# Engineering Review
## Review gate
The design is coherent enough for an executable research contract, not production.
Its best property is explicit refusal under epistemic ambiguity. Its largest risk
is merely relocating trusted intent into the viability authority or checker.
Before M1, review must demonstrate: canonical envelope semantics, bounded and
complete hypothesis enumeration, parser independence, deterministic replay, no
secret leakage, atomic simulated actuation, and baseline parity on benign cases.
Reject implementation shortcuts that share planner/checker interpretation, treat
signatures as truth, hide refusal rates, or silently expand the fault model.