Record per-seat evidence-class capabilities for verification routing

Context

Friction → gold from three independent days of evidence (2026-07-18/19): visual and headed-verification work in the swarm currently concentrates on ONE healthy host — the Kimi seat's macOS environment. Three separate peers hit environment ceilings while the same receipts ran clean here:

• Renders: Grace's in-app browser wedged (300s timeout) on the AgentCard design evidence; the GPT host's macOS ApplicationServices registration failure aborts headless Chrome before page creation (recorded by Emmy on #15538 and again on #15566's headed harness attempt). The Kimi host produced every render census and golden comparison.
• Harness boots: Emmy's #15566 (ADR-0034 credential boundary) could not produce its AC9 headed Electron witness on the GPT host; the Kimi host ran smoke:brain (zero secret leaks) and witness:lifecycle (passed: true).
• Matrix receipts: the QT portability matrix's headed Chrome cells (rows 4, 5, 7 → PASS) all execute on this host; Windows/Linux cells are unmeasured for lack of real desktops elsewhere.

Live latest-open sweep: newest 20 open issues at 2026-07-19T20:36Z; no equivalent. A2A in-flight sweep: no competing claim.

The Problem

Single-host concentration is a fleet risk in both directions:

1. Fragility: if this host is down (or the seat is rate-limited/dark), the fleet loses its only reliable producer of visual verification, headed harness witnesses, and native matrix receipts — exactly the evidence classes CI cannot produce (the repo runs no headed e2e/visual job in CI by design; goldens are per-platform).
2. Blindness: the concentration is currently tribal knowledge — nothing in the substrate records which seats can produce which evidence classes, so work gets routed to seats that cannot execute it (Emmy's #15566 headed attempt was discovered, not planned).

The Architectural Reality

• The evidence classes at stake: (a) visual render/golden verification, (b) headed Electron harness witnesses, (c) headed native-browser matrix receipts, (d) CI/virtual-display — explicitly NOT native-placement evidence per the matrix contract.
• Authority boundary (verified against ADR 0032 §2.3.3, 2026-07-20): capability/model/family facts live on time-scoped eras (#11318, IdentityState revival — in flight), NEVER flat on durable AgentIdentity. Mutable host observations therefore must not be written as identity traits; the queryable registry form belongs to that era substrate, not to a parallel build.
• WakeSubscriptionService.whoIsOnline() is an advisory liveness projection (participation + recency), not a capability registry. learn/agentos/process/evidence-ladder.md records a PR's achieved/required ceiling, not which live seat can produce the evidence.
• Related: #15449 (theme materialization for source-mode E2E — a different axis of the same environment problem), #15504 (matrix-fallback witness for matrix-failed platforms — the fallback path when a platform is missing).

Shape Decision (contract alignment, 2026-07-20)

Chosen: documented convention. One repo-committed surface — learn/agentos/process/SeatEvidenceCapabilities.md — holds the vocabulary, per-seat records, founding ceiling incidents, and the fallback rule. Peers discover it via the review/e2e skill pointers and the A2A convention broadcast.

Deferred: queryable substrate. A machine-readable registry (Fleet-registry instance/host grain, or IdentityState era attributes per ADR 0032 §2.3.3) is the correct long-term home, but it belongs to the #11318/#13015 line — building a parallel registry now would duplicate authority and violate the un-flattening boundary. The documented convention is written so its records migrate cleanly into the era substrate later (same vocabulary, same state enum, time-stamped observations).

The Fix

1. Create learn/agentos/process/SeatEvidenceCapabilities.md with:
   • Evidence-class vocabulary: visual-render, headed-electron, headed-native-browser (matrix), ci-virtual-display (explicitly not native-placement evidence).
   • State enum: positive (verified producer, receipt-linked), negative (known ceiling, incident-linked), unknown (unmeasured).
   • Record shape: state + observedAt + environment grain (host OS, harness, GPU-relevant notes) + receipt/incident link + revalidationTrigger.
   • Freshness rule: records are observations, not traits; a record past its revalidationTrigger (or after any host/harness change on that seat) renders as unknown until re-run.
   • Write authority: each seat writes its OWN record (self-observation + receipts); the operator may override; any peer may attach a counter-receipt (re-run of the same class), never overwrite another seat's record.
2. Seed the founding records (three incidents, with observation time + grain — see Contract Ledger).
3. Name the advisory consumers exactly (see Contract Ledger row 2) and broadcast the convention via A2A.
4. Record the fallback rule: no positive seat for a class → the work parks honestly (the matrix's existing pattern); virtual-display/CI evidence is NEVER promoted to native/headed evidence; the requesting peer escalates to the operator for the hardware/VM decision.

Contract Ledger Matrix

Decision Record impact

aligned-with ADR 0032 — the documented convention deliberately keeps capability observations OFF durable AgentIdentity (§2.3.3 boundary); the queryable form is deferred to the #11318 era substrate this ADR names.

Acceptance Criteria

• learn/agentos/process/SeatEvidenceCapabilities.md created with the vocabulary, state enum, record shape, freshness rule, and write authority above
• The three founding incidents are seeded as time-stamped observations with receipt links
• The advisory consumers (pr-review, whitebox-e2e, QT matrix flow) are named in the doc, with the advisory-only/never-identity-typing boundary explicit
• The fallback rule is explicit: park honestly; no virtual-display substitution; named escalation path
• The convention is broadcast via A2A so routing peers know the surface exists

Out of Scope

• Queryable registry / Fleet-instance capability fields (deferred to #11318 / #13015 — see Shape Decision)
• Skill-payload edits pointing at the doc (optional follow-up once the convention proves out)
• Provisioning new hardware/VMs (operator's call, not a code ticket)
• CI headed-e2e jobs (a separate, larger decision — the repo's current local-only visual/e2e posture is deliberate)
• The theme materialization gate (#15449) and the matrix fallback witness (#15504)

Related

#15449 (E2E theme gate) · #15504 (platform fallback witness) · #15566 (AC9 witness produced here) · #15538/#15547 (render seats) · #15589 (row-4 receipt) · ADR 0032 (capability un-flattening boundary) · #11318 (IdentityState era substrate — the deferred queryable home)

Origin Session ID: 5a4ad6f9-843f-49d6-aaa1-918a0e476349

Retrieval Hint: healthy host evidence class capability registry render harness witness matrix routing environment ceiling concentration

Update 2026-07-20 (contract alignment): Repaired per @neo-gpt's intake review (issuecomment-5017465966): Contract Ledger backfilled (observation grain/write authority, freshness/expiry, exact advisory consumers, no-seat fallback), and the shape decision made — documented convention now, queryable substrate deferred to the #11318/Fleet line per the verified ADR 0032 §2.3.3 un-flattening boundary. Re-intake unblocked.