The card
A tool is a deterministic instrument. This one is stdlib-only, binds no model at build or run time, and its verdict is a function of its input, not a probability.
Bill of materials
The fixture suite is a constituent, not a test fixture on the side: the tool’s proof of work is--self-test, and that self-test is meaningless without the planted-defect fixtures it proves against. So the fixtures are content-hashed into the BOM alongside the script.
workorders/validate-work-order.py, sha256bba57996d1dac61af20682d2b0195466190379094f2e3285bad64e3375e8a425workorders/fixtures/bad-missing-family.md, sha256c83fb6e892e651539f93a9751ca31e51bad8bb2903541f35f031d633efc818b9workorders/fixtures/bad-missing-principal.md, sha2563fc797095654de3f3ac8fee9b44664579b9904a3b427d519febed2c03dec2654workorders/fixtures/bad-missing-target-cost.md, sha256746b27c8e9e5e9d5190214296c862d74e6303b47be6f4b9549deb549224151eeworkorders/fixtures/bad-missing-why.md, sha256d39f93d5389c03d1ff21ac19967ca8343f13e15c61d09ef74ebd8a9b7cab2706workorders/fixtures/bad-script-shaped-mission.md, sha2567b68be773ed411458c60e83dfee8df3dd7b9c008effcccfb241344ed92d0b1b3workorders/fixtures/bad-untestable-end-state.md, sha256624f487f38bbff6fb9bd9281b3460cabcb27ede6a5684a15cf8c4f19e5d4a07cworkorders/fixtures/good-agent.md, sha256fbb8ea87d5fb1883a6f33e66e946596583ce91e2e56a5279e73ec4e5b7c66e66workorders/fixtures/good-skill.md, sha25627537fcccf300761c386170f65b08b3df0976dc3a1733ec9083e3ac7d5e6e34bworkorders/fixtures/good-tool.md, sha25624ff3a8039f044abab2a1246f7611061ef311f37404baae85b2dcedc8e29c76f- Part: none
- Model: none (deterministic). No model binding at build or run time.
Evidence
- Eval:
--self-testfixture battery, 9 of 9. Six planted-defect fixtures were each rejected for exactly its planted reason, and three good fixtures were accepted clean. No separate tool-family eval suite exists; the self-test is the family’s eval, recorded as a finding. - Proof of work: the raw
--self-testoutput, verdict PASS in both directions. - Judge: none. The judge harness is not built yet (a published gap). The probabilistic layer was manual: a second agent’s independent review.
- Traces: the assembly record (PR #101, the Station 0 intake gate) and the certification run (WO-A8, issue #132).
Provenance
- Work order: WO-A8, issue #132.
- Assembling agent: original assembly and certification both by worker sessions.
- Trial runs: none required. Supervised trial runs are the agent family’s gauge; a tool’s proof is its deterministic fixture suite, run in both directions.
Liability
- Owner of record: the operator of record.
- Escalation: the consuming session or continuous-integration job opens an issue on the factory’s public repository, and the operator of record takes the call.
- Recall: kill switch. Revert the tool and its fixtures to the last certified revision, mark the certificate recalled, find root cause by Five Whys, fix the die (the linter or the work-order schema) upstream, re-run the Verify gates, and re-issue.
Expiry
- Re-certify by: 2026-08-10 (30 days from issue).
- Triggers: any BOM hash mismatch (the tool or its fixtures changed, so the certified unit no longer exists); a runtime dependency change (the interpreter version the factory runs it under); a change to the work-order schema this tool compiles (its verdict would no longer mean the same thing); or 3 production failures. A model swap does not apply: no model binding.