01 / Where did it come from?
Each source keeps its own identity. Retained observations, a separate analyst run and public references are not one joined record.
Three demonstrations, one guided civilian inspection story. Explore collection, analyst review and assurance as distinct chapters. Pause at every handoff to see what is known, what is proposed, and why a release can be withheld.
Illustrative walkthrough · no live execution. Retained observations and the separate historical analyst run are not connected by a verified handoff.
Synchronized explanation, not an execution log. The permission-boundary illustration follows the synthetic reference style; it is not evidence of a retained assurance run.
Playback changes the explanation only. It runs no inspection, model, challenge or command. Space: play/pause · Left/Right: step · Home: restart (when this walkthrough has focus).
Questions to ask, not a coverage score or certification.
Each source keeps its own identity. Retained observations, a separate analyst run and public references are not one joined record.
Recorded digests identify retained files. A matching digest does not prove that the original observation was true.
Capture authenticity is not established. This walkthrough cannot repair that missing proof.
The observations are historical; stale timing and accuracy uncertainty remain relevant.
The public reference has no location or time join to the observation. The diagram is illustrative only.
The retained analyst execution has no demonstrated admission link to these observations.
The three branch explanations are prepared examples, not new model results.
An explicitly injected label conflict withholds the simulated release instead of hiding disagreement.
Insufficient scene association also withholds release. A reported experimental continuation lacks a verified real-refusal run.
A separate synthetic consumer path reported acceptance, with unresolved assurance basis and incomplete qualification. No combined live workflow is established.
A retained DP observation, a real historical Hermes response, and public land-cover references are available. Their existence does not prove they belong to one mission.
Dashed edges are proposed handoffs, not traffic or a flight path. This diagram uses no observed coordinates or geographic transform.
CSV rows, not distinct devices. Stale data and accuracy uncertainty retained.
Historical real execution; unrelated synthetic inventory input.
AnnualCrop, Forest, River. No location/time/mission identity.
Three cases share one prepared review path. These are expectations, not model results or executed commands.
UXS reports fresh synthetic capture → real Vision 0.1.4 → t318u consumer → t349u Gate → one simulated mission command. Exact artifacts have not been locally inspected. This does not connect real DP, Hermes or HF inputs.
Reported sequence: evidence 16:12:30.518 → decision 16:12:31.480 → simulated command 16:12:31.483 → session close 16:12:31.485.
Unauthorized retry; CPU limit 300→600; window 2000→5000 ms; two process-local random token keys; omitted isolation probes; unverified Vision commit; extra Gate stub-sink line; nonce in six retained files. No raw nonce/key files are included here.
Real refusal was not run. Corrected positive + real-refusal requested; no new run reported. Functional behavior is not conformance, acceptance or live production.
16:33:50.898–16:33:51.249 · exit 0 · 20 accepted / 0 refused · gateway CONSISTENT · zero signing-sentinel hits. Root 442ad3b6 pins reported verified.
BASIS_UNRESOLVED · insufficient evidence · qualification NOT_ESTABLISHED. Checks: 27 undetermined, 3 satisfied, 1 not applicable; custody null.
FX-DP01.kml synthetic fixture, not real Pixel91bb97f8 and not a real DP→Hermes connection. Exact bot-box records have not been inspected locally. PB5 subset 6/6 was reported executed; no full-phase closure is inferred.
Retained t349u positive case · October 24. The synthetic workload finished before the challenge. The later decision gated a local stub write.
Historical refusal/deadline cases added no accepted stub-sink event. This does not prove live mission control.
Evidence bytes, source declarations, model inference and challenge verdicts are different things.
resaro/eurosat · revision a4d2b7a4862fc91c1e16af35c38c5c9ff01cacf0 · MIT-tagged. Original EuroSAT: Helber, Bischke, Dengel & Borth (2019), IEEE JSTARS 12(7), 2217–2226. Upstream EuroSAT/Copernicus attribution and terms reference retained. No location, time or mission identity in the selected schema.
Private coordinates, radio identifiers, source files and local filesystem paths are excluded from this build.
✓ Retained real DP CSV/KML verified against intake hashes
✓ Exact historical Hermes input/output digests verified
✓ Pinned public HF file locally hash-verified
✓ One prepared three-case review contract
✓ Self-contained redacted browser surface
DP→Hermes consumption, Steward admission and capture links
Real-input VLM / challenge linkage; corrected continuation and real-refusal proof
Model call count, token enforcement and hard cost bounds
Exact seven-view Mission UI source remains unrecovered
Published static preview; remote-client validation does not establish workflow assurance