# Francis Build Week judge scorecard

This is an evidence map, not a self-awarded score. It maps the four equal OpenAI
Build Week judging criteria to the smallest public artifacts that support each
claim.

## Judge Francis in three minutes

1. Watch the [2:30 4K final demo](https://youtu.be/fIhdQmG2h8g).
2. Open the [Execution Flight Recorder](https://ap3pp3rs94.github.io/Francis-Build-Week-2026/judge-viewer/).
3. Select **LOAD OFFICIAL FROZEN PROOF** and confirm one run, useful result
   `pilot-001`, replay denied, zero containers remaining, correlated identity,
   and five matching receipt hashes.
4. Select **RUN 3 ATTACKS AGAINST THIS PROOF**. The same verifier must reject
   altered receipt bytes, reusable authority, and a hidden leftover container.

The adversarial challenge derives temporary copies in browser memory only after
the exact official bundle hash passes. It does not mutate the official bundle,
run Francis, start Docker, or create new evidence.

## 1. Technological implementation

### Claim

Francis performs useful local agent work under exact, consumable authority in a
constrained container, independently verifies the result, removes the exact
runtime, denies replay, and retains verifiable receipts.

### Evidence

- `src/francis/governance/pilot_scope_lease.py` implements the one-run scope
  lease and consumed-state contract.
- `src/francis/managed_copy_container_isolation.py` binds approvals, identity,
  fixed runtime inputs, Docker constraints, readiness, output verification,
  receipts, and cleanup.
- `infra/managed-copy-runtime/Dockerfile` defines the fixed non-fixture runtime.
- `tests/unit/test_managed_copy_container_isolation.py` exercises timing,
  cross-namespace identity, tampering, cleanup, and real-Docker proof behavior.
- `proof/final-proof-bundle.json` is the frozen redacted result of authorized run
  `mciso2-20260717T220607Z-r5`.
- `judge-viewer/verify_proof_bundle.py` provides a dependency-free independent
  verifier for the frozen bundle.

### Falsifiable result

The proof is accepted only when the lease is consumed, replay returns
`api_permission_denied`, the useful result exists, host and namespace identities
are correlated, zero proof containers remain, and every embedded receipt byte
matches its declared SHA-256.

## 2. Design

### Claim

Francis keeps proposal, permission, execution, denial, cleanup, evidence, and
uncertainty visibly separate instead of collapsing them into one success state.

### Evidence

- The viewer begins at `NO BUNDLE LOADED`; it does not embed sample success data.
- Official verification requires the exact published bundle SHA-256 before any
  green state appears.
- Manual bundles remain source-unverified even when internally consistent.
- The adversarial challenge keeps the verified proof visible while showing why
  each weakened copy is rejected.
- The truth-boundary panel repeats what the bounded pilot does not prove.

### Human consequence

Without Francis, a capable agent may retain authority longer than the task that
justified it. Francis makes that authority exact, consumable, and provably gone.

## 3. Potential impact

### First user

A technical founder managing multiple AI agents alongside sensitive local work.

### Recurring job

Permit one bounded task against the correct tenant, verify the useful result,
remove the runtime, prevent permission replay, and retain evidence that can be
inspected later without trusting the model's narration.

### Expansion path

The same contract can govern local development tools, file operations, private
knowledge work, credentials, desktop actions, and other high-consequence agent
capabilities. The current submission proves one narrow vertical and does not
claim that those broader paths are complete.

## 4. Quality of idea

### Thesis

**Proposal is not permission.**

Most agent systems optimize the model-to-tool path. Francis treats authority as
a separate, consumable object and treats denial, cleanup, and receipts as product
outputs rather than error handling.

### Memorable comparison

Ordinary agent platforms optimize for what an agent can do. Francis governs what
it may do, proves what it did, and prevents it from doing the same thing twice.

## Build Week eligibility and Codex disclosure

Francis existed before Build Week. `BUILD_WEEK_DELTA.md` records the pre-event
baseline, eligible event-window commits, proof candidate, measured corrections,
and explicit limitations.

Codex and GPT-5.6 were the primary engineering collaborators for the event
extension. Austin Peppers retained product direction and authority decisions.
Named Codex sessions such as ATLAS are replaceable build and review roles, not
independent products or Francis runtime authorities. The roadmap defines
direction; the completion ledger preserves validated commits, receipts,
blockers, and handoffs across session replacement.

## Truth boundary

This is a synthetic, non-sensitive local pilot. It does not prove production
multi-tenancy, persistent actor grants, credential access, live Orb execution
authority, external network action, or Stage 18 closure. The viewer validates
the published bundle's structure and embedded receipt bytes; authenticity still
depends on the authorized export path and published bundle hash.