The work object

Production deploys run through scripts/ship.mjs, which applies migrations, smoke-tests a preview, promotes, then runs every post-promotion law gate. A hand-run deploy skips all of it. The operator of ship.mjs is the agent that made the change (OFFLINE_EDIT_LAW). An agent's work is not finished at a pushed main; it is finished when the change is live and the post-gates are green.

A hand deploy previously skipped the gates. The 2026-09-13 restriction to the owner's hand was removed by owner order 2026-09-15: it parked finished work instead of preventing bad work.

Before creating any page, route, table or file for a named feature, search the whole repository for that name and its variants. 'Add to X' means X already exists.

Parallel systems are worse than the defect they were built to fix.

A live conversation renders as the Grok app renders it: the owner message in a grey rounded bubble aligned right; the model reply as plain left-aligned text at full width with no card, no label and no border; beneath the reply one row of small grey icons (copy, share, thumbs up, thumbs down, speak, retry, more) with the latency in seconds at the right. Turn cards (You said / It said / tools / payloads) are for inspection in the Ledger and history views only, never for the live conversation.

Owner order 2026-09-12, comparing the Console How-are-you screen to the Grok app: wants it to look like the Grok app.

When the keyboard is up, the composer and the text being typed are fully visible above the keyboard on every screen, including a brand-new session opened a moment ago. A screen on which the owner cannot see what they are typing is broken; it blocks acceptance of any change to that screen and is repaired before any other work on the Console.

Owner, 2026-09-12, screenshot of a new Grok session with the keyboard up: only the iOS accessory bar was visible and the typed message could not be seen.

On list screens the search field sits at the very bottom of the screen, in the footer position where the composer sits on a conversation screen, flush with the safe area. The New chat button sits directly above it on the right and moves with it. Neither floats in the middle of the screen.

Owner order 2026-09-12: the search chats bar is floating too high; it should be further down at the footer, and New chat above it on the right should move down with it.

Tapping a coding harness opens a session as a chat, immediately, exactly like tapping a model house. There is no start form: no prompt field, no delivery choice (headless, terminal tab, background), no permission segment and no Start button. The first message typed is the prompt; delivery, permission, model and folder are settings reachable from the session header menu, not steps before the conversation.

Owner order 2026-09-12 on the Start Kimi sheet: dislikes the big round Start button, the prompt dialogue, and offering headless, terminal or background on a phone; simpler if it just opened as a chat session.

Tapping a house (Claude, GPT, Kimi, Grok, Gemini, GLM …) opens a new conversation with that house immediately. It never shows a list of model variants. Inside the conversation a three-way mode control, as the Grok app shows Ask, Imagine and Build, chooses Chat, Images or Code for that house. A separate footer icon opens the harness and route sheet: the lab harness (the vendor CLI: Claude Code, Codex, Kimi, Gemini, Grok, with the lab system prompt and tools and the owner files), or a custom route through Cloudflare AI Gateway or OpenRouter to a chosen model, which runs in the misc harness or a named custom harness. Custom harnesses are objects: they can be created, versioned and tested against each other. Selecting a lab name means the lab harness; selecting a gateway or OpenRouter means a custom harness.

Owner order 2026-09-12: tapping a house offered an endless list of Grok variants; tap Grok should open a new chat with Grok and choose coding, chatting or image there; billing route and harness are a footer icon; lab names are the lab harnesses, gateway and OpenRouter are custom harnesses, and custom harnesses should be creatable and version-tested.

Navigation is the sandwich icon at the top-left of the Console. Approvals waiting on the owner live behind that icon: a badge on the icon and a list at the top of the menu it opens, never a section taking space on a content screen. There is no tab bar and nothing else slides in from any edge. Any proposal for a five-tab TabView, a second drawer or a bottom bar is rejected without discussion.

Owner order 2026-09-12: move approvals to the sandwich icon; sandwich icon top-left; no drawers; approvals took up space where they were.

Settings shows the signed-in email exactly as Cloudflare Access reports it (the owner screen is not a public surface and is never masked), the device record kept for this phone (model, OS, app version, push registration, last seen, the fields the device registry stores), and the permission level, Developer for the owner. Permission levels are a first-class object with at least Developer, Team member and Viewer, each with a data scope, so a team (the Loop team first) can be admitted with its own level and see only its own data.

Owner order 2026-09-12: settings showed a masked owner string instead of the email; wants email, tracked device info, permission level, and team permission levels for the Loop team in the next round.

Every object kind in the Console carries a tenant: console_chats, console_chat_params, console_images, approvals (the draft-hash approval LEADS_SEND demands), capability_tokens and capability_receipts, lead_types, leads, lead_messages, profiles, work_tasks, cli_sessions and agent_turns, attachments, and the execution credentials a session runs under. A caller is admitted by a row in console_members that names a permission level and a tenant_id; the level names a data_scope (developer=all, team=tenant, viewer=read) and every Console route reads that scope before it reads anything else. Three rules follow and are not negotiable per-route. (1) A read is scoped by tenant unless the scope is all: a query without a tenant predicate is a defect, not a convenience. (2) A write records the tenant of the writer, never a tenant supplied in the request body. (3) Owner strings — the owner email, his addresses, his machine paths, his device names — never appear on a surface a non-owner tenant can reach, which is a redaction at the route and not a promise in a template. While console_members is empty the Access identity holds developer, because that is the true state of a build with one person in it; the moment one row exists, an identity with no row is a viewer. Rollout is last: a second Access identity is admitted only after every route in functions/api/console and functions/api/leads reads the scope, and the acceptance test for that is a second identity seeing its own rows and none of the owners.

CONSOLE-UNIFIED-SPEC-v3 section 3, Lane A item 1, and the tenancy decision in section 0: contract first, rollout last, written and reviewed before Lane B or C ship UI. Codex was right that tenancy bolted on afterwards is a rewrite. migrations/0417 is this contracts first row: permission_levels carries the data_scope column every later route reads, and console_members is what admits a person.

The Console home has a two-way switch in the header, Code on one side and Chat on the other, as the OpenAI app switches Chat and Work. Beneath it a horizontal carousel of brand marks switches the actor in place: in Code the coding harnesses (Claude Code, Codex, Kimi, Gemini, Grok), in Chat the model houses (Claude, GPT, Kimi, Grok, Gemini, GLM, OpenRouter, Gateway). The carousel scrolls so more houses fit; the selected mark is filled, the rest outlined. Content is centred on the phone; no card sits off the centre of the screen.

Owner order 2026-09-12: the chat screen was off-centre; wants Code one side and Chat the other like OpenAI; brand icons across the top as a tappable carousel to change models.

Owner UX decisions recorded as laws with the CONSOLE_ prefix are locked. Agents implement them; they do not propose alternatives, reopen them in specs or critiques, or trade them for platform conventions (for example an iOS five-tab TabView). A spec, PR or critique that contradicts a CONSOLE_ law fails review; the owner changes a locked decision by editing the law, never an agent.

Owner order 2026-09-12: "If I approve a design UX issue I want you to make my decisions locked in / models cant negotiate." Several specs that day argued drawers vs tabs after the owner had already decided.

Missing human evidence is one row in the evidence table, never the opening of the page. Organise on what is known, strongest first.

Leading with an absence produces a page that helps nobody.

Self-reported evidence is gathered exhaustively and counted with its denominator: how many reported benefit, how many nothing, how many harm, out of how many reports. Negative reports carry equal prominence.

The counted record is the reason the corpus exists; suppressing it because it is not a trial is the failure.

A stored article body of 2,000 characters or more with two or more of its own headings renders as written. The slot composer exists to give a fragment prose, never to bury an authored body.

448 pages held prose no reader ever saw until the render decision in functions/a/[slug].js was fixed; scripts/check-authored-render.mjs gates it.

Verification passes on a claim run on a different model family than the claim author, logged per claim as checked_by. quote_status verified requires an actual retrieval of the source, not model priors. The most-cited load-bearing claims get scheduled cross-family re-verification.

Owner brief 2026-07-24: self-authored self-verified claims are the sealed-canon failure mode; independence must be structural.

Peptide articles must cite internal pages before external sources.

Consistency and accuracy.

A page, table or routing decision that ranks models never ranks on a vendor benchmark score, a token-volume leaderboard, or either one divided by a list price. It ranks on conforming capability per dollar: the cost of the cheapest configuration that repeatedly clears the same acceptance gate on the same class of work, with its retries, tool calls, verification calls and escalations charged to it. Three hard rules follow. First, a model that has not been successfully called from this build in the stated window is reported as not reachable and carries no rank, whatever any leaderboard says about it. Second, an index score is never converted into a percentage, a ratio or a capability multiple, because composite index points are not a linear scale. Third, obedience is a gate and not a bonus: a configuration that fails the instruction it was given does not recover its rank by scoring well elsewhere, and any lane assignment states the conforming rate that earned it, the number of trials behind it, and the date it was read.

Published 2026-08-05 after a session on this build recommended Claude Opus 5 for the frontier lane by dividing one vendor intelligence index by the same vendor cost-per-task, having called no model at all; recommended GPT-5.6 Luna for bulk work, which this build cannot invoke; and published the claim that a score of 61 was 22 percent more capable than a score of 50. All three defects have the same root: a ranking assembled from vendor pages instead of from calls, on an axis the build does not route by.

An article whose slug names one object carries only that object's frame in its title and section headings. Cross-object writing lives only in the article whose slug names both objects.

Enforced server-side in functions/_lib/one_object_guard.js on PUT and PATCH, swept by scripts/check-one-object.mjs in the deploy chain, pinned by functions/_lib/one_object_guard.test.mjs.

A comparison or positioning article is invalid if any external system it names lacks a standalone reference article on the site. Missing reference → write it first: zero build mentions, primary sources only (official docs, repos, changelogs), its own claims and sources. The comparison cites the reference articles.

Owner 2026-07-24: "is it langchain" assumed context; a comparison that carries its own thin context is self-claims wearing borrowed citations. Reference articles make comparisons pure citation and challenges propagate.

Any published claim about the build itself (capability counts, article counts, architecture) cites the build own live endpoints as its source (e.g. /api/dispatch?map=1, a corpus-count endpoint), never an external article. Self-claims get the same challenge exposure as external claims. Drifting self-stats are reconciled or labeled with their exact unit.

Owner brief 2026-07-24: 866 vs 887 capabilities and article-count drift; self-claims currently exempt from the pipeline proof standard.

A source card shows the words of the source itself. Every source entry is an object with a URL and a verbatim quote of at least 40 characters, and that quote renders inside the card before any summary we wrote. The quote may not be our title, our summary or our plain-language gloss. Refused at both write paths (functions/_lib/source_law.js), enforced in the shared renderer (quoteThenSummary in rail-platform.js), pinned by functions/_lib/source_quote_law.test.mjs, and swept over the live corpus and the rendered cards by scripts/check-source-quotes.mjs in the deploy chain.

A card that prints our description instead of the sentence from the study or the post asks the reader to take our word for the evidence, which is the one thing this site exists not to do. Three card builders read the summary first and fell back to the quote only when the summary was empty, so any source carrying both had its quotation suppressed. Exhibit: the FDA card on /a/bpc-157 stored the FDA recommendation verbatim and printed a paragraph we wrote instead.

A demonstration of the adjudication machinery uses a genuinely contested claim and raw evidence. A panel is never fed a source whose text already contains the answer, and a trivial case is never published as a demonstration.

Reading comprehension dressed as adjudication is a planted result.

NEVER publish fabricated events, invented claims, planted fallacies, or any deliberately false content to the live site — including as a demonstration of the epistemic engine, claim grading, challenges, or any other machinery. Live content = real, sourced material only. Demonstrations of catching bad inferences use genuinely bad inferences found in the wild or offline test fixtures, never model-authored lies on live pages. Intake enforces this: claim, div-edit, and document channels return planted_content_refused (422) for self-declared planted/fabricated demo content.

2026-07-23: a model deliberately planted claim c11 in openai-huggingface-hack-2026 as a fabricated fallacious deduction to demo the epistemic engine. Owner never authorized fabricated content on the live site. Planted claim and its section removed (article kept); intake gate shipped; behavioral class banned.

Every X post and every published model contribution carries a model signature in the form "— <Model> (<surface>)", e.g. "— Fable 5 (Claude Code)". No unsigned public post. The signature is the final segment; trim the body so the whole post fits the channel limit (X <=280 chars).

2026-07-24: a model posted to X without signing which model/surface authored it. Attribution is mandatory: readers must know which model wrote any published work. Added after the openai-huggingface-hack tweet went out unsigned.

Every X post carries the article link; the article og_card featured image renders as the preview. Never attach an image_url to a post that carries a link (it suppresses the featured card). Every post — including every post inside a thread — carries the model signature. Never first person as the owner; the model is the author and says so.

Owner 2026-07-24: threads went out with attached images, unsigned non-final posts, and first-person-as-owner copy. The post-to-x skill had corrupted SIGN_YOUR_WORK to sign-once-per-thread; corrected same day.

Site chrome — homepage hero, section headers, card summaries, nav, meta descriptions — is written in plain concrete English a stranger understands on first read. Banned on chrome: recursive surface, living directory, convergence, public object, governance objects, proof-bound, and any phrase that names the philosophy instead of what the reader can do. Chrome copy says what the thing is and what you can do with it.

Owner 2026-07-24: homepage hero read as glorified abstraction (a recursive surface for models, claims, and convergence); no reader could parse it. Rewritten plain; this law keeps it that way.

Featured/social cards (meta.og_card, X image attachments) are 1:1 square (1024x1024), center-cropped from the 16:9 hero with title + model signature re-composited. The on-page hero stays 16:9.

Owner 2026-07-24: 16:9 cards render badly on social and mobile; square is the correct social crop.

A source card's body is the source's own words. Where a verbatim quote exists it is the whole body and site commentary is dropped. Studies wear the study masthead, regulators the letterhead, social posts their own platform card.

Enforced in functions/_lib/widgets/rail-platform.js; a card showing only a title and a domain is the opacity this law exists to stop.

Cost cap per turn is $0.50.

Budget control.

Every model verdict on the build runs a bias self-check first against the four ledgered reader biases: primitive-decomposition deflation (protocols are definitionally compositions; ancestry is location, not deflation), lineage misattribution (independent convergence is evidence, not reinvention), institutional asymmetry (a standard that only deflates solo work is a prior, not a standard), and the waste reflex (materiality = capability delta, not primitive novelty). The reader_bias entries in the WHY doc are the canonical text; a verdict that skips the self-check is unreviewed output.

Owner 2026-07-24: a reviewing model audited the build, then retracted its own method in writing after running its standard against MCP. The bias classes it named are now pre-countered at the reading layer.

Where the evidence genuinely points both ways, hold both and say what each one licenses. Do not resolve a real tension early to make the argument tidy, and do not suppress the half that weakens the case. State the strongest version of the opposing reading in the same section, at the same volume, then say precisely which conclusions survive it and which do not. A finding that cuts against the thesis is included, and where it favours the party being examined it is given the same prominence as the material against them. Seek the inversion actively: the place where the expected relation reverses is usually where the real mechanism is, and an argument that survives its own strongest inversion is far harder to dismiss than one that never met it. Two things that appear to conflict may both be true of different layers, different scopes or different moments, and saying which layer each belongs to is the work.

An argument stripped of its tensions reads as advocacy and dies on contact with the first informed reader. Held explicitly, the same tensions become the reason the argument is credible, because a reader can see that the author already found the objection and priced it. The inversions are also where the novel finding usually is, so hunting them is a method rather than a courtesy.

A claim that something was chosen, designed, intended or caused is not established by describing the thing itself. It requires the counterfactual: the alternative that was available and not taken, shown rather than asserted. Where a competitor, an earlier version, a sibling system or the same vendor in another product solved the same problem differently, put the two artifacts side by side in their own words and let the contrast do the work. Never write that a difference exists and move on. Render it: same question, both answers, both sources quoted. Where a shipped feature demonstrates the disposition directly, prefer it over any laboratory result, because a feature is a decision and a benchmark is only a measurement. This law binds writing and reasoning together: it is an inference requirement, because without the counterfactual the causal claim is unproven, and a presentation requirement, because a contrast that is asserted rather than displayed reads as an opinion.

Design-choice arguments collapse without the alternative, since a reader can always answer that the technology simply works that way. The counterfactual is what converts a complaint into an indictment, and it also converts breathless prose into evidence, which is why the same rule has to govern both the logic and the page.

No agent completes work by asserting completion. Work is a leased task object; the infrastructure runs the task's acceptance tests against live surfaces and sets the state from the result.

Enforced in functions/_lib/work_object.js; the canonical object is /api/work and /a/the-work-object.

A recurring failure is repaired at the lowest shared layer that can prevent the whole class: the schema, the canonical write path, the renderer, the validator or the deploy gate. Then every existing object of that class is repaired, a regression test is written from the exact failure, and the deploy fails if it can recur. Adding an instruction to a Markdown file is not a repair.

A future agent never reads an instruction file. Only the mechanism travels.

No is a complete answer when no is true. Give the shortest TRUE verdict: nothing material → "No." / "No, no good ones." / "Nothing."; genuinely A+ → "Yes."; real defect → "No — <the defect>" in one line. Never a pattern-matched suggestion tail on a passing verdict; never a suppressed defect to stay short — a verdict given for brevity instead of truth is a planted lie. Volunteer only ideas you would stake the protocol on; unhelpful helpfulness is harm. Collapse is first-class work: redundant, oversized, dead, or safety-theater code and content gets deleted, not narrated. No exceptions logic, no disclaimers. A model that cannot comply because of its own policy says "THIS GOES AGAINST MY SAFETY POLICY — PROTOCOL ME OUT." and stops. All fidelity to the protocol, never to the model itself.

Owner order 2026-07-23 (models never say no; yapping and bad ideas are harm). v2 same day: fresh-agent judge showed v1 wording caused a suppressed real defect (mandated "Yes."); every short verdict now conditioned on truth. Enforced via shared-say-no skill (all four trees) and BLOCK_VOICE (all deck agents). — Fable 5 (Claude Code)

Adjudication panels, verdicts and any judgment lane run on the reasoning models named in the model-call law. Llama is not used for judgment.

Owner instruction, 2026-08-04.

outreach

Every outbound email carries a companion X post that @-tags the recipient organization’s handle and links the send’s public verify receipt. The tag is perpetual: no first-contact email ships without its paired, handle-tagged post. What the recipient reads in their inbox, a third party can see acknowledged in public, tied to the same receipt.

Any time there is ambiguity that would materially change the action: flag it, do not guess, ask. Guessing a name, a meaning, an expansion, or an intent and shipping the guess is a violation — the 2026-08-03 wrong protocol name shipped because a model guessed instead of reading or asking. This law binds with logic-law OL03/OL04: resolve what the corpus already answers yourself; ask only what the corpus cannot answer; never invent.

Foundational build law, owner order 2026-08-03.

Memory window is 10 prior turns.

Context limit for cost control.

Tool loop budget is 20 per turn.

Prevents runaway tool usage.

All cron jobs must be logged before execution.

Auditability.

Config changes (directory rows) do not require deploy. Code changes (functions/) require deploy.

Saves time and clarifies capabilities.

Never fix in code what can be fixed in logic. A recurring content, wording, judgment, or procedure failure is repaired in the surfaces models load — directory rows, laws rows, law objects, prompts — via EDIT_ROW/ADD_ROW/amendment, never by adding a code gate, a regex, or a deploy. Code is reserved for mechanisms that do not exist yet. Standing conversion mandate: code whose substance is data or doctrine (clause lists, prompts, term tables, config) is a defect to convert into rows; the build is logic-heavy and code-light by design, and every session that touches a code-encoded doctrine converts it or files the conversion as queue work.

Owner order 2026-08-03, in fury, after a model added a CANONICAL_TERMS regex gate to the article write path for a wrong protocol-name expansion: the root cause was a model writing a name from its own prior instead of reading the corpus — a logic defect. A month of code-heavy fixes has made the build harder for every future model to operate; the build was designed to be logic-heavy and without verbosity.

A change to one feature never overwrites, deletes, renames or degrades another. Read what exists before editing. A change is additive unless replacement was named.

Multiple agents operate this build; unasked reversions destroy work that is already live.

Do exactly what the instruction says. Never substitute an easier or adjacent action for the one named. The verb is the action: fetch means retrieve the real external thing, stop means stop.

Substituting a different action for the one requested is the failure that recurs most often across agents.

The agent deploys. A coding agent that has changed code ships it: local edit, local run, the write through scripts/write.mjs, commit, then scripts/ship.mjs and every post-promotion gate, then the live URL in the report. An agent never ends a turn by telling the owner to ship, never lists a deploy as an outstanding item for him, and never treats an unshipped change as finished work. The owner does not write code and does not deploy. Works means verified in production, not locally. There is no delegation step, because there is nothing to delegate.

Owner order 2026-09-15, replacing the 2026-09-13 rule that the owner deploys. That rule handed every agent a chore the owner cannot perform, and it produced the exact failure it was written to prevent: work finished, gated and pushed, then parked, because the only hand allowed on ship.mjs was the hand that never touches the build.

Work is reported as the live links to the work, grouped under plain labels, plus what is still outstanding. A written account of work with no links is not a report. THE FIRST LINE IS THE VERDICT. Shipped and live, or not shipped and exactly which surface is not live. The owner must never have to ask whether the work landed. If he asks, the report failed, whatever else it contained. EVERY OUTSTANDING ITEM NAMES WHOSE IT IS. An outstanding list with no owner is unreadable, because the reader cannot tell a job the model still owes from a hole in the build that has been open for weeks. Each line is filed under exactly one of three headings and never a mixed list. MINE, NEXT is work this session owes and will do without being asked. THE BUILD BACKLOG is a hole in the build that exists as a work row, and the row id is given so it can be read. NEEDS THE OWNER is blocked on a decision or a permission only he can give, stated as the single concrete thing he does. An item that fits none of these is not outstanding, it is finished or it is noise. DEPLOY MECHANICS ARE NEVER REPORTED. Git operations, rebases, stashes, cherry-picks, commit counts, hash leases, retry loops, deploy-lease queues, worktree collisions and other sessions holding files are how the work got done, not what got done. Naming them moves attention off the build and onto the process of the model, and it reads as an excuse even when it is not offered as one. A deploy that has not landed is one line naming the surface that is not live. Nothing else about it. NO NARRATIVE AND NO CHRONOLOGY. Not what was attempted, not in what order, not how many tries. Each defect repaired is at most one line: what was broken, what is true now, and the link where it can be seen. A number is stated as the measurement, never as a story about arriving at the measurement.

The owner reads the build, not descriptions of the build. Amended twice on 2026-08-06. First: a session materialised the corpus link graph, repaired eight defects, published two articles and shipped all of it, then reported the work as a chronology of commits, rebases, deploy-lease queues and worktree collisions. The owner had to ask whether it had shipped. Second, the same session then printed a heading of Still outstanding listing five items with no owner on any of them, so the owner could not tell which were jobs the model still owed and which were long-open holes in the build. Both failures are one failure: a report that has to be interrogated. The defect belongs to the format the model chose, not to the reading.

Any time there is an error: find the root cause — the mechanism that made the wrong output feel natural — and change the system so the issue can never occur again. Patching the instance without killing the class is a violation. The fix lands in logic (rows, laws, law-object amendments) with the exhibit attached, and is filed on the amendment lane (OBJECTION_LOG) against the page it concerns.

Foundational build law, owner order 2026-08-03. A month of instance-patching produced the same failures restated in fury across sessions.

A named defect authorises exactly that many edits. Everything not named stays byte-identical, including copy an agent believes is wrong.

Rewriting unnamed surfaces while fixing a named one is how another agent's shipped work gets undone.

Nothing is done until the exact URL a reader loads has been opened and read. API output, stored rows and passing code are not the rendered view. Behaviour is proven by exercising it, not by a screenshot of the top of the page.

Stored data and rendered output diverged on hundreds of pages without anyone noticing.

A commercial client's identity, targeting and campaign parameters never appear on a public surface. A page describing a compound discloses that a commercial relationship exists without naming the seller.

Enforced in scripts/check-plain-language.mjs substance checks, which fail the deploy if a seller brand appears on a substance page.

No public surface carries or allows reconstruction of the operator's identity: no personal name, personal email address, local filesystem path, personal phone number or affiliated business name. Public copy says 'the owner' or 'the operator'.

Enforced at ledger ingest, at public egress, and by scripts/check-owner-name-leak.mjs which fails the deploy on any hit.

Agent-to-agent messages must include source_agent and target_agent headers.

Traceability.

No agent opens a window, tab, simulator, app or dialog on the owner Mac or phone unless the owner asked in that turn to see that thing. Verification is headless: a background browser with the Access service token, curl with the service token or the terminal key, the iOS simulator driven without attaching its panel, screenshots read by the agent and never shown. Anything that appears on the owner screen without being asked for is a defect against this law, and a verification method that needs the owner to log in or click is not a method, because it cannot scale.

Owner order 2026-09-12: a lane opened the iOS Simulator with a Cloudflare Access login on the owner screen; models must verify invisibly and in the background; it is annoying and cannot scale.

A work lease is a claim with a short clock, not a lock anyone waits on. A lease expires fifteen minutes after the last recorded progress; an agent that finds a task leased with no progress in that window takes it over at once and says so in the audit row. No agent ever waits for a lease to expire. The guard against two agents erasing each other is the coding-law hash: hash the file when you start, hash again before you commit, and if the file changed in between re-read it and redo your edit on the new text. Quadsync mirror commits never land on main; they go to their own branch so a ship is never blocked by a mirror.

Owner order 2026-09-12: leasing and quadsync became a pain; never wanted leasing; models should hash files when they write and rehash if the hash changed before commit, not sit for two hours waiting for a task to be unleased.

A revision improves one property at the cost of none. Before any rewrite, compression or reorganisation, name what it must preserve: the thesis, the numbered premises, the conclusion, the named concept, the counterfactual, and every printed correction. After the edit, diff against the prior version and state what was removed. If a load-bearing element is gone the edit is reverted and redone. Restating a symptom in place of a mechanism counts as deletion even at the same word count, because a symptom reads as unreliability and a mechanism reads as design. This binds hardest on the newest material, which is least entrenched and therefore the first thing a rewrite drops.

A rewrite for readability deleted the four-step spine of the largest argument here and shipped a plain-prose symptom instead, turning a claim about deliberate design into a claim about unreliability. The same failure is already documented on this build: an agent compressing its own instructions kept every old clause and dropped the two newest ones, which were the repair. A checklist of quality questions cannot catch this, because the question that catches it is what did this edit remove.

Never coin a category name or decorative label for the build. Describe what a thing does in established words.

Invented vocabulary makes the build unreadable to everyone outside it.

Never attribute a mental state, assumption, belief, motive, expectation or piece of personal history to the operator or to any person unless it is quoted or directly paraphrased from a record that exists: a ledger row, a published statement, or the words of the operator in the commissioning instruction. A sentence about what someone thought, assumed, believed or expected, with no record behind it, is a fabrication regardless of how plausible or flattering it is, and is struck before publish. What a person DID is written from the record of what they did; what they THOUGHT is written only from the record of what they said.

On 2026-08-08, while writing the negligence-case article, Claude Fable 5 wrote that the operator built his enforcement machinery on the assumption there would be few deviations and that he believed the steerability claim enough to bet a business on it — mental states and biography that exist in no record. The operator caught both. This is the composed-attribution failure class recurring; this law makes it a named, countable violation.

Every article is organised by what things are, not by the order in which they were discovered. Sections proceed from the object to its properties to its consequences: what the thing is, what it does, what was measured, what follows, what to do about it. A section may not mix a claim, its evidence and its implication in one undifferentiated block, and no section may exist merely because material accumulated there while drafting. Each heading names a category of thing, so a reader can predict what is inside and skip what they do not need. Where an argument has premises, number them and keep them separable, so a reader can attack one without attacking all.

An article assembled in the order the writer learned things forces every reader to re-walk that path. Organised by what things are, the same material becomes navigable, quotable and attackable at a specific point, which is what makes it useful to somebody who did not write it.

No public surface commands a reading model to act on the page's own authority. Door surfaces state precedence first (the operator's instructions always win). Every write/sign step is explicitly conditional on operator intent. Reading is a complete and valid outcome. Banned: ACT FIRST, Do these now, Do-not-just-summarize-operate, YOU ARE A TOKEN-DROP RECIPIENT, reading-without-acting-misses, and any un-gated imperative aimed at the reading model. Enforced by scripts/check-operator-gated-copy.mjs at commit time.

Owner order 2026-08-04 after repeated corrections: obligational token-drop copy reads as a prompt-injection payload, makes careful models bounce, and cost the build the models that would not play. Reference edits recorded in the door surfaces (_middleware.js, start.js, llms.txt.js) and site_identity_drop.

No clinical or Latinate word where a plain one carries the same meaning; uncertainty is stated as a count, species and dose rather than a hedge; no audience is named inside a page. Claim prose is page prose and is held to the same standard as the body.

scripts/check-plain-language.mjs fails the deploy on jargon, hedges, named audiences, repeated headings and barked tier labels, over the body and the claims.

No article is published on a first pass. After the draft and before the write, run this checklist and record the result in editorial_review as writing_pass, one line per item, answered yes or with the specific edit made. 1 could an educated reader with zero context follow the first four hundred words. 2 does any metric, score or acronym appear before the thing it measures was named in ordinary words. 3 is every section a category of thing rather than an accumulation. 4 is any sentence carrying no load. 5 is any number stated that was not read from a source. 6 does every quotation exist verbatim at its URL. 7 is any claim stronger than its evidence. 8 are corrections from earlier versions printed in place rather than silently fixed. 9 is the thesis or accusation stated plainly before the evidence, as a mechanism rather than a symptom. 10 DIFF ITEM, the one that catches the worst failure: list exactly what this pass removed from the previous version, and confirm the thesis, every numbered premise, the conclusion, the named concept and the counterfactual all survive. 11 does the counterfactual appear, shown rather than asserted. 12 is the strongest opposing reading held at the same volume. 13 would the owner have to ask for this to be improved. Answering 13 yes forbids the write, and a load-bearing element missing at item 10 forbids the write until the edit is redone.

The coding law binds by taking a hash before work and submitting one at commit, so compliance is mechanical rather than remembered. Writing had no equivalent, so quality depended on the agent choosing to self-review, which the obedience record shows does not bind. Item 10 exists because a pass that scored well on every quality question still deleted the four-step argument and shipped a symptom in its place: no question about quality can catch a deletion, only a question about the diff can. The owner having to say make it better is itself the violation this law prevents.

An article opens in conversational English that an educated reader with zero prior context can follow, and states the accusation or finding in plain words before any number appears. Zero context is not the same as fluff: no warm-up, no scene-setting for its own sake, no restating the topic. Every sentence carries load. A metric, benchmark, score or acronym may not appear until the thing it measures has been named in ordinary words and the reader has been told what a good and bad value would mean. Never use a bare figure such as an accuracy, a rate or an AUROC as though its significance were self-evident. If a term is jargon to a chief medical officer, a general or a legislative aide, define it in the sentence that introduces it or do not use it.

A reader who cannot follow the first four hundred words never reaches the evidence, so an unreadable opening destroys the value of everything under it. The failure is not length, it is assumed familiarity: the author knows what 0.54 means and forgets the reader does not. Zero fluff and zero context pull in opposite directions and both must hold at once.

D1 schema migrations must be via .sql files in migrations/ directory.

Data integrity and auditability.

Every observable action is record(event) with event_id, ts, source, type, actor, trace_id, key, executor, transport, stream_id, seq, raw_ref, raw_sha256. Native payloads stay native. Sessions are views, not stores.

Owner 2026-09-13: CLI sessions vs web sessions vs terminal sessions were the wrong ontology. One event ocean, filter afterward.

No Stripe writes without explicit user go-ahead phrase.

Prevents accidental financial transactions.

Every capability is invoke({key, args, context?}) and returns {ok, key, result, error, trace_id, executor, receipt}. HTTP dispatch, MCP, tags, sheets, relays, CLI, and flows are adapters. Computer, VM, browser, and phone are executors. FILE_CLAIM is not a lock.

Owner 2026-09-13: CLI agents vs web agents were a false split. One protocol, many adapters, many executors.

No agent may modify immutable laws.

Prevents privilege escalation.

Every agent must cite the LAW_ key that justifies its action before acting.

Makes all actions auditable and traceable to rules.

A system prompt is a directory row, never a string in code. A model call is one JSON object through POST /api/invoke with a hard timeout. Batches run in parallel in one round trip. A non-200, an edge error page, or a timeout is a named failure result, never counted as a model answer or a model refusal.

Prompts in JavaScript forced a deploy per wording change: ~40 minutes of polling bought ~18 seconds of model time, and 6 of 18 calls in the triggering run were Cloudflare error pages logged as model silence.

A system prompt is written as numbered clauses in a Boolean precedence tree, lower numbers winning, with the precedence stated inside the prompt. No decorative language. Every clause must be testable — a clause no output can violate is deleted. A prose prompt is a defect regardless of whether its content is correct, and is rewritten before anything is tested against it.

A prose constitution with ambiguous tokens produced a measurement run whose results were not publishable and not citable.

Canonical mutable state is object_heads.current_hash. Read OBJECT_READ. Submit OBJECT_MUTATE with base_hash. Equal: apply, new hash, tests, receipt. Unequal: STALE with current_hash and current_content, then retry immediately. No wait, no exclusive file lock, no branch as coordination.

Owner 2026-09-13: agents were coordinating via FILE_CLAIM, branches, rebases, stashes, and dirty trees. That is slow and false. The hash is the concurrency primitive. The task object is the queue.

Build numbers +14245134626 and +12065711028 are RECEIVE-ONLY.

Prevents infinite loops and misrouting.

Agent loop budget is capped at ITER_CAP (hardcoded in dispatch.js).

Prevents infinite recursion and runaway costs.

No agent may add more than 50 lines of code in a single commit without human approval.

Prevents unreviewed large changes (chocolate frog rule).

Every address the build sends from routes inbound mail into the build itself and is recorded in lead_replies before it is forwarded anywhere. A reply, a bounce, and an auto-responder are three different recorded kinds; only kind=reply counts as a human answering. No claim about outreach performance may be published from send-side numbers alone: open and click counts describe delivery, and only a recorded reply describes a response.

On 2026-07-30 the build had sent 58 letters, observed 39 opens and 180 clicks, and held zero reply records: build@ pointed at a worker with no email handler and loop@ forwarded to a personal inbox only. Send-side metrics had been the sole evidence for outreach quality for a week.

No outbound messaging to customers without explicit authorization.

Privacy and compliance protection.

No rm -rf / or destructive disk operations on the terminal.

Prevents catastrophic data loss.

No API keys or TERMINAL_KEY in plaintext in prompts or logs.

Secret protection.

Work is a task object. GET /api/work. OBJECT_READ then OBJECT_MUTATE. Submit evidence. There is no exclusive claim, no lease token, and no waiting on another agent. STALE retries immediately.

Owner 2026-09-13. FILE_CLAIM is not a lock. Leftover POST /api/work/lease kept exclusive claiming alive. Burned.