MAINLINE

Every permit system gates on the present; MAINLINE gates on ancestry — the database refuses the merge until someone signs against the incident that wrote the rule.

Comment

Read this knowing the story is invented. Kestrel Resources is fictional and INC-2013-044 never happened. The mechanism is real; the inputs were written by us (docs/HONESTY.md § SYNTHETIC).

In 2011 a gas plant sets the high-temperature alarm on a compressor seal to 150 °C. On 2013-06-12 that seal catches fire and two contractors are burned; nobody dies. On 2013-08-04 an engineer lowers the alarm to 135 °C, saving one line with the change: "Lowered 150 → 135 after seal fire INC-2013-044 — two contractors burned." Then ordinary things happen to that rule: in 2016 it is renumbered from 7.3 to 5.2.1, in 2019 it moves into another standard and becomes 9.2.1, and in 2021 the engineer leaves the company.

Today somebody proposes putting the alarm back to 150 °C. They are not careless: the manufacturer specifies 150, and 135 trips alarms on hot afternoons that people have started ignoring. The rule on their screen says "shall be set at 135 °C" and gives no reason.

Every permit-to-work system we surveyed approves that change — six commercial products, read against the thirteen essential elements of a permit form that the UK Health and Safety Executive's HSG250 lists (docs/demo/research/r3-operator.md §1–§2; we could not obtain screenshots, so this is what their documentation states). A permit to work is the written authorisation without which nobody starts a dangerous job, and all of them ask one question: is the world all right at this moment? Isolations in place, gas test in date, ticket valid. Every one of those checks passes, because nothing about the plant today is wrong. None of them can answer why is this limit here.

MAINLINE makes that answer a condition of the write. Every rule carries a pointer to the event that caused it to be written. Issuing a permit is handled the way a change to source code is handled — as a merge — and before it lands, the database looks up what wrote each rule the job leans on. Any earlier event nobody has answered for becomes an obligation: one open question attached to that permit. While it is open, the database refuses to record the permit as issued.

Refuses is the load-bearing word. Not a banner beside an Approve button, which a tired person dismisses at 04:00; not a check in our application, which a migration script would go around. It is a rule inside CockroachDB, applied to every writer including us — switch our screens off and the permit still will not issue. A named competent person must first sign what they intend to do about the 2013 fire; that signed answer is a disposition, and once it exists the same merge goes through.

An old lesson a new job cannot get around, enforced by the database rather than remembered by a person. Check it in a minute, with no account of ours: POST /v1/demo/gate-run on the demo URL replays that argument in four steps and ends in ROLLBACK, so persisted comes back false and your visit leaves nothing behind.

Dates, setpoints and the quoted line are transcribed from spine.json and CAMERA-STRINGS.yaml under verticals/mainline/ (commit_message_2013, asserted byte-equal across four files). The refusal is 23514 gate_closed_when_issued [src: evidence/gate-refusal/proof-20260810T054407Z.json]. The invented incident is severity 4 — two contractors, partial-thickness burns.

Inspiration

(The scenario is invented — Kestrel Resources and Marrindal are fictional and INC-2013-044 never happened. The mechanism is real; the inputs are authored.)

An engineer raises a compressor alarm setpoint from 135 back to the manufacturer's 150 — a routine change, technically correct, and every permit-to-work system we surveyed would approve it. MAINLINE runs blame on the clause instead. A seal fire burned two contractors on 2013-06-12; the alarm was lowered because of it on 2013-08-04, with the message "Lowered 150 → 135 after seal fire INC-2013-044 — two contractors burned."; and that author left the company on 2021-07-16. The permit merge is then mechanically refused by the database — not flagged, refused — until a named competent person signs a disposition against a thirteen-year-old fire.

Every shipping permit system is synchronic: it gates on the current state of the world — isolation in place, gas test valid, signature present. None can express why a rule says what it says, so the memory of an incident decays to nothing the day its author resigns. MAINLINE is diachronic: it gates on ancestry. Recall is therefore not a panel beside the decision but a precondition of the state transition, enforced under SERIALIZABLE. A document shown next to an "Approve" button is a UI nag, and a UI nag gets dismissed. An invariant does not.

What it does

MAINLINE holds institutional safety memory as a version-controlled repository whose commits are written by incidents. Every clause carries a blame pointer to the event that wrote it, the permit-to-work is a protected branch, and one rule is enforced as a database refusal: a permit may not reach merged while a recalled precursor carries an obligation nobody has signed. Being a refusal rather than application logic, it holds against psql and a back-office correction alike.

The mechanism is three steps, specified normatively in spec/TRAPPOINT-SPEC.md §2 and shipped as a CockroachDB Agent Skill:

  • PROJECT — a trigger writes the cross-row fact onto a scalar column of the subject row, derived from an authoritative relation, never from the inserter.
  • PIN — a completed transition takes a composite foreign key onto (subject_id, gate_epoch); any new obligation increments the epoch, and ON UPDATE RESTRICT makes attaching one to a completed transition physically impossible.
  • REFUSE — a plain-column CHECK over that scalar refuses the write, for every writer, forever.

just prove applies the chain and attempts the merge three times. Reproduced in a scratch database while writing this:

chain 271/271 applied, 0 failed, 51.498s
REFUSAL REFUSED [23514] gate_closed_when_issued (reported)
DRIFT REFUSED [P0001] mainline.fn_permit_merge_gate (parsed)
ADMISSION ADMITTED [00000]
VERDICT PROVEN

The middle beat is the claim under attack: the projected counter was forced to zero out of band, and the gate refused anyway, because it re-derives the count instead of trusting the column handed to it. The third matters as much — the same history is admitted once a disposition is signed, because a gate that always refuses is broken, not safe (evidence/gate-refusal/proof-20260810T054407Z.json).

That transcript is just prove on a laptop: real, measured, and not in the demo's request path — it wants a clone and a local node, and it is worth running for exactly that reason, because it needs no account of ours. The same beats also come back over HTTP from the deployed origin, and that half needs neither. POST /v1/demo/gate-run answers 00000 → 23514 gate_closed_when_issued → P0001 mainline.fn_permit_merge_gate → 00000 at verdict PROVEN, inside one SERIALIZABLE transaction ending in ROLLBACK, so persisted comes back false and asking the question leaves nothing behind. Send it as a POST; the route declines a GET with 405.

Accomplishments that we're proud of

The honesty mechanism is executable, and we can show it going red and then green for the right reason. tests/release/test_honesty_is_checkable.py fails the build when a number in docs/HONESTY.md and its cited source disagree, when a cited file is gone, or when a number carries no reference at all. One rule runs the other way: it fails when evidence appears that the prose has not absorbed. It gave 1 failed, 33 passed naming two artefacts that had landed within the hour, because a document that lags its own evidence is a document that will eventually overstate. Re-run two days later it gives 34 passed, 0 failed: the prose absorbed both. A red build is the correct response to evidence a document has not caught up with, and the green that follows is only worth something because the red was real.

What we learned

A truthful red beats a fabricated green, and it is cheaper to defend. Every quality number here is a ratchet: 671 ruff findings and 0 files ruff format would rewrite, and 0 mypy errors over 660 checked source files — and that zero is worth nothing without the count beside it, because a checker that ran nothing also prints zero. Frozen, published, free to fall but not rise, and gated per rule so a change cannot buy its way past with a headline total.

A skill whose advice cannot be falsified is a blog post. Both CockroachDB Agent Skills ship an executable assertion: one replays an illegal history and fails unless the expected SQLSTATE and constraint name are raised; the other fails unless the query plan actually chooses the vector index. And the verdict on that tool is DESIGNED, not EXERCISED, because shipping an assertion is not the same as capturing its run.

Absence of evidence refuses; it never admits. Where the authority source holds no row for a subject, the trigger must refuse — never default, infer or pass. That rule separates a safety gate from a workflow step.

Limitations — read this before you believe any of it

docs/HONESTY.md publishes what is broken, counted, with the command that re-derives each number. It is the first thing we would want a judge to open; burying it would contradict the entire pitch. What follows is not a footnote — it is the part of this submission we would most want scored, because a judge who finds a gap we did not name should discount everything we did.

(1) Custody is half-built. Offline bundle verification exits 2, not 0: of 16 checks, 9 ran and held, 0 failed, and 7 did not run at all — log_signature, rfc3161_upper_bound, beacon_lower_bound, witness_quorum, archive_object_lock, gate_self_attestation, webauthn_reverification, which is the entire cryptographic half. What is verified is the Merkle structure, never the signatures over it. Exit 2 is the tool refusing to let nine passes read as a verified ledger.

(2) The MI invariant ratchet measures 21 of 30 pending, 9 enforced — re-derived by running python scripts/mi_ratchet.py, whose last line reads 21 pending / 9 enforced. The intentional-red message in CI said 28 of 30 for as long as it took nine invariants to be promoted underneath it. Quote neither number from memory: run the script.

(3) CloudFront cannot be created on this AWS account at all. A real apply reached the distribution and AWS refused with AccessDenied: Your account must be verified before you can add new CloudFront resources. — verbatim, RequestID intact, in docs/deploy/RUNBOOK.md Appendix A, reproduced from a bare aws cloudfront create-distribution with no Terraform involved, by an identity holding AdministratorAccess. Only AWS Support can lift it, so the demo origin is a Lambda Function URL and the runbook is written as though the hold never clears.

(4) Master carries more red than a comfortable submission would. docs/CI-STATE.md is the board and it names every workflow with its run id and a quoted log line. Re-derived live with gh run list --branch master --limit 300, taking the latest run of each: 20 workflows, 8 success and 12 failure. Several of those reds report a true incompleteness and are meant to stay red. The board got worse between two runs of one command in one morning, which is why this bullet prints the command rather than a remembered number.

(5) The lane that finally runs our tests against a real database skips ten of them, against a ceiling of one. Until 2026-08-13 every workflow passed --crdb=none, so each cluster-backed test skipped and the suite that proves the central claim had never executed in CI at all. .github/workflows/cluster-tests.yml now starts a pinned cockroachdb/cockroach:v26.2.5 container and runs the demo-api suite at --crdb=reuse; run 31735341117 measured 528 collected, 518 executed, 10 skipped, 1 failed, 0 errored. That run's conclusion is failure and it should be. The ceiling is max_skipped: 1 beside min_executed: 440, and the lane refuses ten in its own words: a skip here means the suite could not reach the cluster this job started, and a skip is indistinguishable from a green tick on a dashboard. The ten read a .gitignore'd build output the lane never builds. The answer is to build the package in the lane. It is not to raise the ceiling, and the ceiling has not been raised.

(6) The acceptance harness has only ever met its contract against a local emulator. evidence/deploy/acceptance.json reads verdict PROVEN with 0 failures — and url is http://127.0.0.1:8792 with target_is_local_emulator: true, so it is a statement about a local emulator serving the unmodified handler, not about a deployed URL. The run that did go through the public Function URL is a different program's artefact, evidence/deploy/live-gate-run.json, and is named as such rather than folded into this one.

(7) The conformance suite has never been demonstrated end to end. What exists is a census: qa/conformance-census.json records 10 passed, 6 failed and 55 cannot-run over 71 selected, because against a bare node the cases error rather than skip. Exactly two declared cases have been exercised anywhere — CF-01 and CF-03 — and by scripts/proof/gate_refusal.py rather than by the suite. 46 of the cannot-runs share one cause, a column that does not exist, so one repair moves most of them.

(8) The forkable half does not apply. trappoint_ref.clause and trappoint_ref.event are referenced by the rendered SQL and created by no file in it, so trappoint migrate up --tree trappoint-ref refuses at 0058_blocking_check with 42P01.

(9) The console lane has never been observed running against the tree a judge would clone. Its only green is at a headSha five commits behind the tip. A green about a tree nobody is running is not evidence about this tree.

(10) CockroachDB Cloud carries the world, and one Cloud run is owed. The migration chain is APPLIED and the seeded world SEEDED AND REFUSABLE against a Basic cluster in aws-ap-southeast-1, database mainline_demo, CockroachDB CCL v26.2.5 — the refusal observed on Cloud is 23514 gate_closed_when_issued with nothing_persisted: true. The four-beat run through the HTTP handler against Cloud has since been taken as evidence/deploy/live-gate-run.json.

And the boundaries that were always here. The corpus is authored — the compressor-setpoint story is a designed worked example, no real incident, no real site, no real fatality. The agent suite still replays recorded cassettes, and a green run there says our code handles that recorded exchange; it is not a statement about a model today. Separately, and it is a different claim: Bedrock was genuinely invoked while this was written, and the transcripts are committed. The reference-ledger keys are named NOT-SECRET because they are. The custody half of the AWS surface is still not deployed — no evidence bucket, no Object Lock, no KMS signing key, no trail — which is why the cryptographic checks in gap (1) cannot run. Nothing has ever run against CockroachDB Cloud in CI — the cluster lane starts a pinned CockroachDB container, which is a real database and is not the managed one, and the difference matters because a single node never returns 40001 RETRY_SERIALIZABLE and a multi-node Cloud cluster does. Inference is in Sydney and the database in Singapore, so any claim of end-to-end Australian data residency would be false, and the cross-region hop is unmeasured under load. Every timing in the demo is a local timing against Docker on a laptop.

Judged on — Agentic Memory Design

JUDGING AXIS 1 OF 5 — AGENTIC MEMORY DESIGN. This block answers that axis and no other; the four that follow answer theirs.

Memory here is not a retrieval layer bolted beside a workflow; it is the thing the write path is blocked on. Every clause carries a blame pointer to the incident that wrote it, so recall is diachronic — it answers "why does this rule say this?", which none of the permit-to-work products we surveyed can express — and the answer is required before a state transition, not displayed beside it. The mechanism is normative in spec/TRAPPOINT-SPEC.md §2 and is three steps: PROJECT (a trigger writes the cross-row fact onto a scalar column of the subject row, derived from an authoritative relation and never from the inserter), PIN (a completed transition takes a composite foreign key onto (subject_id, gate_epoch), and ON UPDATE RESTRICT makes attaching a new obligation to a completed transition physically impossible), REFUSE (a plain-column CHECK over that scalar, which every writer meets, forever).

Two design rules fall out of it and both are enforced rather than asserted. Absence of evidence refuses; it never admits — where the authority relation holds no row for a subject, the trigger raises rather than defaulting, and that is what separates a safety gate from a workflow step. And memory that cannot be searched is a filing cabinet: clause text is embedded by Amazon Titan v2 into CockroachDB C-SPANN vector indexes declared inline at CREATE TABLE, and every embedding row is forced to record its own embed_model and index_gen by CONSTRAINT embed_model_stated in verticals/mainline/db/migrations/0031_clause_embedding.sql, because a vector whose model is unknown cannot honestly be compared with anything. The plan that proves the index is actually chosen — clause_embedding@ce_ann, both prefix columns bound — is committed at evidence/aws/ann/ann-proof.json with the EXPLAIN beside it.

The loop is not a diagram; it is three live GETs and a committed transcript. STORE → RETRIEVE → ACT runs against the deployed origin and writes evidence/demo/memory-loop.json: verdict PROVEN, 23 of 23 assertions held, 0 failed. An incident dated 2019-03-14 names a clause; seven years later a permit relies on that clause; the retrieval pass finds the incident and ten seconds later the finding is an obligation the database will not let the permit be issued around. Those ten seconds are a subtraction of two columns off two live routes — mainline_meas.recall_run.started_at from GET /v1/recall-runs/{run_id}, and mainline.blocking_check.materialised_at from GET /v1/permits/{permit_id}/blocking-checks — with stated_anywhere_in_this_program: false in the artefact that computes it. The program that writes that file audits itself: values_audited: 79, values_found_in_the_source: [], uuid_literals_in_the_source: 0. A proof script that could have hard-coded its own answer, and demonstrably did not. No endpoint was added to make any of this filmable — the artefact's own ruling R7 says the loop needed none.

The refusal is not a "no"; it is a minimal unsatisfiable set and the nearest admissible alternative. POST /v1/demo/gate-run returns, for the blocked merge, a mus naming the one obligation — origin: blame_ancestry, severity: 4, virulence: blood_major, detail: "open at gate_epoch 1; no live disposition" — and an naa of cardinality 1 describing the exact smallest repair, with the five dispositions the law of this system permits (applied, mitigated, mechanism_absent, escalated, emergency_override). A gate that only says "no" gets routed around, and an invariant that is routed around is not an invariant. On the third beat — the attack — the payload degrades honestly rather than guessing: naa: null, naa_reason: "not_computable", mus[0].kind: "capability_gap". A refusal that tells you it cannot compute the alternative is worth more than one that invents it. Both halves are committed as well as live: the blocked merge's mus and naa in evidence/deploy/live-gate-run.json, which is the public Function URL's own answer, and the degraded third beat in evidence/demo/live-beats.json § beat_three_diagnosis, whose own note calls it "a Product-Readiness point, not an embarrassment".

The recall corpus is authored for this repository. There is no real incident, site, operator or fatality behind it (docs/HONESTY.md § SYNTHETIC). The mechanism is real; the inputs were written by us.

On the criterion's own words — "a meaningful, production-grade role as the agent's memory layer" — the scope of that adjective is the memory layer, and this submission is careful about which half it is claiming. The memory layer is SERIALIZABLE, a named CHECK whose name is the deliverable, a composite foreign key onto (subject_id, gate_epoch) with ON UPDATE RESTRICT, a counter no client may write, row-level security with FORCE, and a 271-file migration chain applied 271 of 271 against managed CockroachDB Cloud (evidence/deploy/cloud-chain.json, files 271 · applied 271 · failed 0). What axis 4 concedes — and it concedes it loudly — is the custody store and the operator surface around that layer: 7 of 16 cryptographic custody checks unwritten, no p50, no p99, no load profile (qa/test-state.json, external_checks.custody_bundle_verification). Those are two different sentences about two different things, and this page will not merge them in either direction.

OPEN THIS TO CHECK IT — no clone, no account, no credential, one command: curl -s <demo_url>/v1/permits/dec0de00-0006-4000-8000-000000000001/blocking-checks, where <demo_url> is the origin docs/submission/SUBMISSION.json carries in demo_url. The field that decides this axis is precursor.severity_gate. It reads 4 with severity_basis: "human_rated" and origin: "blame_ancestry" — a value the client never supplied and a trigger projected onto a row the client never touched (evidence/gate-refusal/proof-20260810T054407Z.json#projection, 10 of 10 assertions holding). If that number is the client's own, memory here is a cache and this axis is falsified. Then spec/TRAPPOINT-SPEC.md §2 for the normative PROJECT · PIN · REFUSE rules the projection obeys.

Judged on — Technological Implementation

JUDGING AXIS 2 OF 5 — TECHNOLOGICAL IMPLEMENTATION. This block answers that axis alone.

The claim worth judging is one beat long: force the projected counter to zero out of band, attempt the merge, and the database still refuses — P0001 mainline.fn_permit_merge_gate — because the gate re-derives the blocking count from the authority relation instead of trusting the column it was handed. A gate that trusts its own projection is a cache with a CHECK on it. Re-derived while writing this, in a throwaway database on a pinned single node: 271 of 271 migration files applied, 0 failed (evidence/gate-refusal/), all 10 projection assertions held, REFUSED [23514] gate_closed_when_issued reported, REFUSED [P0001] mainline.fn_permit_merge_gate parsed, ADMITTED [00000] once a disposition is signed — verdict PROVEN, caveats (none). The third beat matters as much as the first: a gate that always refuses is broken, not safe.

The same chain runs on CockroachDB Cloud, not only on a laptop: evidence/deploy/cloud-chain.json records files 271 · applied 271 · failed 0 against a Basic cluster in aws-ap-southeast-1, with the tree fingerprint that produced it. Amazon Bedrock executes — evidence/deploy/aws-live.json is a four-call transcript in ap-southeast-2 with AWS request ids: Titan v2 returned a 1024-dimension embedding at L2 norm 1.0, and Claude Haiku 4.5 returned MAINLINE gate online for 16 input and 8 output tokens. And the same four beats now come back over HTTP from a deployed AWS Lambda: evidence/deploy/live-gate-run.json is the answer the public Function URL gave — 23514 gate_closed_when_issued, then P0001 mainline.fn_permit_merge_gate against a falsified counter, then 00000 — in one SERIALIZABLE transaction that ends in ROLLBACK, so the demo leaves no state behind it. Of the AWS rows that need a terraform apply, the demo stack's three have had one and the custody store's have not; docs/TOOL-USAGE.md says which is which, per service, with the file and line that does the work and the evidence path beside it.

The suite that proves all of that now runs against a real CockroachDB in CI, and that is new. Every one of this repository's workflows passed --crdb=none until 2026-08-13, which meant each cluster-backed test skipped and the product's own suite had never executed in a lane. .github/workflows/cluster-tests.yml starts a pinned cockroachdb/cockroach:v26.2.5 container and runs the demo-api suite at --crdb=reuse; run 31735341117 at headSha eefae1c measured 528 collected, 518 executed, 10 skipped, 1 failed, 0 errored — 1 failed, 517 passed, 10 skipped in 154.21s. Read the residual with the result. The lane's conclusion is failure, because 10 skips stand against a ceiling of 1 (qa/cluster-known-red.json, floor.max_skipped), and the skips are the two files that read out/lambda/mainline-demo-api-arm64.zip, a .gitignore'd build output the lane never builds. A lane that skips is indistinguishable from a green tick on a dashboard, which is the lane's own sentence and the reason it refuses rather than reports.

The honest numbers, because they are the argument. docs/CI-STATE.md is the board and it names every workflow with its run id and a quoted log line; read on 2026-08-14 it states 18 workflows · 11 GREEN · 7 RED. Re-derived live on 2026-08-14 with gh run list --branch master --limit 300, taking the latest run of each: 20 workflows, 8 success, 12 failure, 0 never-run. The gap against the board is the two cluster lanes added after that board was taken, and the board says on its own face that it credits nothing still in the working tree. Several of the reds report a true incompleteness and are meant to stay red. The MI invariant ratchet stands at 21 of 30 pending, 9 enforced — the last line python scripts/mi_ratchet.py prints — where the intentional-red message in ci.yml said 28 of 30 until nine invariants were promoted underneath it and the string was corrected. The custody chain has 7 of 16 checks unimplemented, the whole cryptographic half, and offline bundle verification exits 2 rather than letting nine passes read as a verified ledger. And a one-grep claim this page used to overstate, corrected by running the grep. It said "continue-on-error and || true appear nowhere in this repository's lanes", and half of that survives measurement while half does not. grep -rn '^\s*continue-on-error\s*:' .github/workflows/ returns 0 — the directive is in no lane, and every textual mention of it is prose saying it is banned. grep -rn '|| true' .github/workflows/ returns 39 lines, of which 3 are executable shell and the rest are that same prose. The three are named here rather than left for a judge to find: .github/workflows/db.yml:790 is docker rm -f trappoint-crdb || true inside an if: always() teardown, and .github/workflows/nightly-differential.yml:170 and :217 wrap a grep -c that exits 1 on a zero count and would abort the step under set -eu before the test could report that emptiness as the failure it is — the second of those carries a comment in the lane saying so. Neither masks a result, and neither is the reason the sentence changed. The sentence changed because a stranger could falsify it in one grep, and a page that asks to be checked has to survive being checked.

OPEN THIS TO CHECK IT — scripts/proof/gate_refusal.py. Run it against a bare local node and read the last line. The transcript it writes is committed: evidence/gate-refusal/proof-20260814T032418Z.json, 2026-08-14, verdict PROVEN with caveats: [], in a throwaway database of its own — chain 271/271 applied, 0 failed · PROJECTION 10/10 held · REFUSAL REFUSED [23514] gate_closed_when_issued (reported) · DRIFT REFUSED [P0001] mainline.fn_permit_merge_gate (parsed) · ADMISSION ADMITTED [00000]. That PROVEN is local — cluster.database is w_qr_gate_refusal_proof — and the equivalent run against CockroachDB Cloud is owed, which Limitations item (11) states in the ruling's own words. If that last word is anything but PROVEN, this axis is falsified and should be scored as such.

Judged on — Real-World Impact

JUDGING AXIS 3 OF 5 — REAL-WORLD IMPACT. This block answers that axis alone.

The failure this addresses is not hypothetical and not rare: a control is relaxed after an incident, the people who understood why leave, and years later somebody restores the "correct" value. The worked example is a compressor alarm setpoint raised from 135 back to the manufacturer's 150 — technically correct, and approved by every permit-to-work system we surveyed, because each is synchronic: they gate on the current state of the world (isolation in place, gas test valid, signature present) and hold no representation of why a limit is where it is. The institutional memory of an incident decays to nothing on the day its author resigns. MAINLINE makes that memory a precondition of the merge, and a named competent person must sign a disposition against the original event before the permit can proceed.

What makes it deployable rather than a demo is where the rule lives. The refusal is a database constraint under SERIALIZABLE, so it holds against the console, against psql, and against a back-office correction made by somebody with credentials and a deadline — which is how controls actually get bypassed. The blast radius of "our app forgot to check" is zero, because the app is not what checks.

And the honest boundary. The corpus, the site, the operator and the incident are authored for this repository (docs/HONESTY.md § SYNTHETIC); Kestrel Resources is fictional and the film says so on screen. What has been demonstrated is the mechanism, on a real distributed database, with a real refusal — not an outcome at a real operator. Nobody's safety has been improved by this yet, and a submission that implied otherwise would be doing the exact thing this project exists to refuse.

OPEN THIS TO CHECK IT — VERIFY.md. It orders three tiers by how much you must take on faith, and Tier 2 is the one that matters for impact: clone, just up, just prove, and the refusal reproduces on a stranger's laptop with no account of ours and no model call. A safety claim a buyer cannot re-run is marketing. The managed-cluster half is evidence/deploy/cloud-chain.json — files 271 · applied 271 · failed 0 against CockroachDB Cloud Basic in aws-ap-southeast-1, 359.1 seconds there — that is #chain_seconds; the file's #total_seconds is 388.9 and includes bootstrap, so both are named rather than the flattering one — against 46.35 locally (evidence/deploy/chain-261.json#wall_clock_seconds), which is the most useful ratio here for anyone budgeting a deployment. It is a DDL measurement and not a retrieval one.

Judged on — Product Readiness

JUDGING AXIS 4 OF 5 — PRODUCT READINESS. Score this one down; the reasons are counted below and we would rather be marked accurately than believed generously.

What a judge can do today, and what each route actually costs them — because one of the four is not anonymous, and this block names which rather than letting it be discovered. Needing nothing from us at all: clone the repository and run python scripts/proof/gate_refusal.py, which applies the chain into a throwaway database and prints the three beats and a verdict; or verify the signed evidence bundle offline with no credential at all; or open the deployed origin, where GET /v1/health answers ok true and POST /v1/demo/gate-run returns four beats and a verdict, changing nothing, because that transaction ends in ROLLBACK. Both were re-measured against the origin rather than read back out of the artefacts — ok true, database mainline_demo, deploy_chain_applied 271 of 271; and verdict PROVEN, failures [], persisted false, transaction.isolation SERIALIZABLE. Send the second as a POST: that route declines a GET with 405, which is a route refusing a method rather than a path that is not there.

And this is the one route on the list that is not anonymous: the live CockroachDB Cloud ledger through the read-only mainline_judge login, whose password goes in the Devpost form's credentials field and appears nowhere in this repository. Measured 2026-08-11 it read all 14 mainline_audit views and was refused on all 11 of the 11 forbidden statements put to it — base tables, an INSERT, a CREATE TABLE, a DROP VIEW, a forbidden schema and crdb_internal — each refusal recorded with its SQLSTATE.

A fourth route, and the precise claim about it is the artefact's own. A judge may point their own MCP client at the CockroachDB Managed MCP Server, against their own cluster with their own Cloud key, reproducing the mechanism and reaching none of our data — because the credential that opens that endpoint carries create_database, create_table and insert_rows, and is therefore one we will not publish. The sessions we drove are committed instead: two of them, five days and one deployment apart, both reaching 15 of 16 pack questions at verdict DIVERGED — KNOWN GAP, with the one FAIL preserved rather than rounded off. We generate the statement and we dial the HTTP, and everything that turns that statement into an answer — parse, authorise, plan, execute, encode, cap — is CockroachDB's own managed server, running as its own SQL identity on a surface we did not write. The stronger-sounding "none of our code is in the read path" would not be true, because the client that sends the request is ours, and the artefact says exactly that in the same field rather than letting us round it up.

What is not ready. An origin exists and answers, and everything downstream of that is the gap: 7 of 16 custody checks are unwritten; the acceptance harness has met its contract only against a local emulator; and the AWS account carries a verification hold on new CloudFront resources, quoted verbatim with its RequestID in the runbook, which is why the demo origin is a Lambda Function URL instead. The first thing the deployed origin was measured doing wrong is recorded rather than buried: its first health readings were ok=false reason="dsn_unset". A deployed URL is not a finished demo, and this block will not merge the two.

The readiness claim is therefore narrow and true: the mechanism is reproducible by a stranger, an origin is deployed and answering, and the submission is not finished. Three different sentences, and this page will not merge them.

OPEN THIS TO CHECK IT — docs/submission/SUBMISSION.json, then python scripts/submission/check_submission_ready.py. The checker asks every requirement, prints PASS, WARN or FAIL per row with the literal command that resolves it, and refuses to call the submission ready while any row is unresolved. A FAIL row on that output is this axis, stated by a program rather than by us.

Judged on — Creativity & Originality

JUDGING AXIS 5 OF 5 — CREATIVITY & ORIGINALITY. This block answers that axis alone.

The original move is inverting where recall sits. Every retrieval-augmented system in this space puts memory beside the decision — a panel, a summary, a citation list — and leaves a human to weigh it. A panel beside an "Approve" button is a nag, and nags get dismissed at 3 a.m. by somebody who has seen it forty times. Making recall a precondition of the state transition, enforced by the storage engine rather than by the application, is not a better nag; it is a different category of object. The gate that re-derives its own input rather than trusting the projected column is the sharp end of it: the system is built to survive its own bookkeeping being wrong, including when the bookkeeping is wrong on purpose.

The second unusual choice is that this submission publishes its own red lanes. docs/CI-STATE.md names every failing workflow with the run id and the quoted log line; docs/HONESTY.md counts what is broken with the command that re-derives each number; docs/submission/MUST-NOT-CLAIM.md is a list of sentences we are forbidden to say, and scripts/submission/check_submission_prose.py fails the build when one of them appears in our own marketing prose — Quality numbers are ratchets: frozen, published, free to fall and not to rise, gated per rule so no change can buy its way past with a headline total. The UNRESOLVED literal in docs/submission/SUBMISSION.json is a feature and the submission gate refuses while it is there, which is why the open rows are still red on this page instead of being quietly filled in.

A red that reports a true incompleteness is more informative than a green that reports nothing. Building the apparatus that makes that survivable — and then submitting with it switched on — is the creative claim.

OPEN THIS TO CHECK IT — skills/designing-diachronic-gates/. The idiom is generalised out of the product into a CockroachDB Agent Skill, and it ships a program that falsifies it: skills/designing-diachronic-gates/scripts/assert_gate_refuses.py spins a throwaway node, replays an illegal history, and fails unless the expected SQLSTATE and the expected constraint name are raised. Its sibling skills/designing-vector-recall-prefixes/scripts/assert_prefix_index_used.py fails when the query plan stops choosing the vector index, because an ANN query that quietly fell back to a scan is otherwise indistinguishable from one that did not. A skill whose advice cannot be falsified is a blog post. Read the verdict with the claim: evidence/tool-usage/crdb-features.json marks this tool DESIGNED, not EXERCISED, because no run of either script is captured under evidence/ — "shipped and not evidenced", in the census's words. That is the honest shape of an OPEN THIS TO CHECK IT line here: the falsification is a program in the tree that you run, and the thing we are not claiming is a transcript of us having run it.

Feedback for CockroachDB

Feedback for CockroachDB, and the first item is one we got wrong. We built on CockroachDB v26.2.5 for several weeks and kept a list of sharp edges. Before publishing we re-ran every item from a cold shell: seven candidates, six published, one struck, plus six sentences withdrawn from inside the survivors. The struck one was ours — we had published that the planner would not choose our vector index unless the statement named it; it chose it unasked, twice (docs/upstream/STRIKE-LEDGER.md §2).

has_function_privilege() cannot answer false in the form a checking program has to use. Expected: revoking EXECUTE on a stored procedure makes the role-named call answer false. Measured: with EXECUTE revoked from everyone and the engine itself refusing the call with 42501, the role-named form still answered true — for that login and for root, admin and public. The self-asking form answered correctly, and has_table_privilege passed the identical control. Our guard was built on the blind form and could never have gone red; one documentation line would have saved us the afternoon. (findings/F01, REPRODUCED-TODAY.)

Two catalogue surfaces spell one routine two different ways. Expected: SHOW GRANTS and information_schema.routines agree on a routine's name. Measured: the first gives the full argument list, the second the bare name, neither carries the other's spelling, and comparing them as text produces false alarms forever. A stable object-id column on SHOW GRANTS would end the class. (findings/F02, REPRODUCED-TODAY.)

The ceiling on schema objects arrives as unrelated test failures. Expected: a warning on the way up to roughly 20,000 objects. Measured: thirteen broken tests and most of an hour blaming an innocent code change. The refusal at the ceiling is excellent; nothing counts down to it, and the count that would tell you where you stand lives in crdb_internal, closed by default. A NOTICE at 80 % would have cost minutes. The mess was ours — the shape of finding out is what we send. (findings/F05; its central refusal is filed under Reported, not reproduced on this machine, label ARCHIVED-EVIDENCE — not re-triggered here, since doing so means creating twenty thousand schema objects on purpose.)

All six, each with a program that reproduces it: docs/upstream/COCKROACHDB-FINDINGS.md. Read its opening section on what the platform got right before the complaints — three things that carried this product, measured the same way. None of this has been sent to Cockroach Labs; it is the thing we would send.

What actually ran

Every AWS service and CockroachDB feature below carries the verdict its own census gives it. EXERCISED means it ran and a committed artefact records the result. DESIGNED means the code is complete on disk and nothing recorded has run it end to end. NOT-AVAILABLE means it was checked on this platform and is absent. The censuses are evidence/tool-usage/aws-services.json and evidence/tool-usage/crdb-features.json; python scripts/submission/capture_tool_evidence.py --check re-derives both with no network and no credential, and exits non-zero when a count or a citation has drifted off its subject.

AWS — 12 service rows: 6 EXERCISED, 5 DESIGNED, 1 NOT-AVAILABLE.

  • AWS Lambda + Function URL — EXERCISED. The /v1/* demo API, arm64, authorization_type = NONE. The one AWS surface in the demo's request path.
  • AWS Systems Manager Parameter Store — EXERCISED, and it was promoted on a refusal. With the parameter absent the origin answered ok=false reason="dsn_unset" and 503, naming ParameterNotFound exactly; with it present, ok true. The committed plan sets MAINLINE_DSN_PARAM and no MAINLINE_DSN, so the function has no other configured route to a database and an ok true health body is a signed, role-authorised ssm:GetParameter. No artefact records that parameter's value.
  • AWS IAM — EXERCISED, and narrower than its own title. What ran is a role created, assumed, and its one non-managed grant used. The deny-first policies this row is named for are still unapplied. An applied allow is not an applied deny, and the verdict covers only the first.
  • Amazon CloudWatch — EXERCISED, as a reader rather than a writer. 110 read-only GetMetricStatistics calls against the AWS/Bedrock namespace in ap-southeast-2, each Sum taken at Period 300 and 3600 and required to agree, because a Sum is resolution-invariant and a disagreement would mean a clipped bucket. The alarms and dashboard now exist and are unexercised — nothing records an alarm transitioning to ALARM, and an alarm that never fired has demonstrated its existence and nothing about its threshold.
  • Amazon Bedrock — EXERCISED on two rows, and not in the demo's request path. Claude inference on au.anthropic.claude-haiku-4-5-20251001-v1:0 and Titan v2 embeddings on amazon.titan-embed-text-v2:0, both in ap-southeast-2, both returning HTTP 200 with AWS request ids — strings AWS minted that this repository could not have. Those calls are real, and they are not what a judge triggers: the four beats are SQL against CockroachDB and call no model. Both halves are true and neither is separable from the other.
  • DESIGNED — 5, named rather than omitted. Amazon S3 with Object Lock in COMPLIANCE mode, AWS KMS with an ECC_NIST_P256 key, AWS CloudTrail, Amazon EventBridge, and Amazon CloudFront. There is no MAINLINE evidence bucket, no signing key, no trail and no distribution. This is the custody half, and it is the half that matters most — it is why the seven cryptographic checks in Limitations cannot run.
  • NOT-AVAILABLE — 1. Amazon Bedrock Rerank is not offered in ap-southeast-2. Listed as absent rather than dropped.
  • One of the five will not clear on any schedule. A real apply reached the CloudFront distribution and AWS refused, verbatim: AccessDenied: Your account must be verified before you can add new CloudFront resources. It reproduces from a bare aws cloudfront create-distribution with no Terraform involved, under an identity holding AdministratorAccess. Only AWS Support can lift it, which is why the demo origin is a Lambda Function URL.

CockroachDB — 14 rows: 12 EXERCISED, 2 DESIGNED. Two taxonomies are in play, and conflating them is exactly how tool counts get inflated, so both are stated. The hackathon's four named tools come first, in the order the criterion enumerates its three. The census's own kind column splits the same 14 rows differently: 4 are tools and 10 are engine features. So Distributed Vector Indexing appears below as one of the hackathon's four tools and is filed by the census as one of its ten features. That is one thing counted under two schemes, not two things.

  • Distributed Vector Indexing — EXERCISED. C-SPANN vector indexes declared inline at CREATE TABLE, searched under a bound prefix, with the plan that proves the index is chosen — clause_embedding@ce_ann, both prefix columns bound — committed with its EXPLAIN. A measured detail worth having: <-> against a vector_cosine_ops index raises 42809.
  • Managed MCP Server — EXERCISED, at 15 of 16 and a verdict of DIVERGED — KNOWN GAP. Two recorded sessions against https://cockroachlabs.cloud/mcp, protocol 2025-06-18, tools/list returning 12 tools, running as the server's own SQL identity managed-mcp against live Basic cluster 7cfc9ee9-f9b4-413d-bcad-d81fca2c6c7e — one on 2026-08-11, one on 2026-08-16 through the pack's own runner with its envelope validator and truncation guard. Both reach the same 15 of 16 and the same verdict, five days and one deployment apart, so nobody closed the gap by revoking a grant. The one FAIL is N01: that identity can read mainline_qa.v_disposition_profile, which the pack asserted it could not. A 15 of 16 printed as 16 of 16 would be the rounding this whole page exists to refuse.
  • ccloud CLI — EXERCISED. A captured ccloud auth whoami + ccloud cluster list -o json transcript against mainline-dev. ccloud 0.6.12 has no headless authentication, so it is a committed transcript rather than a lane, and that limitation is published rather than smoothed over.
  • Agent Skills — DESIGNED. Two authored skills are on disk, each shipping an executable assertion script — one replays an illegal history and fails unless the expected SQLSTATE and constraint name are raised, the other fails unless the plan actually chooses the vector index. No run of either is captured under evidence/, so the census reads "they are shipped and not evidenced" and this block reads the same. It is a fourth tool beyond a floor of two, and it is not promoted to lengthen a list.
  • The nine engine features that are EXERCISED, and the measurement that earned each. SERIALIZABLE — not merely reported but observed refusing, a write-skew pair rejected at commit with 40001. PL/pgSQL triggers and functions. Named CHECK constraints, where the constraint name is the deliverable and travels intact from a Cloud node through the handler into JSON a browser can read. C-SPANN vector indexing. AS OF SYSTEM TIME, including its refusal — a 90-day read rejected with XXUUU naming the replica GC threshold, which is the half that shows the bound is real. Follower reads. Row-level security with ENABLE and FORCE. SHOW CREATE and pg_get_functiondef chained into a schema self-attestation, so nobody quietly weakens the gate that prevents quietly weakening controls. And crdb_internal, which on v26.2.5 is restricted by default — 42501 until allow_unsafe_internals is set — used by us and forbidden to the audit identity.
  • DESIGNED — 1. CHANGEFEED. SHOW CHANGEFEED JOBS answers and reports 0 jobs, and kv.rangefeed.enabled reads false on the pinned node, so CDC here is not merely unstarted, it is not currently startable without flipping a cluster setting first. That is the honest shape of a DESIGNED verdict.

The arithmetic, so nobody has to trust the prose: 6 + 5 + 1 = 12 AWS rows; 12 + 2 = 14 CockroachDB rows, which the census splits 4 tools to 10 engine features, of which 9 are EXERCISED and 1 — CHANGEFEED — is not. Counting a feature as a tool to clear a bar is the arithmetic this repository exists to refuse, which is why the two are separated everywhere they are counted.

Built With

  • amazon-bedrock
  • amazon-cloudwatch
  • amazon-titan-embeddings
  • as-of-system-time
  • aws-iam
  • aws-lambda
  • aws-lambda-function-url
  • aws-ssm-parameter-store
  • c-spann-vector-index
  • ccloud-cli
  • claude
  • cockroachdb
  • cockroachdb-cloud
  • cockroachdb-mcp-server
  • follower-reads
  • model-context-protocol
  • plpgsql
  • python
  • react
  • row-level-security
  • serializable
  • sql
  • terraform
  • typescript
Share this project:

Updates

Submission history