SI1 CINT R0 — public source and verification baseline

.github/workflows/cint-r0-verification.yml

@@ -0,0 +1,73 @@
+name: CINT R0 verification
+
+on:
+  pull_request:
+    branches:
+      - main
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: cint-r0-verification-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  verification-matrix:
+    name: ${{ matrix.os }} / Node ${{ matrix.node }}
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - ubuntu-24.04
+          - macos-26
+          - windows-2025
+        node:
+          - "20"
+          - "24"
+          - "26"
+
+    steps:
+      - name: Check out the exact candidate
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Select Node.js ${{ matrix.node }}
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: ${{ matrix.node }}
+          package-manager-cache: false
+
+      - name: Install the locked dependency graph
+        run: npm ci
+
+      - name: Verify all 13 registered and packaged schemas
+        run: npm run schema:verify
+
+      - name: Run the complete CINT and historical AF-G0 verification
+        run: npm run verify
+
+  remote-verification:
+    name: CINT-R0 remote verification
+    if: ${{ always() }}
+    needs:
+      - verification-matrix
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - name: Require every verification lane
+        env:
+          MATRIX_RESULT: ${{ needs.verification-matrix.result }}
+        run: |
+          if [ "$MATRIX_RESULT" != "success" ]; then
+            echo "Verification matrix result: $MATRIX_RESULT" >&2
+            exit 1
+          fi

CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## v0.1.0-cint-r0 — 2026-08-28
+
+- Made SI1 CINT and `sntllgnc/CINT` the active repository and default-source
+  identity.
+- Closed architecture findings F1-F5 at accepted architecture commit
+  `1343b88e1b95c8e299a8bfa7d3b0786d8347c8c4`.
+- Closed `CINT-EXPIRY-001` through trusted execution-time revalidation at
+  `ae3502779c97ae44464714fea25e1868d5ecaa1d`.
+- Passed 72/72 automated tests before the publication-state commit and in final
+  publication verification.
+- Enforced all 13/13 public runtime schemas and preserved AF-G0 evidence at
+  53/53.
+- Passed remote verification on Linux, macOS, and Windows across Node.js 20, 24,
+  and 26.
+- Preserved Agent Floor as CINT Adapter 01 and the historical
+  `v0.1.0-af-g0` release lineage.
+- Published the source as a GitHub prerelease without npm publication or a
+  production-readiness claim.
+
 ## v0.1.0-af-g0 — 2026-07-18
 
 - Added clean, self-contained child packets with explicit lineage and authority.

CINT_EVALUATION.md

@@ -0,0 +1,33 @@
+# Independent SI1 CINT R0 verification
+
+Verify the public source and verification baseline at `sntllgnc/CINT` on
+`main`. The accepted architecture commit is
+`1343b88e1b95c8e299a8bfa7d3b0786d8347c8c4`, and the trusted execution-time
+correction is `ae3502779c97ae44464714fea25e1868d5ecaa1d`.
+
+```sh
+npm ci
+npm test
+npm run cint:identity
+npm run schema:verify
+npm run verify
+```
+
+Require all of the following:
+
+- every test passes with zero failures;
+- all 13 runtime schemas are registered and present in the package dry run;
+- the historical AF-G0 demo remains reproducible;
+- dependency, publication, and immutable historical evidence checks pass;
+- `cint:identity` reports `PUBLIC_R0_SOURCE`, public source exposure `YES`, public
+  default product `YES`, public release `YES`, and remaining publication authority
+  `SOURCE_RELEASE_COMPLETE`;
+- `artifacts/cint-r0/gate-ledger.json` contains one ordered pass per completed
+  gate;
+- Git status is clean after verification;
+- the `CINT-R0 remote verification` check passes for Node.js 20, 24, and 26 on
+  Linux, macOS, and Windows.
+
+Review the proof matrix in `docs/cint-r0/05_SYNTHETIC_ACTION_PROOF.md`, the
+adapter boundary in `docs/cint-r0/06_CODEX_ADAPTER.md`, and the active threat
+model when evaluating the public R0 source baseline.

CODE_OF_CONDUCT.md

@@ -1,6 +1,6 @@
 # Code of conduct
 
-Participation in Agent Floor must remain technically rigorous and professionally respectful.
+Participation in SI1 CINT must remain technically rigorous and professionally respectful.
 
 Contributors must:
 

CONTRIBUTING.md

@@ -2,36 +2,48 @@
 
 ## Development setup
 
-Agent Floor requires Node.js 20 or newer and has no runtime package dependencies.
+SI1 CINT requires Node.js 20 or newer and has no runtime package dependencies.
 
 ```sh
 npm ci
 npm test
+npm run cint:identity
 npm run demo
 npm run public:audit
 ```
 
-`npm run demo` is deterministic and makes no model call. A native Codex run is optional and must be explicitly intended by the operator.
+`npm run demo` is the deterministic historical Adapter 01 regression and makes
+no model call. A native Codex adapter run is optional and must be explicitly
+authorized by the operator.
 
 ## Change discipline
 
-- Keep worker packets self-contained and bounded.
-- Never introduce full-history delegation or implicit resume behavior.
+- Preserve the invariant: no consequential action without current
+  decision-bound authority.
+- Keep decisions non-executable and receipts exact, expiring, one-shot, and
+  immediately revalidated.
+- Keep adapters unable to decide, issue, consume, self-admit, or seal.
+- Keep legacy worker packets self-contained and bounded.
+- Never introduce full-history delegation or implicit resume behavior into the
+  Codex adapter.
 - Preserve the operator-selected root model and reasoning setting.
 - Classify each control as policy, mechanical enforcement, telemetry interpretation, or semantic admission.
 - Attribute usage from the worker's own boundary; never assign inherited cumulative totals to the worker.
 - Add a regression test for every accounting or admission defect.
-- Keep AF-G0 read-only; mutation requires a separate authority design.
+- Preserve every AF-G0 observable as historical Adapter 01 compatibility.
+- Add negative controls for replay, drift, fail-open, verification, and rollback
+  changes.
 
 ## Public evidence rules
 
 Use synthetic or explicitly sanitized fixtures. Do not commit credentials, email addresses, session identifiers, local absolute paths, raw native logs, private source text, or private project names. Do not make billing or provider-quota claims from local telemetry.
 
-Run the publication audit before opening a pull request:
+Run the complete local verification before requesting review:
 
 ```sh
 npm run public:audit
 npm audit
+npm run evidence:verify
 ```
 
 ## Pull requests

NOTICE

@@ -1,10 +1,10 @@
-Agent Floor
-Copyright 2026 Agent Floor contributors
+SI1 CINT
+Copyright 2026 SI1 CINT contributors
 
-Agent Floor is an open-source developer tool for governed Codex
-delegation, bounded worker execution, request-local accounting,
-and evidence-based result admission.
+SI1 CINT is an open-source Machine Counterintelligence Runtime for
+decision-bound consequential action. Agent Floor v0.1 is preserved as
+the historical Codex delegation adapter and regression foundation.
 
-"Agent Floor" and "Sentelligence One" may be trademarks or product
+"SI1 CINT", "Agent Floor", and "Sentelligence One" may be trademarks or product
 identifiers of their respective owner. The Apache License 2.0 grants
 copyright and patent permissions but does not grant trademark rights.