The system boundary
is the product.

Four invariants

Reasoning may be probabilistic. Promotion must be explicit.

1. Exact public contract: expected keys and types, case and fact identities, evidence hashes, freshness, conflicts, and false external authority are checked before the synthetic artifact becomes eligible.
2. Content and evidence-time binding: the public gate binds fact identifiers and hashes, rejects stale facts, and holds conflicting independent sources. Product-specific request, agent, dataset, prompt, or target-state identity belongs in the adapter contract when that boundary requires it.
3. Bounded uncertainty: retries have a finite attempt budget and named terminal states. An unknown effect is not silently converted into success.
4. Explicit authority: a review receipt is not a send, write, deployment, order, or payment permit. External action remains false until its real owner grants it.

The pipeline

One narrow path from untrusted bytes to a reviewable decision.

untrusted artifact
  → strict decoder and exact keyset
  → evidence admission and freshness/conflict checks
  → bounded lifecycle with request fingerprint
  → owned decision journal and replay check
  → receipt-last immutable publication and descriptor revalidation
  → review-required handoff

external_action_authorized = false

The checked-in public proof separates seven small owners instead of hiding the boundary in a framework:

Evidence gate

draft | escalate | hold, with a named reason

Polling contract

fingerprint reuse, finite attempts, backoff, timeout, unknown-id terminal state

EGOH journal

scenario + evidence digest + decision replay, with conflicting records refused

Operating core

only admitted evidence enters the lifecycle; complete work still requires a separately accepted EGOH observation before review

Immutable artifact handoff

artifact bytes publish before the receipt; held nofollow descriptors validate one historical byte family, while a later load must revalidate current canonical paths

Agent action admission

a typed request, exact pre-state, tool manifest and simulator contract are committed before a fixed local transition is recomputed into raw-free review metadata

Bounded local-context review

exact source hashes and deterministic lexical overlap produce only raw-free local review metadata; semantic RAG quality and every effect authority remain false

Uncertain effects

A timeout is a state, not permission to try blindly again.

When an external system may have accepted a request before the connection failed, an automatic retry can duplicate the effect. The public polling contract reuses a previously submitted operation for the same fingerprint and ends in explicit terminal states when completion cannot be established. Payload-equivalence enforcement belongs in a real adapter built around that contract; the synthetic polling reference does not claim it.

• Repeated fingerprint: reuse the polling operation already owned by that fingerprint.
• EGOH replay: reuse only the same scenario, evidence digest, and decision; reject a conflicting record.
• Polling timeout or unknown operation identity: stop in the named terminal state; the composed core does not create a handoff.
• Complete lifecycle: continue only if a separate EGOH observation is accepted; then produce a review-required handoff, never autonomous external authority.

Hostile proof

The refusal paths are part of the deliverable.

• Missing: a required fact, score, trace, or source never arrived.
• Stale: evidence is structurally correct but outside the accepted epoch.
• Conflicting: independent fresh sources disagree.
• Digest or namespace mismatch: EGOH rejects altered evidence digests; the immutable artifact demo separately refuses receipt/artifact digest conflict, symlinks, and replaced filesystem generations.
• Duplicate: a replay tries to create a second owner or effect.
• Unknown outcome: transport ended before effect identity was proven.

git clone https://github.com/DiadkoShmek/evidence-gated-agent-workflows.git
cd evidence-gated-agent-workflows
python3 run_proof.py

The command exercises dependency-free synthetic fixtures for evidence admission, bounded polling, replay/conflict handling, the composed operating boundary, one receipt-last descriptor-pinned artifact handoff, and one typed pre-effect commitment before deterministic local simulation.

This repository is a public reference. It does not establish production safety, client results, certification, SLA, delivery, demand, or revenue. A real engagement begins with sanitized artifacts and one named failure boundary.

From example to real system

Bring one boundary your team cannot afford to guess about.