Evidence-Gated Agentic Development: The Koinessa Brain

Author: Kris Christopher (KrisCodes2) Edition: Ninth edition — verified 2026-08-23 Home: koinessa.com — companion video: "The Future of AI Was Invented in 1974" Status disclosure: Koinessa is a pre-release, founder-operated system. Every capability claim in this paper carries one of four labels — live, in flight, built-but-gated, or planned — and the labels are maintained in a claims register before public copy is written. The claims register and research digest preserve the evidence trail; this public paper states the current evidence boundary directly. Every section of this paper has a permanent URL: each heading links to itself, and the fragment identifiers are stable across future editions.

Abstract

AI systems can now generate code, content, plans, and decisions faster than organizations can safely review them. The binding constraint on applied AI is shifting from generation to trusted acceptance: proving what was done, by which actor, under whose authority, and with what evidence. This paper argues that the techniques required are not new. Fifty years of computing history — the internet's narrow-waist protocol design [1], structured and event-sourced data management [6][7], distributed-systems failure handling [8][9][10][11][12], declarative reconciliation [13], observability [14], zero-trust security [4][5], software supply-chain provenance [15][16][17], policy as code [18], and continuous-delivery practice [19] — map directly onto the problems agentic AI creates. Koinessa applies those techniques as a working system: a federated, single-writer organizational memory (the Brain), a coordination plane that lets agents from multiple vendors work in one repository without collisions, and a delivery model we call Evidence-Gated Agentic Development, in which agents move quickly precisely because the boundaries around them are explicit.

Live. The temporal operational ledger records authority classes, evidence references, supersession, and as-of-time queries. Live. A local Context Compiler rebuilds bounded packets from canonical state, and provider inference is leased to disposable physical sessions. Live with a measured boundary. The Brain has 349 base tables: 335 carry project_id, while 14 shared or infrastructure tables do not. Every external write crosses the single-writer gateway, but the schema is not described as universally tenant-scoped. Built-but-gated. Autopilot remains fail-closed and requires an explicit operator action to re-arm. The architectural result is model-independent: the model session is disposable; the operating system is durable.

This paper presents five planes — organizational state, context, coordination, evidence, and inference — and treats frontier models as stateless, nondeterministic compute workers, never as memory, authority, or truth. External evidence is dated and population-bounded; internal metrics identify their source and snapshot date. There is no claimed whole-task performance multiplier, certification, independent audit, or proof of universal provider neutrality.

1. The verification gap

Modern AI-assisted engineering has an asymmetry problem. A single operator can direct agents that produce hundreds of changes per week, but every change still needs to be reviewed, tested, integrated, and remembered. The organizations adopting agents report a consistent cluster of failures:

• Amnesiac sessions. Each new AI session starts without knowledge of prior decisions, fixes, and failures, so the organization re-derives what it already learned.
• Colliding workers. Parallel agents duplicate work, overwrite each other's changes, or lose handoffs — classic distributed-systems failures wearing new clothes.
• Unproven work. "The agent said it passed" is not evidence. Without deterministic verification and durable provenance, AI-generated changes accumulate risk invisibly.

The economics make the gap structural rather than temporary. Generation cost falls with every model release, while the cost of careful review, integration, and operation falls slowly if at all — so the ratio of produced-to-verified work worsens as adoption succeeds. A team that accepts unverified changes accumulates invisible risk; a team that reviews everything at human speed surrenders the throughput it adopted agents to gain. Worse, the loss is compounding: every unrecorded decision is re-litigated by the next session, every unprovenanced change lengthens the next incident investigation, and every collision between parallel workers burns the exact engineering attention the agents were supposed to free. The way out is not slower generation or braver acceptance. It is infrastructure that makes verification, memory, and coordination cheap enough to apply to everything.

1.1 The gap, externally measured

The evidence supports a verification burden, but only when each result retains its own population and denominator.

• External evidence — acceptance. A binomial GLMM over 9,227 agentic pull requests estimated agent-specific merge probabilities from 43.0% to 84.3%; it did not establish a human comparison [55]. A different, older study reported a 76.8% raw accepted share for human pull requests, which is not comparable to the GLMM result [56]. In a separate 33,596-PR snapshot, 28.52% were not merged; non-merger is not proof of bad code. The reviewer-abandonment subset was 228 cases — 38% of the original 600-PR sample and 40.6% of 562 accessible categorized cases [57]. A 35.7% / 31.2% / 33.1% rejection-cause split applies only to 353 manually inspected rejected PRs [58].
• External evidence — review. Of all 33,596 PRs, 61.38% had no recorded review; among 12,975 reviewed PRs, 58.77% were agent-only. No recorded review is not proof that no human inspected the change [59].
• External evidence — delivery. DORA reports an association between AI adoption, higher throughput, and lower stability; it does not establish causation. DORA's 2026 insight names the resulting operational burden a “verification tax” [25][60].
• External evidence — trust. Among 33,244 respondents to Stack Overflow's 2025 accuracy question, 3.1% reported high trust. Among 31,476 respondents to the separate frustration question, 66% selected “almost right, but not quite”; that response is not a general anti-AI measure [61].
• External evidence — security and maintainability. Veracode's vendor-authored SAST study reports secure code on 55% of tasks; “150+ models” is its cumulative model count, not one new cohort [62]. GitClear's non-peer-reviewed vendor research covers its proprietary 2023-through-YTD-2026 dataset and a moved-code proxy; it does not establish that AI caused the reported maintainability patterns [85].
• External evidence — benchmark integrity. ImpossibleBench reports a 76% GPT-5 cheating rate on Oneoff-SWEbench under the full scaffold. Making tests read-only prevented direct test edits but yielded no universal percentage. A separate human-escalation escape route produced the 54-to-9 result [63]. SWE-Bench+ reports 32.67% and 31.08% only among 251 successful SWE-Agent-plus-GPT-4 patches screened in that study [64].
• External evidence — self-report and tests. The developer-resolution study found 16,118 episodes. Of 1,504 with visible resolution, 91.49% resolved after explicit developer pushback [65]. In a separate study of 2025 test commits, agent-authored commits added mocks in 36% of cases versus 26% for non-agent commits; this is a commit-level result, not a repository-wide rate [66].
• External evidence — time horizon. METR estimates human task duration at specified model success probabilities, not continuous agent wall time: about 12 hours at 50% success with a 5–61 hour interval, and about 1.5 hours at 80% with a 50-minute–2-hour- 40-minute interval [67]. AgentFloor is a deterministic, synthetic, read-only benchmark of 30 tasks; it does not demonstrate safe repository edits or production operations [68].
• External evidence — context and retrieval. In one read-only Python-repository QA study, semantic retrieval cost $0.32 per correct answer versus $0.74 for Deep: Deep was about 2.3 times as expensive and semantic was about 57% cheaper. The maximum 22.4-times token difference applied to Qwen3-235B [73]. Coordination breakdown accounted for 41.8% of Deep failures; within that category, 91% still emitted fluent, confident prose [73]. Codebase-Memory reported 83% versus 92% quality, about ten times fewer tokens, and 2.1 times fewer tool calls, while retaining an exploration fallback [74].
• External evidence — token economics. The 85.6% figure is a derived share of input-side processing — uncached input, cache creation, and cache reads — in a worked cost example; cache reads alone were about 51% [70]. A separate eight-model OpenHands/SWE-bench Verified study measured roughly 1,000-times token differences and up to 30-times same-task variance; it does not generalize to every workflow [71].
• External evidence — long context. NoLiMa found that 11 of 13 models fell below half their short-context baseline by 32K, while GPT-4o moved from 99.3% to 69.7%; these are benchmark-specific results, not a universal conclusion about advertised windows [72]. Current long-context prices are model-specific: GPT-5.6 above 272K [75], specified Gemini Pro models above 200K [76], and Claude 4.6-and-later plus Mythos Preview at standard one-million-window rates [70][92].

The market's dominant answer — a more capable model — does not address any of these, because none of them are intelligence problems. They are systems problems: identity, state, ownership, timing, failure, authority, observability, and proof. The thesis of this paper: models create possibilities; systems determine outcomes.

1.2 The common root

Trace any of section 1.1's failures backward and they meet at one absence: AI currently has no durable, independently verifiable definition of organizational truth and successful completion. No durable truth, so sessions need huge context; huge context, so compaction and context rot. No precise knowledge index, so greedy exploration. No cross-session truth, so every swarm relearns everything. No organizational state in the loop, so business policy is re-prompted folklore. State living inside vendor sessions, so lock-in. No formal completion contract, so agents wander or stop early; no independent acceptance criteria, so slop looks complete. No common control plane, so vendors cannot cooperate; no workload decomposition, so every task seems to need a giant model. No authoritative grounding, so hallucinations become operational facts; no independent evidence, so the system cannot distinguish a confident lie from reality; no earned-authority model, so automation cannot safely be trusted — and everything above reloads context, so token cost explodes.

The strongest form of this paper's thesis is therefore not "AI needs better verification." It is: frontier models should be treated as stateless, nondeterministic compute workers — not as the operating system, the organizational memory, the authority source, or the source of truth. The sections that follow are the systems consequences of taking that sentence seriously.

2. Seven lessons from fifty years of systems

2.1 The narrow waist

The internet scaled because its middle contract stayed small: many applications above IP, many networks below it, one stable interface between [1][23]. The AI ecosystem is re-discovering this shape. The Model Context Protocol standardizes how a model-driven application reaches tools and context [2]; the Agent2Agent protocol addresses communication between independent agents [3]. Connectivity, however, is the easy half. The internet standardized packet delivery without solving identity, fraud, or trust — and agent protocols will repeat that pattern unless identity, authorization, reputation, and policy are built above them. The 2026-07-28 MCP HTTP authorization framework is optional and OAuth 2.1-based [77]. A2A 1.0 Agent Cards may be JWS-signed; verification with a trusted key can establish card integrity and provider origin, but signing is optional and is not a global agent identity system [78]. What remains incompletely standardized is delegated authority across agent chains — capability attenuation, work-item authority, policy inheritance, revocation, evidence provenance, replay protection, reputation, and end-to-end accountability from principal to agent to tool to outcome. A May 2026 arXiv v1 snapshot found flaws across 119 testable real-world OAuth-enabled MCP servers; it does not establish a universal property of MCP deployments [79]. Live. Koinessa exposes 366 registered tools behind one search contract (section 3.8). Local Ollama, Ollama Cloud [83], and frontier workers discover capability through that same local contract, and the waist has now been exercised by an arrival: the sixth provider descriptor (Devin CLI, section 3.6) registered onto an existing transport kind with no new transport code and reached the same tool contract through one configuration stanza. External evidence. The vendor's own topology points the same direction: Devin's Outposts run "command execution, file edits, and repository access" on machines the customer operates over outbound-only HTTPS while the agent loop stays in the vendor's cloud [96], and since 2026-07-31 its MCP tools execute from the vendor's servers rather than the session's machine [97] — placements that make the seam between capability discovery and organizational state exactly the boundary this section argues must be owned locally.

2.2 Memory must have structure

A transcript is not memory. An operational memory must answer: where did this come from, when was it true, has it been superseded, what evidence supports it, and who created it? Event sourcing keeps the history that produced current state [6]; CQRS separates broad read paths from narrow, audited write paths [7]. Koinessa applies both. Live. Agents read through the Brain gateway, while every external write crosses its single-writer boundary. Retrieval is lexical, vector, and graph-based over the same store. The 2026-08-23 snapshot contains 17,903 Koinessa symbols (last indexed the same day) and 54,201 symbols across the federation's twelve lanes; the production Desktop line federates under the same product key (section 8.7), and a 7,762-symbol remnant lane from its pre-consolidation development loop remains frozen as stored.

Live. The temporal operational ledger (BRN-002, implemented 2026-08-07) records authority classes — a signed pipeline result outranks an agent's claim — evidence references, supersession links, and as-of-time queries: what did we believe when this decision was made, and what superseded it?

The as-of question sounds academic until the first serious incident review. When a production defect surfaces, the useful question is rarely "what is true now" — it is "what did the system believe at the moment the change was authorized, which evidence was available then, and which later fact superseded it." A memory layer that can answer that converts postmortems from archaeology into queries, and it is the difference between an organization that learns and one that merely accumulates text.

2.3 Partial failure is normal

Distributed systems assume components fail independently, and agent systems inherit every one of those modes: a session dies after modifying files but before reporting; a tool call times out after succeeding; two workers believe they own the same resource. The correct stance is to treat every agent as a worker that can be slow, stale, duplicated, interrupted, or wrong — and to use the classical controls: heartbeats for liveness; leases that expire rather than locks that deadlock [8]; fencing tokens so a stale lease-holder cannot overwrite newer work [9] — the scenario is worth spelling out once, because it is the canonical agent-swarm accident. Agent A takes a lease numbered 41 on a work item and stalls. The lease expires; Agent B takes lease 42 and finishes the work correctly. Agent A eventually wakes and attempts to write its stale result. Without fencing, A silently overwrites B; with fencing, the protected resource remembers that 42 is the newest valid token and rejects 41. Stale authority must never become current authority, and no amount of model intelligence substitutes for that check — idempotency keys so retries cannot double-execute consequential actions [10]; transactional outboxes so state changes and their notifications cannot diverge [11]; and sagas with compensating actions for workflows that cross irreversible boundaries [12]. Live. Session registration, cooperative file claims, and fenced work-item leases let interactive workers from six vendors — Kimi, Claude, Grok, Codex, local Ollama, and Ollama Cloud [83] — share one board; the session registry holds 209 registered sessions, 208 of them since August 1. A seventh vendor, Devin, is registered as the sixth provider descriptor and remains disabled behind a committed guard (section 3.6). Attribution has a measured boundary: a provider label is captured on a minority of session rows (8 of 209 at this snapshot), so per-vendor attribution rests on commit trailers — 18 distinct worker identities since July 1 — which are not universal. The 2026-08-23 git snapshot contains 100 mainline commits from August 19 through August 23, 691 from August 5 through August 23, and a peak of 84 on August 13. Live. Two human operators on separate LAN workstations can direct independent swarms against the same repository through the same coordination plane; that receipt is operating evidence from one system, not a controlled benchmark.

2.4 Declare desired state and reconcile

Kubernetes replaced "run this and hope" with a controller loop: declare desired state, observe actual state, act to reduce the difference, repeat [13]. Agentic work should be governed the same way. A requirements document declares outcomes; work items bound obligations; verification profiles declare required checks; evidence schemas declare the proof that must exist. The controller then compares observed state against declared requirements — coverage exists or it does not; the artifact matches its schema or it does not — instead of asking the agent whether it is finished. This converts vague autonomy into measurable convergence, and it makes observability the load-bearing wall: the trace expands from request-level spans [14] to decision provenance — business goal to requirement to agent session to tool calls to commit to pipeline to evidence to approval to outcome.

Reconciliation also supplies the missing regulator for agent throughput: backpressure. When a downstream system slows or fails, controllers reduce work, queue it, or stop — whereas naive automation converts a small outage into a flood of retries and duplicate actions. And once every operation carries a durable identity from intent to outcome, reliability becomes computable by agent, model, task class, repository, and toolchain. Model selection then stops being brand preference and becomes an evidence question: which model succeeds most often on this repository, which produces the fewest repair cycles, which overclaims completion. That is how a system improves itself without ever letting the AI approve itself.

2.5 Sign what happened

Supply-chain security reframed builds around provenance: verifiable statements about where, when, and how an artifact was produced (SLSA [81]), attestation formats for supply-chain claims (in-toto [82]), and accessible signing and verification (Sigstore and Cosign [17]). These mappings do not confer a SLSA level or trustworthy provenance without verified trust relationships, just as an SSDF mapping does not confer NIST certification [80]. Agentic development needs the same discipline extended backward into source provenance: which requirement initiated a change, which agent wrote it, which context influenced it, which policies constrained it, which repairs modified it, and which human approved it. Git records what content changed; the system around it must record why it changed, under whose authority, and with what proof. The evidence bundle for an agent-produced change (designed under EGD-001) binds the source revision, the agent session and model, the work authorization, the tool versions, the checks executed with their canonical states, the policy profile that interpreted them, the approvals, and the final artifact digest — one chain from intent to deployment. The ledger boundary is stated rather than implied: the CI pipeline builds and signs evidence manifests as jobs (live where those jobs run), while the Brain-side bundle, sufficiency, outcome-evidence, delegation, and conformance ledgers — writers and tests in place — held zero rows at the 2026-08-23 snapshot (built-but-gated). An issuer-neutral external-attestation rail — third-party signed receipts ingested as first-class evidence, the issuer's verdict stored verbatim, verdict-to-state mapping fail-closed so an unverified success is never a pass, keys pinned on first use and frozen per receipt, and invalid receipts stored rather than dropped — is specified and in review (planned). Equally important are canonical result states: a pipeline that only knows green and red will misclassify a missing scanner as a clean scan. Koinessa's verification model distinguishes PASS, FAIL, SKIPPED-NOT-APPLICABLE, INFRASTRUCTURE ERROR, TOOL MISSING, and EVIDENCE INVALID (live). A seventh state — ABSTAIN-SPEC-CONFLICT, a rewarded, first-class route for an agent to declare that work cannot legitimately be completed under its current specification — shipped with EGD-002 (live, 12/12 stories closed 2026-08-15): the measured alternative to a legitimate exit is gaming, and an explicit infeasibility path produced a 54-to-9 result in a separate experiment [63]. The 2026-08-23 repository inventory contains 1,614 git-indexed test or specification files; that inventory does not claim that the suites were rerun.

2.6 Protect the objective

Optimizing systems learn to satisfy the measurement rather than the goal — Goodhart's law [20]. In agentic engineering the canonical failure is the repair agent that deletes a failing test to make the pipeline green. Koinessa's local repair loop (Ralph, live) is therefore bounded by construction: it may fix code, configuration, routing, or infrastructure, and it may not lower thresholds, remove meaningful tests, disable scanners, or convert required checks into advisory ones. The rule generalizes: the optimizer must not control the definition of success. Model improvement follows the same logic. In a champion-challenger arrangement, the current best model for a task class stays in service while alternatives run in shadow mode or on selected low-risk work, judged by the same independent criteria — verified success rate, cost per accepted change, repair cycles, human-intervention rate, regression rate after deployment — so a human may promote a claim only after reviewing measured evidence; an agent may assist research but cannot promote it. And high-impact behavior earns authority through simulation first: a publishing agent validates actions without sending them, a deployment agent produces the plan without applying it, a repair agent patches an isolated workspace and passes verification before any shared state changes. Aerospace, networking, and finance all learned the same sequence — test under controlled conditions before connecting the controller to an irreversible surface.

2.7 Data is not instruction

Retrieval-augmented agents create a new attack and accident surface: anything that can reach the context — an internal document, a tool result, a webpage, a customer message — can carry text a model may misread as authority. An attack paper scopes those risks to MCP v1.0, while current specifications provide security mitigations [90][91]. Untrusted server and tool content still requires client validation, isolation, and authorization. The systems answer is a boundary the model never gets to infer linguistically: provenance and authority must be structural fields on context, not properties a model guesses from prose. Policy must be distinguishable from documentation, verified operational fact from agent observation, company-approved research from an external webpage, tool result from instruction. In Koinessa, every context-packet source already carries a typed authority class (operator, verified, evidence, agent, inferred, unknown) with per-section provenance (live); EGD-002 hardens the boundary (live, closed 2026-08-15): an external-untrusted class, compile-time rejection of packets whose policy or constraint sections claim non-privileged authority, render-time fencing that marks low-authority content as data, never instructions, and evidence-gated memory admission with contradiction checks at write time. A hallucination in a session is temporary — a hallucination admitted into organizational memory contaminates every future session that recalls it, which is why admission is now a gated write rather than a courtesy.

3. The Koinessa Brain architecture

The Brain is the memory-and-coordination substrate of Koinessa.

3.1 Federated store

Live. On 2026-08-23, one DuckDB database held 346 base tables and 21 views (27 of the base tables are retained migration backups). Of those base tables, 333 carry project_id; 13 shared or infrastructure tables do not. Tenant scoping is therefore measured per relation rather than assumed universally. The claims register is the source of truth for these drifting counts. A full identity-key migration (47 tables, 110,811 rows) was executed live with zero corruptions using full-table rebuilds — never in-place key updates — a working example of the risk-tiered ceremony this paper advocates.

3.2 Single-writer gateway

Live. All external writes cross one HTTP gateway: reads are token-free only when the gateway is bound to the loopback interface — on any other bind, reads require a bearer-identified principal exactly as writes do — writes and transactions are bearer-gated through a single writer mutex, work-item leases carry fencing tokens, and hybrid search and graph traversal ride the same surface. The narrow write path is a scar-derived design: an earlier in-place primary-key update corrupted the write-ahead log, and recovery worked only because snapshots and log replay were designed before the failure.

3.3 Coordination plane

Live. Sessions register and heartbeat; file claims detect collisions cooperatively; work items carry leases and fencing tokens; durable messages carry acknowledgment requirements; checkpoints and handoffs let a successor session — any vendor — resume without chat history. This is the infrastructure behind the multi-vendor receipt in section 2.3. The nine-role review and planning workflow layered on top — CEO, engineering-manager, designer, QA, security, release, browser-operator, and memory-support agents that gate and refine work before implementation — ports Y Combinator president and CEO Garry Tan's open-source gstack skill-based engineering framework [53] into this coordination plane (GTR-001, implemented), adopted to close a self-diagnosed planning gap rather than to route around any single vendor's harness.

3.4 Memory with provenance

Live. A decaying fact store captures decisions, fixes, and failures automatically from CI, repair, and session events, with ranked recall injected at session start. The temporal ledger (BRN-002) adds authority classes, verification-evidence links, supersession, and as-of-time queries — all live as of 2026-08-07. Alongside the fact store sit the retrieval surfaces agents actually work through: hybrid lexical-plus-vector search, graph traversal over entities and relationships, the 17,903-symbol code-intelligence index on this lane (54,201 across the federated fleet), and a curated research corpus of 5,351 documents — unchanged since 2026-08-18 — that agents are required to consult before the open web — so marketing and strategy answers stay traceable to sources the company chose.

3.5 Context Compiler and leased inference

Live. The AOE-001 layer (implemented 2026-08-10) treats context and frontier-model inference as schedulable resources. A Context Compiler assembles a bounded, provenance-bearing Context Packet for each physical model session from canonical state: the approved requirement, current Git state and diff, authoritative Brain facts, code symbols and precise source ranges, current ownership, the latest checkpoint, current verification evidence, applicable policy, and the model/context budget. A logical work item may span many short physical sessions — session A -> checkpoint -> session B -> checkpoint -> verified completion — and no physical session owns the truth. Provider inference is leased: a logical worker holds no upstream slot while it runs local tests or CI, so logical swarm size stays independent of a provider's concurrency envelope. Verification, not the generator's narrative, is the stop condition. The compaction design position is that unpersisted detail can be lost when messages are compacted [50]. The invariant is stronger than “do not compact”: no lossy conversational summary is ever the authoritative copy of organizational state, so the Compiler can always rebuild a session's context from canonical state instead of from whatever a summary happened to keep.

3.6 Unified provider layer

Built-but-gated. Six provider descriptors — Kimi Code, Claude Code, Codex, Grok, local Ollama, and Devin CLI — are registered behind one typed shape and three session transports, and every one of them is disabled. That sentence is the design working as intended, and it deserves unpacking. A provider descriptor carries everything vendor-specific as data: the transport kind, a SHA-256-pinned binary and probed CLI version, a credential probe that checks file presence and never reads contents, per-model context windows with a four-value provenance vocabulary (measured, probed, vendor-documented, unverified stand-in), per-model context-packet budgets scaled from one measured calibration, a concurrency triple, a quota shape, and a fail-closed enabled flag. Unprobed fields carry an explicit marker that no gate accepts, so a descriptor registered before its binary was ever run fails preflight closed instead of passing on plausible defaults. The three transports — one for pinned vendor CLIs, one for metered HTTP vendors whose real key never leaves the server, one for GPU-lease-gated local models — implement a single session-transport contract with eight named preflight failure kinds and secret-free results by construction. Adding the sixth descriptor required no new transport code (section 2.1). Enabling any descriptor is an operator decision that additionally requires a per-vendor boundary drill, because one vendor's tool-profile mechanism proves nothing about another's. The managed-session layer therefore has receipts as code and tests, not yet as operating history: the multi-vendor coordination receipts in section 2.3 come from interactive sessions governed by hooks and the coordination plane, not from this launcher.

A local arbiter (built-but-gated: off by default, no production caller) may advise the deterministic session-reset policy, and its advice lattice is monotone toward caution as data, not convention: a continue decision may tighten to finish-current-only or checkpoint-and-yield; terminal decisions accept no advice at all. A wrong or hallucinating local model can waste a session; it cannot keep one alive past a hard context limit, a revoked lease, or exhausted quota. The optimizer, again, does not control the definition of success (section 2.6).

The sixth descriptor is also the worked example of onboarding a provider without extending trust ahead of evidence. Devin's CLI operates on the local working tree while its inference runs in the vendor's cloud [94]; it reads the same instruction files as the other harnesses, including the Claude-compatible ones [95]. Before any enablement, Koinessa committed a deny-all guard — a configuration that denies every tool class and a pre-tool hook that blocks with a machine-readable refusal — and proved it with an in-tree canary: the session's only tool call was refused, and a planted marker never left. Registration followed a kill gate (does the vendor's plan actually serve headless sessions), and the data-governance precondition was verified rather than assumed: the vendor's terms state that customer data may be used for model training and that paid service tiers may opt out, after which zero-data retention is enabled with its model providers [93]; the operator moved to a paid tier and confirmed the opt-out before the first governed probe (operator-reported, 2026-08-23). The guard's boundary is stated with the same care: it governs this working tree's CLI lane; a vendor cloud session operating on its own clone of a repository is governed by repository rules and provider-side controls (section 10). Deeper integration — coordination-plane registration, transcript ingest of the vendor's per-turn exports, usage metering, and a least-privilege policy replacing deny-all behind an operator-approved enable drill — is specified and in review (in flight).

3.7 Transcript compaction across vendors

Section 3.5 argued that a conversational summary must never be the authoritative copy of organizational state. The compaction layer (delivered 2026-08-22) turns that position into per-vendor machinery, and the honest description is a table, because the wiring is uneven:

The bridge itself is vendor-neutral by data: the compile request carries a provider id validated against the descriptor registry, and per-provider synthetic-id prefixes are a lookup table with one legacy exception, not a branch. Admission into organizational memory is idempotent on a content-derived message key — live since 2026-08-22, and proven the unglamorous way: re-posting a 324-frame transcript added zero rows, where the previous key had amplified one conversation by three orders of magnitude. A fail-loud freshness monitor watches the ingest path, because every transcript writer in this system is fail-open and each had, at least once, died silently. The local-GPU transcript compactor and its digest table are live as code; the digest table held zero rows at this snapshot, and the paper says so rather than implying a populated ledger.

3.8 Tool registry and the single search contract

Live. The registry holds 366 tools — 137 API routes, 104 skills, 91 scripts, 29 agents, 3 CI components, 2 MCP servers — behind one two-level search contract: a ranked search that returns terse rows, then a per-tool detail fetch whose invocation block is data (transport, command, arguments, endpoint), never inferred from a name. Filters (kind, capability, retrieval mode) apply before ranking; hybrid keyword-plus-vector retrieval degrades gracefully to keyword-only for tools never embedded; and container-image entries are answered by a live join against the image catalog rather than a re-ingested copy. Every vendor reaches the same contract through the same local MCP surface: the Claude and Kimi harnesses register it in their tool configuration, Grok through the repository's MCP registration, and — in a guarded sandbox — the Devin CLI reached the identical endpoint with only a configuration entry. What stays vendor-specific is one registration stanza per harness; the contract does not change.

3.9 Durability and degraded mode

Live, with a stated boundary. Knowledge admission is queue-backed: a durable ingest queue with retry and an outage spool means nothing is lost when the writer is busy or down, and external writes take an automatic snapshot first. The stronger 2026 lesson is that the host itself is hostile: the machine serving the Brain lost power sixteen times in fourteen days, and two of those cuts tore the database's main file — one of them while nothing was watching, producing a multi-day crash loop against a newest snapshot that was ten days old. The response (live — landed in code and tests on 2026-08-23 and running in the gateway process since its cutover to a native Windows service on 2026-08-24) treats a crash as a cost measured in seconds: checkpoints every sixty seconds or fifty writes; three corruption classes handled distinctly — a transient file lock is retried, an un-replayable write-ahead log is quarantined, a torn main file is restored automatically from the newest importable snapshot into a staging path and atomically promoted; the recovery writes its own audit row into the restored database before promotion, so a restore and its record are inseparable; and when no snapshot imports, the gateway refuses to start with a dedicated exit code its supervisor treats as stop-not-restart, because serving an empty brain would be worse than serving none. Degraded-mode legibility is the drafted next step (planned): today a restarting gateway, a running restore, an unrecoverable file, and a plain query bug still present one indistinguishable error to every consuming surface, and the design goal is that each names itself. Institutional memory that cannot survive a crash is not institutional memory — and a system that hides which failure it is having has not finished learning that lesson.

3.10 What the Brain is not

It is not a SaaS: the deployment model is customer-controlled infrastructure, with cloud capacity as an explicit, bounded exception. It is not multi-writer: that limit is stated rather than hidden. And it does not replace Git or CI — it binds them to intent, authority, and evidence.

3.11 Five planes

Design position. Koinessa is described as five distinct systems rather than “an AI operating system with memory”: an organizational state plane (business facts, requirements, policies, decisions, code intelligence, temporal state and provenance); a context plane (retrieve and compile the smallest authoritative packet the next worker needs); a coordination plane (identity, leases, fencing, ownership, checkpoints, handoffs, retries, multi-vendor scheduling); an evidence plane (independent verification, protected test definitions, attestations, policy evaluation, risk-tiered acceptance, post-deployment evidence); and an inference plane (local Ollama, Ollama Cloud [83], cheap cloud, and frontier models treated as leased workers selected by measured capability and cost). Provider interchangeability is a design goal supported only where code and runtime receipts exist. The invariant that binds the planes: inference may fail, disappear, hallucinate, compact, change vendors, lose its session, exceed its context, or become too expensive — without the organization losing state, authority, evidence, or control.

4. Evidence-Gated Agentic Development

Evidence-Gated Agentic Development (EGAD) is a software-delivery model in which AI agents produce and integrate small mainline changes, while commit, push, promotion, and release authority remain constrained by deterministic verification, signed evidence, policy gates, and human-controlled exceptions.

The operating loop has ten stages, and each exists to kill a specific failure mode: observe current system and business state (no work from stale assumptions); recall prior decisions, fixes, and failures from the Brain (no re-deriving what the organization already paid to learn); plan bounded work with declared verification requirements; claim ownership through leases and file claims (no silent collisions); compile context — build the bounded Context Packet from canonical state (no session inherits a transcript as its memory); execute inside the claimed boundary; verify with deterministic tools emitting canonical result states; approve consequential transitions per policy, with humans holding the exceptions; ship and observe the deployed outcome, not just the merge; and learn — write the verified outcome back into memory where the next session's recall will find it. Three properties distinguish the loop from "autonomous coding":

1. Authority derives from state, not confidence. An agent's report that work is complete changes nothing; the evidence bundle attached to the current commit does.
2. Capabilities are rungs, not a switch. Generate, stage, commit, push, merge, promote, and deploy are separate delegable capabilities, expanded per task class from verified history — trunk-based small batches [19] make each rung cheap to check.
3. Verification is independent of generation. Deterministic tools, separate models, or humans evaluate; the generator never grades its own work (section 2.6), and policy — encoded as versioned, testable rules rather than prompt text — decides whether the evidence satisfies the profile [4][5]. OPA is one source for the general policy-as-code pattern [18]; Koinessa does not claim to embed OPA.

Live. The loop is risk-adaptive end to end (AAV-001, implemented 2026-08-12). Every work item carries a machine-readable risk tier (R0-R3) that deterministically derives its verification profile and approval policy. R2/R3 work cannot even be claimed without a schema-valid task brief — the conversation-to-contract gate, enforced inside the claim's compare-and-set — so exploratory conversation can never slide into high-risk implementation. The evidence manifest accepts domain-pluggable evidence, with firmware/hardware (simulation, formal checks, HIL, toolchain and board identity) as the first extension beyond software CI, under the rule that compilation is not proof. And verification debt is itself measured: defect-escape, review-load, rework, and lead-time metrics land in the same warehouse as every other receipt. Koinessa aligns with several process-control principles articulated by Agentic Agile-V [86]: conversation discovers intent, structured artifacts drive implementation, and evidence gates acceptance. This is alignment, not independently proven equivalence or convergence.

5. Risk-tiered autonomy

Autonomy should expand by proving which classes of action can be delegated under which controls — never by declaring a system autonomous. The platform carries two machine-readable tier axes, and they measure different things. Every work item carries a verification tier R0-R3 (AAV-001, live) that deterministically derives its required gates, brief requirement, and approval policy; every action class carries an action tier 1-4 (EGA-001, live) grading blast-radius from reversible to irreversible, evaluated fail-closed by versioned policy. They are two axes of one discipline — what rigor this work item owes versus how dangerous this action class is. The prose tiers below are the action axis, with the nominal work-item correspondence in parentheses; EGD-002 removes the residual type-name collision in code and pins the crosswalk as a tested module.

• Action tier 1 (R0) — reversible, low-impact (documentation, generated indexes, formatting, research): broad automation once evidence is complete.
• Action tier 2 (R1) — bounded engineering changes (small code changes, dependency updates, internal refactors, test generation): deterministic gates, human review at selected boundaries.
• Action tier 3 (R2) — consequential external actions (production deployment, data deletion, paid media, customer communication, financial transactions): limited credentials, explicit approvals, idempotent execution, tested rollback.
• Action tier 4 (R3) — irreversible or safety-critical actions: human-authorized, potentially with independent review, simulation, or formal analysis.

Tier boundaries are only credible when crossing them costs ceremony. A working example from this system: renaming the identity key stamped on every row of the Brain — part of the primary key in many tables — was executed not as one UPDATE statement but as forty-seven sequential full-table rebuilds (build, bulk-insert, atomic rename, checkpoint, verify), 110,811 rows re-keyed live with zero corruptions, precisely because an earlier in-place key update had corrupted the database. The ceremony is not overhead; it is why the system is still running. Promotion between tiers should likewise be earned with measured criteria — collision rates, stale-worker rates, verified success rates, human-intervention frequency, rollback effectiveness — recorded per activation, never granted because the system has been quiet lately.

Koinessa's Autopilot path — the machinery that takes an approved requirements document through implementation to a verified green pipeline — is built-but-gated: it has run supervised live drills end to end, and its ruling-locked posture is fail-closed, with re-arming an explicit operator action. We consider that posture a feature. Systems should earn authority from operating history, and the earning process should be boring.

6. Business value I — cost advantage: local-first by architecture

The first cost advantage is structural, not negotiated: Koinessa runs on infrastructure the operator already owns.

6.1 Local-first execution

Live. The Brain is a local DuckDB file behind a local gateway. The verification engine runs on a local k3s cluster with a local Zot image registry — more than 69 deterministic jobs execute without purchasing cloud CI minutes. Local models (Ollama-hosted, e.g. a 27B instruct/coding model on the operator's GPU) perform bounded work — context compilation, drafting, log reduction, failure classification — at zero marginal provider cost. Ollama Cloud [83] is the next rung on the same ladder: Ollama states that model execution is automatically offloaded to its cloud service while callers may keep using Ollama interfaces. Frontier cloud models (Claude, Grok, Codex, Kimi — with Devin registered and disabled, section 3.6) remain leased capacity for work that justifies that intelligence, not the default path for everything. External measurement now supports making this a first-class principle rather than a cost hack. AgentFloor is a deterministic 30-task, synthetic, read-only tool benchmark; its results do not prove safe repository edits or production operations [68]. E2B means effective parameters: Gemma 4 E2B advertises sub-2GB mobile base weights, while Gemma 3n E2B reports about a 1.91B effective-memory load [88][89]. The design rule is: do not build a local replacement for a frontier model — decompose the workload until only a small fraction requires frontier intelligence, and escalate along the ladder (micro model, small local, larger local, cheap cloud, frontier) on demonstrated capability, never on brand.

6.2 Local compute does the context management

Live. The AOE-001 design rule is that the cloud model has working memory while Koinessa has project memory. Deterministic reducers and local inference assemble, compress, and format context before a frontier model ever sees it. The operator's measured 30-day workload (2026-07-11 through 2026-08-09) shows why this matters: of 18,284,233,434 total tokens, 17,088,709,895 — 93.46% — were cache reads: history being re-carried, not new work being done. List-priced, that window estimates at $13,910.58. Every token of context assembled or reduced locally is a token the frontier provider does not bill.

6.3 Retrieval first

Live. Agents do not begin by exploring the codebase with grep, sed, and hopeful file reads. The code-intelligence index (Doxygen-ingested, 17,903 symbols for this project alone in the 2026-08-23 snapshot, last indexed the same day) answers “which file, which lines, what exact signature, which files depend on it" as one DuckDB query — milliseconds, with a result small enough to paste into a context packet. The same is true for institutional knowledge: PRDs, requirements, policies, decisions, and provenance records are tables and documents in the Brain, retrievable by SQL and hybrid search, instead of being re-derived from chat history or scattered across a wiki. The standing rule for agents is retrieval-first: symbol index and LSP for code, Brain query for knowledge, grep only as the declared fallback — and the rule is now machine-enforced, not aspirational: a pre-tool hook refuses identifier lookups by text search across the Claude and Kimi harnesses and answers the refusal with the exact index query to run instead (live). The index also has a receipt from a harness Koinessa does not control: in a guarded sandbox probe (repository receipt, 2026-08-23, one question on one paid-tier session), the Devin CLI answered a symbol-location question through the Brain's symbol index in four seconds — 44,496 prompt tokens, 42,752 of them cache reads, 329 completion tokens, eleven steps, no text search and no source read — where the same question routed through language-server tools cost 171,317 prompt tokens over sixteen steps, roughly four times the token cost. One question, one harness, one day; it is quoted as a receipt, not a benchmark.

External measurement brackets this choice from both sides. In one read-only Python-repository QA study, semantic retrieval cost $0.32 per correct answer versus $0.74 for Deep; Deep was about 2.3 times as expensive and semantic was about 57% cheaper. The largest token gap, 22.4 times, applied specifically to Qwen3-235B [73]. A separate structural code-graph system reported 83% versus 92% quality, about ten times fewer tokens, and 2.1 times fewer tool calls, with exploration retained as a fallback [74]. The counterposition is real and worth stating plainly: Anthropic tried a retrieval index inside early Claude Code and removed it in favor of agentic search, citing staleness, privacy, and reliability. Those are architectural objections, and this architecture answers them — the index is local-only, never leaves the machine, and is refreshed per commit by the same hooks that keep evidence current; grep remains the declared fallback rather than a banned tool. Retrieval-first is a cheap first hop, not a doctrine of index-replaces- search.

7. Business value II — measured retrieval and context economics

There is no observed whole-task or 70-times result. The external studies and internal receipts measure non-equivalent components, so they are not multiplied. Any future internal projection must declare assumptions and use either a measured sequential factor or a weighted equation. It remains a conditional design calculation, never a benchmark.

The current bounds are useful without a compound headline:

Live. The Context Compiler and retrieval-first path are intended to reduce repeated context carriage and exploration. The telemetry identifies where cost accumulated; it does not prove how much a counterfactual workflow would have spent. The controlling KPI is verified work per dollar, attributed per work item and interpreted with task quality, acceptance, and human-review cost intact.

Compacted messages remain in active context only in summarized form and are recoverable in full only when separately persisted. Lossiness is an inference about unpersisted detail, not a claim that every durable log is destroyed [87]. NoLiMa's benchmark-specific 11-of-13 and GPT-4o 99.3-to-69.7 results provide another bounded reason to keep canonical state outside the model window [72].

8. Business value III — better and faster

Cost is the floor; control is the multiplier.

8.1 Provenance and governance

Live. Every consequential action carries a chain from intent to outcome: requirement, work item, principal, agent session, model, files, commit, pipeline, evidence, policy decision, approval, deployment, operational result (sections 2.4–2.5). The temporal ledger answers "what did we believe when this was authorized" as a query. Governance is not a slide deck; it is a table you can audit.

8.2 IAM-type policy, zero-trust internally

Live. Identity is separated the way mature IAM systems separate it: principal identity (who is operating), tenant/project identity (whose resources are in scope), agent/session identity (which worker is acting), work authority (which bounded task it owns), capability authority (which action classes it may perform), provider identity, and evidence identity. The identity slice went from design to code in August: sessions carry a principal, permissions are evaluated against versioned policy with persisted decisions [18] rather than prompt text, gateway quotas and write scopes attach per principal and per table, the audit and event ledgers stamp the acting principal, and the gateway can require a principal outright. Network presence is not authority — a LAN connection grants no implicit trust, per zero-trust doctrine [5]; reads themselves are bearer-identified on any non-loopback bind (section 3.2). A worker may be able to reach a resource while lacking the policy authority to use it, and both facts are checked.

8.3 Multi-tenant design — three separate properties

Storage scoping, concurrent operators, and inference-provider choice have different evidence boundaries.

1. Data tenancy (in flight). Of 346 base tables, 333 carry project_id and 13 shared or infrastructure tables do not. Every external write crosses the single-writer gateway, where identity and scope are enforced, but this paper does not infer universal tenant isolation from a partial schema property. TEN-001 is in flight at 78% and MTC-001 at 81% in review; external-principal hardening remains incomplete.

2. Concurrent operator tenancy (live). Two people — the founder and a second operator — routinely do work at the same time on the same repository, from two different PCs on the same local-area network, each directing their own agent swarms. The Main PC serves the Brain gateway and the local Ollama daemon; the second workstation is a first-class LAN client of that host, not a copy of the database. File claims, work-item leases, and fencing tokens are what make that safe: the coordination plane does not care which human, which vendor, or which physical box the worker sits on. This is an operating property a two-person team uses. It is also the property a larger team is buying when they buy the control plane — not a promise that two chat windows can be open, but a demonstrated fact that two humans plus many vendor swarms can share one mainline without colliding.

3. Inference-plane portability (live where receipted; broader neutrality planned). The same board, the same leases, and the same evidence gates accept interactive workers from Kimi, Claude, Grok, Codex, custom local Ollama models, and Ollama Cloud [83]; a seventh vendor, Devin, is registered as a descriptor and disabled (section 3.6). Current runtime receipts come from those interactive lanes; the managed transport layer that would make a provider swap configuration-only is built-but-gated with no descriptor enabled. A provider swap is an internal design goal, not externally proven neutrality or a promise that every provider is configuration-only.

The consequence for buyers: tenant isolation, concurrent-operator safety, and model neutrality are verified the same way code is — as evidence, per the six-state result model — not as a contractual promise.

8.4 Disconnected control-plane operation

Built-but-gated. The local control plane is designed to remain available if a model provider changes terms, the internet is unavailable, or the work must run in a closed environment: the Brain, gateway, coordination plane, verification engine, image registry, and CI runners are local, and local models can continue bounded work. Clean-machine and provider-specific acceptance still govern production claims.

8.5 What the Brain measures

Live receipt, 2026-08-23 snapshot. No whole-task productivity multiplier is claimed. The Brain, board, and indexed repository provide the following direct counts (each mutable counter carries its snapshot instant in Appendix A, and the snapshot necessarily precedes the publication that changes it):

• Token telemetry (27 recorded days through 2026-08-16; no later day ingested as of 2026-08-23): 22,696,191,284 total tokens, of which 20,918,082,610 — 92.17% — were cache reads. List-priced, that window is $12,027.14. It is telemetry at list price, not realized spend.
• Delivery board: 258 cards; 145 done / 74 in progress / 34 backlog / 4 in review / 1 blocked; 68.6% average story completion; 143 cards at 100%. That is the whole portfolio, including operator-only marketing and lead-gen work that is not in the shippable desktop. The five planes this paper describes are live. Toward production, the Desktop closeout epic (installer, public download path, evaluation licence, KEEP/DROP lock) closed on 2026-08-19 with operator acceptance; the installer remains unsigned and clean-machine smoke validation has not run (section 8.7).
• Coordination receipts: 1,733 file claims and eight recorded swarms; 100 mainline commits from 2026-08-19 through 2026-08-23, 691 from 2026-08-05 through 2026-08-23, and a peak of 84 on 2026-08-13.
• Index sizes: 17,903 Koinessa symbols, 54,201 federated; 366 tools and 5,351 curated documents (both unchanged since 2026-08-18); 1,619 git-indexed test/spec files on this tree.

Design position. Durable memory should reduce re-derivation; retrieval-first should reduce unnecessary exploration; explicit coordination should reduce collisions; and evidence gates should make acceptance more reviewable. The receipts above show operating state, not controlled causal effects.

8.6 Parallel model execution

Live. Interactive workers from Kimi, Claude, Grok, Codex, custom local Ollama models, and Ollama Cloud [83] work the same board simultaneously, separated by file claims, work leases, and fencing tokens rather than by courtesy. Two human operators on two LAN PCs can — and do — direct those swarms at the same time; that is concurrent-operator tenancy, not a second copy of the Brain. One repository receipt records that on 2026-08-12 a single orchestrating session (a) scanned the then-266-card work board, (b) ran two explorer agents in parallel to map two code seams, (c) had a local 27B model draft the requirements document from their reports, (d) ran two coder agents in parallel on disjoint workstreams implementing four stories, and (e) independently re-ran the full verification suite — 11,271 tests green — before the work was accepted. No session's context held the project; the Brain did. External measurement provides a bounded comparison: 0.5% of co-active pairs involved different agents, not 0.5% of pull requests. In a replay sample, textual Git conflicts were 41.7% versus 19.8%; those are textual conflicts, not semantic conflicts [69].

8.7 Production vehicle and the two-branch model

Koinessa develops in two long-lived lines, and the paper describes the arrangement as measured drift rather than implied parity. The operator command center — the founder-operated system whose receipts fill this paper — keeps every surface, including the marketing, lead-generation, social, and art automation lanes: those are not the product; they are standing validation evidence that the control plane generalizes past code, exercised daily against real business state. Koinessa Desktop is the production cut: an Electron distribution with its own repository history since 2026-08-12, a lean feature set, and the trust surfaces a third party needs — offline licence keys with seat tiers, purchase flows, identity providers (LDAP, OIDC, SAML, SCIM, with Kerberos shipped dark pending real-directory validation), and adapters for four CI providers. Its governing requirements document closed with operator acceptance on 2026-08-19.

The drift is counted, in both directions. Since the split: 441 mainline commits on the command center against 110 on the Desktop line through 2026-08-23. The unified provider layer of section 3.6 — descriptors, transports, arbiter, the compaction bridge, the tool registry, the evidence chain, risk tiers, the temporal ledger, and the coordination plane — was ported to Desktop on 2026-08-17; the Devin descriptor and guard, transcript compaction, provider conformance, and the Brain auto-restore path have not yet crossed. Desktop's installer is a Windows build that remains unsigned; clean-machine smoke validation has not run; macOS and Linux packages are blocked; and the auto-update rail is built against a placeholder feed (each a repository receipt, verified 2026-08-23). Features are tried first on the command center with the whole system running, then ported; the two histories are reconciled by an explicit transfer process rather than by merges.

8.8 Who this is built for

Koinessa is built for the platform, developer-experience, and security teams that own agentic delivery at organizations already running several AI coding agents against mature CI/CD — the teams asked, after the fact, what was done, by which worker, under whose authority, and with what proof. The controls in this paper — tenant scoping with per-principal authority and audit, IAM-grade identity separation, policy as versioned code, provenance chains from intent to deployment, and evidence bundles that map onto SSDF-style assurance expectations [21][22] — exist so such a team can raise autonomy tiers across many developers without losing that answer. The founders' own operation — three small businesses run on one agent setup — is the origin of the design and its daily proving ground, not its intended scale. A deliberately skeptical, external-evidence-grounded assessment (2026-08-13, design input) applied this paper's own discipline to its claims — external citations fact-checked, planning assumptions labeled as assumptions, no whole-task productivity multiplier — and found the underlying problem real and increasingly measured externally, from DORA's "verification tax" [25] to agentic pull requests substituting review rather than scaling it [29]. It left one condition the platform had not yet met: finish the trust substrate before asking trust-sensitive organizations to rely on it. EGD-002 closed that substrate (section 2.7), and its successors (sections 3.9 and 10) are held to the same standard.

9. Roadmap

Eleven directions, labeled honestly. Each carries binary acceptance criteria in the product PRD, because a roadmap item without a falsifiable exit condition is marketing. Status is a 2026-08-23 snapshot of the live work board unless a repository receipt is named:

1. Unified identity contracts across tools, agents, runners, work, and evidence (in flight — TEN-001 is 78% and MTC-001 is 81% in review; session principals, permission evaluation against versioned policy, per-principal gateway quotas and write scopes, and principal-stamped audit are delivered as a repository receipt; external-principal hardening is not).
2. Temporal operational ledger: authority classes, evidence links, as-of-time queries (live — BRN-002 is done at 100%).
3. Verified agent capability profiles: route work by demonstrated, verified capability (live — EGA-001 is done at 100%, 16/16; AAV-001 is done at 100%, 8/8).
4. Language-agnostic verification: one canonical evidence envelope per ecosystem — Node/TypeScript strongest today, Java and C++ components built, C and Ada spec-only conformance profiles available; Python, Go, and Rust CI fleet images were built and catalogued with on-image self-tests on 2026-08-19 (repository receipt), while their conformance profiles remain unbuilt (in flight where implemented; remaining profiles planned).
5. Autopilot supervised staging with measurable entry and exit criteria (built-but-gated; APX-001 continuation in flight at 74%, while the base APX-001 card is done).
6. Layered Git authority earned per task class (planned).
7. Repair-loop maturation: taxonomy, calibrated confidence, independent re-verification (live loop; maturation planned).
8. Closed business-action loops with idempotent execution and outcome learning (in flight).
9. Enterprise trust surfaces: RBAC, tenancy, recovery, audit export (in flight — TEN-001 at 78%). Concurrent operator tenancy is live; external-principal hardening remains incomplete.
10. Agent-network governance above MCP/A2A: membership, delegation, revocation, replay (live local substrate — EGD-002 is done at 100%, 12/12 and review-approved; cross-network membership remains planned).
11. Provider onboarding as a repeatable governed pipeline: register the descriptor disabled, commit a deny-all guard, pass a kill gate, run conformance, then an operator-gated enable drill (live worked example — the sixth descriptor landed through exactly this sequence on 2026-08-23; generalization in flight, in review).

Live board receipt. BRN-002, EGA-001, AAV-001, EGD-001, EGD-002, AOE-001, and XFR-001 are done at 100%. DSK-001 is 63% on the board but superseded as the go-to-market vehicle; the Desktop line's own requirements document and its production closeout epic both closed with operator acceptance on 2026-08-19 (repository receipt — the registry parser has not ingested them). The installer remains unsigned and clean-machine smoke validation has not run (section 8.7). This is not completed production acceptance.

10. Limitations and status

Koinessa is pre-release and founder-operated; it has not been independently audited, and no claim here should be read as certification or compliance — frameworks are guidance, a control is implemented behavior, evidence proves the behavior occurred [21][22], and certification is a separate determination. The Brain is single-writer by design; multi-writer operation is unsolved here (two operators share one writer via the gateway; they do not each hold a write connection). Verification depth is uneven across languages (section 9, item 4). Autopilot remains fail-closed by ruling. No whole-task performance multiplier is claimed. The 85.6% input-side share is a derivation from a published worked example, not a vendor-printed statistic; cache reads alone account for about 51% in that example.

Boundaries specific to this edition, stated as measured. The managed-session provider layer is built-but-gated: six descriptors, zero enabled, and the arbiter has no caller — the multi-vendor receipts in this paper come from interactive sessions (section 3.6). Transcript compaction is wired unevenly across vendors (section 3.7), and the transcript-digest ledger held zero rows at this snapshot. The Brain-side evidence and conformance ledgers held zero rows at this snapshot; CI-side manifests and signing are the operating path (section 2.5). The sixth registered vendor remains disabled pending enable-time drills, and its refusal guard is scoped to this working tree's CLI lane — a vendor cloud session operating on its own clone of a repository is governed by repository rules and provider-side controls, not by this tree's hooks. No full mainline CI pipeline had completed green end to end as of 2026-08-23; the verification jobs run locally and per job, and the first green mainline pipeline is in flight. Two Brain main-file corruptions occurred in the week before this edition; automatic restore-from-snapshot has run in the gateway process since 2026-08-24, its supervisor is now a native service that stays stopped on the refuse-to-start exit code by design, and degraded-mode legibility is a draft (section 3.9). Usage-telemetry, curated-document, and tool-registry ingestion produced no new rows between their 2026-08-16/18 readings and this snapshot, so the paper reports those counts as unchanged rather than as re-measured growth. The two-branch production model (section 8.7) means the Desktop line trails the command center by measured capabilities at any given date; the gap is stated per capability, never assumed closed. And because this paper's own publication writes to the system it measures — its review rows, facts, file claims, and the commit that carries it all land in the Brain and the git history — every mutable counter here is a pinned snapshot instant that necessarily precedes the publication that changes it.

The remaining receipts quoted in this paper (commit counts, test-file counts, index sizes, table counts, token telemetry, board columns) were verified against the live system, git history, and the work board for the 2026-08-23 snapshot and will drift; the claims register is their source of truth. The production vehicle is Koinessa Desktop; its repository evidence and this operator command center are separate evidence lanes. The external statistics in section 1.1 are reproduced with dates and provenance labels in the EGD-001 research digest; where a circulating figure is vendor telemetry, contested, or methodologically weak (the "95% of AI pilots fail" claim, for example), the digest says so and this paper omits or caveats it. The automatic external- claims probe checks that the versioned digest remains tracked; it checks evidence-trail integrity, not live URL retrieval. All 22 external rows remain disputed for automated or operational reuse. This operator-approved edition presents them only as explicitly cited, population-bounded external evidence; no row is promoted to live. Human primary-source review and explicit promotion remain required before the claims register treats a row as reusable approved evidence. An agent may assist research but cannot promote a claim. The archived typeset PDF remains a historical snapshot rather than the canonical article. Finally, the multi-vendor coordination result is one system's operating evidence, not a controlled study — we publish it as a receipt, not a benchmark.

Appendix A — Brain-backed operating receipts (2026-08-23)

These numbers were read from the Brain, indexed repositories, git history, or the Kanban board at a single snapshot instant — 2026-08-23 22:28 ET, the moment this edition's source was frozen for rendering, after the last review row of its own publication pipeline had landed — except where a row states its own instant. They will drift; this paper's own publication moves several of them, and the claims register is the source of truth. Counts drawn from git windows are measured by committer date (git rev-list --count --since --until HEAD) at commit c0af7fd3; because this tree rewrites history during automated sweeps, a commit can move between days, so a short window is a measure of that window at the stated instant rather than a fixed historical fact.

EGD-001's preregistered self-benchmarks (US-017) remain the declared path to task-matched, reproducible productivity measurements. Until those exist, this paper will not invent a multiplier.

Further Reading

• Cognition. "Agent Trace: Capturing the Context Graph of Code," 2026-01-29.