Qualify a host without manufacturing an SLO.

Let the recorder own time and accounting

QualificationRun moves once through Warmup, Measurement, Drain and Finished using a monotonic clock. Measured operation guards are bounded and cannot disappear silently: abandoning one records an unexpected failure, and drain refuses to finish while work remains.

let plan = FaultPlan::ci_default();
let run = QualificationRun::start(
    QualificationProfile::CiReduced,
    QualificationScenario::AgentHostControlPlaneV1,
    QualificationWindow::ci_default(),
    environment,
    &plan,
)?;

run.begin_measurement()?;
let operation = run.recorder().begin_operation()?;
// Record exact signals and externally checked fault invariants.
operation.finish(OperationOutcome::Completed)?;
run.begin_drain()?;

let report = run.finish()?;
let envelope = report.to_integrity_envelope()?;

Keep absence visible

• Bind the environment

  Record commit, tree, lockfile, dataset and configuration digests plus bounded machine, PostgreSQL, topology and database-RTT facts.

• Retain distributions

  Admission, runnable claim, connected SSE delivery and reconnect use bounded HDR histograms with observed and corrected sample counts.

• Fail safety facts at zero

  Lost acknowledged records, accepted stale writes, cross-tenant disclosure and duplicate external effects fail every profile.

• Never invent missing measurements

  Reduced runs serialize unmeasured saturation or fairness as null and informational_missing. Release runs fail on the same absence.

Use stable, externally controlled faults

Version one names database unavailability, host-dependency readiness loss, Worker loss, rolling replacement, verifier unavailability and operations- policy expiry. StateKnot records injection, recovery and checked invariants; it never receives infrastructure credentials or performs the fault itself.

Current executable evidence

PostgreSQL 16 and 17 CI run a reduced real Agent host profile through HTTP admission to terminal execution, journal-based runnable-claim timing, live and replayed SSE, protected operations, dependency refusal/recovery and replacement-before-drain. That proves the harness wiring and invariants, not production capacity. Read the complete operations contract and Draft RFC-0017.