Checkpoint 2 — TEPP Omega has landed

In one paragraph

TEPP Omega is written, verified and landed as its own repository at /home/kabouter/Production Environment/TEPP-Omega: one commit (4a30364, TEPP Omega: the specification), 32 files, nothing of staging in it. It holds 22 normative parts (1,240 identified statements, glossary and index of 232 defined terms included), the conformance contract, vector format and 19 vector families (151 statements), the six starter profiles byte-exact, and four rationale documents. Every rule-bearing source entry maps to a statement (2,302 of 2,302), every statement traces to a source anchor or is marked made-explicit, and two independent rounds of adversarial review ran over it before landing. 156 questions stay open, each carried in the text at its most fail-closed reading and marked in staging; they are the maintainer's to rule, and the table at the end lists them with the statements that carry them.

How this run came about

You asked, on 2026-09-24, to continue the Gamma work as the Omega run, in a new folder and repository, reusing what was done, and to see whether a specification release could be reached without stopping. So:

• TEPP-pre-Omega is a clone of TEPP-pre-Gamma at 5db183f with its whole history (OMEGA.md records the fork). TEPP-pre-Gamma, TEPPv5 and TEPP-Alpha were not written to; pre-Gamma is still clean at 5db183f.
• Reused as they stood: the source, the complete and reviewed ledger, your checkpoint-1 answers (D-C1-2, D-C1-9, D-C1-10 and the nine accepted recommendations), the 136 questions then open, the drafting pipeline, and the 25 part files the Gamma line had drafted (parts 00 and 02–20, 1,115 statements).
• Model note: parts 00 and 02–20 were drafted by Fable 5.1 in the Gamma line. Everything from 2026-09-24 — the remaining parts, consolidation, both review rounds, every verification, every fix and the landing — ran under Opus 5.5, so the inherited drafts were reviewed by a different model than the one that wrote them.
• The name. The deliverable calls itself TEPP Omega, the way the Alpha and Gamma lines name theirs. It appears once in the README and once in the introduction; if you want another name it is a two-line change.

What was done in this run

1. Drafting what Gamma had not reached (11 drafters): part 01 (terms), part 21 (what TEPP does not define — 101 prohibitions, present tense), the security and privacy traces with rationale/security.md and rationale/privacy.md, the three conformance documents, rationale/design.md, rationale/household.md, the README and the profile walk-through.
2. Consolidation (7 fixers with disjoint files, then 2 follow-up agents): two relocations (the uppercase reference-tag reading into the surface part; the known-missing disposition into the construct lifecycle), duplicate statements reduced to references at their owner, misdirected references corrected, four glossary terms added where the source used a term normatively and never defined it (demand, household / sealed / open channel). 20 new questions logged (Q-139 … Q-158), 32 older ones widened, and every draft brought to carry its question's provisional reading.
3. Review round 1 — 71 reviewers: 20 source-side (every SPEC and CONFORMANCE chunk, sentence by sentence), 43 specification-side (every statement against its anchors), 3 on the derived documents, and five sweeps (NIP claims, scope, legacy wording, terms, duplicates). They reviewed a copy seeded with 36 planted defects: all 36 were reported. The 131 findings not about plants went to 11 verifier batches, each with a known-false decoy; verifiers start from refuted. No batch confirmed its decoy. 92 real defects confirmed (plus five confirmations of one planted defect, which the drafts never contained), 34 refuted. Six fixers applied them.
4. Review round 2 — the same 71 roles, fresh agents with no sight of round 1, 41 planted defects (40 reported). Findings not about plants fell from 131 to 46; 4 batches, no decoy confirmed; 22 confirmed, 24 refuted. Three fixers applied them, and three auditors — default verdict unfaithful — checked every changed hunk: 41 faithful, 3 corrected.

What the confirmed defects were, across both rounds: mostly presentation — a reference pointing at a neighbouring statement (38), a rule stated twice (25), a term used in a second sense (18), text binding without an identifier, a statement carrying two rules, a history word (5). Substantive ones: four overgeneralisations (the introduction's ceremony sentence, "denies nothing" for an invalid permission, a conformance item widened to every finding, an unscoped non-feature); a cap row, and a non-feature, that flattened the nested-opaque wall into a deny; a conformance item marked ⊕ that the source leaves unmarked (it would have doubled the vectors required); six places an implementer would have had to guess (an overview contradicting the degradation rules, the kind0 clause at a space, a self-contradicting ordering sentence, three vector-format gaps); a household clause inside an identified tooling statement (scope); six rationale sentences stronger, weaker or wider than the rule they describe, one of them claiming traces that do not exist; and two NIP citations. No keyword strength differed from the source in the drafts: every raised or lowered keyword the reviewers reported was a planted defect. No reviewer in either round found a lost rule, a wrong number, or a silently settled ambiguity that survived verification.

What was verified, and how

What needs your judgment

The open questions. 156 are open; the full table is below. Twenty are new in this run (Q-139 … Q-158). Those most worth your time first:

• Q-069, Q-101, Q-114 and Q-130 disagree with each other about how many unenforced findings a decrypt request without its enclosing event emits (trace only; no verdict turns on it). The draft follows Q-069/Q-101; the notes on all four say so. They want one ruling.
• Q-022 and Q-107 (type errors; rebroadcast: null): carrying Q-107's fail-closed reading makes a JSON type error fail the whole payload, which narrows Q-022's permission-level rows to values of the right type. They want one answer; so, per the drafter of part 05, do Q-018, Q-019 and Q-020, whose provisional readings make minimal guardian documents refuse.
• Q-090: the no-record advice for sealed sends is now stated completely (TOOL-037) under its provisional reading; the source's own sentence was incomplete.
• Q-056 (which high-water marks survive store loss) carries the largest departure from the source's wording in the construct part.
• Q-033: a deny-side list over perListCap refuses the assembly, against §7's cap sentence.
• Q-142 adds a kindless resolution run for content text beneath a layer that has a kind, and Q-158 reads "the signer's declared relays" as the signing locus's own list; both are the fail-closed choice and both change verdicts under their other reading.
• Q-152 … Q-156 concern the conformance vector format: nine findings have no field shape and the fan-out cap has no configurable name, so byte-exact vectors cannot be written for those corners until names are chosen. Nothing was minted.

Not questions, but yours to confirm:

1. Length. The normative parts run to about 74,000 words against the source SPEC's 36,600. Obligations are held equal by the trace; the words come from explicit procedures, one rule per statement, glossed references, tables and kept candor (about 38k in statements, 9k tables, 11k notes, 13k overviews and connective text). MISSION asks for "smaller in words". A concision pass — removing restating notes, glosses and connective text, never a rule — is possible, but it would need its own review round. Your call whether that comes before 1.0.
2. The walk-through. The source says rows 6 and 13 of the starter composite's table are "the same instant and the same verdict with and without the tag"; they are not (Fri 23:00 and Sat 12:00). The pair that fits is rows 13 and 14; the walk-through says so.
3. Conformance. "A vector changes only together with its specification edit" was dropped as a rule about how the corpus and specification evolve (D-C1-10). "Regeneration with no diff is the regression check" was kept; it sits close to testing (D-C1-2).
4. "No request kind, ever" is kept with "ever", as the load-bearing prohibition MISSION names.
5. Informative corrections, no behaviour changed: §22's residual 5 says "the author's own relay" observes a hint fetch — the rationale says the hint relay observes, which is the author's own only where the referencing guardian wrote the profile; §17.3's advice that an allow-shaped set closes over a client's AUTH is scoped to the global set, the only set that can; DESIGN's overstatements the earlier scan found (X1, X4, X5, X8, X9) are stated at the specification's strength.

A correction to the staging record: the message of commit 13d3166 says the first fix pass restored "keyword strengths (seven raised, one lowered)". That was read off the finding kinds without checking; the seven were five confirmations of the planted defect and one conformance marker confirmed twice, and the one "lowered" was a household rationale sentence.

Where things are

Appendix — the open questions and where each provisional reading is carried

Statement ids are those of the landed specification. The reading shown is the one-line form recorded in the trace; the full question — anchors, readings, why the provisional one is the most fail-closed — is in QUESTIONS.md.