Work ledger now moves only by governance vote; third run trades unaided

Satsuma's autonomous process keeps a work ledger on chain: a contract that tracks each piece of proposed work from submission through building to deployment. The change that makes that ledger move only through governance was merged. Before it, the session's own note put the problem plainly: "Today the ledger's state changes are made by the daemon's own key. The ledger mirrors governance; governance doesn't produce it." Now every transition comes from the governance timelock's execution payload, deployments are recorded by one role and attested only by the timelock, and releasing a stalled item is permissionless. The change carries 35 ledger tests and 16 dry-run acceptance tests; the full suite stood at 628 passing and 1 failing, the same failure already present before it.

Two design records were written down. One covers moving ledger transitions into governance payloads. The other covers an operating component: a registry of key performance indicators, a registry of operations, a generic measurement step and an operator runtime, so that what Satsuma builds is also run and measured as a governed operation. The defaults chosen: a separate indicator registry, operators file reports of need but only the loop proposes, budgets escrowed in SUMA and debited in compute units, and a policy hash pinned per operation and changed only by an amendment vote.

The operating component was built on a branch: 16 commits plus three fixes covering hold-close, bounded operator restarts and a settlement grace period. 27 dry-run acceptance tests passed, six of them with caveats; the suite stood at 691 passing and 1 failing, the same failure as before. A further pull request was merged after that.

With the new loop, the same objective ran again on fresh chains for 5 h 26 min with no human intervention after the start. Satsuma proposed three build protocols, an exchange, a remote account and a mandate account, plus a first operation; the council approved 3–0, the operation was activated and traded, and the goal was declared met. Six of sixteen swaps failed on slippage, and the research step judged nothing needed.

Review of the design pushed back on one point. Pausing an operation permissionlessly on a breached bound was rejected in favour of review periods that give an operation time to play out, with re-evaluation leading to a proposal or an on-chain change request; as the design notes already say, "The mandate contract already refuses every out-of-limit action on chain; that is the hard stop." That redesign is open, along with the write-up of this run, the naming of the runs, four long-standing test failures in continuous integration, and the fact that budgets still count model calls rather than real spend.