# Evidence package — Chassis lifecycle

**Claim supported:** The Chassis is a reusable, profile-driven execution engine that owns durable run
state, ordered stages, retry/budget, run claims + concurrency, crash/handoff recovery, registered
decision forks, deterministic resolution, fail-toward-asking elevation, append-only decision + dispatch
logs, run-path containment, legitimate terminal states, and a codification sink. A consumer declares a
**profile** (declarative data + seam wiring + procedure) and inherits all of it. The engine has exactly
**three** active consumers — Auto Plan, Cure v2, and Cure v3 fix-pass. Auto Plan is an eight-stage
profile. And in the Cure v2 operation, a reported finding with no persisted artifact **blocks
advancement** — the artifact outranks the summary. (Technical companion §6, §8.)

**Claim IDs:** E7-C001, E7-C002, E8-C001
**Evidence level:** exercised
**Access classification:** Sanitized public excerpt (much of this is also **publicly inspectable** —
see below)

## What this package proves, and what it does not

**Proves:** the engine owns twelve named capabilities behind a purity boundary, each cited to the
engine's own contract doc (`engine-capabilities.md`); a profile is a three-kind contract validated
fail-closed, and three real consumer profiles exist and import the engine (`consumer-profile-contract.md`);
Auto Plan's stage surface is an ordered eight-stage sequence (`auto-plan-8-stages.md`); and the Cure v2
§2.5 gate mechanically blocks advancement when an investigator's return summary claims findings its
persisted manifest does not carry (`artifact-outranks-summary.md`).

**Does not prove:** any performance or reliability figure. This package evidences *structure* — what
the engine owns, how a profile is validated, how many consumers exist, how the stages are ordered, and
what one gate enforces — all of which is checkable by reading the cited source. It makes no claim about
success rates, time-to-completion, or before/after measurement. The already-public reference package is
explicit that no such numbers are published, and neither are they here.

## Publicly inspectable companion

A public reference implementation of this exact architecture already ships at
`publications/chassis-reference/` (README.md, METRIC_PROVENANCE.md, `examples/`, `excerpts/`). It is a
runnable, dependency-free engine + one example operation, plus nine production modules copied
byte-for-byte under `excerpts/`. For the parts of this claim covered there, **access is "Publicly
inspectable."** Per `publications/chassis-reference/METRIC_PROVENANCE.md`, the **production** engine is
**25 source modules / 3,743 lines** (excluding `__tests__`) with **3 consumers** — a figure this
package independently re-derived from the live tree at the source commit (25 modules, 3,743 lines).

## Source

- **Source date:** 2026-08-02. Package built 2026-08-02.
- **Source commit:** `24ec65306` (FoundryOS monorepo).
- **Original internal locations:**
  - `system/core/lib/chassis-core/CHASSIS_CORE.md` — the engine's twelve capabilities + public API.
  - `system/core/lib/chassis-core/CONSUMER_PROFILE_CONTRACT.md` — the three-kind profile contract.
  - `system/converge/lib/chassis/auto-profile.mjs` — consumer #1 (Auto Plan).
  - `system/cure/lib/run-driver/cure-v2-profile.mjs` — consumer #2 (Cure v2).
  - `system/cure/lib/run-driver/cure-v3-fixpass-profile.mjs` — consumer #3 (Cure v3 fix-pass).
  - `system/converge/docs/CHASSIS_ORCHESTRATOR.md` (~L115) — the ordered eight-stage sequence.
  - `system/cure/lib/run-driver/gate-graph.json` (§2.5 node) + `system/cure/lib/investigator-output-referential-integrity-gate.mjs` — the artifact-outranks-summary gate.

## Redaction statement

No secrets, credentials, private URLs, or customer/tenant identifiers appear in these artifacts. The
sources are framework engine documentation, declarative profile data, gate topology, and gate logic.
The one incident-specific identifier retained — the Cure sandbox run-id
`atomic-crm-20260525T153327Z` — is an internal QA run against a sandbox target, not a customer tenant,
and is load-bearing: it establishes that Check 1.5 was written against a real observed silent-loss
event. See `manifest.json` → `redactions`.

## Reproduction

- **Engine size:** from a monorepo checkout, `find system/core/lib/chassis-core -name '*.mjs' -not -path
  '*__tests__*' | wc -l` → 25; the same with `-exec cat {} + | wc -l` → 3,743.
- **Three consumers:** confirm `system/converge/lib/chassis/auto-profile.mjs`,
  `system/cure/lib/run-driver/cure-v2-profile.mjs`, and `system/cure/lib/run-driver/cure-v3-fixpass-profile.mjs`
  each `import … from '…/core/lib/chassis-core/index.mjs'` and call `loadProfile`.
- **Eight stages:** read `system/converge/docs/CHASSIS_ORCHESTRATOR.md` ~L115 and
  `system/converge/lib/chassis/stages.mjs`.
- **§2.5 gate:** read the `§2.5` node in `system/cure/lib/run-driver/gate-graph.json` and Check 1.5 in
  `system/cure/lib/investigator-output-referential-integrity-gate.mjs`.
- **Public reference:** `publications/chassis-reference/` — `node --test`, `npm run demo`,
  `npm run generate:evidence`.