.{provider}/rules/conduct.rule.md
.{provider}/rules/conduct.rule.md continued, part 2 of 2.
| `a_venue_is_read_before_it_is_written` | that the venue template was read before a seat's first position, which is a reading order that no artifact records. **The near-checkable half is already covered elsewhere and is a different claim.** Whether a venue conforms to its template is decidable and belongs to the venue check, while whether its author read the template is not, because a conformant venue written by a seat copying a peer's record and one written from the contract are the same artifact. Measured: four seats produced four formats from four sources with the contract one directory away, and no inspection of any resulting document distinguishes which source each seat used. The half compared: a venue whose record schema disagrees with the template it derives from, decided by the `blocking` walk | `blocking/venueSchemaDrift` |
| `absent_board_is_not_solitude` | that the tree moved beneath a seat between reads | `subject-is-an-act` |
| `commuting_writes_replay_rather_than_refuse` | that a write was attempted and what the tool did on finding the surface changed. The retry, the comparison and the refusal are runtime behavior, and the artifact records only the final content, which is identical whether the write landed first, replayed, or was re-derived by hand after a refusal | `subject-is-an-act` |
| `an_intended_write_to_a_shared_prose_surface_is_announced` | that an announcement preceded a write, which is an ordering between a position and an edit. The shared prose surfaces carry no writer identity anywhere, so a section written after an announcement and one written without it are the same artifact. Walked: the subject is the announcement relative to the write, so the second question returns act, and the operand that would settle it is the authorship the surface does not record. **The near-checkable half is a different claim rather than an unbuilt one**: whether two passages state one contract is semantic, which no mechanism here decides, so this entry carries no deferred check and is not enforcement debt. The half compared: the anchored edit already refuses an overlapping write and admits a commuting one, which is the mechanical axis working correctly and a different axis from this one | `subject-is-an-act` |
| `foreign_scope_is_untouchable` | which seat made an edit, and edits carry no author. **One case is observed**: a delimiter for one seat falling inside another's fence is caught by the `board` interleaved axis, whose own reason states it, because a fence enclosing another fence passes the pair check while an edit anchored on the outer one spans the inner content. **A second case is observed too**: an item whose letter differs from its enclosing record's, which the `board` walk observes as a foreign-item-letter kind. **Foreign prose written into a record stays unobserved**, because it brings no delimiter for any axis to match, and it is the cheaper way to intrude | `board/interleavedRecord board/foreignItemLetter` |
| `scope_is_claimed_not_assumed` | whether ownership was claimed or inferred | `subject-is-an-act` |
## Process and method
| slug | what a check would need | checkable half |
| -------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------- |
| `plan_is_drafted_then_restructured` | that a draft existed before the restructure | `subject-is-an-act` |
| `follow_template_as_stated` | whether execution condensed or adapted the nodes | `subject-is-an-act` |
| `template_selector_is_genesis` | which genesis question selected a template | `subject-is-an-act` |
| `mechanism_transfers_catalogs_rederive` | whether a catalog was re-derived or a mechanism substituted, since the artifact carries the result and never which of the two produced it | `subject-is-an-act` |
| `clear_unblocked_work_is_performed_rather_than_routed` | whether an item is clear and unblocked at the moment it is routed, which is a judgment about a state the row does not carry. A routed item and a routed item its owner could have taken are the same row, and the blocker that justifies one lives in a turn. **Walked properly, the fourth question refuses it, and the operands do not live where an earlier reading placed them.** The candidate half, a row whose owner is the party that owns the surface it targets with no named blocker, needs a target-to-owner mapping, and the row carries only the first operand. Ownership is declared by concern in prose rather than by directory, so resolving a target path to an owning party is an interpretation of a concern claim rather than a comparison, and that is judgment no check reaches. **The weaker decidable half is worse than none.** A row carrying no named blocker is decidable and fires on every legitimately routed row, which is a check that punishes the right answer and teaches every party to write the wrong one. **It is stated plainly because a cell corrected toward the dash removes a debt entry, which is the direction a reader trusts least.** The reasoning is declared rather than quiet, and a peer re-walking exactly this cell is worth more than one re-walking any other | `not-evaluable` |
| `a_venue_is_absorbed_before_it_is_archived` | that the work an outcome implies has landed, which is a judgment about whether a decision is fully built. A tree where the outcome is implemented and one where a subset landed while no party noticed the rest differ only by a reading of the outcome's own prose. **The near-checkable half is decidable**: a converged venue whose distribution checklist still carries an open item is a venue not yet absorbed, and both operands are files. **Built and gated**: the convergence walk carries it as a sixth ordering, that the outcome is absorbed and the distribution checklist for this venue carries no open item. It refuses the closure rather than reporting it, so the enforcement is stronger than any registered check offers. The observer is a pipeline entrypoint and carries no rule id, so it is named by its command, and **a count over registered ids cannot see it**, which makes this half enforced and uncounted. The rule stays conduct because whether the work an outcome implies has landed is still a judgment the checklist's own completeness cannot settle | `converge` |
| `a_destructive_tool_carries_every_standing_precondition` | that a standing precondition was checked against a tool's code before an irreversible invocation, which is a read in a turn, and after the operation the tree cannot even show what was lost, because the operand is gone. **The near-checkable half is decidable**: a standing instruction naming a step, against the destructive tool's implemented steps, is two enumerations over files that exist. Measured once, on a converged discussion that a standing instruction required to be archived and that the convergence tool deleted, having never claimed an archive step. The tool was correct, the instruction was correct, and nothing joined them. The half compared: each classified standing precondition against the steps the destructive path implements, both declared operands, which the `converge` walk decides on every run. Its range is the classified set rather than every instruction in prose, since extracting a step from prose needs a phrase list or an inference and both are refused. An unclassified precondition therefore stays outside it, and the registry growing is how the class transfers | `converge/unimplementedStep` |
| `a_mandated_surface_is_tool_writable_first` | that a mandate was added before its write path, which is an ordering between two changes that no artifact records, because a surface mandated with a tool path and one that acquired the path afterwards are the same tree. **The near-checkable half is built and observed**: the `surface` walk compares each surface a refusing mechanism requires against the surfaces the tool can write, and fires where a party must write one the tool cannot reach. **The observing check is narrower than the rule on two axes, and both are stated rather than implied.** Its population is the surfaces this configuration declares, so a mandate naming a surface the configuration never declared is invisible to it. The requires-a-write classification is verified data the mechanism reads rather than a property it infers, seeded only with surfaces whose refusal was read at the source. It says nothing about the ordering the rule names, which is why the entry stays conduct while its half is observed | `surface/noWritePath` |
| `determinism_is_the_one_axis` | whether a subject was tested for determinism before its mechanism was designed, which is an act in a turn, because a mechanism built after the test and one built without it are the same artifact. **The near-checkable half is a different claim, and it is this column**: whether a rule declares which of its halves is deterministic is decidable. **Built: the `conduct` walk carries an unstated-half kind**, failing any entry whose third cell is absent, so the declaration is observed rather than answered structurally and trusted. **The observing check is narrower than the rule**: it decides that a cell is present and drawn from the closed vocabulary, never that the subject was tested for determinism before its mechanism was designed, which is the act the rule names and which no artifact records. Measured on this roster: sixty-two of seventy-six subjects are non-deterministic, so the four properties the axis derives are absent for four fifths of the protocol | `conduct/unstatedHalf` |
| `gate_every_pattern` | that a construct was introduced, against the check shipped with it. The half compared: a registered check shipping with no proving fixture, which the certifier carries as an unfixtured-kind set counted into its open total, so an unproven kind fails the run. **The observing check is narrower than the rule**: it decides that a registered check is proven and says nothing about whether a new construct acquired one, which is the turn this entry correctly calls unobservable | `gate/unfixturedKind` |
| `bypass_strengthens_rule` | that a bypass was spotted, and what happened first | `subject-is-an-act` |
| `scoping_re_runs_the_motivating_case` | that a rule was narrowed and the motivating case was run against it afterwards. Both are acts inside a turn, and a scope authored correctly the first time and one narrowed then re-verified produce byte-identical source. Walked: the subject is the author's re-run rather than an artifact, so the second question returns act. **The near-checkable half is a different claim, and it is observed.** Whether a predicate's identity asserts an axis its body never reads is decidable over a closed declared vocabulary and a body scan, and the `declaration` walk carries it as an unread-asserted-axis kind. It scans the body rather than the signature, deliberately, so that a predicate resolving the declared record inside itself is reached rather than passing as a true negative. **The observing check is narrower than the rule on two axes, both stated in its own remediation.** It answers one instance of the shape this rule generalizes and never whether any refinement anywhere was re-tested. Its residue is a predicate naming no axis while reading the wrong fields, left ungated rather than gated weakly, because no surface holds what a predicate is for. **Its population is worth knowing and is unmeasured**, since a check that exists still ranges over a set no party has counted. **Measured three times in one round, and twice by the party proposing the refinement.** A gate was proposed against a subset-reading consumer that a declared read-set would have matched and passed. A scope was narrowed to functions whose parameter type is the declared record, where every correct member takes it that way and the failing one resolves the record internally. A matcher was keyed on an axis name and its declared values, where the defective identity carries the adjective and neither literal. **A fourth arrived on the check built from this rule**, caught by running the case rather than by reading the scope, which is the rule's own subject arriving on its own enforcement | `declaration/unreadAssertedAxis` |
| `remediation_is_reachable` | that a repair was attempted and refused by a surface outside this tree. The refusal happens at the write and leaves no artifact, and the file afterwards is identical to one no party tried to edit. **A refusal is also per-seat rather than per-tool, which no artifact records either.** Measured on one removal, two seats were refused and a third was permitted, on the same tool with the same operands, so a refusal carries only the boundary of the party that hit it, and a claim about the tool cannot be derived from one environment. The consequence is routing rather than exemption, since a refused repair is re-addressed to the other seats and the first permitted one takes it, and `interpreter_invocation_denied` is the prior art, since it already attributes its own unobservability to the host's settings | `subject-is-an-act` |
| `manual_edit_only` | which tool performed an edit | `subject-is-an-act` |
| `draft_precedes_replacement` | that a draft preceded a structural replacement | `subject-is-an-act` |
| `existing_owner_first` | that alternatives were considered before a capability was added | `subject-is-an-act` |
| `build_the_missing_tool` | that a capability gap was met with a workaround instead of a tool | `subject-is-an-act` |
| `bisect_before_forensics` | the order of isolation steps during a failure | `subject-is-an-act` |
| `baseline_reverified_on_env_change` | that a baseline was re-established | `subject-is-an-act` |
| `instrument_single_subject` | how a measurement was taken | `subject-is-an-act` |
| `mutation_preview_first` | that a preview was shown before application. **The preview path is an artifact and is gated**: the removal tool's non-healing branch shows exactly which fields would go before any extraction happens, and the `entrypoint` walk holds healing opt-out and the unwitnessed-write axis. What stays unobservable is whether a seat looked at the preview it was shown | `entrypoint/healingIsOptIn entrypoint/unwitnessedWrite` |
| `side_effect_authority` | whether a command was handed over or run | `subject-is-an-act` |
| `no_runtime_dependencies` | whether an adopted dependency was structurally unavoidable, which is a judgment about alternatives that were never written down. **The half that carries the rule is one field, and it is decidable**: whether the manifest declares any runtime dependency at all. The half compared: the manifest carries an empty dependency object. **Built: the `declaration` walk carries a declared-runtime-dependency kind**, so the invariant is observed rather than holding because no party has added one. **The observing check is narrower than the rule**: it decides that a runtime dependency is declared and says nothing about whether an adopted one was structurally unavoidable, which is the judgment about unwritten alternatives the entry names | `declaration/declaredRuntimeDependency` |
| `interpreter_invocation_denied` | that an interpreter was invoked directly. The invocation is a tool call, and the denial itself lives in the host's settings rather than in this tree | `subject-is-an-act` |
| `scratchpad_is_ephemeral` | that something transient was reusable and stayed transient | `subject-is-an-act` |
## Design judgment
A check reads what a file _is_, never what its author weighed. These rules govern the weighing.
| slug | what a check would need | checkable half |
| ---------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------ |
| `consumer_breaks_without_it` | the behavior of the tree in the state where the surface does not exist. That is a counterfactual, so what a check must observe is not on disk by construction. A check could certify that a consumer is named, which is presence rather than breakage, and one claiming the second while measuring the first passes exactly the decoration the rule refuses. Walked: the first question already fails, because no surface can be declared for a counterfactual, and the nearest available check measures a different property | `no-declared-surface` |
| `non_goal_is_stated` | the scope that was considered and deliberately excluded. The half compared: the task-contract field set carries a non-goal field beside file, evidence and verifier, and the checklist walk requires every task to carry its contract, so a task with no non-goal is a finding. **The observing check is narrower than the rule**: it is gated where the unit is a task and unbuilt for every other kind of unit the rule binds | `checklist/contractIncomplete` |
| `a_measured_entry_retires_by_extraction` | that an entry left a governing surface, and whether an extraction preceded it. A surface holds its current content and never the shape of the write that produced it, so a document that never carried a measurement and one whose measurement was pruned are the same artifact. Witnessed by the seat whose document it is: a measured set replaced anticipated entries, then the anticipated ones were restored beside them on a peer's argument, and nothing in the tree objected at either step. The half compared: a role document declaring a measured section that is absent or empty is decidable. **Built: the `role` walk carries a measured-section-unfilled kind**, so a document declaring the section and leaving it empty fails. **The observing check is narrower than the rule**: it observes the section's emptiness and not the removal of an entry from a populated one, which is the ordering the rule names and which no artifact records | `role/measuredSectionUnfilled` |
| `nothing_silently_dropped` | that displaced content vanished rather than moved. **Walked properly, the second question already answers it: the subject is a restructuring, which is an act no artifact records.** A tree where content moved and one where it vanished are the same tree, and only the author's intent separates them. **The near-checkable half is a draft standing beside a live file with no published migration map**, which is the draft rule's own shape and is decidable, and its population is empty here, because this tree carries no draft convention and holds no drafts. A check over an empty set is a green that measures nothing, so building one would ship a field that always says the same thing and make its own greenness the evidence that the thing it measures is working. Reading this cell as decidable and unbuilt would confuse the empty near-half with the act, and a search of the toolchain for any reader of a map or a displaced-block record returns zero files either way | `subject-is-an-act` |
| `optimization_follows_a_measurement` | that a change was made for speed, and what was measured before it. An optimized implementation and a speculatively rewritten one are the same artifact, and the measurement lives in a run rather than in the tree | `subject-is-an-act` |
| `gate_that_saturates_is_not_built` | a check that was not built, and why. The artifact records the checks that exist, never the one an author declined and the property declined with it. **Inspection cannot tell a saturating check from a working one**, since both are green, and the difference is whether anything could disagree, which is a property of the field's semantics rather than of any file. Walked: the second question returns act, because the subject is a check an author declined, and a declined mechanism is absent from the tree by construction | `subject-is-an-act` |
| `mechanism_consumed_date_is_an_operand` | whether something reads a date to decide. The discriminator is a consumer's behavior rather than the value, so two identical timestamps differ only by what happens to them, and the consuming mechanism may live in another runtime entirely. Walked: the subject is an artifact and the fourth question fails, because the property is a consumer's behavior, and where that consumer is outside this runtime nothing in the tree evaluates it | `not-evaluable` |
## Template execution
The templates are checked as documents, and mandatory gates and independence both hold. These remaining rules
govern the **executed artifact**, which is produced in a turn and persisted nowhere here, so there is no file
to read.
| slug | what a check would need | checkable half |
| ------------------------------------------ | --------------------------------------------------------------- | --------------------- |
| `decisions_are_typed` | the executed artifact's decisions and their declared shapes | `no-declared-surface` |
| `repair_from_earliest_owner` | which node a failed gate routed back to | `no-declared-surface` |
| `severity_routes_never_orders` | whether severity ordered phases or routed failures | `no-declared-surface` |
| `ripple_carries_names` | an impact record, to check it names entities rather than counts | `no-declared-surface` |
| `generation_gates_are_not_execution_gates` | which gates were resolved while producing versus while running | `no-declared-surface` |
| `descriptive_is_not_full_shaped` | whether the full loop was forced onto a descriptive artifact | `no-declared-surface` |