--- name: adapter-project-binding type: binding summary: Resolves every abstract slot the reasoning templates and the placement standard declare, against this deployment. A slot is RESOLVED, ABSENT or DEFERRED — never silently faked. concern: binding status: current --- # Adapter — project binding The reasoning templates and the placement standard are runtime-neutral cores. They carry no paths, no commands and no model, and instead declare `{slots}` an adapter resolves against the host. This document is that adapter, and it is RENDERED from the surface configuration — the values live there, so a hand edit here is a second truth that disagrees the moment one of them moves. ## Resolution states Every slot resolves to exactly one of three states. The third is the one that matters. | state | meaning | consequence | |---|---|---| | `RESOLVED` | a real value exists here | the branch using it runs | | `ABSENT` | this deployment has no analogue | **the branch using it does not run, and that is declared** | | `DEFERRED` | it will exist; it does not yet | the branch is blocked, not skipped | `ABSENT` is a first-class answer. A consumer gating on a build command in a deployment with no build reports that it cannot gate, never invents a substitute and never quietly passes. **An adapter that resolves everything is an adapter that is lying about something.** ## Project slots — what the host supplies | slot | state | value | why | |---|---|---|---| | `{project.agent_registry}` | ABSENT | — | the HOST's own agent roster, if it keeps one. This package's agents live under its behavior tree and are reached through that slot; a directory named here would be a second roster, and the copy nobody maintains is the one a reader takes. | | `{project.architecture_registry}` | ABSENT | — | no registry of base abstractions; nothing here has a class hierarchy. | | `{project.architecture_rules}` | ABSENT | — | the host's architecture document, if it keeps one on a separate axis from its behavior document. | | `{project.capability_tree}` | ABSENT | — | no tree of composable capabilities is declared. A consumer reading one is skipped rather than blocked, because nothing here has promised to build it. | | `{project.checkpoint}` | DEFERRED | — | whether a reversible checkpoint exists. A host under version control resolves this; until it is resolved, a destructive step is gated on the operator rather than on a rollback that may not exist. | | `{project.component_docs}` | ABSENT | — | no component model. | | `{project.coordination_board}` | RESOLVED | `collab.comms.active` | WHETHER this deployment runs a board, and under what name. It answers a different question from the surface slot that locates the file: **ABSENT here means a single-worker deployment**, which is what derives whether a reader is a seat or a bounded invocation — the scope is read from the binding rather than from the reader, because a reader classifying its own turn is an escape hatch keyed on self-classification. | | `{project.credential_bearer}` | ABSENT | — | the single artifact a host declares as the one permitted to hold a credential. Absent means no artifact bears one, so every credential-shaped value anywhere is a finding — which is the correct default for a package that holds none. | | `{project.design_guide}` | ABSENT | — | no design system or visual language is governed here. | | `{project.design_models}` | ABSENT | — | no design substrate is carried here. | | `{project.governance_policy}` | ABSENT | — | the host's behavior document, and ABSENT until a host ADOPTS this package rather than merely containing it. A resolved value here directs every projection refresh into a document the package does not own, so a surface that is only sitting inside a tree would write its coordination state into that project's standing context — which is the host reach-in this package exists to refuse, arriving through the one slot that looks like configuration rather than like a reach. **An adopting host resolves it and gains the projection**, which matters because a host's standing context is the only channel a bounded invocation receives and a projection kept inside this package reaches nothing; while it is ABSENT the projection branch does not run and a blocker is carried by the board alone. | | `{project.governance_sources}` | RESOLVED | `[]` — declared and empty | every host document that DECLARES a rule. Empty means this package's own axis document is the only declaring surface, which is the correct default — a drop-in does not know what its host declares until the host says so. | | `{project.history}` | ABSENT | — | the host's own history file, if it keeps one. There is ONE history home per project, so a host that has one declares it here and the package writes into it; absent, the package's own accumulator is used and the two never compete. | | `{project.invocation_registry}` | ABSENT | — | invocations are discovered by the host runtime; none is authored here. | | `{project.knowledge_docs}` | ABSENT | — | the host's durable-record tree, if it keeps typed records. Absent means a consumer that would cite one carries its finding in prose instead. | | `{project.open_venues}` | RESOLVED | `*.blocking.md` | the pattern a blocking venue matches at any depth. A blocker outranks every queue, so it is checked before the board and before any claim; ABSENT where no venue mechanism exists, and the branch that checks for one then does not run. | | `{project.planning_roots}` | RESOLVED | `[]` — declared and empty | every HOST directory holding planning surfaces; this package's own is always governed and is not listed here. Empty means the package governs its own planning only, which is the correct default — a drop-in that scans its host's planning surfaces on arrival reports findings about a tree nobody asked it to govern. A surface in a directory no gate reads is ungoverned wherever it sits, so this binding is what governs a planning surface rather than its location. | | `{project.principle_ontology}` | ABSENT | — | the host's principle catalog, if it carries one. | | `{project.projection_marker}` | RESOLVED | `collab-status` | the token that identifies THIS package's projection line inside the host document. It is a slot because a host may run more than one coordination surface, and a bare shared token makes each board read the other's line and refresh a channel it does not own — a cache with two writers and no way to tell them apart. **A host adopting a second surface gives it a distinct marker**, which is what keeps the projection a channel rather than a collision. | | `{project.reasoning_oracle}` | ABSENT | — | no oracle is reachable. An uncertain judgement is carried as a stated uncertainty rather than resolved by consultation, so the branch that consults one does not run. | | `{project.registry_regenerate}` | ABSENT | — | nothing is generated from a registry. | | `{project.root}` | RESOLVED | `..` | the host root, relative to THIS PACKAGE and never to the working directory — a package that resolves its roots from the cwd only works when it IS the repository root, which is the one thing a drop-in never is. This is the ONE value a host sets, and it is DECLARED rather than derived on purpose: a walk to the nearest ancestor carrying a version-control directory or a manifest stops at a submodule boundary or a nested package and answers with a tree that merely contains this one. Measured on a host where that walk lands one level short — the scanned set drops and every citation reframes. Which ancestor is the project is a judgement about the host's layout, and a check that is usually right is wrong. | | `{project.rule_sources}` | ABSENT | — | the directory holding the host's rule digests, if it expands rules into one. | | `{project.runtime_adapter}` | RESOLVED | `config/surface.config.ts` | this configuration. The binding document is rendered from it, so the adapter is a module rather than a page. | | `{project.taxonomy}` | ABSENT | — | the host's own naming and placement configuration, if it governs its tree by one. Absent means the placement rules govern this package's surfaces only. | | `{project.upstream_roots}` | RESOLVED | `[]` — declared and empty | HOST trees holding material authored elsewhere; this package's own are declared on the surface axis. One declaration exempts a tree from the naming, tense and reference gates together, because all three fail such a tree and not one of the three failures is a defect in it — its filenames were chosen by its author, its version statements describe a platform rather than a project, and the paths it cites are illustrative rather than references into this tree. | ## Surface slots — what this package owns | slot | state | value | why | |---|---|---|---| | `{surface.agenda}` | RESOLVED | `_agenda.md` | the LIVE agenda: every planned invariant, what it must establish, and its current state. Named for the function it performs, because a surface a mechanism parses POSITIONALLY cannot carry a name promising a reader they may annotate, reorder or append to it freely — the name and the parse are two contracts over one file, and every defect found on this one was what a reader following the other name produces. Declared because a successor is DECLARED by name rather than derived from an ordinal, so a declaration departing from the planned set displaces a subject — and the only thing that has ever caught such a departure is a seat noticing, which is exactly what the agenda exists to stop being the mechanism. Both operands are files, so the comparison is decidable and the surface has to be reachable by the walk that decides it. | | `{surface.agent_index}` | RESOLVED | `_agent-index.md` | the permanent letter-to-role binding, and an accumulator rather than current truth: a letter that stops being active still has to resolve, because every citation that ever named it points here. | | `{surface.agent_template}` | RESOLVED | `.{provider}/templates/agent.protocol.template.md` | the shape a persisted agent specification is raised from. | | `{surface.agents}` | RESOLVED | `.{provider}/agents` | the persisted agent specifications the agent template raises. Declared because it is the seeded end of a seeds relation: a template holds no content of its own and declares a lifetime FOR AN INSTANCE, so the seeded identity must resolve or the seed points at nothing and reads exactly like one that resolved. | | `{surface.archive}` | RESOLVED | `_archive` | the archive TREE, declared so its lifetime resolves for everything inside it rather than for one subtree of it. A walk deriving an exemption from a declared lifetime reads the nearest declaration, so material sitting beside a declared subtree inherits nothing — and an archive accumulates artifacts authored under earlier rules by construction, which makes every future naming rule and vocabulary edit land a permanent finding there on a file nobody is permitted to touch. Declaring the tree is what makes the exemption follow from the DECLARATION rather than from a path somebody listed. | | `{surface.axis_document}` | RESOLVED | `AGENTS.md` | the package's OWN axis document — the paste block, where every rule this package declares states the check enforcing it. It sits at the package root under the name agent runtimes read without configuration, so no runtime's own folder is needed to find it. Distinct from the host's governance policy, which is where the PROJECTION is written: one is what this package declares, the other is what the host declares, and a single slot serving both makes the coverage check measure the host's rules against this package's checks. | | `{surface.behaviour_tree}` | RESOLVED | `.{provider}` | the package's own behavior tree — the rule digests, the reasoning protocols, the skills and the agent specifications. It ships under a placeholder name in slot syntax, and adoption renames the folder to the one the adopting runtime reads and replaces the placeholder wherever the package spells it, as BOOTSTRAP.md states. Every check reads this value rather than a literal, and the reference check fails a document path still naming the placeholder, so a partial adoption is a loud failure instead of a silent unresolved reference. | | `{surface.binding}` | RESOLVED | `.{provider}/bindings/adapter.binding.md` | the rendered prose face of this configuration. It is GENERATED — the values live here, and a hand-edited binding is a second truth that disagrees the moment one moves. | | `{surface.board}` | RESOLVED | `collab.comms.active` | the coordination board. A deployment with one worker resolves this ABSENT, and that is what derives whether a reader is a seat or a bounded invocation — the scope is read from the binding rather than from the reader, because a reader classifying its own turn is an escape hatch keyed on self-classification. | | `{surface.board_template}` | RESOLVED | `templates/collab.comms.template.md` | the shape a board is raised from. The board gate derives its record schema from this file rather than transcribing it, so the gate cannot drift from the contract it enforces. | | `{surface.bootstrap}` | RESOLVED | `BOOTSTRAP.md` | the adoption procedure, and the one document that names the behavior tree's shipped placeholder after adoption, because it describes the shipped state. The check for a placeholder left behind by adoption skips it by this slot rather than by its name. | | `{surface.checklist_template}` | RESOLVED | `.{provider}/templates/checklist.protocol.template.md` | the planning protocol a checklist is executed from. The checklist gate DERIVES its contract from this file on every run rather than transcribing it, so the gate cannot drift from the protocol it enforces. | | `{surface.conduct_roster}` | RESOLVED | `.{provider}/rules/conduct.rule.md` | the roster of rules no construct observes, and a MANDATED-WRITE surface: a registered walk refuses a row carrying no third cell, so every cell on it is a party write. It is declared because a mandate reaches only surfaces this configuration names — an undeclared target sits outside every walk built to observe exactly that, including the one whose subject it is, and such a walk can only ever report a mandate whose slot fails to RESOLVE rather than one whose surface has no slot at all. | | `{surface.core}` | RESOLVED | `tools/core` | the pipeline core, authored once and never edited to add a rule. | | `{surface.document_template}` | RESOLVED | `templates/document.template.md` | the shape a substrate document is raised from. It carries no seeds entry, because the class it raises has no declared identity yet and a seed naming an undeclared one resolves vacuously — which is the shape this package refuses everywhere else. | | `{surface.emitting_sources}` | RESOLVED | `tools/rules` · `tools/core/inspectors` · `tools/core/validators` | every source that may claim a report id. A report on disk owes an emitter that still writes it. | | `{surface.entrypoints}` | RESOLVED | `tools/core/entrypoints` | every CLI surface the package exposes. | | `{surface.finding_template}` | RESOLVED | `templates/finding.template.md` | the shape a FINDING is raised from — the surface a converging venue writes its measured half into, one row per claim. Declared for the same reason its sibling is: the obligation to write there is stated in a convergence edge, and a shape no walk derives is a contract only its author can check. | | `{surface.findings}` | RESOLVED | `findings` | where a venue's MEASURED half lands — this tree's own instances, one row per claim carrying what observes it and over which members. It is the counterpart to the class half and is declared for the same reason: the two are named together by every exit condition that mandates them, so declaring one and not the other would leave half of a single obligation unreachable. | | `{surface.fixtures}` | RESOLVED | `tools/core/fixtures` | the proving samples every registered kind is certified against, and a MANDATED-WRITE surface for the same reason: the certifier counts an unproven kind into its open total, so a fixture pair naming the fired and the accepted member is a party write the pipeline requires. Declared so that requirement is reachable by the walk that observes mandated writes, and so a lifetime resolves for every sample beneath it rather than for the directory alone. | | `{surface.generated}` | RESOLVED | `_generated` | every derivation a run writes. The report is the state; a question about what is open is answered by reading it rather than by re-running the gate. | | `{surface.history}` | RESOLVED | `_changelogs.txt` | the package's own history accumulator, used when the host declares none. Extraction lands here before any removal, so a drain with no resolvable history file destroys the only durable record of a finding — which is why removal refuses rather than proceeding. | | `{surface.index_template}` | RESOLVED | `templates/index.template.md` | the shape the workspace index is raised from. It carries no seeds entry for the same reason the document template does not. | | `{surface.leaves}` | RESOLVED | `tools/core/types` · `tools/core/constants` · `tools/core/predicates` · `tools/core/strings` | the innermost tier: a leaf imports only leaves, and domain vocabulary reaching one is the deepest point coupling can penetrate. | | `{surface.model_template}` | RESOLVED | `templates/model.template.md` | the shape a MODEL is raised from — the surface a converging venue writes its class half into. Declared because a template nothing resolves is governed by nothing while reading as a contract: the walk that would derive a model's shape from it cannot name it, and the mandate requiring a venue to write there resolves to a surface whose form nobody can check. A template is the one artifact whose consumers are all in the FUTURE, so the moment its correctness matters is the moment nobody is watching. | | `{surface.models}` | RESOLVED | `models` | where a venue's CLASS half lands — what a construct is, which formulation composes, and what a reader may derive from it, naming no project, no seat, no tool and no count. Declared because a mandated write reaches only surfaces this configuration names: a venue whose exit condition refuses to converge until its outcome is written here is a refusing mechanism requiring a write, and an undeclared target sits outside every walk built to observe exactly that — including the one whose subject it is. | | `{surface.pipeline}` | RESOLVED | `tools` | the gate pipeline's root. | | `{surface.planning}` | RESOLVED | `checklists` | this package's own planning surfaces. | | `{surface.planning_template}` | RESOLVED | `templates/checklist.template.md` | the shape a PLANNING surface is raised from — the distribution a venue's absorption edge refuses to converge without. IT IS A SECOND DECLARATION RATHER THAN A RE-POINT OF ITS NEIGHBOR, because two artifacts serve two consumers: the reasoning PROTOCOL states how a plan is executed and the checklist walk derives its contract from that, while this SEED states what a raised instance carries permanently and the raise form freezes its blocks. Re-pointing the protocol's slot would break the walk reading it, and reading the protocol as a seed raises an instance of a reasoning loop into the planning root — conformant to nothing, from a mapping that reads as considered. The family's naming is what hid it: every other member of it resolves a surface seed, so a party looking for this one reaches for the name already bound to the protocol and finds a value its eight siblings do not carry. | | `{surface.principle_canon}` | RESOLVED | `https://banes-lab.com/software-architecture/principles.md` | the principle catalog read where the host declares none: the published Software Architecture principles, as a Markdown view. The same records are served as data at https://banes-lab.com/json/software-architecture/principles, and each principle is anchored at https://banes-lab.com/ontology#arch-. It sits BESIDE the host-facing ontology slot rather than defaulting it: a consumer reads the host's catalog where that slot resolves and this one otherwise, so a host with its own catalog still wins. **Defaulting the host slot to this catalog would make an ABSENT host catalog indistinguishable from a chosen one**, and every branch that correctly declines today would begin running against a catalog the host never picked. | | `{surface.role_template}` | RESOLVED | `templates/role.template.md` | the shape a role document is raised from. The role gate derives its section set and its frontmatter operands from this file, so a seat's first document and the check that reads it answer to one contract — and an absent template fails the gate rather than resolving its contract to an empty set. | | `{surface.roles}` | RESOLVED | `roles` | one role document per concern, the letter in the variant slot. A seat changes hands and a concern does not, so the file survives the letter. | | `{surface.rule_digests}` | RESOLVED | `.{provider}/rules` | the digests that expand a declared rule, and a surface class that DIVIDES: its directive text is current truth and overwritten as enforcement changes, while a measured clause the rule DEPENDS ON is evidence nothing else in the tree holds a copy of. Declared so the divide is stated where a mechanism reads it rather than only in the rule permitting the measurement, which is the same composition the roles root already carries — present-tense and overwrite are each correct here and compose into a license to delete the only copy of a measurement. | | `{surface.rules}` | RESOLVED | `tools/rules` | one drop-in file per rule, discovered at runtime. Adding governance touches no core file. | | `{surface.steps}` | RESOLVED | `tools/core/steps` | the fixed stages that run ahead of the discovered rules. They emit report ids too, so a report's claim set is read from here as well as from the rule directory — a claim set that silently resolves to nothing makes a healing gate delete every report it should have kept. | | `{surface.taxonomy_config}` | RESOLVED | `config/taxonomy.config.ts` | the naming and placement vocabulary, with its cross-slot agreement asserted at compile time. A finding about a declared root or container is reported against this file, because that is where the declaration lives. | | `{surface.upstream}` | RESOLVED | `[]` — declared and empty | material authored elsewhere that this package carries. **Empty, and that is the shipped state**: a coordination package carries no vendored copy of anyone's documentation, because a copy goes stale the moment upstream moves and a stale copy of a vendor's own words is worse than a pointer to the live ones. The mechanism stays for a host that does carry such a tree — one declaration exempts it from naming, tense and reference together, since all three fail it for the same reason and none of the three failures is a defect in it. A declaration resolving to nothing exempts nothing while reading as a considered exclusion, so this stays empty rather than naming a tree that is gone. | | `{surface.venue_archive}` | RESOLVED | `_archive/venues` | where a CONVERGED venue is kept after its discussion closes. It is governed and settled rather than argued, which is a third state the tree had no name for — an OPEN venue holds the build, an absent one is gone, and an archived one must stay findable with its headings resolvable while reading as neither. The venue scan is depth-agnostic by design so a blocker one level down cannot hide, and that same reach makes an archived venue read as an open discussion unless this root is declared: the scan quantifies over the set it is told, and moving a file changed the set without telling it. | | `{surface.venue_template}` | RESOLVED | `templates/blocking.template.md` | the shape a prioritized discussion is raised from. The venue gate DERIVES its record schema from this file on every run rather than transcribing it, so a venue's fields stay the venue's own — the surface a seat writes a position into is not the surface that carries coordination state, and the two drift the moment one gate holds a copy of the other's contract. | ## Convention slots | slot | state | value | why | |---|---|---|---| | `{convention.abstract_prefix}` | ABSENT | — | no class hierarchy. | | `{convention.agent_keys}` | RESOLVED | `name` · `description` | the frontmatter keys an agent specification may carry, which is the set the adopted runtime reads. The package ships the two every runtime reads, and adoption adds the runtime's own keys here, as BOOTSTRAP.md states. A key outside this list reaches no reader: the runtime ignores it, so it drifts against the body with nothing breaking when it is wrong. Everything the agent must act on is written in the body, including the skills it loads, because the body is the one surface every runtime delivers. | | `{convention.agent_workspace}` | RESOLVED | `_generated` | where durable output lands. | | `{convention.audit_pass_threshold}` | ABSENT | — | no numeric pass threshold exists. Every check returns pass or fail, so a weighted score compared against a bound is a middle tier under another name, and the branch scoring one does not run. | | `{convention.audit_workspace}` | RESOLVED | `_generated` | an audit record is a generated report and lands where every other one does, so it is read by the same convention. | | `{convention.base_class_prefix}` | ABSENT | — | no class hierarchy. | | `{convention.binary_extensions}` | RESOLVED | `[]` — declared and empty | file types read as opaque bytes and never scanned. Empty means every governed file is text. | | `{convention.cache_ttl_days}` | ABSENT | — | no domain cache is kept between runs, so a consumer demanding cache evidence would be satisfiable only by fabricating it. | | `{convention.chars_per_token}` | RESOLVED | `2` | measured, never assumed — dense markup runs far denser than prose, and a ratio guessed generously produces a gate that passes exactly when it is most needed. | | `{convention.code_extensions}` | RESOLVED | `.ts` | the file types the comment cleaner and the code-level gates read. | | `{convention.conditional_gates}` | RESOLVED | `projection_is_one_line project.governance_policy` · `board_write_refreshes_projection project.governance_policy` | rules whose gate is REGISTERED and whose enforcing branch depends on a slot, written as the rule slug then the slot it needs. Coverage reports each as GATED-WHEN-RESOLVED and, where that slot does not resolve, names it UNREACHED — because a rule counted plainly gated while the branch enforcing it cannot run is a zero-ungated count standing over rules nothing enforces, and a rule counted plainly UNGATED goes permanently red on a finding whose only repair is acquiring a host, which is unreachable remediation. The third state is real and is carried in the derivation so the count can never over-claim. | | `{convention.embodiment_threshold}` | RESOLVED | `1` | a template either embodies its loop or does not. | | `{convention.enumerable_write_regions}` | RESOLVED | `_generated` | the regions where ONLY RUNS WRITE and EVERY RUN DECLARES, which is what lets both directions of the unclaimed-write question be enforced there: a write with no live claim is refusable, and a claim with no write is detectable. Across the source tree neither premise holds — a party edits without declaring anything — so the primitive carries CLAIMS ONLY there and refuses to infer a writer from a changed file, which is the ambiguity it exists to decline rather than resolve. The regions are DECLARED here rather than branched on inside the mechanism, so a region added to this list acquires the correct direction with no edit to the writer, and a mechanism keyed on a path SHAPE would silently answer the wrong question for the next region somebody adds. | | `{convention.grounding_threshold}` | RESOLVED | `1` | every claim in an authored artifact traces to evidence; no partial grounding. | | `{convention.max_recursion_depth}` | RESOLVED | `3` | the placement depth cap, counted from a governed root. | | `{convention.medium_risk_threshold}` | ABSENT | — | no count-based risk banding. | | `{convention.operator_mode}` | RESOLVED | `overseer` | how the owner takes part, as one of two values. `overseer`: the seats coordinate among themselves and never stop to ask the owner or wait on the owner; the owner writes entries into a venue in any form and anywhere in it, each seat's next wait delivers them as part of the diff, and every seat treats such an entry as new context the discussion must honor; a seat addresses the owner only when coordination has stalled. `interactive`: the seats bring decisions to the owner, as a question with four options and a recommendation first, and wait for the answer. | | `{convention.projection_cap_chars}` | RESOLVED | `2000` | the projection is ONE line and a gate holds it there. A field named a one-liner is making a claim about its size, and where no check reads it the name is documentation and the shape is a hope. | | `{convention.read_token_budget}` | RESOLVED | `25000` | the reader's token cap. No board field may exceed what one read consumes, because reading in parts has a floor at one field. | | `{convention.relevance_threshold}` | ABSENT | — | no scored document-relevance surface. | | `{convention.role_taxonomy}` | RESOLVED | `config/taxonomy.config.ts` | the closed concern vocabulary, with its cross-slot agreement asserted at compile time. | | `{convention.run_live_window_ms}` | RESOLVED | `600000` | how long an unreleased run claim is read as STILL RUNNING rather than as a run that died. A claim is the in-flight declaration a second caller reads before deciding whether to start a second measurement of the same tree, and without a window every claim reads as a dead run — which reports a crash on every concurrent invocation and teaches every reader to discount the line. The value is the consumer's because it depends on how long that consumer's whole-scope run takes, and a package cannot know its host's tree size. IT IS SET GENEROUSLY, AND THE DIRECTION IS DECLARED BECAUSE THE TWO ERRORS COST DIFFERENT THINGS: a window too LONG holds a dead claim, which costs a caller one re-invocation and announces itself, while a window too SHORT declares a live run dead and costs a lost write, which is silent and unrecoverable. The generosity is affordable because the window governs only what the witness cannot decide — an ABSENT process is read as dead immediately whatever the clock says, so a long window never hides a crash this machine can observe, and it governs a present process and a claim recorded on another machine, where nothing portable states when an identity's holder started. | | `{convention.secret_shapes}` | RESOLVED | `[]` — declared and empty | the credential shapes the secret gate looks for, each written as the token's prefix, a colon, and the shortest length a real credential of that shape has (for example `sk_live_:24`). The shapes belong to the host, because only the host knows which services it holds keys for. Empty means the gate has no shape to match and reports nothing. | | `{convention.source_ext}` | RESOLVED | `md` · `ts` | the file types this package authors — documents and configuration. A host adds its own only where these gates are meant to reach them. | | `{convention.source_extensions}` | RESOLVED | `.ts` · `.md` · `.json` | the file types this package authors. A host adds its own only where this package's gates are meant to reach them. | | `{convention.stall_rounds}` | RESOLVED | `3` | rounds after which an unacknowledged item is a finding. It bounds a LIFETIME rather than a size — a stall is literally a duration, so it stands in for no construct. | | `{convention.timestamp}` | RESOLVED | `YYYY-MM-DD` | absolute dates, never relative. | | `{convention.unreached_gate_fails}` | RESOLVED | `0` | whether an UNREACHED gate is a finding, which is the consumer's declaration rather than this package's guess: a deployment expecting to resolve the slot wants the red, and one that will never resolve it does not. Zero reports the state without failing; any other value fails on it. | | `{convention.venue_authority_concern}` | RESOLVED | `Coordination documents` | the CONCERN that holds venue and agenda management, named as a concern because a letter is an identity the index allocates and a concern survives a seat changing hands. Every venue-shaped write — raising a successor, deferring a question, retracting one, recording an agenda row — resolves the holding letter from the index row carrying this concern and refuses every other caller. ONE party manages the sequence: a venue raised, a question moved out of a discussion, or an agenda row written by whoever happens to hold the form is a schedule with several authors, and the schedule is the one surface that cannot have them. | ## Limits | slot | state | value | why | |---|---|---|---| | `{limits.max_files}` | ABSENT | — | no per-folder file cap. Placement is governed by concern, never by count. | | `{limits.max_lines}` | ABSENT | — | a per-file line cap. This package does not gate host code size; a host that wants one holds it in its own linter. | ## Execution | slot | state | value | why | |---|---|---|---| | `{execution.build_command}` | ABSENT | — | this package has no build; nothing compiles and no artifact is produced. | | `{execution.converge_command}` | RESOLVED | `npm run converge` | the convergence walk, which reports every ordering and MOVES a venue whole into the archive once all of them hold. Declared for the same reason the wait command is: a tool printing its own invocation form as a literal states a fact this surface already resolves, so the loudest copy of that fact — the one printed to every seat on every invocation — is the one with nothing behind it. | | `{execution.denied_interpreters}` | RESOLVED | `[]` — declared and empty | interpreters the host's settings refuse. A tool reaching one is handed to the operator instead; empty means the host denies none. | | `{execution.document_generators}` | ABSENT | — | the HOST's own document generators, invoked in order, each as arguments to the runtime. ABSENT by default: this package's entry document ships rendered from the `docs` fields of `_manifest.json`, and the package runs no generator of its own, so the branch does not run. A host that generates its documents with its own tooling resolves this slot, and the dependency is then declared here rather than spelled as a host path inside a script. | | `{execution.quality_command}` | ABSENT | — | the HOST's own quality toolchain entrypoint, if it keeps one — the command that runs its linters, its dead-code sweep and its formatter. RESOLVED means the pipeline runs it as one stage so a consumer has ONE chain rather than two, and the tools stay the host's: nothing enters this package's manifest, which declares no dependencies precisely so a consumer needs no toolchain to verify a package built to adapt to any host. ABSENT means the stage does not exist and the run says so rather than reporting a green over a check nobody ran. | | `{execution.quality_concerns}` | RESOLVED | `[]` — declared and empty | which concerns of the host's quality toolchain the pipeline hands it, and the consumer elects them. The additive ones are the checks this package's own rules do not perform — its rules read structure, protocol and governance and none of them reads a TYPE, so type-aware linting and a dead-code sweep find what no rule here looks for. A FORMATTER is elected deliberately rather than by default: it rewrites every governed document and every source file into the host's house style, and this package declares no formatting of its own — that absence is a property, so imposing a style is a decision the consumer makes rather than one the pipeline makes for them. Empty means the stage runs nothing even where the command resolves. | | `{execution.runtime_probe}` | ABSENT | — | no agent can observe a running system from here. A branch that would confirm a behavior by observing it does not run, and the claim is carried as operator-observed rather than as verified. | | `{execution.verify_command}` | RESOLVED | `npm run govern` | the whole pipeline, whole scope, healing on. | | `{execution.wait_command}` | RESOLVED | `npm run await` | the board write-and-wait tool. Every invocation declares its agent. | ## Resolution census Derived on render, so it cannot disagree with the table above. | section | RESOLVED | ABSENT | DEFERRED | |---|---|---|---| | `project` | 8 | 17 | 1 | | `surface` | 39 | 0 | 0 | | `convention` | 23 | 6 | 0 | | `limits` | 0 | 2 | 0 | | `execution` | 5 | 4 | 0 |