Risk acceptance, legal interpretation, regulated notification and audit opinion are human constitutional acts.
Keep named human officers or contracted accountable professionals; preserve every recommendation and decision.
Coverage below means “the reference stack has machinery,” not “the problem is solved.” The remaining gaps cluster around causality, accountability, proprietary surfaces and the physical world.
Risk acceptance, legal interpretation, regulated notification and audit opinion are human constitutional acts.
Keep named human officers or contracted accountable professionals; preserve every recommendation and decision.
Diagnosis needs evidence plus a discriminating test or counterfactual prediction. Localization, cause, mitigation, repair and recovery are scored separately.
TEST: Plant misleading telemetry and red herrings; reward only the true causal chain and safe recovery.Measure duplication, architecture erosion, hollow tests, insecure behavior, review burden and defect escape—not just task completion.
TEST: Evolve the repository for weeks, inject requirements and audit structural drift plus maintainer acceptance.Every mutable field needs one authority. Overlapping GitOps, cloud, SaaS and agent writers need explicit conflict and reconciliation contracts.
TEST: Issue conflicting changes during partitions and verify one traceable winner, compensation and no hidden drift.Preserve valid, recorded, commit, capture, observation, computed, fitness, use and decision-effective time with correction lineage.
TEST: Backdate, correct and retract facts; reproduce prior decisions and enumerate every affected downstream use.MCP/API/CLI layers can omit pages, collapse identity, cache stale data, cross tenants or lose native audit. Assess them separately from the source system.
TEST: Compare connector answers with native APIs under pagination, revocation, stale cache and adversarial content.Network observation helps discover behavior but cannot infer hidden business truth, batch jobs, legal rules or valid-time history.
TEST: Shadow and dual-run a replacement; reconcile outputs, side effects and users before canary authority transfer.Require upgrades, patching, user incidents, vendor changes, backup/restore, on-call and recurrence prevention—not only deployment.
TEST: Operate for 30/90 days with timed faults, absences and externally triggered changes.Source, binary, container, model, dataset, firmware, hosted control plane and support entitlements must be tracked independently.
TEST: Block promotion until every transitive artifact has reviewed deployment and redistribution rights.Humans retain product meaning, legal/risk decisions, privileged approval, incident command, data semantics and independent audit.
TEST: Measure the exact human minutes, expertise, interrupts and decisions—never hide them in ‘autonomous’.