mary

SRS-MARY-001 — software requirements derived from MARY-CONOPS OS-01..OS-08

status ratified 2026-08-11 — derived 2026-08-10; DEC docs/decisions/2026-08-11-srs-mary-001-ratified.md

Derived, not invented. Every shall below traces to a success-criterion sentence in docs/MARY-CONOPS.md §3 (rank 0, ratified). Where a criterion is ambiguous the requirement states the ambiguity rather than resolving it — a derivation that sharpens its source is authoring, and authoring rank-0 meaning is FLIGHT's.

This document was draft and is ratified as of 2026-08-11 — DEC docs/decisions/2026-08-11-srs-mary-001-ratified.md. Its existence resolved F-017, where four artefacts referenced SRS-MARY-001 and no such document existed; existence was never ratification, and the sentence that stood here until today — nothing here binds until FLIGHT ratifies it — was correct and is now discharged.

Ratification is not verification. 15 of the 30 requirements do not hold today and the VCRM in §8 is where that is tracked. A requirement states what must be true; the VCRM states whether it is yet. No row may be closed on analysis of an unrun drill.

Authoring order is MARY-CONOPS.md §4's hook table, OS-01 and OS-02 first, as AGENT-REGISTER-v2.md C5 requires.

1 · Conventions

Identifier: MARY-SRS-<PLANE>-<nn>. Planes are CONOPS's six: C&DH (command and data handling), AIRLOCK, TLM (telemetry), FDR (flight data recorder), PROP (propulsion — outbound/publication), ECLSS (life support — the daily operating surface).

Verification methods, recorded per requirement in the VCRM:

Code Method Meaning here
T Test a gate drives the deployed artefact and passes or refuses
D Demonstration a drill is run against the real estate, not simulated
A Analysis argued from records; the weakest, and marked as such
I Inspection read directly from configuration or code

Status vocabulary: VERIFIED (evidence exists and is cited) · PARTIAL (some criteria met, the rest named) · UNVERIFIED (no evidence yet) · BLOCKED (cannot be verified until named work exists).

A requirement is never marked VERIFIED by analysis of a drill that was not run. OS-07's own criterion says each deck-loss drill is run, not simulated on paper, before the SRS row verifying it is marked closed. That sentence governs this whole document.

2 · C&DH — command and data handling

Seeded by OS-01, OS-02, OS-05, OS-08.

Open against CDH-03/CDH-04: F-057. OS-08 resolves the door after validation while ICD-001 requires door_id, so "valid" in CDH-03 is unresolved between two readings, and the deployed plane satisfies neither literally — it carries a claimed door. Stated, not resolved.

3 · AIRLOCK

Seeded by OS-02, OS-05, OS-08.

Carried caveat on AIR-04: OS-08's ratification narrowed "the same vault registry state" because no document specifies the vault registry's state model. The falsifiable form is two resolutions of one intent against an unchanged registry agree. The stronger form is owed to whatever specifies the registry and is not asserted here.

4 · TLM — telemetry

Seeded by OS-03, OS-06, OS-07.

5 · FDR — flight data recorder

Seeded by OS-01, OS-03, OS-07, OS-08.

6 · PROP — outbound and publication

Seeded by OS-04.

7 · ECLSS — the daily operating surface

Seeded by OS-03, OS-06, OS-07.

8 · VCRM — verification cross-reference matrix

Status is what the corpus can evidence today, 2026-08-10.

Requirement Scenario Method Status Evidence
CDH-01 OS-01 T UNVERIFIED no dispatch loop exists
CDH-02 OS-01 T UNVERIFIED as CDH-01
CDH-03 OS-08 T VERIFIED verification/2026-08-10-m4.1-stamp-envelope-gate-passed.md — 11 fixtures, live webhook
CDH-04 OS-08 T VERIFIED same; refusal fixtures produce no envelope
CDH-05 OS-08 T VERIFIED same; each refusal names the blamed JSON path
CDH-06 OS-02 T UNVERIFIED no poll surface exists
CDH-07 OS-05 T BLOCKED FIDO is proposed (DEC-0004); no annex wall
AIR-01 OS-02 I PARTIAL FR-003 and FR-015 exist and bind; enforcement is by refusal and inspection, no substrate enforcement
AIR-02 OS-02 T UNVERIFIED no poll surface exists
AIR-03 OS-05 T BLOCKED as CDH-07
AIR-04 OS-08 T VERIFIED (narrowed form) verification/2026-08-10-m4.2-door-resolve-gate-passed.md — 20 requests, five repeats per case, vault digest-stamped
AIR-05 OS-08 T VERIFIED same; no default door, intent named on refusal
TLM-01 OS-03 D VERIFIED (narrowed form) Re-read 2026-08-16 — the verdict the old note said was NOT read WAS read on 2026-08-12, and this row has been stale by three days: verification/2026-08-12-m6.4-anti-fatigue-gate-passed.md, all five criteria PASS, M6.4 complete. Criterion 1 is AR-009 exactly — two synthetic trips at one out-of-hours timestamp, exactly one wakes anybody — read from alertmanager_notifications_total, never from the channel, with the threshold not lowered and alertname checked before the count. NARROWED, and the narrowing is the honest part: what was exercised is class-C on SPUTNIK's emitter, one night. Class-B and class-D hold by CONSTRUCTION, not by measurement — docs/ops/m4.4/sputnik/alertmanager.yml:70-78 routes to discord-wake on severity = critical alone and everything else estate = mary to discord-brief held to brief-window — and APOLLO's emitter was untouched by the drill. Named unexercised, not waived, in M4.3's idiom. The construction claim is read from a class-D directory (2026-08-14 provenance ruling: the deck is source), so it asserts the deck matched this snapshot, and no deck was contacted for this re-read. Falsifiable: a class-B or class-D alert reaching discord-wake, or an APOLLO-side route without the critical matcher, refutes it
TLM-02 OS-03 D VERIFIED verification/2026-08-09-m4.4-wake-path-drill.md — two real ODIN power-offs, two emitters, zero send failures
TLM-03 OS-07 D VERIFIED …-degraded-mode-declared-m4.4-complete.md — declared at five consecutive failed probes, quoted verbatim. Evidence clause amended 2026-08-12 (decisions/2026-08-12-f-078-f-083-ruled-evidence-retention.md R-3): it read "durable in journald" and journald is not durable — it retains seven days by policy, so this row would have asserted VERIFIED on unreadable evidence from 2026-08-17 (F-083). The declaration was recorded in journald and exported into that verification record on 2026-08-12, four days before the horizon; the row is VERIFIED against the export, which is what R-2 requires of any row whose evidence would otherwise live in a deleting store. TLM-03's shall sentence at :112 is untouched — this amends how the fact was established, not what the system shall do
TLM-04 OS-03 D UNVERIFIED no brief content requirement is exercised
TLM-05 OS-06 D UNVERIFIED no brief surface exists
TLM-06 OS-06 I UNVERIFIED Re-read 2026-08-16 — the stated blocker is discharged. The note read needs FDR-01, and FDR-01 is VERIFIED. A class change, not a closure: no brief composer exists, so nothing links anything, and the row moves from cannot be attempted to not done. Left as BLOCKED it makes the brief composer look unreachable when it is merely unbuilt. One live constraint on whatever builds it, and it is not a blocker on this row: F-105 — the FDR holds 2272+ records and has no endpoint that can enumerate them, /fdr/trace/<id> needing an id the caller already holds — so a composer can link a trace it produced and cannot discover one it did not
TLM-07 OS-06 I BLOCKED no MET panel; Skuld is cross-repo
FDR-01 OS-01 T VERIFIED verification/2026-08-10-m5.3-fdr-gate-passed.md — resolves from trace_id alone; a record without one is refused, not stored
FDR-02 OS-08 T VERIFIED same — driven through the live stamp webhook: refusal and acceptance both resolve, both recorded:true
FDR-03 OS-07 D VERIFIED same — 5 enqueued, pkill -9, survived, drained in exact order, and draining is itself recorded. Corrected 2026-08-11: this row read PARTIAL while the gate record it cites reads PASS — the source wins, and what is partial is the scenario, not the criterion. A power cut is still not tested: SIGKILL kills a process, not a deck, and FDR-03's honest form wants a deck powered off under a recorded GO
FDR-04 OS-05 T BLOCKED as CDH-07
PROP-01 OS-04 T PARTIAL bin/pubgate.py refuses and gates. Corrected 2026-08-11: it is no longer advisory — CI blocks on the four PUB-SPEC checks since 2026-08-10, and set -o pipefail was needed before the block actually blocked (F-067). It stays PARTIAL because a publish path now exists and serves 3 documents, while the citations check remains advisory by design
PROP-02 OS-04 I UNVERIFIED Modgud is cross-repo
PROP-03 OS-04 D UNVERIFIED CELIA ratified (DEC-0008), not operating
PROP-04 OS-04 — dormant FR-006 is a draft
ECL-01 OS-03 D VERIFIED (narrowed form) Re-read 2026-08-16 — both residues this row named are discharged and it has been stale by three days. It named criteria 1 and 4 of the re-chartered M5.2 gate; verification/2026-08-12-m5.2-gate-passed-all-four-criteria.md records all four PASS, each met by an event rather than by an argument — canary stopped 21:15:11Z, engaged and repaired 21:15:27Z, 16s detection to repair, out-of-hours computed and printed by the script, and criterion 4 met by name in APOLLO's notification log inside the 07:00–07:05Z window rather than by counter arithmetic. The arrow is no longer inert. NARROWED: criterion 1 is proven on APOLLO only — SPUTNIK carries the realigner and not the proof — ODIN is deliberately excluded (stage-2 R-7: most of its containers are not MARY's), and the canary was stopped by the timer built to stop it, against a manifest the outcome payload itself calls derived by observation. Falsifiable: a drift on APOLLO that Eir observes and does not repair, with no guard firing, refutes it
ECL-02 OS-06 — dormant FR-008 is a draft
ECL-03 OS-07 D VERIFIED three deck-loss drills run against real estate — M3.1, M3.2, M3.3

This VCRM asserts no count of itself. Run bin/vcrm-count.

The counts that stood here — refreshed 2026-08-11 and a machine recount of 2026-08-16 — are removed by the 2026-08-16 extension of F-099 disposition 2 (docs/decisions/2026-08-16-counts-asserted-in-a-document-about-itself-come-out.md), on the register ruling's own reasoning and not on a new one. The removed 2026-08-11 line was wrong: it read 10 UNVERIFIED against an actual 9, so its five classes summed to 31 over 30 requirements — an error visible on the line's own face, standing inside a ratified document for four days, and not caught by the ratification's mechanical audit, which checked shall-to-CONOPS tracing, duplicate ids and VCRM bijectivity and never whether the tally matched the rows it tallies. It is recorded here rather than silently dropped, because a count removed without saying it was wrong reads as tidying.

The command is not a gate: it prints and exits 0 on any tally it can read. It refuses at exit 2 on an empty population — 0 requirements being indistinguishable from a true reading — and names any row whose status it cannot read, stating that the tally excludes it.

Three rows moved on 2026-08-16 and none of them moved because work was done. TLM-01 UNVERIFIED → VERIFIED (narrowed) and ECL-01 PARTIAL → VERIFIED (narrowed) — both corrections, not progress: each row disagreed with a gate record dated 2026-08-12 that had read PASS since it was written, and the source wins (MR-12). TLM-06 BLOCKED → UNVERIFIED — its stated blocker, FDR-01, is VERIFIED, so the row moves from cannot be attempted to not done. Both corrections are three days old, which is the same interval and the same mechanism as the four stale rows repaired before this document was ratified — "ratifying that version would have bound four falsehoods" — and they were found the same way, by acting on the document rather than auditing it. That is now the eighth instance of a summary outliving its read.

PROP-01 was re-read and deliberately NOT moved. Its PARTIAL rests on the citations check being advisory by design, which is a standing scope decision, not a stale reading — moving it would be a ruling on publication law wearing a bookkeeping edit.

Two moves are NARROWER than a plain VERIFIED, and the narrowing is written into the rows rather than into this paragraph — TLM-01 exercised class-C on one emitter with class-B and class-D holding by construction, ECL-01 proven on APOLLO only. AIR-04 is the precedent for the form. No deck was contacted for this re-read and no drill was run; every move is a read of a committed gate record against a committed row, and no row is closed on analysis of an unrun drill — each of the three drills behind these moves ran.

Four rows moved on 2026-08-11 and one moved because it had been wrong. FDR-03 PARTIAL → VERIFIED — a correction, not progress: the row disagreed with the gate record it cited, and the source wins. ECL-01 UNVERIFIED → PARTIAL — a realigner now exists. PROP-01's note corrected: the CI gate blocks and has since 2026-08-10. TLM-01 restated: the drill fired and its verdict was not read.

A VCRM is a claim about state and therefore carries FR-019's obligation. This one went stale in a single day, and the stale rows were found by acting on the document, not by auditing it — which is the seventh instance of that shape and the argument for the refresh discipline rather than for trusting a date.

9 · What this document does not do