HIBS-HORIZON · Consequence Control
HIBS-HORIZON orchestrates the R1–R8 substrate, forensic case materialization, Consequence CI gates, and industry expansion (OTel, MCP guard, CAP draft) from a single pinned assembly. Policy binds to the exact operation; evidence survives crash ambiguity; buyers verify at named commits — not from a demo narrative.
Assembly 1d044a7 · CCP pin f1ffe2e ·
hibs-standalone-control-plane ↗
HIBS-HORIZON has two distinct buyer motions. Do not combine them in a single pitch; each has a different budget owner and proof requirement.
Buyer: VP Eng, platform lead, DevSecOps.
Pain: PRs ship consequence drift — deploy duplicates, webhook mismatches,
blast-radius leaks — that unit tests and SAST miss.
Proof: consequence-ci-qualify.sh, S16/S28 corpus bundles.
Fixture + SchemaOnly boundary · not live API proof
Buyer: CISO, IR lead, compliance / audit.
Pain: Post-incident, logs cannot prove what was known when, what diverged,
or what would have held.
Proof: Assurance Graph Lab — ConsequenceCaseV1 bundles,
hibs-verifier explain, counterfactual S29.
Fixture Track C · CredentialedLive monthly boundary (S21/S25)
Source: docs/BUYER-WEDGES.md ↗
Canonical orchestration repo pinning Store, Replay, CCP, Passport, Stream, CrashStore,
qualification harness, and Horizon II adapters. Clone via clone-assembly.sh;
verify via data-room-verify.sh.
Status: assembly @ 1d044a7 · portfolio self-check green · data room indexed
General control-plane pattern: policy, authority, receipt, commit/effect, reconciliation,
and review. Pinned at f1ffe2e on integration/r1-r8.
Live GitHub adapter, MCP gateway with consequence guard profiles, OTel semconv bridge.
Status: integration/r1-r8 · forensic + consequence-ci tiers wired
Forensic case materialization F1–F12. LATEST bundles for S09–S16 Track C verticals,
S20 finance_advice guard, S25 reconcile, S27-q3 insurance/bilateral SchemaOnly,
S29 counterfactual. Run forensic-rigorous-qualify.sh.
Status: local forensic-rigorous 43/43 PASS (2026-09-07 stamp)
Durable reserve → authorize → dispatch with PossiblyStarted crash recovery,
tenant-bound authentication, dual evidence chains, and offline verification.
Single-host SQLite/WAL qualification boundary.
Status: ui-hibs-labs.hostile-execution-demo · qualified single-host slice
Runtime authority for AI agent and MCP tool calls. Allow is not execution authority
unless the exact plan has a valid receipt. MCP guard profiles gate tools/call
with strict-billing envelopes.
Status: MVP / qualification candidate · monorepo + standalone exports
Five governors (MG, FG, CG, IG, BG): ledger-backed spend, policy, reconciliation, attestation probes, and qualification-drift scanning. Kernel conformance K1/K3/K4/H1/M1 shipped; forensic registry 30/30; SKU catalog parity 9/9 active.
Status: codex/hcap-ccp-publication @ 486a0f49 · Docker spine 128 passed · CG 99 · FG 144 · IG 146 · ledger 7 · skipped cases documented per governor
Incident reconstruction for hostile cases, near misses, and disputed effects. Compare operation/evidence roots, surface divergence, link Replay capsules.
Status: internal MVP · not a hosted forensic service
Portfolio scanner preserving verified baseline commits while reporting
QUALIFICATION_DRIFT when observed local HEAD differs.
Status: scanner evidence discipline · not external attestation
Repo hibs-connect-reconcile ↗
@ 00258d6 — local Rust integration fabric with a 15-phase proof-pack
(hibs-local-proofpack.hibs). CI passed (run 34017943199).
hibs-proofpack fixture-report and verify; included in make tamper-negative.
Boundary: local Rust proof only. Not live provider integration, external attestation, or production qualification.
Sibling hibs-connect holds transport-neutral integrity contracts (SourceEnvelope, Q-CONNECT).
Index: docs/standards/INDEX.md ↗
request → policy → plan → authority receipt → execution boundary → effect receipt → reconcile → evidence review → replay
PossiblyStarted is first-class: a timeout does not silently become retry permission.
Reconciliation resolves to match, divergence, or unresolved — without inventing observations.
M&A index over the assembly repo — nine sections, commit-bound evidence, explicit honesty
boundaries. Run scripts/data-room-verify.sh before sharing; start with §1 Executive
and §7 Honesty boundaries.
Fixture PASS is not production certification. GitHub Actions on the assembly may be blocked on account billing — local qualification stamps are documented as CI substitute.
Eight product briefs under docs/hibs-edge/specs/ — documentation complete; implementation varies by product.
| Tier | Products | Spec |
|---|---|---|
| T1 Revenue | Lead Rescue, LDPE | ✅ |
| T2 OSS | Nexus, API Sentry | ✅ |
| T3 Enterprise | ABCP, Sovereign, Ghost | ✅ |
| T4 Strategic | ZK / HCG / APEP | ✅ diligence-only |
Independent pre-revenue software R&D. Working source, local qualification, and forensic case bundles are not claims of ARR, customer adoption, SOC 2, payment-institution status, or fitness for a buyer's regulated production use without separate diligence. Phase C buyer VPC and signed letters remain external evidence gates.