docs(intelligence): bind merged-source convergence - #95

Problem and scope

Advances #38 with the bounded post-merge convergence receipt. This documentation-only packet binds exact Core main commit 7013de62ae7320c51c3de9e9a03b049e768e4d84, World PR #17, and the independent Market production-store reproduction.

Owned files are one work packet, one immutable candidate evidence record, the evidence index, and restrained current-state roadmap/maturity reconciliation. Runtime code, schemas, package versions, workflows, tags, releases, proposal application, and issue checklists are excluded.

Product boundary and compatibility

Core continues to own durable state, identity, provenance, authority, Decision, Action, Outcome, append-only replay, and proposal coordinates. Intelligence owns only the neutral matched evaluator. World and Market retain their own nouns, sources, criteria, controls, and outcome meaning.

The World result remains bounded useful with a non-effective promote proposal. The materially different Market result remains unproven with a non-effective reject proposal. Neither proposal is selectable or applied.

This remains an experimental 0.6 candidate. It does not pass SI4, establish causality or general benefit, change the eleven-tool MCP surface, close #38, or claim ACE 0.6.0 complete.

Evidence

• Core, reference Action adapter, World source adapter, and World wheels each built twice with byte-identical pairs.
• Exact Core wheel: sha256:662c4197f3ff0cf7dc1e64b0f8bc6bc705c8a1d6373a8468d9cb1d2df3d8c214.
• Fresh installed-artifact World runs: canonical sha256:c62a7db77b66a15f2930c850bdb8bbc44b542f928c2e0b146b5bf3dde08f30df twice.
• World: 123 complete-suite tests, 80 connector tests, 7 release-contract tests, 10 updated convergence controls; PR CI run 31522715774 passed.
• Market: 379 passed, 8 skipped, 4 deselected; focused production-store authority/atomicity/replay 5 passed; fresh-process reopen survived a real SurrealDB restart.
• Core merged measured-impact/F1/F5 focus: 82 passed; main CI run 31520372788 passed all six gates.
• Evidence-index and kernel boundary: 9 passed.
• Clean installed-environment vulnerability audit: no known vulnerabilities; the two separately built unpublished adapters were explicitly skipped as unavailable on PyPI.
• git diff --check: passed.

No credential, private fixture, private source, customer material, or private extension code is included.

Risk and rollback

The main risk is mistaking candidate artifact convergence for release or benefit evidence. The packet keeps release state at Next, records public-index-only installation as impossible before publication, and preserves all causal, population, live-freshness, SI4, and human-benefit non-claims.

Rollback removes only the additive packet/evidence and their current-state references. No runtime or durable history changes.

Issue #49 remains open. On 2026-08-11, the authenticated release owner marked F1/F5 complete against merged Core and re-dated unresolved, unwaived F3 to 2026-11-05 under the containment recorded on the issue.

Checklist

• I used no private data, credentials, proprietary fixtures, or private-extension code.
• I updated documentation for actual demonstrated state and did not overstate maturity.
• I ran focused checks, relevant conformance checks, artifact/security verification, and git diff --check.
• I linked the public milestone and recorded the explicit issue Track accepted E1 post-release security hardening (F1–F7) #49 disposition without treating F3 as resolved.
• No security-sensitive detail beyond the existing public issue wording is disclosed.