01
Claim boundary
File the claim
A claim not written in the specification is not held.
State the boundary, evidence required, exclusions, producer, and condition that would falsify the claim before implementation begins.
The operating method
Work backward. Evaluate lazily. Preserve forward.
The method keeps the entire problem in scope while forcing only the branch a demanded result needs. Each advancement leaves an artifact another reader can challenge.
02
Precondition graph
Derive backward
What must be true for X to happen—and to remain workable?
Fix the terminal invariant, derive its prerequisites, and refuse to build through an unmet or poisoned dependency.
03
Demand trace
Force only what is needed
The whole remains in scope; only the demanded branch evaluates.
Treat each layer as a thunk. Demand descends from the product; evaluation returns from the foundation upward, rebuilding only the load-bearing surface.
04
Artifact + falsifier
Build with an adversary
Every advancement gives the adversary an equal and opposing tool.
Capability and opposing test arrive together. A guard must demonstrate that it catches a planted violation, not merely report PASS.
05
Result or typed refusal
Emit or refuse
Absence, refusal, and a supported result are different states.
Return the supported result or an actionable typed refusal. Never flatten an unknown, unsupported, or out-of-capacity state into a plausible value.
06
Measured identity
Remeasure from disk
Identity is measured; filenames and memory do not establish it.
Run the full affected battery, remeasure hashes, verify citations mechanically, and let the instrument—not its author—write the verdict.
07
Pinned composition
Compose explicitly
No newest, no shadowing, no silent promotion.
Map each capability to a named layer hash, artifact hash, and tool profile. Conflicting providers without an explicit selection produce a resolution refusal.
08
Failure precedent
Preserve the lesson
Documented failure is reusable capital.
Retain the failed state, classify the mechanism, file the superseding correction, and re-run non-locally so a nearby repair cannot hide a distant regression.
09
Immutable audit envelope
Submit a bounded audit question
The auditor receives a scope, not an invitation to promote the project.
Freeze the submitted bytes, disclose role overlap and known failures, name exclusions, and give the determining lane only the claim it is authorized to decide.
10
Scoped determination
Carry the qualification forward
A qualified pass never decays into an unqualified one.
File the determination with its route and limitations. If the written reasoning is absent, record it as owed rather than reconstructing the auditor’s words.
Controls with jobs
Rigor is executable only when each control can fail.
- Claim boundary
- Stops an example from becoming a general theorem by prose.
- Manifested identity
- Makes the exact bytes under review mechanically recoverable.
- Planted violation
- Proves the guard can fire instead of only reporting success.
- Independent route
- Tests agreement without reusing the implementation path.
- Typed refusal
- Represents unsupported and out-of-capacity states without invention.
- Non-local rerun
- Restores credibility only after the whole affected surface passes again.
- Role-separated audit
- Keeps the owner, writer, reviewer, and determining seat distinct while disclosing any historical overlap.
Three planes · one oversight layer
Evidence, development, qualification, and audit do not borrow standing from one another.
Blueprint plane
Preserved runs—including failure, plateau, poisoned branch, and no-standing states—supply evidence, fixtures, and lessons without being edited.
Development plane
Nine working layers provide the current exact-computation surface. A change must travel with its tests, adversaries, measured identity, and dependent re-verification.
Qualified plane
No layer has cleared every entry condition. The qualified composition therefore exposes no capability and correctly refuses every request.
Oversight layer
The first immutable submission asks only about custody and governance. Its owner-relayed pass-with-qualification does not cover mathematics, and the Audit Director’s written reasoning remains owed.
See the result surface
Process earns no standing by description.
The proof ledger shows which parts currently produce measurements and which remain policy.
Inspect the ledger