[Architecture] Replace monolithic visual-reference-research with conditional visual-work contracts

[Sequela02]

Summary

Replace the current monolithic visual-reference-research concept with explicit, conditional contracts for visual intent, authoritative design context, exploration, rendered verification, and independent design review.

This is an architecture issue, not an implementation roadmap. The goal is to remove a conflated abstraction before it becomes a cross-surface compatibility boundary.

Kiln's governing doctrine is:

Kiln is a governed control plane for assigning, executing, reviewing, and reconciling work across agents, tools, runtimes, and human operators.

Software engineering is the first workload, not the architectural boundary. Visual work therefore needs horizontal governance primitives rather than a workflow token that simultaneously acts as evidence, phase, route selector, capability bundle, and implied specialist identity.

Problem

Repository inspection shows that visual-reference-research currently behaves as several different things at once:

• evidence identifier;
• workflow phase;
• phase-route selector;
• policy trigger;
• capability bundle;
• implied agent/specialist identity.

Relevant current surfaces include:

• packages/cli/src/application/work-governance-policy.ts;
• packages/cli/src/application/work-governance-workflows.ts;
• phaseRoutes.visual-reference-research in global configuration and documentation;
• UI-triggered evidence requirements including visual-reference-research and browser-qa;
• recovery, replay, fixtures, GUI/TUI/CLI projections, and tests that depend on these names.

The repository does not define a canonical builtin profile named visual-researcher. Instead, the visual-reference-research token implicitly carries that identity and its expected tools.

This coupling violates the separation required by the governed-work architecture:

• evidence must state what was observed or produced;
• phases must state where work is in its lifecycle;
• routes must identify execution targets;
• capabilities must state what an executor can do;
• agent identities must state who or what is responsible;
• completion must depend on governed evidence, not model self-assessment.

Why replacement is required

A simple rename or local refactor is insufficient. The current abstraction encodes an incorrect policy assumption: that UI work generally requires external visual research.

That is false across common workloads:

• a UI bug fix may only require implementation and rendered regression verification;
• a Figma-directed implementation should use authoritative design context, not external inspiration research;
• an exploratory product-design task may require external visual exploration;
• a UI-preserving refactor should not trigger exploration at all;
• a material visual change still requires rendered verification even when no external research is appropriate.

The architecture must select obligations from the work's visual intent and available authoritative context, rather than from the fact that the task touches a UI surface.

Canonical policy

UI work must use the strongest available authoritative design context. External visual exploration is required only when the work is explicitly exploratory or lacks sufficient visual direction. Material visual changes require verification against the rendered target. Neither research nor model self-assessment is completion evidence by itself.

Target model

1. Visual intent

Introduce an explicit visual-intent classification, conceptually:

• none — no material visual behavior is involved;
• preserve — existing appearance/behavior must remain stable;
• specified — authoritative visual direction is supplied;
• exploratory — the executor is expected to investigate and propose visual direction.

The exact schema and names should be established through architecture review, but intent must be distinct from evidence, phase, route, and agent identity.

2. Evidence contracts

Replace the current token with separate evidence types.

design-context

Authoritative visual direction available to the work, such as:

• Figma or another design source;
• design-system definitions;
• screenshots supplied by an operator;
• an existing product or rendered baseline;
• explicit visual references supplied as requirements.

It should identify provenance, authority, scope, and any freshness/version information needed for replay.

visual-exploration

Required only for exploratory work or insufficient visual direction.

It should contain at least:

• research question;
• references examined;
• rationale;
• alternatives considered;
• rejected alternatives where materially relevant;
• relationship to the resulting design decision.

This is not completion evidence for implementation.

rendered-visual-verification

Verification against the actual rendered target. This replaces the overloaded browser-qa completion role for visual correctness.

It should record at least:

• rendered target/build identity;
• environment and viewport/device where material;
• screenshots or equivalent observations;
• states and interactions exercised;
• expected versus observed result;
• verdict;
• residual risk or unverified states.

Browser execution is one possible capability used to produce this evidence; it is not the evidence type itself.

design-review

An independent review artifact for material design choices where policy requires a separate reviewer.

It must remain distinct from implementation self-assessment and from rendered verification.

3. Semantic phases

Replace phaseRoutes.visual-reference-research with lifecycle phases that describe work rather than a specific technique:

• context acquisition;
• exploration;
• implementation;
• rendered verification;
• review.

Routes may be selected for a phase based on capabilities and authority, but the phase name must not encode an agent profile or tool.

4. Capability-based routing

Visual work must route by declared capabilities, for example:

• browser interaction;
• screenshot capture;
• visual/multimodal input;
• design-context access;
• relevant application/runtime access;
• read-only external research;
• rendered-state interaction.

Do not route by an implied visual-researcher identity or by matching special tool names.

5. Conditional workflow obligations

Representative policy fixtures should include at least:

UI bug fix

implementation -> rendered verification

No external exploration unless the work explicitly lacks necessary visual direction.

Figma/design-system implementation

context acquisition -> implementation -> rendered verification

The authoritative source takes precedence over external references.

Exploratory visual design

context acquisition -> exploration -> implementation -> rendered verification -> design review

UI-preserving refactor

implementation -> regression verification

No exploration.

Nonvisual change

No visual workflow obligations unless actual impact classification or evidence proves otherwise.

Required investigation before implementation

Inspect the repository and inventory every use and semantic dependency of:

• visual-reference-research;
• phaseRoutes entries associated with it;
• browser-qa as evidence, phase, route, completion signal, or compatibility alias;
• UI policy triggers;
• work-governance workflow definitions;
• evidence declarations and projections;
• fixtures and tests;
• recovery and replay;
• GUI, TUI, CLI, SDK, and operator projections;
• documentation and examples.

Do not assume the current design is authoritative merely because it is implemented.

Review relevant current industry and research practice for governed GUI/visual agents, including primary material from major labs and credible papers/benchmarks on:

• computer-use perception/reasoning/action loops;
• GUI grounding and end-to-end verification;
• screenshot/rendered-state evidence;
• design-context integrations;
• safety and independent evaluation of computer-use agents.

External research should inform the contract design, not introduce vendor-specific architecture.

Migration requirements

Stage 1 — contracts and policy fixtures

• define visual intent independently from evidence and phase;
• define the four evidence contracts above, or document justified replacements;
• define semantic phases;
• define capability requirements for each phase;
• add policy fixtures for the representative workloads;
• prove that a generic UI trigger no longer automatically requires external visual exploration;
• document provenance, identity, replay, recovery, and redaction requirements for each evidence type.

Stage 2 — surface migration

Migrate all affected:

• governance policy;
• workflow definitions;
• routing/configuration;
• recovery and replay;
• canonical-state projections;
• GUI/TUI/CLI/SDK/operator surfaces;
• documentation;
• tests and fixtures.

Delete:

• visual-reference-research as a monolithic concept;
• any implied visual-researcher profile contract;
• compatibility aliases that preserve the conflation, unless a concrete external compatibility requirement is documented.

A temporary migration reader may be acceptable only if it converts historical evidence into the new canonical contracts without allowing new writes in the old form.

Replay and recovery expectations

The replacement must be replayable and deterministic enough to answer:

• what visual intent governed the work;
• which design context was authoritative;
• whether exploration was required and why;
• which route/capabilities produced each artifact;
• what rendered target was verified;
• which states were exercised;
• who or what performed independent review;
• whether recovery preserves or supersedes prior evidence;
• whether GUI, TUI, CLI, SDK, and replay produce the same canonical completion state.

Evidence identity, provenance, supersession, redaction, and terminal-state behavior must follow the governed-work execution doctrine in docs/architecture/governed-work-execution.md.

Non-goals

• creating a permanent vendor-specific Figma, browser, or model abstraction;
• requiring web research for every UI task;
• treating screenshots alone as proof without target/build/state identity;
• treating a browser tool invocation as evidence by itself;
• encoding an agent profile into a phase name;
• relying on model self-assessment as completion;
• preserving the old abstraction solely to reduce migration work.

Acceptance criteria

• Repository-wide inventory of the old concept and all dependent surfaces is documented.
• Visual intent is represented independently from evidence, route, phase, and agent identity.
• Authoritative design context is represented explicitly with provenance.
• External visual exploration is conditional, not automatically triggered by UI work.
• Material visual changes require rendered-target verification.
• Independent design review is distinct from implementation and verification.
• Routing is capability-based and provider-neutral.
• No special-case routing by visual-reference-research, implied visual-researcher, vendor, or tool name remains in canonical policy.
• Recovery/replay preserves evidence identity, provenance, supersession, and canonical completion.
• GUI, TUI, CLI, SDK, operator projection, and replay agree on canonical state.
• Fixtures prove bug-fix, specified-design, exploratory-design, preserving-refactor, and nonvisual scenarios.
• New writes cannot emit the old monolithic evidence/phase contract.
• Old aliases are deleted or justified by a documented external compatibility boundary.
• Documentation states the canonical policy quoted above.

Delivery constraints

• Work must branch from codex/cross-harness-gateway.
• Any implementation PR must target codex/cross-harness-gateway.
• Never commit or open this work against main.
• Begin with an architecture/design review before implementation.
• Prefer behavioral fixtures and cross-surface proofs over structural assertions.
• Do not merge as part of the initial implementation task.

[Sequela02]

Long-Term Vision — General Conditional Work Contracts & Research Status

What we are trying to redo (the defect)

Kiln's work-governance contract today conflates five separable dimensions into a single token. visual-reference-research is simultaneously:

1. an evidence type — "what was observed or produced";
2. a workflow phase — "where the work is in its lifecycle";
3. a route selector — "which execution target runs it" (phaseRoutes key);
4. a capability bundle — "which tools the executor needs" (read,glob,grep);
5. an implied agent identity — "who or what is responsible" (visual-researcher, implied by taskAffinityForPhase).

No other evidence id in Kiln carries all five. The others group into semantic phases (surface-diagnosis, planning, implementation-verification, managed-review-closeout) without a dedicated route key, a 1:1 evidence→phase mapping, or an implied identity. visual-reference-research is the monolith.

The defect is not merely that the token is overloaded. It is that the overloading ENCOURAGES repeating the pattern: the next time Kiln needs to govern a new kind of work, the easiest path is to mint another monolithic token that fuses all five axes. The long-term vision is to make that path impossible by construction.

What "general" means

The vision is NOT "Kiln governs every human activity." Kiln is a control plane for assigning, executing, reviewing, and reconciling work across agents, tools, runtimes, and human operators. The vision is that the contract model — the shape of a governed work contract — should be domain-neutral, so that the same separation of dimensions applies whether the work is:

• a UI bug fix in a React codebase (today's visual-reference-research case);
• a plumbing inspection against a building code (construction);
• a clinical pathway execution (medicine);
• a legal pleading→discovery→trial→verdict sequence (law);
• an audit evidence collection and sign-off (audit);
• a hobby project with community contribution rules (informal governance);
• or any future work type Kiln is asked to govern.

The abstraction must be domain-neutral in its base and admit domain-specific overlays — the same way ISO 9001:2015 is a neutral quality base and AS9100 (aerospace), IATF 16949 (automotive), and ISO 13485 (medical devices) are domain-specific interpretations.

The five (or six, or seven) separable axes

Research found strong cross-domain convergence on five axes. Two candidate axes are not yet settled:

Axis	What it owns	Cross-domain support	Open question
Intent	objective, behavioral acceptance criteria, permitted effects, non-goals, scope envelope	✅ contract theory, construction, medicine, law, ISO	is "scope envelope" a sub-field or its own axis?
Capability / identity	who or what is responsible; what qualifications/tools/capabilities they must have; licensing	✅ all surveyed domains	is "route" (which executor) separable from capability, or subsumed?
Process / phase	lifecycle stages the work traverses; phase transitions; stopping conditions	✅ all surveyed domains (FIDIC, clinical pathways, legal procedure)	should phases be declarative (config) or imperative (runtime state machine)?
Evidence	what was observed or produced; provenance (source, observation time, freshness, integrity); reliability hierarchy	✅ ISA 500, PCAOB AS 1105, construction inspection, medical chart	does Kiln need the full audit provenance hierarchy or a subset?
Review	independent verification of completion; reviewer independence level; acceptance gate	✅ all surveyed domains — reviewer must be independent of executor	is independence UNIVERSAL or CONDITIONAL on work type and risk? (pending research)
Temporal context (candidate 6)	base date, observation time, evidence freshness, deadlines, waiting periods	⚠️ FIDIC base date, audit observation time, medical observation windows	separate axis or sub-field of evidence?
Risk triggers (candidate 7)	conditional obligation determination; risk-based control selection	⚠️ ISO 9001 §6.1, FIDIC conditional obligations, clinical pathway selection criteria	separate axis or cross-cutting concern?

The axis count is deliberately unresolved. It is an architecture-review question, not a research question. The research establishes that the SEPARATION matters; the exact count is a design decision.

The schema invariant the abstraction must guarantee

Regardless of axis count, the abstraction must enforce one invariant that the current visual-reference-research token violates:

No single contract token may simultaneously own more than one axis.

An evidence id must not be 1:1-mapped to a phase id, a phaseRoute key, a capability bundle, and an agent identity at the same time. Each axis is a separate field with its own validation. A contract binds axes together; a token does not.

This invariant is what prevents the next monolith. It is the structural fix that the #9 visual-specific implementation must satisfy, and that a general issue must ratify as a cross-cutting schema rule.

Domain-specific controls the base must admit (as overlays, not in the base)

Control	Domain	Kiln analog?
Physical safety gates	construction, medicine	maybe: pre-dispatch fence for destructive authority
In-person inspection	construction, audit, medicine	not applicable (Kiln is software)
Retention / escrow	construction	maybe: pending-settlement capacity hold
Chain of custody	audit, medicine, law	yes: evidence provenance + supersession
Professional stamps with personal liability	engineering, medicine	maybe: authorized-by with revocability (#52 Slice 1)
Mandatory waiting periods	construction, law, medicine	maybe: pause-requirement durations
Insurance / bonding	construction, professions	not applicable (Kiln is not financial)

Research status

Note	Status	Scope
Visual/UI coding-agent research (OSWorld, WebArena, UGround, WebPilot, Anthropic/OpenAI Computer Use, Figma MCP, cloned harnesses)	✅ Done (35 KB, in worktree)	Visual work in coding agents — the first concrete instance
Cross-domain contract/governance research (contract theory, construction, medicine, law, audit, ISO, CMMI, open-source)	✅ Done (44 KB, in worktree)	Five-axis separation across non-programming domains
Completion authority & independence research (who holds completion authority, universal vs. conditional)	⏳ Pending — operator will produce via external deep-research model	The critical open question: is independent review universal or conditional?

Advisor consensus (terra + luna, reasoning high)

Both advisors recommend option C: fix #9 visual-specific now with the schema constraint, open a separate general issue for the cross-cutting rule. Do not replant #9 as general — the visual research does not cover non-programming domains, and replanting risks an attractive but untestable meta-abstraction that delays delivery.

The visual research note remains valuable for the general issue: it is strong evidence that the five-axis conflation causes real failures, and a concrete first instance.

Open questions for the architecture review

1. Axis count: five, six, or seven?
2. "Route" — programming-specific or general? Separate axis or sub-field of capability/identity?
3. Domain extension mechanism — ISO overlay pattern or Kiln-native plugin shape?
4. Evidence provenance — full audit hierarchy or Kiln-specific subset?
5. Conditional obligation determination — risk assessment, project-type selection, diagnosis, or new mechanism?
6. Review independence level — universal or conditional? (pending research above)
7. Incomplete contract defaults — when a work contract is silent on an axis, what is the default?
8. Schema enforcement — where does the "no monolith" invariant live?

---

Prompt for external deep-research model

The following prompt is ready to copy-paste to a superior model for the remaining research axis (completion authority). The operator will run this externally.

---

You are a deep-research advisor with access to primary sources. Produce a rigorous, citation-backed research note answering the following question across human work domains (NOT programming-specific):

THE QUESTION:

In your work or trade, when someone asks you to do something — how do you know it is "finished" and well done? Who decides that: you, the client, an inspector, or an external standard? And if you yourself say "it is done" without anyone else verifying it, does that count as truly finished — or do you need someone independent to confirm?

CONTEXT:

This answer will inform the architecture of a governed-work control plane (Kiln) that must decide whether "independent review of completion" is a UNIVERSAL requirement (all work types require it) or a CONDITIONAL dimension (varies by work type, risk, and domain). The current system has a defect where the worker's self-assessment was treated as completion evidence — which fails in practice. We need cross-domain evidence to decide the correct rule.

RESEARCH AXES — find primary sources for each:

1. Who holds completion authority across domains?

   • Construction, medicine, law, audit, culinary, trades (plumbing, electrical, HVAC), professional services, creative work, academia, hobby/informal.
   • Is the worker's self-declaration accepted, or is independent verification required?
   • Who is the acceptance authority — worker, client, regulator, inspector, peer, standard?
   • Cite specific standards, codes, or laws.

2. When is self-assessment accepted vs. rejected?

   • Are there domains where the worker's own word IS sufficient? (art, hobbies, informal work, trusted-advisor)
   • What distinguishes those domains from ones requiring independent verification?
   • Is the distinction risk, reversibility, regulatory capture, client sophistication, or something else?
   • Cite sources.

3. The independence spectrum:

   • Same-person-later (self-review after delay) vs. peer review vs. supervisor sign-off vs. external inspector vs. regulator vs. independent auditor.
   • Which domains require which level of independence? Why?
   • Cite specific requirements (building codes, academic peer review, medical second opinions, audit standards).

4. Conditional independence — is the requirement itself CONDITIONAL on work type?

   • Within a single domain (e.g., construction: cosmetic paint vs. load-bearing structure), does the review requirement change?
   • ISO 9001:2015 risk-based thinking — does it explicitly make verification depth conditional on risk?
   • Cite sources showing conditional vs. absolute independence requirements.

5. Failure modes of self-assessment — what goes wrong when workers self-certify:

   • Construction defects under self-certification regimes (cite studies or code changes).
   • Medical misdiagnosis rates when self-assessed vs. peer-reviewed.
   • Audit self-certification failures (Enron, Wirecard, etc.).
   • Is there QUANTITATIVE evidence that self-assessment has higher defect rates? Numbers, not anecdotes.

6. Domain-specific "completion" concepts with no programming analog:

   • Substantial completion (construction) vs. final completion — legal distinction?
   • "Standard of care" (medicine, law) — is completion reaching a standard, or satisfying the client?
   • Warranty periods — is completion the moment of delivery or the end of a defect period?
   • Acceptance testing vs. inspection certificates — how do they differ?

OUTPUT FORMAT:

1. Direct answer to the question (max 5 lines) — supported by evidence.
2. Domain-by-domain evidence table: domain → who decides completion → independence level required → citation.
3. The independence spectrum table: level → which domains require it → source.
4. Conditional independence evidence — domains where the requirement VARIES by work type within the domain (max 5 examples with citations).
5. Failure-mode quantitative evidence — what goes wrong without independent verification (max 5 bullets with NUMBERS, not anecdotes).
6. Domain-specific completion concepts with no programming analog.
7. Synthesis: does the evidence say independent verification is UNIVERSAL, CONDITIONAL, or DOMAIN-SPECIFIC?
8. What you could NOT verify — named explicitly.
9. Open questions for architecture review.

CONSTRAINTS:

• Cite primary sources: standards (ISO, IEC, AIA, ABA, AMA), laws, peer-reviewed studies, code texts.
• Mark inference vs. citation. Do not fabricate.
• If evidence is thin for a domain, say so.
• Prefer recent and canonical sources.
• Be exhaustive on the axes; be concise on the synthesis.

[Sequela02]

Completion Authority and Conditional Independence Across Human Work Domains (2026)

Research note: docs/research/33-completion-authority-2026.md
Architecture context: sequelcore/kiln issue #9
Research date: 2026-08-04
Question resolved: Is independent review of completion universal, or conditional on the work type, risk, and governing domain?

1. Direct answer

Independent review is not universal across human work. What is universal in governed work is the need to identify: (1) the completion claim, (2) admissible evidence, and (3) the authority entitled to accept, reject, or qualify that claim. Self-attestation is valid in explicitly bounded cases—especially low-risk, reversible, credentialed, or informal work—but it remains self-attestation and must not be represented as independent verification. Higher-risk, latent-defect, public-interest, fiduciary, or institutionally gated work progressively requires peer, supervisor, client, inspector, regulator, or independent-auditor approval.¹²³⁴

Verdict: the requirement for independent verification is CONDITIONAL, implemented through domain-specific rules. The universal invariant is explicit completion authority and evidence semantics, not a universal independent-review gate.

Terms used in this note

• Worker attestation: the executor states that work is complete or conforming.
• Acceptance authority: the actor legally, contractually, institutionally, or personally entitled to accept the work.
• Independent review: evaluation by an actor who did not perform the work and has sufficient separation to make an objective judgment.
• Completion: a governed state transition. It may be provisional, substantial, accepted, certified, final, or still subject to warranty and latent-defect remedies.
• Inference: an architectural conclusion drawn from cited domain evidence; it is not itself a quoted requirement of a source.

2. Domain-by-domain evidence

Domain	Who decides completion or acceptance?	Required independence	Evidence and authority
Construction	The contractor may declare readiness; the architect may certify substantial completion under the contract; the owner accepts contractual delivery; the building official controls code approval and occupancy.	Conditional but often high. Minor finish work can be permit-exempt. Permit work is inspected. Specified structural work requires an approved agency employed by the owner or its agent, ordinarily not the contractor.	IBC permit exemptions include painting, papering, tiling, carpeting, cabinets, and similar finish work.5 IBC §1704.2 requires owner-engaged approved agencies for specified special inspections, with exceptions for minor construction.2 A certificate of occupancy follows official inspection and is not a waiver of code violations.6 AIA G704 separates contractor punch-list preparation, architect verification, and owner/contractor acceptance of substantial completion.7
Medicine	The clinician determines diagnosis and clinical sufficiency under professional standards; the patient or surrogate decides whether to consent to treatment; institutions and regulators impose additional gates for specified activities.	Conditional. Routine clinical judgment is not independently re-performed in every case. Consultation is required when indicated; high-risk procedures, drugs, or regulated materials can require additional authorization, directives, or checks.	AMA requires competent care and consultation or use of other professionals when indicated.8 Patient consent is a distinct decision authority and does not certify technical quality.9 NRC rules distinguish medical uses for which a written directive is not required from higher-risk uses for which one is required.10 The Joint Commission identifies an independent second check or verification technology as a control when non-pharmacy staff retrieve medication after pharmacy closure.11
Law	The lawyer controls professional means subject to competence and ethics; the client controls objectives and settlement; a court, agency, counterparty, or other institution controls adjudicative or procedural acceptance.	Usually conditional, not universal. A lawyer may self-certify a filing after reasonable inquiry; the court can later challenge or sanction it. Consultation with specialist counsel depends on complexity and stakes.	ABA Rule 1.1 defines competence through legal knowledge, skill, thoroughness, and preparation; its commentary makes preparation depth depend partly on what is at stake.1213 ABA Rule 1.2 allocates objectives and settlement to the client.14 FRCP 11 accepts the signer's certification without routine affidavit, backed by court sanctions after notice and review.15
Audit	The engagement partner remains responsible for the audit; the engagement quality reviewer controls concurring approval for report issuance; the audit committee and regulator exercise separate oversight.	Strong and mandatory for covered engagements. The reviewer must be independent of the company, objective, and must not assume engagement-team decisions. The report cannot be released for client use before concurring approval.	PCAOB AS 1220 requires competence, independence, integrity, and objectivity; separates reviewer and engagement-team responsibility; and conditions report use on concurring approval.4 SEC independence rules require the auditor to be capable of objective and impartial judgment.16
Gastronomy / food service	The chef or manager decides culinary readiness; the customer decides subjective acceptance; management owns food-safety controls; public authorities inspect regulatory compliance.	Dual and risk-based. No independent reviewer is required for the aesthetic quality of every dish. Food-safety assurance combines operator controls with periodic, risk-based regulatory inspection.	FDA places operational food-safety responsibility on management systems while directing regulators to evaluate those systems through risk-based inspections.17 FDA inspection frequency is risk-adjusted, with high-risk facilities inspected more frequently than non-high-risk facilities.18 The FDA Food Code is a model regulatory standard, not a rule that every plate requires independent sign-off.19
Plumbing, electrical, HVAC, and similar trades	Depending on jurisdiction and scope: the installer, scheme operator, code official, approved inspector, or building safety regulator.	Conditional. Credentialed installers may self-certify enumerated work; other work is checked by local authority/private inspector; higher-risk projects receive regulator-selected inspection and final certification.	UK competent-person schemes permit registered installers to self-certify specified work instead of routine building-control inspection, but entry requires competence assessment and continuing inspections.20 Electrical work may be self-certified by a registered installer or certified by a third party/local authority.21 For higher-risk buildings, the regulator may inspect self-certified work and controls final completion certification.22 The International Plumbing Code requires final inspection after permitted plumbing work is complete and ready for occupancy.23
Professional services and procurement	The service provider tenders work; the client or contracting officer accepts it. Acceptance authority remains with the buyer even when the buyer relies on the provider's assurance.	Explicitly conditional. Low-value or noncomplex work can rely on contractor inspection and assurance; complex or critical work requires stronger inspection and quality controls.	FAR 46.502 assigns acceptance to the contracting officer.24 FAR 46.202-2 permits reliance on contractor inspection below the simplified acquisition threshold, unless intended use, potential loss, correction likelihood, or inspection cost justify government testing.25 FAR 46.203 scales controls by complexity and criticality.1 FAR 12.402 permits reliance on contractor assurances for noncomplex commercial work but directs alternative procedures for complex or critical uses.26
Creative work	For self-initiated work, the creator can decide that a version is complete. For commissioned or employed work, the contract, commissioning party, producer, editor, curator, or audience may control acceptance or release.	Usually none for personal completion; conditional for commissioned or institutional release. There is no universal external quality standard for art.	The U.S. Copyright Office treats “year of completion” as applying to the particular version submitted, which presupposes an author/applicant declaration of version completion.27 Work-made-for-hire rules can assign legal authorship to the employer or commissioning party where statutory and written-agreement conditions are met.28 Inference: artistic completion and commissioned acceptance are different events; the cited copyright rules do not impose a quality-review requirement.
Academia	The researcher can stop personal inquiry or declare a draft complete; a journal editor controls publication; reviewers advise; a dissertation committee and degree-granting institution control degree completion.	Conditional by output. Independent review is required for institutional acceptance, not for every research activity or private note.	Nature sends selected manuscripts to independent reviewers, but the editor retains the ultimate publication decision.29 Harvard Biophysics requires three signatures on the dissertation acceptance certificate; if the committee cannot agree, the higher-degrees committee decides.30
Hobby / informal work	The maker or requester, according to an informal agreement or personal goal.	Normally none unless voluntarily introduced. Review becomes necessary only when the activity enters a regulated, contractual, public-safety, competition, community, or shared-resource context.	There is no general external completion authority for private hobbies. Inference: the construction permit exemptions, copyright version-completion practice, and optional ISO certification illustrate the broader boundary: private or low-externality work may be self-complete, while legal or institutional effects introduce external authority.5273

Cross-domain finding: completion authority is frequently composite

A single actor rarely owns every meaning of “done.” Construction separates executor readiness, architect certification, owner acceptance, code approval, occupancy, and warranty. Medicine separates clinical judgment from patient consent. Law separates professional competence, client objectives, and tribunal outcome. Audit separates engagement responsibility from report-release approval. Therefore:

Inference: completion authority should not be modeled as a synonym for reviewer identity. A work contract may need multiple named authorities for different state transitions.

3. Spectrum of independence

The levels below describe increasing separation from the executor. They are not perfectly ordinal: customer acceptance, technical inspection, and regulatory approval answer different questions.

Level	Description	Domains that use it	Source
0 — Executor declaration	Worker declares a version, task, or deliverable complete. No second evaluator.	Personal creative work; hobbies; some low-risk commercial services before tender.	Copyright version completion; FAR contractor tender and assurance.2726
1 — Structured self-check / self-certification	Same executor checks against an explicit rule, signs an attestation, and remains accountable.	FRCP 11 filings; UK competent-person installations; contractor inspection under FAR.	FRCP 11; GOV.UK competent-person schemes; FAR 46.202-2.152025
2 — Same organization, different qualified person	Peer, specialist, pharmacist, second reader, or internal auditor reviews the work.	Medical second opinions and medication checks; internal quality systems; some legal consultation.	AMA consultation duty; Joint Commission check; ISO internal audit option.8113
3 — Supervisor / institutional sign-off	A supervisor, committee, editor, or quality reviewer authorizes release.	Dissertation approval; journal publication; audit report issuance.	Harvard dissertation rules; Nature editorial authority; PCAOB AS 1220.30294
4 — Client / owner acceptance	The principal accepts contractual delivery, often after its own inspection or an advisor's certificate.	Construction contracts; professional services; government procurement; commissioned creative work.	AIA G704; FAR 46.502; ABA allocation of client objectives.72414
5 — Approved independent inspector	Qualified inspection body or agency examines conformity and records findings.	Structural special inspections; code-regulated installations; conformity assessment.	IBC §1704.2; ISO/IEC 17020.231
6 — Public regulator / code official	Government authority controls legal permission, occupancy, licensing, or enforcement.	Building occupancy; higher-risk buildings; food safety; regulated medical use.	IBC certificate of occupancy; UK higher-risk regime; FDA and NRC controls.6221810
7 — Independent assurance / audit over another party's assertions	An independent assurance provider evaluates evidence supporting an assertion, often with a separate engagement-quality reviewer.	Public-company audit and other covered attest engagements.	SEC independence policy; PCAOB AS 1220.164

Same-person-later review

A delayed self-review can reduce immediacy and some execution blindness, but it does not create organizational independence or eliminate self-interest. The sources reviewed did not establish a cross-domain rule treating delay alone as independent verification.

Inference: Kiln may represent delayed self-review as stronger than an unexamined completion claim, but it must retain independence = none or equivalent provenance.

4. Evidence that independence is conditional within a domain

4.1 Construction: cosmetic finish versus structural work

• IBC-derived permit exemptions include painting, papering, tiling, carpeting, cabinets, countertops, and similar finish work.⁵
• IBC §1704.2 requires owner-engaged approved agencies for specified special inspections, in addition to building-official inspections, while exempting minor construction in stated circumstances.²

Finding: the same domain ranges from no permit inspection to an inspector deliberately separated from the contractor.

4.2 Trades: enumerated self-certification versus higher-risk oversight

• Registered UK installers may self-certify specified work; their competence is assessed and then subject to ongoing inspection.²⁰
• In higher-risk buildings, the Building Safety Regulator can decide whether to inspect self-certified work, can perform unannounced inspections, and controls final completion certification.²²

Finding: self-certification is a licensed, scoped, auditable exception—not a general equivalence between executor claim and independent review.

4.3 Government procurement: low-loss/noncomplex versus complex/critical

• FAR permits contractor inspection for lower-threshold acquisitions and reliance on contractor assurances for noncomplex commercial items.²⁵²⁶
• The same rules require stronger controls when defects could cause greater loss, correction is uncertain, properties are latent, or an application is complex or critical.¹

Finding: intended use, consequence, detectability, reversibility, and inspection cost are explicit review-depth selectors.

4.4 Medicine: ordinary professional judgment versus specified high-risk controls

• AMA requires consultation when indicated, not for every clinical act.⁸
• NRC Part 35 distinguishes medical uses not requiring a written directive from uses that do, and imposes authorization/training requirements for regulated uses.¹⁰
• The Joint Commission accepts alternative quality controls such as an independent second check or barcoding for a defined medication-retrieval risk.¹¹

Finding: medical independence is procedure- and hazard-specific; patient consent is mandatory for treatment decisions but is not technical verification.

4.5 ISO 9001: internal assurance with optional third-party certification

• ISO states that certification to ISO 9001 is optional. Organizations should check their systems through internal audits and may choose independent certification or client audit.³
• ISO's auditing guidance frames process-based and risk-based thinking as essential to audit context, while warning that the guidance itself is not a universal prescriptive requirement.³²

Finding: ISO 9001 does not make independent third-party certification universal. It makes assurance systematic while leaving the external independence level conditional on organizational, customer, regulatory, and certification context.

5. Quantitative evidence of failure modes

The figures below show defects or disagreements detected when a second authority reviewed prior work. Except where expressly comparative, they do not prove that independent review always improves outcomes or isolate self-certification as the sole cause.

• Professionally certified building applications, New York City: of 57,172 FY2001 applications, 20,214 (35%) were professionally certified. DOB audits found errors in 59%; the Comptroller's review of 73 found errors in 67%. Of 25 sampled applications already audited by DOB, 14 still contained problems the DOB audit had missed.³³
• Professionally certified fire-alarm corrections, New York City: property owners for 49% of 51 audited professional certifications failed the follow-up inspections. The program had audited only 5% of 1,139 certifications during FY2008.³⁴
• Physician self-assessment versus external competence measures: a systematic review found that 13 of 20 comparisons showed little, no, or an inverse relationship between self-assessment and external assessment; only 7 showed positive associations.³⁵ This concerns competence calibration, not a direct task-completion defect rate.
• Medical second-opinion detection: mandatory surgical-pathology review found 132 major disagreements (2.3%) and 507 minor disagreements (9.0%).³⁶ A later surgical-pathology study found discrepancies in 104 patients (14.1%), with 30 (4.1%) changing care.³⁷ In musculoskeletal imaging, 610 of 2,326 (26.2%) reports had clinically important differences; where pathology established the final diagnosis in high-discrepancy cases, the second opinion was correct in 334 of 407 (82.0%).³⁸
• External inspection of audit work: PCAOB reported that 46% of engagements reviewed in its 2023 annual inspections had at least one Part I.A deficiency—meaning insufficient appropriate evidence supported one or more audit opinions.³⁹ PCAOB cautions that inspected engagements and areas are risk-selected and are not representative samples of all firm audits.⁴⁰

What these numbers establish—and what they do not

They establish that worker or first-reviewer confidence is not reliable completion evidence by itself and that independent checks can expose material disagreement, missing evidence, or nonconformance. They do not establish a single cross-domain defect multiplier for self-assessed work, nor do they justify applying the most expensive review level to every task.

6. Domain-specific completion concepts without a direct programming analogue

Concept	Domain meaning	Why it matters for a governed-work model
Substantial completion versus final completion	A construction project can be sufficiently complete for intended use while punch-list items remain. AIA G704 records the date, outstanding corrections, responsibilities, and acceptance.7	complete is not necessarily binary. A state can authorize use while preserving residual obligations.
Certificate of occupancy	A code official authorizes occupancy after inspection. Issuance does not legalize undiscovered or continuing code violations.6	Regulatory permission is not proof of perfect quality and should not erase defect claims.
Final acceptance with surviving warranty and latent-defect remedies	FAR construction warranty clauses can continue for one year after final acceptance, and acceptance does not necessarily extinguish fraud, gross mistake, or latent-defect remedies.41	Acceptance and obligation extinction are separate temporal states.
Standard of care	In medicine and law, competent performance is measured against professional duties and circumstances, not solely client satisfaction or a guaranteed outcome.813	Outcome failure does not automatically prove incomplete work; client satisfaction does not prove professional conformity.
Informed consent	The patient decides whether to accept treatment after disclosure; the clinician remains responsible for competent care.9	Acceptance authority may govern permission, not technical correctness.
Filing certification versus adjudication	FRCP 11 allows counsel to certify a filing after reasonable inquiry; a court later determines legal sufficiency, sanctions, and ultimately the dispute.15	Submission completeness, procedural acceptance, and substantive success are distinct states.
Engagement completion versus report-release approval	The audit team can complete procedures, but the report cannot be released for use until the engagement quality reviewer concurs.4	Evidence production and terminal authorization are separate gates.
Operator control versus regulatory inspection	Food-service management continuously controls hazards; regulators inspect periodically according to risk.1718	Continuous first-party control can coexist with sampled external verification.
Inspection or testing versus acceptance	FAR distinguishes contractor inspection/testing from the contracting officer's authority to accept supplies or services.124	Evidence producers should not implicitly acquire acceptance authority.
Certificate of compliance versus workmanship satisfaction	A trade certificate can evidence regulatory compliance while the customer can still dispute finish, scope, delay, or contractual quality.2021	Multiple acceptance dimensions may remain open after one certificate passes.
Author completion versus publication or degree acceptance	An author may finish a manuscript, but an editor decides publication; a dissertation committee/institution decides degree acceptance.2930	Personal completion and institutional completion are different contracts.
Version completion in creative work	Copyright registration asks for the completion year of the particular version, not a universal final state of the evolving work.27	Completion can be version-scoped rather than permanently terminal.

7. Synthesis: universal, conditional, or domain-specific?

Evidence verdict

Independent verification is CONDITIONAL. It is neither universal nor merely arbitrary by domain. Across domains, the same selectors recur:

1. Consequence of false acceptance: injury, mission loss, financial misstatement, deprivation of rights, or public hazard.
2. Detectability and latency: whether conformance can be observed at the end or must be verified during the process.
3. Reversibility and cost to cure: whether errors can be replaced or corrected without major loss.
4. Externalities: whether failure affects only the requester or also patients, occupants, investors, the public, or future owners.
5. Conflict of interest and fiduciary exposure: whether the executor benefits from acceptance or controls the evidence.
6. Information asymmetry: whether the client can meaningfully judge technical quality.
7. Credentialing and auditability: whether scoped self-certification is backed by qualification, records, sampling, complaints, sanctions, and regulator access.
8. Statutory, contractual, or institutional mandate: whether an external authority legally controls the state transition.
9. Cost and scalability of review: whether universal inspection would divert scarce assurance resources from higher-risk work.

FAR states several of these selectors expressly—intended use, potential loss, correction likelihood, inspection cost, complexity, and criticality.²⁵¹ Building regulation distinguishes minor work, ordinary permit inspection, structural special inspection, and higher-risk regulator oversight.⁵²²² ISO allows internal audit, customer audit, or optional independent certification.³

Architectural inference for Kiln

The evidence supports these invariants:

1. Every governed work contract must identify acceptance authority. Silence must not implicitly assign authority to the executor.
2. Worker attestation is an evidence type, not a completion decision. It may satisfy a contract only when policy explicitly permits it.
3. Independent review is a policy-selected obligation with a named independence level, scope, and trigger—not a universal Boolean.
4. Evidence producer, reviewer, and acceptance authority must remain separately attributable even when one actor legitimately holds multiple roles.
5. The completion state must preserve qualifiers: provisional, substantial, accepted, regulator-approved, final, warranty-open, superseded, or rejected as applicable.
6. A tool invocation proves activity, not outcome. Browser use, inspection execution, test execution, or document signing is not equivalent to a conforming verdict.
7. Fail closed for high-risk or authority-sensitive transitions. If policy requires independent review and no eligible reviewer produced admissible evidence, the work is not complete.
8. Permit explicit low-risk self-certification. The system should not force ceremonial independent review where the governing contract intentionally accepts credentialed or personal self-attestation.
9. Do not collapse client acceptance into technical verification. A client can accept scope or commercial delivery without being competent to certify hidden safety or professional conformity.
10. Retain post-acceptance obligations and defect remedies. Acceptance must not erase warranties, unresolved items, residual risk, or latent-defect channels.

Recommended contract shape

This is an inference, not a sourced domain standard:

completion_claim:
  claimed_by
  claimed_at
  scope
  claimed_state

completion_evidence[]:
  type
  produced_by
  provenance
  target_or_subject
  observations
  verdict
  limitations

review_requirement:
  required
  minimum_independence
  reviewer_qualification
  trigger_basis
  scope
  sampling_or_coverage

review_result:
  reviewer
  relationship_to_executor
  evidence_reviewed
  verdict
  exceptions
  residual_risk

acceptance:
  authority
  authority_basis
  decision
  effective_state
  surviving_obligations

The key rule is semantic: completion_claim, evidence, review_result, and acceptance must never be inferred from one another merely because the same runtime event produced them.

8. What could not be verified

1. No universal primary-source rule was found requiring independent review for every human work type. The sources instead contain explicit exemptions, optional certification, self-certification schemes, and risk-scaled assurance.
2. No credible cross-domain causal estimate was found for “defect rate with self-assessment” versus “defect rate with independent review.” The available numbers are heterogeneous audits, retrospective disagreement studies, and risk-selected inspections.
3. Creative and hobby work have thin canonical governance evidence because personal completion is generally nonregulated. Copyright sources establish version and authorship concepts, not aesthetic quality or acceptance doctrine.
4. Ordinary culinary quality lacks a universal formal completion authority. Primary sources are strong for food safety but weak for taste, presentation, and subjective customer satisfaction.
5. Delayed same-person review was not supported by a sufficiently canonical cross-domain source as an independence category. It should not be equated with independent review.
6. Regulatory capture was not verified as a general selector of completion-review depth. Conflict of interest and institutional independence are supported; “capture” is a broader political-economy claim requiring separate research.
7. ISO 9001 clause-level text is copyrighted and not fully available on ISO's public page. This note relies on ISO's official description of optional certification/internal audit and the ISO/IAF Auditing Practices Group's public risk-based guidance, not an unauthorized reproduction of the standard.
8. The AIA G704 full form is licensed. This note relies on AIA's official product description rather than reproducing the form.
9. Enron and Wirecard were not used as quantitative proof of self-certification failure. They are consequential cases, but neither isolates self-assessment as a causal variable and both involve multiple audit, management, governance, and enforcement failures.
10. Repository-local notes 31 and 32 and the specified Windows worktree were not accessible in this execution environment. This note used the operator's supplied summaries and the public issue context; exact wording alignment with the unpublished worktree must be checked when applying the file.

9. Open questions for architecture review

1. Is completion authority a sixth top-level axis, or a required submodel of the existing review axis?
2. Should Kiln model independence as an ordered enum, a set of relationship constraints, or both?
3. What is the default when a contract omits acceptance authority: reject the contract, assign the requester, or apply a risk-tier policy?
4. Which selectors are canonical and executable: consequence, reversibility, detectability, externality, information asymmetry, statutory mandate, cost, or a smaller normalized set?
5. How should composite gates work when client acceptance, technical review, and regulator approval answer different questions?
6. Can the executor and acceptance authority be the same actor when policy explicitly permits self-certification? How is that exception made visible in projections and replay?
7. What reviewer-eligibility rules prevent nominal independence—for example, same agent identity, same execution context, shared incentives, or prior decision ownership?
8. Should delayed self-review be represented as a distinct assurance technique while retaining independence = none?
9. How are sampled reviews represented? Does a review approve one artifact, a batch, a process, or a population with stated confidence and coverage?
10. Which terminal states preserve surviving obligations: punch-list items, warranties, latent defects, monitoring, appeal, correction windows, or regulatory recall?
11. How does recovery supersede a prior acceptance decision without erasing the original evidence and authority chain?
12. Should authority be capability-based, credential-based, appointment-based, statutory, contractual, or a composable combination?
13. What is the fail-closed rule when required evidence exists but the required authority is unavailable?
14. How should GUI, TUI, CLI, SDK, replay, and reconciliation distinguish worker_claimed_complete, verified, accepted, and final?
15. For issue [Architecture] Replace monolithic visual-reference-research with conditional visual-work contracts #9 specifically, which visual-work types require independent design review, and which need only rendered-target verification plus requester acceptance?

---

Primary and canonical sources

Footnotes

1. Federal Acquisition Regulation, Subpart 46.2, contract quality requirements, complexity, criticality, and higher-level controls: https://www.acquisition.gov/far/subpart-46.2 ↩ ↩² ↩³ ↩⁴ ↩⁵

2. International Code Council, 2021 International Building Code, §1704.2, owner-engaged approved agencies for special inspections and stated exceptions: https://codes.iccsafe.org/content/IBC2021P1/chapter-17-special-inspections-and-tests ↩ ↩² ↩³ ↩⁴ ↩⁵

3. International Organization for Standardization, ISO 9001:2015—Quality management systems—Requirements, official overview and certification FAQ: https://www.iso.org/standard/62085.html ↩ ↩² ↩³ ↩⁴ ↩⁵

4. Public Company Accounting Oversight Board, AS 1220, Engagement Quality Review: https://pcaobus.org/oversight/standards/auditing-standards/details/AS1220 ↩ ↩² ↩³ ↩⁴ ↩⁵

5. International Code Council, 2018 International Existing Building Code, §105.2, work exempt from permit, including painting and similar finish work: https://codes.iccsafe.org/content/IEBC2018/chapter-1-scope-and-administration ↩ ↩² ↩³ ↩⁴

6. International Code Council, 2012 International Building Code, §§111.1–111.2, certificate of occupancy after building-official inspection and non-waiver of violations: https://codes.iccsafe.org/content/IBC2012P13/chapter-1-scope-and-administration ↩ ↩² ↩³

7. American Institute of Architects, G704–2017 Certificate of Substantial Completion, official description: https://designshop.aia.org/products/g704-2017-certificate-of-substantial-completion-revised-50-pack ↩ ↩² ↩³

8. American Medical Association, Principles of Medical Ethics, especially competent care and consultation when indicated: https://code-medical-ethics.ama-assn.org/principles ↩ ↩² ↩³ ↩⁴

9. American Medical Association, Code of Medical Ethics, Consent, Communication & Decision Making: https://code-medical-ethics.ama-assn.org/chapters/consent-communication-decision-making ↩ ↩²

10. U.S. Nuclear Regulatory Commission / eCFR, 10 C.F.R. Part 35, Medical Use of Byproduct Material: https://www.ecfr.gov/current/title-10/chapter-I/part-35 ↩ ↩² ↩³

11. The Joint Commission, Medication Management—Accessing Medication When the Pharmacy Is Closed: https://www.jointcommission.org/en/knowledge-library/support-center/standards-interpretation/standards-faqs/000001282 ↩ ↩² ↩³

12. American Bar Association, Model Rule 1.1, Competence: https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_1_competence/ ↩

13. American Bar Association, Comment to Model Rule 1.1, including stakes, complexity, preparation, and consultation: https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_1_competence/comment_on_rule_1_1/ ↩ ↩²

14. American Bar Association, Model Rule 1.2, allocation of authority between client and lawyer: https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_2_scope_of_representation_allocation_of_authority_between_client_lawyer/ ↩ ↩²

15. Federal Rule of Civil Procedure 11, signer certification and court sanctions: https://www.law.cornell.edu/rules/frcp/rule_11 ↩ ↩² ↩³

16. U.S. Securities and Exchange Commission, policy statement on auditor independence: https://www.sec.gov/rules-regulations/policy-statements/33-7507 ↩ ↩²

17. U.S. Food and Drug Administration, Managing Food Safety: A Regulator's Manual for Applying HACCP Principles to Risk-Based Retail and Food Service Inspections: https://www.fda.gov/food/hazard-analysis-critical-control-point-haccp/managing-food-safety-regulators-manual-applying-haccp-principles-risk-based-retail-and-food-service ↩ ↩²

18. U.S. Food and Drug Administration, Inspections to Protect the Food Supply: https://www.fda.gov/food/compliance-enforcement-food/inspections-protect-food-supply ↩ ↩² ↩³

19. U.S. Food and Drug Administration, Food Code 2022: https://www.fda.gov/food/fda-food-code/food-code-2022 ↩

20. UK Government, Competent person schemes: https://www.gov.uk/building-regulations-competent-person-schemes ↩ ↩² ↩³ ↩⁴

21. UK Government, Third party certification schemes for domestic electrical work: https://www.gov.uk/guidance/third-party-certification-schemes-for-domestic-electrical-work ↩ ↩²

22. UK Government, consultation on the building-control regime for higher-risk buildings, especially §§3.74–3.83 and 5.8–5.14: https://www.gov.uk/government/consultations/consultation-on-implementing-the-new-building-control-regime-for-higher-risk-buildings-and-wider-changes-to-the-building-regulations-for-all-buildings/consultation-on-implementing-the-new-building-control-regime-for-higher-risk-buildings-and-wider-changes-to-the-building-regulations-for-all-buildings ↩ ↩² ↩³ ↩⁴

23. International Code Council, 2024 International Plumbing Code, administration and final inspection provisions: https://codes.iccsafe.org/content/IPC2024P1/chapter-1-scope-and-administration ↩

24. Federal Acquisition Regulation, 46.502, responsibility for acceptance: https://www.acquisition.gov/far/46.502 ↩ ↩² ↩³

25. Federal Acquisition Regulation, 46.202-2, government reliance on contractor inspection and decision factors: https://www.acquisition.gov/far/46.202-2 ↩ ↩² ↩³ ↩⁴

26. Federal Acquisition Regulation, 12.402, acceptance of commercial products and services: https://www.acquisition.gov/far/12.402 ↩ ↩² ↩³

27. U.S. Copyright Office, Standard Application Help: Publication/Completion: https://www.copyright.gov/eco/help-publication.html ↩ ↩² ↩³ ↩⁴

28. U.S. Copyright Office, Standard Application Help: Author—Work Made for Hire: https://www.copyright.gov/eco/help-author.html ↩

29. Nature Portfolio, Peer Review policy: https://www.nature.com/nature/editorial-policies/peer-review ↩ ↩² ↩³

30. Harvard Kenneth C. Griffin Graduate School of Arts and Sciences, Biophysics PhD dissertation and defense requirements: https://gsas.harvard.edu/policy/biophysics ↩ ↩² ↩³

31. International Organization for Standardization, ISO/IEC 17020:2026—Conformity assessment—Requirements for bodies performing inspection: https://www.iso.org/standard/17020 ↩

32. ISO 9001 Auditing Practices Group, official public guidance portal and disclaimer: https://committee.iso.org/home/tc176/iso-9001-auditing-practices-group.html ↩

33. New York City Comptroller, Audit Report on the Internal Audit Review of Professionally Certified Building Applications by the Department of Buildings (2003): https://comptroller.nyc.gov/reports/audit-report-on-the-internal-audit-review-of-professionally-certified-building-applications-by-the-department-of-buildings/ ↩

34. New York City Comptroller, Audit Report on Fire Department Controls over the Professional Certification Process of the Fire Alarm Inspection Unit (2009): https://comptroller.nyc.gov/reports/audit-report-on-fire-department-controls-over-the-professional-certification-process-of-the-fire-alarm-inspection-unit/ ↩

35. Davis et al., “Accuracy of Physician Self-assessment Compared With Observed Measures of Competence: A Systematic Review,” JAMA 296(9), 2006, PMID 16954489: https://pubmed.ncbi.nlm.nih.gov/16954489/ ↩

36. Manion et al., “Mandatory Second Opinion in Surgical Pathology Referral Material: Clinical Consequences of Major Disagreements,” American Journal of Surgical Pathology 32(5), 2008, PMID 18360282: https://pubmed.ncbi.nlm.nih.gov/18360282/ ↩

37. “Clinical and Financial Implications of Second-Opinion Surgical Pathology Review,” 2021, PMID 33769453: https://pubmed.ncbi.nlm.nih.gov/33769453/ ↩

38. Chalian et al., “Second-Opinion Subspecialty Consultations in Musculoskeletal Radiology,” American Journal of Roentgenology 206(6), 2016, PMID 27058462: https://pubmed.ncbi.nlm.nih.gov/27058462/ ↩

39. PCAOB, PCAOB Posts 2023 Annual Inspection Reports Alongside Staff Observations and New Charts to Boost Transparency (2024): https://pcaobus.org/news-events/news-releases/news-release-detail/pcaob-posts-2023-annual-inspection-reports-alongside-staff-observations-new-charts-to-boost-transparency ↩

40. PCAOB, Inspection Data for Non-Affiliate Annual Firms, limitations and definition of Part I.A deficiency: https://pcaobus.org/oversight/inspections/inspection-data-non-affiliate-annual-firms ↩

41. 48 C.F.R. §52.246-21, Warranty of Construction: https://www.law.cornell.edu/cfr/text/48/52.246-21 ↩

[Sequela02]

Final long-term architecture decision — conditional work contracts

1. Veredicto

C — implementar #9 como visual-specific, imponer ahora la separación semántica y abrir un issue general ejecutable.
La evidencia converge en que los ejes deben separarse, pero no demuestra todavía una abstracción general estabilizada. Expandir #9 diseñaría el framework antes de validarlo con una segunda instancia no visual.

Evidence base: issue #9; comment 5188090142 / notes 31–32; comment 5188340139 / note 33.

2. AI harnesses vs. human governance

Eje	AI labs / harnesses — note 31	Human governance — notes 32/33	Resultado
Intent	Anthropic/OpenAI parten de una instrucción; Gemini/Claude añaden descripciones, prompts y roles. Normalmente no es un contrato tipado ni declara autoridad de aceptación.	Objetivo, alcance, efectos permitidos, non-goals y criterios de aceptación se expresan separadamente.	Convergen conceptualmente; divergen en formalidad.
Capability / identity	Tool schemas, permisos, modelo, sandbox y subagentes suelen estar representados separadamente, aunque se agrupen en perfiles convenientes.	Profesión, licencia, cualificación, responsabilidad y autoridad son separables del procedimiento.	Convergencia fuerte.
Process / phase	Los computer-use agents usan loops percepción→razonamiento→acción; WebPilot separa exploración estratégica de ejecución local; Gemini usa subagent loops.	FIDIC, clinical pathways y procedimiento legal separan etapas, gates y stopping conditions sin imponer un lifecycle universal.	Convergencia fuerte; AI es más adaptativo.
Evidence	Screenshots, tool results, traces y tests son observaciones. OSWorld/WebArena requieren evaluación del estado externo; UGround muestra que mejor grounding visual mejora resultados.	Auditoría, construcción y medicina exigen provenance, sujeto, tiempo, método, cobertura y fiabilidad.	Convergen en que actividad ≠ evidencia de resultado; human governance formaliza mejor provenance.
Review / acceptance	CUA puede emitir una terminación, pero OpenAI/Anthropic añaden confirmaciones, monitores, classifiers y evaluación externa. Codex/OpenCode dejan esta capa limitada o delegada; Claude/Gemini ofrecen mejores hooks/subagents, pero no una autoridad de aceptación general.	Note 33 concluye que la autoridad de aceptación debe ser explícita; self-attestation sólo es admisible cuando una política lo permite y la independencia escala con riesgo.	Convergencia parcial; ésta es la mayor carencia de los harnesses.
Route	Es dispatch operativo: provider/model/runtime/tool/subagent. Puede resolverse automáticamente o por nombre.	Note 32 no encuentra route como eje universal; encuentra asignación, cualificación y jurisdicción, normalmente ligadas a identidad/capability.	Divergen. Importa porque Kiln es un control plane, no porque route sea una ontología universal del trabajo.

Los labs no conflan los cinco ejes tan completamente como el token actual de Kiln, pero sí agrupan route, identity y capabilities para ergonomía. Esos bundles son aceptables como configuración referencial; no deben adquirir semántica canónica sobre phase, evidence o completion.

Self-assessment

No es autoridad de completion general. OSWorld/WebArena usan verificadores externos; note 31 identifica self-assessment sin rendered verification como failure mode dominante. Note 33 llega al mismo resultado desde human work: self-attestation puede ser evidencia válida para trabajo explícitamente low-risk, reversible o informal, pero no debe etiquetarse como independent verification ni adquirir acceptance authority implícita.

3. Schema invariant assessment

Sound, con una precisión necesaria:

Ningún identificador o campo puede ser la fuente canónica de semántica para más de un eje; los vínculos entre ejes deben ser referencias explícitas y validadas.

La lectura literal “un token no puede aparecer en más de un eje” sería unsound: un routeBinding puede referenciar legítimamente un executor profile que declara identity y capabilities. Lo prohibido es que el nombre del token implique silenciosamente phase, evidence, capability, identity, review y completion.

Los harnesses más capaces respetan parcialmente esta versión semántica al separar tools, permisos, loop, screenshots y evaluadores, aunque usen named bundles. No hay benchmark que aísle este invariant como variable causal. WebPilot, UGround y los benchmarks con verificadores apoyan decomposition, grounding y external verification; no prueban por sí solos que esta regla de schema mejore outcomes.

4. Scope de #9

C. #9 debe resolver sólo la instancia visual ya definida:

• visual intent;
• authoritative design context;
• conditional exploration;
• rendered-target verification;
• conditional design review;
• eliminación de visual-reference-research como monolito y de nuevas escrituras legacy.

Debe imponer el invariant semántico en las estructuras nuevas. No debe estabilizar todavía una API general: note 31 prueba el defecto en coding agents; notes 32/33 justifican una dirección general, pero no un framework implementable completo ni un overlay mechanism definitivo.

5. Resolución de decisiones abiertas

1. Axis count: 5. intent, capability/identity, process, evidence, assurance/acceptance. Temporal context es metadata distribuida; risk triggers son inputs del policy resolver. Completion authority es un submodelo obligatorio de assurance/acceptance, no un sexto eje independiente.
2. Route: Kiln-general pero no domain-general. Debe ser un execution binding fuera de los cinco ejes, separado de capability/identity y resuelto contra sus constraints.
3. Review independence: conditional. Lo universal es declarar completion claim, admissible evidence y acceptance authority. Si policy exige independencia y no existe reviewer elegible, completion falla cerrado. Evidence: comment 5188340139 / note 33.
4. Domain overlays: patrón conceptual ISO, mecanismo Kiln-native, versionado y ejecutable. Base estable + overlay que añade tipos, rules, gates y validators. No importar taxonomías ISO.
5. Evidence provenance: subset Kiln, no la jerarquía completa de auditoría: producer, subject/target, method, observedAt, version/freshness, scope/coverage, integrity, verdict, limitations, supersession y redaction. Añadir reliability levels sólo cuando exista un consumidor real.
6. Incomplete contracts: silencio significa unresolved, no permissive. Un overlay/policy declarado puede completar defaults; sin resolución, se bloquea dispatch o acceptance según el eje. Nunca inferir review, authority o completion desde executor identity, tool invocation o ausencia de error.

6. Minimum viable scope del issue general

Debe contener:

• schema tipado de cinco ejes más routeBinding, completionClaim y acceptanceDecision;
• validator que rechace semantic ownership multi-axis y dangling references;
• policy resolver para obligaciones condicionales, minimum independence y fail-closed defaults;
• provenance subset y reglas de supersession/replay;
• fixtures de dos instancias: visual [Architecture] Replace monolithic visual-reference-research with conditional visual-work contracts #9 y una instancia no visual;
• migración real de esa segunda instancia y pruebas de paridad entre canonical state y sus proyecciones.

Segunda instancia recomendada: managed-agent/provider-routing change. Ya exige child evidence, route/provider identity check y adversarial review. Fuerza a separar route, executor capability, evidence, review y acceptance sin depender de screenshots.

No debe contener: ontología para construcción/medicina, workflow DSL universal, marketplace de overlays, full audit hierarchy, nueva provider abstraction, migración de todos los perfiles ni compatibility layer indefinida.

7. Riesgos y mitigaciones

• Invariant dogmático: permitir references y composite profiles; prohibir sólo semantic ownership implícito.
• Generalización desde dos casos software: mantener el schema provisional hasta una tercera instancia; no afirmar universalidad operacional.
• Ceremonial review: seleccionar independence por consequence, detectability, reversibility, externality, information asymmetry y mandate.
• Provenance inflado: comenzar con el subset anterior y exigir consumidores antes de añadir campos.
• Split-brain de migración: nuevas escrituras sólo en contratos nuevos; historical reader unidireccional; ningún legacy writer.
• Confundir review con acceptance: estados y actores distintos: claimed, verified, accepted, final.

8. Lo que no puede verificarse con la evidence disponible

• Las notes 31/32 completas y el worktree Windows no están disponibles desde este entorno; esta decisión usa sus resúmenes en comment 5188090142 y note 33 completa en comment 5188340139.
• No existe evidencia causal de que el invariant de tokens, por sí solo, mejore outcomes.
• No existe un multiplicador cross-domain fiable de self-assessment frente a independent review; note 33 lo reconoce explícitamente.
• Los detalles de harnesses clonados son snapshots de note 31 y no deben tratarse como capacidades permanentes de todos los productos futuros.
• Cinco ejes no están demostrados como ontología final. Son la partición mínima defendible hoy; seis o siete convertirían concerns cross-cutting en entidades prematuras.

Final architecture rule

A contract binds axes together; a token does not. A worker may claim completion; only the resolved acceptance policy may make that claim authoritative.