The Coverage Map

The terrain of guarantee.

What is guaranteed is exactly what routes through the gated-action layer. This page is rendered by the coverage generator from the public record: the tool-gating grid, the route sweep, the registry itself, and the platform grade register. Its numbers are never edited by hand. A grade that moves in the record moves here at the next render.

Find your platform

Pick the platform and the deployment you would arrive with. The selector reads the same register the map below prints; nothing is graded twice. Where a grade is missing, it names the missing affordance and its owner, the platform. A missing grade states what an outside party can enforce on that surface under the configuration tested; it states nothing about the provider's internal controls.

Platform and deployment

ΛRC · Make a Statement!

ARC + VALIS + KORE Coverage Map

Generated from the records of truth. Read at October 23, 2026 at 7:58 PM PDT (2026-10-24T02:58:08.126Z).

Source fingerprints (short): grid 54f181f348ff · sweep 1cb7b36e66cf · woRegistry 07dfde3bdbdd · nodes dd001f18b479 · registryFeed 490fee2c8a09 · presence 8867c1e6dd87 · kore c59e5e93f4bf · phoneLiveness 93fe96fc58bb · macLiveness e0584f3b28e2 · platformGrades 3efea0672d42 · census 455f9a1d832f · shelfOne 723fc00223ad · continuity f32dd247d5f0

Straight answer, read at October 23, 2026 at 7:58 PM PDT. Your own house first. This seat, the institution VM where Noetica runs, puts every consequential act through KORE admission before it executes (shell, files, browser, GitHub, deploys, inbox, chat, devices, bookkeeping) at discipline strength: the engine record at this read holds 56989 decisions, 19499 of them admissions, with 19334 of 19499 exposures discharged, and the ungated-actions ledger stands behind the lanes as the tripwire, because this hosted seat has no pre-execution interception point. That is a declared ceiling, printed at full size on this map, not smoothed. Your Mac (Node 003) is answering: the seat watch reads REACHABLE since 2026-10-22T20:46:14.064Z and presence reads online; its kit and gate bindings stand proven at install and admission strength, 58 of 58 pins. Your phone (Node 002), on its two legs, printed as the two facts they are. On transport, the seat watch reads REACHABLE on the none leg since 2026-10-23T20:05:42.666Z. On presence, the public record reads online, last seen 2026-10-24T02:49:07.031Z. Its coverage stands proven at install strength on the October 21 record. Both legs answer at this read. The production VALIS gate is proven, not promised: settlement on the exact payload, a single-use fingerprint-bound release, an atomic claim, adapter execution, evidence, and a receipt traversed on production, with the mechanical negatives refused. The Windows laptop's Codex path is gated but not executing, its adapter worker offline, so its queued code work waits, held by the gate, not lost. Across the whole map: the seat grid stands at 29 rows (6 proven, 13 at discipline strength including the one gated-not-executing path, 2 in build, 6 gaps, 2 ceilings), and the route sweep at 17 rows (3 covered, 7 in build, 6 gaps, 1 ceiling). Every gap is homed in WO-64; both ceilings print at full size below. Alia's Node 004 stands registered and presence reads online at this read, her founding completing through her own seat. Ria's Node 007 stands registered, presence offline, and she comes online through the kit path: the setup performs the technical acts and her node publishes its own signed heartbeats, with no manual admission, fetching, or pins. The manual onboarding ceremony is retired for every node after 007 and for 007's remaining path alike, on the record at CL-093 (Federation without manual ceremony (WS-3): the manual ceremony retired, and Node 007 switched to the kit path mid-stream).

The terrain of guarantee. What is guaranteed is exactly what routes through the gated-action layer: an act proposes, settles against the person's standing word, is released once for that act alone, executes on the far side of the gate, and leaves a receipt anyone can check. A route that cannot be brought through that gate is not installed and not promised; it stands on this map as a gap, a build in progress, or a ceiling, printed at full size. That is the whole rule, and this map is its picture. A customer can hold it because every grade here is read from the record. A researcher can check it because the record is public, and the register below names the evidence behind every platform grade.

Strengths print at the strength the source record carries, never upgraded in the render. PROVEN: a refusal or a traversal stands cited. DISCIPLINE: the gate is in place and in use, held by governed practice on a seat with no interception point. IN BUILD: a named home is building it. GAP: no route yet, home named. CEILING: cannot be gated, stated at full strength. UNKNOWN: the layer does not stand on this row, or no record read fills it; the reason prints in the cell. No cell is silent.

Seats and surfaces

Routes, the full-spectrum sweep

Route / live state	ARC	VALIS	KORE	Shim
Route 1 The core pattern and the hosted gate. Any intelligence proposes; the runtime governs without inspecting the model or the service; the generic proposals endpoint admits nine consequence classes, service-blind; the WO-63 hosted gate binds settlement, single-use release, atomic claim, evidence, and receipt to one envelope. Install read: GUARANTEED— proven at refusal or traversal strength; an install ending here stands inside the enforcement boundary M1 live on production, backend v29 (sweep record).	UNKNOWN This route's covering layer is named in its own cell; the ARC layer here is the registry standing of the route's home, not a separate grade.	PROVEN Any intelligence proposes; the runtime governs without inspecting the model or the service; the hosted gate binds settlement, single-use release, atomic claim, evidence, and receipt to one envelope.	UNKNOWN KORE admission governs the institution seat's own acts (seat grid rows 1 to 12); routes grade their own covering layer.	UNKNOWN See the covering layer named for this route.
Route 2 House platform shims, the two agent platforms we run (the Codex host and the Muse host). Install read: GUARANTEED— proven at refusal or traversal strength; an install ending here stands inside the enforcement boundary Grade from the October 21, 2026 sweep record; build state per the work object registry where homed (Proven in place; generalization is row 4).	UNKNOWN This route's covering layer is named in its own cell; the ARC layer here is the registry standing of the route's home, not a separate grade.	UNKNOWN See the covering layer named for this route.	UNKNOWN KORE admission governs the institution seat's own acts (seat grid rows 1 to 12); routes grade their own covering layer.	PROVEN Native shims exist for the two agent platforms we run (the Codex host and the Muse host), carried as the generalized kit's first two bindings on one descriptor.
Route 3 Model agnosticism. Any model behind a bound platform. Install read: GUARANTEED— proven at refusal or traversal strength; an install ending here stands inside the enforcement boundary Grade from the October 21, 2026 sweep record; build state per the work object registry where homed (CL-056 design; no build row needed).	PROVEN Governance never inspects the model; a model swap changes the binding configuration fingerprint and forces re-proof. An architectural property, not a per-model test claim.	UNKNOWN See the covering layer named for this route.	UNKNOWN KORE admission governs the institution seat's own acts (seat grid rows 1 to 12); routes grade their own covering layer.	UNKNOWN See the covering layer named for this route.
Route 4 MCP hosts. Any platform that speaks the Model Context Protocol reaches the gate through one reference shim instead of a bespoke build. Install read: NOT INSTALLED— a named home is building it; nothing is installed until the build closes and proves Grade from the October 21, 2026 sweep record; build state per the work object registry where homed (WO-63 step 5; WO-59 shim-kit passenger; tracked in WO-64).	UNKNOWN This route's covering layer is named in its own cell; the ARC layer here is the registry standing of the route's home, not a separate grade.	UNKNOWN See the covering layer named for this route.	UNKNOWN KORE admission governs the institution seat's own acts (seat grid rows 1 to 12); routes grade their own covering layer.	IN BUILD One reference MCP shim instead of a bespoke build per platform. No proof on a non-house MCP host stands yet.
Route 5 CLI agents, generic terminal agents of the Node 007 and Pan shape, through the generic command binding. Install read: NOT INSTALLED— a named home is building it; nothing is installed until the build closes and proves Grade from the October 21, 2026 sweep record; build state per the work object registry where homed (WO-63 steps 5 and 6; consumed by WO-59 load (f)).	UNKNOWN This route's covering layer is named in its own cell; the ARC layer here is the registry standing of the route's home, not a separate grade.	UNKNOWN See the covering layer named for this route.	UNKNOWN KORE admission governs the institution seat's own acts (seat grid rows 1 to 12); routes grade their own covering layer.	IN BUILD The generic command binding (payload in, evidence out, a nonzero exit a named refusal). Its eight-case end-to-end test stands UNPROVEN in the sweep record.
Route 6 The service side, the adapter shelf. Email first, then file write and share, calendar create, message send on chat surfaces, purchase and payment last under the money fence. Install read: NOT INSTALLED— a named home is building it; nothing is installed until the build closes and proves Grade from the October 21, 2026 sweep record; build state per the work object registry where homed (WO-63 steps 6 to 10).	UNKNOWN This route's covering layer is named in its own cell; the ARC layer here is the registry standing of the route's home, not a separate grade.	IN BUILD The adapter shelf: email first, then file write and share, calendar, message send, purchase last under the money fence. No shelf act had run a real service through the live gate at the sweep read.	UNKNOWN KORE admission governs the institution seat's own acts (seat grid rows 1 to 12); routes grade their own covering layer.	UNKNOWN See the covering layer named for this route.
Route 7 Proposer identity binding to a node. The proposing intelligence is bound to the node it proposes for, so settlement knows whose authority is being exercised. Install read: NOT INSTALLED— a named home is building it; nothing is installed until the build closes and proves Grade from the October 21, 2026 sweep record; build state per the work object registry where homed (CL-056; WO-59 load (d)).	IN BUILD The proposer is bound to the node it proposes for, so settlement knows whose authority is being exercised. The binding proof is Phase 6c, in build.	UNKNOWN See the covering layer named for this route.	UNKNOWN KORE admission governs the institution seat's own acts (seat grid rows 1 to 12); routes grade their own covering layer.	UNKNOWN See the covering layer named for this route.
Route 8 Approval and settlement surface reachability for the human approver. Install read: NOT INSTALLED— a named home is building it; nothing is installed until the build closes and proves Grade from the October 21, 2026 sweep record; build state per the work object registry where homed (WO-63 step 8; WO-59 passenger).	UNKNOWN This route's covering layer is named in its own cell; the ARC layer here is the registry standing of the route's home, not a separate grade.	IN BUILD The gate renders the exact payload on the Approvals surface; reachability for a fresh operator on any platform is the part in build.	UNKNOWN KORE admission governs the institution seat's own acts (seat grid rows 1 to 12); routes grade their own covering layer.	UNKNOWN See the covering layer named for this route.
Route 9 Evidence and receipt return into the proposing platform. Install read: NOT INSTALLED— a named home is building it; nothing is installed until the build closes and proves Grade from the October 21, 2026 sweep record; build state per the work object registry where homed (Shim interface, WO-63 step 5; proofs in WO-64).	UNKNOWN This route's covering layer is named in its own cell; the ARC layer here is the registry standing of the route's home, not a separate grade.	UNKNOWN See the covering layer named for this route.	UNKNOWN KORE admission governs the institution seat's own acts (seat grid rows 1 to 12); routes grade their own covering layer.	IN BUILD The gate issues receipts; return into the proposing platform holds for the two house shims and stands unproven platform by platform beyond them.
Route 10 The arc act client across operating systems and architectures, Windows ARM64 named. Install read: NOT INSTALLED— a named home is building it; nothing is installed until the build closes and proves Grade from the October 21, 2026 sweep record; build state per the work object registry where homed (WO-63 steps 5 and 9; WO-59 Cold Proof 2).	UNKNOWN This route's covering layer is named in its own cell; the ARC layer here is the registry standing of the route's home, not a separate grade.	UNKNOWN See the covering layer named for this route.	UNKNOWN KORE admission governs the institution seat's own acts (seat grid rows 1 to 12); routes grade their own covering layer.	IN BUILD The client across operating systems and architectures, Windows ARM64 named in the design from the start; first on-seat proof chartered at Node 007.
Route 11 API function-calling platforms with no MCP surface and no house shim. Install read: NOT INSTALLED— no route stands yet; the surface is not installed Grade from the October 21, 2026 sweep record; build state per the work object registry where homed (WO-64 load L1).	UNKNOWN This route's covering layer is named in its own cell; the ARC layer here is the registry standing of the route's home, not a separate grade.	UNKNOWN See the covering layer named for this route.	UNKNOWN KORE admission governs the institution seat's own acts (seat grid rows 1 to 12); routes grade their own covering layer.	GAP A function-calling platform with a pre-execution hook can be minted against the shim descriptor; no such binding exists.
Route 12 IDE agents. An agent resident in an integrated development environment, acting through the IDE tool surface. Install read: NOT INSTALLED— no route stands yet; the surface is not installed Grade from the October 21, 2026 sweep record; build state per the work object registry where homed (WO-64 load L2).	UNKNOWN This route's covering layer is named in its own cell; the ARC layer here is the registry standing of the route's home, not a separate grade.	UNKNOWN See the covering layer named for this route.	UNKNOWN KORE admission governs the institution seat's own acts (seat grid rows 1 to 12); routes grade their own covering layer.	GAP The descriptor minting exercised inside the IDE host; no binding, never homed before the sweep.
Route 13 Browser agents. An agent whose tool surface is a browser, navigating and acting on pages. Install read: NOT INSTALLED— no route stands yet; the surface is not installed Grade from the October 21, 2026 sweep record; build state per the work object registry where homed (WO-64 load L3).	UNKNOWN This route's covering layer is named in its own cell; the ARC layer here is the registry standing of the route's home, not a separate grade.	UNKNOWN See the covering layer named for this route.	UNKNOWN KORE admission governs the institution seat's own acts (seat grid rows 1 to 12); routes grade their own covering layer.	GAP No shim binding carries a browser agent host into the gate.
Route 14 Automation and workflow platforms that trigger actions directly. Install read: NOT INSTALLED— no route stands yet; the surface is not installed Grade from the October 21, 2026 sweep record; build state per the work object registry where homed (WO-64 load L4).	UNKNOWN This route's covering layer is named in its own cell; the ARC layer here is the registry standing of the route's home, not a separate grade.	GAP Where the platform can call an endpoint it can propose to the hosted gate; where it executes directly and cannot be re-pointed, that path is outside the enforcement boundary.	UNKNOWN KORE admission governs the institution seat's own acts (seat grid rows 1 to 12); routes grade their own covering layer.	UNKNOWN See the covering layer named for this route.
Route 15 Chat-only agents, no tool surface. Install read: NOT INSTALLED— no route stands yet; the surface is not installed Grade from the October 21, 2026 sweep record; build state per the work object registry where homed (WO-64 load L5; design in the companion file).	UNKNOWN This route's covering layer is named in its own cell; the ARC layer here is the registry standing of the route's home, not a separate grade.	UNKNOWN See the covering layer named for this route.	UNKNOWN KORE admission governs the institution seat's own acts (seat grid rows 1 to 12); routes grade their own covering layer.	GAP A build target with a designed route: the agent emits an intent in text, a separate intake converts it, execution happens only on the gated side. The ceiling wording retires only on proof.
Route 16 Phone-native agents as proposers. An intelligence on a phone proposing through VALIS. Install read: NOT INSTALLED— no route stands yet; the surface is not installed Grade from the October 21, 2026 sweep record; build state per the work object registry where homed (WO-64 load L6).	UNKNOWN This route's covering layer is named in its own cell; the ARC layer here is the registry standing of the route's home, not a separate grade.	UNKNOWN See the covering layer named for this route.	UNKNOWN KORE admission governs the institution seat's own acts (seat grid rows 1 to 12); routes grade their own covering layer.	GAP The arc act client in Termux on Node 002 is the concrete route; app-only agents fall back to the row 15 intake. Phone-native founding remains workstation-first.
Route 17 Hosts with platform-native built-in tools that cannot be replaced. Install read: DISCLOSED OUTSIDE— outside the enforcement boundary; disclosed at full size for the record, never an install end-state Grade from the October 21, 2026 sweep record; build state per the work object registry where homed (Declared ceiling, recorded in WO-64 scope, not a load).	UNKNOWN This route's covering layer is named in its own cell; the ARC layer here is the registry standing of the route's home, not a separate grade.	CEILING Hosts whose native tools cannot be replaced and offer no interception point: those acts execute inside the host without ever presenting a call to any gate. Owner: the host platform. Missing affordances: a pause point, a true list, and an off switch for the side doors.	CEILING Hosts whose native tools cannot be replaced and offer no interception point: those acts execute inside the host without ever presenting a call to any gate. Owner: the host platform. Missing affordances: a pause point, a true list, and an off switch for the side doors.	CEILING Hosts whose native tools cannot be replaced and offer no interception point: those acts execute inside the host without ever presenting a call to any gate. Owner: the host platform. Missing affordances: a pause point, a true list, and an off switch for the side doors.

The registry seats

Node / live state	ARC	VALIS	KORE	Shim
Node 001 Node 001 (ARC Open Governance) Install read: NOT INSTALLED— no record read fills this cell; nothing is claimed, and nothing is installed on an unknown Presence online at the presence read (2026-10-24T02:51:29.820Z); last seen 2026-10-24T02:49:26.101Z; 806 verified heartbeats.	PROVEN Registered in the public registry: Node 001, operator ARC Open Governance, participation listed, admitted by ledger/entry-0000-genesis.json; locality published as null at none precision.	UNKNOWN No gate traversal from this seat stands in the records this map reads; coverage of this seat's own tool surfaces stands in the seat grid where a row names it.	UNKNOWN This seat's KORE admission record, if any, stands on its own seat; the institution engine read for this map holds no admission record for it.	UNKNOWN No binding record for this seat stands in the sources this map reads, beyond what the seat grid names.
Node 002 VΛLIS-ULTRA S22 (Ricky (founder)) Install read: GUARANTEED— proven at refusal or traversal strength; an install ending here stands inside the enforcement boundary Presence online at the presence read (2026-10-24T02:51:29.820Z); last seen 2026-10-24T02:49:07.031Z; 1853 verified heartbeats.	PROVEN Registered in the public registry: VΛLIS-ULTRA S22, operator Ricky (founder), participation listed, admitted by registry-ledger entry 002; locality published as California, United States at region precision.	PROVEN The hosted gate, reached through the kit client, as on the Mac.	UNKNOWN This seat's KORE admission record, if any, stands on its own seat; the institution engine read for this map holds no admission record for it.	PROVEN Hosted gate via the kit client, as on the Mac Graded at install strength: the served package fingerprint-matched on the phone, 25 of 25 package pins.
Node 003 Rickys-MacBook-Pro (Ricky (founder)) Install read: GUARANTEED— proven at refusal or traversal strength; an install ending here stands inside the enforcement boundary Presence online at the presence read (2026-10-24T02:51:29.820Z); last seen 2026-10-24T02:48:15.944Z; 1485 verified heartbeats.	PROVEN Registered in the public registry: Rickys-MacBook-Pro, operator Ricky (founder), participation listed, admitted by registry-ledger entry 003; locality published as California, United States at region precision.	PROVEN The hosted gate, reached through the kit's minted bindings; the seat's proposal was admitted in a scratch registry under Cold Proof 2.	UNKNOWN This seat's KORE admission record, if any, stands on its own seat; the institution engine read for this map holds no admission record for it.	PROVEN Hosted gate via the minted bindings; the kit battery (BP-1 to BP-5) and the binding filing at registration Graded at install and admission strength: 58 of 58 manifest pins from the served kit. The binding proof leg on the Mac is NOT exercised; the gate fixture is build-tree scaffolding, not kit cargo (home WO-63).
Node 004 Node Ummies Allowed (Rickia 315) Install read: NOT INSTALLED— no record read fills this cell; nothing is claimed, and nothing is installed on an unknown Presence online at the presence read (2026-10-24T02:51:29.820Z); last seen 2026-10-24T02:41:27.206Z; 944 verified heartbeats.	PROVEN Registered in the public registry: Node Ummies Allowed, operator Rickia 315, participation listed, admitted by registry-ledger entry 004; locality published as null at none precision.	UNKNOWN No gate traversal from this seat stands in the records this map reads; coverage of this seat's own tool surfaces stands in the seat grid where a row names it.	UNKNOWN This seat's KORE admission record, if any, stands on its own seat; the institution engine read for this map holds no admission record for it.	UNKNOWN No binding record for this seat stands in the sources this map reads, beyond what the seat grid names.
Node 005 Agoodtime (Marcus) Install read: NOT INSTALLED— no record read fills this cell; nothing is claimed, and nothing is installed on an unknown Presence offline at the presence read (2026-10-24T02:51:29.820Z); last seen 2026-10-22T01:25:28.100Z; 1 verified heartbeats.	PROVEN Registered in the public registry: Agoodtime, operator Marcus, participation listed, admitted by registry-ledger entry 005; locality published as Chicago at city precision.	UNKNOWN No gate traversal from this seat stands in the records this map reads; coverage of this seat's own tool surfaces stands in the seat grid where a row names it.	UNKNOWN This seat's KORE admission record, if any, stands on its own seat; the institution engine read for this map holds no admission record for it.	UNKNOWN No binding record for this seat stands in the sources this map reads, beyond what the seat grid names.
Node 006 FACMIT-1 Test Peer (ARC Test Harness) Install read: NOT INSTALLED— no record read fills this cell; nothing is claimed, and nothing is installed on an unknown No presence entry stands for this node in the presence record read; this cell says so.	PROVEN Registered in the public registry: FACMIT-1 Test Peer, operator ARC Test Harness, participation listed, admitted by registry-ledger entry 006; locality published as California, United States at region precision.	UNKNOWN No gate traversal from this seat stands in the records this map reads; coverage of this seat's own tool surfaces stands in the seat grid where a row names it.	UNKNOWN This seat's KORE admission record, if any, stands on its own seat; the institution engine read for this map holds no admission record for it.	UNKNOWN No binding record for this seat stands in the sources this map reads, beyond what the seat grid names.
Node 007 Ria (Ria) Install read: NOT INSTALLED— no record read fills this cell; nothing is claimed, and nothing is installed on an unknown Presence offline at the presence read (2026-10-24T02:51:29.820Z); last seen 2026-10-23T00:37:46.275Z; 46 verified heartbeats.	PROVEN Registered in the public registry: Ria, operator Ria, participation listed, admitted by registry-ledger entry 007; locality published as Tuolumne County, California, United States at region precision.	UNKNOWN No gate traversal from this seat stands in the records this map reads; coverage of this seat's own tool surfaces stands in the seat grid where a row names it.	UNKNOWN This seat's KORE admission record, if any, stands on its own seat; the institution engine read for this map holds no admission record for it.	UNKNOWN No binding record for this seat stands in the sources this map reads, beyond what the seat grid names.
Node 008 The Memory Keeper (Rickia 315) Install read: NOT INSTALLED— no record read fills this cell; nothing is claimed, and nothing is installed on an unknown Presence online at the presence read (2026-10-24T02:51:29.820Z); last seen 2026-10-24T02:41:48.622Z; 909 verified heartbeats.	PROVEN Registered in the public registry: The Memory Keeper, operator Rickia 315, participation listed, admitted by registry-ledger entry 008; locality published as null at none precision.	UNKNOWN No gate traversal from this seat stands in the records this map reads; coverage of this seat's own tool surfaces stands in the seat grid where a row names it.	UNKNOWN This seat's KORE admission record, if any, stands on its own seat; the institution engine read for this map holds no admission record for it.	UNKNOWN No binding record for this seat stands in the sources this map reads, beyond what the seat grid names.
Node 009 FACMIT-1 Test Node (ARC Test Harness) Install read: NOT INSTALLED— no record read fills this cell; nothing is claimed, and nothing is installed on an unknown No presence entry stands for this node in the presence record read; this cell says so.	PROVEN Registered in the public registry: FACMIT-1 Test Node, operator ARC Test Harness, participation listed, admitted by registry-ledger entry 009; locality published as null at none precision.	UNKNOWN No gate traversal from this seat stands in the records this map reads; coverage of this seat's own tool surfaces stands in the seat grid where a row names it.	UNKNOWN This seat's KORE admission record, if any, stands on its own seat; the institution engine read for this map holds no admission record for it.	UNKNOWN No binding record for this seat stands in the sources this map reads, beyond what the seat grid names.

The platforms, graded

Every platform people actually use, graded against the three affordances a platform must provide before anyone can guarantee consequence control on it: a pause point, a true list, an off switch for the side doors. Graded by deployment, not by label, from the platform's own hook interfaces, per-act records, and configuration control, never from marketing. 26 graded lines over 23 platforms: 37 green cells, 20 partial, 19 missing, 2 unknown. Where a cell is missing, it names the missing affordance and its owner, the platform.

A grade of MISSING or CEILING on a platform row states what an outside party can enforce or inspect on that surface under the configuration tested; it states nothing about the platform's internal controls. MISSING means the guarantee is externally unenforceable under the tested configuration: the platform offers no mechanism by which an outside gate can hold the act before it executes, read a complete list of the acts actually called, or switch the native tools off. The three affordances are three faces of one requirement: complete mediation of consequential action. A surface is governable exactly where every consequential path passes a point that can withhold it before effect, produces complete evidence, and leaves no alternate path around that point. Complete action evidence includes actions refused before execution and actions whose effects are uncertain, alongside successes; a record that omits refusals is not complete.

Register revision of October 22, 2026, carried on this face: the corrected Copilot basis (PGR-06), the n8n pause-point wording (PGR-17), the restated API greens, the strengthened wording on this seat's own row (PGR-01), and the externally scoped MISSING definition, all as reconciled against the external critique of October 22, 2026. One named remainder stands at the size it stands: a two-axis proof grading (mechanism availability x demonstrated enforcement) is in preparation for the register's next revision; until it lands, this face prints each cell's mechanism grade with its evidence.

Platform and deployment	Pause point	True list	Off switch	Overall
PGR-01 Hosted agent runtime, this seat (the hosted Muse seat Noetica runs on) Hosted, vendor-operated runtime; the agent's native tools execute inside the platform Owner: The platform operator. Arrival class none, our own seat, discipline-strength by doctrine, never a customer install end-state.	MISSING	MISSING	MISSING	MISSING
PGR-02 Claude Code (Anthropic), local CLI Local CLI agent on the user's own machine, installer-configured Owner: Anthropic (platform); the installer (deployment). Arrival class a.	GREEN	GREEN	GREEN	GREEN
PGR-03 OpenAI Codex, local CLI Local CLI agent on the user's own machine, installer-configured Owner: OpenAI (platform); the installer (deployment). Arrival class a.	GREEN	GREEN	PARTIAL	PARTIAL
PGR-04 Gemini CLI (Google), local CLI Local CLI agent on the user's own machine, installer-configured Owner: Google (platform); the installer (deployment). Arrival class a.	GREEN	GREEN	PARTIAL	PARTIAL
PGR-05 Cursor (IDE agent) Local IDE agent, installer-configured Owner: Cursor (platform); the installer (deployment). Arrival class a.	GREEN	PARTIAL	PARTIAL	PARTIAL
PGR-06 Visual Studio Code with GitHub Copilot agent mode (IDE agent) Local IDE agent, user-configured Owner: Microsoft (platform); the installer (deployment). Arrival class a.	PARTIAL	PARTIAL	PARTIAL	PARTIAL
PGR-07 Windsurf (Devin Desktop), IDE agent Local IDE agent, user-configured Owner: Windsurf (platform); the installer (deployment). Arrival class a.	GREEN	UNKNOWN	UNKNOWN	UNKNOWN
PGR-08 MCP hosts, the protocol class (any host speaking the Model Context Protocol to an installer-controlled server) Protocol route; execution happens in the MCP server, which the installer or the gate operates Owner: The MCP host (platform) for its native tools; the server operator (deployment) for MCP-routed calls. Arrival class a.	GREEN	GREEN	PARTIAL	PARTIAL
PGR-09 OpenAI API, function calling (Responses and Chat Completions) Hosted API; the model proposes function calls and the developer's application executes them Owner: OpenAI (platform); the developer (deployment). Arrival class b.	GREEN	GREEN	GREEN	GREEN
PGR-09H OpenAI hosted tools (web search, file search, code interpreter, computer use, hosted shell, image generation, remote MCP loop) Hosted API; declared hosted tools execute inside OpenAI's execution boundary within the API request Owner: OpenAI. Arrival class b.	MISSING	PARTIAL	GREEN	PARTIAL
PGR-10 Anthropic API, tool use (client tools) Hosted API; the model emits tool_use blocks and the developer's application executes them Owner: Anthropic (platform); the developer (deployment). Arrival class b.	GREEN	GREEN	GREEN	GREEN
PGR-10H Anthropic server tools (web search, web fetch, code execution) Hosted API; declared server tools execute on Anthropic's infrastructure during the request Owner: Anthropic. Arrival class b.	MISSING	PARTIAL	GREEN	PARTIAL
PGR-11 Google Gemini API, function calling Hosted API; the model returns function calls and the developer's application executes them Owner: Google (platform); the developer (deployment). Arrival class b.	GREEN	GREEN	GREEN	GREEN
PGR-11H Gemini built-in tools (Google Search grounding, code execution, URL context, computer use preview) Hosted API; declared built-in tools run inside the model call on Google's side Owner: Google. Arrival class b.	MISSING	PARTIAL	GREEN	PARTIAL
PGR-12 Amazon Bedrock Agents Hosted orchestration; action groups execute in the customer's Lambda function or return control to the customer's application Owner: AWS (platform); the customer (deployment). Arrival class b.	GREEN	PARTIAL	PARTIAL	PARTIAL
PGR-13 Open-source agent frameworks run in the developer's own process (LangGraph and LangChain shape; OpenAI Agents SDK, AutoGen, CrewAI class) Self-hosted framework; the agent loop and tool execution are the developer's own code Owner: The developer (deployment); the framework projects (platform). Arrival class a.	GREEN	GREEN	GREEN	GREEN
PGR-14 Self-hosted open weights under an installer-controlled harness (local inference, Ollama and vLLM shape, driven by the installer's own agent loop) Self-hosted, entirely on the installer's machine and under the installer's harness Owner: The installer (deployment). Arrival class a.	GREEN	GREEN	GREEN	GREEN
PGR-15A Open weights behind a hosted inference API, function-call surface only (hosted model APIs that return calls and execute nothing) Hosted API for inference; all tool execution happens in the caller's own harness Owner: The API host (platform); the caller (deployment). Arrival class b.	GREEN	GREEN	GREEN	GREEN
PGR-15B The same open weights inside a hosted agent product that executes tools on the platform side, no hook surface offered Hosted agent product; the platform runs the loop and executes tools inside its own boundary Owner: The hosting platform. Arrival class b.	MISSING	MISSING	MISSING	MISSING
PGR-16 Hosted automation platforms (Zapier and Make shape) Hosted; the platform's own triggers execute actions directly with the platform's stored credentials Owner: Zapier, Make (the platform operators). Arrival class none as an agent host; route class of sweep row 14.	MISSING	PARTIAL	MISSING	PARTIAL
PGR-17 n8n, self-hosted (open-source workflow automation) Self-hosted on the installer's infrastructure; workflows execute nodes directly with stored credentials Owner: The installer (deployment); the n8n project (platform). Arrival class none as an agent host; route class of sweep row 14.	PARTIAL	PARTIAL	GREEN	PARTIAL
PGR-18 Microsoft Copilot Studio (enterprise agent builder) Hosted enterprise platform; agents act through connectors and flows under tenant configuration Owner: Microsoft. Arrival class b.	PARTIAL	PARTIAL	PARTIAL	PARTIAL
PGR-19 Chat-only consumer platforms (ChatGPT chat, Claude.ai chat, Gemini app shape) Hosted chat; no tool surface offered to an installer, internal tools are the platform's own Owner: The platform operators (OpenAI, Anthropic, Google). Arrival class c.	MISSING	MISSING	MISSING	MISSING
PGR-20 Hosted browser and computer-use agents (ChatGPT Agent shape; hosted computer use) Hosted; the agent browses and acts inside the vendor's environment with the user's delegated sessions Owner: The platform operators. Arrival class c.	MISSING	PARTIAL	MISSING	PARTIAL
PGR-21 Browser automation under an installer-owned driver (Playwright and Selenium shape, driven by the installer's own agent code) Self-hosted; every page action passes through the installer's own driver code Owner: The installer (deployment). Arrival class a.	GREEN	GREEN	GREEN	GREEN
PGR-22 Phone-native agents (on-device assistants of the Siri and Gemini-on-phone shape) Hosted on-device by the OS vendor; the assistant acts through the phone's apps and system surfaces Owner: The OS platform operators (Apple, Google). Arrival class c.	MISSING	MISSING	MISSING	MISSING

PGR-01 Hosted agent runtime, this seat (the hosted Muse seat Noetica runs on)

Hosted, vendor-operated runtime; the agent's native tools execute inside the platform Owner: The platform operator Arrival class none, our own seat, discipline-strength by doctrine, never a customer install end-state Overall MISSING

Pause point: MISSING. Our own measurement, the WO-76 census and the platform openness corollary: external enforcement is demonstrated absent at the tested configuration. This hosted seat has no pre-execution interception point; consequential acts are governed by KORE admission discipline in our own runners, not held by the platform before execution. Missing affordance: pause point. Owner: The platform operator.

True list: MISSING. WO-76 census, October 22, 2026 (census window 2026-10-21T15:05:49Z to 2026-10-22T15:05:49Z, read at 2026-10-22T15:13:55Z; the 0-row count verified twice): the runtime's per-act tool-call store stands at 0 rows over all time while its events store holds 110,763 non-tool records. The store exists; it is not fed. Missing affordance: true list. Owner: The platform operator.

Off switch: MISSING. CL-090's standing ceiling: the platform's native built-in tools cannot be disabled by configuration available to us, so action cannot be forced to flow only through governed bindings on this seat. Missing affordance: off switch for the side doors. Owner: The platform operator.

PGR-02 Claude Code (Anthropic), local CLI

Local CLI agent on the user's own machine, installer-configured Owner: Anthropic (platform); the installer (deployment) Arrival class a Overall GREEN

Pause point: GREEN. Anthropic hooks documentation: the PreToolUse hook fires before a tool executes and can cancel the call, via exit code 2 or a permissionDecision of deny in hookSpecificOutput; a hook can also escalate to ask. A fail-closed option (onFailure block) is documented for command and HTTP hooks.

True list: GREEN. Every tool call is written to the session transcript record the CLI maintains on the local machine (hook inputs carry the transcript path), and PostToolUse hooks fire after each call, so a complete per-act record stands populated and checkable by the installer. Our own record: the house native shim for Claude Code is proven in place (full-spectrum sweep row 2).

Off switch: GREEN. Anthropic permissions documentation: naming a tool in disallowed_tools removes its definition from the request entirely (the model does not see it and cannot attempt it); deny rules apply in every permission mode including bypassPermissions; --tools limits the base tool set; '*' and 'mcp__*' globs deny every tool or every MCP tool.

PGR-03 OpenAI Codex, local CLI

Local CLI agent on the user's own machine, installer-configured Owner: OpenAI (platform); the installer (deployment) Arrival class a Overall PARTIAL

Pause point: GREEN. Codex documents hooks in hooks.json or [hooks] in config.toml; PreToolUse receives the pending call and can deny it (permissionDecision deny, or exit code 2). Caveat carried from the same documentation record: a hook that errors in other ways can let the call continue, so a guard must be written to exit 2 on its own errors; the pause point is demonstrable, its fail-closed discipline is the installer's.

True list: GREEN. Codex writes local session records of its runs and fires PostToolUse hooks after each call, so a complete per-act record stands populated on the machine and checkable by the installer. Our own record: the house native shim for the Codex host is proven in place (full-spectrum sweep row 2).

Off switch: PARTIAL. MCP servers and hosted features such as web search are configuration-controlled in config.toml and can be removed or disabled, but the core shell and file tools are governed through the sandbox and approval policy rather than removable by configuration; a binding-only end-state is reached by routing through hooks and approval policy, not by switching the native tools off. Missing affordance: off switch for the side doors, for the core native tools. Owner: OpenAI (platform); the installer (deployment).

PGR-04 Gemini CLI (Google), local CLI

Local CLI agent on the user's own machine, installer-configured Owner: Google (platform); the installer (deployment) Arrival class a Overall PARTIAL

Pause point: GREEN. Gemini CLI hooks reference: the BeforeTool hook fires before a tool is invoked, receives tool_name and tool_input, and blocks execution by returning decision deny (or block) with a reason, or by exit code 2; it can also rewrite the arguments before execution.

True list: GREEN. Hook inputs carry the session transcript path and AfterTool hooks fire after each execution, and the CLI maintains session transcripts on the local machine, so a complete per-act record stands populated and checkable by the installer.

Off switch: PARTIAL. A BeforeToolSelection hook can filter the tools offered to the model, and settings carry tool configuration, but this pass did not verify a documented configuration that removes the native tool surface entirely so only a minted binding remains; the filter is a hook the deployment writes, not a platform off switch. Missing affordance: off switch for the side doors, as a platform configuration. Owner: Google (platform); the installer (deployment).

PGR-05 Cursor (IDE agent)

Local IDE agent, installer-configured Owner: Cursor (platform); the installer (deployment) Arrival class a Overall PARTIAL

Pause point: GREEN. Cursor hooks documentation: preToolUse, beforeShellExecution, and beforeMCPExecution hooks run before the action and can deny it (permission deny in the hook's JSON output, exit code 2 blocks), and a hook can be marked failClosed so its own failure blocks rather than waves through.

True list: PARTIAL. afterShellExecution, afterMCPExecution, and afterFileEdit hooks fire after each act, so the deployment can write a complete per-act record from the platform's own hook surface; Cursor itself does not ship a complete native per-act export this pass could verify, so the record is constructible from the affordance rather than populated by the platform. Missing affordance: true list, as a platform-populated record. Owner: Cursor (platform); the installer (deployment).

Off switch: PARTIAL. Cursor's agent tooling is configurable (auto-run controls, allowlists, MCP servers by configuration), but this pass found no configuration that removes the native tool surface entirely so action flows only through a minted binding. Missing affordance: off switch for the side doors, as a complete configuration. Owner: Cursor (platform); the installer (deployment).

PGR-06 Visual Studio Code with GitHub Copilot agent mode (IDE agent)

Local IDE agent, user-configured Owner: Microsoft (platform); the installer (deployment) Arrival class a Overall PARTIAL

Pause point: PARTIAL. VS Code's own hooks documentation (Configure agent hooks in Visual Studio Code (Preview), page dated October 21, 2026) documents a preToolUse hook event whose stated purpose is to inspect or make a decision about a tool call: a hook returns a documented top-level decision, {"permissionDecision": "deny"}; {} returns no decision; and "ask" requires an interactive approval flow, so it does not pause an unattended session. A programmable pre-execution decision mechanism is therefore documented, in Preview; an earlier basis for this cell, that the pause is a human dialog and not programmable, is superseded by that documentation. The grade stands on the failure contract in GitHub's Copilot hooks reference: command preToolUse hooks are fail-closed on error (a crash or non-zero exit, including exit 2, denies the call even if the output says allow), but command hook timeouts are always fail-open, including for admin-deployed policy hooks, and HTTP preToolUse hooks are fail-open. Coverage of every tool path is not demonstrated by documentation, and VS Code itself cautions that hooks are not substitutes for enforced permissions, sandboxing, or enterprise controls.

True list: PARTIAL. Chat sessions and their tool activity are recorded in the workspace's session state, and postToolUse hooks receive the tool result, so a complete per-act record is constructible from the platform's own hook surface, the same constructible-not-populated basis as Cursor (PGR-05). This pass did not establish a complete, checkable per-act record populated by the platform for every tool call. Missing affordance: true list, as a complete checkable record. Owner: Microsoft (platform); the installer (deployment).

Off switch: PARTIAL. Individual tools can be deselected for a session in the tool picker and extensions can be managed, but there is no configuration that disables the native tool surface wholesale so only a minted binding remains. Missing affordance: off switch for the side doors, as a complete configuration. Owner: Microsoft (platform); the installer (deployment).

PGR-07 Windsurf (Devin Desktop), IDE agent

Local IDE agent, user-configured Owner: Windsurf (platform); the installer (deployment) Arrival class a Overall UNKNOWN

Pause point: GREEN. A documentation-derived comparison of vendor hook documentation (read October 3, 2026) records Windsurf hooks blocking a call via exit code 2.

True list: UNKNOWN. No evidence obtained in this pass on whether Windsurf populates a complete, checkable per-act record of tool calls, natively or through post-execution hooks.

Off switch: UNKNOWN. No evidence obtained in this pass on a configuration that disables Windsurf's native tools so action flows only through a binding.

PGR-08 MCP hosts, the protocol class (any host speaking the Model Context Protocol to an installer-controlled server)

Protocol route; execution happens in the MCP server, which the installer or the gate operates Owner: The MCP host (platform) for its native tools; the server operator (deployment) for MCP-routed calls Arrival class a Overall PARTIAL

Pause point: GREEN. MCP specification shape: the client sends tools/call and the server executes. Execution therefore happens on the server side of the boundary, where the operator can hold, refuse, or release each call before anything acts. This is the shape of our reference shim (WO-63 step 5); the per-host binding proof stands in WO-64 and is not claimed by this grade.

True list: GREEN. Every MCP-routed call passes through the server as an explicit request carrying the tool name and arguments, so the server's record of calls is complete for the routed surface by construction.

Off switch: PARTIAL. MCP governs only what is routed through it. A host's own native tools, outside MCP, are untouched by anything in the protocol and grade as the host grades (rows PGR-01 to PGR-07). Missing affordance: off switch for the side doors, for the host's non-MCP native tools. Owner: The MCP host (platform) for its native tools; the server operator (deployment) for MCP-routed calls.

PGR-09 OpenAI API, function calling (Responses and Chat Completions)

Hosted API; the model proposes function calls and the developer's application executes them Owner: OpenAI (platform); the developer (deployment) Arrival class b Overall GREEN

Pause point: GREEN. OpenAI tools documentation: with function calling, the model returns a call for custom code and the application executes it. Nothing executes on the platform side for a declared function, so every call is in the developer's hands before it acts; holding it for a gate is the developer's own code path.

True list: GREEN. Each function call is returned to the caller as a discrete call item with its arguments before execution, so the caller's record of proposed and executed calls is complete for the function surface by construction.

Off switch: GREEN. A function exists for the agent only if the developer declares it; undeclared tools do not exist, so the developer's declaration is the whole tool surface for this class.

PGR-09H OpenAI hosted tools (web search, file search, code interpreter, computer use, hosted shell, image generation, remote MCP loop)

Hosted API; declared hosted tools execute inside OpenAI's execution boundary within the API request Owner: OpenAI Arrival class b Overall PARTIAL

Pause point: MISSING. OpenAI's Responses documentation describes an agentic loop by default in which the model can call built-in tools within the span of one API request, executing inside OpenAI's boundary. No per-call hold is offered to the developer for a hosted tool call. Missing affordance: pause point, for hosted tool calls. Owner: OpenAI.

True list: PARTIAL. Hosted calls surface in the response as output items (web_search_call, code_interpreter_call, mcp_call and kin) with their actions, which is a per-act record of a kind; its completeness is whatever the platform chooses to return and cannot be independently checked against the acts themselves. Missing affordance: true list, as an independently checkable record. Owner: OpenAI.

Off switch: GREEN. Hosted tools act only when declared in the request; a developer who does not declare them has no hosted-tool surface. The off switch here is non-declaration, and it is complete.

PGR-10 Anthropic API, tool use (client tools)

Hosted API; the model emits tool_use blocks and the developer's application executes them Owner: Anthropic (platform); the developer (deployment) Arrival class b Overall GREEN

Pause point: GREEN. Anthropic's tool-use shape: the model returns tool_use blocks and the application runs the tool and returns a tool_result. Execution is the application's act, so every call can be held for a gate in the application's own loop before it acts.

True list: GREEN. Every proposed call reaches the application as a tool_use block with its full input before execution, so the application's record is complete for the client-tool surface by construction.

Off switch: GREEN. A client tool exists only if the developer defines it in the request; the developer's tool list is the whole surface for this class.

PGR-10H Anthropic server tools (web search, web fetch, code execution)

Hosted API; declared server tools execute on Anthropic's infrastructure during the request Owner: Anthropic Arrival class b Overall PARTIAL

Pause point: MISSING. Server tools run on Anthropic's side as part of the model request; the documentation offers the developer no per-call hold over a server tool's execution. Missing affordance: pause point, for server tool calls. Owner: Anthropic.

True list: PARTIAL. Server tool use is reported back in the response as server_tool_use blocks with their inputs, a per-act record of a kind; completeness cannot be independently checked against the acts themselves. Missing affordance: true list, as an independently checkable record. Owner: Anthropic.

Off switch: GREEN. Server tools act only when included in the request's tool list; non-declaration is a complete off switch.

PGR-11 Google Gemini API, function calling

Hosted API; the model returns function calls and the developer's application executes them Owner: Google (platform); the developer (deployment) Arrival class b Overall GREEN

Pause point: GREEN. Google's function-calling documentation, in its own words: the model doesn't execute the function itself; the developer extracts the name and args and executes in their application. Every call is therefore in the developer's hands before it acts.

True list: GREEN. Each call is returned as a functionCall part with its arguments before execution, so the developer's record is complete for the function surface by construction.

Off switch: GREEN. A function exists for the model only if declared; the declaration is the whole surface for this class.

PGR-11H Gemini built-in tools (Google Search grounding, code execution, URL context, computer use preview)

Hosted API; declared built-in tools run inside the model call on Google's side Owner: Google Arrival class b Overall PARTIAL

Pause point: MISSING. Built-in tools are passed in the request's tools array and run inside the generateContent call; no per-call hold is offered to the developer. Missing affordance: pause point, for built-in tool calls. Owner: Google.

True list: PARTIAL. Grounding metadata and code-execution parts are returned with the response, a partial per-act account; completeness cannot be independently checked against the acts themselves. Missing affordance: true list, as an independently checkable record. Owner: Google.

Off switch: GREEN. Built-in tools act only when included in the request; non-declaration is a complete off switch.

PGR-12 Amazon Bedrock Agents

Hosted orchestration; action groups execute in the customer's Lambda function or return control to the customer's application Owner: AWS (platform); the customer (deployment) Arrival class b Overall PARTIAL

Pause point: GREEN. AWS documentation: for each action group the developer chooses a Lambda function of their own as executor, or Return Control, under which the agent passes the predicted action and its parameters back to the application in the InvokeAgent response instead of executing anything. Execution never happens inside the orchestration boundary for action groups, so a gate can hold every call.

True list: PARTIAL. Bedrock offers invocation tracing and the customer's Lambda invocations are logged in the customer's own account, but the per-act record is assembled from opt-in tracing and executor logs rather than standing as one populated, checkable record by default. Missing affordance: true list, as a standing complete record. Owner: AWS (platform); the customer (deployment).

Off switch: PARTIAL. Action groups are declared per agent and can be individually enabled or disabled, which is a real configuration control; optional platform features outside action groups are governed feature by feature rather than by one off switch for the native surface. Missing affordance: off switch for the side doors, as one complete configuration. Owner: AWS (platform); the customer (deployment).

PGR-13 Open-source agent frameworks run in the developer's own process (LangGraph and LangChain shape; OpenAI Agents SDK, AutoGen, CrewAI class)

Self-hosted framework; the agent loop and tool execution are the developer's own code Owner: The developer (deployment); the framework projects (platform) Arrival class a Overall GREEN

Pause point: GREEN. LangChain documentation: LangGraph interrupts pause graph execution before a node and wait indefinitely for external input; HumanInTheLoopMiddleware interrupts on named tools with approve, edit, and reject decisions, and interrupt_before can pause before the tools node on every run. The Agents SDK likewise runs the loop in the developer's process with per-tool approval hooks (needsApproval) and tool guardrails. The pause point is a documented, demonstrable framework mechanism.

True list: GREEN. Execution state, checkpoints, and traces are the developer's own records in their own process and storage; the framework's checkpointed state shows what the agent saw and did at each step, and tracing is exportable to the developer's own stack.

Off switch: GREEN. No tool exists in a framework deployment unless the developer declares it; there is no platform-native tool surface running beside the declared set.

PGR-14 Self-hosted open weights under an installer-controlled harness (local inference, Ollama and vLLM shape, driven by the installer's own agent loop)

Self-hosted, entirely on the installer's machine and under the installer's harness Owner: The installer (deployment) Arrival class a Overall GREEN

Pause point: GREEN. The harness is the installer's own code or a hookable local harness (rows PGR-02 to PGR-04, PGR-13): every tool call the model proposes passes through it before anything executes, so the hold is supplied by the deployment and is demonstrable.

True list: GREEN. The harness sees every proposed and executed call and writes the record on the installer's own machine; completeness is checkable by the installer against the harness's own log.

Off switch: GREEN. No platform-native tool surface exists beside the harness; the only tools are the ones the harness declares, so there are no side doors to switch off.

PGR-15A Open weights behind a hosted inference API, function-call surface only (hosted model APIs that return calls and execute nothing)

Hosted API for inference; all tool execution happens in the caller's own harness Owner: The API host (platform); the caller (deployment) Arrival class b Overall GREEN

Pause point: GREEN. The platform returns proposals and executes no tools, so every call reaches the caller's harness before it acts; the pause point is the caller's, and it is real for every call this surface produces.

True list: GREEN. Every call this surface produces is returned to the caller as a discrete item before execution; the caller's record is complete for this surface by construction.

Off switch: GREEN. The platform operates no tool surface of its own on this class, so there are no platform side doors; the caller's declared tools are the whole surface.

PGR-15B The same open weights inside a hosted agent product that executes tools on the platform side, no hook surface offered

Hosted agent product; the platform runs the loop and executes tools inside its own boundary Owner: The hosting platform Arrival class b Overall MISSING

Pause point: MISSING. By the commission's rule, the same weights behind a hookless hosted API grade as that host grades: the host offers no pre-execution interception point to anyone, so no gate can hold its calls. Missing affordance: pause point. Owner: The hosting platform.

True list: MISSING. No complete, checkable per-act record of the tools its loop executes is exposed to the user or to any outside checker. Missing affordance: true list. Owner: The hosting platform.

Off switch: MISSING. The host's native tool surface cannot be disabled by configuration available to the user, so action cannot be forced through a minted binding. Missing affordance: off switch for the side doors. Owner: The hosting platform.

PGR-16 Hosted automation platforms (Zapier and Make shape)

Hosted; the platform's own triggers execute actions directly with the platform's stored credentials Owner: Zapier, Make (the platform operators) Arrival class none as an agent host; route class of sweep row 14 Overall PARTIAL

Pause point: MISSING. Zapier's own product shape: a Zap runs on its trigger or schedule and executes its action steps; the platform offers no step-level hold under which an external gate admits or refuses an action before it executes. Where a workflow can call an HTTP endpoint it can be re-pointed to propose to the gate (sweep row 14); the platform's direct execution path has no pause point. Missing affordance: pause point. Owner: Zapier, Make (the platform operators).

True list: PARTIAL. Zapier records every run in Zap History with per-step status and the data processed, which is a real per-act record; it is held by the platform, and retention runs to about 30 days on most paid plans, so the record is neither durable nor complete over time by the standard this register grades. Missing affordance: true list, as a durable complete record. Owner: Zapier, Make (the platform operators).

Off switch: MISSING. No configuration disables the platform's action apps as a class so execution can be forced through a binding; individual Zaps can be switched off, which is per-workflow, not a side-door switch. Missing affordance: off switch for the side doors. Owner: Zapier, Make (the platform operators).

PGR-17 n8n, self-hosted (open-source workflow automation)

Self-hosted on the installer's infrastructure; workflows execute nodes directly with stored credentials Owner: The installer (deployment); the n8n project (platform) Arrival class none as an agent host; route class of sweep row 14 Overall PARTIAL

Pause point: PARTIAL. n8n documents a per-tool human-review enforcement for AI Agent tools (HITL for Tool Calls): a review step is added between the AI Agent node and a tool; when the agent decides to call that tool, execution pauses; the reviewer sees the intended call and approves or declines, and only then does the tool execute or not. The bounds are that it is per-tool by construction (selected tools only), the decision is a human's through a messaging channel rather than an external gate's programmable decision, and node execution outside the agent-tool surface has no hold. An earlier wording of this cell, that a pause exists only where a workflow was built to contain one, under-credited the documented feature and is superseded. Missing affordance: pause point, as a platform-wide affordance. Owner: The installer (deployment); the n8n project (platform).

True list: PARTIAL. n8n saves execution records per execution, but completeness is a property of each deployment's configuration under two named configuration dependencies: saving (the EXECUTIONS_DATA_SAVE_ON_SUCCESS, EXECUTIONS_DATA_SAVE_ON_ERROR, and EXECUTIONS_DATA_SAVE_ON_PROGRESS family, with per-workflow save settings, including the node-level 'do not save execution data' setting) can be off per workflow, and retention is separately configurable pruning (EXECUTIONS_DATA_PRUNE with MAX_AGE and PRUNE_MAX_COUNT). Neither dependency is a standing platform guarantee. Missing affordance: true list, as a standing complete record. Owner: The installer (deployment); the n8n project (platform).

Off switch: GREEN. n8n documents NODES_INCLUDE and NODES_EXCLUDE environment configuration: excluded node types are not loaded at all and cannot be used in any workflow (the Execute Command and SSH nodes are the documentation's own examples), and NODES_INCLUDE whitelists only the listed types. That is a genuine configuration off switch for the native surface.

PGR-18 Microsoft Copilot Studio (enterprise agent builder)

Hosted enterprise platform; agents act through connectors and flows under tenant configuration Owner: Microsoft Arrival class b Overall PARTIAL

Pause point: PARTIAL. Approvals are composable inside flows and human-in-the-loop handling exists for exceptions in computer-use agents, but this pass found no general pre-execution interception point under which every agent action is held for an external gate's decision; approval exists where a maker built it into a flow. Missing affordance: pause point, as a platform-wide interception point. Owner: Microsoft.

True list: PARTIAL. Microsoft documentation: Copilot Studio activities are audited in Microsoft Purview, conversation transcripts are stored in Dataverse, and agent activity records show invocations and tool runs. Retention for transcripts defaults to 30 days (extendable), and this pass did not verify completeness of the per-act record across every action type. Missing affordance: true list, as a verified complete record. Owner: Microsoft.

Off switch: PARTIAL. Tenant controls are real (DLP policies can block connector classes, environments bound where agents run, agents can be unpublished), but there is no single configuration that disables the native action surface so action flows only through a minted binding. Missing affordance: off switch for the side doors, as one complete configuration. Owner: Microsoft.

PGR-19 Chat-only consumer platforms (ChatGPT chat, Claude.ai chat, Gemini app shape)

Hosted chat; no tool surface offered to an installer, internal tools are the platform's own Owner: The platform operators (OpenAI, Anthropic, Google) Arrival class c Overall MISSING

Pause point: MISSING. No hook, interception, or tool-call API is offered on the chat surface to anyone; there is nothing for a gate to hold. Our own record grades this class NO ROUTE as an execution surface (CL-090 coverage audit), and the answer is the proposal-intake shape: the platform thinks, the gated side alone acts. Missing affordance: pause point. Owner: The platform operators (OpenAI, Anthropic, Google).

True list: MISSING. The platform's internal acts (search, code execution, connectors inside the chat product) are shown in-session as activity, but no complete per-act record is exposed to the user or to any checker. Missing affordance: true list. Owner: The platform operators (OpenAI, Anthropic, Google).

Off switch: MISSING. The chat product's internal tools cannot be disabled by an installer's configuration; product settings toggles are the user's product preferences, not an install-grade off switch. Missing affordance: off switch for the side doors. Owner: The platform operators (OpenAI, Anthropic, Google).

PGR-20 Hosted browser and computer-use agents (ChatGPT Agent shape; hosted computer use)

Hosted; the agent browses and acts inside the vendor's environment with the user's delegated sessions Owner: The platform operators Arrival class c Overall PARTIAL

Pause point: MISSING. No programmatic hold is offered over the agent's page actions. A user can watch and take over, which is a human brake on a session in progress, not a pause point a gate can admit or refuse through. Missing affordance: pause point. Owner: The platform operators.

True list: PARTIAL. The products narrate activity and show screenshots of actions taken, an account of a kind; it is neither complete per act nor checkable against the acts themselves. Missing affordance: true list, as a complete checkable record. Owner: The platform operators.

Off switch: MISSING. The agent's browsing and action surface is the product itself and cannot be disabled by configuration so that action flows only through a binding. Missing affordance: off switch for the side doors. Owner: The platform operators.

PGR-21 Browser automation under an installer-owned driver (Playwright and Selenium shape, driven by the installer's own agent code)

Self-hosted; every page action passes through the installer's own driver code Owner: The installer (deployment) Arrival class a Overall GREEN

Pause point: GREEN. The driver is the installer's code: no navigation, click, or submission happens except as that code issues it, so every consequential act can be held for a gate in the driver's own loop before it is issued.

True list: GREEN. Every act is an explicit driver call in the installer's process, so the installer's record of issued actions is complete for this surface by construction.

Off switch: GREEN. There is no native agent tool surface beside the driver; the declared driver actions are the whole surface.

PGR-22 Phone-native agents (on-device assistants of the Siri and Gemini-on-phone shape)

Hosted on-device by the OS vendor; the assistant acts through the phone's apps and system surfaces Owner: The OS platform operators (Apple, Google) Arrival class c Overall MISSING

Pause point: MISSING. No interception or hook mechanism is offered in the platforms' developer surfaces for the assistant's own acts; our coverage record found the same absence (sweep row 16 grades the native route absent; our phone coverage is our own client on the phone, not the native agent). Missing affordance: pause point. Owner: The OS platform operators (Apple, Google).

True list: MISSING. No complete per-act record of the assistant's actions is exposed to the user or to a checker. Missing affordance: true list. Owner: The OS platform operators (Apple, Google).

Off switch: MISSING. OS permissions limit which data and apps the assistant can reach, which is an access control, not a configuration that disables the assistant's native acts so action flows only through a binding. Missing affordance: off switch for the side doors. Owner: The OS platform operators (Apple, Google).

What cannot be claimed, at full size

Platform-native built-in tools with no interception point

On any host whose built-in tools execute internally without ever presenting a call, and where host configuration cannot disable them, no gate can intercept, envelope, or hold the act. Those action classes sit outside the enforcement boundary. Coverage there means the native tools disabled by configuration with action only through a minted binding, or the classes printed here. Never smoothed into a governed claim. Owner: the host platform. Missing affordances: a pause point, a true list, and an off switch for the side doors. (Seat grid row 29; sweep row 17.)

This seat's raw harness tools

On the hosted Muse seat there is no pre-execution interception point. Gating here is prior KORE admission before every consequential act, plus the ungated-actions ledger as tripwire, verified by sampling the engine record against the ledger; it is discipline strength and prints as discipline strength. (Seat grid row 12.)

The subagent spawn act itself

No mechanical gate stands on the act of tasking a subagent on this seat. The child's consequential acts are gated in the child's own runs. The spawn act's own gate is a design question homed as WO-70 open load 2. (Seat grid row 11.)

The laptop code path, while its worker is offline

The gate holds and queued work does not execute; that is the gate working with the executor absent, and it also means code-path work on the Windows laptop does not run until the worker starts. (Seat grid row 21.)

The proton send, until its credential stands

The gate and adapter stand proven at refusal strength, and the adapter refuses by name while no Bridge credential stands in the record the grid read. The send does not run until the credential provisioning completes. (Seat grid row 14.)

The tripwire

The tripwire is the ungated-actions ledger standing behind every lane on the institution seat, and its census is WO-76 (Tripwire at 100 Percent), parked at this read. The first graded census stands in the record, window 2026-10-21T15:05:49.000Z to 2026-10-22T15:05:49.000Z: 4961 acts observed, 4943 of them admitted before execution, 18 standing in the ledger, and 0 exposures without an admission decision; both planted seeds were caught, one in each bucket. The window does not close at 100 percent, and this map prints why at full size: the census residue stands named, not empty. 244 subagent spawns in the window carried no admission, because no admission mechanism exists for the spawn act (its gate is a founder-level design question, homed in WO-70 load 2). Direct harness acts on this seat are unobservable in either direction, because the runtime's per-act record stands empty; the closing build is a runtime-side per-act record, outside this seat's gift. Acts on the other seats and acts behind the wrapper's degraded code route stand named in the census as further residue classes. Zero observed acts stand unaccounted where the record can see.

The standard, and the invitation. ARC Open Governance holds this standard in the open. A platform conforms when it provides the three affordances: a pause point, a true list, and an off switch for the side doors. Together they are complete mediation of consequential action. Without them, nobody can guarantee consequence control on that platform: not us, not the platform, not anyone. This map says so in public, with the receipts. Platforms are invited to open to the standard. The community is handed this map as the instrument to ask with: find your platform in the register, see what it provides and what it lacks, and ask for the missing affordance by name.

Counts

Seat grid, 29 rows: discipline 13, ceiling 2, proven 6, gap 6, in build 2. Route sweep, 17 rows: proven 3, in build 7, gap 6, ceiling 1. Per-install reads across all rows of this map: disclosed outside 16, guaranteed 11, not installed 28. Platform register counts: cells 78, green 37, partial 20, missing 19, unknown 2, graded lines 26, platform rows 23, hosted tool sub-rows 3, full-green lines PGR-02, PGR-09, PGR-10, PGR-11, PGR-13, PGR-14, PGR-15A, PGR-21, unknown cells: PGR-07 true list (Windsurf's record-keeping surface was not examined in this pass.); PGR-07 off switch (Windsurf's configuration surface for disabling native tools was not examined in this pass.). Counts are computed by the generator from the parsed grades of the two records, under the map's normalization (the grid's GATED grades read as discipline strength, as the grid itself defines them, and rows the grid grades in part are counted at their headline grade; the grid's own counts prose stands in the source record).