Aureon Harmonic Design Suite

Build an institutional, research-led public website from current evidence. Use Harmonic Nexus as the shape of the feedback loop, never as automated aesthetic truth or scientific validation.

Operating sequence

1. Locate the active Aureon repository. Preserve unrelated dirty state and runtime-only credentials.
2. Read references/design-doctrine.md, references/harmonic-feedback-contract.md, and references/release-authority.md.
3. Inventory the current website/ tree, claims inputs, research catalogue, ORCID material, pitch evidence, and release state. Label facts, interpretations, hypotheses, and unavailable evidence.

4. Run the deterministic baseline:

   python skills/aureon-harmonic-design-suite/scripts/run_design_cycle.py --goal "<bounded design objective>"

5. Run python -m aureon.operator.design_research_refresh --repo-root . before using volatile research, peer, ORCID or public-attention evidence in a candidate. It validates only redacted local public-source snapshots, schedules due observations, and never clears artwork, fetches a provider, or grants candidate/release authority. Refresh competitor evidence from official sources when it is older than the configured freshness window. Record URL, checked time, pattern evidence, and use boundary. Never copy source code, copy, imagery, or trade dress. Before translating stakeholder feedback, require a passing aureon.operator.design_stakeholder_feedback audit of the canonical human-created redacted declaration. Only the declaration binding, freshness, aggregate counts, deterministic capsule hashes, and exact controlled-code route capsule may cross into design planning. Raw correspondence, the human-redacted evidence snapshot, identities, quotations, provider metadata, URLs, finance, and free-form rationale never enter a worker context. This is planning evidence only and grants no candidate, package, release, connector, credential, or deployment authority.
6. Before selecting a baseline for a successor candidate, use WebsiteOperator.observe_live_surface or aureon-website live-drift on the relevant production routes. This is read-only drift sensing only: a matching receipt is not release authority, and a divergent or incomplete receipt requires a fresh verified backup plus an explicit owner-scoped source-reconciliation decision. The unchanged v1 decision may retain local canonical source. Only the exact v2 decision may select a fresh manifest-bound verified backup below artifacts/homepl-backups/; candidate control revalidates it byte by byte, rejects server-only paths and recognised credential patterns, and copies only public static files plus the intentional .htaccess into its sealed artifact workspace. Never infer a source, auto-copy live content into website/, or overwrite production from local source.

Optional website-source rationalisation plan

After normal live reconciliation has selected the current canonical website/ tree, use aureon.operator.website_source_rationalisation only when a read-only retained/omitted source projection is needed for owner review. Follow WEBSITE_SOURCE_RATIONALISATION.md. Invoke it only through the runbook's externally hash-checked python -I -S -B isolated launcher; direct file and python -m execution are prohibited and fail closed. The immutable proposal binds the full unchanged source tree, the authenticated reviewed release builder's bounded -VerifyOnly public-runtime closure, its launcher/planner/PowerShell/writer/runner/policy identity, a disjoint complete retained/omitted partition, and fixed projections of 4,500,000 total bytes, 2,200,000 image bytes, 350,000 CSS bytes, and a 500,000-byte largest non-code asset. It remains proposal-only, blocked-candidate-qa-not-run, and ineligible for the next local gate. A separately supplied exact named-owner acknowledgement and any passing validation are review-only, carry staging_authority: none, and cannot be reused as a staging token. The validation writer accepts only the exact plan and decision paths and performs its own deterministic replay; it never persists caller-supplied receipt data.

The module may validate one separately supplied exact named-owner decision that expires no more than four hours after approval. It never creates that decision or stages the projection. An omitted path means only not-in-public-runtime-closure; omission does not prove safe deletion, source completeness, candidate readiness, or release readiness. Neither the plan nor a passing validation grants source mutation or removal, staging, candidate creation or mutation, packaging, release, credential, network, publishing, or deployment authority.

Runtime-optimisation structural validation (production blocked)

After owner-controlled live backup and source reconciliation have selected one exact source, use aureon.operator.website_runtime_optimisation only for structural measurement-declaration validation. Follow WEBSITE_RUNTIME_OPTIMISATION.md. Production proposal compilation and writing are hard-blocked with blocked-reviewed-measurement-provenance-tool-not-installed; the QA role has no compile grant, and the isolated launcher must create no proposal in this state.

Structural validation does not prove freshness, provenance, derivative existence, execution, or acceptance. Human Markdown findings are supporting design evidence only and may not be scraped into transformation instructions. A repo-relative tool path plus a self-supplied hash is not measurement proof. Before any separately reviewed production re-enable, require a pinned reviewed measurement tool, recorded invocation provenance, and independently readable derivative artifact paths, SHA-256 values, byte counts, and decoded dimensions. The browser contract must retain executable zoom, interactive/data-failure, derivative-integrity, research-freshness, and report/source binding criteria.

The capability has no encoder, minifier, CSS pruner, reference rewriter, copy, deletion, candidate, staging, package, credential, network, publication, or deployment entrypoint. Test-fixture projection arithmetic is not a production proposal, candidate, QA receipt, release signal, or owner decision. Any eventual transformation requires a separate source-bound staged-candidate workflow and the full browser contract plus named human visual acceptance. PublicWebsiteDesignWorker receives neither structural validation nor compiler access.

Required investor-copy, artwork, and HNC controls

Before deriving candidate scope or issuing a worker lease:

1. Run the investor-copy quality audit against the selected baseline and rerun it against the exact staged candidate:

   python -m aureon.operator.design_investor_copy_quality --repo-root . --website-root website

   Replace website with artifacts/website-candidates/<run-id>/website for staged validation. Treat every blocker as a veto. Investor-facing surfaces must not publish internal or fundraising figures, hard-coded research or traction totals, rolling KPI counters, module/test/commit counts, or stale dated snapshot counters. Prefer durable evidence categories and links that let a reviewer reopen authoritative sources. A passing receipt is copy-quality evidence only; it cannot rewrite or stage copy and grants no candidate, promotion, package, release, or deployment authority. Never reuse an earlier dated copy receipt after the policy, selected source, or audited route hash changes; rerun the audit and bind the current policy and route hashes. WebsiteOperator must carry this control as the investor_copy_quality_current design-cycle hard gate, retain only privacy-minimised policy/route/finding hashes and counts, and rerun the exact binding before release packaging. If the exact investor-copy repair requires a claim-governance delta, use aureon.operator.design_investor_copy_governance only for its bounded owner-gated protocol. With --decision and no --apply, it verifies the exact immutable named-owner decision and fully simulates the three-file after-state in a shadow repository without canonical writes. Broad system access, a time-window approval, deployment approval, or conversational consent is not that decision. --apply is permitted only when the separately supplied decision is fresh, exact, immutable, bound to the module's current proposal and validation hashes, and every source/prestate/shadow audit replays immediately before the transaction. The transaction may change only the public-claim register, controlled stakeholder-feedback declaration, and investor design brief; it never edits the investor-copy policy or website/, and grants no candidate, package, release, credential, network, or deployment authority.

2. Run the canonical editorial-asset provenance audit before retaining, adding, moving, or briefing any editorial artwork:

   python -m aureon.operator.design_editorial_asset_provenance --repo-root .

   Preserve the global artwork policy as not-cleared. Delivery evidence has no rights effect, and neither a successful integrity check nor one per-asset decision clears the collection. An asset may enter a candidate only when the audit emits its exact candidate-use-ready asset and route capsule after a separate, current decision by the controlled allowlisted named owner-reviewer. A failing audit permits only a work-order-scoped corrective removal of blocked existing use; it never permits an import, addition, substitution, or inferred neighbouring placement. The audit and capsule grant no source-import, candidate, package, release, credential, or deployment authority. When the owner supplies an explicit structured decision, use --prepare-rights-request only with one strict v1 JSON request below artifacts/website-operator/editorial-rights-requests/. The request must explicitly say approved or rejected, name the allowlisted reviewer, select one controlled rights basis, list every exact asset ID, bind the current canonical manifest file SHA-256 and the current exact scope SHA-256 for every and only every selected asset, reproduce the exact controlled usage scope and representation-boundary acknowledgement, and provide the non-future decision time. Never derive or insert any of those human-acknowledged values from delivery, a broad access approval, neighbouring assets, design preference, or the preparation run itself. Preparation verifies the signed manifest binding, re-audits every selected scope, rejects stale or mismatched hashes, and copies the explicitly acknowledged controlled values into separate immutable per-asset decisions plus one privacy-minimised proposal-only artifact as an all-or-none batch. It does not edit the canonical provenance manifest, the global not-cleared policy, website/, asset bytes, a candidate, package or deployment. A separate controlled manifest change and fresh provenance audit are still required before candidate_use_rights_ready can become true. Never copy or transform editorial bytes manually or through the text worker. After an existing persisted source-bound work order exactly declares every approved WebP target, only trusted orchestration may call aureon.operator.design_editorial_asset_candidate_importer.import_editorial_assets_to_candidate. Require its fixed candidate-local immutable receipt and a passing verify_candidate_editorial_asset_import replay before later candidate validation. The importer can write only exact content-addressed verified WebPs inside one staged candidate; it cannot write website/, use network or credentials, package, release, or deploy.

3. Audit the source-neutral HNC evidence-control graph contract:

   python -m aureon.operator.design_hnc_evidence_graph --repo-root .

   Treat a passing contract or an immutable bundle beneath artifacts/website-components/ as source-neutral component evidence only. Do not copy or transplant its HTML, CSS, or JavaScript into website/ or a staged candidate until the owner selects the source baseline, any drift-required verified backup exists, and a fresh exact-path work order binds the selected bundle outputs and hashes. Named human visual acceptance remains required. The contract and bundle create no candidate, transplant, promotion, package, release, or deployment authority.

Required pre-work-order brief audit

Before deriving candidate scope, run:

python -m aureon.operator.design_evidence_brief --repo-root .

A passing result is brief-ready planning evidence only. It binds the source document, public-claim register, current redacted research-refresh declaration, current privacy-safe stakeholder-feedback declaration, exact permitted public routes, source inputs, route claim capsules, controlled-code route feedback capsules, visual direction, reduced-motion equivalence, and route allow-lists. It does not expose raw correspondence or the redacted source snapshot and does not satisfy live reconciliation, owner source selection, candidate staging, candidate validation, browser QA, human visual review, package readiness, owner approval, or deployment.

7. Convert the reconciled baseline into one bounded work order. Derive the route and exact file allow-list from the audited brief, then constrain them again in the reconciled v4 aureon.operator.design_candidate_control work order before a worker edits anything. Bind the source baseline, current live-surface receipt, candidate artifact path, claim-impact declaration, remote-origin policy, test policy, editorial-binary policy and acceptance proof. If live drift exists, the work order must also bind the fresh verified backup and owner-supplied time-limited source decision; workers must never generate that decision. A v2 verified-live-backup selection additionally binds its exact source root, manifest hash, WebsiteOperator tree hash, and candidate-baseline tree hash, and fails closed if any source or evidence byte changes. Until the staged-delivery runner records the brief and claim-capsule hashes beside the work-order hash, do not describe a v4 work order alone as brief-bound.

   Keep rights readiness distinct from candidate readiness. candidate_use_rights_ready means only that the provenance audit found at least one exact, current, named-human per-asset rights capsule. It does not mean that any candidate contains that asset. A global capability-registry view must keep candidate_asset_ready: false; only a candidate-specific runner transition bound to an immutable importer receipt and a passing replay may record candidate-assets-ready.

8. Use the specialist design council:

   • Website Design Director
   • Competitor Research Scout
   • Brand and Design-System Lead
   • Technical Editorial Writer
   • Claims and Evidence Editor
   • Stakeholder Insight & Privacy Editor
   • Motion Designer
   • Visual Asset Director
   • Accessibility and Performance QA
   • Design Release QA

9. Autonomous workers stage changes only beneath artifacts/website-candidates/<run-id>/website/; they never write or apply the canonical website/ tree. A worker must receive one broker-issued, short-lived, hash-bound lease with the sealed route purpose, claim capsule, visual/reduced-motion rules, acceptance criteria and prohibited inferences. Version 1 accepts data only: its built-in declarative manifest applier may apply one text-only exact-path patch, never arbitrary worker Python or shell code. A worker's passed string is request bookkeeping, not test evidence. It may not choose a command, arguments, environment, retry, viewport or pass state. The broker rejects links/reparse points and hard-linked candidate files, verifies its full tree delta once, consumes the lease, and hands the result to staged-candidate validation. Before any later candidate decision can consume a test observation, trusted orchestration must separately run the complete operator-pinned suite through aureon.operator.design_candidate_test_evidence, seal the immutable receipt hash independently, and replay strict verification. Structural verification explicitly retains origin_attested: false; require both the trusted orchestration seal and evidence_passed: true. Neither module installation, a structurally valid receipt, nor evidence_passed: true grants candidate validation, promotion, package, release, credential or deployment authority. Validate every staged diff for exact scope, blocked files, secret patterns, undeclared remote origins and claim impact. A separate owner-controlled promotion may later make a validated candidate canonical. Record before/after hashes and changed paths. Do not give design agents credentials or a deploy tool.

   The worker submission must also contain claim_surface_manifest, including an empty list for a no-copy change. The staged validator compares the canonical baseline and candidate public text surfaces for the exact changed paths. Every newly rendered surface must have one hash-bound entry with path, kind, claim_id, text_sha256, surface_sha256, and rationale. Classify it only as exact route-capsule permitted-wording, its exact boundary, or a genuine non-claim; a non-claim cannot smuggle an Aureon, customer, adoption, validation, partnership, funding, or commercial assertion. Rationale is a controlled taxonomy label, never free prose: route-permitted-wording, route-claim-boundary, or the matching non-claim label from the claim-surface runbook. Do not refresh a local claim-register hash to evade this control. Dynamic rendered copy that cannot be statically audited is a veto, not an invitation to weaken the check. Follow DESIGN_CANDIDATE_CLAIM_SURFACE.md for the full contract.

   Every worker submission must also include one complete feedback_response_manifest for the exact sealed route feedback capsule. The manifest must close every signal exactly once with controlled response codes, retain each audited disposition and route, bind the exact signal-capsule hash, and keep changed paths and claim ids within the sealed route scope. no-action stays unchanged; declined, deferred, and unchanged responses carry no changed paths or claims; an addressed response must bind actual patch paths and existing signal claim ids. Empty route capsules require an empty response map. Free-form explanations, raw correspondence, identities, quotes, provider metadata, URLs, finance, and inferred neighbouring-route work are forbidden. The broker must validate and hash the complete response manifest against the actual staged diff before accepting delivery.

V4 asset readiness and structural surface replay

For a v4 work order that declares WebP targets, preserve this order:

• The runner first stages the pristine full candidate tree as candidate-staged.
• Before any text-worker context or broker lease is issued, trusted orchestration imports the complete work-order-declared WebP batch into that candidate through the content-addressed importer.
• The runner persists and replays the immutable importer receipt. Only the runner may then record the candidate-specific candidate-assets-ready state.
• The text worker receives only the sealed text-mutation contract after that transition. It has no binary read, write, copy, or import authority, cannot call the importer, and cannot create or assert candidate-assets-ready.
• After the declared text patch, candidate validation performs a final structural surface replay from the current staged bytes. It may accept separately controlled text deltas, but the binary projection must still equal the source-bound baseline plus the exact importer receipt. Reject undeclared, missing, unbound, remote, embedded-media, or otherwise binary-smuggled asset references.

A text-only candidate skips the importer, remains candidate-staged until validation, and must never be labelled candidate-assets-ready. The rights capsule, importer receipt, asset-ready transition, worker lease, structural replay, and candidate receipt are local evidence with no release authority: none may promote website/, package, access credentials, publish, or deploy.

Before calling a motion or resource-budget task passed, run the exact source-bound configuration through aureon.operator.design_motion_performance_budget and preserve its deterministic receipt. Capability-registry readiness is installation evidence only and never executes or infers this result. A motion-budget pass requires both decision.status: pass and decision.eligible_for_next_local_gate: true on the exact replayed receipt. This static result does not prove browser timing, interaction parity, visual purpose, human acceptance, candidate validation, promotion, packaging or release.

10. For a focused browser performance diagnosis, first run python -m aureon.operator.design_candidate_initial_gate against the exact candidate.v1.json and focused staged QA receipt. It revalidates the candidate tree, confirms source binding, and makes the geometry/performance decision explicit. Only eligible-for-repeatability permits the fixed sequential performance series; a rejected initial gate must be preserved rather than retried for a passing outlier. If a Research-route initial gate rejects performance and the existing trace leaves the source-level explanation unresolved, run aureon-website research-attribution --source-root artifacts/website-candidates/<run-id>/website at most once. It is a minimized, self-hosted, runtime-only, analysis-only temporal investigative hint—not causal proof, a performance gate or result, owner-work-order evidence, candidate/package/deployment authority, or a basis to issue or scope a fresh work order. It cannot satisfy candidate-control, source-reconciliation, or owner-decision requirements. It may identify a hypothesis for a separately scoped investigation only. Do not repeat it for a more favourable correlation or performance result. Only after a separately controlled successor candidate exists and independently passes its own initial gate, capture the full browser matrix against the staged candidate, not the canonical site. Use tools/aureon_candidate_visual_review_v1.js with the exact candidate.v1.json; it self-hosts only the staged tree and writes evidence beneath that candidate artifact. A named reviewer must complete every pixel-review disposition and a separate named human acceptance receipt must bind the candidate, visual receipt and manual review. Screenshot differences are review evidence, not an automatic taste score. This local review never replaces the fresh canonical V28 review after owner-controlled promotion.
11. Require exact transitive runtime dependency closure in the release ZIP. An overlay manifest is insufficient when the rendered site loads unverified remote files.
12. After a candidate passes objective gates and staged human visual review, use aureon.operator.design_learning_ledger to record an append-only, source-bound reusable-pattern proposal. It may propose a target within this Design Suite, but it cannot modify a skill automatically; a separate human-reviewed repository change is required.
13. Use WebsiteOperator for release: audit, build, verified Home.pl backup, short-lived package-hash owner gate, explicit deploy, and live HTTPS read-back.

Quality contract

Accept a local candidate only when:

• every hard gate passes under an unchanged test policy;
• every targeted finding is closed;
• no existing hard gate regresses;
• material claims are bound to current permitted evidence;
• the investor-copy quality audit passes against the exact selected source and staged candidate, with no static investor, internal-finance, research-total, traction-total, or KPI-counter figures;
• the editorial-asset provenance audit is current; the global artwork state remains not-cleared; every retained or added asset is bound to one exact candidate-use-ready route capsule backed by a separate controlled allowlisted named-owner-reviewer rights decision; and candidate_use_rights_ready is never relabelled as candidate asset readiness;
• every asset-bearing v4 candidate reaches candidate-assets-ready only through the runner after the trusted content-addressed importer completes the exact batch and its immutable receipt passes current byte, work-order, provenance, route and rights replay verification; text-only candidates never enter that state;
• final candidate validation replays structural public surfaces and asset references from staged bytes, permits only separately controlled text deltas, and proves every binary delta is exactly receipt-bound;
• any HNC evidence-control graph remains source-neutral until owner source selection, any required verified backup, a fresh hash-bound exact-path work order, and named human visual acceptance are all present;
• the current source-bound design-evidence brief passes, every selected route retains its exact permitted claim capsule and static/reduced-motion visual rule, and brief-ready is not treated as candidate-delivery-ready;
• the canonical stakeholder-feedback declaration is current and privacy-safe, every worker receives only the exact controlled-code route capsule, and the staged delivery contains a complete hash-bound response manifest that closes every sealed signal without expanding its path or claim scope;
• source-bound benchmark metadata, public-claim evidence and redacted research-refresh controls pass as non-authoritative input gates; valid expiry-near attention signals are scheduled for refresh rather than relabelled as traction, and not-cleared artwork remains unusable for a new candidate;
• responsive, keyboard, reduced-motion, resource-load, console, and release-closure checks pass;
• source, brief, policy, candidate, screenshot, and package hashes are recorded;
• every focused performance series is preceded by a source-bound initial gate that passes both deferred-render geometry and every fixed initial performance check;
• autonomous V30+ candidates have a reconciled v4 exact-path work order, current live-surface evidence, a fresh owner source-selection decision plus verified backup whenever production drift exists, source baseline, one consumed staged-worker lease where a worker is used, and one consumed V2 candidate-QA attempt bound to the unchanged candidate and canonical tree. The read-only candidate-QA control-plane discovery is metadata-only-no-subprocess and always records sealed verification executed: false plus runner delegation invoked: false. Imported compiler verifier APIs are drift-check-only and cannot claim pre-import source authentication. Only direct compiler-file execution under python -I -S -B with --verify-config or --verify-policy is sealed; trusted orchestration must delegate those read-only replays through the V2 runner during an explicit candidate-QA action, and the runner verifies already compiled artifacts and does not compile them. It uses one bounded subprocess.Popen with shell=False, a 64 KiB aggregate/per-stream output ceiling, a 300-second timeout, and no retry. Trusted candidate-test evidence binds the reviewed Node executable by a source-pinned absolute path, size, SHA-256, and binding digest with no ambient PATH fallback; its separate bounded subprocess.Popen uses shell=False and a 2 MiB per-stream capture ceiling. Trusted orchestration must derive the candidate-control and motion tree hashes, both algorithm identifiers, and captured-manifest hash from one byte-manifest capture; require the V2 motion-compiler verification to agree with all five values and its reviewed source-policy hash; require the V2 test-policy verification to bind the V1 policy payload's content-core hash; run motion first; run V2 candidate-test evidence only after motion passes; and permit the initial browser gate only from candidate-qa-verified. Candidate-test evidence still requires an independently preserved orchestration seal and evidence_passed: true; worker pass strings are never evidence, structural verification remains origin_attested: false, and every newly rendered public text surface is bound to the exact sealed route capsule or rejected;
• every claimed motion/resource-budget pass has an exact replayed receipt with decision.status: pass and decision.eligible_for_next_local_gate: true; installed protocol readiness is never substituted for that decision;
• material V30+ candidates have a source-bound staged browser capture, completed named manual pixel review, and a separate named human visual-acceptance receipt before any owner-controlled promotion discussion;
• reusable patterns have a source-bound Design Learning Ledger record with exact changed paths, regression-test paths and a refresh deadline; its promotion is proposal-only;
• material brand changes receive human visual acceptance.

Stop after five iterations, two no-progress iterations, a repeated identical blocker, missing claim evidence, or any security, accessibility, package-integrity, or authority-boundary veto.

Capability levels

• L0 Atomic: inventory, live-surface drift sensing, owner-source-reconciliation validation for either v1 retained-local source or v2 exact verified-live-backup source, read-only website-source rationalisation planning and exact named-owner-decision validation, structural-only runtime-optimisation measurement-declaration validation with production compilation blocked, research-source refresh audit, stakeholder-feedback audit, investor-copy quality audit, source-bound investor-copy task/work-order preflight, contract replay and exact candidate re-audit, investor-copy governance decision verification and shadow simulation plus separately explicit exact-owner-gated three-file application, editorial-asset provenance audit, explicit-human editorial rights-decision preparation, trusted staged-candidate editorial import and replay verification, source-neutral HNC evidence-graph audit, design-evidence brief audit, route feedback-capsule binding, feedback response-manifest validation, sealed claim-surface comparison, lease-bound staged-worker issue/submission, read-only candidate-QA control-plane and compiler-ingress discovery with no subprocess, candidate-scoped static QA, fixed motion-config compilation, fixed complete test-policy compilation, imported read-only drift-check inspection, runner-delegated sealed direct-file read-only replay, one-shot V2 candidate-QA claim, deterministic motion-first budget execution and replay, trusted hash-bound candidate-test execution and sealed receipt verification, Research route layout attribution, claim read, route capture, contrast, keyboard, reduced motion, performance, initial candidate gate only after candidate-qa-verified, screenshot diff, dependency closure and Design Learning Ledger recording. Live-surface sensing remains observational; workers may only bind an existing owner decision after drift, never create one, choose between v1 and v2, or reconcile production automatically. Website-source rationalisation records only a plan and validation; its omitted manifest, four fixed footprint projections, and passing owner-decision receipt grant no source removal, staging, candidate, QA-pass, package, release, credential, network or deployment authority. Runtime optimisation currently records only structural validation; production proposal compilation and writing remain hard-blocked until reviewed measurement provenance and independently readable derivative evidence exist. Investor-copy governance verification and simulation are read-only, broad access is invalid as approval, and neither design nor coding agents may generate the required named-owner decision or invoke apply autonomously. Editorial rights-decision preparation verifies and records only exact values already acknowledged by the controlled named human; it never makes or infers the human decision. Copy, rights-preparation, asset-provenance, source-neutral HNC, QA-readiness, motion-budget and candidate-test receipts are non-authoritative controls: they never select a source, create or validate a candidate, import an asset, transplant a component, promote source, package, release or deploy. The trusted importer is separate from the text worker and may copy only exact approved content-addressed WebPs into one existing staged candidate under a current persisted work order; its receipt grants no canonical, package, release, credential, network or deployment authority. Research attribution is a single-capture, analysis-only temporal investigative hint, never causal proof, performance-gate evidence, owner-work-order evidence, or candidate/package/deployment authority; it cannot substitute for candidate control, source reconciliation, or an owner decision. The initial gate revalidates the staged candidate and binds a focused browser result before any repeatability series.
• L1 Compound: competitor benchmark, route audit, design-system audit, copy/claim audit, privacy-safe stakeholder-signal translation, bounded candidate.
• L2 Task: route redesign, motion pass, evidence-copy pass, visual asset, scoped repair.
• L3 Workflow: public-site design cycle and website release preflight.
• L4 Role: the ten design-council roles above.

Non-negotiable boundaries

• The public site is read-only; it never exposes operator, credential, trading, grant, filing, or client controls.
• The public narrative exists to attract qualified investors through the thesis, research authority, shared-core leverage, sector relevance, public proof, and next validation. It does not publish raise, valuation, revenue, runway, application, grant, provider-route, correspondence, meeting, portal, operator, deployment, or hosting records.
• Prefer flagship questions, methods, source routes, and attributable evidence over catalogue arithmetic or KPI counters. Public identifiers and dates may appear only when they help a reviewer reopen an authoritative source, such as Companies House, ORCID, Zenodo, or a DOI.
• Platform analytics may support a clearly dated public-attention signal only when the source, measurement window and interpretation boundary are preserved. Treat views, downloads, clones, stars and forks as different signals; never relabel them as citations, customers, production use, scientific validation or independent adoption.
• Keep each analytics window independent. Never sum rolling or overlapping windows, and never add window-distinct visitors or cloners into a cross-window "unique" total. A renamed repository may be presented as one history only after an authoritative redirect or rename receipt is preserved.
• Store visitor-level exports outside every public Git checkout. The release may use reviewed aggregates, hashes and date boundaries; it must not expose visitor identifiers, locations, referrers, search keywords or signed download links.
• Research may be the product story, but authored research, hypotheses, demonstrations, discussions, submissions, partners, customers, awards, validation, and financing are separate states.
• Motion must explain hierarchy or state, remain restrained, and preserve reduced-motion and keyboard parity.
• "Harmonic", "coherence", and "Design Nexus" are internal operating terms unless public wording is explicitly evidenced and appropriate.
• Local design readiness is not deployment readiness. Never say "live" without current production read-back.
• A live-surface reconciliation receipt is not a source-selection decision, canonical promotion, package, backup, owner approval or deployment authority. Drift is resolved only through a fresh verified backup and explicit owner-scoped reconciliation.
• A passing design-evidence brief is not a candidate, candidate-validation receipt, browser gate, visual acceptance, canonical promotion, package, backup, owner approval or deployment authority. Workers may use only the exact audited route scope and claim capsule; they must not infer permission for a neighbouring route or broader public wording.
• A refreshed staged claim register or a self-declared claim-impact is not permission to add public copy. Rendering changes remain materially classified, but only a changed material path already bound by the existing claim register may require an exact source-hash refresh; an unbound material path must preserve the register unchanged and must never gain a synthetic binding. A bound-source refresh may not broaden the existing source or public-route scope. Independently, the validator compares static baseline/candidate public text and requires each new surface to be hash-bound to exact capsule wording or a boundary. Its receipt contains evidence only; it does not turn a staged candidate into canonical source, a package, an approval or a deployment.
• A research-refresh receipt is not artwork clearance, a candidate, a provider export, a package, release, owner approval or deployment authority. It contains redacted local public-source bindings only; never place Gmail, Drive, attachment, visitor or credential material in it.
• An investor-copy audit is not permission to publish figures or new claims. Keep internal and fundraising figures, static research or traction totals, and KPI counters off investor-facing surfaces; a passing receipt cannot select source, stage copy, promote, package, release, or deploy.
• Investor-copy governance verification and simulation do not approve or apply a change. A broad access approval never substitutes for the exact fresh immutable named-owner decision. Even a successful explicit three-file application changes governance evidence only: it cannot edit website/ or policy, create a candidate or package, approve release, use credentials or network, or deploy.
• The editorial-asset provenance audit never changes the global not-cleared artwork policy. Delivery is not rights clearance, and only an exact current per-asset decision by the controlled allowlisted named owner-reviewer may produce a candidate-use-ready route capsule. That is candidate_use_rights_ready, not candidate_asset_ready; even the capsule cannot import bytes, create or mutate a candidate, promote, package, release, or deploy.
• candidate-assets-ready is candidate-local runner evidence, never a global artwork state or a worker assertion. It requires an immutable candidate-local importer receipt and current replay before any text-worker lease. The worker has no binary authority, and neither the state nor its receipts grant canonical mutation, promotion, package, release, credential, or deployment authority.
• A source-neutral HNC evidence graph is not candidate content. Its bundle must remain outside website/ and every staged candidate until owner source selection, any drift-required verified backup, and a fresh exact-path work order bind its exact outputs; it grants no transplant, promotion, package, release, or deployment authority.
• A website-source rationalisation plan is a read-only proposal, and its owner-decision receipt is validation evidence only. not-in-public-runtime-closure is not a deletion finding, a complete staged-source finding, or candidate/package/release readiness. The plan and receipt cannot remove or mutate canonical source, stage a projection, create or mutate a candidate, satisfy candidate QA, package, release, access credentials or network, publish, or deploy.
• Runtime-optimisation measurement validation is structural only, and production proposal compilation/writing are hard-blocked until reviewed provenance tooling and independently readable derivative artifacts exist. Test-fixture arithmetic cannot create measurement truth, run an encoder or CSS transform, rewrite references, omit or delete physical source, create or mutate a candidate, satisfy any browser or human gate, package, release, access credentials or network, publish, or deploy.
• A stakeholder-feedback audit is a local planning signal, not permission to publish private correspondence or new claims. Design workers never receive provider mail, raw messages, the redacted evidence snapshot, stakeholder identities, quotations, provider identifiers, URLs, finance, credentials, or free-form rationale. They receive only one current hash-bound controlled-code route capsule and must return a complete validated response manifest; neither record grants candidate, package, release, promotion, connector, credential, or deployment authority.
• A staged-worker lease is one-time local candidate evidence, not a general filesystem, shell, network, credential, promotion, package or deployment permission. Its receipt hash detects accidental local drift, not a hostile filesystem writer; do not treat it as a substitute for OS isolation or owner-controlled access. A rejected, expired or consumed lease requires a separately scoped successor run.
• A worker pass string is not test evidence. Structural validation of a candidate-test receipt reports origin_attested: false; require an independently preserved trusted orchestration seal and evidence_passed: true, and never promote either into candidate, package, release or deployment authority.
• An installed motion/performance-budget protocol is not a pass. Require the exact receipt to retain decision.status: pass and decision.eligible_for_next_local_gate: true; the receipt remains static audit evidence with no candidate, promotion, package, release or deployment authority.
• Installed candidate-QA control-plane readiness is not authorisation, execution, or a pass. Discovery is metadata-only-no-subprocess; it must never launch either compiler, Node, or any subprocess.Popen, and it reports sealed verification executed: false plus runner delegation invoked: false. Imported compiler APIs are read-only drift checks only and do not provide pre-import source authentication. The accepted sealed read-only verification path is direct compiler-file python -I -S -B execution with the exact --verify-config or --verify-policy form, delegated only by trusted orchestration through the V2 runner's bounded subprocess.Popen with shell=False, a 64 KiB aggregate/per-stream ceiling, a 300-second timeout, and no retry. Candidate-test execution separately requires the source-pinned reviewed Node absolute path, size, SHA-256, and binding digest with no PATH fallback, plus its bounded subprocess.Popen with shell=False and a 2 MiB per-stream ceiling. Direct agent shell execution or an imported verifier result cannot substitute for that runner evidence. Workers and QA agents cannot select or relax policy, commands, thresholds, origins, retries, or order. The only trusted order is V2 fixed motion-config compilation, V2 fixed complete test-policy compilation around the unchanged V1 policy payload, runner-delegated sealed read-only replay, one single-manifest dual-hash candidate binding, one handle-bound attempt claim, motion first, V2 candidate-test evidence second, and the initial browser gate only from candidate-qa-verified; every state remains local evidence with no candidate-creation, candidate-validation, canonical, promotion, package, release, credential, or deployment authority.
• A learning record is not a skill edit, canonical promotion, package, backup, owner approval or deployment authority.