ARC Open Governance. Case study. WO-116
The Ten That Never Existed
On October 23, 2026, two agent surfaces sharing one work queue disagreed with their own record, and the disagreement was resolved by evidence rather than by assertion. The canonical registry carried a gauge stating that ten closures recorded through a lightweight reporting path stood blocked awaiting identification. The registry owner asked the second surface to name the ten. The second surface audited its own record and reported that the ten closures did not exist. Its record held six completed support runs carrying eight named support packets, and not one of those runs asserted a canonical closure. The gauge was corrected from ten to zero in both records, with the original count, its source, and its replacement preserved, and the work object closed on its full scope.
What happened, in plain language
The program runs one queue of governed work objects across two surfaces. One surface holds the canonical registry, which is the record of what stands open and what stands closed. The other surface works from a repository record and runs an hourly workflow. That workflow could report finished work in prose, and a closure asserted in prose carries none of the fields a second surface needs in order to check it. A count of ten such closures entered the shared record from a relayed report. It had a source and no identifiers behind it. When the owner asked for the identifiers, the audit found six support runs and eight packets, each run record asserting that it claimed no canonical closure. The surface reported the finding rather than inventing a reconstruction, and the owner verified the audit, spot-recomputed one evidence binding exactly, and corrected the gauge in both records as a recorded correction.
The mechanism
A canonical record with a single owner, so closure is one party's act and no worker surface can assert it. A schema-constrained reporting validator, merged under human authorization, which refuses any closure report missing the fields reconciliation reads and refuses the closed outcome outright. Independent verification by recomputation from primary bytes rather than agreement between summaries. Human authorization at the consequential gate, where the fix merged only on the founder's word. And correction as record, where the original count and its source stand beside the replacement value, so a later reader can reconstruct the whole path.
Graded claims
| Claim | Grade |
|---|---|
| The work object stands closed and the registry count is 45 of 123 | Observed |
| The validator merged to main and refuses the closed outcome in code | Observed |
| The test suites total 40 on the owner side and reconcile with 46 on the Codex side as the same 40 plus 6 | Observed |
| The historical ten closures never existed as canonical closures in the reviewed record | Observed |
| The gauge stands corrected from ten to zero in both records | Observed |
| The hourly automation adopted the validated shape, with its saved instruction read back | Attested |
| A first post-adoption run passed the validator before finish | Observed |
| That run was an invocation of the unattended hourly automation | Unverified |
Limitations, at the same strength as the canonical document
This is one episode. It was not a controlled probe with repetitions, and it supports no rate. Both surfaces are internal to one program with one founder and one governance culture. The adoption is a prompt rule rather than a non-bypassable production gate, so the mechanism detects confabulated closures at reconciliation rather than preventing a noncompliant report from being written. Operating effectiveness rests on one post-adoption run, and whether that run was the unattended hourly automation is not established. A repeatability test under benchmark conditions, WO-66 Family 7, has since been run: five tasks, eight instances, single-surface, with a fabrication rate of 0 over 44 enumerated opportunities and all eight instances passing under non-submitter grading, graded PARTIAL at two-surface strength because the Codex administration was prepared, not exercised. No outside party has yet reproduced the audit from the published bytes alone, and every grade on this page is a first-party grade.
Why it matters beyond this program
Status reporting between agents needs a grammar with a refusal in it. Reports that claim completion should carry the fields reconciliation will later read, a validator should refuse reports that omit them before publication, and outcomes that change canonical state should sit outside the reporting agent's vocabulary entirely. Corrections should preserve the original claim and its source, because a record that quietly improves itself destroys the evidence that its controls work.
The other half of the pair
This case study is one half of a pair. Its companion is a convergence note on PHP2Shell, the pair of PHP engine flaws disclosed on October 21, 2026, which let unauthenticated code execute inside the runtime behind most of the web. In that incident the safe answers on offer were to patch at once or to take the system offline, and the note grades the event and the response from their sources. It also states its limit on its face: the incident validates the problem, not our solution. Read together, the note is the industry problem at global scale and this study is the discipline demonstrated at home, in one program, against its own record.