.
• Completion gate: Tools/check_proof.py.
• Other checks: check_links.py, check_profile.py, check_moc.py, duplicate_check.py, check_residual_content.py, stamp_cards.py, compose_vocab.py; shared parser kblib.py.
• Schemas: Tools/schemas/ — coverage_ledger, coverage_delta, progress_ledger, receipt.template.jsonl, terminal_proof, audit_plan, watermark, execution_defaults, residual_scan_config.
• Tests: Tools/tests/ — 66 modules, notably test_vocab_artifact_integrity.py (vacuous-pass refusals), test_card_activation.py (delivery evidence, mostly negative cases), test_metadata_gate_runtime.py (the actor-role refusal) and test_mcp_server.py (the static import-set assertion).
• Licensing: LICENSE.md, LICENSES/, NOTICE, ATTRIBUTION.md.

History

2026-09-13 — 6ed60b8c… — re-read, 140 commits past the previous pin across 1,008 files. All three marks stand, and every path they rest on had to be re-resolved: the Tools/ scripts the evidence cited are now 22-line shims whose docstrings read "Stable public command; implementation lives at…", with the implementations moved under Tools/platform/common/, Tools/knowledge/metadata/ and Tools/execution/evidence/. kblib.py and metadata_gate_runtime.py no longer exist at the cited paths at all; the records now name where the code is. The audit writer gained a distinction worth recording: write_receipts_observed returns an outcome rather than raising, and separates a writer error after durable bytes — reported present with the error attached — from a partial or truncated record, reported uncertain, because a canonical transaction caller uses exactly that difference to decide whether a rollback is closed or must keep its recovery lock. Screened again first; nothing was installed and no suite was run.

2026-08-22 — 48dcf34c… — re-pinned 9 commits on. Screened again: no auto-run surface, one build-time Makefile, no dependency manifest, nothing installed or run. Marks unchanged.

The addition is in section 4: the delivery guarantee's middle third, measured. card-first-readback-v3 splits activation into budgeted pieces, K13/20 adds an assignment-state and delivery gate, and Tools/host-conformance.yaml records which host adapter builds have demonstrated inline delivery by test rather than by assumption. The probe requires both a positive and a negative control and treats a positive-only result as its own failure, on the stated ground that "a probe that cannot fail cannot certify". Measured against Claude Code 2.1.223: 49,152 bytes inline with the tail nonce intact, 57,344 and 65,536 spilled to a persisted-output file — a pass, recorded together with the warning that the ceiling leaves the budget no headroom.

2026-08-21 — 32ed022e… — re-pinned 13 commits on, later the same day. Screened again: no auto-run surface, one build-time Makefile, no dependency manifest, nothing installed. audit_log is awarded, on a mechanism present at the earlier pin and not credited: kblib.make_receipt builds one record per check and per state transition with a result asserted to be pass, fail or candidate, appended under .cambium/receipts/ with a hot catalog and a cold archive, across 146 call sites — a refusal filed in the same shape as a pass. Taking the report to three marks.

New at this pin, in section 4: contract-era replay. A family of predicates in check_queue.py decides which shape a historical record was promised to have from the semantic version of the tool that produced it, and "an absent or malformed producer identity fails closed onto the current shape instead of becoming a way to erase the new binding" — the escape hatch that schema-version leniency usually opens, closed deliberately. Alongside it, adopter Standards state is separated from adoption history, with a migration bridge that states what it will not do. bitemporal is withheld and section 4 says why: effective_date is stored and validated and no read path takes an as-of.

2026-08-21 — 21bada21… — re-pinned 22 commits on. Screened again: no auto-run surface, one build-time Makefile, no dependency manifest, nothing installed. Marks unchanged.

A correction first. This report said Tools/tests/ held "one file of 73 lines covering check_links.py" and listed the ratio of tooling to tests among the project's risks. At the pin it described, the directory held 62 test modules and 44,734 lines; at this pin, 66 and 45,822. The claim was wrong when written and survived a re-pin that rewrote the executive summary without revisiting section 10 — the same shape recorded for Agent Mesh in the overview's history, where the sections nobody edited kept the old position. Both capability-evidence records also carried "no case was located at this pin"; test_vocab_artifact_integrity.py and test_metadata_gate_runtime.py:121 are those cases, and the records now name them. The architecture figures were recounted at the same time: 58 tools and 67,280 lines of Python, 164 kernel modules and 10,121 lines of normative text.

New at this pin: delivery evidence, in section 4. K13/19 Card Context Activation and Read-back Delivery separates the reading obligation from proof that the bytes arrived, hashes the five-field reading plan independently of the contract, binds a machine-delivered admission to one MCP session ID that queued -> open must match, degrades a CLI run to cli-tool-result and forbids claiming machine-enforced delivery from it — and states in the standard that none of this proves cognition. test_card_activation.py covers it with nine refusal cases out of twelve. Alongside it, Batch Review Requirements became an executable per-batch protocol whose expansion is deterministic and carried as review_requirement_set_sha256, so an agent starts a batch with its judgment obligations in context "rather than discovering them at refusal".

2026-08-20 — 7181c94e… — re-pinned 127 commits on, 272 files and +73,434 lines, across Tools/ (137 files), profiles/ and kernel/. Screened again: no auto-run surface, one build-time Makefile, no dependency manifest of any kind, so nothing was installed. Marks unchanged at trust_state and human_review. One published claim in this report stopped being true, and two mechanisms are new.

There is a server now, and the way it is kept from becoming a judgment is the interesting part. Tools/mcp_server.py is an MCP stdio server at protocol revision 2025-11-25, whose tools/list is projected straight out of Tools/compiled/mcp-tools.json, itself compiled from the CLI contract by compile_cli_contract.py. Two properties are enforced rather than intended. It declares no argparse parser and no main(), so discover_tools cannot see it and it never appears in its own tool list — "a transport that advertised itself as a callable operation would be the exact layer smear this file exists to avoid." And it imports nothing from the distribution — not a check, not an applier, not kblib — with Tools/tests/test_mcp_server.py asserting the import set statically, "so the property survives future edits." The stated reason is the one this atlas keeps asking for: "a module that cannot reach a judgment module cannot make a judgment." The cost is a hand-rolled sha256 and a hand-rolled canonical json.dumps, and the file says so.

Metadata authority became executable. Tools/apply_metadata_transition.py (489 lines) consumes one typed Profile Gate receipt as a canonical metadata transition: only the Integrator may run --apply, a current-catalog producer receipt is validated first, Profile, K00, metadata-contract, page and Coverage inputs are compare-and-swapped under a shared runtime writer lock, and a pre-commit failure restores both Coverage and the exact page before-image. An authority that was a documented role is now a gate with an actor, a receipt and a rollback.

Also at this pin: freshness evidence closed over the full scan rather than a sampled one, legacy observations recording the field's vocabulary rather than the gate's enum, per-host registration and binding configs rendered with the run that produced them named in the header, and compile_cli_contract no longer claiming complete receipt extraction.

2026-08-07 — 78140714… — 32 commits and 52,570 inserted lines on, and the work is the project auditing its own distinguishing property. Screened first: 0 auto-run surfaces, 1 build-time execution path, 0 unpinned surfaces, nothing inside the cooldown; nothing was built or run. Marks are unchanged. Seven remediation batches left 106 findings open, and the commit that matters separates them: most were wording and ownership consistency, while six "had the same shape as the S1s this work started by fixing, which is that something passes by saying nothing" — the failure class this report already credits the project for naming. The worked example is the vocabulary gate: compose_vocab was the one artifact writer not going through atomic_write_text, and check_vocab only asked whether the file existed, so a zero-byte vocab.yaml made every controlled frontmatter value legal and exited 0. Both sides now share one predicate — the artifact must parse, be a mapping, and carry a non-empty field set — and CI was added that would have caught the original two findings. A separate batch closes "the bypasses an independent review found in the new checks", which is the second-order version of the same discipline: the checks that catch vacuous passes were themselves checked for vacuous passes.

2026-08-04 — 4f8bf4df… — second reading, four commits on, prompted by the project's author. profiles/examples/agent-atlas/ is a 603-line filled reference profile carrying no placeholder markers, and it was present at the previously pinned commit; check_profile.py passes on it — slots=10 bound_ok=10, sentinel_hits(fail)=0, 13 files scanned. Verified at the old pin before the re-pin. compose_vocab.py still refuses to build a vocabulary from it, because K00/03 carries four uninstantiated {{ }} placeholders and adoption is a governance act the public repository declines to simulate, so check_vocab.py continues to exit 1 and check_freshness.py continues to report NOTHING CHECKED. Since the old pin: ROADMAP.md gains a typed-dependency-runtime section, and the example's adoption wording is rewritten — where it previously described the live Agent Systems Atlas corpus as "migration inputs to a future adoption task", it now records that the Atlas has completed a separate formal adoption of Cambium 3.0.0 against a materialized profiles/agent-atlas/, while adding that this example "remains a reference rather than an adoption certificate or proof of corpus-wide acceptance". That private instance state is not distributed, so nothing about it is checkable here.

2026-08-04 — 289515b5… — first reading. The three self-application runs in section 10 were executed against the repository at this commit, as was the test file; the exit codes are measured, not read.