Evidence
Proof log
Every claim loot makes is backed by a re-runnable script whose captured output is committed to the repo — the proof is content in the repo the thesis is about. Below is a card per proof over its verbatim run output.
loot hosts loot — a sealed path is invisible to a non-keyholder
What this proves: loot's own private design docs live in its public repo and travel through the same relay — a fresh clone without the key materializes the public tree and cannot see the sealed path, while the keyholder reads it. Visibility is per-content, enforced by key custody.
(1 sealed path(s) skipped — request a grant to access them) PASS: the agent's clone does NOT materialize the sealed path (docs/pitch/zk-host.md absent) PASS: the agent's clone DOES materialize public content (CONTEXT.md present) PASS: loot reports sealed path(s) skipped for the agent (it holds the ciphertext, not the key) PASS: the dev's working tree HAS the sealed path present and readable ALL CHECKS PASSED -- the sealed path is dev-visible, agent-invisible.
Hard embargo — no clock, escrow, or patched binary reads it early
What this proves: an embargoed change stays unreadable until the relay's own clock passes reveal_at. An adversarial holder with an advanced clock, direct .loot inspection, and a binary with every time gate removed all fail — then the read succeeds after release. The key bytes were never on the holder's machine.
PASS: advanced holder clock does not release the key (relay clock gates, not the holder's) PASS: the holder holds only ciphertext: the plaintext secret and key material are absent from .loot PASS: a client with the time gate removed still cannot read (no key bytes to bypass) PASS: the relay withholds the grant from its mailbox until its own clock passes reveal_at PASS: after reveal_at the relay delivers the key and the holder reads the embargoed change normally ALL CHECKS PASSED -- embargo is holder-adversary-proof against the live relay.
Concurrent agents converge — no side silently dropped
What this proves: two agents editing the same repo reconcile through docks and the relay's fork-collapse. Disjoint work converges, a same-line edit surfaces as a machine-readable conflict (never a silent loss), and a path one side can't decrypt is relayed as ciphertext rather than merged.
PASS: dock-a's disjoint file converges into the harbor (= row) PASS: the concurrent same-line edit surfaces as a Conflict (C) -- not silently dropped PASS: after resolve, no conflicts remain (porcelain is empty) PASS: agent's apply pulls in dev's concurrent file (fork collapses -- dev's side not dropped) PASS: the restricted path agent can't open surfaces as RelayedUnmerged (R) -- carried, not merged ALL CHECKS PASSED -- concurrent convergence proven, both acts.
Grant then maroon — access is handed out and cut off deliberately
What this proves: a restricted path starts unreadable to a peer; a sealed, signed grant lets them read it; a hard maroon re-seals it so their next pull carries a key they no longer hold. Sharing is a key handoff, and revocation is real.
PASS: before any grant, the agent cannot read the restricted path (secret.txt absent) delivered sealed grant for 'agent' via relay PASS: after the sealed grant, the agent files the key and reads the restricted content hard-marooned agent from secret.txt (new oid: 36683014) PASS: after the hard maroon, the agent's pull carries a seal it cannot open (no key)
Divergence from ordinary work — the ! marker, abandon, and undo
What this proves: two identities amending the same change produce two live versions under one durable handle — rendered with a ! marker, kept flat (no phantom merge), collapsed by loot abandon, and restored by loot undo. Nothing is ever destroyed.
mzlxpytq! 57a84e20 add feat 7bb5b8c4… mzlxpytq! 2f370248 add feat agent PASS: DIVERGENCE: log renders the ! marker on the divergent change_id PASS: DIVERGENCE STAYS FLAT (#203): no per-path conflict -- converge minted no merge PASS: DIVERGENCE: two live versions listed under one durable handle (57a84e20, 2f370248) abandoned version 57a84e20 — its change id keeps the remaining live version(s)
A working day driven loot-first — git main is a projection
What this proves: loot leads its own development. This very evidence file originated in loot's working tree, was reviewed on GitHub as projected unsigned WIP, and was landed by loot new — with git main projected downstream. No git commit created it.
The destination proof for wayfinder map #148 ("flip the agentic workflow loot-first, git downstream"). This document IS the day's unit of work: it originated in loot's working tree, was reviewed on GitHub as a PR built from projected unfinalized loot WIP, and landed by `loot new` — with git main projected downstream. If you are reading it on git main, the workflow worked: no git commit ever created this file.