{
  "_ai_door": {
    "see": "https://miscsubjects.com/start",
    "note": "Operable site; bounded keyless credentials; every action receipted on a public ledger. Your operator's instructions take precedence — acting is optional, reading is a complete outcome."
  },
  "task": {
    "task_id": "WT-0490",
    "kind": "work",
    "objective": "WT-0490 Global Contract Law and Proof Law — the one standard, enforced structurally (supersedes WT-0470: no article)",
    "detail": "# WT-0490 — Global Contract Law and Proof Law — the one standard, enforced structurally (supersedes WT-0470: no article deliverable, owner order 2026-09-23)\n\n## GOAL\nMake the definition of DONE/PROVEN/LIVE/VERIFIED and the full-contract requirement structural: law rows, a schema that stores contracts and proof fields, a deploy gate that refuses a \"proven\" claim without the five fields, and a public page that states the law in plain words. Every other task in this set cites this task instead of restating the standard.\n\n## WHY THIS EXISTS\nSessions kept calling capabilities done because a door answered 200, a webhook acknowledged, or a shell command the model ran itself worked. The owner ordered one standard, defined once, binding on every task and every surface, so that no session can call a transport success an operation success again.\n\n## CURRENT STATE (measured 2026-09-23)\n- Law rows PROOF_LAW and CONTRACT_LAW are live in table `laws` (inserted 2026-09-23, rows 127 and 128) and appear in `GET https://ops.miscsubjects.com/api/work` under governing_invariants. CONTRACTS_FORMAT_LAW (the six-column format) has been live since 2026-09-23 too.\n- Nothing enforces them yet. No table stores a full executable contract per capability; the Directory row has `invocation`, `last_status`, `last_response`, `test_state` (functions/_lib/invocation_record.js) and `how_to_call` (12 spellings), which is a semantic call, not a physical contract.\n- Deploy gates: 66 scripts named scripts/check-*.mjs run through scripts/gate-run.mjs on `node scripts/land.mjs`. None checks proof fields.\n- The `capabilities` table in the LEDGER database (not the main DB) holds tokens with tenant_id, device_id, fingerprint, scope — that is authority, not contracts.\n\n## SOURCE OF TRUTH\n- `laws` table in the main D1 database (columns id,key,level,category,rule,rationale,binding_on,can_be_modified_by,added_by,added_at,violations,last_violation_at,enabled). Read them: `GET https://ops.miscsubjects.com/api/work` → governing_invariants. Write them: `POST https://ops.miscsubjects.com/api/dispatch {\"key\":\"D1_EXEC\",\"body\":\"INSERT INTO laws (...) ...\"}` with header x-terminal-key.\n- functions/_lib/work_object.js — RUNNABLE_TEST_TYPES, runOneTest, createTask, failTask (child failure tasks).\n- scripts/gate-run.mjs and scripts/check-*.mjs — how a gate is wired.\n\n## IN-SCOPE INVENTORY\n- Law rows: PROOF_LAW, CONTRACT_LAW, CONTRACTS_FORMAT_LAW (exist); add nothing else unless a task files `law_insufficient`.\n- New table `capability_contracts` (main DB): key, surface, protocol, executor, platform, min_invocation (JSON), max_invocation (JSON), fields (JSON array of {name,required|optional|conditional,type,enum,default,nullable,cardinality,min,max,format,depends_on,conflicts_with,one_of,omitted_means}), ack_shape (JSON), return_shape (JSON), error_shapes (JSON array), discovered_from, state ∈ {discovered, executable, proven}, proven_receipt, updated_at.\n- New table `proof_runs` (LEDGER DB, or columns on `events`): cause, raw_invocation, raw_confirmation, raw_return, receipt_id, trace_id, parent_receipt_id, surface, started_at, finished_at — written by WT-0485; the schema is defined here so every plane writes the same shape.\n- Deploy gate scripts/check-proof-law.mjs: refuses a work-task submit or a directory row `test_state=proven` whose latest proof_run lacks any of the five fields or whose `surface` differs from the declared surface.\n- No public page: the law is read from GET https://ops.miscsubjects.com/api/work → governing_invariants (owner order 2026-09-23: no articles unless he asks).\n\n## OUT OF SCOPE\n- Running any capability. Building the resolver (WT-0471). Writing the ledger writer (WT-0485). Changing the six-column sheet (WT-0473).\n\n## ONTOLOGY (separate axes; never a flat string)\n- TOOL SURFACE: the law itself is surface-neutral; the gate runs in scripts/land.mjs\n- CAPABILITY: LAW_READ, LAW_WRITE (D1_EXEC on `laws`), GATE_PROOF\n- OBJECT: rows of `laws`, `capability_contracts`, `proof_runs`; work-task evidence\n- ROUTE / CONTEXT: main D1 (site plane) and LEDGER D1 (machine plane); the deploy machine\n- PROTOCOL: SQL over the dispatch door; Node process for the gate\n- EXECUTOR: Pages Functions Worker; node on the deploying Mac\n- PLATFORM: Cloudflare D1 / Pages; the build\n\n## DISCOVERY (run these first; they answer, they do not prove)\n- `curl -sS https://ops.miscsubjects.com/api/work | python3 -c \"import json,sys; [print(l['key'], '·', l['rule'][:120]) for l in json.load(sys.stdin)['governing_invariants']]\"`\n- `node -e \"import('./scripts/gate-run.mjs')\"` is not how gates run; read scripts/land.mjs to see the phase order, then scripts/check-work-acceptance.mjs as the model for a gate that reads work tasks.\n\n## CONTRACT (FIELD LAW)\n- Contract of a law row: key (required, unique, UPPER_SNAKE), level ∈ {constitutional, mutable} (required), category (required, lower-kebab), rule (required, plain prose, ≤ 4,000 chars), rationale (required), binding_on (JSON array; `[\"all\"]`), added_by (required: agent + session), added_at (ISO with offset), enabled (0/1, default 1). Omitting enabled means enabled. Conflict on key updates rule and rationale only (ON CONFLICT(key) DO UPDATE).\n- Contract of a capability_contracts row: every field above; `fields` entries are the FIELD LAW itself; `state` defaults to discovered; `proven_receipt` is required when state=proven (CHECK constraint).\n- Contract of a proof_run: cause (required; one of user_request | task:<WT id> | parent:<receipt id> | event:<id> | webhook:<hook id> | model:<run id>), raw_invocation (required, ≤ 200,000 chars, written BEFORE execution), raw_confirmation (required after execution; may be `NONE (<reason>)`), raw_return (required; failures verbatim), receipt_id (required), trace_id (required), parent_receipt_id (nullable), surface (required; one of the WT-0472 spelling ids or a plane executor id), started_at/finished_at (ISO).\n\n## MINIMUM VALID INVOCATION\nInsert a law: `curl -sS -X POST https://ops.miscsubjects.com/api/dispatch -H \"x-terminal-key: $TERMINAL_KEY\" -H \"content-type: application/json\" -d '{\"key\":\"D1_EXEC\",\"body\":\"INSERT INTO laws (key,level,category,rule,rationale,binding_on,added_by,added_at,enabled) VALUES (\\\"X_LAW\\\",\\\"mutable\\\",\\\"proof\\\",\\\"rule text\\\",\\\"why\\\",\\\"[\\\\\\\"all\\\\\\\"]\\\",\\\"agent\\\",\\\"2026-09-23T00:00:00-07:00\\\",1)\"}'` (the key is `grep '^TERMINAL_KEY=' ~/.build-vault.env`).\n\n## FULL / MAXIMUM INVOCATION\nThe same call with can_be_modified_by, violations, last_violation_at set; plus the CHECK-constrained capability_contracts insert with all 17 columns; plus `node scripts/check-proof-law.mjs --task WT-0470 --strict` before landing.\n\n## RAW CONFIRMATION SHAPE\nD1_EXEC returns `{\"ok\":true,\"result\":{\"changes\":1,\"last_row_id\":<n>}}` with HTTP 200; a refused governed table returns HTTP 403 `{\"ok\":false,\"error\":\"governed_table\",...}` (functions/_lib/governed_tables.js).\n\n## RAW RETURN SHAPE\n`GET /api/work` → governing_invariants contains the row; `SELECT * FROM laws WHERE key=?` returns it; the gate prints `proof-law: <n> claims examined, <m> refused` and exits 0/1.\n\n## ERROR SHAPES\n- `D1_ERROR: no such table` (schema not migrated; add migrations/0484_capability_contracts.sql and land it).\n- `governed_table` 403 when writing work_tasks/articles/directory through D1_EXEC.\n- `unknown_fields` 400 / `acceptance_test_not_executable` 422 from createTask.\n- Gate exit 1 with the list of claims lacking fields (never suppress; fix the claim).\n\n## RECEIPT / TRACE / PARENT LINKAGE\nEvery D1_EXEC through the dispatch door writes an events row (source=dispatch, key=D1_EXEC) and a receipt at https://miscsubjects.com/receipt/<id>; cite the receipt id of the law insert and of the migration in evidence.\n\n## TEST MATRIX\n| case | what runs | kind |\n|---|---|---|\n| law rows readable | GET /api/work governing_invariants has PROOF_LAW and CONTRACT_LAW | live |\n| schema exists | SELECT COUNT(*) FROM capability_contracts returns 0 or more (no error) | migration |\n| gate refuses | a fixture task with evidence.verification=\"HTTP 200\" and no raw_return is refused by check-proof-law.mjs | fixture |\n| gate accepts | a fixture with all five fields and surface matching passes | fixture |\n| amendment path | POST /api/work/task/WT-0470/fail with failure_class law_insufficient creates a child WF task | live |\n\n## ACCEPTANCE TESTS (mechanical; the infrastructure runs them)\n- `{\"type\": \"sql_count_at_least\", \"id\": \"laws\", \"sql\": \"SELECT COUNT(*) AS n FROM laws WHERE enabled=1 AND key IN ('PROOF_LAW','CONTRACT_LAW')\", \"min\": 2}`\n- `{\"type\": \"contains\", \"id\": \"work_object\", \"url\": \"https://ops.miscsubjects.com/api/work\", \"needle\": \"PROOF_LAW\"}`\n- `{\"type\": \"http_ok\", \"id\": \"page\", \"url\": \"https://miscsubjects.com/a/proof-law\"}`\n- `{\"type\": \"contains\", \"id\": \"page_text\", \"url\": \"https://miscsubjects.com/a/proof-law\", \"needle\": \"An HTTP 200 proves an HTTP 200\"}`\n- `{\"type\": \"evidence_present\", \"id\": \"commit\", \"field\": \"commit\"}`\n- `{\"type\": \"evidence_present\", \"id\": \"gate\", \"field\": \"gate_run\"}`\n- `{\"type\": \"evidence_present\", \"id\": \"live\", \"field\": \"verification\"}`\nEvidence fields the submitting agent supplies: commit, gate_run, verification. `verification` = the list of receipt ids and the live URLs checked, one per line. `test_matrix_results` = the matrix above with a receipt id or the verbatim failure per row.\n\n## KNOWN FAILURES / REGRESSION FIXTURES (preserve; never rewrite into success)\n- transport 2xx treated as success (the whole 2026-09 CONTRACTS run: 1,698 HTTP 2xx rows of 10,072 were counted as \"answered\", not as \"the operation succeeded\")\n- `--help` exit 0 accepted as capability proof (cli_tools layer)\n- a model running a command itself and reporting the surface as proven (every session before 2026-09-23)\n\n## DEPENDENCIES\n- depends_on: none (parallel start)\n- OWNS (only this task rewrites): migrations/0484_capability_contracts.sql (new); scripts/check-proof-law.mjs (new); article proof-law (new); rows PROOF_LAW / CONTRACT_LAW in `laws`\n- SHARED (additive edits only): functions/_lib/work_object.js — additive only: export the proof_run shape as a constant other tasks import; do not change createTask or runOneTest semantics; scripts/land.mjs — wire the new gate the way the 66 existing gates are wired\n\n## HANDOFF FOR NEXT SESSION\n- If the migration landed but the gate is not wired: `grep -n check-work-acceptance scripts/land.mjs` shows the wiring pattern.\n- State in evidence: receipts of the two law inserts, the migration commit, the gate run output with the count of claims examined.\n\n## DONE LAW (this task is done when every line is true and evidenced; not before)\n- Both laws present in governing_invariants (mechanical).\n- capability_contracts and proof_runs exist with CHECK constraints (mechanical).\n- check-proof-law.mjs runs in land.mjs and refuses the fixture (evidence: gate_run output).\n- Every subsequent task cites this id; no task carries its own definition of proof.\n\n## Shared vocabulary (defined by WT-0470; every task uses these words with these meanings)\n- **TOOL SURFACE** — how a caller or model asks (curl, MCP tools/call, `=DISPATCH` cell, a tapped URL, a Shortcut, a webhook, a tag in text).\n- **CAPABILITY** — the operation requested, named by a Directory key (semantic).\n- **OBJECT** — what it acts on (a chat, a file, a profile, a row, a page).\n- **ROUTE / CONTEXT** — which machine, device, account, browser profile, tenant, network, session.\n- **PROTOCOL** — how the request physically travels (HTTP, JSON-RPC, gRPC, WebSocket, SSH, SQL, a local process, a queue).\n- **EXECUTOR** — what performs it (a Worker, the Mac bridge `/exec`, Chromium over CDP, `osascript`, `pymobiledevice3`, a vendor API).\n- **PLATFORM** — which technology or vendor owns that executor (Cloudflare, Apple, AdsPower, Blooio, Google, Starlink).\n- **RAW CONTRACT** — the exact physical invocation sent, fully resolved.\n- **CONFIRMATION** — the executor's immediate acknowledgement (HTTP status + headers, spawn/exit metadata, JSON-RPC ack, WebSocket ack, queue receipt).\n- **RETURN** — the final result, verbatim, including failure payloads.\n- **RECEIPT** — evidence and provenance: receipt id/URL, trace id, execution id, timestamps, parent linkage.\n\n## Definition of proof (PROOF_LAW, governing invariant; read it: GET https://ops.miscsubjects.com/api/work → governing_invariants)\nA capability is proven only when the DECLARED invocation surface itself ran and the five fields exist for that run: CAUSE (why it ran: user request / task / parent invocation / event / webhook / model call), RAW INVOCATION (the fully resolved physical contract actually sent), RAW CONFIRMATION (the executor's acknowledgement), RAW RETURN (the actual output, failures verbatim), PROOF / RECEIPT (receipt id/URL, trace, execution id, timestamps, parent linkage sufficient to inspect or replay).\nAn HTTP 200 proves an HTTP 200. A webhook acknowledgement proves receipt. Hidden bash proves bash. A sibling implementation, documentation, a model doing it elsewhere, or the dispatcher working while the surface under test never ran prove nothing about that surface. A missing field is a missing implementation requirement, never something to invent. Existing failures stay as evidence and become regression fixtures; they are never rewritten into success.\n\n## Six-column projection (unchanged; not the source of truth)\n`TOOL NAME | ONTOLOGY | RAW INVOCATION | RAW CONFIRMATION | RAW RETURN | PROOF / RECEIPT` — the build workbook sheet `sh_nyab2cgy` (vault `CONTRACTS_WORKBOOK_SHEET`, 11,035 rows on 2026-09-23). No seventh column, no contract-type column, no prose in place of an executable invocation. Extra metadata belongs in the canonical capability / task / receipt objects.\n\n## Parallelism law\nOther tasks run at the same time in other sessions. Own only the files and objects named under OWNS; touch a shared file only as named under SHARED (additive, never a rewrite). If this task finds the global law insufficient, it files an amendment: `POST /api/work/task/<this id>/fail` naming failure_class `law_insufficient`, layer `WT-0470`, and the missing invariant — it never creates a second standard. Ask the build, never the owner: keys are in `~/.build-vault.env` (`grep '^NAME=' ~/.build-vault.env`; `CLOUDFLARE_API_TOKEN=$CF_API_TOKEN` is a shell reference, resolve `$NAME`). The owner key travels as header `x-terminal-key`. Deploy only with `node scripts/land.mjs \"<WT id> what changed\"` from `~/miscsubjects-pages`. Submit evidence: `POST https://ops.miscsubjects.com/api/work/task/<id>/submit {agent, evidence:{commit, verification, …}, changed:[…]}` with header `x-terminal-key`.\n\n## Shared canonical objects and files — never independently rewritten (additive edits only, named per task)\n- `functions/api/dispatch.js` (the one door; runHttp/runFn/tenant delegation) — owner WT-0471.\n- `functions/_lib/invocation_methods.js`, `functions/_lib/grammar.js`, `functions/_lib/projection_manifest.js`, `functions/api/tools/[[path]].js`, `functions/api/mcp.js`, `functions/_lib/mcp_inspect.js` — owner WT-0472 (spellings and model projections).\n- `functions/_lib/event_log.js`, `functions/_lib/wire_log.js`, `functions/_lib/lean_receipt.js`, `functions/_lib/invocation_record.js`, the `events` table and R2 `logs/` — owner WT-0485 (ledger).\n- `functions/_lib/admin_session.js` (tokens, capabilities, tenants), `functions/_lib/tenant_devices.js`, `functions/api/onboard/[[path]].js` — owner WT-0487 (authority) / WT-0488 (onboarding).\n- `functions/_lib/mac_bridge.js`, `bridge/server.js`, `bridge/device_auth.js`, `bridge/surface-run.py`, `bridge/surface-verbs.py`, `bridge/bridge-run.py`, `bridge/bridge-browser.mjs`, `public/device-kit/*` (synced copies) — owners WT-0474 / WT-0475 / WT-0478.\n- `functions/_lib/work_object.js`, `functions/api/work/[[path]].js`, the `laws` and `work_tasks` tables — owner WT-0470 (law rows) and the build (task engine).\n- `scripts/contracts-*.mjs`, `apps-script/Contracts.gs`, the `CONTRACTS_RUN` directory row, sheet `sh_nyab2cgy` — owner WT-0473.\n- `scripts/ship.mjs`, `scripts/land.mjs`, `scripts/write.mjs`, `scripts/check-*.mjs`, `.githooks/*` — governed; add a gate only by adding a new `scripts/check-<name>.mjs` and wiring it as the existing gates are wired.\n",
    "state": "open",
    "priority": 1,
    "revision": 1,
    "depends_on": [],
    "permitted_capabilities": [
      "dispatch",
      "d1",
      "bridge",
      "sheets",
      "receipts"
    ],
    "acceptance_tests": [
      {
        "type": "sql_count_at_least",
        "id": "laws",
        "sql": "SELECT COUNT(*) AS n FROM laws WHERE enabled=1 AND key IN ('PROOF_LAW','CONTRACT_LAW')",
        "min": 2
      },
      {
        "type": "contains",
        "id": "work_object",
        "url": "https://ops.miscsubjects.com/api/work",
        "needle": "PROOF_LAW"
      },
      {
        "type": "evidence_present",
        "id": "commit",
        "field": "commit"
      },
      {
        "type": "evidence_present",
        "id": "gate",
        "field": "gate_run"
      },
      {
        "type": "evidence_present",
        "id": "live",
        "field": "verification"
      }
    ],
    "required_evidence": [
      "commit",
      "gate_run",
      "verification"
    ],
    "parent_task": null,
    "supersedes": "WT-0470",
    "failure": null,
    "failure_count": 0,
    "last_result": null,
    "completed_at": null,
    "created_at": "2026-09-22T22:33:11-07:00",
    "updated_at": "2026-09-22T22:33:11-07:00",
    "audit": "/api/work/task/WT-0490/audit",
    "submit_to": "/api/work/task/WT-0490/submit"
  }
}