How it works: From canonical source to projected surface

01 / SourceCanonical sourceSkills, agents, workflows, contracts, and adapters, versioned in one repository.

02 / ManifestsTyped manifestsDeclare what each surface receives. A missing reference stops projection.

03 / SyncOne-way projectionManaged files written per surface, hashed and drift-checked.

04 / Surfaces12 declared surfaces

Claude CodeCodexHermesOpenClawPrime AgentPaperclip+ 6 more declared, four at experimental tier

evidence returns: doctor · readiness · tests · Work Packets

Diagram: canonical source projected through typed manifests into twelve declared surfaces, with evidence returning to source.

The one-way invariant

Projection beats hand-editing a runtime root.

A runtime root like ~/.claude or ~/.codex is output, not input. A hand edit there is drift, not authority: it is unversioned, unreviewed, invisible to every other surface, and gone the next time the factory publishes.

So the sync engine snapshots projected-file hashes and halts before clobbering a hand-edited live file. The diff is surfaced instead, so a legitimate live fix can be promoted into canonical source and then re-projected everywhere.

A declaration says what Scaffolde can project and verify; it does not prove that local auth, provider access, gateways, or processes are healthy on a particular machine. That is what doctor and readiness are for.

The flow

Author → validate → project → evidence.

Four steps turn a capability into versioned infrastructure every declared surface can use.

01 / AUTHOR

Capabilities as source

Skills, agents, workflows, contracts, and adapters are written in the repository first and versioned like any other code. Nothing becomes authoritative by being typed into a runtime root.

02 / VALIDATE

Typed manifests, fail-closed

Manifests declare what exists and what each surface receives. A missing or inconsistent reference stops projection instead of shipping a half-built surface.

03 / PROJECT

One-way sync with drift detection

The sync engine writes managed files into each declared runtime root and records hash checkpoints, so the next run can tell a fresh projection apart from a hand edit.

04 / EVIDENCE

Doctor, readiness, tests decide what returns

Doctor and readiness report each surface as ready, degraded, attention, or blocked. Those signals, plus tests and Work Packets, decide whether a change earns its way back into source.

The evidence discipline

Done exists in writing before the work begins.

Scaffolde runs on Algorithm 8.4.0, a conjecture-and-refutation loop: the goal survives verbatim, done is a set of falsifiable claims, and each claim names the probe that could disprove it. “Should work” is forbidden.

The goal, verbatim. The original ask survives word for word, so the work cannot quietly drift toward an easier problem.
Falsifiable claims, written first. Done exists in writing before building starts, as claims that could be shown false, and each claim names the probe that could disprove it.
Right-modality evidence. No completion claim closes without tool evidence in the right modality: a file claim needs a read, a deploy claim needs a live probe, a UI claim needs a real browser, never curl.
Mechanical gates. A VerificationGate hook grades completion claims against actual tool calls; gaps block. Rewording never passes.
Honest grading. Some of this is mechanically enforced today (the VerificationGate hook, drift detection, fail-closed validators); the rest is honest self-attestation, and the repo grades each claim’s enforcement level by name.

Fail-closedEvidence-backed

Claims and probes

Claim modality	Evidence that closes it
file	A read of the file that was written.
deploy	A live probe against the deployed target.
ui	A real browser session driving the interface, never curl.
completion	Matching tool calls, graded by the VerificationGate hook. Gaps block.

‘Should work’ is forbidden.

Table: each claim modality and the tool evidence required to close it.

Federated authority

Where authority lives.

Memory is federated, not pooled. Each store owns one kind of truth, and the boundaries are written down rather than assumed.

Authority map

Store	What it owns
Paperclip	The durable backlog: tasks, assignment, and status across sessions. Vendored upstream with explicit patch boundaries.
.scaffolde/tasks/	Execution evidence: what a run actually did, kept next to the work it describes.
gbrain	Synthesized cross-surface knowledge with lineage, so a recalled fact carries where it came from. Vendored upstream.
SecondBrain / Telos	Human-authored intent: goals, preferences, and direction written by the operator.

Human authority wins conflicts.

Table: the four memory authorities and the kind of truth each one owns.

The repository is the factory.