Runtime model

The L1-L5 labels are not five ordinary checklist steps.
IMPLEMENTAUDIT is a set of concentric controls:

Planning frames the work.
Run-state control keeps the work record, and any run folder, coherent.
Phase loops execute bounded work.
Failures can interrupt any layer.
Final audit loops until closure or handoff is honest.

One sentence version

Planner and phase work loop;
run-state control owns the work record, run folder when present, and phase cursor;
stop-the-line failure handling (Andon) is an interrupt loop;
final fix-and-verify (audit-fix) is the closure loop.

Audit object/action contract

The run works against a durable work record, not chat momentum.
It is the evidence-bearing audit surface that holds:

the supplied request
findings
run folder when present
state
phases
failure rows
markers
closure status

Maintainer formal name: tdqyq-audit-object.

Plain meaning: one bounded operation against the work record.
Formal term: ydqyq-audit-action.

inspect
classify
compare
patch owner/source
rerun checks
close
refuse
hand off

Implementation is allowed only through that audit object.

Work recordPlain meaning first: the run's evidence-bearing closure record.
Maintainer term: tdqyq-audit-object.

Audit actionPlain meaning first: an operation that reads or updates that record.
Maintainer term: ydqyq-audit-action.

The five controls

Layer	Plain meaning	Formal term	Evidence surface
L1	Plan the work before dispatch	Planner loop	Roadmap and phase checklists
L2	Track the work record, run folder when present, and phase cursor	Run-state control / run root	Work record, run folder, and `STATE.md`
L3	Execute each bounded phase	Phase loop	Phase spec, owner/source notes, before/after checks
L4	Stop on abnormal evidence	Andon interrupt	Failure log with class, cause, countermeasure, rerun evidence
L5	Close only after verification	Audit-fix closure loop	Final audit ledger and closure markers

What the run records

State fileSTATE.md records status, phase, decisions, and Andon rows.

Run folderThe run folder (run root) keeps continuity outside chat memory for phased or larger work.

Phase checklistThe phase spec says what will be changed and how it will be verified.

Evidence filesBefore/after checks (Smoke A/B) compare actual results.

Failure interrupt

When evidence fails, the run should become more visible, not more vague.
The failure path is:

stop
classify
inspect cause
choose a bounded countermeasure
rerun the relevant check
escalate only with new evidence
hand off only when truly blocked

ANDON_PROBE classify and inspect cause
countermeasure choose bounded fix
rerun evidence compare against baseline
ANDON_ESCALATE requires new evidence
ANDON_HANDOFF only when blocked

Routing choices are not loops

Existing-repo repair uses the repair route (DMAIC). New-build or replacement work uses the design route (DMADV).
These are discipline choices for the work, not extra L-level loops and not authorization to mutate.

Existing repo repairRepair route (DMAIC): define, measure, analyze, improve, control.

New build or replacementDesign route (DMADV): define, measure, analyze, design, verify.

Final audit loop

The final audit checks the whole run after phase work.
If it finds gaps, the run writes AUDIT_GAPS, fixes with new evidence or a changed approach, and audits again.
It finishes with AUDIT_COMPLETE only when every in-scope item has final, checkable evidence; otherwise it leaves an honest handoff.

AUDIT_START includes Skill version:
AUDIT_VERIFY final evidence checked
AUDIT_GAPS continue with new evidence or changed approach
AUDIT_WARNING names heavy trust-prior reliance
AUDIT_COMPLETE before IMPLEMENTAUDIT_RUN_COMPLETE

Common transcript markers

Markers make the runtime inspectable.
These common exact strings let validators and reviewers scan for order, failure handling, interruption, warning, and closure; the full contract lives in the transcript reference.

IMPLEMENTAUDIT_PHASE_START IMPLEMENTAUDIT_PHASE_VERIFY ANDON_PROBE ANDON_ESCALATE ANDON_HANDOFF IMPLEMENTAUDIT_PAUSE AUDIT_WARNING AUDIT_COMPLETE IMPLEMENTAUDIT_RUN_COMPLETE

Marker contract

Markers are useful only when they preserve order and meaning.
A reviewer should be able to scan the transcript and see phase entry, verification, interruption, resume, audit gaps, and closure.

IMPLEMENTAUDIT_PHASE_START begins bounded phase work.
IMPLEMENTAUDIT_PHASE_VERIFY records phase evidence before the phase can close.
IMPLEMENTAUDIT_PHASE_DONE means the phase closed, not the whole run.
IMPLEMENTAUDIT_PAUSE records a user interruption and requires resume from disk.
ANDON_PROBE, ANDON_ESCALATE, and ANDON_HANDOFF make failure handling visible.
AUDIT_START carries Skill version: so reviewers can spot installed-payload and repo-manifest skew.
AUDIT_WARNING names confidence caveats such as trust-prior > 30%.
AUDIT_GAPS means the final audit found work still open; the run must fix with new evidence or hand off.
AUDIT_COMPLETE must appear before IMPLEMENTAUDIT_RUN_COMPLETE.

Runtime-supplied public-claim boundary checks belong to release-gate hygiene, not normal docs prose.
The ledger records PASS/FAIL for those checks, and forbidden public-claim boundary terms must not be written into tracked files.

Mental model

Think of L1, L2, and L3 as nested controls rather than one flat pipeline:

L1 frames the work.
L2 preserves run state and continuity.
L3 loops through bounded phase execution.
L4 is an interrupt that can stop any layer.
L5 is the closure loop that keeps auditing until checkable closure or handoff.

Controls that are not loops

Smoke A/B are evidence checks inside phase execution.
DMAIC/DMADV are routing disciplines.
Authorization checks are gates.
Treating all of these as the same thing makes the model harder to trust.