Status and vocabulary
This is a source observation dated 2026-09-08. The stored snapshot was exported at 2026-08-16T11:36:21.577Z: artifacts/snapshots/foundry.json:2-5. It supplies a dated read model; this page does not treat serving those counters today as evidence that generation or a decision happened today.
Three similarly named things must stay distinct:
- The extension’s exported
eligibleFrontiersis a per-icon list built from candidates that exist, have reports, are not quarantined or rejected, and have no deterministic blocker:iconomatix-extracted/iconomix/iconloom-1.0.0/iconloom-1.0.0/src/core/snapshot.ts:293-302. - Root
computeEligibilityFrontier()is a separate metric-based nondominance utility. It filters mechanically blocked or incomparable candidates and returns eligible hashes plus exclusion reasons:src/search/frontier.ts:20-53. - The blueprint calls a mechanical frontier “eligibility, not selection”; artistic choice is live-human-only:
docs/blueprint.yaml:319-327.
Implemented pure primitives
The following functions are executable source, not placeholder names. They are pure data/decision utilities; the table does not claim that a root controller currently invokes them.
| Primitive | Deterministic behavior | Boundary |
|---|---|---|
compileSetProgram() | Validates schema, identifiers, non-negative budgets, duplicate inventory/nodes, dependencies, total candidate budget, and cycles; successful output is normalized with a topological order. | src/contracts/set-program.ts:40-84 |
findReadyNodes() | Returns only pending nodes whose dependencies succeeded; missing, failed, or blocked dependencies create typed blocked findings. | src/gates/dag.ts:14-28 |
| Budget operations | Reserve rejects invalid or over-limit spend; commit moves reserved spend to consumed; release frees a reservation; exhaustion includes both reserved and consumed. | src/gates/budget.ts:15-49 |
separateEvidence() | Keeps measured, inferred, and human records in separate copied, sorted arrays and rejects duplicate evidence IDs. | src/evidence/separation.ts:19-36 |
computeEligibilityFrontier() | Requires comparable metric signatures and unique metric names, eliminates dominated candidates, and never chooses a single winner. | src/search/frontier.ts:20-53 |
recoverySequence() | Offers a frozen, conditional recovery order and always ends in quarantine; it expressly makes no artistic or authority decision. | src/decision/recovery.ts:24-38 |
serializeTerminalPhaseRecord() | Validates a terminal record, normalizes its collections, and emits canonical JSON. It rejects overcommitted budgets, malformed frontiers, inconsistent readiness, and invalid next operations. | src/decision/checkpoint.ts:54-115,125-136 |
evaluateReleaseReadiness() | Collects veto blockers across rights, proof freshness, parity, extraction, checksums, reproducibility, inventory, evidence, quarantine, decision, and approval. Only zero blockers returns release_ready. | src/release/readiness.ts:1-13,43-69 |
[INFERENCE] On the inspected 2026-09-08 root path, the application reads a precomputed snapshot through readFoundrySnapshot(), serves it through handleFoundryApi(), then renders it in React; it does not invoke the primitives above as a search controller: src/adapters/iconloom-ledger.ts:16-119; src/adapters/foundry-api.ts:45-76; src/App.tsx:25-79; src/app/foundry-cockpit.tsx:346-715. The functions are real code, but their composition into a live root worker remains unimplemented in that path.
Designed controller composition
This is a design diagram connecting implemented pure primitives. It is not an execution trace of the current root API or cockpit.
flowchart TD P["Frozen set program"] --> C["Compile and normalize"] C --> D["Dependency-ready nodes"] D --> B["Reserve, commit, or release budget"] B --> V["Candidate and proof results"] V --> E["Separate measured, inferred, human evidence"] E --> F["Mechanical eligibility frontier"] F --> H["Live human selection"] H --> T["Canonical terminal checkpoint"] T --> R["Mechanical release-readiness assessment"] R --> L["Separate live human release"] E --> X["Verified defect or stop condition"] X --> Q["Frozen recovery sequence"] Q --> U["Permitted retry"] U --> B Q --> T
The blueprint specifies the broader stage sequence and controlled-run steps, including human selection, exact-hash approval, and a separate human release: docs/blueprint.yaml:185-244. Its foundation status means that diagram is an architectural target, not evidence of a running autonomous pipeline: docs/blueprint.yaml:1-6.
Gates before judgment
Program, dependencies, and budgets
compileSetProgram() stops an invalid program before work is scheduled; its topological order is a deterministic consequence of the graph, not a permission to make artistic choices: src/contracts/set-program.ts:40-84. findReadyNodes() similarly distinguishes unavailable dependencies from succeeded ones: src/gates/dag.ts:14-28.
The budget state has only candidates, rounds, and automatic repairs. A reservation is part of capacity, so consumed + reserved may not exceed a limit; unused reservations can be released: src/gates/budget.ts:1-49. The blueprint’s reserve-before-dispatch and release-unused-reservation rules are design requirements for a future controller, not proof of a wired dispatcher: docs/blueprint.yaml:360-381.
Evidence and frontier
Evidence kinds remain separate even when merged. Measured evidence, inferred critique, and human records cannot be silently collapsed into one score: src/evidence/separation.ts:13-32. A deterministic blocker excludes a candidate from the root metric frontier; incompatible metrics and dominated candidates are also returned with explicit reasons: src/search/frontier.ts:20-53.
Neither frontier is a vote. The blueprint makes deterministic blockers absolute vetoes, makes inferred findings disclosed but non-voting, and reserves artistic choice for a live human: docs/blueprint.yaml:323-327. The exported snapshot separately encodes the same authority boundary as human_only decisions/approval/release, no blocker override, and modelMaySelect: false: src/contracts/dashboard.ts:48-84; src/adapters/iconloom-ledger.ts:91-119.
Recovery and checkpoints
Recovery is bounded rather than optimistic looping. Its optional controlled mutation requires exactly one verified defect and remaining mutation and candidate budget; quarantine is always the final available step: src/decision/recovery.ts:24-38. The blueprint adds non-negotiable limits: do not rewrite an accepted candidate, reclassify evidence to clear a blocker, override a deterministic blocker, or infer a human decision: docs/blueprint.yaml:383-408.
A terminal record is an auditable statement, not a decision. It binds program/set/phase identifiers, hashes, node states, budget state, separate evidence counts, blockers, frontiers, stop reason, next permitted operation, readiness, and a recording time; canonical serialization sorts these structures after validation: src/decision/checkpoint.ts:23-75. It rejects a release_ready record with blockers and a not_ready record without blockers: src/decision/checkpoint.ts:101-115.
Readiness is not release
The pure readiness function computes vetoes only. It cannot sign, publish, or waive a failing condition: src/release/readiness.ts:43-69. The blueprint makes the distinction explicit: mechanical readiness is neither approval nor release; release requires a live human and exact immutable bytes: docs/blueprint.yaml:410-440.
The snapshot can display readiness and the next legal operation, but its parser rejects an internally inconsistent ready state and does not execute the shown command: src/adapters/iconloom-ledger.ts:97-119; src/app/foundry-cockpit.tsx:793-825.