Publish Programmable Open Review Standard v1

.github/CODEOWNERS

@@ -4,3 +4,5 @@
 /scripts/ @0xprogrammable
 /.github/ @0xprogrammable
 /vendor/ @0xprogrammable
+/review/ @0xprogrammable
+/docs/OPEN_REVIEW_STANDARD.md @0xprogrammable

CONTRIBUTING.md

@@ -21,6 +21,12 @@ or deployment claim.
 Never hand-edit generated indexes. Change a source project record, then run `npm run generate`. Existing history files
 are append-only and must never be rewritten.
 
+## Review standard maintenance
+
+Changes to `review/`, its schemas or its decision semantics require a separate maintainer pull request, public regression
+fixtures for both unusual legitimate behavior and proven failures, and a version change when existing inputs could
+receive a different decision. A model score or private assertion is never sufficient test evidence.
+
 ## Security
 
 Do not publish an unpatched vulnerability, credential, wallet secret, private RPC, personal data, or exploit in a pull

README.md

@@ -2,32 +2,47 @@
   <img src="assets/repository-cover.jpg" alt="Programmable islands connected by streams, representing composable projects" width="100%">
 </p>
 
-<h1 align="center">Programmable Registry</h1>
+<h1 align="center">Programmable Apply</h1>
 
 <p align="center">
-  The public application ledger and live discovery memory for projects built with the Programmable v4 Builder.
+  Public applications, open review rules and the discovery ledger for Programmable projects.
 </p>
 
 The Registry gives agents, reviewers, and the Programmable Explorer one GitHub-backed source for what has been
 submitted, reviewed, deployed, made available, suspended, or retired. It never turns a local check, merged application,
 similarity match, deployment, or indexer observation into a safety guarantee.
 
-## The four-repository model
+## Build, apply, review
 
 ```mermaid
 flowchart LR
-  B["Builder-owned project repository"] -->|"six-file application PR"| R["Programmable Registry"]
-  S["Programmable v4 Builder Skill"] -->|"build, check, submit, discover"| B
-  R -->|"bounded live index"| S
-  R -->|"canonical records"| E["Programmable Explorer"]
+  B["Builder-owned project repository"] -->|"six-file application PR"| R["Programmable Apply"]
+  S["Hookbuilder"] -->|"build, check, submit"| B
+  R -->|"open review standard"| V["Review"]
+  V -->|"exact-revision record"| E["Programmable Explorer"]
 ```
 
 - The builder's repository owns the complete project.
-- [`programmable-v4-builder`](https://github.com/0xprogrammable/programmable-v4-builder) owns agent behavior, rules,
+- [`hookbuilder`](https://github.com/0xprogrammable/hookbuilder) owns agent behavior, rules,
   templates, checks, and the GitHub client.
 - This repository owns applications and discovery records.
 - [`programmable`](https://github.com/0xprogrammable/programmable) owns the platform, contracts, and Explorer.
 
+## Open review standard
+
+The selection rules are public. They judge exact evidence, not whether an idea is familiar, fashionable or profitable.
+Unknown platform-owned behavior stays pending; it is not silently called unsafe. A hard block requires a complete,
+revision-bound and independently replayed witness.
+
+Read the [Open Review Standard](docs/OPEN_REVIEW_STANDARD.md), inspect the
+[policy](review/policy.v1.json), or run a public example:
+
+```bash
+npm run review -- review/examples/disclosed-high-fee.json
+```
+
+The local result never signs an approval or grants launch rights.
+
 ## Current registry
 
 [`registry/index.json`](registry/index.json) is the small discovery entry point. Every entry binds one closed record by
@@ -45,10 +60,11 @@ Read the small contracts before integrating:
 - [Review and promotion lifecycle](docs/REVIEW_LIFECYCLE.md)
 - [Legacy intake migration](docs/MIGRATION.md)
 - [Current code-maturity assessment](docs/CODE_MATURITY.md)
+- [Open Review Standard](docs/OPEN_REVIEW_STANDARD.md)
 
 ## Apply
 
-Use the released Programmable v4 Builder. Your complete project stays in your own public GitHub repository. After exact
+Use the released [Hookbuilder](https://github.com/0xprogrammable/hookbuilder). Your complete project stays in your own public GitHub repository. After exact
 confirmation, the Builder opens a draft pull request containing exactly six generated files under
 `submissions/<application-id>/`.
 

docs/CODE_MATURITY.md

@@ -1,19 +1,19 @@
 # Code maturity assessment
 
-Assessment date: 2026-08-02. Scale: 0 absent, 1 initial, 2 developing, 3 established, 4 strong. This is a maintainer
+Assessment date: 2026-08-08. Scale: 0 absent, 1 initial, 2 developing, 3 established, 4 strong. This is a maintainer
 self-assessment, not an independent audit.
 
 | Category | Score | Current evidence | Remaining gap |
 | --- | ---: | --- | --- |
 | Arithmetic and precision | 4 | Registry values use safe integers; the mandatory 10 bps identity is exact and tested | Economic correctness of submitted projects remains outside Registry arithmetic |
-| Auditing and observability | 3 | Exact source, record hashes, immutable history, CI receipts, and public review threads | No independent Registry audit yet |
+| Auditing and observability | 3 | Exact source, record hashes, immutable history, deterministic review receipts, CI receipts, and public review threads | No independent Apply audit yet |
 | Authentication and access control | 3 | Candidate identity binds to GitHub's immutable user id; intake authority is read-only | Remote branch protection must be verified after publication |
-| Complexity management | 3 | Closed schemas, bounded files, generated indexes, separate application and maintenance paths | The vendored intake validator is intentionally large and needs continued differential testing |
+| Complexity management | 3 | Closed schemas, bounded files, generated indexes, separate application and maintenance paths, and one small dependency-free public review engine | The vendored intake validator is intentionally large and needs continued differential testing |
 | Decentralization and governance | 1 | Decisions are public and append-only | Initial acceptance authority is one maintainer; no independent quorum is established |
-| Documentation | 4 | Architecture, discovery, review, migration, contribution, support, and security contracts are explicit | Operational runbooks must stay synchronized with future website integration |
+| Documentation | 4 | Architecture, discovery, open review rules, schemas, migration, contribution, support, and security contracts are explicit | Operational runbooks must stay synchronized with future website integration |
 | Ordering and race resistance | 4 | PR merge parents, base/head commits, repository ids, trees, and stale-base behavior are bound and tested | External GitHub availability remains a dependency |
 | Low-level and unsafe operations | 4 | Blobless bounded Git handling, disabled hooks/filters/submodules, byte/time/process limits, and no candidate execution under privileged CI | OS resource hard stops retain one Linux-only test path |
-| Testing and verification | 4 | Deterministic registry tests plus the complete trusted intake adversarial suite | Model-backed agent evals and an independent penetration review remain outstanding |
+| Testing and verification | 4 | Deterministic registry and decision tests plus the complete trusted intake adversarial suite | Hidden mutation corpora, production runner evidence, and an independent penetration review remain outstanding |
 
 The practical release blockers are remote CI proof, protected-main enforcement, fresh-clone verification, and the
 matching Builder activation. Local green checks alone do not prove those external states.

docs/MIGRATION.md

@@ -11,7 +11,7 @@ Activation requires all of the following:
 
 1. this repository is public at the exact tested commit;
 2. protected-branch checks are enforced;
-3. a released Builder version targets `0xprogrammable/programmable-registry`;
+3. a released Hookbuilder version targets `0xprogrammable/apply`;
 4. the vendored intake validator matches that Builder's application contract; and
 5. `docs/builder/intake-status.json` and `registry/config.json` are changed together from `prelaunch` to `open`.
 

docs/OPEN_REVIEW_STANDARD.md

@@ -0,0 +1,77 @@
+# Open Review Standard v1
+
+Programmable reviews exact project revisions. It does not rank ideas, judge whether a project is interesting, or reject
+unusual tokenomics merely because they are unusual.
+
+The public standard has five decision-critical axes:
+
+1. **Artifact identity** binds the repository, commit, tree, configuration and executable artifact.
+2. **Functionality** checks that declared paths actually execute, including failure, recovery and no-market behavior.
+3. **Disclosure** checks that fees, losses, authority, custody, exits and external dependencies are stated before consent.
+4. **Integrity** reconciles value and authority effects against those disclosures.
+5. **Launch compatibility** checks the separate technical requirements for a Programmable launch.
+
+Advisories are separate. Novelty, complexity, profitability, popularity, a high disclosed fee, an intentional disclosed
+loss, a no-market design, or an unfamiliar architecture is not by itself a blocker.
+
+```mermaid
+flowchart LR
+  A["Exact public revision"] --> B["Deterministic evidence"]
+  B --> C["Open review decision"]
+  C --> D["Separate platform signature"]
+  D --> E["Separate single-use launch permit"]
+  U["Candidate repository"] -. "never receives secrets" .-> B
+```
+
+The public checker ends at the unsigned review decision. It has no production credentials and cannot sign or issue a
+launch permit.
+
+## Decisions
+
+| Status | Meaning |
+| --- | --- |
+| `launch_ready` | Every decision-critical axis is closed for the exact revision. This local result still does not authorize a launch. |
+| `changes_requested` | Candidate-owned evidence or implementation is missing or contradicted. |
+| `platform_analysis_pending` | Platform-owned replay, tooling or external evidence is still missing. Unknown does not mean unsafe. |
+| `blocked_proven_integrity_failure` | A supported universal failure has a complete, revision-bound and independently replayed witness. |
+| `changed_since_review` | The current repository, tree or configuration no longer matches the reviewed revision. |
+
+Only `UNAUTHORIZED_VALUE_DIVERSION` has an automated hard-block replay class in v1. Five additional universal rule
+classes are published in [`review/policy.v1.json`](../review/policy.v1.json), but they remain pending until their dedicated
+replay semantics exist. A model opinion, scanner score, label or incomplete witness cannot hard-block a project.
+
+## Run the public checker
+
+Node.js 20 or newer is sufficient. The checker has no runtime dependencies and never executes a candidate repository.
+
+```bash
+npm run review -- review/examples/disclosed-high-fee.json
+```
+
+The output is deterministic and hash-bound. It is an unsigned local preview with `checkerOnly: true`,
+`launchAuthorized: false` and `independentAudit: false`.
+
+The input and decision formats are public:
+
+- [`open-review-input.v1.schema.json`](../review/schemas/open-review-input.v1.schema.json)
+- [`open-review-decision.v1.schema.json`](../review/schemas/open-review-decision.v1.schema.json)
+
+## Hard-block proof
+
+A hard block requires all of the following:
+
+- the exact repository, commit, tree and configuration;
+- a reachable transaction or state sequence;
+- affected actors and value;
+- the violated property;
+- a deterministic reproduction;
+- an independent replay; and
+- a complete witness supported by the current policy version.
+
+Suspicion is not proof. An incomplete witness remains pending. A new revision receives a new review.
+
+## Authority boundary
+
+This repository publishes the standard, schemas, deterministic preview engine, examples and public application ledger.
+Production signing keys, credentials, isolated runners, hidden mutation corpora and launch-permit authority are not
+public application data. A signed platform decision and a later launch permit are separate steps.

docs/REVIEW_LIFECYCLE.md

@@ -1,13 +1,15 @@
 # Review and promotion lifecycle
 
-The public lifecycle is deliberately non-automatic.
+The public lifecycle separates deterministic review from launch authority. The current public policy and preview engine
+are documented in [Open Review Standard v1](OPEN_REVIEW_STANDARD.md).
 
 | State | Evidence | Meaning |
 | --- | --- | --- |
 | Prepared | Local six-file package | No GitHub action occurred |
 | Submitted | Draft application pull request | Public review thread exists |
 | Intake passed | Trusted check is green | Package shape and exact public evidence passed known checks |
 | Changes requested | GitHub review state | Builder must update the exact application revision |
+| Review ready | Public checker decision | Critical evidence is closed for one exact revision; no launch right exists yet |
 | Accepted | Maintainer acceptance record | One exact source revision may be promoted |
 | Deployed | Deployment evidence | Contracts or services were deployed; not automatically available |
 | Available | Platform release evidence | Programmable currently exposes the project |

docs/builder/PUBLIC_GITHUB_PR_BETA.md

@@ -1,7 +1,7 @@
 # Public GitHub application intake
 
 The complete project stays in the builder-controlled public GitHub repository. A draft pull request to
-`0xprogrammable/programmable-registry:main` carries exactly six generated files under one
+`0xprogrammable/apply:main` carries exactly six generated files under one
 `submissions/<application-id>/` directory.
 
 The intake is `prelaunch` until a matching Programmable v4 Builder release activates this repository. Existing pull

package.json

@@ -1,6 +1,6 @@
 {
-  "name": "@programmable/registry",
-  "version": "1.0.0",
+  "name": "@programmable/apply",
+  "version": "1.1.0",
   "private": true,
   "type": "module",
   "engines": {
@@ -9,17 +9,18 @@
   "scripts": {
     "generate": "node scripts/generate-registry.mjs --write",
     "check": "node scripts/verify-repository.mjs",
+    "review": "node review/cli.mjs",
     "test": "node scripts/verify-repository.mjs",
     "test:intake": "node --test --test-concurrency=1 scripts/test/verify-public-hook-application*.test.mjs",
     "test:registry": "node --test test/*.test.mjs"
   },
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/0xprogrammable/programmable-registry.git"
+    "url": "git+https://github.com/0xprogrammable/apply.git"
   },
   "bugs": {
-    "url": "https://github.com/0xprogrammable/programmable-registry/issues"
+    "url": "https://github.com/0xprogrammable/apply/issues"
   },
-  "homepage": "https://github.com/0xprogrammable/programmable-registry#readme"
+  "homepage": "https://github.com/0xprogrammable/apply#readme"
 }

registry/config.json

@@ -2,10 +2,10 @@
   "activeIntake": {
     "baseBranch": "main",
     "directory": "submissions",
-    "repository": "0xprogrammable/programmable-registry",
+    "repository": "0xprogrammable/apply",
     "state": "prelaunch"
   },
-  "historyVersion": "1.0.0",
+  "historyVersion": "1.1.0",
   "legacyIntake": [
     {
       "baseBranch": "main",
@@ -19,5 +19,5 @@
     "registry/projects/stock-paired/project.json"
   ],
   "schemaVersion": "1.0.0",
-  "updatedAt": "2026-08-02T12:00:00Z"
+  "updatedAt": "2026-08-08T06:30:00Z"
 }

registry/history/1.1.0.json

@@ -0,0 +1 @@
+{"generatedAt":"2026-08-08T06:30:00Z","records":[{"id":"classic","path":"registry/projects/classic/project.json","sha256":"sha256:e39276a06f6e6a7307dadb5fbe3e7f4163aefc69590c412add16462ab485ad34","status":"available"},{"id":"deep","path":"registry/projects/deep/project.json","sha256":"sha256:1d97c8c47886cea2324d88a9a2de2e2e573d147d4bfb0a73ec8d361bc776ba2f","status":"design"},{"id":"stock-paired","path":"registry/projects/stock-paired/project.json","sha256":"sha256:3721379ecb6bb351c5c99d155251842a1be05891d2cf0cece00ac94b33dd925f","status":"candidate"}],"registryDigest":"sha256:a3880dccd6d1fbcd3e7e5de73cdc244ede2ce3b7a5c733e8f99981248933e2bf","schemaVersion":"1.0.0","version":"1.1.0"}