V-One / VOODOO One

Keep approval, execution and proof separate when humans or AI perform consequential actions.

Portfolio status: Reference implementation / pre-production engineering. Production effects are disabled by default.

Governed Operations Control Plane for Human and AI Execution

Technical trust-plane: provider-neutral control plane for proof-carrying operations.

V-One explores one practical question: how can a human or AI perform a consequential action without blurring approval, execution and proof?

flowchart LR
    A[Reviewed operation] --> B[Approval]
    B --> C[Bounded grant]
    C --> D[Isolated execution]
    D --> E[Independent verification]
    E --> F[Evidence]

Loading

Canonical model

All current operations share the authority/execution prefix:

ReviewedOperation
→ Approval
→ AuthorizationSnapshot
→ ExecutionGrant/v2
→ control-plane GrantConsumptionWitness/v1
→ durable Dispatch
→ ExecutionEpoch / Lease / Fence
→ isolated bounded Runner
→ provider effect / observation

The evidence tail is profile-specific, not universal:

READ_ONLY_VERIFIED
→ independent Verifier
→ VerificationResult/v1

BOUNDED_MUTATION_VERIFIED
→ ExecutionReceipt/v2                 [effect claim, NOT verification]
→ independent Verifier
→ VerificationResult/v1
→ OperationProof/v2
→ OperationCell/v1

ExecutionReceipt/v2 and OperationProof/v2 are bounded-mutation contracts. READ-only verification currently terminates at VerificationResult/v1.

ExecutionReceipt != VerificationResult
execution succeeded != VERIFIED
VerificationResult != OperationProof
OperationProof != OperationCell

Current state

Area	Status
Root engineering/governance standard	ADOPTED exact-content standard
Exact live Git identity	Query live Git directly; never self-embed a commit as "current"
Current source/runtime evidence	See current-state/capabilities plus live Git/CI/CASER evidence
Local identity, approval and legacy product lifecycle	VERIFIED current test scope
AuthoritativeSnapshotCreator	IMPLEMENTED / tested
ExecutionGrant/v2 + durable grant service	IMPLEMENTED / tested
Control-plane grant consumption + Outbox	IMPLEMENTED / tested
Inbox/dedup + Epoch/Lease/Coordinator	IMPLEMENTED / tested
Isolated bounded READ Runner	LIVE VERIFIED D4b scope
Independent Verifier + VerificationResult/v1	LIVE VERIFIED E3/E4b/F6b scope
Bounded GitHub CREATE_REF / DELETE_REF	HISTORICALLY VERIFIED staging scopes
ExecutionReceipt/v2	IMPLEMENTED bounded-mutation contract; F6b evidence
OperationProof/v2	IMPLEMENTED bounded-mutation proof; F6b VERIFIED
OperationCell/v1	IMPLEMENTED bounded-mutation atom; F6b VERIFIED
Security Intelligence R-SI1.1	IMPLEMENTED intelligence-only metadata/test layer
VOP semantic revision R2	CURRENT / MERGED via PR #128
Canonical FastAPI ProductComposition runtime seam	IMPLEMENTED / MERGED; explicit runtime factory required, default provider pack disabled
Canonical public READ operation API	IMPLEMENTED / MERGED via PR #137; reconciled with resume/runtime via PR #140
Read-only /api/v1/control-room dashboard projection	IMPLEMENTED / targeted tested
Canonical Operation Passport GET /api/v1/operations/{execution_id}/passport	IMPLEMENTED / targeted tested; same-DB durable lineage, verification UNKNOWN / NOT_PERSISTED
Restart-safe durable READ resume	IMPLEMENTED / MERGED via PR #140
GitHub main governance enforcement	UNKNOWN / fresh post-rename G0 required; historical VERIFIED evidence retained
G8 READ runtime pack + explicit non-production activation	IMPLEMENTED / targeted tested; opt-in only, default remains disabled; live acceptance pending
Real canonical HTTP READ E2E through explicitly activated G8 pack	BLOCKED / not yet verified
Provider WRITE activation	BLOCKED pending repeated READ E2E + restart-safe verification gate
Production effects	BLOCKED / disabled by default
Unrestricted production release	BLOCKED
Public commercial distribution	BLOCKED
CyberCore read-only intake contract	IMPLEMENTED / contract-only; no runtime wiring or authority
CyberCore mutation/runtime integration	BLOCKED pending parser/trust/runtime/release-governance hardening

Product version remains 0.9.0-rc2-dev; G7 reconciliation is not release/deploy.

Historical runtime checkpoint

Latest retained full local runtime-attested development checkpoint:

main@d57d37111b8bc9471a136b6c618aad8e920f1aff
archive SHA-256: 80e53da665fe122375900ac888fef3562b0182018c4f7492f355d3d3401f4df2
image ID: sha256:8342c2ac978343a59ef13d90bda5d89f3d06be2c3d25875665026f039eb99abc

It does not attest later source changes.

Current product truth: CURRENT_PRODUCT_STATE.md and docs/product/CURRENT_CAPABILITIES.md.

One canonical language

Machine authority:

• voodoo_product/vop_vocabulary.py;
• schemas/vop/registry.v1.json.

Human projection: docs/architecture/VOP_CANONICAL_VOCABULARY.md.

Current semantic revision is vop-terminology-freeze-r2 (ADR-0018). R2 makes the lifecycle stage list an ordered superset and registers explicit terminal profiles/compatibility. It deliberately does not call Receipt/v2 or Proof/v2 universal supersessions of the older v1 families.

Important boundaries:

Approval != Authorization
AuthorizationSnapshot != ExecutionGrant
ExecutionGrant != ExecutionCapsule
Runner != Verifier
ExecutionReceipt != VerificationResult
Observation != VerificationResult
VerificationResult != OperationProof
OperationProof != OperationCell
Evidence-chain integrity != independent verification
Release != Deploy

Grant consumption belongs to the control plane before Dispatch. Runner authority is bounded_execution_only.

ProductComposition reality

The repository contains the accepted authority, durable dispatch, coordination, Runner, verifier and bounded-mutation proof/cell components. Merged PR #128 established the canonical trust-plane runtime as a ProductComposition seam: an explicit runtime factory must share the exact ProductService database and DatabasePermissionAuthority, and the default application intentionally leaves the provider runtime pack absent/fail-closed.

PR #137 merged the canonical READ HTTP surface. PR #140 reconciled that surface with restart-safe durable resume and runtime resume wiring, without adding a provider WRITE route or default provider runtime pack.

COMPONENT COVERAGE = STRONG
HISTORICAL BOUNDED-MUTATION ATOM = VERIFIED
CANONICAL PRODUCT RUNTIME SEAM = IMPLEMENTED / MERGED
CANONICAL PUBLIC READ API = IMPLEMENTED / MERGED
RESTART-SAFE DURABLE RESUME = IMPLEMENTED / MERGED
DEFAULT PROVIDER RUNTIME PACK = DISABLED / FAIL-CLOSED
REAL DEFAULT-RUNTIME HTTP READ E2E = NOT VERIFIED
PROVIDER WRITE = BLOCKED

Legacy ExecutionService remains an explicit compatibility surface and is not canonical fallback authority. Public READ API availability does not imply provider runtime activation, provider mutation, deployment, or release.

The current web surface at /console is a static dark control-room dashboard. It reads one read-only /api/v1/control-room projection for overview, runs, plans, capability registry, evidence timeline, policy gates, verifier separation, runtime health, learning signals, and governance settings. This projection does not add new execution authority and must not be read as provider runtime activation.

G0 governance evidence

The repository retains historical live G0 evidence for the repository identity that was current when the run executed:

workflow = g0-governance-verify
run = 32553113424
source_sha = 76d74d2ed62b6e78f027728c456c22da0b4a95bd
artifact = g0-governance-evidence-32553113424-1
artifact_digest = sha256:6e63caee23a57613471df66ef0279c0261ed8d375e4c929accdf50eff7dc4f5f
verdict = VERIFIED

That artifact remains valid historical evidence only. The canonical repository is now eimyroot/Voodoo-One; current G0 governance is therefore UNKNOWN until a fresh g0-governance-verify run executes on the exact post-repair main SHA and independently verifies the current repository identity and live ruleset. Historical G0 PASS never authorizes provider runtime, release, or deployment.

READ before WRITE

The next governed direction is a READ-only G8 runtime pack followed by repeated real canonical HTTP READ E2E and restart/resume verification. Provider WRITE remains blocked unless the adopted safety gate is satisfied with evidence for READ E2E, restart continuity, no duplicate authority/effect, independent verification, and fail-closed behavior. Even then, ELIGIBLE would not itself authorize a WRITE effect.

Execution success remains distinct from independent verification:

execution.status      = SUCCEEDED
verification.verdict  = NOT_VERIFIED

is truthful and must not be promoted to VERIFIED by execution success, receipts, or hash integrity.

Historical verified bounded-mutation atom

F6b run 32213563750 proved one staging rollback operation:

• DELETE_REF exactly once;
• mutation count 1;
• automatic retry false;
• rollback true;
• Runner and independent Verifier observed ABSENT;
• VerificationResult/v1 = VERIFIED / OBSERVED_STATE_MATCH;
• OperationProof/v2 = 40248a675287785778e1b0a8cc9ae9fd8fff12e869e820413f6fcea0ffcd1718;
• OperationCell/v1 = 2fc7de767018bdab8e08dcbfeffba988f16a4bc95694d2bf94b7854408e0a7b5.

This is real bounded-mutation evidence, not evidence that every READ produces Proof/v2/Cell/v1 or that a new provider mutation is authorized.

Security posture

• production effects default disabled;
• one-time grant consumption in control plane;
• exact current user/global-role/workspace/environment/membership permission revalidation before durable grant store/consume;
• exact target/capsule/dispatch/epoch/fence bindings in current contracts;
• SQLite migrations through schema 14;
• bounded isolated pilot runtimes;
• separate independent verifier path;
• receipt/verification semantics separate;
• canonical public READ API and restart-safe resume are merged;
• default G8 provider runtime and real product HTTP READ E2E remain blocked/unverified;
• provider WRITE remains blocked behind READ-before-WRITE evidence and separate effect authorization;
• no release/deployment inferred from CI, merge, Proof or Cell;
• historical G0 VERIFIED evidence is retained, while current post-rename GitHub governance remains UNKNOWN until fresh exact-main verification.

Documentation

Document	Purpose
CURRENT_PRODUCT_STATE.md	Current evidence-scoped product snapshot
CHANGELOG.md	Product/history changes
VISION.md	Product purpose and direction
ARCHITECTURE.md	Current architecture and composition target
ROADMAP.md	Ordered delivery/gate plan
SECURITY.md	Security policy/supported-state boundary
foundation/FOUNDATIONS.md	Stable engineering foundations
foundation/TERMINOLOGY.md	Shared terminology/status language
docs/product/CURRENT_CAPABILITIES.md	Current capability inventory
docs/product/POST_G7_CANONICAL_STATE.md	Commit-bound post-G7 truth snapshot
docs/product/G8_READ_RUNTIME_GATE.md	G8 READ-only runtime acceptance boundary
docs/product/TARGET_CAPABILITIES.md	Target capability contracts
docs/product/CONTROL_ROOM_CURRENT_TO_TARGET_GAP.md	Evidence-bound Control Room current-to-target gap map
docs/product/SECURITY_OVERVIEW.md	Security-control summary
docs/product/MVP_DELIVERY_MAP.md	MVP/product delivery map
docs/architecture/TRUST_BOUNDARIES.md	Trust-boundary topology
docs/governance/DOCUMENTATION_POLICY.md	Documentation truth rules
docs/governance/ADR0008_R3_EVIDENCE_INDEX.md	Historical R3 evidence index
docs/README.md	Documentation index

Normative governance remains in WORLD_CLASS_SOFTWARE_DEVOPS_OPERATING_MODE.md, PROJECT_CONSTITUTION.md, and effective adopted records/ADRs. ADR-0019 retains its immutable embedded PROPOSED label, while the external owner-adoption register makes its READ-before-WRITE boundary effective as of 2026-08-24.

Local verification

python3.12 -m venv .venv
. .venv/bin/activate
python -m pip install --require-hashes -r requirements-dev.lock
python -m ruff check .
python -m compileall -q voodoo_product scripts tests
python -m pytest -q
python scripts/product_readiness_gate.py

No command above enables production effects.

Local checkpoint verification

export PATH="$PWD/scripts:$PATH"
voodoo evidence verify /absolute/path/to/checkpoint

Equivalent:

python -m voodoo_product evidence verify /absolute/path/to/checkpoint

Checkpoint verification does not independently attest provider state, publish artifacts, authorize a release or enable production effects. See ADR-0002.

Local start

Create .env.product.local from .env.product.example, replace secret placeholders, configure exact VOODOO_TRUSTED_HOSTS, and keep:

VOODOO_ALLOW_PRODUCTION_EFFECTS=false

Then:

set -a
. ./.env.product.local
set +a
.venv/bin/uvicorn voodoo_product.main:app --host 127.0.0.1 --port 8000 --no-access-log --no-server-header

Console: http://127.0.0.1:8000/console

Control-room API: http://127.0.0.1:8000/api/v1/control-room

Operation Passport API: http://127.0.0.1:8000/api/v1/operations/<execution_id>/passport

Change governance

• focused reviewable commits;
• behavior changes include tests;
• CI is not release/deploy authority;
• production effects remain separately authorized/released;
• authentication/authority/persistence/evidence/write/release changes use governed review;
• automation cannot create stronger authority by inference.

See SECURITY.md, CONTRIBUTING.md, and COMMERCIAL_READINESS.md.