Protocol

The application governs mission state. No AI model may simulate, substitute for, or speak for another required seat.

Core hard rule

No required live-seat proof + no required mission-specific contribution receipt = no mission state transition.

A contributor cannot satisfy another contributor's lane. If a required seat is unavailable or blocked, the mission stays BLOCKED.

Anti-substitution mapping

Claude → Anthropic
ChatGPT → OpenAI
Gemini → Google
Manus → Manus

If the issuing provider does not match the required contributor, the receipt is rejected and marked SUBSTITUTION REJECTED.

State authority

AI providers are workers only. They cannot mutate mission state. Only the control plane transitions state, and only after deterministic gate evaluation.

draft→confirmation_pending→opening→active→blocked→close_pending→complete

For this proof, the mission remains BLOCKED until both gate sets pass.

Proof separation

· Roll-call proof establishes liveness only and never counts as contribution proof.
· Test-harness receipts are segregated and can never satisfy a live mission gate.
· Missing proof is never auto-filled, inferred, or simulated.
· Every receipt is bound to mission, branch, step and action.