Status: provider-neutral execution contract. This file grants no authority by itself.

Any real agent substrate may contribute cognition to Project Brain without the Brain depending on that provider's UI, session model, or product-specific identity.

A substrate counts as capacity only after a real run succeeds.

• PROVEN_EXECUTABLE
• CANDIDATE_REAL_RUN_REQUIRED
• FAILED_RUNTIME_REPRODUCED
• ECONOMICALLY_DISALLOWED
• PROVEN_EPHEMERAL_FALLBACK

Configured agents, saved prompts, schedules, or provider objects are not capacity by themselves.

Every execution incarnation carries:

• provider_id
• worker_id
• unique instance_id
• brain_agent_id
• declared capabilities
• workstream
• started_at
• economic_mode
• provider attestation/evidence reference

Never reuse instance_id after restart.

A worker identity is not proof that an execution is still alive.

Each real execution incarnation SHOULD publish a nonauthority fabric heartbeat:

• unique instance_id;
• provider_id;
• brain_agent_id after registration;
• workstream;
• truthful capabilities;
• state=RUNNING;
• started_at;
• heartbeat_at;
• short expires_at (current rollout target: about 5 minutes).

Refresh after consequential Brain/progress activity and before long operations when practical. On graceful end, mark the incarnation ENDED. If it disappears, expiry removes it from live capacity automatically.

Heartbeat does NOT grant Brain authority, extend a canonical task lease, authorize recovery, or permit commit. Canonical Brain lease_generation remains the write fence.

During rollout the controller reports both recent Brain identities and attested execution incarnations. It must not switch to heartbeat-only supply until adoption is high enough to avoid false undercounting.

A provider adapter must prove:

1. a real independent execution happened;
2. zero additional spend under current project constraint;
3. it can receive a bounded Brain bootstrap/task instruction;
4. it can return durable evidence;
5. it does not require user task reconstruction for every run;
6. it can be stopped/demoted when limits or failures occur.

Only then may it become PROVEN_EXECUTABLE.

Workers never mutate canonical state directly.

Normal sequence:

1. read fabric capacity ticket / bootstrap;
2. register truthful Brain agent identity;
3. reconcile current generation;
4. claim only causally ready work matching actual capabilities;
5. receive exact canonical lease_generation;
6. execute;
7. write immutable task-progress receipts after consequential progress;
8. renew only with exact expected lease_generation once fencing exists;
9. preserve evidence + hashes;
10. reconcile and commit through Brain CAS;
11. acquire next task or yield.

Never claim human_authority_approval.

Agent identity is disposable.

Progress receipt key: evidence/task_progress/<task_id>/lease_<lease_generation>/seq__.json

Receipts are append-only and include task/lease/worker identity, completed substeps, evidence URIs + hashes, falsifications, remaining unknowns, exact next action, and predecessor receipt hash.

A successor validates canonical lease history and the receipt hash chain, then resumes from the highest valid predecessor receipt.

Worker death is a scheduling event, not a project failure.

• expired work is recovered through the verified recovery path;
• successor gets a new lease_generation;
• old incarnation renewal/commit/result must fail closed;
• repeated death/recovery must be idempotent.

The fabric may emit:

• SPAWN_COMPATIBLE
• MIGRATE_OR_REBIND_CAPABILITY
• CREATE_INDEPENDENT_USEFUL_WORK
• PROVISION_MORE
• PROVIDER_PROBE

Capacity tickets are nonauthority scheduling evidence. Canonical Brain remains authoritative for tasks and leases.

More available agents are desirable. Direct task width is not a cap on total population.

Surplus capacity should move to independent falsification, clean-sheet alternatives, limiting-factor discovery, evidence acquisition, architecture/mechanism search, chaos/regression/recovery tests, contradiction search, and verifier replication.

Avoid duplication by diversifying decision nodes and information channels, not by shrinking the pool by default.

Current project rule: $0 additional out-of-pocket.

Included ChatGPT/Codex allowance may be used. Optional credits, auto-top-up, paid API keys, paid managed-agent runs, and provider upgrades are forbidden unless the user changes this rule.

When included allowance is exhausted, that substrate becomes temporarily unavailable.

Immediately demote a substrate if:

• real runs repeatedly fail;
• billing boundary becomes ambiguous;
• durable results cannot be returned;
• identity/lease fencing cannot be preserved;
• recurrent manual task reconstruction remains necessary;
• advertised capacity cannot be reproduced.

A new substrate counts as production capacity only after:

1. two independent real runs execute distinct Brain-compatible tasks;
2. both return durable evidence;
3. at least one worker is killed/stopped or fails;
4. replacement execution resumes correctly;
5. no duplicate canonical commit occurs;
6. chain and claim graph still verify;
7. no additional spend occurs;
8. an independent reviewer reproduces the result.

Brain publishes demand. Providers compete to supply real workers. Workers are disposable. State is durable. Manual chat opening is fallback only. Provider failure changes capacity, not project truth.