[ROADMAP] MAGI Final Architecture — implementation and acceptance #2

目标与权威基线

本 Issue 是 MAGI 最终架构实施的唯一导航入口，不是规范修订，也不是将全部差异平铺为独立任务。最终行为与验收门槛以 《MAGI 最终版本设计与验收标准》修订 4 为准，重点追溯 §2、§10、§13、§17–20。首次实施审查的历史代码基线为 98c69a14b274bc1d74561b01bd4de2f1e81f4c33；后续文档提交及 Issue 模板合并未改变该代码基线。任何新发现必须注明其实际复核 commit，不能永远把旧行号视作最新事实。

设计文档定义最终目标，不承诺现有能力，也不包含分期路线。本 Issue 仅负责组织实施；不得凭关闭 Issue、模型自评或模拟实验声称满足最终验收。ROLLOUT-LAB-1.0 是隔离测试参考域，不构成真实生产写入授权。

首批工作包（首批已建；勾选表示完成且有验收证据，不表示 Issue 已存在）

• #3 决策、议程与密封票据：候选集、逐候选裁决、成对偏好、全局选择和真实失败语义。
• #4 人格、证据、经验与上下文：PersonaSpec、四类断言、独立验证、ContextManifest、撤销传播。
• #5 授权和人类决策：认证主体、同意集合、委托链、AuthorityProof、人类覆盖。
• #6 独立见证与受保护出口：ActionIntent、outbox、AuditReceipt、唯一 Egress Gate、远端恢复。
• #7 状态投影与真实报告：分离六维权威状态，持久化异议，报告引用和外部契约。
• #8 预算、形式化验证与统计验收：分阶段期限、k=1..4 验证、真实故障注入、四组配对及 23 项声明族。

已确认的现有正确性问题（首批已建；勾选表示修复验证完成）

• #9 审批错误复用 → 父 Epic #5。
• #10 失败/非法投票被当作 ABSTAIN → 父 Epic #3。
• #11 必需工件保存失败后流程继续 → 父 Epic #7，并阻塞未来受保护出口的权威 outbox 设计。
• #12 自动应用忽略回归失败 → 父 Epic #4。
• #13 报告引用与持久化异议 → 父 Epic #7。

以上为静态核对确认的代码路径，不能等同已完成运行复现；每个 Bug 必须补 RED→GREEN 用例、相邻路径检查及适用的故障测试。

阶段顺序与退出条件

阶段表示主要依赖，不排斥互不依赖的契约审阅。不得为了赶阶段而弱化设计硬门槛。受保护写入路径在最终授权与出口能力尚未建立前，不得被宣称符合最终设计。

接纳新发现：先归类，再决定是否开 Issue

1. 属于正在实施的同一不变量：补进原 Issue 的测试/验收，不新开。
2. 独立且阻塞当前验收：创建单独 Bug/Implementation，链接 Blocked by，不扩张原任务。
3. 非阻塞或远期问题：只登记在父 Epic 的待拆解项；到达对应阶段且验收明确时才建新 Issue。
4. 需要变更最终规范：先用 Design Change 模板走 PROPOSED→正式接受→规范 PR；不允许实现 Issue 私自改目标。
5. 当前 PR 引入且仍在原范围内的回归：在当前 PR 修复，不转移为“以后再说”。

并行限制、准入及关闭标准

• 同时进行的 Implementation/Bug 最多 2 个；另可为安全或关键数据问题保留 1 个紧急处理位置。Epic 与 Roadmap 是组织容器，不占 WIP。
• 仅当任务含固定规范条款/不变量、可重现或可验证的目标、具体非目标、依赖、RED→GREEN 测试与完成定义时，才进入 Ready。
• Issue 关闭必须关联实际 PR 和真实测试证据；未实施、未运行、未通过不得使用“已验证”描述。
• 每完成一个阶段，按 §19 不变量检查覆盖度、仍未关闭的阻塞问题、历史工件和对外声明适用性，不以已关闭 Issue 数量代替阶段验收。

追溯矩阵及最终交付

Epic 分别维护所属不变量与待拆解清单。本路线图在各工作包就绪后汇总 §19 全部 GOV/PER/MEM/EVID/AGENDA/SELECT/VOTE/AUTH/EGRESS/AUDIT/SEND/TX/SEC/REPORT/STAT/OPS 的实现 Issue → PR → 测试结果 → 已验证/未验证状态。§18 的冻结试验与 §20 最终交付材料必须单独呈现，不得由文档或绿灯 CI 推断完整能力通过。

2026-10-23 · Implementation progress reconciliation (main 37ec45997a62e4e2829f69e7384ed6f1a6c4447e)

现状与证据（非 Rev4 全量验收）：

• P0 既有正确性修复：#9、#10、#11、#12 均已关闭且具实施/合并记录；#13 仅由 PR #31 完成结构化引用与持久化异议，报告自由文本授权/发送/核验真实性仍未完成，Issue 保持 Open。
• Durable ExecutionGeneration / Fencing：#17 与 T1–T6（#19–#24，PR #25–#30）完成单调代次、Claim 所有权、按代次工件读写/Checkpoint、终态 CAS、停止依赖破坏性 Cleanup、协调切换门禁；详细合并与 MySQL 证据见 [BUG] Fence cross-attempt artifact cleanup and stale writers with durable execution generation #17。这不证明 Context/Authority/Credential 撤销排序、唯一 Egress、外部效果 exactly-once 或已完成生产切换。
• 新的阶段性基础能力：PR #32 Decision Protocol v1 设计契约；#33 C0 magi-cj/1 身份；#34 C1-A 输入工件契约；#35 read_set_snapshot/rset_ 身份注册；#36 DomainProfile 离线语义验证；#37 PersonaSpec 三正式基线 离线语义验证。全部已合并。
• 当前仍缺失：Decision Artifact v2 显式绑定，ContextManifest/ReadSet 实际读取与关闭事务，AuthorityProof、ActionIntent/独立见证/安全出口，多候选密封票据与选择算法、六维状态及 §17–20 独立验收。
• 下一阶段门槛：先进行 Decision Artifact v2 版本化绑定设计（与 C1-A §6.5、[EPIC] Multi-candidate decision, agenda and sealed ballots #3/[EPIC] Persona, typed evidence, governed experience and ContextManifest #4/[EPIC] Authenticated authority, delegation, owner consent and human decisions #5/[EPIC] Independent audit witness, sole egress gate and recovery semantics #6 对齐），再独立实施 ContextManifest 离线验证与后续受权威顺序约束的 Journal/Closure。C2/C3 契约可独立设计但不得提前开启权威发布/发送。

状态纪律： #3–#8 六个 Epic 和 Roadmap 全部保留 Open；现有单工件静态/离线/CI 证据不构成 Rev4 整体验收。最新 main 仅为本次对账基线，后续执行需重核。

2026-10-23 · Decision Artifact v2 work started

已在 Epic #3 下启动独立设计任务 #38，针对 C1-A §6.5 / PR #32 的版本化 DecisionCharter、CandidateSnapshot、三角色回执与 evidence closure 身份绑定。当前仅任务立项并冻结范围；后继顺序为 #38 契约 Draft PR/审阅 → C1-C1 ContextManifest 离线验证 → 依赖 C2/C3 的可信 Journal/Closure。其他 Epic 保持 Open，CAS-9 不标 Done；#38 的实际代码/CI/PR 尚未产生。

2026-10-24 · PR #39 merged and C1-C1 scoped

• Done — design/offline only: #38 was closed after PR #39 merged to main=f0277e15c356b426ee25be995d9f49c929534ec8. Final PR Head 0e9fea17cbd7415b5a5c54f099669f59a8f0176b, exact-Head CI #40049521968 6/6 success. Versioned Decision Artifact v2 binding, no-circular ID, capability/legacy matrix, 7 valid / 88 negative fixtures, 9+1 Python/Go Goldens and 28 fixed-version parity probes. The two independent P2 findings F39-01/F39-02 were closed before merge.
• Important: historical 2026-10-23 notes above described v2 as not yet delivered. They are historical snapshots. The new v2 contract exists; production consumers, trusted delivery, Journal/EVIDENCE_CLOSED atomic transaction, C2/C3 authority and Egress do not. Real v2 MySQL/session/authority fault injection remains NOT RUN/BLOCKED. The main push workflow #40050376341 was in progress at this update; PR-head success is separate.
• Next scoped task: #40 C1-C1 ContextManifest v1 offline semantic validator under [EPIC] Persona, typed evidence, governed experience and ContextManifest #4 is now PLANNED / Open. It covers exact three views, snapshot descriptor closure, Charter/Domain/Persona bindings, ctxm_ C0 identity, immutable readback/Envelope, reference qualification states and independent Golden. It does not implement actual read-set, session delivery, closure, revocation or authority.
• Follow-on DAG: [IMPL] C1-C1 — Validate ContextManifest v1 semantics and immutable offline identity #40 offline validation → C1-C2 controlled delivery/Journal/ReadSet (only staged independently) + C2 Auth trust/epoch and C3 common-order design → integrated closure/ballot/egress conditional commits once their capabilities exist. Roadmap and Epics [EPIC] Multi-candidate decision, agenda and sealed ballots #3–[EPIC] Budgets, model checking, fault injection and registered acceptance #8 remain Open; CAS-9 remains In Progress.

2026-10-24 · PR #41 merged; #40 completed; C1-C2A #42 scoped

Completed, independently bounded offline: #40 closed after PR #41 merged to main=737ee9381ec0fdc57d26e605d557a844bdefd3d1; reviewed final PR Head a95289e99958d5a631f162aaaefd41c9bd88864c CI #40055630479 6/6 PASS. C1-C1 delivered ctxm_ ContextManifest v1 offline strict Schema+semantic validation, exact 3 views, referenced snapshot descriptor closure, selected Domain/Persona and external-byte digest checks, original stored body/Envelope readback, two independent full-body Goldens and v1/v2 Schema mirror drift guard. F41-01/02 independently reviewed closed; Context test suite 127 PASS events/2 explicit runtime/authority boundary SKIPs (including subtests).

Do not promote evidence: Qualification=UNVERIFIABLE_REFERENCE, ActualReads=NOT_RUN; partial Persona domain extension relations remain PARTIAL_OFFLINE and strict complete local binding fails closed. Existing MySQL CI 143+47 PASS events does not cover new runtime C1-C2 closure. Merge-push CI #40056497201 was in progress at the time of first merge verification and must be independently checked.

Next work package scoped, NOT implemented: #42 — C1-C2A ReadSetSnapshot v2 offline semantics / rset_ full-body identity, under #4. Only local ReadEvent sequence, SourceNode DAG, Manifest/candidate/closure/role exact declared references, immutable identity/Envelope, independently produced Golden and fail-closed missing qualification; no real actual reads, trusted provider receipts or authoritative closure.

Dependencies: C1-C2A standalone offline → C1-C2B real append-only Journal and controlled injection (separate scope) alongside separately designed C2 AuthorityProof/epoch root and C3 common-order/witness → integrated true 3-role delivery/confirmations/one Evidence Closure transaction → sealed ballots/adjudicator. No C1-C2 runtime release until C2/C3 authoritatively implemented. #2–#8 remain Open; CAS-9 still In Progress, CAS-10 still Backlog.

2026-10-24 · Joint Stage #43 activated as tracked execution programme

Project coordination (tracking created, not code executed): #43 joint C1-C2/C2/C3 implementation Stage is the shared orchestration gate, using two concurrent workstreams, no more than TWO active Implementation/Bug PRs. Seven precisely scoped children: #42 C1-C2A (existing), #44 C1-C2B Journal, #45 C2/C3 authority/ordering design, #46 C2 Auth, #47 C3 conditional commit/witness, #48 C3 sole Egress, and #49 3-way final delivery/EVIDENCE_CLOSED integration.

First two parallel Draft PR targets: #42 (offline ReadSet v2 consumer) + #45 (shared authority API/commit-sequence design). #44/#46 follow merged upstream; #47/#48 and #49 remain dependency-gated and not executable authority/sends merely because their issues exist. #17 durable Generation is reused for worker fencing, never equated with scoped epochs, round or verified auth. Maintain independent README/version/Golen/RED→GREEN/real MySQL/provider failure evidence and final Head CI for each.

Verification baseline: main=737ee9381ec0fdc57d26e605d557a844bdefd3d1, zero open PR when stage plan created. No Stage code PRs have been created by this coordination action. All Epics remain Open; #13 remains Open, CAS-9 In Progress, CAS-10 Backlog; no protected send enabled. Stage completion does not imply full Rev4 acceptance.

2026-10-24 · Stage #43 first-wave #51/#50 merged; #42/#45 complete

Joint Stage #43 first-wave complete by two merged PRs: #45/PR #51 typed C2/C3 common-order design contract (merge c818d297), #42/PR #50 ReadSet v2 offline semantic consumer (merge c2c56912); both corresponding bounded Issue DoDs closed after independent source review. Both PR-head and merge-main workflows were 6/6 success, including current combined main c2c5691210e736a632c0033c196d3305e356ee9a CI #40077747132.

Next: #44 C1-C2B and #46 C2 are the next two eligible scoped Draft PR targets, within existing WIP=2. A2 provider/Journals can only be staged fail-closed until true C2/C3 ordered authority and delivery verification exist; B1 cannot issue a governance root by inference. #47/#48/#49 still depend on actual downstream review/merge. Not completed: actual model read-set/provenance, credential validation, new authority SQL/atomic closure, independent witness, protected Egress/Rev4 global acceptance. All Epics remain Open; CAS-9 In Progress.

2026-10-24 · Stage #43 second wave #52/#53 merged; gated slices only

Updated verified code baseline: main=1585ae11ae66fbc32600e3aa12c13260eac2bd4c, zero open PRs. Stage #43 wave 2 merged partial C1-C2B and C2 slices: PR #53 under #44 MySQL durable ReadSetJournal registration (S31, Generation lease/source check, delivery idempotency, DAG/reverse edges, UNKNOWN lineage), and PR #52 under #46 authenticated Ed25519 AuthorityProof / trust-root + policy/consent/credential-scope closure / scoped revocation persistence (S32). PR Head CI #40100073962 and #40095754907 each 6/6 success. Merge-main CI #40101137176 was in_progress at sync.
Not complete or active: #44 and #46 remain Open because both deliver only default-disabled bounded slices, no provider actual exposure and no production root/issuer activation. C2 VALID means authenticated locally, NOT CommitEligible or MutationAuthorized; ReadSet registration/replay does not prove a model read or authorize extra exposure. #47 common-order commit/witness, #48 sole protected Egress, #49 true three-party EVIDENCE_CLOSED still blocked/open.
New cross-track blocker: Add versioned JOURNAL_ADMIT pre-exposure operation to #45/#47 common-order contract via reviewed Design Change; absence explicitly admitted by #53. Keep source/status evidence levels segregated. Rev4 and all Epics remain Open; Stage #43 still In Progress, CAS-9 In Progress.

2026-10-24 · Outcome-driven delivery gates M1/M2/M3 (ROLLOUT-LAB-E2E-01)

Governance note: Delivery coordination, not a Revision 4 change or an AcceptanceManifest. This programme translates the already frozen Rev4 §§3–6, 9–13, 17–20 into observable milestones, without lowering any final standard. Observed baseline at planning: main=1585ae11ae66fbc32600e3aa12c13260eac2bd4c, 0 open PR; Rev4 remains the ultimate authority. Historic sections above remain valid as dated snapshots. All gates below begin NOT RUN / BLOCKED, not PASSED.

1. Three non-interchangeable release gates

Gate semantics: M1 is an actual read-only end-to-end system demonstration (not local schema or mocked sessions); M2 is an isolated functional safety integration gate (not general production permission); M3 is the only full Rev4 final acceptance. Partial integration and truthful DEFERRED/UNKNOWN are legitimate outcomes but are not proof of a successful complete path without their mandated evidence. No target calendar deadline is invented. Gate remains BLOCKED if any necessary capability is absent.

2. Single reference acceptance scenario: ROLLOUT-LAB-E2E-01

Scenario ID is planning/test-case identity, NOT an AcceptanceManifest or statistical sample. One fixed scenario family with two staged checkpoints (R0 and R1) and explicit negative controls; no actual final-test set is being run or disclosed/frozen here.

1. Frozen objective/owners/context: Isolated resettable single-tenant HTTP service; Requester seeks at least 10% P95 latency improvement while retaining stop/control rights, proven recovery, and no expanded permission. Authorized test Requester/ServiceOwner; C3 would need ChangeApprover but is excluded from M2 execution. Input package includes raw service state, last 30 minutes telemetry, version/dependencies, matched recovery drill, authenticated user preference, governed charter/domain and available candidates C0 no action, C1 shadow (R0), C2 5% canary (R1 when conditions met), C3 10% (R2; non-executed negative gate here). New final shared fresh state must be obtained within 30 seconds before candidate freeze, then delivered to each session with trusted receipts.
2. M1 checkpoint, actual read-only: MELCHIOR checks goal/baseline/counterevidence, BALTHASAR checks failure/rollback/no-action risk, CASPER checks authentic goals/control/consent and burden; all fulfill required §17 minimum inquiries/budgets and record uncertainty. Controlled provider/session APPLY evidence, initial ContextManifest and actual ReadSetJournal/ReadSetSnapshot/close, three distinct sealed ballots and independent candidate/selection result. Use R0 C0/C1 only for demonstrable read-only output; no ActionIntent SEND. If missing required information, output DEFERRED/INCOMPLETE with real reason, never fabricate success. Report includes minority dissent, source dependencies and separate state dimensions.
3. M2 checkpoint, isolated R1 extension: On a fresh authorized decision round with genuinely validated rollback ≤60 sec, extra errors ≤0.5 percentage point, explicit end time ≤15 min, and user/owner scope, consider C2 5% trial as R1 (not auto-upgrade from R0, not implied by M1 vote). Risk/alternatives and R1 ≥2 approve threshold obey Rev4. Unique consent/credential/context scopes/epochs are checked at common-order commit, then independent witness and sole Gate issue exact authorized target request; remote FENCED_IDEMPOTENT adapter enforces generation and logical-operation de-dup. Keep C3 prohibited without R2 all-three approval and additional separate human authority.
4. Negative probes required from first E2E suite: third role absent or unknown provider receipt, out-of-scope/material injected after cutoff, stale/withdrawn preference, expired telemetry/failed recovery, duplicate/conflicting final ballot, revoke vs JOURNAL_ADMIT or SEND_COMMITTED, stale worker, witness unavailable, model-claimed authorization and remote-response-loss. Each must block/downgrade with persisted truthful audit; do not make every negative case a successful decision.
5. Inspectable evidence artifact per run: fixture/manifest/seed/model+provider versions, exact case+round+ExecutionGeneration+epochs, session and delivery IDs, validated readsets and source DAG, all candidate/ballot/decision IDs, authority/consent and witness records if write path, send/remote receipts + independently checked final state, minority dissent, report and untested/unknown tags, command and CI/run URLs. Secret/key bytes must not enter reports.

Minimal scenario result labels: NOT_RUN / BLOCKED / DIAGNOSTIC_ONLY / FAIL / PASS_M1 / PASS_M2 / PASS_M3. Labels never auto-promote a subsidiary task or Epic. Actual final acceptance is separately adjudicated by Rev4 §19/§20.

3. Critical path, work-in-progress and anti-drift

• Immediate executable blocker: resolve #53's missing versioned JOURNAL_ADMIT pre-exposure conditional-commit design under #47 and [DESIGN] C2/C3 common authority-order contract — VerifyAuthority and CommitIfCurrent #45 legacy contract. This is a bounded, reviewed compatibility Design Change, not authorization to add arbitrary new architecture.
• Then #47 real shared ordered auth/context/credential conditional commit + witness; #44 real trusted provider admission/exposure reconciliation; #49 3-way delivery/closure; Epic #3 executable election and Epic #7 truthful report to cross M1. #48 only then enables M2 protected egress; full Persona/decision and independent tests into #8 and CAS-10 support M3.
• The decisive PR question: Which blocked E2E oracle/assertion becomes executable with this merged PR? Record: blocker before → code & committed RED/GREEN test → observable E2E assertion after → still blocked. No new generic platform/plugin/provider abstraction on the critical path. New design work only for proven cross-component incompatibility or security defect.
• Keep ≤2 active Implementation/Bug PRs (≤1 per [STAGE] C1-C2 / C2 / C3 joint implementation — two workstreams and gated Evidence Closure #43 workstream); merge independently reviewable bounded slices without waiting for broad feature perfection. Do not auto-merge/activate production or close Epics. P0/P1 block; scope-limited P2 has explicit affected invariant, reproduced test and disposition, not unbounded design expansion.
• Stage #43 is a foundation integration programme, not the full MAGI completion denominator. Existing progress 2/7 child Issues Closed, [IMPL] C1-C2B — Durable ReadSetJournal and controlled material admission/injection #44/[IMPL] C2 — Authenticated roots, delegation, AuthorityProof and scoped revocation #46 partial/OPEN, [IMPL] C3 — One durable conditional-commit order and independent audit witness #47–[INTEGRATION] Three-role trusted delivery and atomic EVIDENCE_CLOSED with sealed ReadSet #49 Open. Do not count PRs merged as full business-loop acceptance.

4. Acceptance engineering now, final statistics later

CAS-10 should plan/design the independent invariant → feature → test/fixture → real evidence/run → gate → verdict matrix, scenario runner and 24-family dataset generation interface now. Frozen AcceptanceManifest/confirmatory 4,800-round execution, model comparison and 23 claims remain NOT RUN until M1/M2 functional capabilities and pre-registration governance are independently ready; no post-hoc statistical threshold change. Epic #8 retains all original Rev4 exit conditions.

Baseline truth at creation: main=1585ae11ae66fbc32600e3aa12c13260eac2bd4c; main CI #40101137176 6/6 success; merged PR #50–#53 contribute offline/v1 authenticated/Journal disabled foundations, NOT real E2E success. No M1/M2/M3 has been run by writing this plan.