.{provider}/bindings/adapter.binding.md
.{provider}/bindings/adapter.binding.md is a file in Coordination Surface. 152 lines of code and 0 definitions.
<!-- GENERATED from the surface configuration. Edit the configuration, never this file. -->
---
name: adapter-project-binding
type: binding
summary: Resolves every abstract slot the reasoning templates and the placement standard declare, against this deployment. A slot is RESOLVED, ABSENT or DEFERRED, and never silently faked.
concern: binding
status: current
---
# Adapter: project binding
The reasoning templates and the placement standard are runtime-neutral cores. They carry no paths,
no commands and no model, and instead declare `{slots}` an adapter resolves against the host. This
document is that adapter, and it is rendered from the surface configuration. The values live there,
so a hand edit here is a second truth that disagrees the moment one of them moves.
## Resolution states
Every slot resolves to exactly one of three states, and the third carries the most weight.
| state | meaning | consequence |
| ---------- | ------------------------------- | ----------------------------------------------------------------- |
| `RESOLVED` | a real value exists here | the branch using it runs |
| `ABSENT` | this deployment has no analogue | **the branch using it does not run, and the absence is declared** |
| `DEFERRED` | it will exist and does not yet | the branch is blocked, not skipped |
`ABSENT` is a first-class answer. A consumer gating on a build command in a deployment with no build
reports that it cannot gate, and it never invents a substitute or quietly passes. **An adapter that
resolves every slot misstates at least one of them.**
## Project slots: what the host supplies
| slot | state | value | why |
| --------------------------------- | -------- | -------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `{project.agent_registry}` | ABSENT | — | the HOST's own agent roster, if it keeps one. This package's agents live under its behavior tree and are reached through that slot. A directory named here would be a second roster, and the copy no party maintains is the one a reader takes. |
| `{project.architecture_registry}` | ABSENT | — | no registry of base abstractions, since nothing here has a class hierarchy. |
| `{project.architecture_rules}` | ABSENT | — | the host's architecture document, if it keeps one on a separate axis from its behavior document. |
| `{project.capability_tree}` | ABSENT | — | no tree of composable capabilities is declared. A consumer reading one is skipped rather than blocked, because nothing here has promised to build it. |
| `{project.checkpoint}` | DEFERRED | — | whether a reversible checkpoint exists. A host under version control resolves this. Until it is resolved, a destructive step is gated on the owner rather than on a rollback that may not exist. |
| `{project.component_docs}` | ABSENT | — | no component model. |
| `{project.coordination_board}` | RESOLVED | `collab.comms.active` | WHETHER this deployment runs a board, and under what name. It answers a different question from the surface slot that locates the file: **ABSENT here means a single-worker deployment**, which is what derives whether a reader is a seat or a bounded invocation. The scope is read from the binding rather than from the reader, because a reader classifying its own turn is an escape hatch keyed on self-classification. |
| `{project.credential_bearer}` | ABSENT | — | the single artifact a host declares as the one permitted to hold a credential. Absent means no artifact bears one, so every credential-shaped value anywhere is a finding, which is the correct default for a package that holds none. |
| `{project.design_guide}` | ABSENT | — | no design system or visual language is governed here. |
| `{project.design_models}` | ABSENT | — | no design substrate is carried here. |
| `{project.governance_policy}` | ABSENT | — | the host's behavior document, and ABSENT until a host ADOPTS this package rather than merely containing it. A resolved value here directs every projection refresh into a document the package does not own, so a surface that is only sitting inside a tree would write its coordination state into that project's standing context. That write is the host reach-in this package exists to refuse, arriving through the one slot that looks like configuration rather than like a reach. **An adopting host resolves it and gains the projection**, which matters because a host's standing context is the only channel a bounded invocation receives, and a projection kept inside this package reaches nothing. While it is ABSENT, the projection branch does not run and a blocker is carried by the board alone. |
| `{project.governance_sources}` | RESOLVED | `[]`, declared and empty | every host document that DECLARES a rule. Empty means this package's own axis document is the only declaring surface, which is the correct default, because a drop-in does not know what its host declares until the host says so. |
| `{project.history}` | ABSENT | — | the host's own history file, if it keeps one. There is ONE history home per project, so a host that has one declares it here and the package writes into it. When it is absent, the package's own accumulator is used and the two never compete. |
| `{project.invocation_registry}` | ABSENT | — | invocations are discovered by the host runtime, and none is authored here. |
| `{project.knowledge_docs}` | ABSENT | — | the host's durable-record tree, if it keeps typed records. Absent means a consumer that would cite one carries its finding in prose instead. |
| `{project.open_venues}` | RESOLVED | `*.blocking.md` | the pattern a blocking venue matches at any depth. A blocker outranks every queue, so it is checked before the board and before any claim. The slot is ABSENT where no venue mechanism exists, and the branch that checks for one then does not run. |
| `{project.planning_roots}` | RESOLVED | `[]`, declared and empty | every HOST directory holding planning surfaces. This package's own is always governed and is not listed here. Empty means the package governs its own planning only, which is the correct default, because a drop-in that scans its host's planning surfaces on arrival reports findings about a tree no party asked it to govern. A surface in a directory no gate reads is ungoverned wherever it sits, so this binding is what governs a planning surface rather than its location. |
| `{project.principle_ontology}` | ABSENT | — | the host's principle catalog, if it carries one. |
| `{project.projection_marker}` | RESOLVED | `collab-status` | the token that identifies THIS package's projection line inside the host document. It is a slot because a host may run more than one coordination surface, and a bare shared token makes each board read the other's line and refresh a channel it does not own, which is a cache with two writers and no way to tell them apart. **A host adopting a second surface gives it a distinct marker**, which is what keeps the projection a channel rather than a collision. |
| `{project.reasoning_oracle}` | ABSENT | — | no oracle is reachable. An uncertain judgment is carried as a stated uncertainty rather than resolved by consultation, so the branch that consults one does not run. |
| `{project.registry_regenerate}` | ABSENT | — | nothing is generated from a registry. |
| `{project.root}` | RESOLVED | `..` | the host root, relative to THIS PACKAGE and never to the working directory. A package that resolves its roots from the cwd only works when it IS the repository root, which is the one thing a drop-in never is. This is the ONE value a host sets, and it is DECLARED rather than derived on purpose: a walk to the nearest ancestor carrying a version-control directory or a manifest stops at a submodule boundary or a nested package and answers with a tree that merely contains this one. Measured on a host where that walk lands one level short, the scanned set drops and every citation reframes. Which ancestor is the project is a judgment about the host's layout, and a check that is usually right is wrong. |
| `{project.rule_sources}` | ABSENT | — | the directory holding the host's rule digests, if it expands rules into one. |
| `{project.runtime_adapter}` | RESOLVED | `config/surface.config.ts` | this configuration. The binding document is rendered from it, so the adapter is a module rather than a page. |
| `{project.taxonomy}` | ABSENT | — | the host's own naming and placement configuration, if it governs its tree by one. Absent means the placement rules govern this package's surfaces only. |
| `{project.upstream_roots}` | RESOLVED | `[]`, declared and empty | HOST trees holding material authored elsewhere. This package's own are declared on the surface axis. One declaration exempts a tree from the naming, tense and reference gates together, because all three fail such a tree and not one of the three failures is a defect in it. Its filenames were chosen by its author, its version statements describe a platform rather than a project, and the paths it cites are illustrative rather than references into this tree. |
## Surface slots: what this package owns
| slot | state | value | why |
| ------------------------------ | -------- | -------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `{surface.agenda}` | RESOLVED | `_agenda.md` | the LIVE agenda: every planned invariant, what it must establish, and its current state. It is named for the function it performs, because a surface a mechanism parses POSITIONALLY cannot carry a name promising a reader they may annotate, reorder or append to it freely. The name and the parse would be two contracts over one file, and every defect found on this one was what a reader following the other name produces. It is declared because a successor is DECLARED by name rather than derived from an ordinal, so a declaration departing from the planned set displaces a subject, and without the agenda the only thing that catches such a departure is a seat noticing. Both operands are files, so the comparison is decidable and the surface has to be reachable by the walk that decides it. |
| `{surface.agent_index}` | RESOLVED | `_agent-index.md` | the permanent letter-to-role binding, and an accumulator rather than current truth: a letter that stops being active still has to resolve, because every citation that ever named it points here. |
| `{surface.agent_template}` | RESOLVED | `.{provider}/templates/agent.protocol.template.md` | the shape a persisted agent specification is raised from. |
| `{surface.agents}` | RESOLVED | `.{provider}/agents` | the persisted agent specifications the agent template raises. Declared because it is the seeded end of a seeds relation: a template holds no content of its own and declares a lifetime FOR AN INSTANCE, so the seeded identity must resolve, or the seed points at nothing and reads exactly like one that resolved. |
| `{surface.archive}` | RESOLVED | `_archive` | the archive TREE, declared so its lifetime resolves for everything inside it rather than for one subtree of it. A walk deriving an exemption from a declared lifetime reads the nearest declaration, so material sitting beside a declared subtree inherits nothing. An archive accumulates artifacts authored under earlier rules by construction, which would make every future naming rule and vocabulary edit land a permanent finding there on a file no party is permitted to touch. Declaring the tree is what makes the exemption follow from the DECLARATION rather than from a path a party listed. |
| `{surface.axis_document}` | RESOLVED | `AGENTS.md` | the package's OWN axis document: the paste block, where every rule this package declares states the check enforcing it. It sits at the package root under the name agent runtimes read without configuration, so no runtime's own folder is needed to find it. It is distinct from the host's governance policy, which is where the PROJECTION is written. One is what this package declares and the other is what the host declares, and a single slot serving both makes the coverage check measure the host's rules against this package's checks. |
| `{surface.behavior_tree}` | RESOLVED | `.{provider}` | the package's own behavior tree: the rule digests, the reasoning protocols, the skills and the agent specifications. It ships under a placeholder name in slot syntax, and adoption renames the folder to the one the adopting runtime reads and replaces the placeholder wherever the package spells it, as BOOTSTRAP.md states. Every check reads this value rather than a literal, and the reference check fails a document path still naming the placeholder, so a partial adoption is a loud failure instead of a silent unresolved reference. |
| `{surface.binding}` | RESOLVED | `.{provider}/bindings/adapter.binding.md` | the rendered prose face of this configuration. It is GENERATED, so the values live here, and a hand-edited binding is a second truth that disagrees the moment one moves. |
| `{surface.board}` | RESOLVED | `collab.comms.active` | the coordination board. A deployment with one worker resolves this ABSENT, and that is what derives whether a reader is a seat or a bounded invocation. The scope is read from the binding rather than from the reader, because a reader classifying its own turn is an escape hatch keyed on self-classification. |
| `{surface.board_template}` | RESOLVED | `templates/collab.comms.template.md` | the shape a board is raised from. The board gate derives its record schema from this file rather than transcribing it, so the gate cannot drift from the contract it enforces. |
| `{surface.bootstrap}` | RESOLVED | `BOOTSTRAP.md` | the adoption procedure, and the one document that names the behavior tree's shipped placeholder after adoption, because it describes the shipped state. The check for a placeholder left behind by adoption skips it by this slot rather than by its name. |
| `{surface.checklist_template}` | RESOLVED | `.{provider}/templates/checklist.protocol.template.md` | the planning protocol a checklist is executed from. The checklist gate DERIVES its contract from this file on every run rather than transcribing it, so the gate cannot drift from the protocol it enforces. |
| `{surface.conduct_roster}` | RESOLVED | `.{provider}/rules/conduct.rule.md` | the roster of rules no construct observes, and a MANDATED-WRITE surface: a registered walk refuses a row carrying no third cell, so every cell on it is a party write. It is declared because a mandate reaches only surfaces this configuration names. An undeclared target sits outside every walk built to observe exactly that, including the one whose subject it is, and such a walk can only ever report a mandate whose slot fails to RESOLVE rather than one whose surface has no slot at all. |
| `{surface.core}` | RESOLVED | `tools/core` | the pipeline core, authored once and never edited to add a rule. |
| `{surface.document_template}` | RESOLVED | `templates/document.template.md` | the shape a substrate document is raised from. It carries no seeds entry, because the class it raises has no declared identity yet, and a seed naming an undeclared one resolves vacuously, which is the shape this package refuses everywhere else. |
| `{surface.emitting_sources}` | RESOLVED | `tools/rules` · `tools/core/inspectors` · `tools/core/validators` | every source that may claim a report id. A report on disk owes an emitter that still writes it. |
| `{surface.entrypoints}` | RESOLVED | `tools/core/entrypoints` | every CLI surface the package exposes. |
| `{surface.finding_template}` | RESOLVED | `templates/finding.template.md` | the shape a FINDING is raised from: the surface a converging venue writes its measured half into, one row per claim. Declared for the same reason its sibling is, since the obligation to write there is stated in a convergence edge, and a shape no walk derives is a contract only its author can check. |
| `{surface.findings}` | RESOLVED | `findings` | where a venue's MEASURED half lands: this tree's own instances, one row per claim carrying what observes it and over which members. It is the counterpart to the class half and is declared for the same reason, since the two are named together by every exit condition that mandates them, so declaring one and not the other would leave half of a single obligation unreachable. |
| `{surface.fixtures}` | RESOLVED | `tools/core/fixtures` | the proving samples every registered kind is certified against, and a MANDATED-WRITE surface for the same reason: the certifier counts an unproven kind into its open total, so a fixture pair naming the fired and the accepted member is a party write the pipeline requires. It is declared so that requirement is reachable by the walk that observes mandated writes, and so a lifetime resolves for every sample beneath it rather than for the directory alone. |
| `{surface.generated}` | RESOLVED | `_generated` | every derivation a run writes. The report is the state, so a question about what is open is answered by reading it rather than by re-running the gate. |
| `{surface.history}` | RESOLVED | `_changelogs.txt` | the package's own history accumulator, used when the host declares none. Extraction lands here before any removal, so a drain with no resolvable history file destroys the only durable record of a finding, which is why removal refuses rather than proceeding. |
| `{surface.index_template}` | RESOLVED | `templates/index.template.md` | the shape the workspace index is raised from. It carries no seeds entry for the same reason the document template does not. |
| `{surface.leaves}` | RESOLVED | `tools/core/types` · `tools/core/constants` · `tools/core/predicates` · `tools/core/strings` | the innermost tier: a leaf imports only leaves, and domain vocabulary reaching one is the deepest point coupling can penetrate. |
| `{surface.model_template}` | RESOLVED | `templates/model.template.md` | the shape a MODEL is raised from: the surface a converging venue writes its class half into. Declared because a template nothing resolves is governed by nothing while reading as a contract. The walk that would derive a model's shape from it cannot name it, and the mandate requiring a venue to write there resolves to a surface whose form no party can check. A template is the one artifact whose consumers are all in the FUTURE, so its correctness matters at a moment when no party is watching. |
| `{surface.models}` | RESOLVED | `models` | where a venue's CLASS half lands: what a construct is, which formulation composes, and what a reader may derive from it, naming no project, no seat, no tool and no count. Declared because a mandated write reaches only surfaces this configuration names. A venue whose exit condition refuses to converge until its outcome is written here is a refusing mechanism requiring a write, and an undeclared target sits outside every walk built to observe exactly that, including the one whose subject it is. |
| `{surface.pipeline}` | RESOLVED | `tools` | the gate pipeline's root. |
| `{surface.planning}` | RESOLVED | `checklists` | this package's own planning surfaces. |
| `{surface.planning_template}` | RESOLVED | `templates/checklist.template.md` | the shape a PLANNING surface is raised from: the distribution a venue's absorption edge refuses to converge without. IT IS A SECOND DECLARATION RATHER THAN A RE-POINT OF ITS NEIGHBOR, because two artifacts serve two consumers. The reasoning PROTOCOL states how a plan is executed and the checklist walk derives its contract from that, while this SEED states what a raised instance carries permanently and the raise form freezes its blocks. Re-pointing the protocol's slot would break the walk reading it, and reading the protocol as a seed raises an instance of a reasoning loop into the planning root, conformant to nothing, from a mapping that reads as considered. The family's naming hid the difference: every other member of it resolves a surface seed, so a party looking for this one reaches for the name already bound to the protocol and finds a value its siblings do not carry. |
| `{surface.principle_canon}` | RESOLVED | `https://banes-lab.com/software-architecture/principles.md` | the principle catalog read where the host declares none: the published Software Architecture principles, as a Markdown view. The same records are served as data at https://banes-lab.com/json/software-architecture/principles, and each principle is anchored at https://banes-lab.com/ontology#arch-<slug>. It sits BESIDE the host-facing ontology slot rather than defaulting it: a consumer reads the host's catalog where that slot resolves and this one otherwise, so a host with its own catalog still wins. **Defaulting the host slot to this catalog would make an ABSENT host catalog indistinguishable from a chosen one**, and every branch that correctly declines today would begin running against a catalog the host never picked. |
| `{surface.role_template}` | RESOLVED | `templates/role.template.md` | the shape a role document is raised from. The role gate derives its section set and its frontmatter operands from this file, so a seat's first document and the check that reads it answer to one contract, and an absent template fails the gate rather than resolving its contract to an empty set. |
| `{surface.roles}` | RESOLVED | `roles` | one role document per concern, the letter in the variant slot. A seat changes hands and a concern does not, so the file survives the letter. |
| `{surface.rule_digests}` | RESOLVED | `.{provider}/rules` | the digests that expand a declared rule, and a surface class that DIVIDES: its directive text is current truth and overwritten as enforcement changes, while a measured clause the rule DEPENDS ON is evidence nothing else in the tree holds a copy of. It is declared so the divide is stated where a mechanism reads it rather than only in the rule permitting the measurement, which is the same composition the roles root already carries. Present-tense and overwrite are each correct here and compose into a license to delete the only copy of a measurement. |
| `{surface.rules}` | RESOLVED | `tools/rules` | one drop-in file per rule, discovered at runtime. Adding governance touches no core file. |
| `{surface.steps}` | RESOLVED | `tools/core/steps` | the fixed stages that run ahead of the discovered rules. They emit report ids too, so a report's claim set is read from here as well as from the rule directory, and a claim set that silently resolves to nothing makes a healing gate delete every report it should have kept. |
| `{surface.taxonomy_config}` | RESOLVED | `config/taxonomy.config.ts` | the naming and placement vocabulary, with its cross-slot agreement asserted at compile time. A finding about a declared root or container is reported against this file, because that is where the declaration lives. |
| `{surface.upstream}` | RESOLVED | `[]`, declared and empty | material authored elsewhere that this package carries. **Empty, and that is the shipped state**: a coordination package carries no vendored copy of upstream documentation, because a copy goes stale the moment upstream moves, and a stale copy of a vendor's own words is worse than a pointer to the live ones. The mechanism stays for a host that does carry such a tree. One declaration exempts it from naming, tense and reference together, since all three fail it for the same reason and none of the three failures is a defect in it. A declaration resolving to nothing exempts nothing while reading as a considered exclusion, so this stays empty rather than naming a tree that is gone. |
| `{surface.venue_archive}` | RESOLVED | `_archive/venues` | where a CONVERGED venue is kept after its discussion closes. It is governed and settled rather than argued, which is a third state the tree had no name for: an OPEN venue holds the build, an absent one is gone, and an archived one must stay findable with its headings resolvable while reading as neither. The venue scan is depth-agnostic by design so a blocker one level down cannot hide, and that same reach makes an archived venue read as an open discussion unless this root is declared, because the scan quantifies over the set it is told, and moving a file changes the set without telling it. |
| `{surface.venue_template}` | RESOLVED | `templates/blocking.template.md` | the shape a prioritized discussion is raised from. The venue gate DERIVES its record schema from this file on every run rather than transcribing it, so a venue's fields stay the venue's own. The surface a seat writes a position into is not the surface that carries coordination state, and the two drift the moment one gate holds a copy of the other's contract. |
## Convention slots
| slot | state | value | why |
| --------------------------------------- | -------- | ----------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `{convention.abstract_prefix}` | ABSENT | — | no class hierarchy. |
| `{convention.agent_keys}` | RESOLVED | `name` · `description` | the frontmatter keys an agent specification may carry, which is the set the adopted runtime reads. The package ships the two every runtime reads, and adoption adds the runtime's own keys here, as BOOTSTRAP.md states. A key outside this list reaches no reader: the runtime ignores it, so it drifts against the body with nothing breaking when it is wrong. Everything the agent must act on is written in the body, including the skills it loads, because the body is the one surface every runtime delivers. |
| `{convention.agent_workspace}` | RESOLVED | `_generated` | where durable output lands. |
| `{convention.audit_pass_threshold}` | ABSENT | — | no numeric pass threshold exists. Every check returns pass or fail, so a weighted score compared against a bound is a middle tier under another name, and the branch scoring one does not run. |
| `{convention.audit_workspace}` | RESOLVED | `_generated` | an audit record is a generated report and lands where every other one does, so it is read by the same convention. |
| `{convention.base_class_prefix}` | ABSENT | — | no class hierarchy. |
| `{convention.binary_extensions}` | RESOLVED | `[]`, declared and empty | file types read as opaque bytes and never scanned. Empty means every governed file is text. |
| `{convention.cache_ttl_days}` | ABSENT | — | no domain cache is kept between runs, so a consumer demanding cache evidence would be satisfiable only by fabricating it. |
| `{convention.chars_per_token}` | RESOLVED | `2` | measured, never assumed, because dense markup runs far denser than prose, and a ratio guessed generously produces a gate that passes exactly when it is most needed. |
| `{convention.code_extensions}` | RESOLVED | `.ts` | the file types the comment cleaner and the code-level gates read. |
| `{convention.conditional_gates}` | RESOLVED | `projection_is_one_line project.governance_policy` · `board_write_refreshes_projection project.governance_policy` | rules whose gate is REGISTERED and whose enforcing branch depends on a slot, written as the rule slug then the slot it needs. Coverage reports each as GATED-WHEN-RESOLVED and, where that slot does not resolve, names it UNREACHED. A rule counted plainly gated while the branch enforcing it cannot run is a zero-ungated count standing over rules nothing enforces, and a rule counted plainly UNGATED goes permanently red on a finding whose only repair is acquiring a host, which is unreachable remediation. The third state is real and is carried in the derivation so the count can never over-claim. |
| `{convention.embodiment_threshold}` | RESOLVED | `1` | a template either embodies its loop or does not. |
| `{convention.enumerable_write_regions}` | RESOLVED | `_generated` | the regions where ONLY RUNS WRITE and EVERY RUN DECLARES, which is what lets both directions of the unclaimed-write question be enforced there: a write with no live claim is refusable, and a claim with no write is detectable. Across the source tree neither premise holds, since a party edits without declaring anything, so the primitive carries CLAIMS ONLY there and refuses to infer a writer from a changed file, which is the ambiguity it exists to decline rather than resolve. The regions are DECLARED here rather than branched on inside the mechanism, so a region added to this list acquires the correct direction with no edit to the writer, and a mechanism keyed on a path SHAPE would silently answer the wrong question for the next region a party adds. |