Separate who proposes, proves, authorizes, executes, and observes.
DSG ONE is a governed execution architecture. Simulation may search. Cinema may verify. Monitoring may observe. Executors may act. Only the control authority may authorize promotion or post-deploy mutation.
Truth boundary: this page distinguishes implemented code paths from marketplace approval, certification, and external review. A Proof Receipt proves one bounded verification request; it is not SOC 2, ISO, regulatory, legal, or third-party certification.
User intent, agents, and deterministic simulation can propose work. Simulation cannot promote its own candidate.
Five trust domains. One authority boundary.
The system that produces a candidate does not get to approve its own candidate. The verifier does not execute. Monitoring does not mutate production. External side effects only occur after plan-bound authorization.
Intent / Plan / Candidate
User goals, agents, and AGI Simulation create candidate actions or improved configurations. Candidate admission requires real objective improvement with no protected-metric regression.
Cinema Proof Agent + Z3
Raw metric, test, build, commit, and plan bindings are independently checked. Exact QUBO verification only claims a global optimum when a separate Z3 proof obligation establishes that no better assignment exists.
DSG Control Plane
Canonical gate checks plan hash, commit binding, path scope, constraints, tests, build, evidence completeness, and independent Cinema proof before promotion or post-deploy control is authorized.
Controlled Executor
API, MCP, browser, and deployment adapters perform only the approved side effect. Browser sessions are plan-bound; verifier controllers are read-only; sensitive identity material uses opaque references outside the model/evidence path.
Evidence / Replay / Monitoring
Observed production results determine ACCEPT_NEXT_BASELINE, HOLD_REVIEW, or rollback recommendation. Monitoring remains observation-only; the control authority decides the mutation.
Proposal ≠ Authority
Simulation and agents can search and propose, but selfPromotionAllowed=false.
Observation ≠ Authority
Monitoring can report PASS / REVIEW / BLOCK, but execution authority remains the control plane.
Proof before claim
Timeout, incomplete shards, missing raw evidence, or unbound production targets do not become success claims.
Every major box points to code.
These references are the implementation anchors used for this architecture. They are not decorative labels.
Run the real Cinema + exact Z3 path.
Choose one bounded scenario. The browser obtains a free capped API key when needed, calls production /verify/evaluate, and displays a decision only when the backend returns a structurally valid proof receipt with verified=true and VERIFIED_GLOBAL_OPTIMUM.
See ALLOW / REVIEW / BLOCK, why it happened, exact verification status, proof hashes, and the next action.
The interface answers six operational questions.
Where do I start?
Select a bounded scenario and press Run live verification.
Where is the result?
The result panel shows the decision and proof in the same screen.
What did I get?
Plain ALLOW / REVIEW / BLOCK plus machine-readable proof status.
What must change?
The reason and next action identify the failing boundary instead of forcing log hunting.
Is it supported?
Proof, request, and context hashes plus downloadable receipt bind the result.
Is it simpler?
One bounded run replaces separate policy, solver, evidence, and replay interpretation steps.
Separate live delivery from external approval.
A repository package is not the same as marketplace approval. These labels describe the boundary without implying third-party certification.
Direct API
LIVEProduction Cinema API and self-serve free activation are publicly reachable.
GitHub Marketplace
LISTING / CUTOVER CHECKRepository integration exists; paid entitlement cutover must be verified independently.
OpenAI Skills
PACKAGE READYSkill package exists in the repository. External review remains separate.
Microsoft Marketplace
OFFER PACK READYOffer metadata exists; this page does not claim Microsoft approval or certification.
AWS Marketplace
EXTERNAL WORK REMAINSSeller onboarding and marketplace billing infrastructure remain external requirements.
JetBrains Marketplace
SPEC / PACKAGE BOUNDARYSpecification exists; installable artifact and marketplace review must be verified separately.
Know what passed, why, and prove it.
The architecture is deliberately asymmetric: candidate generators cannot promote themselves; verifiers cannot mutate; observers cannot execute; and unbound production targets fail closed.
Supported claim
Claim only what the bound plan, raw evidence, exact proof, execution result, and production binding support.
Incomplete evidence
Timeouts, partial search, missing replay, incomplete evidence, or external review remain visible as unresolved work.
Unsupported mutation
Out-of-plan actions, missing authority, constraint violations, or unbound targets do not execute.