Open a target and record intake (declared purpose, jurisdiction, ToS snapshot). target: cli:docker: | cli:build: | cli:local | web: | android:: | desktop:docker:. strict: every release needs a person's approval at a terminal. target_options (web): reset_command, reset_check_url, contract_selectors {source, selectors}, api_templates, profile {asset_hosts, ...}; see the observer guide.

Replace the mapper rules (drop/mask/rename/classify). Creates a new mapper version.

Reset the target, apply the inputs, and return raw observations and symbols. symbols_only drops the raw observations; keys (e.g. ["path", "status", "alerts"]) keeps only those parts of each symbol.

Define named actions (CLI invocations: argv, stdin, files, env, stdin_mode, stdout_mode, timeout_s) for learning flows of stateful CLIs.

Discover a CLI's interface: help structure confirmed by behavior probes. Help prose is kept as dirty-side evidence only; the result is structure (options, arity, value types).

Probe a CLI feature: one-factor sweep, pairwise over accepted classes, noise calibration (rerun + env variations), probe table, mined decision-table claims and unknowns. hints = {cmd, base, selector_options, takes_files, default_input, sweep_inputs, inputs, pair_inputs, operand_type, unicode_argv, skip_options, extra_inputs, extra_values}.

Probe one form field (web, Android or desktop UI): equivalence classes for its kind (text/email/password/number or custom classes), a length-boundary search, per-class outcomes and folded claims. prefix = named actions that reach the form; submit = the named action that submits it. Boundary classes become named actions you can add to learn_flow's alphabet. When accepted values change the outcome (computed results), say what acceptance looks like: accepted_if = {subset: {...}} and/or {text_contains: '...'}. Number fields skip the length search (their limits are ranges). Without submit, the outcome is read right after typing (live previews, totals, counters).

Check observer-authored rules against the original. Each rule: {statement (your own words), origin: documented|inferred-intent|observed, kind, checks: [{kind: outcome|same|differs, a: invocation, b: invocation (same/differs), expect: subset (outcome), keys: [..] (optional)}]}. Falsified documented rules are reported as documentation/behavior conflicts.

Coverage of a feature inventory {item: [patterns]} by probes and rule checks (options are added automatically). Uncovered items become unknowns.

Register public documentation you read (dirty side). Its paragraphs join the gate corpus so copied wording is flagged; write rules in your own words.

Learn a state machine for a feature with KV or L# under an explicit oracle budget.

State a falsifiable claim as a trace check (expect: symbol per step, null = any).

Try to falsify a claim with fresh, uncached probes.

List claims, optionally for one feature.

List the rules recorded for a feature: id, statement, status, failed checks.

List unknowns (yours and the ones coverage generated) with id, question and status, so they can be answered with update_unknown.

Record something that could not be observed (missing coverage is unknown, not absence).

UI targets: crawl from the start screen (or after the named start actions, e.g. a sign-in) clicking every enabled control; screens are identified by route, headings and controls. Defines a click[role:name] action for every control found and records the inventory that coverage and suggest_probes use. Start here, then probe fields and state rules.

Concrete next steps for the feature's coverage gaps: fault actions with a path that makes the call, probe_web_field arguments for unprobed fields, click paths for unexercised controls. Run after discover_ui and after each batch of rules.

Retract one of your rules (e.g. superseded by a reworded version), with a reason. Rule ids are in check_rules results.

Mark an unknown resolved / out-of-scope / investigating (or reopen it) with a note. Resolved unknowns leave the release; the audit log keeps the history.

Web: third-party hosts the app tried to load during one episode (reset + actions); candidates for target_options.profile.asset_hosts when layout depends on them.

Web: the value-free backend contract observed so far (paths, methods, statuses, body shapes). Fold data-bearing path segments with target_options.api_templates.

Compile a spec draft (model + claims + unknowns) for a feature.

Run the gate on a draft without releasing it: findings grouped by class (expected-output / interface / prose), which are approved, and prose findings in full.

Release a draft through the gate. Strict mode: succeeds only once a person has approved every finding and acknowledged coverage gaps (teardown approve); rewrite prose findings instead of waiting for approval. Standard mode: refused while measured coverage items are neither exercised nor explained, unless accept_gaps gives the reason they ship as unknowns.

Standard mode only: allow one literal through the gate, with the reason it is functionally necessary.

Standard mode only: approve byte-exact output the behavior requires (default: help/usage/version output) as functional quotes. Records who approved it.

List questions from the clean side.

Answer a clean-side question; the answer is gate-checked.

Verify the audit log's hash chain.