Sheet 04 — envelope
A kernel that sells honest refusal and conceals its own limitations has already failed its own test. So this is the capability map, and the rule for it is simple: a row moves when an implementation moves, not when a plan does.
Every row below was checked by reading the code rather than the roadmap. Where a capability is narrower than its name, the note says how. Where something is designed but not shipped, it is marked designed — which here means specified in detail and not written, not nearly done.
The map
| Capability | State | What that means precisely |
|---|---|---|
| B-Rep core — primitives, booleans, extrude, revolve, loft, sweep | live | Real implementations, reachable over REST, and replayable from the event log. |
| Soundness certificate | live | Nine-conjunct AND, computed synchronously under the model write lock at fifteen mutating call sites. Full certificate is the default; callers may opt out per request, except STEP import, which refuses the opt-out. |
| Sketch certificate — DOF, conflict witnesses | live | Minimal conflicting constraint sets via QuickXplain, per-entity constrainment, honest minimal: false when the oracle cap is hit rather than a fabricated core. |
| Rebuild certificate — editing history | live | Per-feature verdicts after a mould; global soundness re-measured from the resulting B-Rep, never asserted. |
| Agent surface — MCP and REST | live | Minimal default surface of ~18 tools with a meta-tool funnel reaching the long tail, workbenches, and a program ledger. The meta path validates against the same schema as a direct call, so it is never less checked. |
| Durable event log — replay and quarantine | live | Write-through persistence, pure-replay boot, and honest quarantine that serves the clean prefix and refuses the tail. Verified live by killing the process and resurrecting the model. |
| Auth posture | live | Secure by default on an empty environment; the bypass requires an explicit insecure flag. Middleware is global rather than per-route, and the websocket is not exempt. |
| Exact predicates | partial | A genuine Shewchuk adaptive cascade — orient2d, orient3d, incircle — but consumed by five files, and inside the boolean confined to 2D arrangement decisions. The 3D surface–surface intersection path is not on exact predicates. |
| Piecewise-analytic revolve — arcs to exact Torus / Sphere | partial | Real analytic band classification, gated to full 360° profiles with no inner loops. Exactness is guaranteed only on the typed strict path; the permissive path currently falls back to a faceted approximation. Making strict the default is decided and queued. |
| Independent 14-viewpoint reconcile | partial | Genuinely independent and honest about coverage when it runs — but advisory. It runs off the write lock, capped at two concurrent, and is skipped under burst. It does not gate a mutation. |
| NURBS ↔ analytic corefinement | partial | Shared-imprint corefinement is live: a NURBS × analytic cut produces a single shared edge, which is what makes the result manifold and the mesh watertight. Levin-method quadric intersection curves are live. Exact axisymmetric SSI is outstanding. |
| Fillet | partial | The more mature of the two blends. Constant-radius is solid; mixed-convexity corners return a typed refusal naming the literature that solves them. |
| Chamfer | partial | Closed-edge rim chamfers support plane–cylinder pairs only; cone, torus and revolve-seam rims return NotImplemented. Sequential single-edge blends at a shared corner are refused outright, because they corrupt the solid. |
| Blend × boolean ordering | partial | Chamfering before a boolean can leave a solid unsound at the seam; the kernel detects it and halts rather than serving it. Drill first, chamfer last. One defect in this family is fixed; the ordering sensitivity is not fully closed. |
| Marcher unification | in flight | The duplicated boolean-local marcher is being deleted in favour of the canonical one. See Case 03. |
| Exact axisymmetric SSI | designed | Coaxial revolution pairs still march rather than resolving to exact circles. Specified; not written. |
| Lossless durability snapshots | designed | Boot is a full log replay. Snapshots are specified but not implemented, so boot time grows with history length. |
Known narrowness
These are repeated from Sheet 02 because they belong on the capability map too. Anyone relying on the certificate should know exactly where its coverage thins.
Orientation is local. The check catches two facets winding the same way across a shared edge. A mesh in which every facet is uniformly inverted has no repeated directed edge and passes. Outward-ness is not tested.
Self-intersection is gross. It runs on a coarse audit tessellation — coarser than the watertightness pass — on the reasoning that gross self-overlap is visible at low density. The search is exact; the approximation is the density. A shallow self-intersection below that resolution is not detected.
Boundary conformance is u-only. Facets are tested for bridging a periodic seam only on surfaces declaring a u-period. A torus's second period is not tested.
Construction consistency is a bounding box. It catches a sketch that has drifted or been orphaned. It does not verify that the profile still generates the solid.
Stale labels do not fail a solid — an annotation is not geometry. Model debris is reported at model scope rather than charged to a part that did nothing wrong. Sliver aspect ratios are reported as an optimisation target, not gated, because a faithful tessellation routinely carries them and gating would flag every real part.
Direction
The near-term queue is unglamorous and mostly about closing the gap between what the kernel computes exactly and what it computes approximately. Unifying the marcher removes a duplicated implementation that drifted from its twin. Exact axisymmetric intersection turns a class of coaxial revolutions from marched approximations into exact circles.
Making strict analytic revolve the default is the one with a visible cost: some calls that previously returned a faceted approximation will begin returning a typed refusal instead. That is the trade this project exists to make. An approximation the caller did not ask for and cannot see is the failure mode; a refusal they can act on is not.
Further out sits the parity work — the exact-predicate coverage widening from the 2D arrangement layer into the 3D intersection path, and exact mass properties on trimmed surfaces. Neither is close, and neither is claimed.
Roshera