Bryforge · Bryforge · May 24, 2026 · May 29, 2026 · May 29, 2026 · May 29, 2026
diff --git a/.gitignore b/.gitignore
@@ -23,10 +23,13 @@ latticra_substrate_engine
 latticra_theorem_engine
 # Local build outputs
 /build/
+/build-separate/
+
 __pycache__/
 *.py[cod]
 .DS_Store
 /assets/piper-voices/
+>>>>>>> origin/main
 latticra_nuclear_recursion_engine
 latticra-nuclear-recursion-engine.mp4
 # Nuclear recursion visual engine outputs

diff --git a/Makefile b/Makefile
@@ -2012,13 +2012,51 @@ seal-demo: seal-cli
 seal-docs:
 	sh scripts/test-latticra-seal-docs.sh
 
-.PHONY: latticra-academic-presentation-preview latticra-academic-presentation latticra-academic-presentation-test
-
-latticra-academic-presentation-preview:
-	sh ./scripts/render-latticra-academic-presentation.sh preview
-
-latticra-academic-presentation:
-	sh ./scripts/render-latticra-academic-presentation.sh render
-
-latticra-academic-presentation-test:
-	sh ./scripts/test-latticra-academic-presentation.sh
+# Isolated build-separate/ platform targets (delegated to scripts/build-separate.sh)
+# These exist so `make build-separate` and `make build-separate-platform` etc. work
+# as documented, instead of Make reporting "Nothing to be done" due to the
+# build-separate/ directory existing with no rule.
+.PHONY: build-separate build-separate-platform build-separate-full-validate build-separate-clean
+
+build-separate:
+	sh ./scripts/build-separate.sh all
+
+build-separate-platform:
+	sh ./scripts/build-separate.sh platform
+
+.PHONY: build-separate-demo
+build-separate-demo:
+	sh ./scripts/build-separate.sh demo
+
+# Quick focused demo (binaries + effect runner + key reports, no heavy validation)
+.PHONY: build-separate-demo-quick
+build-separate-demo-quick:
+	@echo "Running focused demo (best for macOS presentations)..."
+	BUILD_PROFILE=effect-enabled sh ./scripts/build-separate.sh demo
+
+# Effect-enabled builds (experimental - Phase 1+)
+# Usage: make build-separate-platform-effect BUILD_PROFILE=effect-enabled
+.PHONY: build-separate-platform-effect
+build-separate-platform-effect:
+	BUILD_PROFILE=effect-enabled sh ./scripts/build-separate.sh platform
+
+.PHONY: build-separate-effect-tools
+build-separate-effect-tools:
+	BUILD_PROFILE=effect-enabled sh ./scripts/build-separate.sh build_effect_enabled_tools 2>/dev/null || true
+
+# Quick way to build just the experimental guarded execution runner
+.PHONY: build-separate-effect-runner
+build-separate-effect-runner:
+	BUILD_PROFILE=effect-enabled sh ./scripts/build-separate.sh build_effect_enabled_tools 2>/dev/null || true
+	@echo "Experimental effect runner (if built): build-separate/bin/latticra-effect-runner"
+
+build-separate-full-validate:
+	sh ./scripts/build-separate.sh full-validate
+
+build-separate-clean:
+	sh ./scripts/build-separate.sh clean
+
+# Catch-all for other subcommands supported by the script (e.g. build-separate-cli,
+# build-separate-q-seal, build-separate-dashboard, build-separate-prepare-release-candidate, etc.)
+build-separate-%:
+	sh ./scripts/build-separate.sh $*
diff --git a/README.md b/README.md
diff --git a/STATUS.md b/STATUS.md
diff --git a/docs/status/CURRENT_STATUS.md b/docs/status/CURRENT_STATUS.md
diff --git a/docs/status/README.md b/docs/status/README.md
diff --git a/docs/status/SEAL_CORE_EVIDENCE_PUBLIC_STATUS_UPDATE.md b/docs/status/SEAL_CORE_EVIDENCE_PUBLIC_STATUS_UPDATE.md
@@ -8,6 +8,7 @@ Scope: public-facing status language after the completed report-only Seal runtim
 Latticra Seal has reached an important report-only milestone.
 
 The project now has an operator-visible evidence path for a report-only runtime gate and a completed core case evidence set covering:
+operator-visible evidence report surface
 
 This is an operator-visible evidence report surface, not runtime enforcement.
 

diff --git a/docs/transition/EFFECT_RUNNER_USAGE.md b/docs/transition/EFFECT_RUNNER_USAGE.md
@@ -0,0 +1,39 @@
+# Using the Experimental Guarded Command Runner (v0.3.0edge+)
+
+## Easiest way on macOS (recommended for demos)
+
+```sh
+# One command for a focused, impressive demo
+make build-separate-demo-quick
+# or
+BUILD_PROFILE=effect-enabled make build-separate-demo
+```
+
+This will:
+- Build the effect runner
+- Create a safe default allowlist
+- Exercise real guarded command execution
+- Generate Dashboard + Q-Seal report
+
+## Manual build + run
+
+```sh
+BUILD_PROFILE=effect-enabled make build-separate-effect-runner
+```
+
+Then run:
+
+```sh
+export LATTICRA_EFFECT_ALLOWLIST="effect-allowlist.txt"
+./build-separate/bin/latticra-effect-runner echo "hello from the effect layer"
+./build-separate/bin/latticra-effect-runner date
+```
+
+The root `effect-allowlist.txt` (checked into the repo) contains a safe default set.
+
+## How the allowlist works
+
+- `LATTICRA_EFFECT_ALLOWLIST` env var (colon-separated commands, or path to a file)
+- Falls back to `effect-allowlist.txt` in current directory
+
+This is the first real effectful capability in Latticra. Use it to show that the system can now actually execute (guarded) commands while producing evidence.
diff --git a/docs/transition/FIRST_REAL_EFFECT_COMMAND_EXECUTION.md b/docs/transition/FIRST_REAL_EFFECT_COMMAND_EXECUTION.md
@@ -0,0 +1,65 @@
+# First Real Effect: Guarded Command Execution
+
+**Status:** Design in progress (post v0.3.0edge)
+**Priority:** Highest for making Latticra actually useful
+
+## Rationale
+
+The single most useful narrow effect Latticra can provide early is **safe, contract-bound, fully evidenced command execution**.
+
+This directly serves:
+- AI agent tool use (with strong boundaries)
+- Automated operations with audit trails
+- "Run this only if these conditions are met" workflows
+- Complementing host systems without replacing them
+
+## Scope for v0.4-era First Implementation
+
+**In scope:**
+- Execute commands only from an explicitly declared allowlist (or exact command + args)
+- Capture full evidence: command, args, env (redacted), cwd, uid, start/end time, stdout/stderr (bounded), exit code, resource usage summary
+- Integrate with existing Seal (for cryptographic approval where required) + Nucleus + Runtime Boundary
+- Support both "preview/report only" and "actually execute" modes via the Effect Gate
+- Operator confirmation hooks for high-impact commands
+- Rollback/undo hooks where practical (future)
+
+**Out of scope for first cut:**
+- Arbitrary shell interpretation (no `sh -c` with untrusted input)
+- Network-bound commands by default (can be explicitly allowed under contract)
+- Privileged execution (starts as user-level only)
+- Long-running services (focus on discrete commands first)
+
+## Integration Points
+
+- `nucleus_task` will gain a new request kind: `LATTICRA_NUCLEUS_TASK_COMMAND_EXECUTION`
+- Effect class: `LATTICRA_NUCLEUS_TASK_EFFECT_LOCAL_MUTATION` or a new specific one
+- New effect type in the Effect Dispatcher
+- Evidence written through the existing evidence layer (with optional Q-Seal signing later)
+
+## Security / Boundary Posture
+
+- Denied by default
+- Explicit allowlist required in the contract
+- Full pre-execution validation via existing Lat/LIR + boundary systems
+- All execution goes through the Effect Gate
+- Evidence is mandatory and structured
+
+## Success Criteria for First Cut
+
+A user (or automated system) can:
+1. Declare a contract allowing specific commands with arguments
+2. Have the contract validated and approved (or auto-approved under policy)
+3. Execute one of the allowed commands through Latticra
+4. Receive rich, tamper-evident evidence of what was attempted and what actually happened
+5. The system refuses anything not explicitly contracted
+
+This would be the first time Latticra crosses from "describes what should happen" to "makes something happen safely."
+
+## Next Steps (Immediate)
+
+1. Extend nucleus task types and effect enums (if needed)
+2. Design the Command Execution Contract schema
+3. Implement the guarded executor (initially very conservative)
+4. Wire it into the Effect Dispatcher
+5. Add platform support for building effect-enabled command executor
+6. Create test contracts and evidence examples
diff --git a/docs/transition/LATTICRA_EFFECT_SUBSTRATE_TRANSITION.md b/docs/transition/LATTICRA_EFFECT_SUBSTRATE_TRANSITION.md
@@ -0,0 +1,102 @@
+# Latticra Effect Substrate Transition Plan
+
+**Status:** Draft (v0.3.0edge → real effect capability)
+**Date:** 2026-05-29
+**Owner:** Chase Bryan (with Grok assistance)
+
+## Goal
+
+Move Latticra from a pure evidence/report-only foundation to a genuine, useful substrate architecture that can safely perform real, bounded system modifications on host systems (starting with Linux user-space, expanding to full host complement layers).
+
+## Core Principles (Non-Negotiable)
+
+- Contract-first (no effect without explicit contract + identity)
+- Evidence-bound (every effect must produce auditable evidence)
+- Denied-by-default authority
+- Substrate model (complements hosts, does not claim to replace them)
+- Clear, reviewable boundaries at every layer
+- Progressive disclosure of capability (start narrow, expand with evidence)
+
+## Current State (v0.3.0edge)
+
+- Excellent isolated Development Platform
+- Rich contract, preview, report, and boundary modeling
+- Almost everything is deliberately "no-effect" or "requires future gate"
+- Packaging is planning-only
+
+## Proposed Transition Phases
+
+### Phase 1: User-Space Effect Foundation (Next 3-6 months target)
+
+**Scope:**
+- User-space only (no kernel, no privileged daemons initially)
+- Narrow, high-value effects with strong contracts
+- Full evidence capture for every effect
+
+**Initial Effect Classes to Implement (in order):**
+
+1. **Guarded Local File Operations** (within user-controlled paths)
+2. **Guarded Command Execution** (with full parameter + environment evidence)
+3. **Guarded Configuration Management** (templated, auditable writes)
+4. **Guarded Service/User Unit Control** (systemd user units, launchd agents where applicable)
+
+**Key Deliverables:**
+- Effect Execution Layer (new `src/effect/` or `src/substrate/effect/`)
+- Effect Gate (runtime enforcement of contracts + boundaries)
+- Evidence Recorder (structured, signed or hash-chained evidence)
+- Updated Nucleus + Runtime Boundary to actually dispatch real effects when policy allows
+- Packaging that produces real, installable user-local tools
+
+### Phase 2: Host Complement Layer
+
+- Optional privileged components (with extremely narrow authority)
+- Better integration with host package managers, init systems, etc.
+- Architecture-specific backends behind clear interfaces
+
+### Phase 3: Cross-Architecture Maturity
+
+- Real support for x86_64 and aarch64 hosted profiles
+- QEMU and real-device validation pipelines
+- Proper multi-distro packaging (deb, rpm, pkg, ports, etc.)
+
+## Build System Evolution
+
+The current `build-separate/` platform is excellent for development.
+
+We need to evolve toward:
+
+- Profile-aware builds (`--profile=hosted-x86_64`, `--profile=report-only`, etc.)
+- Real artifact production for target hosts
+- Cross-compilation support
+- Integration with packaging directories (`packaging/fedora/`, etc.)
+
+## Risk Management
+
+- Start extremely narrow (user-controlled paths only)
+- Heavy use of the existing Seal + Nucleus + Runtime Boundary machinery for gating
+- Mandatory evidence for every effect
+- Progressive rollout with strong non-claims
+
+## Success Criteria for Phase 1
+
+- A user can install a Latticra user-space agent
+- Define a contract for a file operation or command
+- Execute it through Latticra
+- Get rich, auditable evidence that the effect happened (or was denied)
+- The system remains denied-by-default and contract-first
+
+---
+
+This document should be treated as a living transition plan. All effect capability must still go through the existing contract, preview, and boundary systems.
+
+## Work Started in v0.3.0edge → v0.4 Transition
+
+As of late May 2026, initial scaffolding has begun:
+
+- Created `src/substrate/effect/` directory and basic `effect_dispatcher.c` skeleton.
+- Created public header `include/latticra/substrate/effect.h`.
+- Added `BUILD_PROFILE` support to the Development Platform (`build-separate.sh`).
+- New Makefile targets: `build-separate-platform-effect` and `build-separate-effect-tools`.
+- Effect dispatcher currently returns "effects disabled" unless explicitly built in effect-enabled profile.
+
+This is the beginning of the shift from pure report-only to gated real effects.
diff --git a/docs/transition/MINIMAL_USEFUL_EFFECT_LAYER.md b/docs/transition/MINIMAL_USEFUL_EFFECT_LAYER.md
@@ -0,0 +1,38 @@
+# Minimal Useful Effect Layer (Phase 1 Target)
+
+**Goal:** The smallest possible set of real, gated effects that would make Latticra genuinely useful as a substrate on Linux (and eventually other hosts) while staying true to the project's principles.
+
+## Proposed Minimal Scope (User-Space Only)
+
+### 1. Guarded Command Execution
+- Execute a command with explicitly declared arguments and environment.
+- Full pre- and post-execution evidence (including stdout/stderr capture with size limits).
+- Policy can require operator confirmation, cryptographic approval (via Seal), or be fully automated under contract.
+
+### 2. Guarded File Operations (within declared safe paths)
+- Read / write / delete files only within paths the contract has explicitly authorized.
+- Atomic operations where possible.
+- Full before/after hashes and change evidence.
+
+### 3. Guarded Environment / Configuration Management
+- Apply configuration from a declared source (with validation).
+- Rollback capability with evidence.
+
+## Non-Goals for Phase 1
+- Kernel modifications
+- Privileged system services (initially)
+- Network effects (except under very narrow contracts)
+- Boot / firmware changes
+
+## Key New Components Needed
+
+- `src/substrate/effect/` — Effect dispatcher and executor
+- `src/substrate/evidence/` — Structured evidence recorder (with optional signing)
+- Updates to Nucleus Task Execution to actually call into the effect layer when policy allows
+- Effect Gate (runtime enforcement)
+- Simple user-space agent / CLI that can perform these effects when authorized
+
+## Success Metric
+A user can write a contract, get it approved (or auto-approved under policy), execute a real file operation or command through Latticra, and receive rich, tamper-evident evidence that it happened — all while the system remains denied-by-default for anything not explicitly contracted.
+
+This would be the first time Latticra does something *useful* in the real world rather than just describing what it would do.
diff --git a/effect-allowlist.txt b/effect-allowlist.txt
@@ -0,0 +1,9 @@
+echo
+date
+uname
+ls
+pwd
+whoami
+cat
+true
+false
diff --git a/include/latticra/runtime_boundary_domain_matrix.h b/include/latticra/runtime_boundary_domain_matrix.h
@@ -43,6 +43,24 @@ latticra_status_t latticra_runtime_boundary_domain_matrix_report(
     char *buffer,
     size_t buffer_len);
 
+/* High-level convenience query.
+ * Returns non-zero if the evaluated domain would block the requested effect
+ * under current policy and boundary classification.
+ * This is pure query/report surface — no authority is granted.
+ */
+int latticra_runtime_boundary_domain_matrix_effect_is_blocked(
+    const latticra_runtime_boundary_domain_matrix_result_t *matrix_result);
+
+/* Additional high-level queries for evidence and reporting surfaces */
+int latticra_runtime_boundary_domain_matrix_is_declarative(
+    const latticra_runtime_boundary_domain_matrix_result_t *m);
+
+int latticra_runtime_boundary_domain_matrix_is_operational(
+    const latticra_runtime_boundary_domain_matrix_result_t *m);
+
+int latticra_runtime_boundary_domain_matrix_is_future_gated(
+    const latticra_runtime_boundary_domain_matrix_result_t *m);
+
 #ifdef __cplusplus
 }
 #endif

diff --git a/include/latticra/seal_guarded_allowlist.h b/include/latticra/seal_guarded_allowlist.h
@@ -85,6 +85,9 @@ latticra_status_t latticra_seal_guarded_allowlist_report(
     char *buffer,
     size_t buffer_len);
 
+size_t latticra_seal_guarded_allowlist_entry_count(
+    const latticra_seal_guarded_allowlist_t *allowlist);
+
 #ifdef __cplusplus
 }
 #endif

diff --git a/include/latticra/seal_status_rollup.h b/include/latticra/seal_status_rollup.h
@@ -44,6 +44,11 @@ typedef struct {
     char rollup_state[LATTICRA_SEAL_STATUS_ROLLUP_STATE_MAX];
     latticra_seal_status_rollup_error_t error;
     char status[LATTICRA_SEAL_STATUS_ROLLUP_STATE_MAX];
+
+    /* Q-Seal / Post-Quantum posture (report-only planning surface) */
+    unsigned q_seal_post_quantum_profile_planned;
+    unsigned post_quantum_signature_support_planned;      /* ML-DSA etc. */
+    unsigned post_quantum_key_establishment_planned;      /* ML-KEM etc. */
 } latticra_seal_status_rollup_t;
 
 const char *latticra_seal_status_rollup_error_label(
-Original file line number
+Diff line change
@@ -0,0 +1,9 @@
+    echo
+    date
+    uname
+    ls
+    pwd
+    whoami
+    cat
+    true
+    false