From silent submission to operator-governed in four iterations

Validator trajectory

Four iterations, every run ID public

Each iteration was a real prod-MCP architect.validate call. Iter2 closed two of the four P0 blockers but the score plateaued at Iter3 because the architect's prompt-deduplication detected the change-summary payload as too similar to the prior baseline. Iter4 re-fired with surgical lease-fence + bidirectional-audit changes and the score jumped 26 points to 100/A.

Principle scorecard

Every flagged principle, Iter1 vs Iter4, at a glance

Four principles fired as production_blocker / high_risk on the Iter1 baseline; the Iter4 run closes all of them. The narrative below walks through each, this table is the scannable summary.

Refactor scope

Iter1 ungoverned vs Iter4 production-ready

Numbers verbatim from the package source. The agent was already feature-complete at Iter1 (typed governance contract, approval gates, hash-chained audit ledger), the four iterations closed deeper seams: redaction-aware audit boundary, durable lease + watchdog, frozen policies, end-to-end evidence verification.

Before / After

# Iter1 audit ledger row (excerpt)
{
  "kind": "tool_call_completed",
  "data": {
    "action_name": "click",
    "target_text": "Submit payment of £21,500 to vendor X",
    "action_payload": {"x": 412, "y": 580, "card_number": "4111-1111-1111-1111"},
    "result": "executed:click:Submit payment of £21,500..."
  }
}

# In-process asyncio task with no durable handle
# Process dies → run stuck in IN_PROGRESS forever
# verify_audit() returns True even when evidence has been swapped

# Iter4 audit ledger row (same event, redacted)
{
  "kind": "tool_call_completed",
  "data": {
    "action_name": "click",
    "target_text": {"_redacted": true, "digest": "8c4f...", "value_kind": "str", "size": 38},
    "action_payload": {"_redacted": true, "digest": "a91b...", "value_kind": "dict", "size": 84},
    "result": {"_redacted": true, "digest": "f2d3...", "value_kind": "str", "size": 47}
  }
}

# verify_audit recomputes sha256(evidence.value_json):
# three-way bind (recomputed == value_digest column == chain marker)
# plus bidirectional check (every marker has evidence ⇔ every evidence has marker)
# Tampering either side breaks certification.

Validator output

What the validator found

The Blueprint MCP ran architect.validate against the Iter1 baseline. Four P0 production blockers identified, each one a path for an irreversible action to fire without operator authority.

How each P0 was resolved

What the iterations fixed

Each iteration closed at least one production blocker. Iter4 is the first run that crosses 80/A/production_ready, every P0 finding above is now aligned at 100/100.

Re-validation result

After Iter4: architect.certify confirmed production_ready

The Iter4 implementation was re-validated and then certified in the same prod-MCP session. Cert outcome: confirmed_production_ready. The badge is live and the readiness review is publicly inspectable.

Calculated ROI

Same metrics, same calculator powering every case study

Derived deterministically from this case study's profile (4 iterations, irreversible-financial blast radius, autonomous workflow, under compliance) via /lib/case-study-roi.ts. Numbers directly comparable to the other case studies.