[GTrunSec]

Weaver keeps every LLM operation bound to its original task, profile, claim and shared budget/history domains from authenticated Go publication through MRR Data/Turso consumption and Rust's actual provider write and final gRPC delivery. Routing proposes a target; current Cedar authorization and durable original consumption constrain its use.

Go owns configuration, authenticated gRPC, routing proposals and source-publication orchestration. Rust owns Cedar evaluation, atomic consumption, fencing and final effects. Scheme retains its upstream Governor/Governance allocation; runtime reintegration remains paused.

Runtime enforcement

• Independent SPEC review binds the authority-owned parent, candidate and Delta. Publication performs no provider IO. Original-profile, current Policy, OAuth ancestry/witness, shared exposure and fencing remain in the deciding view. Unknown witness results retain their pending barrier.
• Every production writer registers its outcome ticket before scheduler/database waiting. Semantic changes close affected delivery and advance its revision. Only audited fresh range/cursor updates and exact release CAS preserve the complete authorization image; generic SQL invalidates by default. Unknown outcomes seal the owner. Production storage custody is opaque.
• Rust groups only complete, already buffered ranges within the existing four-range/32-row bound. One deciding transaction validates every exact manifest sequence through the current Cedar/claim/domain view, stages the first frame inert, CAS-burns the whole manifest and commits it atomically. Only known commit publishes its shared qualification. Single-range callers reuse this implementation.
• Shared qualification does not share per-frame acknowledgment, deadline or consumed state. The final Tonic receiver joins the actual current cut, unique owner/session/plan, effective OAuth time interval and one-use cursor. A source change requalifies the exact retained manifest without another reservation, burn or provider call. Read-only renewal does not close current peers. Satisfied duplicate demand and already-visible semantic pending defer redundant reads; later mutations still fence final use.
• Native admission is distinct from transport occupancy. Two queue slots and one staged receiver remain fixed; an unqueued burned tail is neither a receipt nor refund evidence. Capacity waiting holds no SQL scope, terminal completion joins all handoffs, and partial writes, uncertain commits and restart retain original unknown exposure. Exact independently observed native prefixes are required during recovery.
• The process lease outlives every frame/worker role and retires after the engine. WAL and MVCC reject another live process owner. Explicit unlock prevents copied custody descriptors from extending a completed lease.

Source-led design and validation

Agentgateway's serialized endpoint publication, Go push coalescing and Rust ADS/body paths, the locked Tonic encoder, and Cargo-owned MRR/Turso sources informed the change. Weaver adopts immutable bounded publication and coalesces notification demand; it does not drop Policy intents or use a bare Arc load as final authorization. No new runtime framework, storage engine, queue capacity or dependency revision is introduced.

• Rust: 53 ledger library and 127 actual-Turso integration/PBT tests; 29 broker and 28 server library tests. Workspace/all-target/all-feature Clippy and ASP deny gates pass. Go explicitly starts the existing ignored TLS fixture entrypoints.
• Go: the complete uncached race suite and 19 real TLS/gRPC fault/property groups pass, covering commit loss, request seal, migration, pending Policy, OAuth witness, cancellation, restart and original shared quota retention.
• Quint: 19 snapshot schedules and 2,000 seeded 80-transition safety traces pass, including partial-publication and load-before-revoke/use-after-revoke counterexamples. Lean's complete SPEC composition builds and checks a closure of 3,896 declarations. Exact SQL/read-set correspondence, authenticated custody, durability and actual transport mediation remain explicit Host premises; no custom axiom is introduced.
• Deterministic real-engine controls cover later-manifest CAS failure after inert staging, refresh re-request during native qualification, and source pending appearing before renewal scheduling. The last control fails on the pre-fix implementation and passes after correction. Earlier failures remain in ignored cache.
• The selected final-delivery D2/SVG is generated from SysML/Design through the locked upstream Library and checked in Chromium at 830 px with the original 5-second export, 30-second readability and 18 px font gates. The check is scoped to that view; it is not an all-diagram claim.

Measured performance boundary

Every complete paired MVCC run accounts for all 13,312 frames: 128 streams per arm, four concurrent streams, 13 one-row Protobuf frames, shared/disjoint roots and injected/no-injection cohorts. Both arms use one immutable optimized image per run. Four grouped preparations remain four; native final-queue transactions fall from 13 to four. Payloads, provider-call counts, queue capacity, original holds and latency targets remain unchanged.

The final image's shared no-injection control/snapshot throughput is 29.48/43.39 streams/s, and whole-stream P99 is 202.6/147.8 ms. Across all four final cohorts throughput improves 1.37–1.65 times. Snapshot final owner-turn P99 is 14.25–17.08 us. Native commit sums are per stream, not transaction quantiles; independent percentiles are never added.

The complete path does not qualify for sub-millisecond latency. Shared acknowledgment-to-Tonic P99 remains 10.380–22.224 ms; final disjoint no-injection Rust-queue-to-Go P99 is 4.498 ms. Shared injected acknowledgment, shared renewal-bin tails and disjoint Tonic-to-Go have regressions. The observed injected pressure is 2.561/3.680 CPU equivalents, not six occupied cores. Other jobs appeared around sampling, so final-image low-background qualification remains open. Earlier lower-background attempts, all regressions and the before/after scheduling counterexample are retained; no sample, deadline or safety constraint is discarded.

English Org, SysML, Lean, Quint and generated D2/SVG are synchronized. Raw logs and failed evidence stay in ignored cache. External dependency pins remain unchanged; Scheme reintegration is paused. No additional PR or storage backend is introduced, and the separate response-window candidate remains unpromoted.

See the source-led snapshot design and complete results, writer mediation and core delivery view.