Traffic decides whitepaper

Bar

Propose ≠ dispose — humans and LLMs face the same verify path.
Honest holes — unlabeled stubs fail.
No façades — demo finish over missing origin fails (D6447).
Language first — CWL tip pins Convert/Secure consumers.
Traffic decides — recorded behavior beats migration memos.

Helix canon: trust nothing until certified; DNA from traffic, not hope; change guilty until promoted.

Three pillars + shared bar

                 ┌─────────────┐
                 │     CWL     │  language + specs + tooling
                 └──────┬──────┘
        ┌───────────────┼───────────────┐
        ▼               │               ▼
┌───────────────┐       │       ┌───────────────┐
│    Convert    │◄──────┴──────►│    Secure     │
│  (translator) │   shared bar  │   (Helix)     │
└───────────────┘  propose/     └───────────────┘
                   verify/holes

Closed agent gates

Gate	Owner	Token	Status
Propose ≠ dispose + oracle replay	Convert	`TRAFFIC_DECIDES_CONVERT_OK`	Done
Helix shadow-ready	Secure	`TRAFFIC_DECIDES_SECURE_OK`	Done
Live customer soak → enforce	Operator	Real `SHADOW_LOG`	Open

Ship bar for agents = the first two gates. Prefer “recorded traffic” for Convert/oracle. Do not overclaim finished customer soak until real SHADOW_LOG exists.

Declared vs observed

CWL effects: are declared; DNA proves observed traffic.
Seed may hint auth; certification still requires traffic or explicit promote (Helix-owned).
RFC-0022 identity: method + path_template (+ host from deploy profile).
CWL holes and DNA holes[] are different vocabularies — never auto-copy.
Content-class drift (JSON route returning HTML errors) is DNA/Helix, not grammar.
Static asset globs are DNA-only collapse via pathTemplate.
HTML body hashes not in DNA v0.

UT ↔ Helix spine — exact steps

Owner: engines/chrysalis-cwl/scripts/smoke-ut-spine.mjs (G10125). Report: reports/ut-spine/ut-spine.json. Invariant string: CWL owns surface contract; Helix disposes DNA; Convert does not own this spine.

Assert gold fixtures/language-gold/24-dna-bridge/routes.cwl
Validate optional deploy-profile.json (cwl-deploy-profile-v1)
Always run gate-cwl-dna-bridge.mjs → contract equality
If sibling Secure packages/cwl-bridge present:
- seedDnaFromCwlFile → assert app-dna-v1 + bridge.kind === cwl-surface-seed
- stripBridgeEnvelope
- Promote mode: certified + signDna / verifyDna
- compareCwlSurfaceToDna → cutover cwl_surface_subseteq_dna
- scoreRequest allow /api/health, deny /api/backdoor
- Optional Secure cutover-smoke → CUTOVER_SMOKE_OK
Print UT_SPINE_OK (Helix soft-skip without Secure unless --require-helix)

CWL language gold (24-dna-bridge)
  → RFC-0022 contract gate (chrysalis-cwl)
  → Helix seed → strip → promote(+HMAC)
  → compare: CWL surface ⊆ certified DNA
  → enforce allow/deny

Pillar	Owns	Must not
CWL	Surface contract, gold 24, `smoke:ut-spine`	Become the firewall
Secure	DNA seed/compare/enforce, `cutover-smoke`	Fork CWL mapping; require Convert monorepo
Convert	Origin → CWL; consumer cutover smoke	Own the spine; redefine language

Command tokens

Where	Command	Token
CWL	`npm run test:cwl-dna-bridge`	`CWL_DNA_BRIDGE_OK`
CWL	`npm run smoke:ut-spine`	`UT_SPINE_OK`
CWL	`npm run smoke:ut-evidence`	`UT_EVIDENCE_OK`
Convert	`pnpm run hub:traffic-decides-bar-smoke`	`TRAFFIC_DECIDES_CONVERT_OK`
Convert	`pnpm run hub:cwl-helix-cutover-smoke`	`CWL_HELIX_CUTOVER_OK` / `SKIP`
Secure	`npm run traffic-decides-bar-smoke`	`TRAFFIC_DECIDES_SECURE_OK`
Secure	`npm run cutover-smoke`	`CUTOVER_SMOKE_OK`
Secure	`npm run sign-smoke`	`SIGN_SMOKE_OK`

Operator residual

Live customer soak → enforce is not closed by lab preflight. Shadow through real peak and off-peak, then flip enforce. Do not invent customer soak traffic to paint the bar green. Preflight smoke ≠ soak.

Non-goals / stop list

Convert Pilot Kit ≠ DNA cutover.
CWL is not the firewall.
Secure must not require the Convert monorepo to enforce.
No Nest / LiveView / Flutter façades; no EXTFMAP invent.
NGFW: Helix augments; it does not absorb VIP/NAT homework as day-one.

CWL · Convert · Helix · Proof