Verified-Against: 0ff72880 (2026-09-07).
Audience: agent · Diátaxis: reference · Kind: contract
Census of proof-case seal and isolated CalculiX @3 files. Historical @1/@2 stay
unregistered. Not live-FEA sensitivity.
Index: workspace source map. Domain coverage stays on engineering domains.
Test/conformance compiled proof-case JSON only; not live production authority
Declaration validation and limited identity matching
Closed CalculiX worker input/output and evidence contracts: the local use case supplies
reviewed proof plus exact STEP; no caller-authored .inp, shell, command or path
Parse already-read sealed static-proof bytes for isolated @3. CAS reads stay in the
adapter.
Pure projected identity checks for isolated static FEA @3. No orchestration or adapter
imports.
Closed oracle payload and evaluation mapping. error/unresolved have no comparison.
Exact legacy and run-scoped Thread identity layouts for repeated @3 publications. The
historical layout remains byte-identical when it does not conflict; a conflicting
successor is scoped by the exact producer run id, and cross-run or mixed layouts are
refused.
Deterministic isolated static-proof Thread successor. A fail publishes caused_by /
evidences / addresses; error/unresolved publish no violation.
Provider-free profile plus optional local Microsandbox capability graph, lease,
WAL/evidence stores and output CAS; the @3 descriptor and unavailable dispatcher entry
remain registered, while its concrete executor is wired only under explicit local
execution with the separate SysON oracle
FEA foundation (historical proof CAS on its descriptor path, not
recorded-analysis/calculix/proof-cases) plus project reviews/seal/@3. Product @3 is
composed only when SysON and the CalculiX runtime are both present.
Real generation-0 local microVM gate for the digest-pinned CalculiX worker: exact historical ROP2/proof/STEP inputs, nine publication-gated outputs, external format and physical checks, evidence replay and proven destruction; temporary gate state is removed and no historical operation is rerouted
Permission-bounded entry point for that exact real CalculiX worker gate; it is distinct
from the registered @3 product executor and does not reroute the historical @2 plan
used as its qualification input
Earlier Docker-only CalculiX worker prequalification with fixed wrapper and declared outputs; it remains useful worker-contract evidence but not a substitute for the real local microVM gate, imported-candidate Microsandbox qualification, or product runtime wiring
Maintainer-only imported-candidate qualification for calculix-worker. Input is only a
bound first-party-microsandbox-image-candidate-import/3.0 record plus --run or
--recover. It reads the control-plane host observation once, refuses anything other
than linux/arm64 before composition, then reuses the production composition,
ExecuteIsolatedCalculixStaticProof, validators, batch inspector, CAS reread and proven
destruction under a candidate-specific root. eligibleForPromotion stays false. It is
not a product FEA verdict and not L3/L4/L5 engineering evidence
Code-owned active CalculiX policy, limits, wrapper digest and local server options. The server, the active vertical and the imported-candidate gate share this builder. The candidate factory accepts only an already-bound import record
Record-bound plan/run/recover orchestration for an imported CalculiX worker candidate. Synthetic candidate-qualification identities only; it never reopens a historical product ROP/MRTR
Registered local verify.run-fea-static-proof@3: refuses @2, reopens exact
ROP/MRTR/proof/STEP/profile, publishes nine local outputs plus isolated evidence,
journals the separate SysON oracle before dispatch, and exactly replays CAS/WAL/Thread
evidence without a second solve or oracle
Isolated CalculiX @3 registry descriptor plus thin @2 absence identity for
ROP/unknown_operation guards. Not a recorded-analysis stack. Historical recorded
Modelica identities are unregistered literals, not a fallback.
Closed agent-authored mechanical-proof-case-source/1.0 plus server compile of
mechanical-proof-case/1.0
Outward CAS seam: capture canonical source JSON and reopen by fingerprint only
Dedicated draft-CAS adapter for mechanical-proof-case-source/1.0; no provider, path or
catalog id
Fail-closed parser for the sealed fea-proof-case-capture/1.0 document consumed by
verify.run-fea-static-proof@3
Pure join of a compiled case to cad-model, requirements tip and STEP on one Thread basis
verify.run-fea-static-proof@3 binding contract: proof JSON document + canonical part
STEP; cad-model is a lookalike, never fea.run.*
Inward FEA seal-compilation port: project, opaque source fingerprint, and an optional false-by-default sensitivity-catalog opt-in only
Shared FEA review parsing, current-tip resolution, snapshot reopen, and next.append /
next.propose hop; omitted basis is the unique max-revision Thread snapshot, never
latest
Reopens the captured source and exact causal admission, compiles fea.proof.*, and when
explicitly requested adds the offer digest and admission identity to the same proposal;
read-only, no MRTR authority, and the proof-only review stays resolved when no offer
exists
Shared read-only geometry-capture + canonical STEP admission used by the seal review and
verify.seal-proof-case@1; no claim, write, or MRTR gate
Inward isolated-run port: project, basis and sealed proof artifact id; no numbers
Outward port for reopening and validating the exact active requirements capture and seed behind a proof seal
Capture-backed, archive-aware requirements admission using the shared exact-component tip selector
Shared read-only admission contract implemented by the isolated plan resolver for proof producer, inputs, subject, lineage and MRTR history
Reopens the sealed capture and emits verify.run-fea-static-proof@3 bindings; never
binds a cad-model as geometry. When the compiled root activity already exists, a
successor revision is derived only from its unique current leaf after one evidence-free
isolated_output_validation_failed attempt; the failed work item and run stay immutable
Deterministic isolated-run activity-successor identities and leaf qualification. Not a new operation, provider path, or physics surface
MCP project_fea_proof_case_capture, project_fea_proof_seal_review and
project_fea_isolated_run_review
MRTR grammar, fail-closed encoders and parsers, and field cross-check for
verify.seal-proof-case@1; historical proof-only proposals remain valid, while explicit
catalog opt-in signs schema, offer digest and exact admission artifact identity
Translation boundary between the mechanical proof-case schema and
syson_constraint_evaluate; projects metric enum to featurePath without local
arithmetic; the sole authority on the unit convention (mm/MPa)
Trusted executor for verify.seal-proof-case@1: reopens the signed source capture and
recrosses the current tip without a provider call; a signed catalog opt-in additionally
reopens the exact admission, recompiles and digest-checks the offer, stores its CAS
capture, and publishes a separate artifact derived from both proof and admission. The
offer is not a solve or complete sensitivity case