Architecture at the boundaries

your material ──► extract + screen ──► (optional) AI draft ──► confirmed IntakeSpec
                                                                       │
                                                               rule-based planner
                                                                       │
                      ┌──────────────────────────────┬─────────────────┴───────────────┐
             concept review (no world)        synthetic world (WorldSpec)        later: connected tests
                      │                              │
       registry search → integrity checks     compiler → deterministic kernel
       → closed-world draft → verification    → paired replications → ZIP export

Trust boundaries:

• AI output is never trusted directly. Drafts are validated against schemas, citations must point to records Alive retrieved, and quotes must appear verbatim in licensed text.
• Documents are data. Prompt instructions mark uploaded text as untrusted data. Schema and semantic checks remain authoritative; prompt wording alone does not establish resistance to prompt injection.
• WorldSpecs cannot carry code or URLs. Metrics and models are referenced from registries; connections are named, never raw addresses.
• Plans are server-computed. You approve them; you cannot write them.
• Completed deterministic trials replay. Keep the world, model lock and runtime fixed. Wall-clock timeouts can stop at different points; a truncated run is not a full-replay guarantee.