Principles

How a shared memory stays honest.

Twenty-four principles decide what supragnosis keeps, believes, shares and refuses. Each one is split into clauses, and each clause names the tests or the construction that hold it, or says that it is owed, which means the code does not yet guarantee it.

110 clauses across 24 principles: 75 tested by name, 6 hold by construction, 29 owed. Each column is a principle and each block one of its clauses, written here from the coverage registry.

Tested by name
Holds by construction
Owed, today's behavior pinned
Owed

Clause: One demand a principle makes, small enough to check.
Tested: A test named in the registry checks it.
By construction: The code's shape makes it hold, so there is nothing to test.
Pinned: Owed, with today's behavior held by a test, so a change shows.
Owed: The code does not yet guarantee it.
Tension: Two principles that pull against each other, and the ruling between them.

Chapter 1 Epistemology

What is kept

Claims rather than facts: who said them, when, and what is believed because of them.

Assertions, not facts.

The log keeps what was said, by whom and when. What is believed is computed from it, and computing it again gives the same graph.

Two machines can disagree, and either can be wrong. Keeping the claims and deriving the belief means a better rule can read the same log again.

1 Write Each entry is a claim: who said what, and when. The graph is computed from the entries.
2 Throw away Throw the graph away. The log is untouched.
3 Replay Replaying the log builds the same graph, down to its digest.

Shows the graph is a projection: re-deriving it from the log reproduces it exactly

5 clauses: 4 tested, 1 by construction

the graph is a projection: re-deriving it from the log reproduces it exactlytested by 4 named tests
a generator proposes; nothing but a verdict commitstested by 1 named test
a read is answered from the log as it stands, not from a stale view of ittested by 4 named tests
ingest validates well-formedness and nothing beyond ittested by 1 named test
no API may write a fact that did not pass through an assertion directly into the graphholds by construction

Normative text How each clause is checked

Every claim has an author.

Each entry carries the machine, the person it acted for, the workspace and the time. A confidence nobody stated stays unstated.

An agent usually works on someone's behalf. Without the chain, nobody can tell a guess from a decision, or trace a bad one back.

1 Unpack An entry carries the machine that wrote it, the person it acted for, the workspace, the time and its source.
2 Unstated A confidence nobody stated stays unstated. Nothing fills it in with a guess.
3 Trace back Any answer points back to the entry it came from, with all of this attached.

Shows an attestation carries its acting host, principal, workspace and time, and an unstated confidence stays unstateda query result can carry its provenance: a hit dereferences to its observation, with its attestations and delegation chain

5 clauses: 5 tested

an attestation carries its acting host, principal, workspace and time, and an unstated confidence stays unstatedtested by 4 named tests
a peer's claimed tier is stored verbatim, because the log is audittested by 1 named test
at least one attestation, refused at ingest at the schema leveltested by 2 named tests
a query result can carry its provenance: a hit dereferences to its observation, with its attestations and delegation chaintested by 1 named test
a relayed attestation is authenticated by its origin's signature, not by the relaytested by 2 named tests

Normative text How each clause is checked

Correct, never erase.

A correction supersedes an entry and the old one stays readable. The same entry arriving twice changes nothing.

Deleting loses the reason something was believed. Superseding keeps that history for whoever needs it later.

1 Write An entity's description is written once.
2 Correct A correction supersedes it. The older entry stays readable in the log.
3 Again The same entry arriving again merges into the one already there. Nothing changes.
4 Delete? There is no delete. owed a destruction demand leaves an absorbing tombstone that propagates and refuses re-ingest

Shows a re-arrival merges monotonically and drops nothing, in any order

6 clauses: 3 tested, 3 owed

a re-arrival merges monotonically and drops nothing, in any ordertested by 6 named tests
every encoding the log has ever used stays readabletested by 3 named tests
entity merge preserves history, so un-merge is possibletested by 2 named tests
a destruction demand leaves an absorbing tombstone that propagates and refuses re-ingestowed
a relation accumulates attestations the way an entity and an observation doowed
a re-materialization concurrent with an observe cannot interleaveowed

Normative text How each clause is checked

Two clocks.

When something was true and when the system learned it are recorded apart.

Knowledge goes stale on both axes. A fact learned late is not a fact that became true late.

1 True billing-api has used Postgres since January 10. That is valid time: when it was true in the world.
2 Learned The system learned it on March 3. That is recorded time, and the two are kept apart.
3 Recorded Both dates are captured with the entry, in the log and in the graph.
4 As of Asking what was believed as of a date reads the two axes. owed as_of_valid / as_of_recorded time travel, and the asserted close of a disproven relation's valid interval

Shows both time axes are captured at ingest, into the log and the projection

2 clauses: 1 tested, 1 owed

both time axes are captured at ingest, into the log and the projectiontested by 1 named test
as_of_valid / as_of_recorded time travel, and the asserted close of a disproven relation's valid intervalowed

Normative text How each clause is checked

Missing is not false.

A search that finds nothing says 'not found', never 'no'. Each kind of non-answer keeps its own name.

Every node holds part of the picture. Reading a gap as a no turns missing knowledge into a wrong answer.

5 clauses: 4 tested, 1 owed

absence is a well-formed answer, never an errortested by 3 named tests
absent is distinguished from unavailable, rather than collapsing into an empty resulttested by 2 named tests
each value of the answer alphabet stays its own - unavailable, uncomputable, withheld and truncated never collapse into not foundtested by 4 named tests
an id outside the caller's grants answers as unknown, and a named scope outside them is refused by nametested by 2 named tests
a destroyed id answers as destroyed, recording the act and never the contentowed

Normative text How each clause is checked

Found
Postgres.
Said by laptop for you on Mon 10:02, and confirmed by you in the console.
Not found
Nothing on this node says so.
That is unknown, never no. Another node may know, and a later entry may say so.
Unavailable
The hub did not answer.
This is not an empty result. Local answers still work; ask again when the hub is reachable.
Withheld
You are not granted 'payroll'.
You named the workspace, so the refusal names it too.
Not found
No entity 7f3a91c2 on this node.
Word for word the answer an id that does not exist gets, so asking cannot reveal what exists.
Truncated
Showing 20 of 57.
The rest were left out, not missing. Ask a narrower question or for the next page.

owed a destroyed id answers as destroyed, recording the act and never the content

Shows absence is a well-formed answer, never an errorabsent is distinguished from unavailable, rather than collapsing into an empty resulteach value of the answer alphabet stays its own - unavailable, uncomputable, withheld and truncated never collapse into not foundan id outside the caller's grants answers as unknown, and a named scope outside them is refused by name

Disagreement is information.

When sources conflict and trust cannot settle it, the answer says 'contested' and keeps both sides.

A silent winner hides the one place a person should look.

3 clauses: 2 tested, 1 owed

a conflict that trust does not settle surfaces as contested instead of resolving silentlytested by 3 named tests
a defeated assertion stays in the log and is reinstated by re-resolutiontested by 1 named test
a contradiction between relations is surfaced tooowed

Normative text How each clause is checked

A second machine says Cache. Both are agents, so trust cannot decide: the answer shows the latest value and says it is contested.

Shows a conflict that trust does not settle surfaces as contested instead of resolving silentlya defeated assertion stays in the log and is reinstated by re-resolution

Forget by ranking, not by deleting.

Old knowledge should fall in retrieval, never out of the log. Consolidation suggests and commits nothing.

Attention is finite and the log is not. Forgetting is how attention gets spent.

1 Idle When the node is idle, consolidation reads the log.
2 Draft It drafts candidates for review and commits none of them. The canon is unchanged.
3 Rank Older knowledge should sink in retrieval while the log keeps every entry. owed forgetting happens as retrieval demotion at idle, never as deletion

Shows consolidation generates candidates and commits none of them

4 clauses: 2 tested, 2 owed

consolidation generates candidates and commits none of themtested by 3 named tests
a generated summary is never stored by the servertested by 1 named test
forgetting happens as retrieval demotion at idle, never as deletionowed
a consolidation output enters the log only as a gated candidate's derived, lowest-trust, lineage-bearing enrichmentowed

Normative text How each clause is checked

Chapter 2 Ontology

How it is shaped

A vocabulary that starts small, grows from use and stays consistent.

One name, one meaning.

A type enters the vocabulary only with a plain-language definition, and a description once written is never erased by an omission.

Agents from different tools read the same vocabulary. A name with two meanings splits the graph without anyone noticing.

1 No definition A new type with no definition is refused at the door.
2 Defined With a plain-language definition, it enters the vocabulary.
3 Left blank A description already written survives a later entry that leaves it blank.

Shows a type cannot enter the vocabulary without a natural-language definitiona description already captured, an entity's or a relation's, is never erased by a later omission, and a blank description is an omission

3 clauses: 2 tested, 1 owed

a type cannot enter the vocabulary without a natural-language definitiontested by 1 named test
a description already captured, an entity's or a relation's, is never erased by a later omission, and a blank description is an omissiontested by 1 named test
a relation type reads its direction from its name, and relates_to is the one catch-all, treated as not yet classifiedowed

Normative text How each clause is checked

A vocabulary that cannot contradict itself.

Two definitions of one type surface as contested, and a name defined twice blocks the change that would add it.

The data may disagree. The vocabulary that reads the data may not.

1 Two definitions Two machines define Service differently. The type surfaces as contested.
2 Both axes A proposal would add member_of as an entity type while it is already a relation type. The name is surfaced, and the merge is blocked.
3 Inference Contradictions derived by inference are next. owed subtype cycles and domain/range coherence are checked

Shows conflicting definitions of one type surface as contesteda name defined on both T-Box axes is surfaced, and blocks a tbox_change merge

4 clauses: 2 tested, 2 owed

conflicting definitions of one type surface as contestedtested by 1 named test
a name defined on both T-Box axes is surfaced, and blocks a tbox_change mergetested by 2 named tests
subtype cycles and domain/range coherence are checkedowed
inference rules are tested for non-derivation of contradictionsowed

Normative text How each clause is checked

P10

Extend, don't modify.

Your vocabulary grows in the log. The core model stays fixed, and a change to it comes with a migration.

Every workspace names its own things. None of them should need a new build to do it.

1 Extend Your vocabulary grows through the log: new types arrive as entries, and the core model is not touched.
2 Migrate When the core itself changes, a migration comes with it, and every older log still reads.

Shows the domain vocabulary extends through the log without touching the core modela change to the core model comes with a migration path

2 clauses: 2 tested

the domain vocabulary extends through the log without touching the core modeltested by 2 named tests
a change to the core model comes with a migration pathtested by 2 named tests

Normative text How each clause is checked

P11

Let the schema emerge.

Notes come in untyped. Names said together form a context, and promoting one writes an entry that names its lineage.

Nobody designs a good taxonomy up front. A schema induced from use fits the work it came from.

1 Untyped Notes come in with names and no types. No schema blocks ingest: an untyped name is a Concept.
2 Said together Names said together form a context: a derived view identified by its members, beside the ordinary relations.
3 Promote Promoting the context writes an ordinary entry. It names its members as its lineage and starts at the lowest trust; raising it goes through the gate. owed type candidates are induced from repeated co-occurrence

Shows no schema blocks ingest: free text alone is an observation, an untyped entity is a Concept, and an undefined kind is kept as writtensecond-order structure is a derived view identified by its member set, coexisting with binary relations rather than replacing thempromoting a recurring context is an ordinary gated assertion that carries its lineage

7 clauses: 4 tested, 3 owed

second-order structure is a derived view identified by its member set, coexisting with binary relations rather than replacing themtested by 3 named tests
promoting a recurring context is an ordinary gated assertion that carries its lineagetested by 1 named test
the T-Box is scoped to the workspace - an all-workspaces read is a union of glossaries, not one glossarytested by 1 named test
no schema blocks ingest: free text alone is an observation, an untyped entity is a Concept, and an undefined kind is kept as writtentested by 1 named test
type candidates are induced from repeated co-occurrenceowed
the escape hatch is complete: Concept, relates_to and free-form propertiesowed
corroboration counts independent principals, not repetitionsowed

Normative text How each clause is checked

P12

Not tied to a store.

The model is defined above any encoding. The store is an adapter, and it has already been replaced once.

Storage formats change faster than meaning. Knowledge should survive a change of database.

1 Above The graph is defined above any storage format.
2 Swap The store has been replaced once already, from cozo to redb. The graph above it did not change.
3 Boundary No storage concept can cross into the domain model. The crate graph makes it impossible to write.

Shows a storage concept cannot reach the domain model

1 clause: 1 by construction

a storage concept cannot reach the domain modelholds by construction

Normative text How each clause is checked

P13

What it is, and what it does.

'Person' is a kind and 'reviewer' is a role held for a time. Roles should be relations, not subtypes.

A role that becomes a subtype cannot end. The person stops reviewing; they do not stop being a person.

1 A role Reviewing is something you do for a while, so it is drawn as a relation with a time span, not as a kind of person. owed essence is distinguished from role, and a role cannot subsume an essence
2 It ends When the role ends, the relation closes. You are still a person. owed essence is distinguished from role, and a role cannot subsume an essence

1 clause: 1 owed

essence is distinguished from role, and a role cannot subsume an essenceowed

Normative text How each clause is checked

Chapter 3 Identity and trust

Who said it, who sees it

Stable names, one graph from one log, and trust that the receiver decides.

P14

Names that do not move.

Identifiers come from content, so the same entry has the same id on every machine, and an id still resolves after a merge.

An id that depends on where something is stored breaks the moment it travels.

1 Same content Two machines write the same note. Each computes the id from the content, so both get the same id.
2 Sync When they sync, it is one entry, counted once.
3 After a merge Merge pg into Postgres, and asking for pg still resolves, forwarded to Postgres.

Shows identifiers are content-derived, collision-resistant and independent of notationan identifier stays resolvable after the thing it names is merged away

7 clauses: 4 tested, 1 by construction, 2 owed

identifiers are content-derived, collision-resistant and independent of notationtested by 4 named tests
an identifier stays resolvable after the thing it names is merged awaytested by 1 named test
one content counts once even when a re-keying leaves it under two idstested by 1 named test
an identity or a signature, once made, verifies under every later buildtested by 2 named tests
a field added to the identity, attestation-order, re-arrival-merge or signing functions is a compile error until it is classifiedholds by construction
every identifier the system hands out is dereferenceableowed
the wire envelope and the well-formedness check are forced the same wayowed

Normative text How each clause is checked

P15

Same thing, two names: the system's job.

The system proposes that two names are one thing. A verdict commits it, and a split can undo it.

Each tool speaks its own vocabulary. Asking every client to agree first would mean they never connect.

1 Propose Two tools call one database pg and Postgres. The system proposes that they are one thing, and does not commit it. owed top-band candidates merge automatically
2 Merge A reviewer's verdict merges them.
3 Split A split is a new proposal. Merged, it separates them again, and the merge stays in the log.

Shows the substrate proposes identity candidates rather than leaving them to the operatora proposed identity is committed by the gate, never by the generatora merge and a split are both reversible

6 clauses: 4 tested, 2 owed

a merge and a split are both reversibletested by 1 named test
the substrate proposes identity candidates rather than leaving them to the operatortested by 2 named tests
a proposed identity is committed by the gate, never by the generatortested by 1 named test
resolution is scoped to the workspace - a merge joins entities of one workspace, and an all-workspaces read is the union of each workspace's resolutiontested by 4 named tests
top-band candidates merge automaticallyowed
identity across workspaces is expressed only through an explicit alignment assertionowed

Normative text How each clause is checked

P16

Same log, same graph.

In any order, by any route, with duplicates or without: machines that hold the same entries build the same graph.

Laptops, servers and hubs sync in whatever order the network allows. Agreement cannot depend on it.

4 clauses: 4 tested

one observation set converges to one state regardless of order, partitioning or duplicationtested by 8 named tests
a query response is reproducible, and ties and truncation break on a stable keytested by 7 named tests
a response labels the surface that answered, so a retrieval aid is told apart from the convergence surfacetested by 2 named tests
a terminal state is absorbing, so a conclusion is never overturned by a later verdicttested by 2 named tests

Normative text How each clause is checked

Three machines received the same six entries in three orders, and each computed the same graph.

Entries: 1 billing-api is an App / 2 Postgres is a Database / 3 billing-api uses Postgres / 4 webhooks is a Feature / 5 billing-api sends webhooks / 6 webhooks use idempotency keys, a Pattern

Shows one observation set converges to one state regardless of order, partitioning or duplication

P17

Yours to share.

Nothing leaves until you allow a workspace. Text shaped like a secret is refused at the door.

The person who wrote the knowledge decides who sees it. A default that shares everything cannot be taken back.

1 Sync Only the workspace you allowed travels. The others stay on your machine.
2 Allow oss Allow another workspace, and from the next sync it travels too.
3 A secret Text shaped like a credential is refused at the door, and the refusal does not repeat it.

Shows sharing is opt-in per workspace and enforced at the sync boundary, federated retrieval includedcredential-shaped text is refused at every local ingest door, and the refusal does not repeat it

6 clauses: 6 tested

sharing is opt-in per workspace and enforced at the sync boundary, federated retrieval includedtested by 1 named test
the viewer socket and the sync bind admit only the local principal or an authenticated peertested by 3 named tests
the MCP daemon admits only the local principal - loopback TCP is host-local, not single-usertested by 2 named tests
a workspace boundary is not crossed by a derived suggestion eithertested by 1 named test
credential-shaped text is refused at every local ingest door, and the refusal does not repeat ittested by 4 named tests
an authenticated network read tier filters workspace enumeration by the reader's grantstested by 4 named tests

Normative text How each clause is checked

P18

Every write could be wrong.

A sender's claim of trust is kept as sent and evaluated by the receiver. A signature proves who sent it, not that it is true.

Poisoning an agent's memory is an attack. The defense is trust that the receiver computes, never trust the sender declares.

6 clauses: 4 tested, 2 owed

a claimed tier is the receiver's to evaluate, and no wire claim or agent verdict can mint a human's direct acttested by 6 named tests
the reserved surface-marker namespace is refused at every local ingest doortested by 2 named tests
origin is provable and tampering detectable, and a signature is not mistaken for well-formednesstested by 2 named tests
untrusted text never becomes markup in the console that reviews ittested by 1 named test
derived assertions without lineage are quarantined, retrieval is trust-weighted, and contamination can be traced back and cleanedowed
a replicated verdict marker is evaluated against the canon policy, not honored as sentowed

Normative text How each clause is checked

Your node keeps the claim exactly as sent, for the audit trail, and evaluates it as host signed. A signature proves which machine sent it, never that a person checked it.

Shows a claimed tier is the receiver's to evaluate, and no wire claim or agent verdict can mint a human's direct act

Chapter 4 System

How it is built

Code decides and models help. A small surface, and nothing extra to maintain.

P19

Deterministic core, probabilistic edge.

Models widen search and draft proposals. What commits is decided by code that gives the same answer every time.

A model can be swapped, can be missing and can be wrong. The graph cannot depend on any of that.

1 Widen A model widens the search, finding notes that share no words with the question.
2 Model missing Without the model, search falls back to keywords and says so. A write never waits for it.
3 Suggest Similarity can suggest that two names are one thing. Only a verdict commits it.

Shows a failing probabilistic edge degrades and never blocks a write, and says so rather than degrading silentlyembedding similarity only generates identity candidates; a merge commits only through a verdict

4 clauses: 3 tested, 1 owed

a failing probabilistic edge degrades and never blocks a write, and says so rather than degrading silentlytested by 3 named tests
a vector the store accepted is a vector the store returns - a dropped retrieval aid must not be reported as a backend that has nonetested by 3 named tests
embedding similarity only generates identity candidates; a merge commits only through a verdicttested by 1 named test
a probabilistic component's output enters as an assertion carrying its confidence, never as factowed

Normative text How each clause is checked

P20

A core with no IO.

The domain logic touches no disk and no network. Storage, sync and models plug in from outside.

Rules that run against memory alone can be tested exactly, and every adapter can be replaced.

1 Inward Every dependency points inward. The core depends on nothing.
2 No way out An arrow from the core out to storage cannot be written: the core has no IO dependency to call.
3 In memory So all engine logic runs against an in-memory adapter, which is how the rules are tested exactly.

Shows dependencies point inward onlyall engine logic runs against an in-memory adapter

2 clauses: 2 by construction

dependencies point inward onlyholds by construction
all engine logic runs against an in-memory adapterholds by construction

Normative text How each clause is checked

P21

A small surface for models.

Thirteen tools and no query language. A failed call says how to fix it.

The caller is a model with no person beside it. Fewer, clearer tools get used correctly more often.

1 Thirteen Thirteen tools, from observe to workspace_map. owed the surface stays at one tool per recurring intent
2 A call A model calls the tool for what it means to do.
3 A mistake A failed call says what was wrong and how to call it instead: here, an id that is not on this node, and where a real one comes from.
4 Query? There is no query language to pass through, so a query in one has nowhere to go.

Shows a failure tells the caller how to correct itself, since the caller is a model with no human beside itno query-language passthrough exists; the pinned tool list would show one

4 clauses: 2 tested, 2 owed

a failure tells the caller how to correct itself, since the caller is a model with no human beside ittested by 1 named test
no query-language passthrough exists; the pinned tool list would show onetested by 1 named test
the surface stays at one tool per recurring intentowed
long-running work is non-blocking, and mediation asks through elicitationowed

Normative text How each clause is checked

P22

Knowledge as a by-product.

After a commit, the agent is asked for the decision behind it. A new session starts knowing what the workspace holds.

If keeping knowledge becomes a separate job, nobody does it, and the system dies.

1 Commit You commit. The hook asks the agent whether the commit settled a decision the diff does not show.
2 Answer The agent records the decision as an observation that points at the commit. If it settled nothing, it records nothing.
3 Next session The next session starts knowing what the workspace holds, with nobody writing it up.

Shows a commit the agent made asks it for the decision behind the change, and a session starts knowing what the workspace holds, with the person asking for neither

3 clauses: 3 tested

a commit the agent made asks it for the decision behind the change, and a session starts knowing what the workspace holds, with the person asking for neithertested by 2 named tests
curation surfaces as decisions where the person reads, never as a document to maintaintested by 1 named test
observe has minimal friction: free text alone is an observationtested by 1 named test

Normative text How each clause is checked

Chapter 5 Governance

What becomes canon

Writing is free. Trust is granted by a verdict.

P23

A gate to the canon.

Anything can be written. Only a verdict on a proposal changes what is trusted, and proposing alone changes nothing.

Free writing and careful promotion pull apart. Putting the gate on promotion only keeps both.

14 clauses: 9 tested, 5 owed

a proposal is itself an observation, and its state is a deterministic fold with merge absorbingtested by 2 named tests
no merge without a diff: what a verdict would overturn is computed before it is casttested by 3 named tests
blocking checks are enforced by the fold, and reach the same conclusion on every nodetested by 3 named tests
a merge the fold calls blocked has no commit effect - the grant fold and the state fold agreetested by 1 named test
the write surface refuses a proposal the fold could never resolvetested by 2 named tests
a merged verdict has the commit effect its kind promisestested by 1 named test
a recall verdict is not delegable: a recall merge cast anywhere but the human console decides nothing, and the agent surface refuses to cast onetested by 2 named tests
no proposal state blocks or delays an observetested by 1 named test
a rejection is not a negation, and no verdict deletes an assertiontested by 3 named tests
self-attestation is computed from the proposer and reviewerowed, today's behavior pinned by 1 test
a reviewer is shown the informative checks - blast radius and the payload's trust profileowed
every proposal kind the surface accepts has a commit effectowed
a verdict binds to the base it reviewed, and a stale or withdrawn proposal cannot mergeowed
a T-Box change passes the gate - a tbox_change merge defines the type - and direct define_type is the solo-exception shortcutowed

Normative text How each clause is checked

7entries in the log

0changes to the canon

The proposal is an entry in the log, and the canon has not changed. Before anyone decides, the diff shows what a merge would move: one relation, overturning no belief.

Shows no merge without a diff: what a verdict would overturn is computed before it is castno proposal state blocks or delays an observea merged verdict has the commit effect its kind promisesa rejection is not a negation, and no verdict deletes an assertionP14: an identifier stays resolvable after the thing it names is merged away

Chapter 6 Operation

When parts fail

Keep serving, say what is off, and refuse only when serving would mislead.

P24

Degrade loudly.

When a part cannot start, the rest keeps serving and says what is off. It refuses only when going on would be worse.

A server that will not start over a typo teaches people to fear upgrades, and a server nobody upgrades stops getting fixed.

1 Model missing The search model is not there. Semantic search turns off, keyword search keeps working, and the node says so.
2 Hub lost The hub cannot be reached. Sync turns off, every local read keeps working, and sync_status says what to change.
3 Unknown key A setting this build does not know refuses to start, because a misspelled key would otherwise do nothing in silence. A public address without TLS refuses too.

Shows a subsystem that cannot come up leaves the node serving, and says what it disabledthe workaround reaches the operator's own surface, not only a startup logrefusal is reserved for proceeding being worse: a wrong answer, an unauthorized surface, or a configuration other than the one writtenP19: a failing probabilistic edge degrades and never blocks a write, and says so rather than degrading silently

6 clauses: 5 tested, 1 by construction

a subsystem that cannot come up leaves the node serving, and says what it disabledtested by 1 named test
the workaround reaches the operator's own surface, not only a startup logtested by 1 named test
a workaround narrows without asking only toward sharing less, never toward moretested by 3 named tests
refusal is reserved for proceeding being worse: a wrong answer, an unauthorized surface, or a configuration other than the one writtentested by 4 named tests
two conflicting settings resolve by a stated precedence that names what it ignoredtested by 1 named test
a workaround applies to the running state and never rewrites the operator's fileholds by construction

Normative text How each clause is checked

Tensions

When two principles pull apart.

Principles collide. Each collision has a ruling. Where the mechanism behind a ruling is not built yet, the cautious side holds: nothing is removed, demoted or merged automatically.

Ingest first, and leave a path to refine. Knowledge that never came in cannot be refined either.
Do not block ingest. Suspicious knowledge comes in and is held at the lowest tier: a label, not a locked door. owed The mechanism behind this ruling, the quarantine tier, is not built yet, so the cautious side holds.
Privacy wins. A demand to destroy is the one exception to Principle 3, and it leaves a tombstone. owed The mechanism behind this ruling, the tombstone, is not built yet, so the cautious side holds.
Not a conflict. The log is kept forever and retrieval is finite. Forgetting spends attention, not storage. owed The mechanism behind this ruling, retrieval demotion, is not built yet, so the cautious side holds.
Caution is the default. Merge automatically only in the confident band; when unsure, propose a candidate. owed The mechanism behind this ruling, the auto-merge band, is not built yet, so the cautious side holds.
Small is the default. Compose the existing tools first, and promote a pattern only when it repeats. owed The mechanism behind this ruling, a check that the surface stays one tool per recurring intent, is not built yet, so the cautious side holds.
Models only widen retrieval. What commits stays deterministic.
Degrade loudly. Refuse only when going on would serve a wrong answer, an unauthorized surface or a configuration other than the one written.
The gate is on promotion, never on writing. Even with review backlogged, knowledge exists and circulates at a low tier.
Most of it is automatic. Only new contradictions, high-impact or structural changes and recalls reach a person. owed The mechanism behind this ruling, the checks that route review, is not built yet, so the cautious side holds.
The gate is the act. A merged type change defines the type; defining one directly is the shortcut for working alone. owed The mechanism behind this ruling, the gate for type changes, is not built yet, so the cautious side holds.
Destruction wins. It does not pass through the gate, and a decision resting on what was destroyed is undone with its effects. You see which decisions fall before you act. owed The mechanism behind this ruling, excision, is not built yet, so the cautious side holds.
Both hold. A split is a new proposal; the merge stays in the log and only its forwarding is removed.
Outside your grants, an id is unknown rather than refused. A refusal is only for a scope you named.
The channel carries the question and the signature carries the answer. A reply alone grants nothing above the agent's ceiling. owed The mechanism behind this ruling, asking a person through elicitation, is not built yet, so the cautious side holds.
Not a conflict. Evaluation depends on the entry alone and the policy is in the log, so one log gives one canon. owed The mechanism behind this ruling, evaluating a replicated verdict marker against the canon policy, is not built yet, so the cautious side holds.

Method

How a principle is held.

A principle is a conjunction, so it is checked clause by clause. Every clause declares one of four states, and the build fails when a clause declares none, or when a test it names stops running.

Tested by name: Named tests show the clause holds. Rename or delete one and the clause reports itself unguarded.
Holds by construction: The code cannot express the violation, like a crate graph with no path from the core to storage. The mechanism is written down.
Owed, behavior pinned: The clause does not hold yet. A running test records today's behavior, so repaying it means rewriting that test.
Owed: Not assured: it may not hold, or it holds with nothing checking it. It names the milestone that repays it, or the event that brings it due.

Rules about change are tested as change.

Most principles forbid a difference: nothing may be forgotten, a proposal may not move the canon. A final state cannot show that, so these cases snapshot the store before and after an act and check the difference.

given the log as it stands
when  a proposal to merge pg into Postgres is written
then  the canon changed by nothing        proposing is not deciding
when  a reviewer merges it
then  the canon changed by that merge     and by nothing else

The registry, principle_coverage.rs Policy cases, policy_cases.rs

Read the normative text What is owed, and when Install supragnosis