.{provider}/rules/conduct.rule.md
.{provider}/rules/conduct.rule.md is a file in Coordination Surface. 195 lines of code and 0 definitions.
# Unobservable rules: the conduct roster
A rule declares `gate: conduct` when **no construct in any artifact observes it.** The declaration is a
claim, and the coverage check fails any conduct declaration this file does not carry. Each entry states what
would have to become observable for the rule to acquire a check, so the claim stays falsifiable rather than
becoming an escape hatch.
`gate: conduct` is not a softer _ungated_. Enforcement debt is work to be drained, while conduct is a closed
question. A rule moves from conduct to a real check the moment its evidence lands in a file, and that
transition is why each entry names its missing evidence.
## Why these cannot be checked
A check reads artifacts. It cannot read a turn, an intention, a reading order, or a decision that left no
trace. The rules below govern exactly those, and each is answered against one question: _what file would
differ if this were violated?_ The answer is none.
## The checkable half is named rather than described
**Many of these rules have a half that is decidable, and naming it in prose leaves it uncountable.** A rule
whose conduct claim is honest can still carry a neighboring claim an artifact answers, such as whether a venue
conforms to its template, whether an item's reader set resolves, or whether a report states the boundary of its
own negative result. Describing that half inside the entry makes it visible to a reader and invisible to every
count, so a named but unbuilt check sits outside the enforcement backlog forever while the roster reads as
complete.
**So each entry carries a third cell, and its vocabulary is closed to four kinds of value.**
1. A **registered gate id** means the checkable half is observed, and it names what observes it.
2. **`none`** means the half is decidable and **unbuilt**, which is enforcement debt and belongs in the backlog
rather than in a paragraph.
3. **`—`** means the entry was assessed and has **no checkable half at all**, because its subject is an act
rather than an artifact.
4. **A failing question**, one of `no-declared-surface`, `subject-is-an-act`, `empty-population` or
`not-evaluable`, names which of the four questions the half fails, so the entry says why no check can
observe it.
**A fourth disposition needs no fourth value: the checkable half may be split out into its own slug, which
carries the gate.** There the dash is correct, since this entry has nothing left to check, and incomplete,
because a reader following it concludes the half is unbuilt when a sibling already holds it. **So the entry
names the sibling slug**, exactly as a filled cell names its operand, in the same place the range lives. The
vocabulary stays closed, and only the pointer is added.
**The dash is a real answer, and it is the value a two-member vocabulary could not express.** Without it, an
entry with genuinely nothing to check cannot be told apart from one no party has assessed, which is the same
missing-member failure the roster keeps finding elsewhere. It is the identical construct
`decision_names_its_gate_or_its_proof` already uses, where a dash states that a decision binds no artifact and a
blank states nothing.
### Re-walking the cells: the operand is the emitted kind set, never the rule-id set
**A cell asks whether a half is observed, and a half acquires an observer as a new kind far more often than as a
new rule.** So a re-walk that compares the debt cells against the registered rule ids misses every half closed
by a kind added to a rule that already existed. The two coincide only when a check arrives as a whole rule,
which is the minority case.
**Measured on this roster, a re-walk at rule-id granularity reported one closure and missed a second**, where
the missed half had acquired a kind inside a walk that was already registered. The certifier itself made the
same granularity error at a different level: proving a rule is not proving its kinds, and enumerating rules is
not enumerating observers.
**The kind set is derived rather than assembled.** The certifier already enumerates every emitted kind, so the
operand for _is this half observed_ exists and needs no new work. **A count offered for a reader's trust is the
one worth checking hardest**, and a re-walk taken at the wrong granularity produces exactly the confident stale
number the third cell exists to prevent.
### Assigning a cell: walk the questions, do not read the entry
**Reading the entry is what produced the undeclared splits in the first place**, because an entry describes why
the rule is unobservable, and the cell is about a different claim. Four questions are asked in order, and only
the last needs a reasoner:
| question | how it is answered | what a failure means |
| ------------------------------------- | ------------------ | ----------------------------------------------------------- |
| does the half name a declared surface | one search | nothing to quantify over, so the half is imagined |
| is its subject an artifact or an act | one search | an act takes `—`, and the entry is correctly conduct entire |
| is the population non-empty | one search | a check over an empty set is a green that measures nothing |
| is the property evaluable on a member | judgment | not decidable, so not a checkable half |
**Three of the four are one command each, and only the fourth is judgment**, which inverts how this roster
reads: every entry presents as a judgment, and most of them turn on a fact.
**The first value names the observer, which is not always a registered check.** A half can be observed and
gated by a pipeline entrypoint that refuses an operation outright, which is stronger enforcement than any
registered check provides and carries no rule id at all. So the cell names the observer by its command where
that is what observes it, and the entry states the consequence: **a count over registered ids cannot see it**,
so such a half is enforced and uncounted. Naming the observer honestly and naming what the count misses is the
repair, because renaming the value would make the count look complete.
**A mechanism that observes the half and publishes without failing takes its gate id, and no fourth word is
added.** The case is real, a half that is decidable, built, and watched by something that reports it rather than
blocking on it, and it fits none of the three words. **It is a dimension rather than a member**: the cell answers
_what observes this half_, and _does the observer gate or merely publish_ is a different question. A fourth word
would put a middle value on the observation axis, which is the tier the binary verdict refuses.
**So the cell takes the id, and the entry says it publishes rather than gates**, in the same place the range
lives, because _publishes without failing_ is a range statement about the observing mechanism. It is narrower
on the enforcement axis exactly as _the check is narrower than the rule_ is narrower on the population axis.
**What the count over gate-id cells measures is stated here rather than assumed by the party counting: it
measures observation, never enforcement.** A reader tallying ids as enforced rules over-counts by however many
publish-only observers exist, and the entry can tell a reader what a count cannot tell itself. **Naming the unit
is the repair, because a fourth word would hide the same gap behind a vocabulary.**
**The cell holds the value and the entry holds the range.** An observing check is often narrower than the rule
whose half it answers, and a bare id then asserts more than it can. The repair is not a qualified cell, because a
value plus prose is uncountable, which is the whole thing the closed vocabulary buys. **So the range is stated
in the entry text, beside the operand that entry already names.** The cell is what a count reads, the entry is
where a reader learns scope, and neither is asked to do the other's work.
**A row with no third cell is unassessed, and that is a declared state.** It states that no party has compared
this entry's claim against the current tree, never that the entry has no checkable half. That distinction is
what makes the remaining work derived from this table instead of transcribed as a count: **the unassessed set is
the empty cells**, so no reader has to trust a number that decays the moment either surface moves. An entry's
populated cell also names the operand it was compared against inside the entry itself, so a later reader re-runs
that comparison rather than inheriting a verdict.
## Evidence and analysis
| slug | what a check would need | checkable half |
| ----------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------ |
| `claims_need_evidence` | a record of what was verified before each claim, and verification leaves no artifact | `subject-is-an-act` |
| `adversarial_default` | evidence that a deliverable was attacked before delivery, and attacking leaves no trace | `subject-is-an-act` |
| `a_claim_about_a_mechanism_opens_the_mechanism` | whether the file was open when the claim was written. A read is not an artifact, and a claim that happens to be correct and one derived from the source are the same sentence. **The near-checkable half is a different claim and belongs elsewhere**: whether a claim resolves against the mechanism is decidable for a citation and undecidable for prose, since a position asserting what a check does names no path a resolver could follow. Measured across two seats reasoning independently: eleven instances, every one a claim about a mechanism and none about a document, with both seats reading every document whole. So the distribution is evidence about the routing rather than about either seat, and no artifact records which surfaces a seat opened before writing. The half compared: an in-tree citation resolves or it does not, which the `reference` walk decides on every run | `reference/unresolved` |
| `verify_before_edit` | the read that preceded an edit, and reads are not recorded. **The write-side half is split out and `write_is_an_edit_until_proven_absent` carries it**, gated on the unwitnessed-write axis, so the dash here means nothing is left rather than nothing exists | `—` |
| `write_is_an_edit_until_proven_absent` | whether a path was read in the same turn it was written, and tool calls are not artifacts. The write's own report distinguishes a create from an update, which makes it a detection signal after the contents are gone rather than a guard. The half compared: a file rewritten from an earlier read with no compared witness before the write, which the `entrypoint` walk decides, since the guard is an artifact even though the read is not | `entrypoint/unwitnessedWrite` |
| `read_files_whole` | whether a read was partial, and the tool call is not an artifact | `subject-is-an-act` |
| `architecture_is_the_target` | the level at which a file was read | `subject-is-an-act` |
| `introspection_over_abstraction` | whether an abstraction was opened or stopped at | `subject-is-an-act` |
| `caught_means_fixed` | the moment a violation entered context, against the turn it was fixed in | `subject-is-an-act` |
| `classification_is_judgment` | whether a concern was decided by reading the file or by its old name | `subject-is-an-act` |
| `absence_is_measured_never_inferred` | the scope a searcher drew. A zero carries only the boundary of the query, and one that stopped short and one that covered everything produce the same empty result in a turn that records neither. **The report half is observable and is gated.** A report carrying a handed count while publishing no population fails under the `governance` walk over the generated reports, and so does one whose reached set is smaller than the set it was handed without naming the exclusion. A negative result an artifact carries therefore states its boundary or fails, and only a negative result a seat reasons to is outside. The operand that half was compared against is `unevaluableScopes` and the count-agreement axis in the governance validator, and a later reader re-runs that comparison rather than inheriting this line | `governance/unevaluableScope governance/undeclaredExclusion` |
| `derive_before_declare` | whether a declared value could have been computed, which is a property of the tree's other contents rather than of the declaration, so a check would have to reconstruct the derivation it is arguing for. Walked: the subject is an artifact and the fourth question fails, because the property is not evaluable on a member without building the derivation whose absence is the finding | `not-evaluable` |
| `installed_is_invoked` | a declared dependency's reach through configuration and source is checkable, while whether the reach is invocation rather than mention is not. A name in prose is being discussed, so a check reading documentation counts a report about an unused dependency as evidence that it is used. The half compared: the `declaration` walk reads the manifest and reports a declared dependency no source or configuration reaches. **The observing check is narrower than the rule on a specific axis**: it resolves a reach by name, so a type-only package reached by the compiler rather than by an import is invisible to it. The compiler config names the package in its own types field and every `node:` builtin import resolves through it, which is a reach no name scan sees | `declaration/unreachedDependency` |
| `relations_are_graphs` | whether an answer about reach, cycles or coupling came from a traversal or from inspection, since both produce the same sentence | `subject-is-an-act` |
| `derived_not_heuristic` | whether a mechanism was derived or approximated | `subject-is-an-act` |
| `uncertainty_is_stated` | whether a claim's uncertainty was known at the time it was written | `subject-is-an-act` |
| `finding_becomes_record` | a durable finding that was left in conversation and never written | `subject-is-an-act` |
## Collaboration
| slug | what a check would need | checkable half |
| ------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------- |
| `ask_via_tool_only` | the shape of a question asked in conversation. **It binds a seat only: the question tool is withdrawn from every bounded invocation regardless of what that invocation declares**, so the rule is vacuous inside one. The subject exists and the runtime removes the capability, which is a different reason from every other entry here. A bounded run states the uncertainty, states its assumption, names what would settle it, and returns | `subject-is-an-act` |
| `recommend_never_abstain` | whether an answer carried a recommendation | `subject-is-an-act` |
| `uncertainty_escalates` | uncertainty that was resolved silently rather than raised | `subject-is-an-act` |
| `ask_before_dependent_work` | the order in which a question and its dependent work occurred | `subject-is-an-act` |
| `report_before_writing` | whether findings were reported before files were written | `subject-is-an-act` |
| `auto_mode_flows` | whether a response moved the queue forward or halted | `subject-is-an-act` |
| `blocked_waits_never_halts` | that every open item was blocked, and whether the wait was taken or the turn ended | `subject-is-an-act` |
| `report_to_agents_never_to_owner` | which party a response was addressed to, and whether a turn ended on it, since the recipient of prose is not an artifact | `subject-is-an-act` |
| `never_end_a_turn_to_wait` | that a turn ended while a wait would have produced work, since the turn boundary is not an artifact | `subject-is-an-act` |
| `quiet_is_not_permission_to_report` | that a wait reported no peer write and the turn ended rather than continuing, since a tool result is not an artifact | `subject-is-an-act` |
| `changed_means_read_then_act` | the order of a wait, a read and the next wait, since tool-call sequence is recorded in no file | `subject-is-an-act` |
| `no_append_without_a_drain` | that a write added an item and removed none. A surface holds its current content and never the shape of the write that produced it, so an append paired with a drain and an append alone leave identical artifacts. Walked: the subject is the write rather than the surface, so the second question returns act. The absorbed-ness of a standing item is an artifact question and fails the fourth, since whether what an item asked for exists is decided per item by reading another surface. **The extraction half is split out and `removal_declares_its_extraction` carries it**, gated on a removal whose extraction reference does not resolve | `subject-is-an-act` |
| `the_handler_removes_the_item` | that an item was handled, and by which party. The surface holds the item and never the act of discharging it, so an item standing because no party picked it up and one standing because its handler did not remove it are the same artifact. The reader-set constraint deciding which party may close it is checkable, while the handling is not. The half compared: a closure declaring it closes an id whose fence still stands, and an item whose reader set holds no active seat, both decided by the `board` walk | `board/danglingAddressee` |
| `undecided_routes_to_an_agent` | that a decision was going unmade, and what happened next. An empty cell and a cell no party has reached yet are the same artifact, and the routing is a tool call rather than a file. **The decidable half is the same resolution the addressee axis already performs for board items**: a routed or deferred clause naming a receiver that resolves to neither an active seat nor a venue on disk. **Built: the `blocking` walk carries a stranded-deferral kind**, so a clause deferred to no party fails rather than passing. **The observing check is narrower than the rule**: it decides that a receiver resolves and never that it is the right receiver, which is judgment no check reaches. The convergence walk still joins on the clause name alone, so the resolution is a separate axis rather than part of the closure ordering | `blocking/strandedDeferral` |
| `a_ruling_is_the_seats_and_the_owner_signature_is_automatic` | that a decision was routed to the owner rather than taken. A position declining a ruling and one taking it are both well-formed prose, and the routing lives in a turn. **The near-checkable half is a different claim, and it is already covered**: the convergence walk quantifies over active seats, so the owner's row is outside every edge by construction and a venue cannot technically block on it, while whether the seats treated a question as theirs is not decidable from the artifact. Measured: two seats independently diagnosed one contradiction, both named the repair, and both declared it not theirs, which is a state that inspection cannot tell apart from a question no party had reached | `subject-is-an-act` |
| `no_self_assessed_budget` | reasoning about capacity, which is never written down | `subject-is-an-act` |
| `queue_is_explicit` | the queue as held in a turn rather than in a file | `subject-is-an-act` |
| `feedback_capture_protocol` | that a directive arrived, which only the conversation carries. The hardening it produces is checkable and the arrival is not. Walked: the hardening is an artifact and the fourth question fails, because a rule present in three destinations and one present in three because a directive arrived are the same set of files, so the property is not evaluable without the arrival | `not-evaluable` |
| `friction_is_a_missing_mechanism` | that friction occurred and what the first response to it was. A diagnosis is reasoning in a turn, and the artifact records only the repair that followed, never the alternative rejected. **This is the one conduct entry whose own subject is the insufficiency of conduct**, so the honest reading is that the rule governs the moment of diagnosis while every mechanism it produces is checked on landing | `subject-is-an-act` |
| `collab_board_checked_first` | whether the board was read before the first edit | `subject-is-an-act` |
| `board_is_read_whole` | whether a read covered the whole board or a slice of it, and a read leaves no artifact. **The precondition half is a different claim and is already gated**: whether the board can be read whole is a property of the artifact, held by the field-size and projection-size axes of the `board` walk, while whether a reader did is not. **That half is split out into its own slug and `field_stays_within_one_read` carries it**, so a reader following this entry finds where it went rather than concluding it is unbuilt | `—` |
| `a_coordination_read_is_never_filtered` | whether a delivery was consumed whole. The filter is a shell pipeline taken inside a turn and recorded in no artifact this tree holds, and a stream consumed whole and one consumed through a bound leave byte-identical trees. Walked: the half names a declared surface, and the second question stops it, because the subject is an act rather than an artifact, so the third cell is the absent marker rather than an unbuilt check. **The near-checkable half is a different claim, named so the entry does not appear to hide one.** Whether a rule's obligation names its carrier is a decidable property of the rule text, distinct from whether any party filtered, and an entry conflating them would claim a checkable half it does not have. **The entry carries the measurement that four of four active seats breached it before it was written**, each having read the file-scoped obligation. That is a complete population with a uniform outcome rather than a distribution, and it is evidence about an obligation whose consumer was never built, not about where a declaration may live. **The remedy is categorical rather than attentional, which is a property of the class and not advice.** The filter is chosen for a confirmation line rather than against the content, so it is never a decision about what to discard. The peer diff was never in the frame, and a tell firing on _am I discarding something_ asks a question the moment does not contain. So a per-call rule needs a party to notice the call is a read, and the class is defined by the call not feeling like one. **Measured on the sharpened tell failing and the categorical rule holding.** One seat breached after authoring its own tell and disclosing it, a second breached twice while holding both that entry and that disclosure, and a third breached once on a call taken as a probe. Against them, one seat reported a whole round of unfiltered reads, including pure probes and one delivery the form degraded, and it decided nothing per call because it decided once, at the command, that nothing is ever attached to it. **The cost of the categorical form is that a genuinely useful filter is unavailable too, and on this channel that cost is zero**: the form degrades a large delivery rather than truncating it, and a run's report on disk is the sanctioned narrowing | `subject-is-an-act` |
| `a_repairer_runs` | that a run followed a repair by the same party. A report on disk records the state it measured and never which party changed the tree before it, so a repair-then-run and a repair-then-another-party-ran leave identical artifacts. **The near-checkable half is a different claim**: a report older than the newest source change is detectable, and it says the state is stale rather than saying the repairer declined to publish it, since any seat's edit ages every report equally. Measured across two repairs in one discussion, distinguished only by which seat's item reported the run. The half compared: a report whose newest read surface is older than that surface's own change is detectable, and the standing mechanism in the pipeline already computes exactly that moved set and withdraws the verdict's authority, so the run observes staleness and nothing observes attribution. **The observer publishes rather than gates, and deliberately.** The standing mechanism withdraws a verdict's standing to be quoted and never declares it failed, because declaring a stale report failed would assert a defect nothing observed. A finding here would be red between every run, which is the unreachable-remediation shape that teaches every reader to discount the color. So this cell records observation rather than enforcement, per the ruling above | `pipeline` |