Clossys

Declared reality made actual: an idempotent manifest engine and machine verification, a deployment surface contract with read-only platform adapters, a toolchain pin (runtime, package manager, build order), the liveStateSurface contract and shared CI gate

Provider-neutral sponsor assessment, pre-work gating, and session contracts for Foundry engagements.

Judges a change before it lands: a secret-scan attempt (attested, or actually run via the ./secret-scan subpath's verified gitleaks acquisition), a change's task record, its review evidence, and policy drift, each reported as satisfied/violated/indetermin