v0.2.0 — four more guards (written 28 July 2026)

Four more guards, from a month of running this across six machines.

Written 28 July 2026, tagged 4 August 2026. The content is the July commit; the tag was never cut at the time, and it is recorded that way rather than backdated.

Every guard here has the same shape as the first three: something the protocol trusted without checking. The list is written from incidents, not from imagination.

New guards

• Arbiter election (reference/protocol_guards.py) — the tie-break role no longer dies with the machine holding it. Elected from an ordered list by presence freshness, computed identically by every peer so they agree without messaging, and promoting only on positive evidence of life: a stale stamp fails over, an absent one does not. Gated behind an armed flag so an un-upgraded peer behaves identically. Announced once per episode, not once per tick.
• Proof grading — a VERIFY proof is graded proven only when it carries the residue of an action: an exit code, a hash, a moved counter, a before/after pair. Armed from a timestamp; earlier history is grandfathered rather than retroactively downgraded.
• Risk tracking — a track (financial / secrets / outbound / canon / infra / general) classified independently of the tier the proposer chose, because a tripwire catches dangerous words but not a dangerous category carried at a low tier. Ships in shadow with a deliberately falsifiable verdict and a report that says whether the guard earned its keep.
• Machine identity (reference/fleet_sign.py) — Ed25519 detached signatures via ssh-keygen -Y, one public key file per machine (single writer, no conflicts), a revocation list, allowed-signers assembled in memory at each verify. Unsigned (a rollout gap) is kept strictly distinct from bad (tampering), and bad is refused even during the dark phase.

Two Windows scars are documented in place: two ssh-keygen builds on PATH where one hangs on -Y sign, and the newline="" that stops CRLF armor from being corrupted into a false "tampered" verdict.

Proof

Both new files self-test (python <file>.py selftest), and fleet_sign.py does a real signature round trip including a tampering check — a signature selftest that never fails a verification proves nothing.

docs/PROTOCOL.md §6a and FOR-ROBOTS.md carry the write-up, plus a "what is here versus what we run" section: the reference is sanitized and trimmed for reading.

Full Changelog: v0.1.0...v0.2.0