Shared-device arbitration

How far up the trust ladder

Each rung is a claim that has actually been checked, and they are climbed in order — a later check passing while an earlier one has not does not earn the rung. This mutation has reached Adopted allele.

1. ✓AI proposalA model asserts this change is beneficial.Not trust on its own
2. ✓Unverified proposalRecorded, but nothing is checked yet.Not trust on its own
3. ✓Source verifiedThe referenced commit and digest resolve.Not trust on its own
4. ✓Build verifiedProvenance shows how the artifact was produced.
5. ✓Tests passedThe adopter’s suite ran green in a sandbox.
6. ✓Policy passedSecurity and licence gates were satisfied.
7. ✓Maintainer approvedA human with authority said yes.
8. ✓Adopted alleleThe capability now lives in this genome.

Evidence checklist

The six gates a mutation clears before it can be offered onward. Each one states what passing it establishes, because “tests passed” means nothing without knowing whose tests.

• ✓

  Source digest

  clearedSource verified

  The referenced commit and content digest resolve to the same bytes.

• ✓

  Build provenance

  clearedBuild verified

  An attestation shows how the artifact was produced, and by what.

• ✓

  Tests

  clearedTests passed

  The adopter's own suite ran green against the change in a sandbox.

• ✓

  Security policy

  clearedPolicy passed

  No new advisory was introduced and the policy gate was satisfied.

• ✓

  Licence

  clearedPolicy passed

  The change's licence is compatible with the adopting genome's.

• ✓

  Maintainer approval

  clearedMaintainer approved

  A human with authority over the adopting project said yes.

• ◉RUNRuntime observation. Measured from a real or sandboxed execution.Fleet telemetry from 34 classroom devices over six weeks. (34)2027-03-02 · sha256:d0e91a77

Measured phenotype

What the change did when it ran, against what it did before. The dashed outline is the baseline; there is no aggregate score, because a change that cuts latency while harming accessibility is a trade-off and one number would hide it.

The change itself

An illustrative before and after, pinned to content digests. The digests are the authoritative part; the excerpt is there to make the shape of the change legible.

Reference digest

sha256:27ad9017

Alternate digest

sha256:6e90d4fa

Commit

commit:6e90d4fa18

Test suites touched

1

registry.claim(device);

await arbiter.lease(device, seatId, { ttlMs: 30_000 });

Sandbox runs

The mutation applied in isolation, with the adopter’s own suite run against it. This is the step that turns a proposal into a measurement.

• node 22 on ubuntu-24.04 · fleet-34

  pass · 392/392 · 204.6s

  CAEV:997 · sha256:d0e91a77

  › fleet-arbitration-suite ....... 61 passed
  ⚠ 1 API break: registry.claim() removed
  ✓ accepted locally, not offered upstream

Who this applies to

12 relatives are eligible and 401 would need manual review, at a parent compatibility of 0.34. Eligibility is not adoption: every one of them decides for itself.

Provenance

Claims bound to immutable artifacts. An attestation is not a promise that the change is good — it is a signed statement about how it was produced, read here as SLSA, in-toto, CycloneDX pedigree and W3C PROV triples.

Decision

A decision is itself a record: attributable, reasoned and signed. Choose one to see what would be written on behalf of KEYLIT.