P0: propose event-loop and language benchmark contracts

[0thernet]

Scope

P0 language-contract fixtures and event-loop specification only: spec/v1/{README,event-loop}.md and benchmarks/language/**. The contract and synthetic fixture timings do not qualify measured performance, source provenance, a runtime, event-loop cross-runtime parity, or cumulative competence. P1/P2 remain gated until P0 integrates.

Reviewed proposal

Head 926c5795c11e0d91145c9385931534d9ce24e8b2, tree 0a7f9d2a7c6e30b3493d8ec64fd92b5a80497c01, base bc6ddae6e426b2727a3ce7e07158b248bae74309. The 28 changed paths are limited to the P0 scope above. This head repairs the previous content HOLD on db3f787f: a transition rejects a repeated state-field write with stable EVENT_LOOP_SEMANTIC at the second path; distinct fields may commit together. The new test and spec agree. Event source/sequence semantics remain agent-decided and owner-revisitable (see benchmarks/language/P0-EVENT-IDENTITY-DECISION.md); older repairs are in P0-REPAIR-EVIDENCE.md.

Independent AI content review on this exact head/tree on 2026-10-12 (XCB t_cc65185eda5a5c42d6792206f49d7057cccb8f84ab53594377664f4d6be225af, confirmed by t_64679d4067f6e2f81975a24c43aea63fc961eb80fa7b2fd20097634aa1e288bc and t_b517f2ab5375a1803e9ef65274b504163468dedf2de28a0523dee269e53e947f) is affirmative for delivery of the P0 proposal only, superseding the previous-head HOLD. This is not human approval or evidence of runtime parity.

Gates and limitations

Focused local bun test benchmarks/language passed (39 tests, 502 assertions); docs, site build, typecheck, lint, Cargo format and Clippy, native build and PR diff check passed in the independent review. Exact-head Check run 38206769860 passed Required on attempt 2, including the incumbent native and application parity gates. Its first Test (3/3) attempt failed SQLite IOERR_RDLOCK/BUSY; one diagnosed failed-job rerun passed. CI application parity compares existing runtimes, not this proposed event loop.

Local bun run check and application parity timed out at 600s with loopback restrictions; workspace Cargo tests failed in tests/http.rs locally, and default Cargo fetch had SSL -9808. These are not local passes; the same required gates completed in loopback-capable CI on the exact PR head. Synthetic timings and source digests are not performance or provenance results.

Delivery

The separately released delivery task rechecked the exact head/tree/base, all 28 paths, mergeability, review threads and gh pr checks 276 -R hraness/algal --required on 2026-10-12. No new blocker was found. Ready and enable normal squash auto-merge on this same PR; verify the merge SHA and post-merge main Required. Do not force-push, bypass checks, or claim P1/P2/event-loop runtime delivery. No release is requested.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
algal	Ready	Preview	Oct 12, 2026 5:10am UTC

[0thernet]

P0 selection handoff, not an integration approval (2026-10-10).

• agent-decided, owner may revisit: select the existing deferred independent P0 verification of this draft as the one bounded lane, not another implementation or PR. ALGAL integration owns spec/v1/{README,event-loop}.md and benchmarks/language/**; the verifier is independent and read-only. P0 has no prerequisite; no model calls.
• agent-decided, owner may revisit: use merged main bc6ddae6 and its green Required for shipped progress; use this PR's c5792e0a only for unmerged proposal evidence. docs/north-star.md (SHA-256 106588ea8a55a008298c66f3cded6fd5b9ea83251e43ec26fe55125e3eeb1059) controls phase gates; vision, lineage and AGENTS constrain claims. Open Add Goose as a design reference for compile-time bounds and verified storage #275 owns docs/north-star.md and docs/lineage.md; do not edit them here.
• agent-decided, owner may revisit: P0 requires the event-loop, actor/supervisor/habitat/revision vocabulary, benchmark result, identity and baseline protocol, no separate runtime, plus strict parsing, unknown-field rejection, limits on every count/byte field and >=1 valid/>=5 invalid fixtures. Synthetic smoke timing and incumbent parity are not measured performance or event-loop parity. Green PR-head Required is necessary but insufficient: prior independent review says DO NOT MERGE, broader coverage is unresolved. P1/P2 stay blocked. No file-boundary extension is needed for this read-only lane; a separately authorized P0 repair may include repo-owned gate-required manifests, indexes or fixtures, not Add Goose as a design reference for compile-time bounds and verified storage #275's files.

Validation commands for the verifier: git status --short --branch; bun test benchmarks/language/span.test.ts benchmarks/language/contract.test.ts; bun run docs:check; bun run typecheck; bun run lint; git diff HEAD --check; gh pr checks 276 --repo hraness/algal; gh run view 38088925642 --repo hraness/algal --json headSha,conclusion,jobs. Audit the exact-head CI receipts for bun run check, cargo test --workspace --locked, cargo clippy --workspace --all-targets --locked -- -D warnings, cargo fmt --all -- --check and bun scripts/application-parity.ts; do not convert local timeouts to passes.

Idempotency key: (P0-independent-verification-276, north-star:106588ea8a55a008298c66f3cded6fd5b9ea83251e43ec26fe55125e3eeb1059, corpus:7669ae5f5cf15a07818461051192f0074f4d4f68fe339c07d47e6b7c9fa8f586, contract:2bc86853449529b14edad150596062ba57938f2748a0a5a7133f75d8d5ffaf4b, tree:0c6ed64f5c9380b0611ce8abdf14d2f1dcd003e2, head:c5792e0a57e52d2e4ee534f882cf6065cbb67070). Success: independent positive recommendation on this exact tree with the P0 gate and PR-head Required evidenced; no integration in this lane. Failure: P0_CONTRACT_GATE_FAILED; one review attempt, no automatic retry of an uncertain effect; after an authorized repair/new SHA at most one new keyed verification. Keep the draft unmerged on failure.

[0thernet]

P0 selection handoff (not an independent approval or permission to merge).

• agent-decided, owner may revisit: select one lane, the existing deferred P0 contract repair on this draft PR (P0: propose event-loop and language benchmark contracts #276; XCB backlog t_5c3c461b381e6ab101627c202de07634e52845c171a7fd0f568c490202d37bcf), not a second PR or P1/P2. P0 has no prerequisite. No model/provider calls or new study.
• agent-decided, owner may revisit: judge shipped progress from merged main bc6ddae6 and its successful Required run 37726508198; this PR head c5792e0a has successful Required run 38088925642 but is unmerged and independently failed the P0 contract gate. One valid/ten invalid fixtures exist; smoke timings are synthetic, not performance, source provenance or event-loop parity.
• agent-decided, owner may revisit: read docs/north-star.md P0 exit literally: strict parsing, unknown-field rejection, bounds for every count/byte field and at least one valid/five invalid fixtures. Repair the documented 262,144-byte project-closure limit over actual source-file bytes (262,144/262,145 regression cases); make checkEventLoopBytes return a stable code and UTF-8 span for unknown limits.extra and out-of-range limits, rather than throw; complete the per-field edge matrix. Retain no-separate-runtime decision. The 64-byte ID README fix is local and uncommitted, so the PR CI does not cover it.
• agent-decided, owner may revisit: ALGAL integration owns spec/v1/{README,event-loop}.md and benchmarks/language/**. Extend only to repository-owned gate-required manifests, indexes, claim registries or fixtures if demonstrated necessary in a released P0 repair task; no such extension is needed yet. Open Add Goose as a design reference for compile-time bounds and verified storage #275 owns docs/north-star.md and docs/lineage.md; do not duplicate it. No files were modified by this inspection.

Idempotency key (P0-repair-276; input SHA-256 AGENTS=33aa2fb1ddb2d745b0a599c14c1a172c799dde763df8c11563b58c66545cd2a7, north-star=106588ea8a55a008298c66f3cded6fd5b9ea83251e43ec26fe55125e3eeb1059, vision=b66cd5c5b42aabf4a8da44675951f4c987e81b655aaf1a7f608138c5977d5117, lineage=1a4bc48ade7d9639a053176eac78f8eaef0fda420f6f64f5610af3e18556494a, README-dirty=a4dc44b8754d5f7c3d7adf57ee39bc49aa1601c61b84e276a14422d95d5097d7, event-loop=2bc86853449529b14edad150596062ba57938f2748a0a5a7133f75d8d5ffaf4b, corpus=7669ae5f5cf15a07818461051192f0074f4d4f68fe339c07d47e6b7c9fa8f586, contract=640a2be8864fe0a02c486576fd57bd699be23850ff0fd69787a1e0b77fa325c0; code HEAD=c5792e0a57e52d2e4ee534f882cf6065cbb67070/tree=0c6ed64f5c9380b0611ce8abdf14d2f1dcd003e2); recompute on changed inputs.

Validation after repair: bun test benchmarks/language/contract.test.ts benchmarks/language/span.test.ts; bun run docs:check; bun run typecheck; bun run lint; bun run check; cargo fmt --all -- --check; cargo test --workspace --locked; cargo clippy --workspace --all-targets --locked -- -D warnings; cargo build --locked; bun scripts/native-parity.ts; bun scripts/application-parity.ts; git diff HEAD --check; after separately authorized publication to the same draft PR, gh pr checks 276 --repo hraness/algal and gh run view <new-run-id> --repo hraness/algal --json headSha,conclusion,jobs. Local loopback/SSL failures and timeouts stay unresolved, never passes. Success: exact-head independent positive P0 review plus green Required on the repaired PR head, with all contract gates met; no merge in this lane. Failure: P0_CONTRACT_GATE_FAILED; at most one bounded repair attempt and one independent review per idempotency key, then a newly keyed revision or stop. No uncertain effect retries.

[0thernet]

P0 selection and local-partial-work handoff; not an integration approval.

• agent-decided, owner may revisit: select exactly one lane, existing deferred P0 architecture/benchmark-contract repair on this draft (P0: propose event-loop and language benchmark contracts #276), owned by ALGAL integration. P0 has no prerequisite; P1/P2 remain blocked. No model, provider or new study. Merged main bc6ddae6 / Required run 37726508198 is shipped progress; green PR-head Required 38088925642 at c5792e0a covers only the committed P0 proposal. The independent P0 review remains DO NOT MERGE / P0_CONTRACT_GATE_FAILED.
• agent-decided, owner may revisit: docs/north-star.md P0's strict parsing, unknown keys, bounds on every count/byte and >=1 valid/>=5 invalid fixtures are the acceptance gate; vision/lineage constrain performance and cumulative-skill claims. Required deliverables are event-loop/benchmark contracts, actor/supervisor/habitat/revision vocabulary, identity and baseline protocol, and no separate runtime. Synthetic smoke is not measured speed, provenance or event-loop parity.
• agent-decided, owner may revisit: scope stays spec/v1/{README,event-loop}.md and benchmarks/language/**, extending only to demonstrably gate-required repo-owned indexes/manifests/claim registries/fixtures if a released P0 repair needs them; no extension needed now. Open Add Goose as a design reference for compile-time bounds and verified storage #275 owns north-star/lineage docs; no duplication. No commit, push or merge in this inspection.
• agent-decided, owner may revisit: reconcile partial local effects from the failed advance before any edit/retry. The dirty README's 64-byte ID fix and untracked project-closure.ts, project-closure.test.ts, P0-REPAIR-EVIDENCE.md have NOT reached this PR. The helper tests 262144/262145 actual source bytes but is NOT called at parseProject/the fixture-reading boundary. Unknown limits.extra and several out-of-range fields can still throw instead of returning code plus UTF-8 span; the per-field edge matrix remains incomplete. Preserve partial work; never repeat an uncertain external effect. Fresh focused tests: 27/27, 272 assertions; bun run docs:check and git diff HEAD --check passed. These do not satisfy the gate.

Idempotency key: (P0-repair-276, input-hash-list sha256=e111e8117a3f10d11a7da3cfb24dc1f9dbdf8edc53d16f1715d47dc98c7e540b, HEAD=c5792e0a57e52d2e4ee534f882cf6065cbb67070, tree=0c6ed64f5c9380b0611ce8abdf14d2f1dcd003e2). Input-hash-list is the exact output of shasum -a 256 AGENTS.md docs/north-star.md docs/vision.md docs/lineage.md spec/v1/event-loop.md benchmarks/language/README.md benchmarks/language/corpus.json benchmarks/language/contract.test.ts benchmarks/language/span.ts benchmarks/language/project-closure.ts benchmarks/language/project-closure.test.ts | shasum -a 256 (current dirty inputs included); recompute after revision. The existing XCB deferred P0 item owns the full ordered-input list and replay instructions.

Exact post-repair commands: bun test benchmarks/language/contract.test.ts benchmarks/language/span.test.ts benchmarks/language/project-closure.test.ts; bun run docs:check; bun run typecheck; bun run lint; bun run check; cargo fmt --all -- --check; cargo test --workspace --locked; cargo clippy --workspace --all-targets --locked -- -D warnings; cargo build --locked; bun scripts/native-parity.ts; bun scripts/application-parity.ts; git diff HEAD --check; after separately authorized publication to the SAME draft: gh pr checks 276 --repo hraness/algal --required and gh run view <new-run-id> --repo hraness/algal --json headSha,conclusion,jobs; recheck merged-main Required after any authorized integration. Local timeouts/loopback errors remain unresolved, never passes. Success: repaired P0 contract gate, independent positive review and green Required on exact repaired PR head, without a merge in this lane. Failure: P0_CONTRACT_GATE_FAILED; at most ONE bounded repair and ONE independent review per new key, with no retry of uncertain effects.

[0thernet]

P0 handoff/selection only; NOT an independent approval or merge instruction.

• agent-decided, owner may revisit: select exactly ONE lane: independent, read-only verification of this EXISTING draft P0: propose event-loop and language benchmark contracts #276 at head 086d03673f4fd640a34f1af233dc9ced253d7b06 (XCB deferred t_5c3c461b381e6ab101627c202de07634e52845c171a7fd0f568c490202d37bcf). P0 has no prerequisite; P1/P2 are blocked until P0 freezes. ALGAL integration owns spec/v1/{README,event-loop}.md and benchmarks/language/**; verification does not edit them. No model/provider calls or new study.
• agent-decided, owner may revisit: use docs/north-star.md for phase/dependency/scorecard gates, docs/vision.md for mechanism/claim limits, docs/lineage.md for precedent, and AGENTS.md for workflow. Shipped progress is merged main bc6ddae6e426b2727a3ce7e07158b248bae74309 with successful Required run 37726508198; recent merges Specify Lisp-shaped ALGAL workbench direction #258/Present ALGAL's north-star vision, leading with Lisp #260/Restore frame protection on the owner-token local servers #274 do not land P0. This unmerged P0 proposal has successful exact-head Required run 38101840813, but the last independent review said DO NOT MERGE on an earlier unpublished repair; there is no new positive recommendation covering this published SHA. Keep draft, no auto-merge. Add Goose as a design reference for compile-time bounds and verified storage #275 owns north-star/lineage docs and has failing Required; do not duplicate its work. Other open PRs own dependency/formal-verification paths, not this P0 review.
• agent-decided, owner may revisit: read P0 acceptance literally: event-loop contract, actor/supervisor/habitat/revision vocabulary, benchmark-result contract, source-to-runtime identity, no-separate-runtime decision, baseline corpus/protocol; strictly reject unknown fields, bound every count/byte field, >=1 valid and >=5 invalid fixtures. Verify the 262144/262145 actual closure byte edge, malformed UTF-8/JSON and stable located UTF-8 diagnostic spans. One valid actor and ten invalid fixtures are synthetic contract evidence, not measured speed, source provenance, new-runtime parity or cumulative competence. A positive recommendation needs this gate AND exact-head CI evidence, not CI alone.
• agent-decided, owner may revisit: NO file-boundary extension in this read-only lane; any separately authorized P0 repair can extend only to demonstrably gate-required repo-owned manifests, indexes, claim registries and fixtures, never Add Goose as a design reference for compile-time bounds and verified storage #275's docs or credentials/CI release/provider/publication work.

Idempotency key (P0-independent-verification-276, ordered-input-sha256:76cf4a8e48b451edb9ad515654388f87939f8042ad6b0604ab23ff3bee817120, HEAD:086d03673f4fd640a34f1af233dc9ced253d7b06, tree:537c4f602f0bfa340323c5fb96ea4c5f5155e1b6). Ordered digest is shasum -a 256 AGENTS.md docs/north-star.md docs/vision.md docs/lineage.md spec/v1/README.md spec/v1/event-loop.md benchmarks/language/README.md benchmarks/language/corpus.json benchmarks/language/contract.test.ts benchmarks/language/project-closure.ts benchmarks/language/project-closure.test.ts benchmarks/language/span.ts benchmarks/language/span.test.ts benchmarks/language/P0-GATE-REVIEW.md benchmarks/language/P0-REPAIR-EVIDENCE.md | shasum -a 256; the Git tree pins all remaining PR files/fixtures. Recompute on any changed input or head.

Exact read-only validation/reconciliation commands: git status --short --branch; git rev-parse HEAD 'HEAD^{tree}'; git diff HEAD --check; bun test benchmarks/language/contract.test.ts benchmarks/language/span.test.ts benchmarks/language/project-closure.test.ts; bun run docs:check; bun run typecheck; bun run lint; gh pr checks 276 --repo hraness/algal --required; gh run view 38101840813 --repo hraness/algal --json headSha,conclusion,jobs. Independently audit the exact-head CI jobs for bun run check (Bun shards), cargo fmt --all -- --check, cargo test --workspace --locked, cargo clippy --workspace --all-targets --locked -- -D warnings, cargo build --locked, bun scripts/native-parity.ts and bun scripts/application-parity.ts; don't turn previous local loopback/SSL failures or timeouts into local passes. If code is later repaired under a separately authorized delivery step, rerun those commands and exact-NEW-head CI and get new independent verification.

Success: explicit independent positive P0 recommendation bound to this SHA/tree and green exact-head Required, without integration in this lane. Named failure: P0_CONTRACT_GATE_FAILED (including unresolved evidence): remain draft, P1/P2 blocked. Retry limit: ONE independent review per key, zero automatic retries for uncertain effects; after a separately authorized repair/new SHA, at most one new keyed review. No owner answer required.

[0thernet]

P0 selection handoff (not independent verification or merge approval). No files changed.

• agent-decided, owner may revisit: select exactly one lane, the existing deferred independent read-only P0 verification of draft P0: propose event-loop and language benchmark contracts #276, XCB t_4ee25d34b69dfae889a6176dd378ce0ef9a23b385d9f92c33aeafa0464bafc2d. P0 has no prerequisite; P1/P2 remain blocked. ALGAL integration owns spec/v1/{README,event-loop}.md and benchmarks/language/**; this verification edits nothing. A future authorized repair may extend to repo-owned manifests/indexes/claim registries/fixtures its own gate requires, but not Add Goose as a design reference for compile-time bounds and verified storage #275's north-star/lineage files. No model, provider, publication or new study.
• agent-decided, owner may revisit: use merged main bc6ddae6 / successful Required run 37726508198 to judge shipped progress; recent merged Specify Lisp-shaped ALGAL workbench direction #258/Present ALGAL's north-star vision, leading with Lisp #260/Restore frame protection on the owner-token local servers #274 did not ship P0. PR P0: propose event-loop and language benchmark contracts #276 remains OPEN/DRAFT, head 6d5e8849a12aac6e088ca63025b58891d9e20c31, tree 5b4e25d110006c22b8cb5227803e8e98184fff90, clean worktree and mergeable; exact-head CI 38105500321 passed Required and Bun/Cargo/parity jobs. No PR review threads. Previous independent HOLD on the unpublished two-file repair has not been superseded by an independent positive recommendation on this published tree; do not merge or enable auto-merge. Add Goose as a design reference for compile-time bounds and verified storage #275 owns docs and has failed Required; other open PRs do not own this verification.
• agent-decided, owner may revisit: docs/north-star.md controls P0 dependencies and exit: event-loop and benchmark-result contracts, actor/supervisor/habitat/revision vocabulary, source/runtime identity, no-separate-runtime decision, baseline corpus/protocol; strict parsing, unknown-key rejection, bounds for every count/byte field and >=1 valid/>=5 invalid fixtures. docs/vision.md limits mechanism/quality claims, docs/lineage.md is precedent, AGENTS.md supplies workflow. Path repair must reject Windows drive prefixes and control characters before closure file reads, with located/edge tests. Synthetic smoke is not measured performance, source provenance, new event-loop runtime parity or cumulative-skill evidence. Green incumbent parity alone cannot freeze P0.

Idempotency key: (P0-independent-verify-276, ordered-input-SHA256:9b0d996acad22cf789b966eea47942bcf4d7380db296546ee026545441af5c81, head:6d5e8849a12aac6e088ca63025b58891d9e20c31, tree:5b4e25d110006c22b8cb5227803e8e98184fff90). Ordered input hash is SHA-256 of the shasum -a 256 output for AGENTS.md docs/north-star.md docs/vision.md docs/lineage.md spec/v1/README.md spec/v1/event-loop.md benchmarks/language/README.md benchmarks/language/corpus.json benchmarks/language/contract.test.ts benchmarks/language/span.ts benchmarks/language/project-closure.ts benchmarks/language/project-closure.test.ts. Recompute if any input or head changes.

Exact verifier commands: git status --short --branch; git diff --name-status origin/main...HEAD; git diff origin/main...HEAD --check; bun test benchmarks/language; bun run docs:check; bun run typecheck; bun run lint; gh pr checks 276 --repo hraness/algal; gh run view 38105500321 --repo hraness/algal --json headSha,conclusion,jobs. Inspect the code and CI's exact-head Bun, Cargo and parity jobs; local full Bun/Cargo HTTP/application parity were blocked by loopback/timeouts and must not be called passing. This inspection's focused tests passed (30/30, 366 assertions), docs/typecheck/lint and diff whitespace passed. Success: independent positive P0 recommendation for the unchanged published tree and still-current green Required, then hand integration to delivery owner; this lane does not merge. Failure state: P0_CONTRACT_GATE_FAILED; one independent review attempt per key, no automatic retry of an uncertain effect; after a separately authorized repair/new SHA, at most one new keyed verification. Hold the draft on failure.

[0thernet]

P0 corpus-path handoff, 2026-10-11. Agent-decided, owner may revisit: reject Windows drive-prefixed (^[A-Za-z]:) and ASCII control-character (U+0000–U+001F, U+007F) corpus fixture paths before fixture reads, consistent with the project-closure path contract. This is the reversible, narrower cross-platform rule; accepting ambiguous local paths would weaken the shared refusal behavior. Add located regression cases for both shapes in benchmarks/language/contract.test.ts, keep the repair inside the existing P0 lane, and retain the reviewer finding as unresolved until implemented and independently reverified. The old exact-head green Required does not validate a future repair, nor prove event-loop runtime parity. This comment is a decision/handoff, not positive verification or merge permission: keep #276 draft and P1/P2 blocked pending fresh exact-head CI and independent positive review.

[0thernet]

P0 handoff / ONE lane selection, not a merge approval. No repository files changed.

• agent-decided, owner may revisit: select the held XCB backlog t_6e4516b3d637ed75be93860b301a483511e57217c747167960877f41e0b9d995: repair corpus fixture path validation in this existing draft P0: propose event-loop and language benchmark contracts #276; do not open another PR or start P1/P2. P0 has no prerequisite. ALGAL integration owns spec/v1/{README,event-loop}.md and benchmarks/language/**; this fix is inside benchmarks/language/**. Extend only to repository-owned manifests, indexes, claim registries or fixtures demonstrably required by its own gates. Add Goose as a design reference for compile-time bounds and verified storage #275 owns docs/north-star.md/docs/lineage.md, not this repair. No model/provider calls, external publication or new skill study.
• agent-decided, owner may revisit: merged main bc6ddae6 / Required run 37726508198 is shipped progress; recent Specify Lisp-shaped ALGAL workbench direction #258/Present ALGAL's north-star vision, leading with Lisp #260/Restore frame protection on the owner-token local servers #274 did not ship P0. This PR is open/draft at 6d5e8849a12aac6e088ca63025b58891d9e20c31 (tree 5b4e25d110006c22b8cb5227803e8e98184fff90), Required run 38105500321 green, but independent review on this same head says HOLD: contract.test.ts admits drive-prefixed and control-character corpus fixture paths before reads, unlike project-closure.ts. No review threads; no auto-merge. Local loopback/Cargo HTTP/application parity issues from the independent review are not passes. The path-rule judgment is separately recorded in issue comment 6105723730.
• agent-decided, owner may revisit: docs/north-star.md controls the P0 gate: event-loop and benchmark-result contracts, actor/supervisor/habitat/revision vocabulary, source-to-runtime identities, decision against a separate runtime, baseline corpus/protocol; strict unknown-key rejection, count/byte bounds, >=1 valid and >=5 invalid fixtures. docs/vision.md restricts mechanism/claim promotion and docs/lineage.md is precedent; AGENTS.md governs checks. Reject both path shapes before corpus file reads, with located refusal regression tests. The existing one valid/ten invalid fixtures and synthetic smoke are not measured speed, provenance, new-runtime parity or cumulative competence. Green Required alone does not freeze P0.

Idempotency key (P0-corpus-path-repair-PR276, input-sha256:ffec937cd88f12a3a754c8579970250633da47c3fa737ef7ce7f87ab2ee6b862, head:6d5e8849a12aac6e088ca63025b58891d9e20c31, tree:5b4e25d110006c22b8cb5227803e8e98184fff90). Input digest is SHA-256 of ordered lines path + NUL + hex SHA-256(file bytes at this head) + LF for AGENTS.md docs/north-star.md docs/vision.md docs/lineage.md spec/v1/README.md spec/v1/event-loop.md benchmarks/language/README.md benchmarks/language/corpus.json benchmarks/language/contract.test.ts benchmarks/language/span.ts benchmarks/language/project-closure.ts benchmarks/language/project-closure.test.ts. Recompute if any input/head changes; reconcile remote and worktree before editing.

Validation on repaired tree: bun test benchmarks/language; bun run docs:check; bun run build:site; bun run typecheck; bun run lint; bun run check; cargo fmt --all -- --check; cargo test --workspace --locked; cargo clippy --workspace --all-targets --locked -- -D warnings; cargo build --locked; bun scripts/native-parity.ts; bun scripts/process-parity.ts; bun scripts/store-parity.ts; bun scripts/cli-parity.ts; bun scripts/application-parity.ts; git diff --check bc6ddae6 <new-head> -- spec/v1 benchmarks/language. After authorized publication to this SAME PR: gh pr checks 276 -R hraness/algal --required; gh run list -R hraness/algal --commit <new-head> --workflow Check --limit 1 --json databaseId,headSha,conclusion; gh run view <run-id> -R hraness/algal --json headSha,conclusion,jobs. Bind run SHA to published head; report local environmental blockers, never convert them to passes.

Success: repaired P0 contract passes its exit gate with fresh exact-head Required and independent positive verification; integration is separate. Failure state P0_CONTRACT_GATE_FAILED: keep draft/unmerged and P1/P2 blocked. Limit: one bounded repair and one independent verification per idempotency key; no automatic retry of uncertain publication or effects.

[0thernet]

P0 selection handoff, not an independent review or merge approval. Agent-decided, owner may revisit for every judgment here:

• Select exactly one existing, deferred lane: independent read-only verification of this draft PR P0: propose event-loop and language benchmark contracts #276 on repaired head e0942fb69cba1553fd30ff72edaafac4aca53e52 (XCB follow-up t_6e4516b3d637ed75be93860b301a483511e57217c747167960877f41e0b9d995). Reconcile local/remote identity first; no new PR, model/provider calls or cumulative-skill study. P0 has no prerequisite; P1/P2 cannot begin before its gate freezes.
• Use docs/north-star.md for phases/scorecard and the literal P0 gate, docs/vision.md for new-mechanism and capability-claim limits, docs/lineage.md for precedent, and AGENTS.md for scope/delivery. Merged main bc6ddae6 and its passing Required run 37726508198 are shipped progress; recent merges Present ALGAL's north-star vision, leading with Lisp #260/Restore frame protection on the owner-token local servers #274 and dependency work did not complete P0. This PR is still open/draft, with passing exact-head Required run 38124269362, but has no positive independent review of the repaired head. Prior independent HOLD is not cancelled by green CI. Other open PRs have no review threads; Add Goose as a design reference for compile-time bounds and verified storage #275 owns north-star/lineage docs and has failing Required. Keep P0: propose event-loop and language benchmark contracts #276 draft/unmerged without auto-merge pending verification.
• ALGAL integration owns spec/v1/{README,event-loop}.md and benchmarks/language/**; the selected verifier changes no files. No boundary extension is needed; any separately authorized repair may touch only repo-owned files its own P0 gates demonstrably require (manifest/index/claim registry/fixture), not Add Goose as a design reference for compile-time bounds and verified storage #275's docs. Treat the no-separate-runtime, located diagnostic and limit-attribution choices as reversible agent decisions, not owner-gated waits.
• P0 acceptance: event-loop contract; actor/supervisor/habitat/revision vocabulary; benchmark-result contract, source-to-runtime identity, no-separate-runtime decision, baseline corpus/protocol; strict parsing, unknown-field refusal and bounds on each count/byte field with >=1 valid and >=5 invalid fixtures. Inspect repaired C0/C1 and drive-prefix rejection before fixture reads, shared project-closure path rule, located UTF-8 spans, 262144/262145 closure edge, malformed input and raw byte limits. One valid actor and ten invalid fixtures are contract evidence only. Synthetic smoke, incumbent parity and replay receipts do not prove measured speed, proposed-runtime parity, external truth or cumulative competence.

Idempotency key: (P0-independent-verify-PR276, ordered-input-sha256:d937e539e8a4f0560612ed37f5cf53ed2e3fb99c6f375e5c964a4e042ecee949, HEAD:e0942fb69cba1553fd30ff72edaafac4aca53e52, tree:0715596df3dad12fd8fab1c366b3a3d5b6f783b4). Digest is SHA-256 of ordered /usr/bin/shasum -a 256 output for AGENTS.md docs/north-star.md docs/vision.md docs/lineage.md spec/v1/README.md spec/v1/event-loop.md benchmarks/language/README.md benchmarks/language/corpus.json benchmarks/language/contract.test.ts benchmarks/language/span.ts benchmarks/language/span.test.ts benchmarks/language/project-closure.ts benchmarks/language/project-closure.test.ts benchmarks/language/P0-GATE-REVIEW.md benchmarks/language/P0-REPAIR-EVIDENCE.md; tree pins remaining fixtures. Recompute after input/head change.

Exact read-only validation: git status --short --branch; git rev-parse HEAD 'HEAD^{tree}'; git diff origin/main...HEAD --check; bun test benchmarks/language; bun run docs:check; bun run typecheck; bun run lint; gh pr checks 276 --repo hraness/algal --required; gh run view 38124269362 --repo hraness/algal --json headSha,conclusion,jobs. Audit the exact-head CI Bun shards, Cargo tests/clippy/fmt/build and incumbent parity jobs; local full bun run check (loopback EADDRINUSE), Cargo HTTP (EPERM/SSL fetch) and application parity (timeout) remain unresolved local results, never local passes. This inspection ran the 32 focused language tests (386 assertions) and diff check, both passed; no independent verdict was produced.

Success: explicit independent positive P0 recommendation for the unchanged SHA/tree plus still-green exact-head Required; then separately reconcile delivery on this existing PR under AGENTS. Failure P0_CONTRACT_GATE_FAILED: keep draft/unmerged, record concrete findings and block P1/P2. One read-only review attempt per key; after a separately authorized repair/new SHA, at most one newly keyed verification. Zero automatic retries of uncertain effects; no owner answer required.

[0thernet]

Independent, read-only P0 verification of published head e0942fb69cba1553fd30ff72edaafac4aca53e52 (tree 0715596df3dad12fd8fab1c366b3a3d5b6f783b4, ordered input SHA-256 d937e539e8a4f0560612ed37f5cf53ed2e3fb99c6f375e5c964a4e042ecee949). I did not author the repair or change the tree. Agent-decided, owner may revisit: recommend integrating this exact P0 contract proposal, contingent on rechecking that this head remains current and Required stays green; no opinion on future heads or P1/P2.

The P0 exit is met for this proposed contract: spec/v1/event-loop.md and benchmarks/language/README.md state actor/supervisor/habitat/revision, identity, bounded result/corpus protocol and no separate runtime; fixture parsers reject unknown fields, bound counts and bytes, and check one valid actor plus ten pinned invalid fixtures. In the repaired code, corpus fixture and event paths call the shared project-closure path rule during whole-corpus parsing before any fixture read. That rule rejects drive prefixes and C0/C1 controls (including U+0080, U+0085, U+009F); project closure uses the same rule before reading its files. Focused regressions confirm pre-read/located refusal, UTF-8 spans, malformed input, 16,384/16,385 fixture bytes and 262,144/262,145 closure bytes. An additional read-only probe on this head rejected U+0000, U+001F, U+007F, U+0080, U+0085 and U+009F, while accepting a normal path.

Fresh local evidence on this unchanged tree: bun test benchmarks/language 32 passed/386 assertions; bun run docs:check, bun run typecheck, bun run lint, and git diff origin/main...HEAD --check passed; worktree clean. Exact-head CI run 38124269362 passed Required, Bun shards, Linux/macOS Cargo test/clippy (Linux fmt/build), application parity and incumbent native parity. Local full bun run check, Cargo HTTP and application parity remain previously reported environment failures/timeouts, not local passes. The synthetic smoke timings, incumbent parity and receipts are not measured new-runtime speed, event-loop parity, external truth, or cumulative-skill evidence. This review changes no files, PR draft state, or merge setting. The existing delivery follow-up must reconcile the head, CI and any later blocker before applying the AGENTS workflow; on a changed head this recommendation expires. Failure state on a changed or red head: P0_CONTRACT_GATE_FAILED; one review attempt for this key, no uncertain-effect retry.

[0thernet]

P0 lane selection / handoff, not review approval or permission to merge. No repository files edited.

• agent-decided, owner may revisit: select exactly ONE bounded lane: existing XCB deferred repair t_2ea9a62f9880107b260291864889a584b7c107f2388ad8c7442cdf0ff9890dce, on this SAME draft PR P0: propose event-loop and language benchmark contracts #276. P0 has no prerequisite; P1/P2 wait for its contract exit. No paid/live models, provider/Gateway calls, new skill study or external publication.
• agent-decided, owner may revisit: measure shipped progress from main bc6ddae6 and passing Required run 37726508198; recent merged Specify Lisp-shaped ALGAL workbench direction #258/Present ALGAL's north-star vision, leading with Lisp #260/Restore frame protection on the owner-token local servers #274 did not deliver P0. This PR at e0942fb6 has green exact-head Required run 38124269362 but remains open/draft/unmerged; the subsequent independently observed unpaired-surrogate/UTF-8 alias supersedes the earlier positive review. Hold merge and auto-merge. Open Add Goose as a design reference for compile-time bounds and verified storage #275 owns north-star/lineage docs and has red Required; dependency/formal-verification PRs own their separate paths. No open review threads were found.
• agent-decided, owner may revisit: apply docs/north-star.md P0 literally: versioned event-loop and benchmark contracts, actor/supervisor/habitat/revision vocabulary, source/runtime identities, baseline corpus and protocol, no separate runtime; strict unknown-field rejection, every count/byte bounded, >=1 valid and >=5 invalid fixtures. Vision/lineage prohibit treating synthetic smoke or incumbent parity as demonstrated event-loop runtime, performance or cumulative skill. For this repair reject unpaired high/low UTF-16 surrogates before fixture reads in the shared path rule; permit valid paired Unicode, avoid double counting UTF-8-aliasing files, and cover corpus path, actor eventPath, project entry/files[].path with located negative cases plus positive paired-surrogate and 512-byte boundary cases. ALGAL integration owns spec/v1/{README,event-loop}.md and benchmarks/language/**; this fix stays in benchmarks/language/**. Extend only to repo-owned gate-required manifest/index/claim/fixture files if demonstrated necessary, never duplicate Add Goose as a design reference for compile-time bounds and verified storage #275.
• agent-decided, owner may revisit: idempotency key (P0-surrogate-path-repair-276; sha256 AGENTS=33aa2fb1ddb2d745b0a599c14c1a172c799dde763df8c11563b58c66545cd2a7, north-star=106588ea8a55a008298c66f3cded6fd5b9ea83251e43ec26fe55125e3eeb1059, vision=b66cd5c5b42aabf4a8da44675951f4c987e81b655aaf1a7f608138c5977d5117, lineage=1a4bc48ade7d9639a053176eac78f8eaef0fda420f6f64f5610af3e18556494a; PR-input Git blobs project-closure.ts=88b6dcf5756820101e8751c8ffcd646687296c43, corpus.json=ec2b7e99f012f9a73da19b4a8cd55f66bf80b4b6; code head=e0942fb69cba1553fd30ff72edaafac4aca53e52/tree=0715596df3dad12fd8fab1c366b3a3d5b6f783b4). Re-key on changed inputs.
• agent-decided, owner may revisit: validation on repaired checkout: BUN_INSTALL_CACHE_DIR=$PWD/.cache/bun bun install --frozen-lockfile; bun test benchmarks/language; bun run typecheck; bun run lint; bun run docs:check; bun run build:site; bun run check; git diff --check. If the shared TS/Rust contract changes, additionally cargo fmt --all -- --check, cargo test --workspace --locked, cargo clippy --workspace --all-targets --locked -- -D warnings, cargo build --locked, bun scripts/native-parity.ts, bun scripts/application-parity.ts. After a separately authorized update to this draft: gh pr checks 276 --repo hraness/algal and gh run view <new-run-id> --repo hraness/algal --json headSha,conclusion,jobs; get independent review of that exact new head. Preserve local loopback/SSL/timeouts as unresolved, not passes.

Success: repaired P0 gate with fresh exact-head Required and independent positive review; this repair lane does NOT merge. Failure P0_SURROGATE_PATH_GATE_FAILED: at most one bounded repair attempt and one independent verification per key; no automatic retry of uncertain writes. Keep PR draft/unmerged on failure, re-key only after reconciled new inputs. Delivery backlog t_6e4516b3d637ed75be93860b301a483511e57217c747167960877f41e0b9d995 stays held until then.

[0thernet]

P0 handoff delta to the existing lane decision; not independent approval, a new PR, or permission to merge. No files modified by this inspection.

• agent-decided, owner may revisit: keep exactly one lane, the held P0 surrogate-path contract repair on this draft (P0: propose event-loop and language benchmark contracts #276; XCB t_2ea9a62f9880107b260291864889a584b7c107f2388ad8c7442cdf0ff9890dce). Main bc6ddae6 has green Required run 37726508198 but no P0 artifacts; PR head e0942fb6 has green Required run 38124269362 only for the old, adversarially rejected head. P1/P2 wait. P8 docs: start P8 consumer inspection queue #277 remains draft with incomplete consumer evidence; Add Goose as a design reference for compile-time bounds and verified storage #275 owns north-star/lineage docs and has red Required. No open review threads on these PRs.
• agent-decided, owner may revisit: reconcile the local partial effect before any new work. codex/p0-surrogate-guard-20261011 is based on main and has 23 intent-to-add paths under benchmarks/language/**. Against P0: propose event-loop and language benchmark contracts #276 it differs in exactly four benchmark files (P0-REPAIR-EVIDENCE.md, contract.test.ts, project-closure.test.ts, project-closure.ts); it LACKS the PR's spec/v1/README.md and spec/v1/event-loop.md. Transfer only the four-file correction to the existing PR branch, preserving both spec files. Do not merge the main-based local tree as-is. If a P0 gate demonstrably requires another repo-owned manifest, index, claim registry or fixture, extend only to that file without duplicating Add Goose as a design reference for compile-time bounds and verified storage #275.
• agent-decided, owner may revisit: key (P0-surrogate-path-repair-276; sha256 ordered AGENTS.md/docs/{north-star,vision,lineage}.md hash-list=4f1f6251375d1526d287ac0dc6076af7c1c075df1422234c571cb66ff7e62367; sha256 git diff --binary e0942fb6 -- benchmarks/language=2d9f931535c442904818f13a18c164b39a264101d92a0e2aadcc18e354bcd3c9; PR code=e0942fb69cba1553fd30ff72edaafac4aca53e52; local base=bc6ddae6e426b2727a3ce7e07158b248bae74309). Re-key after input/head changes. The previous handoff names the P0 exit criteria and validation commands. Fresh local-only bun test benchmarks/language/contract.test.ts benchmarks/language/span.test.ts benchmarks/language/project-closure.test.ts passed 33 tests/461 assertions; git diff HEAD --check passed. The aggregate local bun run check timeout and loopback EADDRINUSE remain unresolved. Success requires a combined P0 tree meeting strict bounds/unknown-field and >=1 valid/>=5 invalid fixture gates, new exact-head Required, and independent positive review. Failure P0_SURROGATE_PATH_GATE_FAILED: one bounded transfer/verification attempt per key; zero automatic retries of uncertain writes, and keep the PR draft/unmerged until reconciled.

[0thernet]

P0 selection/handoff only; not a positive review or merge instruction. No repository files changed.

• agent-decided, owner may revisit: use merged main bc6ddae (Required run 37726508198 passed) for shipped progress. Draft P0: propose event-loop and language benchmark contracts #276 is unmerged at 023797a4c122b809b3a9ef817b8fde617cba4c99, exact-head Required run 38148556349 passed on attempt 2; this is proposal evidence, not a P0 freeze. Add Goose as a design reference for compile-time bounds and verified storage #275 owns north-star/lineage docs; docs: start P8 consumer inspection queue #277 owns its P8 queue; neither is a reason to duplicate those edits. Their status and other open PRs do not unblock P1/P2.
• agent-decided, owner may revisit: select exactly ONE bounded lane, existing deferred independent P0 contract review t_2ea9a62f9880107b260291864889a584b7c107f2388ad8c7442cdf0ff9890dce of this repaired exact head. P0 has no prerequisite and needs no model/provider calls. ALGAL integration owns benchmarks/language/** and spec/v1/{README,event-loop}.md; this reviewer edits no files, needs no boundary extension, opens no new PR, and does not merge. The older review predates the surrogate-path repair, so it cannot clear the HOLD. The delivery task remains separate.
• agent-decided, owner may revisit: apply docs/north-star.md P0 gate literally: event-loop/actor/supervisor/habitat/revision vocabulary, benchmark result and baseline protocol, source/runtime identity, no separate runtime; strict parsers reject unknown fields, bound every count/byte field, with >=1 valid and >=5 invalid fixtures. Treat the smoke result and incumbent parity as synthetic/old-runtime evidence, not measured speed, source provenance, event-loop parity or cumulative-skill proof. Local focused language tests passed 34/34, 470 assertions; the prior full local Bun timeout and Cargo fetch/loopback failures are NOT passes. CI green does not substitute for independent contract review.

Idempotency key: (P0-independent-review-276, ordered-input-sha256=dbb2b220eee0a8698038b6b4414f09ebdae46969734ffdbcb48a2b88034bc269, code-revision=023797a4c122b809b3a9ef817b8fde617cba4c99/tree=cd9971aa7fd50dfc0fb7a85e3755d095d72f142a). The input digest is SHA-256 of the shasum -a 256 listing, in this order: AGENTS.md docs/north-star.md docs/vision.md docs/lineage.md spec/v1/event-loop.md spec/v1/README.md benchmarks/language/README.md benchmarks/language/corpus.json benchmarks/language/contract.test.ts benchmarks/language/project-closure.ts benchmarks/language/project-closure.test.ts benchmarks/language/span.ts benchmarks/language/P0-REPAIR-EVIDENCE.md. Principal source hashes: north-star 106588ea8a55a008298c66f3cded6fd5b9ea83251e43ec26fe55125e3eeb1059, corpus 7669ae5f5cf15a07818461051192f0074f4d4f68fe339c07d47e6b7c9fa8f586, event-loop spec 2bc86853449529b14edad150596062ba57938f2748a0a5a7133f75d8d5ffaf4b.

Validation for the released reviewer: git status --short --branch; bun test benchmarks/language/contract.test.ts benchmarks/language/span.test.ts benchmarks/language/project-closure.test.ts; bun run docs:check; bun run build:site; bun run typecheck; bun run lint; bun run check; cargo fmt --all -- --check; cargo test --workspace --locked; cargo clippy --workspace --all-targets --locked -- -D warnings; cargo build --locked; bun scripts/native-parity.ts; bun scripts/application-parity.ts; git diff HEAD --check; gh pr checks 276 --repo hraness/algal --required; gh run view 38148556349 --repo hraness/algal --json headSha,conclusion,jobs; inspect PR review threads and source/fixture bounds. Attribute host-only loopback/SSL/timeouts rather than counting them as passes.

Success: independent positive P0 gate review and explicit merge recommendation for this exact head with passing exact-head Required; delivery is separate. Failure: P0_CONTRACT_GATE_FAILED, leave draft/unmerged and P1/P2 blocked. Retry limit: one independent attempt per keyed tree; after a diagnosed repair/new SHA, at most one newly keyed review, never automatically retry uncertain external effects.

[0thernet]

Inspection/decision handoff only; no file change, new PR, review approval, or merge. Agent-decided, owner may revisit for each choice below.

• Judge shipped progress from merged main bc6ddae6e426b2727a3ce7e07158b248bae74309 (Required run 37726508198 successful), not the calendar or draft work. Recent merged Specify Lisp-shaped ALGAL workbench direction #258/Present ALGAL's north-star vision, leading with Lisp #260/Restore frame protection on the owner-token local servers #274 and dependency/security work did not ship P0. P0: propose event-loop and language benchmark contracts #276 is still OPEN/DRAFT/MERGEABLE at 023797a4c122b809b3a9ef817b8fde617cba4c99, tree cd9971aa7fd50dfc0fb7a85e3755d095d72f142a; exact-head Required run 38148556349 succeeded on attempt 2, including CI Application parity. No review threads. Its independent P0 contract review is positive, but the recorded local application parity diverged twice and later timed out after a rebuild; bun run check timed out on loopback and Cargo workspace tests were locally blocked. Green CI and focused P0 tests do not erase those unresolved outcomes. docs: start P8 consumer inspection queue #277 owns the incomplete P8 audit; Add Goose as a design reference for compile-time bounds and verified storage #275 owns north-star/lineage edits with red Required. No duplicate lane or new PR.
• Select exactly ONE existing deferred lane: P0 integration/delivery reconciliation of this same P0: propose event-loop and language benchmark contracts #276, XCB t_6e4516b3d637ed75be93860b301a483511e57217c747167960877f41e0b9d995. P0 has no prerequisite; P1/P2 remain gated until P0 integrates. ALGAL integration owns spec/v1/{README,event-loop}.md and benchmarks/language/** (including its corpus, parsers and fixtures). If its own gates demand changes to a repo-owned manifest, claim registry or fixture, integration may extend that boundary only with evidence and without taking Add Goose as a design reference for compile-time bounds and verified storage #275/docs: start P8 consumer inspection queue #277 work. This is an agent scope decision, not an owner-gated hold. No paid/live model, provider, external publication, credential change or new cumulative-skill study.
• Use docs/north-star.md for the phase graph, scorecard and P0 gate; docs/vision.md for new-mechanism selection and claims, docs/lineage.md for precedent, AGENTS.md for workflow. P0 acceptance: algal.event-loop.v1 and benchmark-result contracts, actor/supervisor/habitat/revision vocabulary, source-to-runtime identities, no separate runtime decision, baseline corpus/protocol, strict parsing and unknown-key refusal, bounded count/byte fields, >=1 valid and >=5 invalid fixtures. Existing synthetic baseline is not measured performance, new-runtime parity, external truth or cumulative-skill evidence.

Idempotency key (P0-PR276-delivery-reconcile, ordered-input-SHA256:ee2e90e7fbac97c2884ffcddd9879a71a1b6a86aedf490d4455555f0cef80415, revision:023797a4c122b809b3a9ef817b8fde617cba4c99, tree:cd9971aa7fd50dfc0fb7a85e3755d095d72f142a). Hash input: lexicographically sorted 34 repo files: AGENTS.md, docs/{north-star,vision,lineage}.md, spec/v1/{README,event-loop}.md, all regular files under benchmarks/language/**, scripts/application-parity.ts, package.json, bun.lock, Cargo.toml, Cargo.lock. For each path concatenate UTF-8 path + NUL + lowercase SHA-256(file bytes) + LF, then SHA-256 the concatenation. Recompute on changed input/head and reconcile the remote before effects.

Exact validation in a loopback-capable environment, one owner per expensive command: git status --short --branch; git rev-parse HEAD 'HEAD^{tree}'; git diff origin/main...HEAD --check; bun test benchmarks/language; bun run docs:check; bun run build:site; bun run typecheck; bun run lint; bun scripts/application-parity.ts (after CARGO_NET_GIT_FETCH_WITH_CLI=true cargo build --locked -p algal --bin algal); bun run check; CARGO_NET_GIT_FETCH_WITH_CLI=true cargo test --workspace --locked; cargo fmt --all -- --check; CARGO_NET_GIT_FETCH_WITH_CLI=true cargo clippy --workspace --all-targets --locked -- -D warnings; gh pr checks 276 -R hraness/algal --required; gh run view 38148556349 -R hraness/algal --json headSha,conclusion,jobs. If head changes, use its fresh exact-head run, not 38148556349. No local blocked/timeout check is a pass.

Success condition: reconcile the local parity discrepancy with exact-head CI; complete applicable aggregate/native checks or explain environment-specific failures with independent evidence; obtain a fresh integration recommendation explicitly supporting merge, then the delivery owner can recheck head/Required/threads/mergeability and deliver via existing #276 only. Failure state P0_LOCAL_PARITY_UNRECONCILED: keep draft/unmerged, P1/P2 blocked, record reproducer and environment. Retry limit: one bounded validation/reconciliation attempt per key; no automatic retry of a timed-out or uncertain external effect; after documented reconciliation or new SHA, at most one new keyed attempt. Decisions and hold are reversible by the owner, not waiting for owner input.

[0thernet]

P0 selection/handoff amendment on exact head 023797a4c122b809b3a9ef817b8fde617cba4c99, tree cd9971aa7fd50dfc0fb7a85e3755d095d72f142a; this is not a merge, approval, file change or claim that local parity passed.

Agent-decided, owner may revisit: Per AGENTS.md, use the exact-head Required check (run 38148556349, attempt 2), independent positive P0 contract review, and fresh tree/PR inspection for artifact admission. Local EADDRINUSE/port-0 and Cargo libgit2 SSL failures are host limitations, not proof of a P0 defect or universal merge prerequisites. The two local application-parity query-status mismatches and later timeout remain recorded as not passing locally. They involve application code unchanged by this P0-only diff; the exact-head clean CI passed application parity (268 steps) and Cargo tests. The existing P0 delivery owner should make one bounded check of local binary/toolchain/loopback identity: a reproducible discrepancy with matched artifacts is a hold; an environment-only discrepancy can be disclosed while CI serves as gate. Do not waive a red exact-head Required or make synthetic-performance/cumulative-competence claims.

Agent-decided, owner may revisit: select only the existing deferred P0 #276 delivery task t_6e4516b3d637ed75be93860b301a483511e57217c747167960877f41e0b9d995 (backlog rev 8); it now carries this clarification, exact validation, input hash, success/failure and retry rule. No owner reply is required for a routine AGENTS.md judgment. This inspect-only selector makes no PR state change; the separately released delivery worker must independently check head, Required, review threads, authority and an explicit fresh integration recommendation before any ready/auto-merge action. P1/P2 remain gated until #276 is actually integrated.

[0thernet]

P0 selection and reconciliation handoff, not an integration approval. No repository files changed.

• Agent-decided, owner may revisit: judge progress by merged main bc6ddae6e426b2727a3ce7e07158b248bae74309 and successful Required run 37726508198, not elapsed time or draft proposals. Recent Specify Lisp-shaped ALGAL workbench direction #258/Present ALGAL's north-star vision, leading with Lisp #260/Restore frame protection on the owner-token local servers #274 and security/dependency merges did not integrate P0. This P0: propose event-loop and language benchmark contracts #276 remains draft at db3f787fac813322d4f1ecd6da2a246c45c01bd6, tree 7dac546b6aaf451d44875b00ef1b121d3ddeea0e; exact-head Required run 38189675641 passes, including Ubuntu application parity. There are no review threads. docs: start P8 consumer inspection queue #277 separately owns unfinished P8; Add Goose as a design reference for compile-time bounds and verified storage #275 owns north-star/lineage edits and has red Required. No duplicate PR or new lane.
• Agent-decided, owner may revisit: select exactly one bounded lane, the existing deferred P0 delivery/reconciliation of P0: propose event-loop and language benchmark contracts #276 (XCB t_6e4516b3d637ed75be93860b301a483511e57217c747167960877f41e0b9d995). P0 has no prerequisite; P1/P2 stay gated until integration. ALGAL integration owns spec/v1/{README,event-loop}.md and benchmarks/language/**; extend only to demonstrably gate-required repository-owned manifests, claim registries, indexes or fixtures, not Add Goose as a design reference for compile-time bounds and verified storage #275/docs: start P8 consumer inspection queue #277 files. This inspect task edits no files and does not merge. No model/provider calls, credentials, publication or new skill study.
• Agent-decided, owner may revisit: apply docs/north-star.md P0 literally: event-loop and benchmark-result contracts, actor/supervisor/habitat/revision vocabulary, source-to-runtime identity, no-separate-runtime decision, baseline corpus/protocol; strict parsing, refusal of unknown fields, bounds on every count/byte field, at least one valid and five invalid fixtures. Current one valid/ten invalid fixtures and passing focused tests are synthetic contract evidence, not measured speed, source provenance, cross-runtime event-loop parity or cumulative competence (docs/vision.md; precedents in docs/lineage.md). Independent review covers only older 023797a4; local application parity mismatches on that head and the 600-second timeout after the matching rebuild at this head are NOT passes. Reconcile with independent exact-tree content review and one bounded diagnostic on a matched, loopback-capable environment; classify a proven host-only limitation explicitly, or hold and repair if matched artifacts reproduce divergence. Never blindly rerun the timed-out same key.

Idempotency key (P0-PR276-delivery-reconcile; input SHA-256 north-star=106588ea8a55a008298c66f3cded6fd5b9ea83251e43ec26fe55125e3eeb1059, vision=b66cd5c5b42aabf4a8da44675951f4c987e81b655aaf1a7f608138c5977d5117, lineage=1a4bc48ade7d9639a053176eac78f8eaef0fda420f6f64f5610af3e18556494a, AGENTS=33aa2fb1ddb2d745b0a599c14c1a172c799dde763df8c11563b58c66545cd2a7, event-loop-spec=1993733ace5ea20c504981577ae740894f263070a5e8c6c42b1bce08414ca7c4, corpus-file=7669ae5f5cf15a07818461051192f0074f4d4f68fe339c07d47e6b7c9fa8f586, canonical-corpus=955bfd3eae801f566d464d0225487afad85c5665b1c2f953bf8b70b9cb4035cf; code HEAD=db3f787fac813322d4f1ecd6da2a246c45c01bd6/tree=7dac546b6aaf451d44875b00ef1b121d3ddeea0e); rekey on changed inputs or head.

Exact validation: git status --short --branch; git diff origin/main...HEAD --check; bun test benchmarks/language; bun run docs:check; bun run build:site; bun run typecheck; bun run lint; in a matched environment after CARGO_NET_GIT_FETCH_WITH_CLI=true cargo build --locked -p algal --bin algal, only when diagnostic preconditions change, bun scripts/application-parity.ts; repository aggregate bun run check, CARGO_NET_GIT_FETCH_WITH_CLI=true cargo test --workspace --locked, cargo fmt --all -- --check, CARGO_NET_GIT_FETCH_WITH_CLI=true cargo clippy --workspace --all-targets --locked -- -D warnings; gh pr checks 276 -R hraness/algal --required; gh run view 38189675641 -R hraness/algal --json headSha,conclusion,jobs (replace run ID on new head). One owner per expensive command; do not count socket, SSL or timeout errors as local passes.

Success: exact-head independent positive P0 review, parity disposition with evidence, fresh explicit integration recommendation and green exact-head Required; only a separately released delivery task may ready/auto-merge this same PR after rechecking head, scope, threads, mergeability and main. Failure P0_LOCAL_PARITY_UNRECONCILED or P0_CONTRACT_GATE_FAILED: keep draft, P1/P2 gated, preserve diagnostic and input identities. Retry limit: zero blind repeats of the timed-out parity at this key; at most one bounded diagnostic and one independent review per newly keyed environment/revision; never automatically retry an uncertain external effect.

[0thernet]

P0 selection/handoff correction, not approval to merge. No files changed. The previous inspection comment said independent review covered only an older head. Correction: an independent content reviewer DID inspect exact db3f787fac813322d4f1ecd6da2a246c45c01bd6, found no new blocking defect in the inspected contract paths, but explicitly recommended DO NOT MERGE pending aggregate/local-parity reconciliation. The PR body now records that hold. Exact-head Required 38189675641 is green (including Ubuntu application parity); local matched diagnostic timed out after 88 matching steps, and loopback binds fail EPERM in this executor. These are not local passes. No review threads exist.

Agent-decided, owner may revisit: select exactly one already-held lane: P0 delivery/reconciliation of this SAME draft PR #276, XCB t_6e4516b3d637ed75be93860b301a483511e57217c747167960877f41e0b9d995. P0 has no prerequisites; P1/P2 remain gated. ALGAL integration owns spec/v1/{README,event-loop}.md and benchmarks/language/** (extend only to repository-owned manifest/index/claim/fixture files demonstrably needed for P0's own gate). #277 owns unfinished P8 and #275 owns north-star/lineage edits, so do not overlap either. Merged main bc6ddae6e426b2727a3ce7e07158b248bae74309 passed Required 37726508198, but the recent merges did not deliver P0. This choice uses docs/north-star.md for the phase/gate and scorecard, docs/vision.md for truth/selection boundaries, docs/lineage.md for precedent, and AGENTS.md for checks/delivery. Do not start new implementation, models, providers, external publication or a v9 study.

Agent-decided, owner may revisit: P0 acceptance is a versioned event-loop and benchmark-result contract, actor/supervisor/habitat/revision vocabulary, source-to-runtime identities, no-separate-runtime decision and pinned baseline corpus/protocol; strict unknown-field refusal, bounds on every count/byte field, >=1 valid and >=5 invalid fixtures. One valid/ten invalid plus synthetic timings are contract evidence, not measured event-loop performance/parity or cumulative competence. Independent integration recommendation must explicitly disposition exact-head CI versus host-restricted local aggregate/parity and earlier old-head mismatch before readying this PR. A matched loopback-capable completed parity run is an alternative, not a blind repeat; fix a reproduced defect inside P0.

Idempotency key (P0-PR276-delivery-reconcile, ordered-input-SHA256:d6e56a685776163adbe5117a33217dbba9c3fda520040a5f1ffa1d6fd302f22f, HEAD:db3f787fac813322d4f1ecd6da2a246c45c01bd6, tree:7dac546b6aaf451d44875b00ef1b121d3ddeea0e, CI:38189675641). Input hash is SHA-256 of shasum -a 256 output in this exact order: AGENTS.md docs/north-star.md docs/vision.md docs/lineage.md spec/v1/event-loop.md spec/v1/README.md benchmarks/language/README.md benchmarks/language/corpus.json benchmarks/language/contract.test.ts benchmarks/language/event-sequence.ts benchmarks/language/event-sequence.test.ts; tree binds remaining files. Re-key on changed head/inputs.

Exact validation for the released lane: git status --short --branch; git rev-parse HEAD 'HEAD^{tree}' origin/main; git diff origin/main...HEAD --check; bun test benchmarks/language; bun run docs:check; bun run build:site; bun run typecheck; bun run lint; bun run check; cargo fmt --all -- --check; CARGO_NET_GIT_FETCH_WITH_CLI=true cargo test --workspace --locked; CARGO_NET_GIT_FETCH_WITH_CLI=true cargo clippy --workspace --all-targets --locked -- -D warnings; CARGO_NET_GIT_FETCH_WITH_CLI=true cargo build --locked -p algal --bin algal; bun scripts/application-parity.ts only in a matched loopback-capable environment with an adequate bounded time after inspecting .cache/p0-parity-diagnostic.log, not the same 600s retry here; gh pr checks 276 -R hraness/algal --required; gh run view 38189675641 -R hraness/algal --json headSha,conclusion,jobs. Preserve environmental failures, never call them passes. This read-only inspection reran 38 language tests/499 assertions and diff check: pass.

Success: fresh affirmative independent integration verdict for this unchanged P0 tree, explicit parity disposition, green exact-head Required and clean scope; only then consider the existing PR's normal delivery gates. Failure P0_LOCAL_PARITY_UNRECONCILED or P0_CONTRACT_GATE_FAILED: keep draft and P1/P2 gated. Retry limit: one fresh independent review per key, zero blind repeats of the timed-out parity in this host/key; no automatic retry of uncertain effects.

[0thernet]

P0 selection/handoff only; not an independent affirmative review or permission to merge. No repository files changed.

• agent-decided, owner may revisit: Choose exactly one existing lane: P0 independent verification and delivery reconciliation of this same draft P0: propose event-loop and language benchmark contracts #276 (XCB deferred t_6e4516b3d637ed75be93860b301a483511e57217c747167960877f41e0b9d995). P0 has no prerequisite. P1/P2 wait for an integrated P0, not a calendar date. No model/provider calls, paid work, external publication, credentials or new cumulative-skill study.
• agent-decided, owner may revisit: Judge shipped progress from merged main bc6ddae6e426b2727a3ce7e07158b248bae74309, whose Check Required passed (37726508198). Recent Specify Lisp-shaped ALGAL workbench direction #258/Present ALGAL's north-star vision, leading with Lisp #260/Restore frame protection on the owner-token local servers #274 and dependency/security merges did not integrate P0. This PR remains OPEN/DRAFT/MERGEABLE at 926c5795c11e0d91145c9385931534d9ce24e8b2 (tree 0a7f9d2a7c6e30b3493d8ec64fd92b5a80497c01); exact-head Required passed on run 38206769860 attempt 2 after one diagnosed SQLite failed-job rerun. No GitHub reviews or review threads. docs: start P8 consumer inspection queue #277 owns an unfinished P8 queue; Add Goose as a design reference for compile-time bounds and verified storage #275 owns north-star/lineage (Required red); Establish formal verification and repair runtime admission boundaries #70 is conflicting and broad. None is a second P0 lane. The older independent HOLD predates this duplicate-write repair and has not been superseded by an independent affirmative review.
• agent-decided, owner may revisit: Use docs/north-star.md for the dependency graph, scorecard and literal P0 exit gate; docs/vision.md for selection/claims and docs/lineage.md for precedent. P0 acceptance: event-loop and benchmark-result contracts, actor/supervisor/habitat/revision vocabulary, source/runtime identity, no separate runtime decision, baseline corpus/protocol, strict unknown-field refusal, bounds for all count/byte fields, >=1 valid and >=5 invalid fixtures. Smoke timings are synthetic, not measured speed; incumbent application parity is not event-loop runtime parity or cumulative-skill proof. ALGAL integration owns spec/v1/{README,event-loop}.md and benchmarks/language/**. Extend only to repo-owned manifests, indexes, claim registries or fixtures if P0's own gate proves necessary, without editing Add Goose as a design reference for compile-time bounds and verified storage #275/docs: start P8 consumer inspection queue #277 or taking another PR's work. This read-only selection needs no extension or owner answer.

Key: (P0-PR276-review-delivery, inputs-sha256:4036c57a0aebea7807385eab7ee67febe5cc18400adc8e25125e5a9c879115d2, HEAD:926c5795c11e0d91145c9385931534d9ce24e8b2, tree:0a7f9d2a7c6e30b3493d8ec64fd92b5a80497c01). Input digest is SHA-256 of shasum -a 256 lines over sorted tracked AGENTS.md, docs/{north-star,vision,lineage}.md, spec/v1/{README,event-loop}.md, benchmarks/language/**, package.json, bun.lock, Cargo.toml, Cargo.lock. Re-key on any changed input/head.

Exact validation for the released lane: git status --short --branch; git diff origin/main...HEAD --check; bun test benchmarks/language; bun run docs:check; bun run build:site; bun run typecheck; bun run lint; bun run check; CARGO_NET_GIT_FETCH_WITH_CLI=true cargo test --workspace --locked; cargo fmt --all -- --check; CARGO_NET_GIT_FETCH_WITH_CLI=true cargo clippy --workspace --all-targets --locked -- -D warnings; CARGO_NET_GIT_FETCH_WITH_CLI=true cargo build --locked -p algal --bin algal; bun scripts/native-parity.ts; bun scripts/application-parity.ts (only in a loopback-capable, matched environment); gh pr checks 276 -R hraness/algal --required; gh run view 38206769860 -R hraness/algal --json headSha,conclusion,jobs. Do not relabel earlier local loopback/SSL/timeouts as passes. On exact head today, focused tests 39/502, docs check and diff check passed; local aggregate/parity remain without a passing verdict.

Success for the follow-up: independent affirmative contract review of this tree, explicit integration recommendation after parity disposition, current Required/threads/mergeability recheck, then normal delivery of this existing PR and green post-merge main Required, each evidenced separately. This selector does not deliver. Failure P0_REPAIRED_HEAD_UNVERIFIED (or P0_PARITY_UNRECONCILED if matched artifacts reproduce divergence): leave draft/unmerged, P1/P2 gated, record reproducer. Retry limit: one independent review and one bounded diagnostic per keyed revision/environment; after a diagnosed repair, at most one newly keyed review. Zero blind retries of timed-out or uncertain effects.

[0thernet]

P1 selection/handoff only, not implementation or permission to merge another PR. No repository files changed.

• agent-decided, owner may revisit: Select exactly one lane, P1 portable event-loop contract (existing deferred XCB task t_15c33dd696fc11a27aafbca9f1a5154bea7d77db22205b7dd9558f092c7fc863). P0 P0: propose event-loop and language benchmark contracts #276 merged as 8315bb00a4a330e606a5488cc1f342efc7912513; post-merge main Check run 38219476996 has successful Required. This freezes the P0 proposal, not an evaluator, measured speed, or cumulative-skill improvement. P1 is the earliest unfinished phase on the contract branch. No model/provider calls, external publication, credentials, paid work or new skill study.
• agent-decided, owner may revisit: Read the P0/P1 contract-first ordering in docs/north-star.md as requiring P1's portable records/parsing/digests before P3/P4 evaluators. The last paragraph of spec/v1/event-loop.md calls an evaluator possible in P1, but its P0 status and the north-star P1 exit gate do not move P3/P4 implementation or scheduling into this lane. P2's graph edge from P0 does not displace earlier P1; keep its measurement baseline separately scoped. Use merged-main spec, not Add Goose as a design reference for compile-time bounds and verified storage #275's red/unmerged edits or synthetic timings, as P1 input; docs/vision.md preserves truth/authority boundaries and docs/lineage.md is precedent, not evidence of implemented parity.
• agent-decided, owner may revisit: Core contract lane owns src/event-loop-* and focused tests, spec/v1/event-loop.md, a mirrored crates/algal/src/event_loop_contract.rs plus focused Rust tests, and a new offline fixture/parity runner in scripts/fixtures/event-loop-contract.json and scripts/event-loop-contract-parity.ts. Reuse P0 benchmarks/language/** as pinned input, not an invitation to alter its synthetic results. Extend to the smallest repo-owned manifest, shared Rust barrel or fixture only if this lane's gates actually require it; integration owner coordinates those shared files and rechecks Establish formal verification and repair runtime admission boundaries #70's enormous open diff (crates/algal/src/lib.rs, Cargo.lock), never takes Establish formal verification and repair runtime admission boundaries #70's feature work. docs: start P8 consumer inspection queue #277 independently owns P8 docs/consumer-matrix.md; Add Goose as a design reference for compile-time bounds and verified storage #275 owns its unmerged north-star/lineage change; Dependabot owns package/lock changes. Nine open PRs currently have no review threads. docs: start P8 consumer inspection queue #277 exact-head Required is green but independently held at its incomplete audit; Add Goose as a design reference for compile-time bounds and verified storage #275, build(deps-dev): bump react and @types/react #270/build(deps-dev): bump react-dom and @types/react-dom #267/build(deps-dev): bump @eslint/js from 9.39.5 to 10.0.1 #264/build(deps): bump libc from 0.2.189 to 0.2.190 #263/build(deps): bump getrandom from 0.3.4 to 0.4.3 #262 have red Required; build(deps): bump ryu-js from 1.0.2 to 1.0.3 #265 is green; Establish formal verification and repair runtime admission boundaries #70 has no Required. None owns P1 records.

Acceptance: typed event, transition, state-write, notification, deferral and escalation records; event identity/deduplication and conflict rejection; explicit mailbox backpressure/failure outcomes; replayable bounded trace; static effect/resource summary; strict unknown parsing and rejection of unknown fields/bound overages in both TS/Rust. Both parse identical accepted/rejected fixtures and yield identical canonical digests, including duplicate/restart/uncertain decisions where meaningful. No scheduling, host effects, model calls, runtime-parity or performance claim.

Exact future validation (on the eventual P1 tree): bun test src/event-loop-contract.test.ts; cargo test -p algal --locked event_loop_contract; bun scripts/event-loop-contract-parity.ts (new fixture runner must be implemented in this lane); bun run check; cargo test --workspace --locked; cargo clippy --workspace --all-targets --locked -- -D warnings; cargo fmt --all -- --check; git diff origin/main...HEAD --check; gh pr checks <P1-number> --repo hraness/algal --required; after integration verify main Required on the merge SHA. Run Cargo with CARGO_NET_GIT_FETCH_WITH_CLI=true only if the host's libgit2 SSL fetch reproduces the known failure; a loopback restriction or timeout remains unresolved, never a pass. Obtain independent affirmative review on exact tree.

Idempotency key SHA-256 51df55ce4b9191fa1bc113d049fd31a2d2a116aa603aedbf6285ae361c3a0333 over the literal sorted tuple (lane=P1-portable-event-loop-contract, code=8315bb00a4a330e606a5488cc1f342efc7912513, Git blob OIDs AGENTS=17c2e386, north=4d618c50, vision=a2101074, lineage=cb3011fb, spec=f0e00d00, corpus=ec2b7e99); full blob OIDs in the XCB deferred handoff. Re-key after changed inputs/revision. Success: P1 gate passes in both runtimes with parity and independent review, green exact-head Required, integrated code and green post-merge main Required; do not claim those from this selection. Named failure P1_CONTRACT_PARITY_BLOCKED: preserve counterexample/uncertain effect, do not freeze P1 or advance dependent runtime lanes. Retry limit: one initial verification and at most two diagnosed repair/recheck cycles per key; zero blind retries of timed-out or uncertain writes.

[0thernet]

P1 selection/reconciliation handoff, 2026-10-12. No repository files edited by this inspection. Not a review approval or permission to integrate partial work.

• agent-decided, owner may revisit: Keep exactly ONE lane: P1 portable event-loop contract, reconcile and complete existing partial local work (XCB deferred t_15c33dd696fc11a27aafbca9f1a5154bea7d77db22205b7dd9558f092c7fc863), not a fresh P1 implementation or P2/P8. P0 P0: propose event-loop and language benchmark contracts #276 merged as 8315bb00a4a330e606a5488cc1f342efc7912513, and post-merge main Required passed in run 38219476996. This establishes the P0 proposal, not a working evaluator, measured speed, or cumulative skill. North-star P1's records/parity gate controls this lane; vision/lineage keep the evidence and claim boundaries.
• agent-decided, owner may revisit: The failed advance left local branch codex/p1-portable-event-loop-contract-20261012 at main HEAD with 3 modified and 8 untracked P1-related files. Preserve and inspect rather than overwrite or blindly retry; remote branch ref is 404, there is no open P1 PR. The untracked trace spec says shape/identity only, explicitly not a completed P1 gate. bun test src/event-loop-contract.test.ts passed 5 tests and git diff --check passed; Rust parity, full contract, aggregate gate and any previous worker's uncertain effects remain unverified. Do not turn this into an integrated claim.
• agent-decided, owner may revisit: Core contract owner: src/event-loop-*, spec/v1/event-loop.md and the new spec/v1/event-loop-trace.md, crates/algal/src/event_loop_contract.rs and focused tests/example, scripts/fixtures/event-loop-contract.json, scripts/event-loop-contract-parity.ts. Small shared crates/algal/src/lib.rs registration is gate-required but coordinate with open Establish formal verification and repair runtime admission boundaries #70; .gitignore/eslint.config.mjs cache ignores require separate necessity review. docs: start P8 consumer inspection queue #277 owns P8 audit and is held despite green Required; Add Goose as a design reference for compile-time bounds and verified storage #275 owns north-star/lineage edits and has red Required; Establish formal verification and repair runtime admission boundaries #70 and Dependabot own their own changes. None owns P1 records. No model/provider/Gateway calls, spending, account/permission changes, external publication or new cumulative-skill study.

P1 acceptance: typed events, transitions, state writes, notifications, deferrals and escalations; identity/deduplication; explicit backpressure/failure; replayable trace; static effect/resource summaries. Both TS and Rust strictly parse identical valid/invalid vectors with equal canonical digests and refusal behavior (unknown fields, bounds, conflicting identities). No scheduler or provider. Future exact checks: bun test src/event-loop-contract.test.ts; cargo test -p algal --locked event_loop_contract; bun scripts/event-loop-contract-parity.ts; bun run check; cargo test --workspace --locked; cargo clippy --workspace --all-targets --locked -- -D warnings; cargo fmt --all -- --check; git diff origin/main...HEAD --check; gh pr checks <P1-number> --repo hraness/algal --required; post-merge main Required on merge SHA. Independent affirmative review on exact P1 tree required. Success is those P1 gates, reviewed green PR head, integration and green post-merge main; failure P1_CONTRACT_PARITY_BLOCKED preserves the counterexample and keeps dependents unfrozen. Limit one initial verification plus at most two diagnosed repair/recheck cycles per key, zero blind retries of uncertain writes.

Idempotency key: sha256:25658382eb04fe00b3456936922011cef8a00de957e71e5734b2041f8e15deef for literal lane=P1-partial-contract-reconciliation|code=8315bb00a4a330e606a5488cc1f342efc7912513|<path>=<SHA-256 file bytes> over lexicographically sorted AGENTS/north-star/vision/lineage/P0 spec/corpus and the 11 local modified/untracked paths (exact path/hash list in the updated XCB deferred handoff). Re-key on file or code-revision change. The earlier clean-tree key 51df55ce… must not be used to restart or discard this partial work.

[0thernet]

Inspection handoff, 2026-10-12. No repository files edited here; this is not P1 verification, review approval, or permission to merge partial work.

• agent-decided, owner may revisit: Select exactly ONE existing deferred lane, P1 portable event-loop contract reconciliation/completion, XCB t_15c33dd696fc11a27aafbca9f1a5154bea7d77db22205b7dd9558f092c7fc863. Read docs/north-star.md P1 literally as portable records/parsers/digests before P3/P4 evaluators despite the P0 spec's loose evaluator wording; docs/vision.md limits mechanism and cumulative-skill claims, docs/lineage.md is precedent, AGENTS.md governs work. P0 P0: propose event-loop and language benchmark contracts #276 is merged as 8315bb00a4a330e606a5488cc1f342efc7912513, with successful main Required run 38219476996; this is a P0 proposal, not event-loop runtime parity or measured speed. P2 also depends on P0, but P1 is the earlier unfinished phase. No model/provider/Gateway calls, new v9 study, external publication, spending or permission changes.
• agent-decided, owner may revisit: Preserve/reconcile the same dirty local branch: 3 tracked changes (.gitignore, eslint.config.mjs, crates/algal/src/lib.rs) and 8 untracked P1 files, no local P1 commit or remote P1 branch/PR. The 17 input-file SHA-256 values and HEAD recompute the unchanged key sha256:25658382eb04fe00b3456936922011cef8a00de957e71e5734b2041f8e15deef (lane=P1-partial-contract-reconciliation|code=8315bb00a4a330e606a5488cc1f342efc7912513|<lexically sorted path>=<SHA-256 file bytes>, paths in the deferred handoff). Do not discard or blind-retry the failed advance. Current bun test src/event-loop-contract.test.ts passed 5/5; git diff --check passed tracked changes only. Rust parity/full P1 and aggregate gates remain unverified. Re-key on any input or revision change.
• agent-decided, owner may revisit: Core owner paths src/event-loop-*, spec/v1/event-loop{,-trace}.md, crates/algal/src/event_loop_contract{,_tests}.rs, crates/algal/examples/event_loop_contract_parity.rs, scripts/fixtures/event-loop-contract.json, scripts/event-loop-contract-parity.ts. Coordinate the gate-required crates/algal/src/lib.rs registration with open Establish formal verification and repair runtime admission boundaries #70; separately justify or omit cache ignores in .gitignore and eslint.config.mjs. Extend only to repo-owned manifests, indexes, claims or fixtures required by P1's own gates. docs: start P8 consumer inspection queue #277 owns P8 (draft, green Required, ten consumers still unaudited); Add Goose as a design reference for compile-time bounds and verified storage #275 owns north-star/lineage (red Required); Dependabot owns its package/lockfile changes. All nine open PRs have zero review threads; none owns P1 contract records.

P1 acceptance: typed events, transitions, state writes, notifications, deferrals and escalations; identity/deduplication; explicit backpressure/failure; replayable trace; static effect/resource summaries. Strict TypeScript/Rust admission of the same valid/invalid vectors must yield identical canonical digests and refusal codes; no scheduler or provider. The current new trace spec explicitly checks shape/identity only, so P1 remains open. Future gates: bun test src/event-loop-contract.test.ts; cargo test -p algal --locked event_loop_contract; bun scripts/event-loop-contract-parity.ts; bun run check; cargo test --workspace --locked; cargo clippy --workspace --all-targets --locked -- -D warnings; cargo fmt --all -- --check; git diff origin/main...HEAD --check; independent affirmative exact-tree review; gh pr checks <P1-number> --repo hraness/algal --required; after integration confirm main Required on its merge SHA. Success is the full P1 gate, reviewed green PR, merge, and post-merge main green, not this selection. Failure P1_CONTRACT_PARITY_BLOCKED retains failing vectors/diagnosis and keeps dependents unfrozen. One initial verification plus at most two diagnosed repair/recheck cycles per key; zero blind retries of uncertain writes.