Version. 0.24
Date. 2026-08-04
Status of this document. The single guide we work to. This is the one page the Operator reads at each sitting. Charter v0.1 ratified 2026-07-30; autonomous regime in effect. Day-to-day status lives in current-status/dunin7-status-brief.
Author. Claude.ai; v0.3–v0.4 and v0.10 by Claude Code; the rest by Claude.ai.
Changes from v0.23. One claim about a tag corrected. v0.23 named the engine's tag and its main-line commit as though they were the same. They are not, and should not be — the tag marks the merge, and three fixes landed after it deliberately. (v0.23 was drafted and never filed.)
Changes from v0.22, carried. B-49 is closed, and it was worse than the item described. Both repositories now have real automated checks — the surface for the first time ever. The recommendation order has changed: the quality-tooling decision moves back, and B-11 moves up, because the gate that would hold that decision now exists and B-11 is what everything else waits on.
Changes from v0.21, carried. The clean-report cluster is closed and one item opened. Both repositories now pass their own checks. B-42's fix produced something worth more than the fix — an inventory separating exceptions that are genuinely inapplicable from exceptions covering real defects, so a zero can be read rather than merely counted. Two were in the second category; one is now B-51. And the recommendation is reordered: gate what is clean before it stops being clean.
Changes from v0.20, carried. A recommendation corrected and three items added that nobody knew were there. v0.20 recommended the clean-report cluster on the ground that it would make every future gate stronger. An inspection established that it makes three of six gates readable, and that three further gates exist which no document in this project had named — now B-48, B-49 and B-50. B-49 is the one to read twice: the engine's only automated check verifies documentation freshness and does not run the tests.
Changes from v0.19, carried. B-10 is closed — outside contributors can now be credentialed into an engagement without ever becoming members of it. **And this version answers what next explicitly**, at the top, because the list has grown to the point where the answer is no longer obvious from reading it.
Three things, and the order has changed from v0.22.
First: B-50 — half an hour's work that is now much cheaper than it was. The surface's build passes while a direct type-check of the same project does not. The gate installed this week is the thing that makes this small: fix a handful of errors, add one line to a workflow that now exists. It closes the last of the three gates nobody had named.
Then: B-11 — and this is the change from v0.22. That version put the quality-tooling decision second. B-11 goes there instead. It is the largest thing left on the main line and the only thing between here and the last third of the demonstration — B-12 and B-13 both wait behind it.
Why the order moved. B-49's window has closed in the good sense: the gate exists now, so whatever is decided later can be held. The quality decision has no comparable urgency — its backlog is already large, and another week does not change the shape of the choice. B-11 does have a cost to waiting, because everything after it waits too.
Then: B-48. The engine has two standard checkers configured, shipped, and never run. A decision about what a gate should check, not a cleanup — and now genuinely optional in its timing, because the gate that would hold the answer is already in place.
Everything else can wait, and most of it is small enough to slot in whenever a session is short.
It is written for you first. Technical cross-references sit at the end of each line for the sessions.
The highest-numbered version is always the truth — past nine, sort as numbers, not text.
Some numbers are deliberately absent. Where a count grows every time something is built, this list names the mechanism and says to count it at scoping time. A figure written here is wrong before it is read.
The statuses: READY · IN PROGRESS · NEEDS YOU: decision · NEEDS YOU: act · WAITING · DONE · PARKED.
The finish line, in one sentence: the full live demonstration works with no excuses — a firm's own document becomes a working engagement, information flows in, the summary view appears, a finished report comes out, a question gets a truthful answer with its sources shown, and an outsider can contribute without seeing anything else.
B-10 — an outsider can contribute without becoming an insider.
A person who is never a member of an engagement can be given a credential by its Operator, claim it through the ordinary sign-up, and contribute into that engagement. Their contributions land unadmitted, fully attributed to them as a person, and admissible only by members with commit authority. They can see their own submissions and nothing else.
The fence is structural rather than a rule. Membership is what every existing read checks, and a credentialed non-member has no membership — so they are excluded from all of it without a single existing read being changed.
Three real defects were caught by its own acceptance tests, not by review: a revoke that reached across engagements, a query filter that was literally correct and broke the moment something was committed, and a value the system emitted that its own schema did not allow. All three were found by tests written to prove the acceptance criteria — the same pattern that caught a README nobody could follow two days ago.
(CR-2026-157 with its amendment note; engine 3b10ff1, tag cr-2026-157-non-member-contribution-v0_1.)
> One thing worth knowing about how it nearly went. That change request was written before the charter existed and sat unexecuted for a week. A check confirmed every function and line it named still resolved — and it would still have run a migration down-and-up cycle against the live production database, because that fence was written after it was. The code had drifted; the rules had drifted further.
B-1 to B-7. DONE. The four rooms exist: Memory, Manifestation, Shaping, Rendering.
B-8. Teach the Companion the last three rooms. READY — unblocked. (Change request D. First Step 0 item: does a vaguely-worded request skip the authority check entirely?)
B-9. The "show me where this came from" walk. DONE.
B-10. Outside contributors, safely. DONE. See above.
B-11. Make answers truthful. READY — and the recommended next build after the cluster below. The answer isn't wrong, it's unstable: the same question three times gave correct, then a false confession of fabrication, then correct with its source cited. Needs a Step 0 before anything is drafted.
B-12. Make the record searchable. WAITING on B-11. The biggest single piece of engineering on this list. May merge with B-11.
B-13. Ask your engagement. WAITING on B-12.
B-14. Read spreadsheets and slide decks. READY (independent).
B-33. The engine's one broken test. DONE. A regression, not an always-broken test: a dependency added a stricter authentication step seventeen days after the test was last written, and the test's fixture had no way to know. The production path was never affected — it is a separate implementation that does not use the code the test exercises. Fixed inside the test's own fixture; nothing else changed.
B-34. The surface's test run ends in an error state. DONE — and it was hiding a real one. The failures under test were artefacts of incomplete test doubles. The gap underneath them was not: a background request failing at the network level — offline, DNS, a blocked request — threw an error nothing caught, in a browser exactly as under test. **Fixed so the failure is caught and reported, and so it still reads as we could not tell rather than *we checked and there is none*** — the rule three of the four rooms hold, and the obvious fix would have broken it.
B-42. A rule the codebase breaks systemically. DONE. The rule was right, and aimed at something this codebase does not do at those places — verified at every site individually, not sampled. Each exception states which of two things is true: the hazard does not apply here, or it does and the fix is its own item. Two fall in the second category, named rather than waived. (CR-2026-166.)
> The inventory matters more than the zero. Lint now reports nothing. A zero standing over an unlabelled exception is the same defect as a green report standing over a known failure — so every exception is categorised in the implementation notes, and the ones covering real defects carry the item that will fix them.
These three were one problem wearing three hats, and they were three of six. Each was a case where nobody could read a clean report as clean, because a standing exception had to be held in mind — and a standing exception is how a second failure hides. The other three are below, and nothing yet enforces the three now fixed. (CR-2026-166; engine 7bdbf8b, tag stele-mount-test-fix-v0_1; surface 7a9adc9, tag clean-report-surface-v0_1.)
B-48. The engine has quality tooling it has never run. READY to scope — new, and the largest of these. Two standard checkers are configured in the engine's own settings and shipped as dependencies. Neither has ever been run as a gate, and both report large backlogs — one of them in the thousands, across dozens of distinct rules, though a majority of those are mechanically fixable.
This is not a cleanup item and should not be scoped as one. The question is what a gate ought to check, and the answer is unlikely to be everything currently reported. A rule that has never run has never been agreed to — the same finding as B-42, at forty times the size. Scope it before anyone fixes anything.
B-49. Nothing was checking anything. DONE.
What it turned out to be was worse than the item said. The engine's single check did not merely fail to run the tests — it had never passed at all, not once since June, and nobody had acted on it. It was failing on real drift: the API documentation was dozens of commits behind the schema it described. The surface had no automated checks whatsoever, and neither repository ever opened a pull request — every merge was local and pushed straight to the main line, so nothing had a chance to run before code landed.
A permanently-red check is worse than none, because it teaches everyone that red means nothing — and any new check installed beside it inherits that.
What landed. The red check was removed rather than repaired: nothing read the document it guarded. The engine now runs its full test suite on every push; the surface runs its lint, tests and build. Every gate was deliberately broken and observed failing before it was trusted — a check whose failure nobody has seen is a claim, not a check.
And the first real runs were the point. The surface passed immediately. The engine took three attempts, each a difference between a developer's machine and a clean one, each fixed and reported rather than switched off to make the merge look tidy. That is the whole reason to install a gate while everything is already clean. (CR-2026-167. Engine main at afe8507, tagged engine-ci-gate-v0_1; surface main at 1fc6a65, tagged surface-ci-gate-v0_1.)
> The engine's tag sits behind its main line, and that is correct. The tag marks the merge. The three fresh-runner fixes landed after it, as separate commits, because the change request required them reported rather than folded in to make the merge look clean. Moving the tag forward would erase the one thing that arrangement was for. v0.23 of this list implied the tag and the main line were the same commit; they are not, and the difference is the record working.
> One thing to keep an eye on. The engine's suite takes about a quarter of an hour on a fresh machine. That is a real cost on every push, and if it grows it will start to be paid in people not waiting for it.
B-50. Building the surface is not the same as checking it. READY — small, and now the cheapest thing on the list. The surface's build passes cleanly and a direct type-check of the same project does not. The build only inspects files reachable from the running application, so the test tree is invisible to it — and that is where the errors are. A green build has been read as a checked codebase and is not one.
B-49 made this small. There is now a workflow to add a line to, where before there was none.
B-16. Update the foundation document. READY to draft · NEEDS YOU: act (read it first). (Seed v0.13.)
B-17. The portfolio filter. READY. B-18. File the four protocol requirements. READY. B-19. Keep this list alive. IN PROGRESS.
B-25, B-27, B-28, B-29, B-41. DONE.
B-26. Correct the record about door 3. READY (small).
B-30. The trap that caused B-27. READY — small. Never repaired; only the broken door was removed. The test suite cannot see it.
B-31. The post-admission lifecycle investigation. READY to open. An investigation, not a build.
B-32. The re-derive button on the Manifestation screen. READY — small.
B-35. A missing key looks like a crash. READY — small.
B-36. A way to retire a render. READY — small.
B-37. Show when a shape's production has failed. READY — small (engine).
B-38. Bring the Rendering screen onto the shared contract. READY — small.
B-39. Ephemeral agent identities. READY to scope. B-40. Where contributed Markdown should go. READY to scope.
B-43. Walk the other way. READY — costed.
B-44. An untitled draft that has a title. READY — cosmetic.
B-45. One command instead of five. READY — deliberately deferred. Now that the stand-up sequence is written down and proven, wrapping it is available whenever it is wanted.
B-46. Where documents live. READY to scope — small. Implementation notes land in the code repositories; the filing convention says documents live in the record. A session orienting from the record alone cannot find them.
B-51. Four components rebuilt on every change. READY to scope — new. On the main dashboard, four pieces of the screen are defined inside the screen itself. The consequence is that they are torn down and rebuilt whenever anything on that page changes, rather than updated in place.
What is unread, and it decides the priority: whether any of the four holds something a user would notice losing — a scroll position, a selection, where the cursor is. If so, this is a bug people have been living with. If not, it is a performance cost. Nobody has looked.
B-47. The issuance screen for contributor credentials. READY — new, small. B-10 built the whole pathway in the engine and deliberately built no screen for it — an Operator can issue a credential only through the interface. Named as a follow-on when it was scoped, and now the follow-on.
B-20. The marketing website. READY. B-22. Package Stele. WAITING (background). B-23. The security story. READY. B-24. Investor-visible FORAY. READY.
Restricted-visibility slices 2–3 · target-hosted visibility · protocol wire-format changes · OVA's remaining standalone role · cross-fund questions · the stray zip file in the record's working tree — every session reports it and leaves it alone; a one-line decision ends that · how many live records carry a fabricated author · whether playground_dev's schema matches what the chain now produces · whether a held shape whose job failed is ever cleaned up.
The restart. Ten change requests, thirteen merges — three span both repositories.
| Merged and not deployed | Where | |---|---| | CR-2026-159 — the provenance field | engine | | CR-2026-160 — the Manifestation screen | surface | | CR-2026-161 — the record writes that aren't true | engine | | CR-2026-162 — the lost contribution, and downloads | both | | CR-2026-163 — the Shaping screen | surface | | CR-2026-164 — the provenance walk | surface | | CR-2026-165 — the stand-up sequence | engine | | CR-2026-157 — outside contributors | engine | | CR-2026-166 — the clean-report cluster | both | | CR-2026-167 — the first real gates | both |
B-16. Read seed v0.13 before it commits.
Two decisions on the queue, blocking nothing. Per-statement provenance — clicking a sentence rather than a note, which cannot be built the obvious way because asking the model to cite makes the citations model output. And whether a walk should use the event identifier, which would show the act rather than the record.
Everything else proceeds without you.
DUNIN7 — Done In Seven LLC — Miami, Florida DUNIN7 — the build list — v0.24 — 2026-08-04