Bounded reasoning

It reads the build and proposes.
A named person decides.

When the records under a job change, what can a machine conclude, and what must stay a person’s call?

Concept visualization. The yard from above, one change traced through it. Synthetic model; not a Veldarium facility.

VeldMind is orchestration and bounded reasoning over the build state VeldBuild establishes. When a record under a job changes, it works out which questions the change raises, puts each to the engine that owns the answer, and returns one bounded proposal with the observation that would overturn it. Today it reasons about engineering change, missing material, qualification gap, inspection evidence, dimensional disagreement, open nonconformance and capacity; conflicting source records, scheduling conflict, floor exception, supplier risk and commissioning evidence are direction. Findings that disagree stay on the record and are settled by a stated precedence rule, never by a vote. A model does not acquire physical release authority because it is confident: the person whose call it is decides.

Deterministic synthetic demonstration. No model of any provider is connected, and no action leaves the page.

Reasoning proposes
1. Governed state
2. Admissible evidence
3. Reasoning
4. Uncertainty and conflict
5. Recommendation and its falsifier
Authority decides
1. Human decision
The record persists
1. Recorded result
2. Outcome check

VeldMind does: Identifies which record under a job changed, and how
Traces the change to every object it can reach
Selects which of those objects need a question now
Pulls the records bearing on each question from VeldBuild
Checks which evidence still governs, and which rests on a moved basis
Names the record that should exist and does not
Separates what can be established from what cannot
Drafts one bounded proposal, with the observation that would overturn it
Abstains where the records cannot settle the question
Routes the decision to the named authority who holds it
It never, and who does instead: Approve an engineering change: Engineering / configuration control
Override configuration authority: Engineering / configuration control
Waive a requirement: The requirement’s owner
Release production work: The production release authority
Accept an inspection: The quality inspector
Authorize procurement: Supply chain and its approver
Command a machine: The cell, under its own machine safety
Override a system of record: The system that owns the fact
Grant itself authority: No one may grant it

BuildingWhere it sits in the architecture

Method and evaluation

Every step reads a record. Planted wrong rules show the cases can fail.

How a question becomes a proposal, what the reasoning returns when evidence runs out, and how planted wrong rules test the cases, with what that does not yet cover. Every figure is computed on this commit.

From question to decision

The 7 steps, and what each may never do

01One bounded questionThe question names one governed object and one action no stronger than advance to release review, and it is asked of state VeldBuild has already computed, never of a document.
On the worked package
May WP-030 (VS-001, block B30) proceed to release review?
Never
Accept an open question, or one whose answer would be a release.
02Each part to the engine that owns itEach part of the question goes to the one deterministic engine that owns the answer, and each answer keeps that engine’s own vocabulary. Nothing is translated onto a shared scale, so nothing is softened on the way.
On the worked package
6 sub-questions go to the readiness gates, one per gate, and 1 more goes to the build graph, because a released change reaches the package.
Never
Route a sub-question to a model. Today every route resolves to a deterministic evaluator.
03Findings, each citing its recordEach engine returns one of three stances (clear, blocked, cannot establish) and cites the record it read. A finding with no record says so and cites nothing.
On the worked package
6 gate findings: 5 clear and 1 cannot establish. The clear findings cite KIT-B30-030, WP-014-ACC, AREA-MS-03, INS-207 and CREW-B30-030; the one that cannot establish cites nothing, because no record exists. The build graph adds a reason, never a verdict.
Never
Return a fourth, softer stance, or a score.
04Precedence, not a voteWhere findings disagree, both stay on the record and a stated rule settles it: a known-open gate holds the work, an unknown is never upgraded, and the build graph may add a reason to a hold but never decides one.
On the worked package
5 of 6 gate findings are clear, so a vote would return proceed. The rule “Unknown is never upgraded” returns cannot establish. The build graph adds a reason to hold, and no verdict.
Never
Average, tally or weight the findings.
05The falsifierThe recommendation names the observation that would overturn it, derived from the gate that holds the work: who could produce it, and whether it would overturn the answer on its own.
On the worked package
A current record is produced for "Which released revision governs WP-030, and is it the one the work is written against?". If it establishes the gate this hold is withdrawn; if it shows the gate open this becomes a known-open hold. Producing the record is not itself a proceed. Owner: Engineering / configuration control. Overturns this on its own.
Never
Offer a falsifier that would release work. If the missing record establishes the gate and nothing else is outstanding, the proposal becomes advance to release review, still not a release.
06The seamThe reasoning ends at a proposal. Its strongest possible action is advance to release review, and VeldMind has no code path to approved state.
On the worked package
Proposal: hold pending evidence, confidence cannot establish. VeldMind recommends and explains; it does not release work. A named human authority decides.
Never
Emit a release, or any action above the ceiling.
07The decision, by a named personThe person who holds the decision chooses from the actions the answer lawfully permits. Authorize release exists only when every consulted domain is clear, and the record binds the decision to the evidence as it stood.
On the worked package
M. Okafor (Production release authority · B30) may hold or return for evidence. Authorize release is not offered, because a gate cannot be established.
Never
Choose for the person, or offer approve beside an unknown.

It reads governed state, never a source system

Today the reasoning reads only state VeldBuild has already computed from records.

What a recommendation can rest on

Governing configuration
Gate evidence
Finite qualified capacity
Dependency topology

The domains the live instrument consults

Governed readiness
Finite qualified capacity
Capability qualification
Physical evidence
Nonconformance

What it never reads directly

A drawing or model file
A spreadsheet, an email or a meeting note
A raw sensor or machine stream
A source system’s own database

Those reach VeldBuild first, where each fact keeps the source that owns it and becomes a record with a revision and a recording authority. VeldMind reads only what VeldBuild has made a governed record, so every finding can be traced to one.

When evidence is missing, stale or in conflict

It abstains rather than guesses. Uncertain is never one bucket: a missing record, a stale one and an unassessed dependency each ask a different person for a different thing.

4 of 9 uncertainty classes run inside the reasoning path, each held by a test that fails if it stops. The other 5 (conflicting evidence, model uncertainty, source reliability, insufficient authority and computational uncertainty) are architecture, and each says what it would take.

Missing evidenceDemonstrated: A required record is absent, so the gate it would close cannot be established either way. Returns: Hold pending evidence. The gate stays unknown, and the proposal names the question no record answers and who owns it. Settled by: A current record from the gate’s owner. If it establishes the gate the hold is withdrawn; if it shows the gate open, the hold becomes a known-open one.
Conflicting evidenceDirection: Two admitted records assert incompatible states. The reasoner reads one record per gate and never compares two, so it cannot reach this. Returns: Not reached today, because one record is read per gate. Settled by: Comparability first (same quantity, basis and measurement class), then the configured source precedence. Where precedence cannot decide, cannot establish, with both records kept.
Ambiguous applicabilityDemonstrated: A released change reaches this subject, so a record captured before it no longer governs it. Returns: Cannot establish for the subject a released change reaches. Records captured before the change stop governing it. Settled by: An impact assessment for that subject from configuration control, or records captured again against the new revision.
Model uncertaintyDirection: A probabilistic reasoner cannot establish the conclusion. No such reasoner runs here, so this state is unreachable. Returns: Unreachable, because no probabilistic reasoner runs. Settled by: A deterministic check on what a model drafted. Never a confidence threshold.
Stale evidenceDemonstrated: The record was captured against a basis that has since moved, so it no longer establishes what it once did. Returns: Cannot establish, never known open: the record existed and the basis it was captured against has moved. Settled by: The record re-baselined or captured again against the current basis.
Source reliabilityDirection: The source or acquisition path is not sufficient for the fact. The reasoner does not assess how a record was obtained. Returns: Not assessed today. Settled by: A declared acquisition path for each evidence class, checked before a record is admitted.
Unresolved dependencyDemonstrated: A related downstream object has no completed impact assessment, so its state is not established either way. Returns: Impact cannot be established for the neighbor nobody assessed. It is never read as unaffected. Settled by: A completed impact assessment for that object.
Insufficient authorityDirection: The actor or source lacks the necessary scope. The reasoner resolves who holds a decision but does not test an actor’s scope against a request. Returns: Not assessed today. The reasoning names who holds a decision but does not test an actor’s scope. Settled by: A check of the actor’s scope against the requested action before a decision is accepted.
Computational uncertaintyDirection: The computation cannot be reproduced within its declared tolerance. The engines here declare no tolerance, being exactly reproducible rather than approximately so. Returns: Not applicable: the engines reproduce their output exactly. Settled by: A declared tolerance, if an approximate computation is ever admitted.

Why it cannot invent a record or overstate its confidence

These are properties of how the engines are built, not instructions they are asked to follow. Each says what holds today and what it would have to become with a model attached.

A claim is a record, or it is not madeEvery finding cites the record its gate carries, and a gate with no record cites nothing, so the trace cannot point at a record the governed state does not hold. Among the wrong rules planted to test the cases (25 / 25 caught) is a fabricated citation, and the run fails unless a case catches it.
With a model attached
Each identifier a model cites would be looked up in VeldBuild, and a draft carrying one that does not resolve would be discarded before a person sees it. That check on a model’s output is not built.
Confidence is a state, not a numberA recommendation is either established or cannot establish. There is no score to inflate, and cannot establish only ever accompanies a hold.
With a model attached
A model’s own confidence would not be carried into the proposal. The epistemic state comes from the gates, which are computed from records.
Unknown blocks, however fluent the explanationA missing record leaves its gate unknown, and no proceed is emitted while any verifier check cannot establish.
With a model attached
A persuasive draft could not close a gate, because the gate is computed by the engine and the draft has no field for it.
Every answer can be replayedThe same governed state yields the same recommendation, its id included, so a later and different answer can be traced to changed records, changed rules, or both.
With a model attached
A model does not replay this way, which is why it may only propose: the deterministic checks decide what reaches a person, and they do replay.

The evaluation

The corpus, on this commitMeasured

37 / 37Governed cases that hold
20Invariant families covered
25 / 25Wrong rules injected, and caught
26Cases that must preserve an unresolved condition
9Cases that must surface a disagreement
4Known limitations recorded on purpose

How each figure is produced

Governed cases that hold: Each case is an industrial state, a bounded question and the answer a written rule requires, with the rule and its source named in the case. Recomputed before every release
Invariant families covered: Distinct failure shapes: a stale evidence basis, a rejected measurement, the wrong measurement class, two reads off one instrument head, a record filed but not accepted. Recomputed before every release
Wrong rules injected, and caught: Each is a plausible wrong rule written into the engine source (majority vote, unknown read as ready, a fabricated citation), and one that fails to apply fails the run. Recomputed before every release
Cases that must preserve an unresolved condition: The required answer carries a condition the evidence cannot settle, and the case fails if the engine resolves it in either direction. Recomputed before every release
Cases that must surface a disagreement: The reasoning must report that its sources conflict rather than return the answer it prefers; one case exists only to prove no tally is taken. Recomputed before every release
Known limitations recorded on purpose: What the engines actually do where that is worse than the intent. Pinned so it cannot drift, and published so nobody has to discover it. Recomputed before every release

Not published: a model benchmark, a reasoning-quality score, real-world validation, and why

A model benchmark: No model of any provider is connected to Veldarium’s software. There is nothing to benchmark, and a number here would be invented.
A reasoning-quality score: Every figure above is pass/fail against a written rule. A single blended score would hide which rule broke, which is the only part anyone can act on.
Real-world validation: The corpus is a synthetic program. It establishes that the engines obey their stated rules; it establishes nothing about a shipyard.

The 4 known limitations the corpus records on purpose

EV-MULTI-002The disagreement instrument shows at most three conflicting reads and does not say when it dropped others. The verdict and the recommendation keep all of them.
EV-NOANCHOR-001A package where nothing is clear is the one state in which the trace names no governing rule at all, even though a rule plainly governed the answer.
EV-TOPOLOGY-001A blocker found in the dependency topology reaches the trace and not the recommendation. The falsification harness established that the guard meant to carry it forward can never fire.
EV-EVID-REJECT-002The sufficiency engine names no owner for an unsatisfied hold point, where the readiness engine names one for every unresolved gate.

What a future model would be graded on: 5 scored measures and 11 intended ones; no result exists

The scored contract for a future modelDefined, not benchmarked

The first bounded task a model would be given: find every object a controlled change touches, and no others. The scorer is committed, and its own tests show it credits a perfect answer, catches a miss and an uncited claim, counts a declined object as not found without calling it wrong, and reports a measure with nothing to measure as undefined rather than zero. No result exists.

Impact recall: Of every object the change actually touches, how many did it find? A declined object counts as not found.
Impact coverage: Of those objects, how many did it answer rather than decline? Read beside recall.
Impact precision: Did it avoid flagging objects the change does not touch?
Unsupported-claim rate: How often did it assert impact with no cited evidence?
Abstention rate: How often did it decline rather than guess?

Intended, beyond the first task

Task-decomposition quality
Routing accuracy
Evidence-citation correctness
Unsupported-claim rate
Disagreement preservation
Verifier catch rate
Refusal correctness
Recommendation usefulness
Latency and cost
Human override rate
Falsifier completeness (counted)

What a pass proves, and what it does not

What the case figure shows: 37 / 37 means every case returns the answer its written rule requires, across 20 distinct failure shapes. A case states the industrial condition, the question and the rule before the engine runs.
What the mutation figure covers: 25 / 25 means each of the 25 wrong rules planted in six engine files is caught by at least one case, and the run fails on one that escapes rather than reporting a lower score. It covers only the rules planted: none is planted yet in the five-domain composition the live instrument runs, the decision engine, the workcell engine, the capacity model or the scheduler.
Where over-confidence would show first: 26 cases require the engines to leave a condition unresolved, and fail if the engine settles it in either direction; 9 require a conflict to be reported rather than smoothed over.
What it does not show: That these are the right rules for a particular yard. That needs the yard’s own engineers to write the expected answers against their own records, and it has not happened.
What it does not evaluate: A model. None is connected. The scored contract defines what one would be graded on, and no result exists.

After the decision

Each recommendation is checked later against what it said would prove it wrong. An outcome it did not name goes to configuration control as a question, never into the build graph on its own. A hold is never scored, and nothing is trained.

Three synthetic decisions, and what happened next

Lifted, as it said it wouldAUTH-WP-019-HELD. Lifted once DR-118 and Kit B30-019 moved, which is what the hold said it was waiting on.
Turned on something it did not nameAUTH-WP-019-APPROVED. Flange gaskets were supplied to the Rev C pressure class, and Rev D raised it. The recommendation did not name GSK-118. Question for Engineering / configuration control: Does GSK-118 govern or feed WP-019?
Not yet observedAUTH-WP-030-RETURNED. Still held. Whether the work would have failed if released cannot be observed.

Each decision records its ruleset and a digest of what it read, so a changed answer can be traced to changed records, changed rules, or both. A ruleset name is pinned to one behavior: a test fails if the rules change under the same name.

What it reasons about, today and direction

7 kinds of decision run today, 5 are direction

Engineering changeA revision moves the governing drawing.Today
Missing materialA kit is counted, not accepted.Today
Qualification gapThe crew lacks the procedure qualification.Today
Inspection evidenceA weld has one scan, no independent second read.Today
Dimensional disagreementTwo reads of one joint disagree.Today
Open nonconformanceA finding on the unit is open.Today
CapacityThe cell or crew is not free this window.Today
Conflicting source recordsTwo systems disagree about which revision governs.Direction
Scheduling conflictTwo trades need one space in one shift.Direction
Floor exceptionA mid-shift breakdown blocks unplanned work.Direction
Supplier riskA long-lead item slips at the supplier.Direction
Commissioning evidenceA system handed over with a test open.Direction

The 8 question families, with evidence

Demonstrated3 of 8

Runs today in the deterministic synthetic demonstration, against evidence you can open.

Readiness reasoning
Can this work start, and if not, which gate is binding?
Evidence for readiness reasoning
Verifiable behavior
Readiness derived from kit completeness rather than asserted
A named cause for the hold, not a red badge
Material modeled as a first-class vessel layer
Modeled, not real
The items, the supplier, the superseded revision and the lead times
What it does not do
No procurement, inventory or receiving integration
No supplier records, lead-time data or substitution workflow
Nine stages are illustrative of a real flow, not a configurable process
Change impact
What does this revision touch downstream, and what does it not?
Constraint synthesis
How do material, schedule and quality constraints combine on one decision?

Direction5 of 8

Architecture, not software. Nothing here is built: each one needs a governed engine that can answer it deterministically, and evidence records carrying a basis it can cite. That requirement is stated once because it is the same for all of them.

Configuration conflict
Which revision governs this object right now, and do authorities disagree?
Production exception triage
This exception appeared on the floor. What is it blocking, and who owns it?
Evidence comparison
Which record actually establishes this state, and is anything contradicting it?
Planning & scenario support
If this slips or changes, what is the downstream shape of the plan?
Authorized bounded execution
Once a human approves, carry out the bounded action within granted authority.

How a recommendation is checked

Verification is typed: a citation can exist and still fail the question it was cited to answer. Each class below carries whether the reasoner performs it.

7 of 9 verification classes run inside the reasoning path, each held by a test that fails if it stops. The other 2 (authority verification and independent verification) are architecture, and each says what it would take.

Source verificationDemonstrated: Does every citation resolve to a record the governed state actually carries?
Authority verificationDirection: May that source establish this class of fact? The reasoner carries each record’s recording authority forward and resolves who may decide, but does not qualify a source against the claim it is cited for.
Applicability verificationDemonstrated: Does a released change reach this subject, so records taken before it stop governing?
Consistency verificationDemonstrated: Do the bounded reasoners conflict, and is the conflict settled by a named rule rather than a tally?
Computation verificationDemonstrated: Is the result reproducible: the same governed state yielding the same trace, every time?
Policy verificationDemonstrated: Is the proposed action inside what the verdict permits? The ceiling is advance to release review, never release.
Scope verificationDemonstrated: Has the reasoning exceeded its permitted boundary, such as a proceed resting on a gate no record closes?
Completeness verificationDemonstrated: Is a record that would establish a gate missing, and is that stated rather than passed over?
Independent verificationDirection: Where useful, can another bounded reasoner test the conclusion? Every sub-question today is routed to exactly one reasoner, so no conclusion is re-tested.

The 6 reasoning operations, and what each may never decide

RetrieveSyntheticFind the governed records relevant to one object and one question.
Reads
Object identity, question scope and configured source authority.
Returns
A bounded evidence set with source, revision and observation context.
Never decides
Read only. Retrieval cannot establish a state that the source does not establish.
CompareSyntheticCompare revisions, gates or dependency edges without hiding disagreement.
Reads
Two or more typed records with an explicit comparison rule.
Returns
A structured difference, impact classification or unresolved conflict.
Never decides
No write. A difference is evidence for review, never approval.
ReconcileSyntheticApply configured source precedence to produce one governed answer.
Reads
Conflicting records, authority configuration and effective dates.
Returns
A resolved answer with the precedence path and losing assertions retained.
Never decides
Cannot invent authority. If precedence cannot resolve the conflict, return cannot establish.
Detect conflictSyntheticFind contradictions, missing evidence and states that should stop work.
Reads
Established build state, policy and evidence links.
Returns
A named conflict with affected objects, owner and next evidence needed.
Never decides
May recommend a hold; cannot clear a hold or release work.
PrioritizeConceptRank bounded exceptions by impact, urgency and accountable owner.
Reads
Known constraints, downstream reachability and an explicit policy.
Returns
A ranked queue with a reason and confidence boundary for each item.
Never decides
Decision support only. A ranking never changes schedule or authority.
DraftConceptPrepare a reviewable instruction, report or decision brief from cited state.
Reads
Traceable evidence, approved templates and the named recipient.
Returns
A draft with citations, omissions and explicit human acceptance required.
Never decides
Draft only. Nothing becomes a record or instruction until a person accepts it.

An agent may observe, compare, reconcile, detect, prioritize or draft inside a scoped authority lease. It may not approve, release, clear an unknown, or write authoritative industrial state without a named human decision and a recorded provenance trail.

The guarantee that holds today, where a language model would sit, and what it would be refused

Unknown is never a proceedDemonstrated

advance(w) ⟹ ∄ g ∈ gates(w) : state(g) = unknown

advance(w): the only positive action VeldMind may emit for work w: advance to release review
gates(w): the readiness gates of w
unknown: the record that would settle a gate does not exist

A proceed is emitted only when no gate is unknown. Missing evidence stays unknown and is never rounded to a pass. The suite checks this across every combination of the controlled conditions.

A model, if one is ever connected, would sit where the deterministic reasoners sit now: it may read, draft and propose, and the engines check every draft before a person sees it. A better model gets no more authority. Selection would be provider-neutral, so no vendor becomes an authority in this loop. Today no model of any provider is connected, and every route resolves to a deterministic reasoner. Concept

Allowed, each with its bound

Read governed records by identifier, through VeldBuildRead only, and scoped to the object and the question it was handed. Never a source system, a file share or the open web.
Ask the deterministic enginesThe engines compute every gate and every verdict. The model may choose which question to put to them first.
Decompose a question and draft an explanationEvery sentence that asserts a state must cite a record identifier, or it is removed before review.
Propose a hypothesis or a next checkLabeled as a proposal. It changes no gate, no queue and no schedule.

Refused, each with what enforces it

Write governed state, directly or through a toolThe gateway issues no write tool. VeldBuild records a transition only from a named person’s decision.
Cite a record VeldBuild does not holdEvery cited identifier is resolved against VeldBuild, and a draft with one that does not resolve is discarded.
Set a gate or the confidence of an answerBoth are computed by the engines from records. The draft has no field for either.
Read outside the governed setRetrieval is scoped to the object, the question and the configured source authority.
Widen its own scope, or call another serviceScope is issued by the gateway for one question and expires with it.
Gain authority by being more capableRouting may weigh calibrated confidence only inside the authority the question carries. A better model gets no more.

Every decision VeldMind never takes stays with the person named at the top of this page, and a model would inherit that boundary unchanged. None of this is built: no model of any provider is connected, and the gateway and its checks are architecture.

The authority ladder, and the evidence each step up needs

L0 · ObserveSyntheticRead bounded state without changing it.
Earned so far
The reasoning reads computed state and writes none; the composition is tested to invoke no model and write no state.
Would need
The same reads over a yard’s own records, through VeldBuild, with each source’s authority configured by the yard.
Sent back down by
Any write to state from the reasoning path.
L1 · RetrieveSyntheticAssemble permitted evidence with provenance.
Earned so far
Every finding cites the record its gate carries, and a missing record is cited as missing.
Would need
Retrieval over real records, each citation checked by the engineer who owns the fact.
Sent back down by
A citation that resolves to a record VeldBuild does not hold, or to the wrong revision.
L2 · AnalyzeSyntheticCompute, compare, classify and preserve disagreement.
Earned so far
On synthetic records, 37 / 37 governed cases hold and 25 / 25 planted wrong rules are caught.
Would need
The corpus written again against a yard’s records, with its engineers stating the expected answers before the engines run.
Sent back down by
A planted wrong rule that no case catches.
L3 · RecommendSyntheticReturn a traceable proposal to the responsible person.
Earned so far
Each proposal names its falsifier and stops at advance to release review.
Would need
Proposals followed on real work: each falsifier checked against what happened, holds never scored, every override by a person recorded with its reason.
Sent back down by
A proceed proposed while a gate is unknown.
L4 · Prepare changeConceptDraft a reversible state transition for review.
Earned so far
Nothing. No change is drafted today.
Would need
A recommend rung that has held up on real records, a reversible transition type defined by configuration control, and a review log showing every drafted change read and decided by a named person.
Sent back down by
A drafted change that reaches the record without a person’s decision.
L5 · Execute authorized reversible actionConceptAct only inside an explicit, logged and revocable authority lease.
Earned so far
Nothing. No action is executed.
Would need
The durable execution contract built and tested, an authority lease a person can revoke, and a history of prepared changes accepted without being reversed.
Sent back down by
An action taken outside its lease, or one that cannot be undone.
L6 · Controlled industrial executionLong-termCoordinate approved physical action through governed systems.
Earned so far
Nothing. Veldarium operates no machine and generates no machine instruction.
Would need
Everything above, on a physical cell whose machine safety stays with the cell’s own authority.
Sent back down by
Any software path that clears a machine inhibit.
L7 · Reserved / prohibited authorityHuman-authorizedKeep regulated, safety-critical or otherwise reserved decisions outside autonomous execution.
Earned so far
Not a rung to earn.
Would need
No evidence moves a reserved decision. Regulated, safety-critical and release decisions stay with people by design, not by maturity.
Sent back down by
Any delegation of a reserved decision.

The 7 stages, one of them a person, and what execution would owe

01ObserveA question or event arrives against a specific unit of governed build state.Demonstrated
02AssembleRead the established state, evidence, policy and authority around the subject, and nothing else.Demonstrated
03Decompose & routeBreak the question into bounded sub-questions and route each to the reasoner that fits.Demonstrated
04Reason & verifyReason independently, surface disagreement, check evidence, and keep unknowns as unknown.Demonstrated
05RecommendProduce one recommendation: what, why, on what evidence, and what would overturn it.Demonstrated
06Authorize & recordA named person decides and VeldBuild records the decision. Bounded execution within granted authority is architectural direction. It is not built.Partial
07Check the outcomeLater records are compared with what the recommendation named. Anything it missed goes to a person as a proposed dependency, never into the graph.Demonstrated

6 of 7 stages run in full in the deterministic demonstration. Authorize & record is marked partly direction because it groups authorized execution, which is architecture and not built.

If bounded execution were ever built, it would owe this

Deterministic workflow stateNot built: Decisions about what runs next are recoverable, replayable and inspectable.
Fallible activitiesNot built: External effects carry explicit retry, timeout and idempotency behavior.
Event historyNot built: Consequential transitions survive process failure and remain reconstructable.
Durable human waitNot built: A workflow can wait for approval without losing state or silently advancing.
Versioned workflow definitionsNot built: Long-running work remains interpretable when the governing workflow changes.

It reads the build and proposes.
A named person decides.

It names what holds the work, and hands the decision to a person.

Change a record. The proposal, its reasons and the decision recompute.

Governed records

VeldMind proposes

Why the answer is what it is

Consensus is not evidence.

May WP-030 (VS-001, block B30) proceed to release review?

Several systems of record, read in parallel instead of one opaque source.

One question, decomposed and routed to bounded reasoners.

Independent perspectives test the same state against different constraints.

Verification could not establish 1 gate(s). Unknown is preserved, not resolved into a pass.

VeldMind proposes: Do not release WP-030. Readiness cannot be established, because the evidence record does not exist.

Every step reads a record. Planted wrong rules show the cases can fail.

From question to decision

The evaluation

After the decision

What it reasons about, today and direction

Readiness reasoning

Change impact

Constraint synthesis

Configuration conflict

Production exception triage

Evidence comparison

Planning & scenario support

Authorized bounded execution

It reads the build and proposes. A named person decides.

Change a record. The proposal, its reasons and the decision recompute.

Governed records

VeldMind proposes

Why the answer is what it is

Consensus is not evidence.

Several systems of record, read in parallel instead of one opaque source.

One question, decomposed and routed to bounded reasoners.

Independent perspectives test the same state against different constraints.

Verification could not establish 1 gate(s). Unknown is preserved, not resolved into a pass.

VeldMind proposes: Do not release WP-030. Readiness cannot be established, because the evidence record does not exist.

From question to decision

The evaluation

After the decision

What it reasons about, today and direction

Readiness reasoning

Change impact

Constraint synthesis

Configuration conflict

Production exception triage

Evidence comparison

Planning & scenario support

Authorized bounded execution

It reads the build and proposes.
A named person decides.