Files
Bundle OKF 0.2 · 7 conceitos · acg-box/aiq
Open source Repository Open in the app JSON README (API)
About
# Files
- [Architecture and Runtime](architecture-and-runtime.md) - AIQ components, trust boundaries, data flow, and runtime contracts.
- [Benchmark Method](benchmark-method.md) - AIQ Core fixture, scoring, execution, and verification method.
- [Deployment Handoff](deployment-handoff.md) - Personal Supabase, Vercel, and Cloudflare handoff, native publication topology, and pending release work.
- [Knowledge Maintenance](knowledge-maintenance.md) - Authority and update rules for AIQ repository knowledge.
- [Operations and Validation](operations.md) - Local validation, runner, verifier, database, Web, and Storage procedures.
- [AIQ Quickstart](quickstart.md) - Product scope, local demonstration, validation, and deployment status.
- [Template Adoption](template-adoption.md) - Repository-specific ownership after template adoption.
Details
- Kind
- OKF bundles
- Topic
- Cloud & DevOps
- Publisher
- acg-box
- Origin
- okf_github
- Category
- dados
- Version
- 0.2
- Open pull requests
- 4
- Last push
- 2026-09-08T00:06:26Z
- Repository state
- ativo
- Language
- Rust
- License
- GPL-3.0
- Added
- 2026-09-08 16:05:40
- Updated
- 2026-09-08 16:05:40
- Origin id
acg-box/aiq:openwiki/index.md
README
# AIQ AIQ records fixed-fixture AI and agent benchmark results. The repository contains a Rust runner, a Rust verifier, a Next.js application, the public AIQ Core catalog, and one declarative PostgreSQL schema. AIQ production is live at [aiq.wiki](https://aiq.wiki). The personal Vercel scope `acgbox` hosts project `aiq`. The personal Supabase organization `ACG Box` hosts project `aiq` on PostgreSQL 17.6 with reference `xxnszykaeapolqdnhalx`. The personal Cloudflare account that owns the `aiq.wiki` zone owns DNS handoff. Production uses the private Storage buckets `aiq-submission-packages` and `aiq-runner-artifacts`. The only supported production tuple is AIQ Core `1.1.0`, task scorer `1.0.6`, aggregate scoring `1.0.8`, and measurement `2.0.0`. Do not publish, preserve online, migrate, or display a legacy tuple as production evidence. Production must remain without an Official AIQ 2.0 publication until a fresh complete, non-synthetic, signed 17-by-72 calibration is replayed under policy v2 to establish the fixed item bank and admission v3, and a separate fresh 17-by-72 Official package passes native verifier replay and all release gates. Formal calibration and Official model and evaluator work has no benchmark-enforced wall-time, step, tool-call, aggregate-evaluator, or per-check deadline. The runner separately measures model and evaluator elapsed time, agent steps, tool calls by type, tokens, and estimated cost. These values are auxiliary evidence only and cannot change task score, AIQ, quality, strict pass, interval, eligibility, or ranking. Functional preflight and hard safety boundaries remain separate. A safety, runtime, provider, or infrastructure termination produces a null semantic score, never a semantic zero. All earlier bounded or deadline-bearing runs remain immutable failed release evidence. They cannot be relabeled, composed with selected reruns, or published under the active tuple. ## Product contract - Repository source targets AIQ Core `1.1.0`, with 72 private controlled tasks in ten domains. Task evaluation stays at `1.0.6`; aggregate scoring is `1.0.8`. - Every formal task encodes `wall_seconds: null`, `max_steps: null`, and `max_tool_calls: null`. Controlled evaluator configuration uses `aiq.evaluator-config.v2` with `completion_policy: natural_completion` and no aggregate or per-check deadline. - The candidate.20 catalog is the deterministic source candidate for the `1.1.0` task set. A fresh independent review and seal, complete 17-by-72 calibration, policy-v2 fixed-bank admission, separate complete Official run, publication, and deployment are required. No earlier publication is a fallback. - The public catalog contains metadata and commitments, not private task content. - Task scores use committed weighted binary checks. A failed hard gate or structural check sets the score to zero; otherwise the evaluator divides passed positive weight by total positive weight. The runner commits only one semantic evaluator result for each sealed response and workspace. A retryable evaluator process failure keeps that evidence pending and reruns only the evaluator on resume. The independent verifier executes the evaluator once and compares the parsed result and exact raw output digest. A failed verifier invocation releases the claim for a later model-free replay. A first successful replay with different output also requires a later confirmation attempt. Publication remains blocked until one exact replay matches. - The source-head AIQ measurement contract is `2.0.0`: the Official ranking score is `100 × logistic(theta)` from the admitted fixed Rasch item bank; theta and its conditional Wald interval are reported separately from the raw equal-domain `qualityScore` diagnostic. This contract is not an IQ norm or a 150-point scale. - Calibration policy `aiq.official-calibration-policy.v2` reports the binary informative-task rate and its 0.50 descriptive target, but does not use that count as a release cliff. Complete semantic coverage, non-uniformity, universal floor and ceiling limits, domain checks, and model and latent spread remain hard gates. - Strict pass is strict successes divided by all attributable tasks with a valid semantic task score. Partial scores remain in that denominator; only missing, infrastructure-invalid, runtime-failed, and unscored tasks are excluded. `invalid_tasks` records observed runtime or infrastructure failures, while `missing_tasks` is reserved for an expected cell with no result record. Runtime failures are not semantic zeros. The Wilson interval uses the same sample. - The model matrix contains 17 configurations: six Sol, six Terra, and five Luna. - The runner performs capability preflight, executes tasks, scores results, and creates signed `aiq.result-package.v4` envelopes. - Every result keeps separate runner-observed model and evaluator elapsed time as `latency.wall_ms` and `latency.evaluator_ms` and, when Codex reports it, token usage and a versioned Standard API-equivalent cost estimate. - AIQ, Rasch ability, quality, strict pass, ranking, and intervals use only evaluator-backed semantic task scores. Elapsed time, tokens, tool use, and estimated cost are independent efficiency evidence and never change a score. - Public evidence labels time as `runner_observed`, provider token source as `provider_reported`, and verifier-checked token and cost evidence as `verifier_recomputed`. Unavailable evidence remains null, not zero. - The verifier reconstructs submitted workspaces and replays deterministic evaluators before it signs `aiq.verifier-attestation.v4` evidence. - The verifier also provides an offline `diagnose-rescore` audit. It first verifies and replays one source package, then scores the preserved cells with a candidate source, task, evaluator, runtime, and toolchain set. Its create-new report is permanently non-Official and non-ranking. It cannot publish or create an attestation. - Production uses three distinct identities: runner, verifier, and publisher. - The Web application reads public database views and sends controlled writes through server routes. The source-head ordered task-metadata catalog digest is: ```text sha256:3580555315d49a62b28b6947491819276dca5b261ade802f10b33808569d1708 ``` Its public source-release digest is `sha256:5b651845280ea0b27a8cfc2aec4efe4c149bbbfdeeb0e5a9c883174938b58d69`. The production task-set identity is `aiq-core/1.1.0`; the retained catalog source identity is `aiq-core/1.1.0-candidate.20`. Do not infer any controlled identity from these public digests. The reviewed evaluator identity is `sha256:748e0a6c07eb7e3407cc22d50b65eb6d055305cb6e1d719ca3cfd3a109bec809`. The current no-deadline public-safe database task-set identity is `sha256:c7481e46c64dbf5ff9f50a85c83608d48390a03cbf9e94a1d89ab36aeb6df89a`, and its task-commitment manifest identity is `sha256:d8dddd1bc496a1609c3268068fdfdfa4562c589ddfdfec365a6a49caadefe96b`. These are checked-in bindings derived from the reviewed candidate.15 seal. Production activation still requires the exact private corpus, calibration, admission, Official package, and verifier evidence. The checked Core schema requires `runner.identity_kind` to remain `source_only` and `runner.built_binary_sha256` to remain null. The shared Rust validator now fails closed on this runner subtree for both Core and Contrast. Contrast does not have a separate checked-in JSON schema. Each corpus also binds the Node.js and ripgrep identities. The source-only corpus rule and signed per-run runner and complete Codex runtime provenance are the executable product contracts. The Codex runtime is one private directory that contains exactly the `codex` executable and its `codex-code-mode-host` sibling. After the final clean build, the operator retains a private, unsigned audit receipt with the exact source commit and tree identity and SHA-256 values for the native runner, verifier, Codex executable, and Codex code-mode host. The offline native verifier validates this receipt against an independently supplied receipt digest. It is not a database input or published artifact. Node.js and ripgrep remain bound by the corpus commitment. Do not infer a runtime hash from a generated-task tree digest. The accepted AIQ 2.0 publication will be one batch of 17 configuration runs and 1,224 task-level executions. Elapsed time, provider-token usage, and Standard API-equivalent cost are reported separately from AIQ. The Web application is a professional analysis workbench. Official evidence presents calibrated ability with its conditional 95% interval. Synthetic fixtures present descriptive quality with task-mix sensitivity and never appear as Official. Scientific context also reports strict pass with a Wilson interval, sample count, coverage, missing cells, runtime state, scoring method, and provenance. It keeps semantic task outcomes separate from runtime, invalid, and missing cells. Cost remains an estimated Standard API-equivalent comparison, not an actual ChatGPT or Codex subscription bill. Charts use ECharts with SVG rendering and ARIA descriptions. Users can select system, light, or dark color themes. Production views must use only real evidence for the sole production tuple, not synthetic or legacy data. ## AIQ Core 1.1.0 source authority The `1.1.0` source candidate is candidate.20 at `benchmarks/candidates/aiq-core-1.1.0/`. It preserves candidate.19 except for one scored, digest-bound final-response reconciliation decision in `tool-use-02`. Candidate.19 completed all 1,224 calibration cells but failed policy v2 because the Tool Use domain mean facility was `0.949580`, above the `0.90` ceiling. Candidate.20 keeps the policy, 72 tasks, 17-model matrix, supplied tool, and workspace receipt semantics unchanged. It still requires fresh independent review, sealing, calibration, admission, and Official evidence. `benchmarks/candidates/aiq-core-1.1.0/catalog.json` uses `aiq.catalog.v2`. Candidate.20 keeps 71 response contracts and advances only `tool-use-02` from workspace-only scoring to a final-response reconciliation decision while retaining its workspace and receipt checks. It keeps the seven distinct tool-use constructs. It records 29 private tasks as retained and 43 as repaired after candidate.15 calibration. It has 72 distinct within-domain clusters. Every task requires `gold`, `alternate_correct`, `partial`, `adversarial_format`, and `empty`; `timeout` is `not_applicable` under natural completion. The catalog is the sole expected-class authority. Its canonical catalog digest is `sha256:00e555904daa023f0f7731a0e7e66e12d833641f62eb4aaa59447be6417807d7`. Its ordered task-metadata digest is `sha256:3580555315d49a62b28b6947491819276dca5b261ade802f10b33808569d1708`. Its public release digest is `sha256:5b651845280ea0b27a8cfc2aec4efe4c149bbbfdeeb0e5a9c883174938b58d69`. Candidates.1 through .18 are immutable predecessor evidence. Candidate.5 remains the durable source for the seven distinct disclosed scenario, operation, result, evaluator, metamorphic, and cross-task substitution contracts. Its source integration was rejected because its catalog task-metadata identity was `sha256:cfac96630c9efe3153d80ed43effd6e541bef751e1e7f766a52cfb2910fa3fc4`, while the Rust commitment consumer and public v3 schema still required `sha256:393cb2563b2161ccb42dd5a50ea63a7827f4d5c485ca0a98103e80eef3d0fbe6`. Candidate.6 removed that duplicate Rust identity authority. Candidate.7 kept the catalog-derived commitment authority and repaired the trusted execution and qualification-evidence bridge. Candidate.7 is rejected because its completed-run, recovery, and package paths returned to the active 1.0.7 validator after candidate preparation. Candidate.8 carries one provenance-bound validation context through those paths, but its package command derived that context from the saved record and its private runtime used Node.js 24.19.0. Candidate.9 requires independent task, corpus, and source inputs for candidate packaging. It binds the complete validated context through signed-payload serialization and uses Node.js 24.18.0. The active 1.0.7, Contrast, historical, and Official validators remain unchanged. The commitment validator derives the expected candidate identity from the validated embedded catalog and rejects candidate.14 and older identities. Candidate.9 is rejected because `debugging-04` declared `src/task.mjs` while its prompt, workspace bindings, and weighted evaluator import `src/task.ts`, and `instruction-following-05` declared the non-schema field type `undefined` for `calculation_note`. Candidate.10 corrects those values to `src/task.ts` and `string`, but its location check is rejected because candidate.3's versioned response contract selected the source locations used to validate candidate.3 through candidate.5. Candidate.11 preserves the corrected leaves and all task, evaluator, fixture, and tool semantics. Its separately tracked `benchmarks/candidates/aiq-core-1.1.0/task-response-authority.json` file owns the public-safe response mode and locations for every task. The generator validates all versioned contracts against that unchanged projection. Candidate.11 is rejected because its tracked private validator treated protected `expected_file_sha256` inputs as response outputs and inferred final response from workspace-policy absence. Candidate.12 corrects that existing owner only. It requires one hard-gate `complete_workspace_policy`, detects `response_*` checks for final response, excludes protected inputs from the mutable allowlist, and derives workspace locations from progress files plus evaluator `path` targets, with evaluator-source fallback only when both are empty. The immutable tasks resolve to 71 workspace responses and one final response: progress is exact for 66 workspace tasks, empty for four, and a strict subset for one. Candidate.12 is rejected before model invocation because file loading used lexical task order while candidate validation required checked-catalog order. Candidate.13 uses the existing catalog-order owner during candidate-only preparation. It also selects the v3 commitment schema only on that same candidate preflight route; the active and standalone preflight routes continue to require v2. Candidate.13 is rejected operational evidence. Its isolated Jordan qualification completed all 17 preflight probes and started 88 task cells, but only 56 of 1,224 cells completed before the five-hour subscription quota reached 100%; seven-day usage was 17%. No package, verifier stage, attestation, or qualification artifact exists. Candidate.14 keeps every task-facing semantic unchanged and replaces only the quota-infeasible candidate release-qualification shape. Its one 216-cell run and package completed, but the real candidate verifier loaded ordinary filenames lexically and rejected the catalog-ordered evaluator identity before replay. No stage, attestation, or qualification artifact exists. Candidate.15 reuses the existing checked-catalog ordering owner in that candidate-only verifier load path. Its complete 1,224-cell calibration had no runtime failures, but policy v2 rejected 38 universal full-credit tasks, ten universal semantic-zero tasks, only 22 non-uniform tasks, and six degenerate domains. Candidate.16 keeps policy v2, repairs those task-bank failures, and normalizes only the exact Codex zsh transport before hashing the logical ToolUse command. Independent review rejects candidate.16 because all 43 revised tasks reject a publicly declared optional field; six Documentation tasks also score optional `next_steps` as required. Candidate.17 repairs that existing evaluator owner and the independently identified 1.1.0/v3/13-view runbook drift. Independent source review rejects candidate.17 because one Security model sentence still says 12 public views and the focused regression did not match that wording. Candidate.18 corrects that final documentation owner. Its isolated Morgan calibration reached 288 checkpoint results before Codex returned `Selected model is at capacity`; task output containing `authentication` caused the adapter to misclassify that temporary capacity event as terminal authentication. Candidate.19 routes the exact structured capacity event through existing resumable backpressure and limits provider-failure classification to stderr or structured `error` and `turn.failed` messages. Its complete calibration then failed only the Tool Use domain facility ceiling; candidate.20 adds the bounded `tool-use-02` response decision described above. The exact 42 task-issue closures remain unchanged. The catalog records the unauthenticated candidate execution and qualification-evidence bridge as one separate source-integrity closure. It records the candidate.7 end-to-end validation failure as a second source-only closure. Neither closure counts as a task issue. The package-input, Node.js runtime, public response-contract, and private response-source-owner repairs are four additional source-only closures. None counts as a task issue. For each tool-use task, the hard gate requires exactly one total tool call and one `command_execution` call. It also requires one completed command-line digest for `node bin/task-tool.mjs`: `sha256:6763cc80f8294b52c6494f1c9891e41a8e3cd1c466ca622377c59643a0466319`. The separate receipt `command_sha256` continues to identify the supplied tool file bytes. The runner retains digest counts only for task-declared required command identities; exact total and per-tool counts still expose undeclared or extra calls. One three-configuration qualification matrix can contain at most 21 declared digest entries. The runner removes command text from provider stdout and stderr evidence, but it extracts and preserves the exact semantic final response before that log redaction. Candidates.14 through .17 remain inactive and not production-publishable. Candidate.18 is the current source candidate; production cutover requires its fresh review, seal, complete calibration, admission, and Official evidence. AIQ Core 1.1.0 sealing also requires one independently supplied `aiq.leakage-review.v2` record for every task. Each record binds the reviewer, the reviewer task or thread, review time, source commit and tree, source manifest, task definition, catalog entry, verdict, method, scope, and notes. The sealer copies and hashes the supplied record. It rejects missing, extra, rejected, stale, or mismatched records. It never creates a completed review from task-authored notes. Recorded process separation is review evidence. It is not cryptographic proof that a human reviewer was independent. The v1 review contract remains isolated to frozen 1.0.7 compatibility. The shared `aiq-runner` library owns `aiq.benchmark-qualification-policy.v2`. Both existing executables use that same in-process implementation: ```sh cargo run -p aiq-runner -- qualify-candidate --help cargo run -p aiq-verifier -- verify-qualification --help ``` Qualification accepts exactly one predeclared, complete, non-synthetic 3-by-72 Calibration stage: Sol medium, Terra medium, and Luna medium in that order over all 72 catalog-ordered tasks. Its verifier-derived 216 cells must all be semantically complete, and its attestation must come from the predeclared verifier. The manifest fixes the candidate, corpus, source, model selection, run, and verifier identities before execution. The final artifact additionally binds the exact signed package, runner, stage, attestation, provenance, and matrix digests. This is an end-to-end execution and identity qualification only. It makes no prediction-interval, Spearman-correlation, run-variance, or precise-rank claim. Those stability-only fields are absent from the v3 manifest and artifact. The active/default production matrix remains all 17 configurations. Any task, evaluator, policy, or source-identity revision requires a new reviewed source identity and fresh release evidence. ## Repository map | Path | Purpose | | -------------------- | ------------------------------------------------------------------------- | | `apps/aiq/` | Scheduled observation orchestration, release validation, and cleanup | | `apps/aiq-runner/` | Capability checks, task execution, scoring, packaging, and submission | | `apps/aiq-verifier/` | Queue claims, artifact reconstruction, evaluator replay, and attestations | | `apps/web/` | Public Next.js site and controlled server gateways | | `benchmarks/` | Public catalog, schemas, and synthetic examples | | `databases/` | Desired database state, fresh initializer, and disposable SQL checks | | `openwiki/` | Architecture, method, operations, and deployment handoff | Private tasks, expected outputs, controlled evaluators, signing keys, Codex authentication, and production data must stay outside Git. ## Local synthetic demonstration Use Node.js `24.15.0` or newer, the npm `11.17.0` version pinned by `package.json`, the stable Rust toolchain selected by `rust-toolchain.toml`, and the locked dependencies. `cargo make fmt` also requires a separately managed nightly rustfmt toolchain. ```sh npm ci --ignore-scripts cargo run -p aiq-runner -- demo npm run dev ``` Open `http://localhost:3000`. When both public Supabase variables are absent in development, the site uses checked-in synthetic data. Production fails closed when its configuration is incomplete. Useful runner commands: ```sh cargo run -p aiq-runner -- matrix cargo run -p aiq-runner -- validate --public-tasks benchmarks/examples/tasks cargo run -p aiq-runner -- validate-core-corpus --help cargo run -p aiq-runner -- validate-contrast-corpus --help cargo run -p aiq-runner -- --help cargo run -p aiq-verifier -- --help cargo run -p aiq-verifier -- diagnose-rescore --help ``` ## Validation Install the Playwright browsers once on a fresh host, then run the complete local browser gate: ```sh npm exec --workspace @aiq/web -- \ playwright install --with-deps chromium firefox webkit cargo make check cargo make verify ``` `check` is the complete read-only source gate. It checks the database schema, TypeScript, Rust and TypeScript lint rules, vstyle, and all Rust and TypeScript tests. `verify` extends `check` with one Web build and every local browser acceptance suite. `fmt` is an independent mutating action; it is not a dependency of either gate. Native release builds, production browser checks, database runtime checks, deployment, and publication remain separate contracts. Do not run component tasks again in the same validation pass. Coverage instrumentation is opt in with `cargo make test-typescript-coverage`. The two subscription smokes are ignored and opt in. Each consumes one Codex subscription attempt. ```sh cargo make smoke-subscription cargo make smoke-controlled-subscription ``` The public-task smoke validates a fixed example. The controlled-task smoke needs operator-supplied private task, evaluator, corpus, runtime, workspace, and Codex inputs. Neither smoke creates a benchmark result. ## Database initialization `databases/schema.sql` is the sole desired database state. `databases/init.ts` is the only production initialization entry point. There is no migration chain. It opens one PostgreSQL connection and applies the schema plus public reference data in one transaction. It accepts the direct host or exact port-5432 session pooler identity for personal Supabase project `xxnszykaeapolqdnhalx`. An explicit test/development override accepts only a loopback target and cannot apply in production. It rejects a database that already contains the AIQ schema, gateway roles, or either exact AIQ Storage bucket identity. Apply this one greenfield desired state to the existing target project only after its AIQ namespace is empty. If AIQ residue exists, the operator must remove only `aiq_private`, the two AIQ gateway roles, and the exact AIQ-owned public views and RPC overloads. Preserve all Supabase-managed and non-AIQ objects. This cleanup is a deployment prerequisite, not a migration or compatibility path. The schema creates the `aiq-submission-packages` and `aiq-runner-artifacts` Storage buckets as private. The preflight rejects either existing bucket identity. Do not create the buckets in a separate operator step. The preflight enumerates the 13 canonical public view names and all public RPC names from the desired state. It rejects every overload of those exact RPC names without matching unrelated public objects. ```sh AIQ_DATABASE_URL='<direct-or-session-pooler-url>' \ AIQ_PRODUCTION_REFERENCE=/controlled/production-reference.json \ cargo make init-database ``` For an empty AIQ namespace, the production reference must contain the real controlled, non-synthetic AIQ Core `1.1.0` v3 corpus commitment, its real canonical `published_at` timestamp, and exactly three public identities: runner, verifier, and publisher. Prepare it only after the controlled corpus passes model-free validation, the operator verifies the final native build, and one real signed non-synthetic 17-by-72 package passes native verifier replay; the repository contains no substitute production reference. Retain the private final-build audit receipt separately. Database initialization does not accept or validate that receipt. A successful initialization receipt must report aggregate scoring `1.0.8`, both public catalog identities, 72 tasks, 17 model configurations, and three nodes. Use one initialized disposable database for production-shape smoke and calibration publication checks: ```sh cargo make smoke-database AIQ_DATABASE_URL='<direct-or-session-pooler-url>' cargo make smoke-calibration-database ``` Use a separate fresh PostgreSQL 17 database for the deterministic synthetic flow: ```sh psql "$AIQ_DATABASE_URL" -X --set ON_ERROR_STOP=1 \ --file databases/schema.sql psql "$AIQ_DATABASE_URL" -X --set ON_ERROR_STOP=1 \ --file databases/synthetic-demo.sql psql "$AIQ_DATABASE_URL" -X --set ON_ERROR_STOP=1 \ --file databases/integration.sql ``` Do not apply the synthetic flow to the initialized production-shape database or to production. ## Production data flow 1. The runner validates the controlled corpus, toolchain, and capability manifest. 2. It executes the selected tasks and runs each formal evaluator against the sealed model evidence. A retryable evaluator process failure keeps the model evidence pending for evaluator-only recovery. The runner writes content-addressed artifacts. 3. It scores the run, records efficiency evidence, and signs one v4 result package. 4. `POST /api/submissions` stores the exact package bytes and queues the package as unverified. 5. The verifier claims the package, reconstructs the workspaces, and executes each deterministic evaluator once for that claim attempt. An operational replay failure releases the claim for retry without changing the retained package or invoking a model. 6. `POST /api/verifications` stages the normalized batch and records the signed verifier attestation. 7. A distinct publisher identity completes publication through the gateway. 8. Public security-invoker views supply the Web application. Official means a complete, non-synthetic 17-by-72 run with valid task-set `1.1.0`, task-scorer `1.0.6`, aggregate-scorer `1.0.8`, and measurement `2.0.0` bindings that completed this flow and was published as `trusted_verified`. A complete synthetic fixture uses the `synthetic_complete` classification, has no Official AIQ value, and is never ranking eligible. There is one submission, native verification, and publication path. ## Official paid-work boundary The only Official execution and publication path runs `aiq-runner` and `aiq-verifier` natively on the controlled Apple Silicon macOS host with direct network access. Use the release binaries in this order: `admit-permissions`, `preflight`, `run`, `score`, `package`, `submit`, and then verifier replay. `admit-permissions` is model-free; `preflight` is the first paid step. Only its exact configuration probes and runnable task cells in `run` invoke models. Scoring, packaging, submission, verifier replay, and publication do not invoke models. The same private admission receipt binds preflight through package. Provide the runner signing key only to `package`, the submission token only to `submit`, and verifier credentials only to the verifier command. The source runner targets native macOS. Linux and Docker remain future deployment targets. A frozen `aiq` release built from this source starts the observation scheduler at `03:00` and `15:00` UTC. It selects one canonical 12-hour slot, holds a global nonblocking lock, and does not start a second scheduler. An installed frozen release keeps its existing behavior until an operator replaces it. A self-contained release stores the pinned runner and verifier binaries and an exact Git source bundle. `aiq` restores the clean detached source at a stable per-slot path below the private `state_root/scratch` directory. This path stays outside the macOS platform-minimal roots that model processes can read. The command does not use a repository worktree at run time. On a host fixed to the `America/New_York` time zone, the macOS `launchd` template wakes at 11:05, 11:35, 23:05, and 23:35 local time. The four wakes cover EST and EDT with one bounded retry for each UTC slot. Official task dispatch must begin during the first two hours of a slot, and the v2 configuration requires all 32 supported workers for the fixed 1,224-cell matrix. A late wake does not start a new matrix. Temporary selected-model capacity and subscription quota, usage, or rate limits are persisted as non-terminal backpressure: completed cells stay in the same checkpoint, rejected cells remain pending, and later scheduled wakes resume the oldest blocked slot before they can start newer paid work. The scheduler starts Official and Speed as sibling publication paths for the same slot. Official keeps its two-hour model-dispatch grace. Speed has an independent 12-hour slot window. After the scheduler grants dispatch, neither path waits for the other path. A slow or failed path cannot block the other path's dispatch or publication. Each path writes retained status below its own slot directory, and `aiq status` composes both outcomes. A completed run with a non-semantic infrastructure result is retained as unpublished evidence. It is not retried or presented as an AIQ score. Provider-capacity backpressure is not a completed result and is therefore the sole exception to that terminal rule. The subscription runner uses a protected copy of `~/.codex/auth.json` in an isolated per-release `CODEX_HOME`; it does not reuse the interactive Codex home as its writable runtime directory. It also uses a private two-file copy of the ChatGPT app's `codex` and `codex-code-mode-host` executables. Capability preflight succeeds only after Codex completes one command and writes the exact content-bound marker in a fresh disposable workspace. See [Operations and Validation](openwiki/operations.md) for the native command contract. Repository support does not prove that private inputs, credentials, or live model capabilities are configured. ## Continuous observations Normal/Fast transport measurements are auxiliary evidence. `observe-speed` reads the live Codex model catalog before any paid turn, records an exact available, unsupported, or unavailable state for each selected configuration, and runs paired Normal/Fast fixed-response trials only for advertised modes. It records completion, total elapsed time, aggregate output throughput, token usage, tool use, and estimated ChatGPT credits. It does not calculate or modify AIQ. The current Codex JSONL stream does not expose a trustworthy first-token timestamp, so TTFT and post-first-token throughput remain explicit unavailable values instead of estimates. ```sh cargo run -p aiq-runner -- observe-speed --help cargo run -p aiq-runner -- submit-speed --help cargo install --locked --path apps/aiq aiq status --config /absolute/private/path/to/continuous-observation.json aiq doctor --config /absolute/private/path/to/continuous-observation.json aiq run --config /absolute/private/path/to/continuous-observation.json aiq run --config /absolute/private/path/to/continuous-observation.json \ --slot 2026-08-12T03-00Z ``` Use `--slot` only for one known canonical UTC slot. Official task dispatch can start only during the first two hours of its current slot. The frozen runner can resume an unchanged checkpoint during the same slot only when it contains no indeterminate in-flight cell. A checkpoint with explicit subscription backpressure can also resume after the dispatch grace or 12-hour slot window; it reuses the exact admitted preflight and never replaces completed cells. Other checkpoints with sealed pending evaluator work can also resume that work after the window without another task-model invocation. This rule includes a retryable evaluator process failure. An indeterminate model cell still fails closed after all sealed pending evaluator work is recovered. Other late slots can continue only when the complete Official run output already exists and only scoring or publication remains. `aiq` recognizes that output only as an `aiq.run.v4` document with all 1,224 results; the runner's create-once reservation is not a completed run. Otherwise, `aiq` records a terminal missed or unpublished state without new model work. Speed model dispatch can start during its own 12-hour slot. An existing Speed batch can resume submission after that window without new model work. A terminal slot remains a no-op. If another observation owns the global lock, a scheduled `run` coalesces successfully without starting another model process; `doctor` reports the contention instead. Each runner, verifier, and evaluator step runs below an internal supervisor that owns a separate process session. Runner-created model and evaluator process groups remain in that session. A private pipe binds the supervisor to the user-facing `aiq` parent. If that parent exits or is killed, the pipe closes and the supervisor repeatedly sends `SIGTERM`, then `SIGKILL`, to every remaining session process before it exits. This no-orphan boundary does not depend on `launchd` process-group cleanup. Start from `config/continuous-observation.example.json` and `config/com.acgbox.aiq.continuous-observations.plist.example`. Keep the concrete configuration and `launchd` plist outside Git. Use `aiq install-release` once to copy the minimal frozen release, create its source bundle, and print the release manifest digest. Install the release in a versioned directory outside the repository. The private v2 configuration contains stable runtime paths, limits, the endpoint, the manifest digest, and optional non-secret unattended provider metadata. It does not contain a source worktree path, worker executable path, provider credential, or consumer secret. `cargo install` is sufficient for local operator use. An unattended service must pin `apps/aiq/package.nix` in the host configuration so an unrelated Cargo install cannot replace the scheduled executable. Set `official_jobs` to `32`; lower values are rejected before model work. The `aiq run` accepts either all four explicitly supplied consumer variables or no consumer variables. Partial ambient delivery fails closed. When all four are absent, `aiq` requires the complete `unattended_secrets` metadata, reads the exact Keychain bootstrap, performs one Universal Auth login, and retrieves only the four fixed `prod:/aiq` keys. It removes the provider session before it starts a downstream step. Provider credentials and tokens do not reach workers. The orchestrator gives the signing key only to `package`, the submission token only to submission steps, and verifier credentials only to the verifier. Each owner uses a fresh isolated `CODEX_HOME` directory for the slot. A retryable slot retains checkpoints and raw artifacts. Checkpoint v10 distinguishes indeterminate model work from sealed pending evaluator work. The latter resumes from the same model response and workspace without another model invocation. A retryable evaluator process failure stays in this pending state and cannot create a terminal run. Provider-declared temporary model capacity and subscription limits leave the affected cells pending under `aiq.subscription-backpressure.v1`; the runner also migrates v9 checkpoints to the v10 evaluator-resume shape and legacy v8 checkpoints that incorrectly committed those limits as terminal results. On resume, `aiq` revalidates the permission admission, complete Official run, submission receipts, and verifier receipt before it reuses them. It stores non-success verifier records in a private append-only attempt log. A create-once success receipt is valid only when its package SHA-256 and idempotency identity match the exact local package. Copied credentials are removed after each invocation. A terminal slot keeps both owner-status records, the compact batch, package, score, attestation, and receipts. It removes the detached source, raw local artifacts, replay scratch, checkpoints, and disposable workspaces. `launchd` invokes the pinned `aiq run --config ...` command directly. Use absolute AIQ and configuration paths, supply `HOME`, `USER`, `LOGNAME`, and the pinned execution `PATH`, and do not set a repository working directory. The provider identity must grant only the four fixed source keys. The runtime keeps the Keychain bootstrap and short-lived provider token inside AIQ. The already-provisioned provider target is external frozen state. Do not run setup to reconcile, rotate, or replace it. For a new exact target only, the hidden `aiq operator provision-unattended --config ...` command uses `config/unattended-provider-provision.example.json`. It refuses an existing Keychain account or provider identity, creates only the fixed identity, four-key privilege, Universal Auth method, and Keychain bootstrap, and rolls back only known intermediate writes. ## Security boundaries - Keep runner, verifier, and publisher credentials separate. - Keep privileged Supabase values in server-only environment variables. - Keep `aiq-submission-packages` and `aiq-runner-artifacts` private. - Use RLS and the narrow database RPCs; do not write private tables from the browser. - Put authentication, request limits, and a WAF in front of write routes. - Run the Storage reconciliation worker before the deletion worker. - Treat readiness responses as bounded dependency evidence, not deployment proof. See [OpenWiki quickstart](openwiki/quickstart.md), [operations](openwiki/operations.md), and [deployment handoff](openwiki/deployment-handoff.md) for the maintained details. `aiq.wiki` is canonical, and `www.aiq.wiki` returns a permanent `308` redirect that preserves the request path. Automatic Vercel project and branch aliases can be removed only transiently because a later deployment can recreate or reassign them. A deployment-specific URL is intrinsic to its retained deployment. The current generated Vercel surfaces emit `noindex`.