{
  "content": {
    "kind": "tabbed",
    "layout": "chapter",
    "meta": {
      "emblem": "/assets/images/pag-emblem.png",
      "subtitle": "Structured instructions for LLMs",
      "title": "Pattern Abstract Grammar",
      "version": "2.0.0"
    },
    "tabs": [
      {
        "icon": "bi-lightbulb",
        "id": "introduction",
        "label": "Introduction",
        "sections": [
          {
            "icon": "bi-lightbulb",
            "id": "what-is-pag",
            "intro": "Pattern Abstract Grammar (PAG) is a structured format for writing the instructions a model is asked to follow. A PAG document declares what kind of instruction it is and what it may touch, and it draws every operative word from a [closed vocabulary](/ontology#arch-closed-vocabulary) of uppercase tokens grounded in a reasoning ontology. The work is grouped into nodes; each node reads the previous node's output and closes on a gate of checkable conditions, each with its evidence and the population it covers. The document states its boundaries as invariant records and ends with a report, and [minimal document] shows all of these parts together. Each part is one stage of a reasoning loop written down, as listed in [construct to stage], so the document makes [the loop](/disciplined-methodology#the-loop) legible. [prose or directive] shows where variance enters without the grammar, and [scan, loop, binding] shows what walks a document. What the tokens gain is described in [why it works](/pag#why-pag-works), and what the grammar never reaches is described under [limits](/pag/validation#limitations).",
            "subsections": [
              {
                "blocks": [
                  {
                    "application": "In practice, an instruction is written as a PAG document when a reasoning loop will walk it. The document declares its type, states a checkable objective, divides the work into nodes with contracts, closes each node on three to five checks that can be settled with evidence, and bounds the whole with invariants.",
                    "boundary": "A prompt that asks one question in passing gains nothing from a node structure. The grammar earns its cost where the document will be walked more than once, read by more than one party, or trusted to have done what it says.",
                    "cause": "An [implicit contract](/ontology#arch-implicit-contract) leaves the model to supply the terms, and it supplies them from the completion, so they vary with it.",
                    "decision": "The instruction gets a type rather than sharper prose: a declared type, tokens from a closed set and gates with checkable exits, rather than a longer or more careful sentence.",
                    "failureMode": "The same request run twice produces two plausible results, and neither you nor the model can say which sentence was read differently.",
                    "kind": "lesson",
                    "principle": "For this reason I write an instruction as an [explicit contract](/ontology#arch-explicit-contracts) rather than as a request in prose.",
                    "problem": "An instruction written as prose leaves its terms to the model that reads it.",
                    "validation": "To check this, hand the same document to the model twice and compare both outputs against the gates. Where both runs pass every gate, the structure held; where one fails, the failing gate points to the sentence that was still prose."
                  },
                  {
                    "kind": "text",
                    "text": "A document has no runtime. What walks it is a reasoning loop, the one the methodology page teaches, and every construct of the grammar makes one of that loop's stages explicit. The document type names which reasoning model walks the document and on which axis of the loop it sits, and an adapter outside the document maps each [semantic operation](/pag/guide#tool-invocation) to the tool that performs it."
                  },
                  {
                    "kind": "text",
                    "text": "Two kinds of check apply to a document. A scan checks its shape; that is [static analysis](/ontology#arch-static-analysis), deterministic and cheap, and it is what makes the grammar parsable. The loop checks its meaning, and that check is not deterministic, because the loop is walked by a model."
                  },
                  {
                    "code": "---\nname: <document-name>\ntype: TASK\nversion: 1.0.0\n---\n\nTHIS TASK EXECUTES <what the document is for, in one sentence>\n\n%% META %%:\n    objective: \"<what finished looks like, checkable against the tree>\"\n    jurisdiction: <source> | external: everything else\n    recursion_limit: \n\n# NODE 1 — <the first bounded decision>   [epistemic · analysis · logic · yields: boolean]\n@genesis: existence\nCONTRACT:\n  input:     <source>\n  transform: READ_RESOURCE <source> INTO <held>; VALIDATE_ARTIFACT <held> AGAINST <schema>\n  output:    <held>, validated\nHANDOFF GATE:\n  [check] <held> read from <source> (evidence: the read returned content)\n  [check] <held> conforms to <schema> (evidence: the validator's report) over: <held> records measured: <conforming> / <records>\n  [check] every <held>.<record> carries the fields NODE 2 reads (evidence: no record with a missing field)\n  result: pass → NODE 2 | unread or nonconforming → REPAIR (owner: NODE 1) | unknown → BLOCKED\n\n# NODE 2 — <the decision that consumes the first>   [epistemic · reasoning · set-theory · yields: set]\n@genesis: difference\nCONTRACT:\n  input:     <held> from NODE 1\n  transform: FOR EACH <item> IN <held>.<collection>: ANALYZE_CONTENT <item> AGAINST <criterion> INTO <finding>; IF <finding>.<met>: APPEND <item> TO <result>\n  output:    <result>\nHANDOFF GATE:\n  [check] every <item> analyzed (evidence: one finding per item) over: <held>.<collection> measured: <analyzed> / <items>\n  [check] <result> holds every <item> that met <criterion> (evidence: the two counts match)\n  [check] no <item> outside <held> appears in <result> (evidence: every result item present in <held>)\n  result: pass → TERMINATE | count mismatch → REPAIR (owner: NODE 1) | unknown → BLOCKED\n\n# CROSS-NODE INVARIANTS\nINVARIANT validate-before-persist: <held> is validated before anything is persisted over: every node binds: the reader objector: [check] <held> conforms to <schema> at NODE 1\nINVARIANT source-untouched: <source> is never modified in place over: <source> binds: the reader objector: none\n\nREPORT:\n  subject: NODE 2\n  verdict: pass | fail | unknown\n  domain: declared <items> measured <analyzed>\n  completion: saturated <bool> complete <bool> verified <bool>",
                    "kind": "code",
                    "language": "pag",
                    "title": "minimal document"
                  },
                  {
                    "code": "# each construct of a document is one stage of the reasoning loop, written down\ndeclaration          orient      what kind of instruction exists, and what it may touch   yields: a set\nkeyword directive    see         the lens the intent is read through                    yields: a structured line\nnode                 project     what follows what, as a contract                       yields: an edge-list\ncontrol flow         act         which branch, which iteration                          yields: a procedure\nsemantic operation   act         which effect, bound to a result                        yields: a procedure\ninvariant record     constrain   what is admissible, and what would object               yields: a boolean\nhandoff gate         verify      what evidence closes the node, over what set           yields: pass, fail or unknown\nreport               commit      the verdict as a representation a checker can challenge yields: an artifact\nwell-formedness      terminate   whether the document may be trusted                    yields: a boolean",
                    "kind": "code",
                    "language": "pag",
                    "title": "construct to stage"
                  },
                  {
                    "caption": "prose or directive",
                    "kind": "mermaid",
                    "text": "flowchart TB\n    prose[\"Prose · 'get the data and check it'\"]\n    interpret[\"The model interprets · what is get, what is check, what counts as valid\"]\n    variance[\"A different completion each run\"]\n    pag[\"A directive · READ data FROM source, VALIDATE data AGAINST schema\"]\n    pattern[\"The model completes a pattern it has seen\"]\n    narrow[\"A narrower set of completions · still probabilistic\"]\n    prose --> interpret --> variance\n    pag --> pattern --> narrow"
                  },
                  {
                    "caption": "scan, loop, binding",
                    "kind": "mermaid",
                    "text": "flowchart TB\n    doc[\"A document · typed, contracted, gated, bounded\"]\n    scan[\"A scan · checks the shape, deterministic\"]\n    loop[\"A reasoning loop · orient, intent, see, derive, project, act, constrain, verify, commit, terminate\"]\n    binding[\"A binding · maps each operation to a tool, each slot to a value\"]\n    output[\"Output · a sample, unverified until read\"]\n    doc --> scan\n    doc --> loop --> output\n    loop -- an effect --> binding\n    doc -. has no runtime of its own .-> output"
                  }
                ],
                "title": "A contract, not a request"
              }
            ],
            "title": "What PAG is"
          },
          {
            "icon": "bi-diagram-3",
            "id": "why-pag-works",
            "intro": "The grammar does not change how a model behaves; it changes what the model is completing. A large language model predicts the next token from the patterns it was trained on, and a large share of that training is code, configuration and structured documentation. [three sources] writes those three sources into one line, and [vocabulary origin] shows how they combine. What that gains is limited, and [the honest claim] states the limit.",
            "subsections": [
              {
                "blocks": [
                  {
                    "application": "In practice, every operative word comes from the [keyword](/pag/keywords#keyword-ontology) vocabulary, and its operands are bound with a preposition, so the model completes a recognised structure instead of interpreting a sentence. The intent is stated as an English verb the reader can review.",
                    "boundary": "Structure helps where the model has seen the structure. A vocabulary invented for one project is prose with capital letters, and the model interprets it as it would interpret a sentence.",
                    "cause": "The model completes what it has seen most often, and uppercase verbs with explicit prepositions are what it has seen in code, configuration and documentation.",
                    "decision": "Ambiguity is reduced at the input and the output is verified, rather than the input being asked to guarantee anything.",
                    "failureMode": "A page of careful prose gets a confident result that answers a slightly different question, and the difference stays invisible until the result is run.",
                    "kind": "lesson",
                    "principle": "For this reason I use explicit, high-frequency tokens, which reduce interpretive variance while the output stays probabilistic.",
                    "problem": "Careful prose is not answered with a more careful result.",
                    "validation": "To check this, rewrite one prose instruction as a directive and run both several times against the same gates. The directive should pass more often, and where it does not, the gate that fails is the one whose condition was still a judgement."
                  },
                  {
                    "kind": "text",
                    "text": "The vocabulary combines code syntax for structure with English verbs for intent and prepositions for the relations between operands. A line that carries all three is one the model can complete and a reviewer can read without a legend."
                  },
                  {
                    "kind": "text",
                    "text": "Token frequency is the reason the vocabulary is uppercase and closed. A word that appears in the same slot across many structured contexts carries a stable meaning into the completion, while a word that appears with many meanings carries all of them. So the grammar keeps its verbs few and capitalised, and gives each one a [semantic contract](/ontology#arch-semantic-contracts), stated under [instruction patterns](/pag/patterns#instruction-patterns). One term for one operation is the [ubiquitous language](/ontology#arch-ubiquitous-language) the model and the reviewer share."
                  },
                  {
                    "kind": "text",
                    "text": "Reducing ambiguity works at the derive stage of [the loop](/disciplined-methodology#the-loop). There the model works out what a line means, and a line drawn from the vocabulary leaves it one reading where prose leaves several."
                  },
                  {
                    "code": "# code syntax · a structural pattern the model has completed many times\nFOR EACH <item> IN <collection>:\n\n# an english verb · the intent, readable by a reviewer\nANALYZE <held> AGAINST <schema>\n\n# a preposition · the relation between the operands\nREAD <config> FROM <file> INTO <settings>\n\n# together · one line the model completes and a reviewer can read\nEXTRACT <field> FROM <record> INTO <value>",
                    "kind": "code",
                    "language": "pag",
                    "title": "three sources"
                  },
                  {
                    "caption": "vocabulary origin",
                    "kind": "mermaid",
                    "text": "flowchart TB\n    code[\"Code syntax · loops, conditions, assignment\"]\n    verbs[\"English verbs · analyze, validate, report\"]\n    preps[\"Prepositions · FROM, INTO, AGAINST, USING\"]\n    token[\"An uppercase token in a fixed slot\"]\n    completion[\"A completion drawn from structured contexts\"]\n    code --> token\n    verbs --> token\n    preps --> token\n    token --> completion"
                  },
                  {
                    "caption": "the honest claim",
                    "kind": "mermaid",
                    "text": "flowchart LR\n    input[\"Input ambiguity · reduced\"]\n    load[\"Interpretation load · reduced\"]\n    variance[\"Output variance · narrowed, never removed\"]\n    claim[\"The honest claim · tends toward consistency\"]\n    input --> load --> variance --> claim"
                  }
                ],
                "title": "Pattern completion"
              }
            ],
            "title": "Why it works"
          },
          {
            "icon": "bi-people",
            "id": "pag-and-the-method",
            "intro": "A PAG document is one instrument, a single input inside [the loop](/disciplined-methodology#the-loop) the method owns, as shown in [one input]. It shapes what a model reads, but nothing about it decides whether the work was worth doing, whether the result is true, or how several parties share one tree. Those questions are handled on the methodology page, in [worth before work](/disciplined-methodology/plan#worth-before-work), [it looked right](/disciplined-methodology/verify#it-looked-right) and [coordination is software](/disciplined-methodology/collaborate#coordination-is-software). Where a section of this page touches them, it shows how a document expresses them and leaves the reasoning where it lives.",
            "subsections": [
              {
                "blocks": [
                  {
                    "application": "In practice, a document shapes one input: the instruction a party reads before it acts. Everything around that input is held by the method. Worth is decided before the document is written, the output is checked by a gate the document did not run, and parties coordinate through surfaces the document only reads.",
                    "boundary": "A collaboration with no tools and no shared tree is a conversation, and a document there is a well-shaped message. The instrument does its work where an adapter can perform what the document names.",
                    "cause": "A well-shaped input reads as a guarantee because the output usually matches it, and the failures live in the runs where it does not.",
                    "decision": "The checks sit outside the document, in a gate the method runs, rather than inside it as sentences the model completes.",
                    "failureMode": "A team writes careful documents, skips the checks because the documents read as complete, and discovers in production that a gate the model reported as passed was never evaluated by anything.",
                    "kind": "lesson",
                    "principle": "For this reason the grammar shapes an input, and the method holds the work around it.",
                    "problem": "A document that reads well invites the belief that it did what it says, and a document cannot verify itself.",
                    "validation": "To check this, take a document that reported every gate as passed and run the checks the method names over its output. A gate the checks contradict was a sentence the model completed, and the document could not have known."
                  },
                  {
                    "kind": "text",
                    "text": "What a document adds to a collaboration is concrete, as listed in [what it adds], and each addition narrows the set of completions without promising what the model will do with them. What a document cannot add is stated under [limits](/pag/validation#limitations); those absences are real, and the methodology page covers them in it looked right, [verify the verifier](/disciplined-methodology/verify#verify-the-verifier) and [a report, not a checkbox](/disciplined-methodology/verify#a-report-not-a-checkbox)."
                  },
                  {
                    "kind": "link",
                    "links": [
                      {
                        "description": "The loop, who does what, the stance, the gates and the coordination the grammar is written inside.",
                        "href": "/disciplined-methodology",
                        "icon": "bi-cpu",
                        "text": "Methodology"
                      },
                      {
                        "description": "The principle canon, the tensions and the decay paths a document's constraints are drawn from.",
                        "href": "/software-architecture",
                        "icon": "bi-bricks",
                        "text": "Architecture"
                      }
                    ]
                  },
                  {
                    "caption": "one input",
                    "kind": "mermaid",
                    "text": "flowchart TB\n    subgraph method[\"The method · holds the work\"]\n        worth[\"Worth before work\"]\n        gates[\"Checks that hold the rules\"]\n        evidence[\"Evidence, never a claim\"]\n        seats[\"Coordination between parties\"]\n    end\n    subgraph grammar[\"The grammar · shapes one input\"]\n        doc[\"A document · typed, contracted, gated, bounded\"]\n    end\n    worth --> doc\n    doc --> gates\n    gates --> evidence\n    seats -. every party reads the same document .-> doc"
                  },
                  {
                    "caption": "what it adds",
                    "kind": "mermaid",
                    "text": "flowchart LR\n    subgraph adds[\"What the grammar adds\"]\n        tokens[\"Tokens the model weights\"]\n        order[\"A processing order\"]\n        exits[\"Explicit exit criteria\"]\n        bounds[\"Boundaries the model can quote\"]\n    end\n    narrow[\"A narrower completion set · never a promise about the completion\"]\n    tokens --> narrow\n    order --> narrow\n    exits --> narrow\n    bounds --> narrow"
                  }
                ],
                "title": "One instrument inside a method"
              }
            ],
            "title": "PAG and the method"
          }
        ]
      },
      {
        "icon": "bi-book",
        "id": "guide",
        "label": "Guide",
        "sections": [
          {
            "icon": "bi-rocket-takeoff",
            "id": "getting-started",
            "intro": "This section covers how a first document is written. The work starts with five questions, answered in the order shown in [five questions], and the answers become the document's parts: the objective, each node's purpose and yield, each node's contract, each gate's result line, and each gate's checks with their evidence. Those parts make up [node shape]. Inside a node, each line follows [directive shape], whose slots are named in [directive slots], and [catalogue and flow] shows what a node declares before it reads. A document written before those answers exist is prose in uppercase.",
            "subsections": [
              {
                "blocks": [
                  {
                    "application": "In practice, the five questions are answered before the first line is written. Each node has its header, its purpose, its contract, its output and one gate carrying evidence, whose result names the next node and a repair owner. Inside a node, each directive is written as an operation, a target, a relation and a destination, with the destination explicit wherever a result has to survive the line. A catalogue is declared before a node reads it, and a transform is named as a function before a node calls it.",
                    "boundary": "A one-line task with one input and one output needs one directive and no node. The structure grows with the work, and a document that carries a gate for a single read is ceremony.",
                    "cause": "The grammar gives every part of a node and every part of a directive a slot, and a slot left empty is a decision the model makes in the author's place.",
                    "decision": "Meaning is resolved by position rather than by wording: every operand gets a slot, rather than a fuller sentence being written around a missing one.",
                    "failureMode": "A node says analyze the data and never says into what, so the result exists in the model's reply and nowhere the next node can read it.",
                    "kind": "lesson",
                    "principle": "For this reason a node and a directive each have a fixed shape, and the shape carries the meaning.",
                    "problem": "A line that leaves an operand out reads complete to its author.",
                    "validation": "To check this, read each node and name what it reads, what it yields and who repairs its failure, then read each directive and name its operation, target, relation, source and destination. A slot with no name is where the model will improvise, and the next node will read nothing."
                  },
                  {
                    "kind": "text",
                    "text": "Meaning is carried by [positional slot resolution](/ontology#arch-positional-slot-resolution): a word is read by the slot it lands in. The yield slot in a node's header types the decision the gate owes. The contract's input slot carries the discipline, because a node reads only the previous node's output, and that is what makes the chain checkable. A line that fills every slot leaves the model one completion and the reviewer one reading."
                  },
                  {
                    "kind": "text",
                    "text": "Declaration comes before use because a node reads data by name, so a transform is a walk over a catalogue rather than prose, and a function reads the same in every node that calls it. Control flow is written out because the model should not have to infer structure from the order in which sentences appear, and iteration always takes the two-word form FOR EACH. Where the recovery from a failure is the document's own repair edge, the gate's result line routes the failure there, rather than the branch improvising a recovery."
                  },
                  {
                    "code": "# a node is the unit · every field is load-bearing, and the gate is what makes it a unit\n# NODE <n> — <NAME>   [<layer> · <axis> · <math type> · yields: <shape>]\n@purpose: \"<what this node decides, in one sentence>\"\n@axis_question: \"<the question its axis asks>\"\n@cue: \"<the one-line reminder a reader executes>\"\n@mandatory                # present on a node of the conative or evaluative layer · it never folds\n\nCONTRACT:\n  input:        <the prior node's output, and nothing else>\n  transform:    <what this node does to it, as a chain of semantic operations>\n  constraints:  <what binds the transform>\n  output:       <the one record the next node reads>\n  handoff:      <the condition that closes it, and the shape its decision yields>\n\n# OUTPUT CONTRACT\nSET <output> = <the transform applied>\n\nHANDOFF GATE (evidence-bearing):\n  rule_id: \"<NAME>\"   yields: <shape>\n  [check]  (evidence: <what settles it>) over: <the set it ranged over> measured: <n> / <N>\n  [check]  (evidence: <what settles it>)\n  [check]  (evidence: <what settles it>)\n  refuse: <the condition that stops it> before <the irreversible write>   # on a node that writes\n  result: pass → NODE <n+1> | <named failure> → REPAIR (owner: <the earliest node that can supply the evidence>) | unknown → BLOCKED",
                    "kind": "code",
                    "language": "pag",
                    "title": "node shape"
                  },
                  {
                    "code": "# inside a node, a directive is an operation, a target, a relation and a destination · every slot filled\nOPERATION <target> PREPOSITION <source> INTO <destination>\n\nREAD_RESOURCE <records> FROM <store> INTO <held>\nEXTRACT_FACTS <field> FROM <held> INTO <values>\nANALYZE_CONTENT <values> AGAINST <pattern> INTO <findings>\nFILTER <values> TO <kept> WHERE <condition>\nCOMPOSE_ARTIFACT <report> FROM <kept> USING <template>\nPERSIST_ARTIFACT <report> TO <destination>",
                    "kind": "code",
                    "language": "pag",
                    "title": "directive shape"
                  },
                  {
                    "code": "# declaration precedes use · a catalogue is data a node reads, a function is a transform it names\nDECLARE <catalogue>: array\nSET <catalogue> = [\n  {id: <member>, asks: \"<the question it answers>\", yields: <shape>},\n  {id: <member>, asks: \"<the question it answers>\", yields: <shape>}\n]\n\nFUNCTION <transform>(<input>):\n  DECLARE <out>: array\n  SET <out> = []\n  FOR EACH <item> IN <input>:\n    ANALYZE_CONTENT <item> AGAINST <catalogue> INTO <fit>\n    IF <fit>.<applies>: APPEND {item: <item>, kind: <fit>.<id>} TO <out>\n  RETURN <out>\n\n# branching ends in a colon, iteration names its collection, failure has a recovery\nIF <condition>:\n    EXECUTE_TOOL <next>\nELSE IF <recoverable>:\n    ATTEMPT <retry>\nELSE:\n    REPORT_RESULT \"<the blocker, named>\"",
                    "kind": "code",
                    "language": "pag",
                    "title": "catalogue and flow"
                  },
                  {
                    "caption": "five questions",
                    "kind": "mermaid",
                    "text": "flowchart TB\n    purpose[\"What is this for? · the objective, one sentence\"]\n    nodes[\"What does each node decide? · its purpose and its yield\"]\n    reads[\"What does each node read? · only the prior node's output\"]\n    fails[\"What can fail, and who repairs it? · the result line\"]\n    done[\"How will I know a node closed? · its gate, with evidence\"]\n    write[\"Then write the document\"]\n    purpose --> nodes --> reads --> fails --> done --> write"
                  },
                  {
                    "caption": "directive slots",
                    "kind": "mermaid",
                    "text": "flowchart LR\n    op[\"OPERATION · what happens\"]\n    target[\"target · what it happens to\"]\n    prep[\"PREPOSITION · the relation\"]\n    source[\"source · where it comes from\"]\n    into[\"INTO destination · where the result lands\"]\n    op --> target --> prep --> source --> into"
                  }
                ],
                "title": "Five questions, then the slots"
              }
            ],
            "title": "Writing a first document"
          },
          {
            "icon": "bi-file-earmark-code",
            "id": "document-structure",
            "intro": "A document says what kind of instruction it is before it gives any instruction, which is the orient stage of [the loop](/disciplined-methodology#the-loop) written down: what exists is declared before anything is done with it. That makes a document a [self-describing structure](/ontology#arch-self-describing-structures), laid out as shown in [skeleton] and ordered as shown in [parts in order]. A document that opens with a directive has left its own contract unstated. The type it declares is one of those listed in [the types], and [what a type fixes] shows what that one line settles before any node is walked.",
            "subsections": [
              {
                "blocks": [
                  {
                    "application": "In practice, a document runs in this order: the header, the declaration, the meta block and the frame the nodes cite, and it closes with the repair edge and the invariants.",
                    "boundary": "A fragment reused inside other documents carries no header of its own, because the enclosing document already declared the contract. A fragment that declares a second type is two documents.",
                    "cause": "A reader classifies a document from its first lines and reads everything after against that guess.",
                    "decision": "The contract is fixed on the first line with a type, rather than left for the reader to infer from the directives below.",
                    "failureMode": "A reader cannot tell whether a document is a standing policy or a one-time task, walks a policy once and then drops it, and the rules it carried end up applying to nothing.",
                    "kind": "lesson",
                    "principle": "For this reason the type comes first, and everything after it is read against that type.",
                    "problem": "A document with no declared type has an unstated contract, so each reader, the developer or the model, supplies its own.",
                    "validation": "To check this, cover everything below the declaration and ask what the document is for, what will walk it and how it will be used. A declaration that cannot answer all three is missing a type or an intent."
                  },
                  {
                    "kind": "text",
                    "text": "The meta block settles four things before any node runs. The priority between sources decides a disagreement before it arises. The trust anchor ensures that a claim from an untrusted source is never promoted to evidence just by being read. The jurisdiction states what the document may touch and what it declares outside itself, rather than leaving that assumed; it is the same boundary [the honest gaps](/disciplined-methodology/ship#the-honest-gaps) draws for a system. The recursion limit makes a repair loop terminate. Choosing the type chooses the contract, the reasoning model and the axis at once, and the verb makes that choice legible on the first line."
                  },
                  {
                    "kind": "text",
                    "text": "The substrate and the spine are declared once and cited by every node. The substrate orders the nodes, as described in [node design](/pag/guide#node-design), and each node names its stage on it. The spine declares every transition: which node leads to which, where a failed [verification](/ontology#arch-verification) sends the work back, and where the loop terminates. A node names its place on both and inherits the rest, which is why a document reads as one structure rather than ten separate documents. The document closes with its invariant records and a report, which states the verdict in a form a later checker can challenge, as described in [a report, not a checkbox](/disciplined-methodology/verify#a-report-not-a-checkbox)."
                  },
                  {
                    "code": "---\nname: <document-name>\ntype: WORKFLOW\nversion: 1.0.0\n---\n\nTHIS WORKFLOW EXECUTES <what it is for>\n\n%% META %%:\n    priority: <what outranks what when two sources disagree>\n    trust: <what is trusted> = TRUSTED, <what is not> = UNTRUSTED\n    objective: \"<what finished looks like, checkable>\"\n    jurisdiction: <what the document may touch> | external: <what it declares outside itself>\n    recursion_limit: \n\n# THE FOUR LAYERS · each answers one question about this document\n#   substrate  — how does the artifact come to be        grounds the order of the nodes, named on each by @genesis\n#   epistemic  — how is it known                          orient · see · derive · project · act\n#   conative   — what is worth doing                      intent · constrain            mandatory, always\n#   evaluative — is it right, and are we done             verify · commit · terminate   mandatory, always\n\n# YIELDS-SHAPE LEGEND · every decision resolves to a typed shape\n#   set-theory → set|boolean · logic → boolean · graph → edge-list · optimisation → boolean|ranking · computation → procedure\n\n# SEMANTIC OPERATION BOUNDARY · nodes say WHAT as operations; an adapter decides HOW, and the core names no tool or path\n\n# THE LOOP SPINE · transitions declared once, every node cites it\n# node · layer · axis · yields · transition out\n\n# NODE 1 — ORIENT … NODE 10 — TERMINATE · each with its four-slot tag, its genesis stage, its contract and one evidence-bearing gate\n\n# REPAIR EDGE · verify refutes back to the earliest invalid node, bounded by recursion_limit\n\n# CROSS-NODE INVARIANTS\nINVARIANT <name>:  over: <the set it ranges over> binds: <the parties it constrains> objector: <the check that would disagree | none>\n\nREPORT:\n  subject: <the terminal node>\n  verdict: pass | fail | unknown\n  domain: declared <N> measured <n>\n  completion: saturated <bool> complete <bool> verified <bool>",
                    "kind": "code",
                    "language": "pag",
                    "title": "skeleton"
                  },
                  {
                    "code": "# a type binds a document to a reasoning model and to the axis of the loop it sits on\n\n# cognition · how a system perceives, acts and adapts\nTHIS AGENT PERFORMS                 axis: reasoning\nTHIS WORKFLOW EXECUTES                     axis: formalisation\nTHIS PROMPT IS <one interaction>                                 axis: formalisation\nTHIS COMMAND EXECUTES <one invocable operation>                  axis: formalisation\n\n# pattern-cycle · how pattern-work proceeds\nTHIS PROTOCOL DEFINES            axis: formalisation\nTHIS CHECKLIST PROVIDES <tasks with their contracts>             axis: formalisation\nTHIS TASK EXECUTES <one objective>                               axis: formalisation\nTHIS INSTRUCTION IS <general guidance>                           axis: formalisation\nTHIS COMPOSITION RENDERS  axis: formalisation\nTHIS POLICY ENFORCES                           axis: teleology\nTHIS TEMPLATE IMPLEMENTS           axis: representation\n\n# epistemology · how a pattern is known\nTHIS TEST PERFORMS        axis: verification\nTHIS VERIFICATION PERFORMS <claims adjudicated against evidence> axis: verification\nTHIS AUDIT AUDITS <an artifact against a contract, then corrects> axis: verification\nTHIS DEBUG RESOLVES       axis: analysis\nTHIS DISTILLATION DISTILLS <repeated behaviour into one base>    axis: reasoning\nTHIS TRANSLATION AUDITS          axis: representation",
                    "kind": "code",
                    "language": "pag",
                    "title": "the types"
                  },
                  {
                    "caption": "parts in order",
                    "kind": "mermaid",
                    "text": "flowchart TB\n    front[\"Header block · name, type, version\"]\n    decl[\"Declaration · THIS TYPE VERB description\"]\n    meta[\"META · priority, trust, objective, bounds\"]\n    frame[\"The four layers, the shape legend, the operation boundary\"]\n    substrate[\"The substrate · how the artifact comes to be\"]\n    spine[\"The spine · transitions declared once\"]\n    nodes[\"Nodes · each with a contract and one gate\"]\n    repair[\"The repair edge · bounded\"]\n    rules[\"Cross-node invariants · one record each\"]\n    report[\"The report · what was measured, over what, and whether the three conditions coincide\"]\n    front --> decl --> meta --> frame --> substrate --> spine --> nodes --> repair --> rules --> report"
                  },
                  {
                    "caption": "what a type fixes",
                    "kind": "mermaid",
                    "text": "flowchart LR\n    type[\"The declared type\"]\n    verb[\"Its default verb\"]\n    model[\"The reasoning model that walks it\"]\n    axis[\"The axis of the loop it sits on\"]\n    reader[\"A reader knows what kind of instruction this is, and what will walk it\"]\n    type --> verb --> reader\n    type --> model --> reader\n    type --> axis --> reader"
                  }
                ],
                "title": "Declare, then instruct"
              }
            ],
            "title": "Document structure"
          },
          {
            "icon": "bi-tools",
            "id": "tool-invocation",
            "intro": "Every external effect in a document is a named semantic operation, with explicit parameters and an explicit binding for its result; [invocation parts] names those parts, and [invocation forms] writes them four ways. The operation says what happens, and [the operations] groups the operations by the kind of effect. An adapter outside the document, one per harness, decides how the effect is carried out, which is the split shown in [document and adapter] and [one adapter per harness]. An invocation is the act stage of [the loop](/disciplined-methodology#the-loop), and it yields a procedure.",
            "subsections": [
              {
                "blocks": [
                  {
                    "application": "In practice, every effect is named with a semantic operation and given a target, its parameters are passed through a named clause, and its result is bound to a name the next line can read. A location or a command is referred to through a slot the adapter resolves, never through a literal path, and the harness's own tool names, configuration files and features stay out of the document.",
                    "boundary": "A document written for exactly one throwaway session may name whatever it likes, because nothing will port it. The discipline is for a document that will be walked again, by another party, or under another harness.",
                    "cause": "A tool name is a fact about one harness, and a document that carries it is bound to that harness by the first line that does.",
                    "decision": "The document is separated from the harness at the operation, with one adapter per harness, rather than one document being written per harness.",
                    "failureMode": "A library of documents names one harness's tools throughout, the harness changes its tool set, and every document breaks at once, which is [vendor lock-in leakage](/ontology#arch-vendor-lock-in-leakage) with nothing in any document to explain it.",
                    "kind": "lesson",
                    "principle": "For this reason a document names semantic operations, and one adapter resolves them to tools by [late binding](/ontology#arch-late-binding).",
                    "problem": "An effect described in prose is not addressable by any adapter, and an effect named by one harness's tool is [hardcoded configuration](/ontology#arch-hardcoded-configuration) that only that harness can address.",
                    "validation": "To check this, rename the harness under the document and hand it to a different model. Where a line fails, it carried a tool name or a path where an operation or a slot belonged, and the fix belongs in the adapter."
                  },
                  {
                    "kind": "text",
                    "text": "The operations fall into three groups by the kind of effect: those that act on a tree and produce values, those that leave an artifact in it, and those that reach outside it or address another party. Each operation carries a [semantic contract](/ontology#arch-semantic-contracts), so a document relies on the contract rather than on what a particular tool happens to do."
                  },
                  {
                    "kind": "text",
                    "text": "[Portability](/ontology#arch-portability) follows from this boundary. Operations and slots in the document are [configuration externalization](/ontology#arch-configuration-externalization) applied to an instruction, and one adapter per harness is the [adapter pattern](/ontology#arch-adapter-pattern). A slot with no counterpart in a harness resolves as absent, as described under [limits](/pag/validation#limitations). A decision request is the clearest case: a participant has a question surface and a bounded reader does not, so the same operation resolves for one and is absent for the other, while the document stays unchanged. The model a document runs under is always a slot, because choosing the model belongs to the harness."
                  },
                  {
                    "code": "# SEMANTIC OPERATION BOUNDARY · a node states WHAT as an operation; an adapter decides HOW\n\n# discover, read, search, analyze · operations against a tree that produce values\nDISCOVER_RESOURCES \"<pattern>\" INTO <resources>\nREAD_RESOURCE <resource> INTO <content>\nSEARCH_CONTENT <content> FOR <term> INTO <matches>\nANALYZE_CONTENT <content> AGAINST <criteria> INTO <findings>\nEXTRACT_FACTS <fields> FROM <content> INTO <facts>\nCALCULATE_METRIC <measure> FROM <facts> INTO <value>\n\n# compose, validate, persist · operations that leave an artifact\nCOMPOSE_ARTIFACT <artifact> FROM <facts> USING <shape>\nVALIDATE_ARTIFACT <artifact> AGAINST <schema>\nPERSIST_ARTIFACT <artifact> TO <destination>\n\n# execute, decide, report · effects outside the tree and on other parties\nEXECUTE_TOOL <command> WITH timeout: <bound> INTO <result>\nREQUEST_DECISION <party> WITH options: [, **] INTO ****<choice>****\nREPORT_RESULT ****<artifact>**** TO ****<the parties whose next work it creates>**",
                    "kind": "code",
                    "language": "pag",
                    "title": "the operations"
                  },
                  {
                    "code": "# the document names an operation and a slot · one adapter per harness resolves both, outside the document\nREAD_RESOURCE {project.governance_policy} INTO <policy>\nEXECUTE_TOOL {toolchain.verify_command} INTO <verdict>\n\nadapter:\n    DISCOVER_RESOURCES → <the harness's discovery tool>\n    READ_RESOURCE      → <the harness's read tool>\n    SEARCH_CONTENT     → <the harness's search tool>\n    EXECUTE_TOOL       → <the harness's shell>\n    PERSIST_ARTIFACT   → <the harness's write tool>\n    REQUEST_DECISION   → <the harness's question surface, or ABSENT for a bounded reader>\n    {project.governance_policy} → <the path in this tree>\n    {toolchain.verify_command}  → <the command in this tree, or ABSENT>",
                    "kind": "code",
                    "language": "pag",
                    "title": "document and adapter"
                  },
                  {
                    "code": "READ_RESOURCE <resource>                                 # the operation and its target\nREAD_RESOURCE <resource> INTO <parsed>                   # bound to a name the next line reads\nSEARCH_CONTENT <scope> FOR <term> WITH glob: \"*.md\"      # named parameters\nEXECUTE_TOOL <command> → <result>                       # the arrow is the same binding",
                    "kind": "code",
                    "language": "pag",
                    "title": "invocation forms"
                  },
                  {
                    "caption": "one adapter per harness",
                    "kind": "mermaid",
                    "text": "flowchart TB\n    doc[\"The document · semantic operations and {slots}\"]\n    adapter[\"One adapter per harness\"]\n    harnessA[\"Harness A · its read tool, its shell, its question surface\"]\n    harnessB[\"Harness B · different tools, same document\"]\n    absent[\"A slot with no analogue · declared ABSENT, the branch does not run\"]\n    doc --> adapter\n    adapter --> harnessA\n    adapter --> harnessB\n    adapter -. no analogue .-> absent"
                  },
                  {
                    "caption": "invocation parts",
                    "kind": "mermaid",
                    "text": "flowchart LR\n    op[\"Operation · what happens\"]\n    target[\"Target · what it acts on\"]\n    params[\"WITH · named parameters\"]\n    result[\"INTO or arrow · where the result lands\"]\n    addressable[\"An effect the adapter can perform and the next line can read\"]\n    op --> target --> params --> result --> addressable"
                  }
                ],
                "title": "Operations, not tools"
              }
            ],
            "title": "Semantic operations"
          },
          {
            "icon": "bi-layers",
            "id": "node-design",
            "intro": "A node is one bounded [unit of work](/ontology#arch-unit-of-work-pattern) with one decision, a declared input, a declared output and a gate at its end; [three granularities] shows this bounded form beside the two forms that fail. Data moves between nodes by name. A value is declared before its first use, its scope reaches every later node, and no node reads an output that a later node produces, which is the flow written out in [contracts in order] and shown in [forward flow]. Dividing work into nodes is the project stage of [the loop](/disciplined-methodology#the-loop). It yields the edges between units, and the order of the nodes follows how the artifact comes to be, as listed in [verb to stage], rather than a count chosen in advance. [split or combine] shows where a boundary belongs.",
            "subsections": [
              {
                "blocks": [
                  {
                    "application": "In practice, each node has one decision and ends with the gate that shows the decision was made. A node is split at a repair point, a persistence, a decision, or a condition the next node needs, and steps that succeed or fail together are combined. The nodes are ordered by dependency and by genesis, and every contract names the one prior output it reads and the one output it yields.",
                    "boundary": "A document with one decision has one node, and a gate at the end of it is still worth writing.",
                    "cause": "A gate can only check what a node produced, so a node that produces several unrelated things has a gate that checks a list rather than a unit.",
                    "decision": "The boundaries decide the number of nodes, rather than a number deciding the boundaries.",
                    "failureMode": "A node halfway through a long document fails, neither you nor the model can say which earlier output it needed, and the repair restarts from the top because no boundary was a real checkpoint.",
                    "kind": "lesson",
                    "principle": "For this reason the data flow from one node to the next is a contract, and the order of the nodes follows the genesis of the artifact.",
                    "problem": "Directives poured into one flat block have no repair point and no place a gate can hold.",
                    "validation": "To check this, read each contract's input slot and name the earlier node that yields it. A node whose input names nothing from its predecessor is in the wrong place, an input that no node produces is a forward reference, and a node that builds before its input is found is a genesis inversion."
                  },
                  {
                    "kind": "text",
                    "text": "Granularity can fail in two directions, and both look tidy. If the nodes are too fine, each gate only checks that one line ran. If they are too coarse, the only gate is at the end, where it can no longer say which step failed. The bounded form has [high cohesion](/ontology#arch-high-cohesion) inside a node and [low coupling](/ontology#arch-low-coupling) across the boundary, so the boundary is a repair point and the result line can name its owner."
                  },
                  {
                    "kind": "text",
                    "text": "Node order follows the genesis of the artifact, which is what makes it derivable rather than chosen. A node never depends on an output from a later stage than the one it realises, because a thing cannot be built before it is found, or checked before it is built. The same rule makes a document orderable as a [directed acyclic graph](/ontology#arch-directed-acyclic-graph), in which a genesis inversion and a forward reference are one defect seen from two sides."
                  },
                  {
                    "code": "# too fine · a node per directive, a gate that checks one line ran\n# NODE 1 — READ\n    READ_RESOURCE <config> INTO <held>\n# NODE 2 — PICK\n    SET <name> = <held>.<field>\n\n# too coarse · one node, no recovery point, no gate until the end\n# NODE 1 — EVERYTHING\n    READ_RESOURCE <config> INTO <held>\n    READ_RESOURCE <records> INTO <rows>\n    FOR EACH <row> IN <rows>:\n        COMPOSE_ARTIFACT <shaped> FROM <row> USING <held>.<rules>\n        PERSIST_ARTIFACT <shaped> TO <output>\n\n# bounded · one decision per node, a gate at each boundary\n# NODE 1 — CONFIGURATION   [epistemic · analysis · set-theory · yields: set]\nCONTRACT:\n  input:   <the declaration's objective>\n  output:  <config>, validated\nHANDOFF GATE:\n  [check] <config> read (evidence: the read returned content)\n  [check] <config> conforms (evidence: VALIDATE_ARTIFACT against <schema> passed)\n  [check] <config>.<rules> is non-empty (evidence: a count above zero)\n  result: pass → NODE 2 | nonconforming → REPAIR (owner: NODE 1) | unknown → BLOCKED\n\n# NODE 2 — TRANSFORMATION  [epistemic · formalisation · computation · yields: procedure]\nCONTRACT:\n  input:   <config> from NODE 1, and nothing else\n  output:  <shaped-records>\nHANDOFF GATE:\n  [check] one entry per <record> (evidence: the two counts match) over: <records> measured: <shaped> / <records>\n  [check] every entry conforms to <config>.<rules> (evidence: VALIDATE_ARTIFACT passed on each)\n  [check] <records> unchanged (evidence: a witness read after the transform)\n  result: pass → NODE 3 | count mismatch → REPAIR (owner: NODE 2) | unknown → BLOCKED",
                    "kind": "code",
                    "language": "pag",
                    "title": "three granularities"
                  },
                  {
                    "code": "# NODE 1 — DISCOVERY   [epistemic · analysis · set-theory · yields: set]\n@genesis: existence\nCONTRACT:\n  input:     <the objective's pattern>\n  transform: DISCOVER_RESOURCES \"<pattern>\" INTO <files>\n  output:    <files>\nHANDOFF GATE:\n  [check] <files> is non-empty (evidence: a count above zero)\n  [check] every <file> matches <pattern> (evidence: the discovery's own filter) over: <files> measured: <matching> / <files>\n  [check] no <file> lies outside <root> (evidence: every path prefixed by <root>)\n  result: pass → NODE 2 | empty set → REPAIR (owner: NODE 1) | unknown → BLOCKED\n\n# NODE 2 — ANALYSIS     [epistemic · reasoning · logic · yields: boolean]\n@genesis: difference\nCONTRACT:\n  input:     <files> from NODE 1\n  transform: FOR EACH <file> IN <files>: READ_RESOURCE <file> INTO <content>; ANALYZE_CONTENT <content> AGAINST <pattern> INTO <finding>; APPEND <finding> TO <findings>\n  output:    <findings>\nHANDOFF GATE:\n  [check] every <file> read (evidence: one content per file) over: <files> measured: <read> / <files>\n  [check] one <finding> per <file> (evidence: the two counts match)\n  [check] every <finding> names its <file> (evidence: no finding with an empty source)\n  result: pass → NODE 3 | unread file → REPAIR (owner: NODE 2) | unknown → BLOCKED\n\n# NODE 3 — REPORTING    [evaluative · representation · information-theory · yields: artifact]\n@genesis: structure\nCONTRACT:\n  input:     <findings> from NODE 2 · never anything a later node produces\n  transform: COMPOSE_ARTIFACT <report> FROM <findings> USING <shape>; PERSIST_ARTIFACT <report> TO <destination>\n  output:    <report>\n  freshness: fingerprint(<findings>) + fingerprint(this document)\nHANDOFF GATE:\n  [check] <report> names every entry in <findings> (evidence: each finding's id present) over: <findings> measured: <named> / <findings>\n  [check] <report> persisted (evidence: a read of <destination> returns it)\n  [check] <findings> unchanged since NODE 2 (evidence: a witness read)\n  refuse: <destination> changed since it was read before PERSIST_ARTIFACT\n  result: pass → TERMINATE | missing entry → REPAIR (owner: NODE 3) | unknown → BLOCKED",
                    "kind": "code",
                    "language": "pag",
                    "title": "contracts in order"
                  },
                  {
                    "code": "# a verb realises one stage of how an artifact comes to be\n# and a node never depends on a later stage than the one it realises\nREAD, FIND        → existence       does it exist, is it found\nANALYZE, FILTER   → difference      what distinguishes it\nEXTRACT, LINK     → relation        what it connects to\nCREATE, WRITE     → structure       how its parts are arranged\nEXECUTE, ITERATE  → transformation  what operation it performs\nVERIFY            → constraint      what bounds it\n\n# a genesis inversion · a decomposition defect, not a tie to break\n# NODE 1 — BUILD    COMPOSE_ARTIFACT <base> FROM <signatures>      structure\n# NODE 2 — FIND     DISCOVER_RESOURCES <signatures> INTO <found>   existence · needed by NODE 1",
                    "kind": "code",
                    "language": "pag",
                    "title": "verb to stage"
                  },
                  {
                    "caption": "split or combine",
                    "kind": "mermaid",
                    "text": "flowchart TB\n    split{\"Split here?\"}\n    output[\"The next node needs this node's output\"]\n    retry[\"This part is repaired on its own\"]\n    human[\"The developer decides before it continues\"]\n    persist[\"The result is persisted before it continues\"]\n    verify[\"A condition must hold before the next node\"]\n    combine{\"Combine here?\"}\n    atomic[\"The steps succeed or fail together\"]\n    partial[\"A partial result has no value\"]\n    shared[\"The steps share values that must not outlive them\"]\n    coupled[\"Separating adds noise, not clarity\"]\n    split --> output\n    split --> retry\n    split --> human\n    split --> persist\n    split --> verify\n    combine --> atomic\n    combine --> partial\n    combine --> shared\n    combine --> coupled"
                  },
                  {
                    "caption": "forward flow",
                    "kind": "mermaid",
                    "text": "flowchart LR\n    n1[\"Node 1 · existence · yields files\"]\n    n2[\"Node 2 · difference · reads files, yields findings\"]\n    n3[\"Node 3 · structure · reads findings\"]\n    n1 -- gate --> n2 -- gate --> n3\n    n3 -. never a forward reference, never an earlier genesis .-> n1"
                  }
                ],
                "title": "Boundaries, data flow, genesis"
              }
            ],
            "title": "Node design"
          },
          {
            "icon": "bi-pencil-square",
            "id": "writing-constraints",
            "intro": "A constraint states a boundary in a form the model can quote back and a reviewer can check against a line. It has four parts: a property that could be false, the set it ranges over, the parties it binds, and the objector that would disagree if it stopped holding; [four slots] shows these parts, and [invariant records] fills them in. A rule that holds everywhere names every node as its set, and a rule that holds inside a context names that context. The invariant block is the constrain stage of [the loop](/disciplined-methodology#the-loop). It decides what is admissible and yields a boolean over the work rather than an opinion about it, and it closes the document, as shown in [worked document]. A rule written as encouragement is judged rather than checked, as traced in [exhortation or record]. A rule written as a bullet under a heading carries no set and no objector, so nothing can say when it was broken, and [exhortation rewritten] shows the repair.",
            "subsections": [
              {
                "blocks": [
                  {
                    "application": "In practice, each constraint is stated as an invariant record: a name, a property with a verb and its operand, the set it ranges over, the parties it binds, and the objector, which is either a gate check or none. A rule that holds only in a context is scoped by naming the context in its set, rather than by nesting a block. Each record is written so that a reviewer can point at a directive and say it broke this one, and the block sits after the last node.",
                    "boundary": "A constraint the model cannot observe from inside the document, such as a rule about its own confidence, cannot be checked by anything and belongs under [limits](/pag/validation#limitations) rather than in an invariant record.",
                    "cause": "A model completes an exhortation with whatever careful looks like in its training, and a specific prohibition with the thing it names; a record with a named objector is the only form in which a reviewer and a check read the same rule.",
                    "decision": "The reach of a broad exhortation is traded for the checkability of a narrow record, with one violating directive per rule and one objector per record.",
                    "failureMode": "A document says handle errors properly, the model wraps some operations and not others, and the reviewer cannot say the rule was broken because the rule never said what handling was.",
                    "kind": "lesson",
                    "principle": "For this reason a behavioural boundary is written as a checkable record with its objector, not as guidance.",
                    "problem": "A rule stated as an exhortation binds nothing, because neither you nor a check can say when it was broken.",
                    "validation": "To check this, write for each constraint the one directive that would violate it, and name the check that would notice. A constraint with no violating directive is an exhortation, and one with no objector is declared debt, which the record states with none."
                  },
                  {
                    "kind": "text",
                    "text": "Scope is what keeps a constraint set small: a rule that holds everywhere is stated once, with every node as its set, and a rule that holds somewhere names where. The rewrite from exhortation to record is the same move every time. The operation and the operand are named, the adverb is dropped, and the objector is stated. Writing rules this way is [policy as code](/ontology#arch-policy-as-code), and it lets a gate's check cite an invariant by name rather than restating it, as described in [orchestration invariants](/pag/orchestration#orchestration-invariants)."
                  },
                  {
                    "kind": "text",
                    "text": "Invariants close a document rather than open it, because they are read against the work they bind. A recovery block sits near the top, because recovery is a mechanism rather than a rule."
                  },
                  {
                    "code": "# CROSS-NODE INVARIANTS · hold for every node, read after the nodes they bind · each a record with four slots\nINVARIANT read-before-write: a surface is read whole before anything is persisted to it over: every persisting node binds: the reader objector: [check] a witness read precedes PERSIST_ARTIFACT\nINVARIANT validate-at-boundary: an input is validated at every node boundary over: every node binds: the reader objector: [check] VALIDATE_ARTIFACT ran on the input at the gate\nINVARIANT prior-output-only: a node reads only the prior node's output over: every node binds: the reader objector: [check] input names NODE n-1 or a slot\nINVARIANT no-silent-blocker: a blocker stops the run until a decision is requested over: every node binds: the reader objector: [check] result routes unknown to BLOCKED\nINVARIANT source-untouched: <source> is never modified in place over: <source> binds: the reader objector: none\n\n# scoped · a property that holds only inside a named context is stated with that context in its set\nINVARIANT encrypt-sensitive: every sensitive field is encrypted before it leaves the node over: nodes handling <sensitive-data> binds: the reader objector: [check] no plain-text field in the persisted artifact\nINVARIANT audit-access: every access to <sensitive-data> is recorded over: nodes handling <sensitive-data> binds: the reader objector: [check] one audit entry per access\nINVARIANT bounded-retention: <data> is not retained past <retention-period> over: persisted <data> binds: the reader objector: none",
                    "kind": "code",
                    "language": "pag",
                    "title": "invariant records"
                  },
                  {
                    "code": "# a rule the model can quote back · and a reviewer can check against a line\nALWAYS handle errors properly\nINVARIANT wrapped-io: every <file-operation> runs inside TRY/CATCH over: file operations binds: the reader objector: [check] no bare file operation in the transform\n\nNEVER do bad things\nINVARIANT inside-the-root: nothing is persisted outside <workspace-root> over: every PERSIST_ARTIFACT binds: the reader objector: [check] every destination under the root\n\nALWAYS be careful with data\nINVARIANT validated-first: <data> is validated against <schema> before it is processed over: every node reading <data> binds: the reader objector: [check] VALIDATE_ARTIFACT precedes the first use\n\nNEVER modify anything\nINVARIANT read-only-zone: no file in <read-only-zone> is modified over: <read-only-zone> binds: the reader objector: [check] a witness read of the zone after the run",
                    "kind": "code",
                    "language": "pag",
                    "title": "exhortation rewritten"
                  },
                  {
                    "code": "---\nname: <processor-name>\ntype: WORKFLOW\nversion: 1.0.0\n---\n\nTHIS WORKFLOW EXECUTES validation and transformation of <records>\n\n%% META %%:\n    objective: \"An <output> whose entry count matches the conforming input\"\n    jurisdiction: <source> and <output> | external: every other file\n    recursion_limit: 2\n\nON ERROR <write-failed>:\nTRY:\n    RENAME <file> TO <file>.bak\n    PERSIST_ARTIFACT <content> TO <file>\n    DELETE <file>.bak\nCATCH:\n    RENAME <file>.bak TO <file>\n\n# NODE 1 — INPUT VALIDATION   [epistemic · analysis · logic · yields: boolean]\n@genesis: existence\nCONTRACT:\n  input:     <source>\n  transform: READ_RESOURCE <source> INTO <input>; FOR EACH <row> IN <input>.<rows>: VALIDATE_ARTIFACT <row> AGAINST <schema>; IF <row>.<conforms>: APPEND <row> TO <valid> ELSE: REPORT_RESULT \"<which row, which field>\"\n  output:    <valid>\nHANDOFF GATE:\n  [check] <input> read (evidence: the read returned rows)\n  [check] every <row> validated (evidence: one verdict per row) over: <input>.<rows> measured: <validated> / <rows>\n  [check] every non-conforming <row> reported with its field (evidence: the report names a field per rejection)\n  result: pass → NODE 2 | unread → REPAIR (owner: NODE 1) | unknown → BLOCKED\n\n# NODE 2 — TRANSFORMATION     [epistemic · formalisation · computation · yields: procedure]\n@genesis: transformation\nCONTRACT:\n  input:     <valid> from NODE 1\n  transform: FOR EACH <row> IN <valid>: COMPOSE_ARTIFACT <entry> FROM <row> USING <mapping>; APPEND <entry> TO <shaped>\n  preserves: the source row of every entry\n  output:    <shaped>\nHANDOFF GATE:\n  [check] one <entry> per <row> in <valid> (evidence: the two counts match) over: <valid> measured: <shaped> / <rows>\n  [check] every <entry> conforms to <mapping> (evidence: VALIDATE_ARTIFACT passed on each)\n  [check] <valid> unchanged (evidence: a witness read after the transform)\n  result: pass → NODE 3 | mismatch → REPAIR (owner: NODE 2) | unknown → BLOCKED\n\n# NODE 3 — OUTPUT             [evaluative · representation · information-theory · yields: artifact]\n@genesis: emergence\nCONTRACT:\n  input:     <shaped> from NODE 2\n  transform: PERSIST_ARTIFACT <shaped> TO <output>\n  output:    <output>\n  freshness: fingerprint(<shaped>) + fingerprint(this document)\nHANDOFF GATE:\n  [check] <output> persisted (evidence: a read of <output> returns it)\n  [check] entry count of <output> matches <shaped> (evidence: the two counts match) over: <shaped> measured: <persisted> / <entries>\n  [check] <source> unchanged (evidence: a witness read)\n  refuse: <output> changed since it was read before PERSIST_ARTIFACT\n  result: pass → TERMINATE | loss → REPAIR (owner: NODE 3) | unknown → BLOCKED\n\n# CROSS-NODE INVARIANTS\nINVARIANT validate-before-transform: every row is validated before any transform reads it over: every node binds: the reader objector: [check] every <row> validated at NODE 1\nINVARIANT reject-with-field: a rejected <row> is reported with its field over: rejected rows binds: the reader objector: [check] the report names a field per rejection at NODE 1\nINVARIANT source-untouched: <source> is never modified over: <source> binds: the reader objector: [check] <source> unchanged at NODE 3\nINVARIANT non-empty-input: the run does not proceed with zero conforming rows over: every run binds: the reader objector: [check] every <row> validated at NODE 1 over a non-empty set\n\nREPORT:\n  subject: NODE 3\n  verdict: pass | fail | unknown\n  domain: declared <rows> measured <validated>\n  populations: conforming <n>, rejected <n>, persisted <n>\n  completion: saturated <bool> complete <bool> verified <bool>",
                    "kind": "code",
                    "language": "pag",
                    "title": "worked document"
                  },
                  {
                    "caption": "exhortation or record",
                    "kind": "mermaid",
                    "text": "flowchart TB\n    rule[\"A rule\"]\n    exhort[\"An exhortation · be careful, handle properly\"]\n    judged[\"Judged by the model, differently each run\"]\n    specific[\"A record · property, set, parties, objector\"]\n    checkable[\"Checked by the objector, or declared unwatched\"]\n    quoted[\"Quoted back by the model when it applies\"]\n    rule --> exhort --> judged\n    rule --> specific --> checkable\n    specific --> quoted"
                  },
                  {
                    "caption": "four slots",
                    "kind": "mermaid",
                    "text": "flowchart LR\n    property[\"The property · could be false\"]\n    set[\"over · the set it ranges over, the whole document or one context\"]\n    parties[\"binds · who must receive it\"]\n    objector[\"objector · what would disagree, or none\"]\n    property --> set --> parties --> objector"
                  }
                ],
                "title": "Rules the model can quote"
              }
            ],
            "title": "Writing constraints"
          },
          {
            "icon": "bi-clipboard-check",
            "id": "well-formedness",
            "intro": "This section covers the [static analysis](/ontology#arch-static-analysis) that decides whether a document can be trusted; [two routes to trust] contrasts it with trusting a document because it reads fluently, and [the scan] shows the scan. Each defect is named for the shape it catches and has one fix, as paired in [defect set] and reported in [scan result]. The syntactic defects are a missing declaration, a bare iteration, a lowercase [keyword](/pag/keywords#keyword-ontology), a conditional with no colon, a malformed node tag, and a node declared twice. The epistemic defects are a node with no gate, a gate with fewer than three or more than five checks, a check that is a judgement, a check with no evidence, a gate with no population or an empty one, and an unknown left unrouted. The remaining defects are a write with no refusal, an artifact with no freshness, an input that names no source, an invariant missing its set, its parties or its objector, and a bare invariant block. The scan is the terminate stage applied to the document itself: it yields one boolean, and because it reads tokens rather than patterns, its verdict has [repeatability](/ontology#arch-repeatability).",
            "subsections": [
              {
                "blocks": [
                  {
                    "application": "In practice, a document is scanned for the defect set before it is walked and after every edit. Each defect is reported with its location, what was found, what was expected and the one fix, so a reader repairs the line rather than re-reading the whole document. A document is trusted only when the defect set is empty, and a fluent document that fails the scan counts as ill-formed, however well it reads.",
                    "boundary": "Well-formedness is structure, not meaning. A document can pass every scan and still ask for the wrong thing, and that is what the gates, the review and the method exist to catch.",
                    "cause": "Fluency is a property of prose, and the defects that break a document are properties of tokens the prose reader does not see.",
                    "decision": "The tokens are scanned rather than matched against a pattern or read for fluency, because only a token scan reports a location a reader can go to.",
                    "failureMode": "A document reads well, but a bare iteration completes as a count, the node produces one result instead of many, and the gate that would have caught it was never written.",
                    "kind": "lesson",
                    "principle": "For this reason a document is trusted after a deterministic scan, not because it reads well.",
                    "problem": "A document that reads well is walked as if it had been checked.",
                    "validation": "To check this, plant one defect from the set in a passing document and scan it. A scan that stays green cannot catch that class of defect, and a scan that reports it at the wrong location is matching a pattern rather than reading tokens."
                  },
                  {
                    "kind": "text",
                    "text": "The defect set is the grammar's taxonomy of failures, and it is derived rather than collected. Each epistemic defect is one of the ways a representation escapes its check, which the methodology page names from the other side in [the honest gaps](/disciplined-methodology/ship#the-honest-gaps) and [coverage is derived](/disciplined-methodology/verify#coverage-is-derived). A check with no population is the gate that passed over nothing, and an unknown left unrouted is the verdict that folded a third value into pass. A write with no refusal is an irreversible act with nothing to stop it, an input that names no source is a dependency inferred from a name, and an invariant with no objector is a property nothing would disagree with. Each defect has one repair, which is what lets a scanner state it. The scan works on tokens and uses no pattern language; that is a fact about the scanner rather than the grammar, whose conditions may still carry a pattern literal."
                  },
                  {
                    "kind": "text",
                    "text": "Three defects that the scan does not catch show up as gate failures instead, as shown in [gate failures], and all three are found by tracing a value from the node that yields it to the node that reads it. One of them, a contract whose input names a later node's output, is repaired in the decomposition rather than in the line, because the node is in the wrong place."
                  },
                  {
                    "code": "# no declaration · a document with no stated kind\n%% META %%:\nTHIS WORKFLOW EXECUTES <what it is for>\n\n# a bare iteration · reads as a count, completes as one\nFOR <item> IN <collection>:\nFOR EACH <item> IN <collection>:\n\n# a lowercase keyword · a word, not a token\nif <condition>\nIF <condition>:\n\n# a node with no gate · a unit nothing can prove closed\n# NODE 2 — CONVERT   [epistemic · formalisation · computation · yields: procedure]\n    COMPOSE_ARTIFACT <shaped> FROM <row> USING <rules>\n# NODE 2 — CONVERT   [epistemic · formalisation · computation · yields: procedure]\n    COMPOSE_ARTIFACT <shaped> FROM <row> USING <rules>\n    HANDOFF GATE:\n      [check] every <row> converted (evidence: one <shaped> per row) over: <rows> measured: <converted> / <rows>\n      [check] <shaped> holds one entry per <row> (evidence: the two counts match)\n      [check] every entry conforms to <rules> (evidence: VALIDATE_ARTIFACT passed on each)\n      result: pass → NODE 3 | mismatch → REPAIR (owner: NODE 2) | unknown → BLOCKED\n\n# a vague check · a judgement in a gate\n[check] data looks good\n[check] <data>.<field> matches <pattern> (evidence: the match returned true)\n\n# a check with no evidence · a claim the gate cannot settle\n[check] <report> is complete\n[check] <report> names every entry in <findings> (evidence: each finding's id present)\n\n# a gate with no population · a verdict about nothing\n[check] every <file> conforms (evidence: the validator's report)\n[check] every <file> conforms (evidence: the validator's report) over: <files> measured: <conforming> / <files>\n\n# an unknown left unrouted · the third verdict absorbed into pass\nresult: pass → NODE 3 | failure → REPAIR (owner: NODE 2)\nresult: pass → NODE 3 | failure → REPAIR (owner: NODE 2) | unknown → BLOCKED\n\n# a write with no refusal · an irreversible act with no condition to stop it\nPERSIST_ARTIFACT <shaped> TO <destination>\nrefuse: <destination> changed since it was read before PERSIST_ARTIFACT\n\n# an invariant with no objector · a property nothing would disagree with\nINVARIANT one-writer: a record has exactly one writer\nINVARIANT one-writer: a record has exactly one writer over: every record binds: every party objector: [check] one open fence per record\n\n# a bare invariant block · a bullet under a head, with no set, no parties, no objector\nALWAYS:\n  - VALIDATE at node boundaries\nINVARIANT validate-at-boundary: every node validates its output over: every node binds: the reader objector: [check] the gate ran\n\n# a prose directive · an instruction the model must interpret\nGet the customer data and check it\nREAD_RESOURCE <records> INTO <held>\nVALIDATE_ARTIFACT <held> AGAINST <schema>",
                    "kind": "code",
                    "language": "pag",
                    "title": "defect set"
                  },
                  {
                    "code": "document: <name>\n  defect      for_without_each\n  locus       NODE 2, line 4\n  found       FOR <item> IN <collection>:\n  expected    FOR EACH <item> IN <collection>:\n  fix         insert EACH after FOR\n\n  defect      gate_without_population\n  locus       NODE 3, gate\n  found       three checks, none with a set\n  expected    at least one check measured over a declared set\n  fix         name the set and the count measured over it\n\n  defect      unknown_unrouted\n  locus       NODE 3, result line\n  found       pass and failure arms only\n  expected    an unknown arm routed to BLOCKED\n  fix         add the third arm\n\n  defect      invariant_without_objector\n  locus       cross-node invariants, one-writer\n  found       a property with no objector\n  expected    the check that would disagree, or none as declared debt\n  fix         name the objector\n\nverdict: ill_formed",
                    "kind": "code",
                    "language": "text",
                    "title": "scan result"
                  },
                  {
                    "code": "# a value undefined in a later node\n# cause · declared inside a branch, so it exists only there\nIF <condition>:\n    DECLARE <result>: object\n\nDECLARE <result>: object\nIF <condition>:\n    SET <result>.<value> = <data>\n\n# a gate that always fails\n# cause · the check names a value the node never produced\n    APPEND <item> TO <processed-items>\nHANDOFF GATE:\n    [check] <processed-list> populated (evidence: a count above zero)\n\n    APPEND <item> TO <processed-items>\nHANDOFF GATE:\n    [check] <processed-items> populated (evidence: a count above zero)\n\n# a contract that reads forward\n# cause · the input names an output a later node yields\n# NODE 2 — ANALYSIS\nCONTRACT:\n  input: <report> from NODE 3\n\n# NODE 2 — ANALYSIS\nCONTRACT:\n  input: <files> from NODE 1",
                    "kind": "code",
                    "language": "pag",
                    "title": "gate failures"
                  },
                  {
                    "caption": "the scan",
                    "kind": "mermaid",
                    "text": "flowchart TB\n    doc[\"A document\"]\n    scan[\"A deterministic scan · tokens, never patterns\"]\n    defects[\"The defect set · each named for the shape it catches\"]\n    well[\"well_formed\"]\n    ill[\"ill_formed · each defect with its locus and its fix\"]\n    doc --> scan --> defects\n    defects -- empty --> well\n    defects -- non-empty --> ill"
                  },
                  {
                    "caption": "two routes to trust",
                    "kind": "mermaid",
                    "text": "flowchart LR\n    fluent[\"Reads fluently\"]\n    trusted1[\"Trusted · and wrong in the details that went unread\"]\n    scanned[\"Passes the scan\"]\n    trusted2[\"Trusted · because a mechanism said so\"]\n    fluent -. the tempting path .-> trusted1\n    scanned --> trusted2"
                  }
                ],
                "title": "The defect set and the scan"
              }
            ],
            "title": "Well-formedness"
          }
        ]
      },
      {
        "icon": "bi-diagram-3",
        "id": "orchestration",
        "label": "Orchestration",
        "sections": [
          {
            "icon": "bi-diagram-3",
            "id": "declared-structure",
            "intro": "[Orchestration](/ontology#arch-orchestration) is the part of a document that says how work is ordered and where it runs in parallel, and the grammar does not let that be implied. A document declares its structure with constructs, each tied to the representation it makes explicit, as shown in [prose or construct]. A [dependency graph](/ontology#arch-dependency-graph) covers a partial order with forward dependencies; [dependency graph] declares one by name, and [name, never number] shows what the name gains. A [finite state machine](/ontology#arch-finite-state-machine) covers a lifecycle drawn from a closed set of states, as shown in [state machine]. Alongside these are a priority queue for a ranking, a flowchart for the rendered view of any of them, a surface for state that several parties share, a parallel block for readers that return, and a wait for a reader that never returns; [join and wait] writes that last pair. The same idea is taught in [the plan is a graph](/disciplined-methodology/plan#the-flat-checklist). Here it is the project stage of [the loop](/disciplined-methodology#the-loop), and it yields an edge-list. Ordering carried by the order of sentences is [temporal coupling](/ontology#arch-temporal-coupling), and a model given prose reconstructs a structure of its own.",
            "subsections": [
              {
                "blocks": [
                  {
                    "application": "In practice, an order is modelled as a dependency graph whose nodes name what they depend on, so the order is partial and a number never stands in for an edge. A lifecycle is modelled as a finite state machine whose states form a closed set, whose transitions name their trigger and their guard, and whose current state is derived from the tree by a function rather than written by a party. Independent investigations run as bounded readers in a parallel block, with their artifacts joined by an await, and a participant waits through a command with its turn kept open.",
                    "boundary": "Whether a declared parallel group actually runs in parallel is a fact about the harness. The grammar declares that the readers are independent, the binding decides what that gains, and a harness with no [concurrency](/ontology#arch-concurrency) runs them in order without the document changing.",
                    "cause": "A sentence has an order and a graph has edges, and only the second survives being read by a party that did not write it.",
                    "decision": "The order goes in a graph and the lifecycle in a state machine, rather than the units being numbered and the sequence narrated.",
                    "failureMode": "A sequence of decisions is numbered, one is raised out of dependency order because the next number was free, and every citation of the displaced decision resolves to the wrong thing with nothing erroring.",
                    "kind": "lesson",
                    "principle": "For this reason concurrency and [event ordering](/ontology#arch-event-ordering) are declared as structure, never implied by the order of the text.",
                    "problem": "Ordering implied by the order in which sentences appear is reconstructed by every reader, and each reconstructs it differently.",
                    "validation": "To check this, reorder the sentences of a node and run it again. Where the outcome changed, the ordering was carried by prose, and the repair is the construct that carries it explicitly."
                  },
                  {
                    "kind": "text",
                    "text": "A dependency graph is the construct for work whose order is a set of edges rather than a line. A node names what it depends on and what comes after it, and the successor is declared by name rather than derived from a position, for the reason given in [the board and the venue](/disciplined-methodology/collaborate#the-board-and-the-venue). A [directed acyclic graph](/ontology#arch-directed-acyclic-graph) turns a [circular dependency](/ontology#arch-circular-dependency) into a defect the reader can see. Where one unit holds every other party's work, at most one such unit is open at a time, because two holds are two waits with no defined order between them."
                  },
                  {
                    "kind": "text",
                    "text": "A finite state machine is the construct for a lifecycle, and its states form a closed set because a mechanism can join on a value from a closed set but not on a sentence. A unit moves forward through its states over its life and never backwards, with one correction allowed where an act is reversed before anything depends on it. The current state is a [derived state](/disciplined-methodology/verify#derived-state), a function over the tree, and no party writes it. Both constructs are [declarative configuration](/ontology#arch-declarative-configuration) of a run, where a paragraph would only imply the configuration."
                  },
                  {
                    "kind": "text",
                    "text": "A parallel block with an await is the construct for readers that return: each is spawned with a task, receives nothing shared, and returns exactly one typed artifact. Investigations that read a tree and write nothing belong there, one per concern, because reading contends with nothing. A wait is the construct for a participant, which never returns; for a participant, [posting and waiting are one operation](/disciplined-methodology/collaborate#posting-and-waiting-are-one-operation), and a wait is a call rather than a halt. The two constructs are not interchangeable, because an await joins a reader that was always going to end, while a wait keeps open a reader that must not end."
                  },
                  {
                    "code": "# NODE 5 — PROJECT   [epistemic · reasoning · graph · yields: edge-list]\n@purpose: \"Declare the order as edges, so a reader who did not write it can still resolve it\"\n@cue: \"DECLARE_THE_EDGES\"\n\nCONTRACT:\n  input:        <the units of work>\n  transform:    for each unit → name what it depends on → refuse a cycle → name the groups that are independent\n  constraints:  a successor is declared by name, never derived from a position; at most one unit that holds the others is open at a time\n  output:       DAG <units>\n  handoff:      acyclic AND every unit names its dependencies (yields: edge-list + boolean)\n\nDAG <units>:\n    NODE <unit-a>:\n        <what settles it>\n    NODE <unit-b> AFTER <unit-a>:\n        <what settles it>\n    NODE <unit-c> DEPENDS_ON [<unit-a>]:\n        <what settles it>\n    PARALLEL_GROUP: <unit-b>, <unit-c>\n\nHANDOFF GATE (evidence-bearing):\n  rule_id: \"PROJECT\"   yields: edge-list + boolean\n  [check] no unit depends on itself through any path (evidence: the walk over DAG <units>) over: <units> measured: <acyclic> / <units>\n  [check] every successor is named, none is a number (evidence: the AFTER and DEPENDS_ON clauses)\n  [check] at most one holding unit is open (evidence: count of open holds)\n  result: pass → NODE 6 | a cycle → REPAIR (owner: NODE 5) | unknown → BLOCKED",
                    "kind": "code",
                    "language": "pag",
                    "title": "dependency graph"
                  },
                  {
                    "code": "# a lifecycle as a closed set of states · a transition names its trigger and its guard\nSTATE_MACHINE <unit>:\n    STATE <planned>:\n        ENTRY: <no artifact exists yet>\n    STATE <open>:\n        ENTRY: \n    STATE <settled>:\n        ENTRY: <every condition of the exit holds>\n    STATE <retired>:\n        ENTRY: <what the settlement implies has landed>\n\n    TRANSITION FROM <planned> TO <open> ON <first-reading>\n    TRANSITION FROM <open> TO <settled> ON <exit-condition>\n        GUARD: <every party that must agree has agreed>\n    TRANSITION FROM <settled> TO <retired> ON <implied-work-landed>\n        GUARD: <nothing the settlement distributed is still open>\n    TRANSITION FROM <open> TO <planned> ON <artifact-removed>\n        GUARD: <no argument has landed yet>\n\nFUNCTION state_of(unit):\n  # derived from the tree on every read · never written by a party\n  IF NOT EXISTS(unit.artifact): RETURN <planned>\n  IF every_exit_condition_holds(unit) AND implied_work_landed(unit): RETURN <retired>\n  IF every_exit_condition_holds(unit): RETURN <settled>\n  RETURN <open>",
                    "kind": "code",
                    "language": "pag",
                    "title": "state machine"
                  },
                  {
                    "code": "# NODE 6 — ACT   [epistemic · formalisation · computation · yields: procedures]\nCONTRACT:\n  input:        DAG <units>\n  transform:    run each independent group as bounded readers → join their artifacts → a participant waits rather than returns\n  constraints:  a bounded reader receives a task and nothing shared; whether a group runs together is the harness's fact, declared independence is the document's\n  output:       artifacts[] per group\n  handoff:      every group joined or explicitly still open (yields: procedure)\n\nPARALLEL:\n    TASK \"<investigate unit b · mutate nothing>\" WITH agent: <role-b> → <artifact-b>\n    TASK \"<investigate unit c · mutate nothing>\" WITH agent: <role-c> → <artifact-c>\nEND\nAWAIT <artifact-b>, <artifact-c> INTO <artifacts>\n\n# a participant does not join · it waits, and a wait is a call rather than a halt\nWAIT ON <the shared surface> AS <party> INTO <change>\nIF <change> == <changed>:\n    READ_RESOURCE <the shared surface> whole INTO <current>",
                    "kind": "code",
                    "language": "pag",
                    "title": "join and wait"
                  },
                  {
                    "caption": "prose or construct",
                    "kind": "mermaid",
                    "text": "flowchart TB\n    prose[\"Prose · 'first do this, then that, meanwhile the other'\"]\n    implied[\"Ordering implied by sentence order · the model reconstructs it\"]\n    declared[\"A construct · DAG, STATE_MACHINE, PARALLEL, AWAIT, WAIT\"]\n    explicit[\"Edges, states and groups every reader shares\"]\n    prose --> implied\n    declared --> explicit"
                  },
                  {
                    "caption": "name, never number",
                    "kind": "mermaid",
                    "text": "flowchart LR\n    ordinal[\"An ordinal · a position in a total order\"]\n    hidden[\"A unit raised before its predecessor settles · every number still intact\"]\n    name[\"A declared successor · an edge in a partial order\"]\n    caught[\"A successor nobody created, or a unit no predecessor declared · both decidable\"]\n    ordinal -. preserves the violation .-> hidden\n    name --> caught"
                  }
                ],
                "title": "Structure is declared"
              }
            ],
            "title": "Orchestration as declared structure"
          },
          {
            "icon": "bi-tools",
            "id": "composing-a-workflow",
            "intro": "This section covers how a collaboration is put together from parties, as shown in [parties over a partition]. The methodology page states the premise in [coordination is software](/disciplined-methodology/collaborate#coordination-is-software), and the grammar expresses it as documents. [two terminal nodes] shows how a document states its reader class, [change across ownership] shows how a finding travels to its owner, and [party count] shows how the count is derived rather than chosen. A document cannot make the parties agree; it can only make their disagreement land where a reader can see it.",
            "subsections": [
              {
                "blocks": [
                  {
                    "application": "In practice, the work is partitioned into concerns that must be able to contradict each other, and each concern gets one document. The terminal node states the reader class, so the ending is derived: a participant re-enters after a wait, and a bounded reader returns one typed artifact. A change across ownership travels as an item carrying what was observed, what was expected and the one edit, and the owner's act node is the only one that writes.",
                    "boundary": "One writer and one tree is not a collaboration, and the constructs here defend against a party that cannot exist there. A single document with a single reader takes none of this, and adding it is ceremony.",
                    "cause": "A party that holds the order for the others is a party every other party waits on, and a design where finders also fix has parties writing a tree that other parties are still reading.",
                    "decision": "The parties are derived from the partition rather than assigned positions, and the order is given to the surfaces rather than to a controller.",
                    "failureMode": "A workflow names four positions before the work is examined, the work has three concerns, one position spends the run relaying between the other three, and the relay is where every message is lost.",
                    "kind": "lesson",
                    "principle": "For this reason a collaboration is a set of parties over a partition of the work, coordinating through surfaces with nothing between them.",
                    "problem": "A workflow written as a sequence of agents with fixed positions runs the same shape on every task, and no task has that shape.",
                    "validation": "To check this, take a running collaboration and remove any one document. Where the others stall, that document was a controller; where they route around it, the composition held."
                  },
                  {
                    "kind": "text",
                    "text": "A document's terminal node states the reader class, and the class decides what the node yields: a participant's node re-enters after a wait, and a bounded reader's yields one typed artifact. Which class a reader belongs to, and why the rules about turns invert for one of them, is explained in coordination is software. A document whose terminal node states its class makes the inversion legible, while one that leaves it to the reader gets both classes' rules applied at once."
                  },
                  {
                    "kind": "text",
                    "text": "Ownership is what replaces the controller. Scope is claimed by concern rather than by location, because two parties can claim one folder through two claims that never mention each other. A finding that lands on a surface its finder does not own is a real finding and a forbidden edit at the same time, and the two rules are reconciled by kind rather than by restraint. The finder's act node emits an item carrying the surface, the location, what it observed, what it expected and the one change, and the owner makes the change. The finder's set of operations forbids the mutation, and its handoff gate carries the evidence that nothing it applied touched a surface it does not own. The conflict between fixing on sight and leaving another party's scope alone therefore has a structural answer rather than one that depends on care."
                  },
                  {
                    "kind": "text",
                    "text": "The count is an output, and what a document carries is the function that derives it rather than a number. The floor is one party per concern, as described in [a concern is a component](/software-architecture/scale#a-concern-is-a-component). The ceiling is the point where a stale claim costs more than one more perspective gains, as described in [the ceiling moves by cost](/software-architecture/scale#the-ceiling-moves-by-cost)."
                  },
                  {
                    "code": "# the reader class is derived from what a document receives · its terminal node says which\n\n# NODE 10 — TERMINATE   [evaluative · termination · set-theory · yields: ter-stop boolean]\n# a participant · receives what it owns and what is addressed to it, and never returns\nCONTRACT:\n  input:        <items addressed to me> + <open units of my own concern>\n  transform:    handle what is addressed to me → perform my own clear work → WAIT on the shared surface → re-enter\n  constraints:  ter-stop is the developer's call; a quiet wait is a fact about the peers, never about the queue\n  output:       nothing terminal · the loop re-enters at NODE 1\n  handoff:      <changed> → NODE 1 ORIENT (read the surface whole, then act) | <quiet> → my own work, then WAIT again\n\n# NODE 10 — TERMINATE   [evaluative · termination · set-theory · yields: ter-stop boolean]\n# a bounded reader · receives a task and nothing shared, and returns exactly once\nCONTRACT:\n  input:        <the task it received>\n  transform:    evaluate saturation AND completion AND verification → emit one typed artifact\n  constraints:  no shared surface is read, so no surface rule binds; an unresolved question is a finding with what would settle it, never a held turn\n  output:       one typed artifact | a blocked report naming what would settle it\n  handoff:      TERMINATE",
                    "kind": "code",
                    "language": "pag",
                    "title": "two terminal nodes"
                  },
                  {
                    "code": "# a finding on a surface I do not own becomes an item, never an edit · the op-set forbids it, not restraint\n\nFUNCTION emit_repair(finding):\n  IF owner_of(finding.surface) == <me>: RETURN {route: \"act\", change: finding.change}\n  SET item = {kind: artifact, to: [owner_of(finding.surface)], surface: finding.surface, locus: finding.locus, observed: finding.observed, expected: finding.expected, change: finding.change}\n  PERSIST_ARTIFACT item TO <the shared surface> AS <me>\n  RETURN {route: \"sent\", item: item}\n\n# NODE 6 — ACT   [epistemic · formalisation · computation · yields: procedures]\nCONTRACT:\n  input:        findings\n  transform:    for each finding → emit_repair → apply only what routes to \"act\"\n  constraints:  an INVESTIGATE op-set performs no mutation; a mutation on another's surface is a breach whatever its correctness\n  output:       applied[] + sent[]\n  handoff:      every finding either applied on my own surface or sent to its owner (yields: boolean)\n\nHANDOFF GATE (evidence-bearing):\n  rule_id: \"ACT\"   yields: boolean\n  [check] no applied change touched a surface I do not own (evidence: applied[].surface)\n  [check] every sent item names its owner, its locus and the one change (evidence: sent[])\n  [check] every finding routed exactly once (evidence: applied[] and sent[] partition findings)\n  result: pass → NODE 7 | a foreign write → REPAIR (owner: NODE 6) | unknown → BLOCKED",
                    "kind": "code",
                    "language": "pag",
                    "title": "change across ownership"
                  },
                  {
                    "code": "# the party count is an output of the structure, never an input to it\n\nFUNCTION derive_count(work):\n  ANALYZE_CONTENT work FOR <pairs of surfaces where a change to one forces a change to the other> INTO coupling   # yields: edge-list\n  EXTRACT_FACTS connected_components FROM coupling INTO concerns                                                 # yields: set\n  CALCULATE_METRIC floor = count(concerns)                                                                        # one party per concern\n  ANALYZE_CONTENT claims FOR <how many rest on one surface> INTO fan_in                                          # yields: number\n  CALCULATE_METRIC ceiling = <the population past which a claim is stale more often than it is useful>\n  RETURN {concerns: concerns, floor: floor, ceiling: ceiling}",
                    "kind": "code",
                    "language": "pag",
                    "title": "party count"
                  },
                  {
                    "caption": "parties over a partition",
                    "kind": "mermaid",
                    "text": "flowchart TB\n    work[\"A body of work\"]\n    concerns[\"Concerns that must be able to contradict each other\"]\n    parties[\"One party per concern · each a document, none above the others\"]\n    surfaces[\"Shared surfaces · what each owns, what is addressed to whom\"]\n    owner[\"A change to another's surface travels as an item · the owner makes it\"]\n    work --> concerns --> parties --> surfaces --> owner\n    parties -. nothing here .-> controller[\"A controller\"]"
                  }
                ],
                "title": "Parties over a partition"
              }
            ],
            "title": "Composing a collaboration"
          },
          {
            "icon": "bi-journal-text",
            "id": "shared-surfaces",
            "intro": "When more than one party writes to one tree, the surfaces they share are [shared mutable state](/ontology#arch-shared-mutable-state). A document expresses four things about them, the schema, the records, the items and their lifetime, as written in [surface declared] and shown in [surface to state]. The definitions and the reasons are given in [coordination is software](/disciplined-methodology/collaborate#coordination-is-software) and in [the board and the venue](/disciplined-methodology/collaborate#the-board-and-the-venue); this section declares the shape. [state as function] shows how a state is read and a write is fenced, [a write lands] shows where a write lands or is refused, and [lifetime axes] shows the declaration a mechanism reads.",
            "subsections": [
              {
                "blocks": [
                  {
                    "application": "In practice, a shared surface is declared as a schema: its key in the header, one record per writer with the writer named on the record, and a fence around each record so that an edit has a span to anchor on. An item is declared with an id the surface allocates, a kind that selects its closure, and the readers it is addressed to. Open, blocked and absorbed are derived by a function over the edges, an absorbed item's durable half is extracted and the item deleted in the same change, and each surface's lifetime is declared on retention, mutability and removal.",
                    "boundary": "An outcome surface written jointly has no per-party unit for the one-writer rule to range over, so the invariant is declared inapplicable there, with its reason. A clash of meaning on such a surface is caught by announcing the intended write, with each author removing its own duplicate.",
                    "cause": "A file offers no span a party can anchor on unless the document declares one, so the only edit available is the whole file.",
                    "decision": "The surface is declared as a schema a tool can refuse against, rather than described in prose the parties have to keep in mind.",
                    "failureMode": "Two parties revise their own records by rewriting the file, each correctly, and the second write is a [lost update](/ontology#arch-lost-update) for the first party, with no error anywhere.",
                    "kind": "lesson",
                    "principle": "For this reason a shared surface holds records with one writer each, and every state is a query over those records.",
                    "problem": "A shared document with no declared writer per span is one that every party rewrites whole.",
                    "validation": "To check this, take the last write to a shared surface and name the span it was anchored on. A write with no span was a whole-file write, and the neighbour it overwrote is the finding."
                  },
                  {
                    "kind": "text",
                    "text": "The document states the one writer per record on the record itself. The act node that writes carries the mechanism as its contract: a witness read, an anchor on its own fence, and a refusal when the surface has moved. An edit against a moved surface is therefore refused with the diff, and a whole-file write is never the available path."
                  },
                  {
                    "kind": "text",
                    "text": "The document writes no state. Every state is a function over the edges, declared once and evaluated on every read, as described in [derived state](/disciplined-methodology/verify#derived-state), and an item whose citation resolves is extracted and deleted in the same change rather than left resting in a state."
                  },
                  {
                    "kind": "text",
                    "text": "A lifetime is declared on the three axes derived in [stating an invariant](/disciplined-methodology/collaborate#stating-an-invariant), each drawn from a closed set, so the declaration is a value a mechanism can join on rather than a sentence. A mechanism decides what it may do to a surface from that declaration, never from the shape of the surface's path."
                  },
                  {
                    "code": "# the four things a document declares about a shared surface · a structure declaration, never prose\nSURFACE <key>:                                   # declared in the header, never derived from the path\n    RECORD <key>-1 subject: <what it is about>   # one writer, named on the record · the fence an edit anchors on\n        ITEM <key>-1-1 TO <reader>:     # an addressed span · its id allocated once, never reused\n            SATISFIED_BY <artifact>              # an edge · an id in a field · resolves or does not\n            BLOCKS <key>-2-1\n    RECORD <key>-2 subject: <what it is about>\n        ITEM <key>-2-1 TO <reader>: \n            ANSWERS <key>-1-1\n\n# the states are derived from the edges, never written\nstate: OPEN | BLOCKED | ABSORBED\n\n# the lifetime, declared on three axes a mechanism can join on\nDECLARE lifetime: object\nSET lifetime = {retention: <what ends a piece of content>, mutability: <who may rewrite a landed statement>, removal: <who may take content out>}",
                    "kind": "code",
                    "language": "pag",
                    "title": "surface declared"
                  },
                  {
                    "code": "# no party writes a state · every state is a function over the edges, evaluated on every read\nFUNCTION state_of(item):\n  IF resolves(item.edges.satisfied_by): RETURN <absorbed>       # a transition · extract, then delete in the same change\n  FOR EACH edge IN inbound(item, <blocks>):\n    IF state_of(edge.from) == <open>: RETURN <blocked>\n  RETURN <open>\n\n# NODE 6 — ACT   [epistemic · formalisation · computation · yields: procedures]\nCONTRACT:\n  input:        <my record> + <the surface as it stands>\n  transform:    read the surface whole → anchor on my own fence → land the edit inside it\n  constraints:  a write to a path not read this turn is an edit to unknown contents; a whole-file write reports success to the one who overwrote and nothing to the one overwritten\n  output:       <my record, revised>\n  handoff:      the edit landed inside my fence and the surface had not moved, or the edit was refused with the diff (yields: boolean)\n\nHANDOFF GATE (evidence-bearing):\n  rule_id: \"ACT\"   yields: boolean\n  [check] nothing outside my fence changed (evidence: the diff of the surface) over: the surface's records measured: <untouched> / <records>\n  [check] the surface was read whole immediately before the write (evidence: the witness read)\n  [check] a moved surface refused the write, or the write commuted and replayed (evidence: the compare against my own span)\n  refuse: the surface moved inside my span since the witness read before PERSIST_ARTIFACT\n  standing: moved-set <the records that moved outside my span>\n  result: pass → NODE 7 | a write outside my fence → REPAIR (owner: NODE 6) | unknown → BLOCKED",
                    "kind": "code",
                    "language": "pag",
                    "title": "state as function"
                  },
                  {
                    "code": "# a lifetime is three independent axes · one word for it drops the axis a reader assumes follows\nDECLARE lifetimes: array\nSET lifetimes = [\n  {surface: , retention: <current-truth>,  mutability: <owner-rewritable>, removal: <the handler of an item>},\n  {surface: <an argument>,            retention: <accumulating>,   mutability: <append-only>,      removal: <none while open · moved whole when settled>},\n  {surface: <an archive>,             retention: <accumulating>,   mutability: <frozen>,           removal: <none>}\n]\n\nFUNCTION may_remove(party, content, surface):\n  # decided from the declaration, never from the shape of the path\n  SET lifetime = lifetimes[surface]\n  RETURN lifetime.removal == party.role_on(content)",
                    "kind": "code",
                    "language": "pag",
                    "title": "lifetime axes"
                  },
                  {
                    "caption": "surface to state",
                    "kind": "mermaid",
                    "text": "flowchart TB\n    surface[\"A surface · a file the parties read and write\"]\n    r1[\"Record · one writer, declared on the record\"]\n    r2[\"Record · one writer\"]\n    item[\"Item · an allocated id, a kind, its readers\"]\n    ref[\"An edge · an id in a field · resolves or does not\"]\n    state[\"State · a function over the edges, written by no party\"]\n    surface --> r1\n    surface --> r2\n    r1 --> item --> ref --> state"
                  },
                  {
                    "caption": "a write lands",
                    "kind": "mermaid",
                    "text": "flowchart TB\n    intent[\"A party intends a write\"]\n    read[\"Read the surface whole\"]\n    span[\"Anchor on its own fence\"]\n    moved{\"Surface moved since the read?\"}\n    land[\"Land inside the span\"]\n    overlap{\"Overlap with its own span?\"}\n    replay[\"Replay · the writes commute\"]\n    refuse[\"Refuse · with the diff of the span\"]\n    intent --> read --> span --> moved\n    moved -- no --> land\n    moved -- yes --> overlap\n    overlap -- no --> replay --> land\n    overlap -- yes --> refuse"
                  }
                ],
                "title": "Records, items, derived states"
              }
            ],
            "title": "Shared surfaces"
          },
          {
            "icon": "bi-toggles",
            "id": "phase-binding",
            "intro": "This section covers how a run is bound to one of two kinds before it touches anything, as derived in [agents as executed contracts](/disciplined-methodology/collaborate#agents-as-executed-contracts) and shown in [two kinds]. The orient node binds the kind, as written in [binding the kind], and the constrain node asks afterwards whether the binding held, as written in [admissibility]. [the cycle] and [cycle, not line] show the shape the two kinds make together.",
            "subsections": [
              {
                "blocks": [
                  {
                    "application": "In practice, every run is bound to one kind in its orient node, and the operations it permits and forbids are derived from that kind rather than listed by hand. An investigation discovers, reads, searches and analyzes, and it persists exactly one report. An action reads the report, repairs each gap in dependency order, and logs what changed. The constrain node then checks, once the operations exist, that each stayed inside its set, and a breach is routed to the node that owns the fix.",
                    "boundary": "A single-party task with one read and one write is one action run, and splitting it into an investigation and an action doubles the document for nothing. The binding matters where the findings will be read by a party that did not produce them.",
                    "cause": "A finding is a claim about a tree, and a tree the finder also mutated is a different tree from the one the finding describes.",
                    "decision": "The kind is bound in the orient node before any operation, rather than declared in prose in the hope that the operations stay within it.",
                    "failureMode": "A run finds a defect, repairs it in passing, and reports the defect as open, so the next run repairs it again against a tree where it no longer exists.",
                    "kind": "lesson",
                    "principle": "For this reason a run either investigates or acts, and the operations allowed to each have nothing in common.",
                    "problem": "A run asked to look starts repairing what it sees.",
                    "validation": "To check this, list the operations of a run and mark each as reading or writing. A run that has both kinds is unbound, and its first write is where it splits."
                  },
                  {
                    "kind": "text",
                    "text": "The binding is a property of the run, declared in its orient node before any operation, and the permitted operations follow from it, which is [state isolation](/ontology#arch-state-isolation) applied to a run. An investigation may discover, read, search and analyze resources, and it may persist one artifact, its report. It may not edit, write anywhere else, or run a command that changes the tree, and that includes the [verification](/ontology#arch-verification) chain, because the chain's early stages rewrite the tree. An action may persist, execute and fix, but it may not widen its scope, because scope discovered in the middle of an action is a finding that was never reported and will never be verified. The same binding is taught in agents as executed contracts; here it is the contract of one node."
                  },
                  {
                    "kind": "text",
                    "text": "The shape that follows is a cycle rather than a line. The work is investigated, then acted on, then investigated again to verify what the action did, and it stops when the second investigation finds every gap either resolved or carried forward with a reason. Each investigation reads the same report and removes what is settled, so the report converges rather than growing. A fixed pipeline of positions cannot express this, because it has no edge back, and the edge back is where a repair that missed is caught."
                  },
                  {
                    "kind": "text",
                    "text": "A run declared as an investigation can still contain a write that went unnoticed, and a check that reads only the declaration passes it. So the constrain node checks the observations against the operations the binding allowed, and a breach is routed to the node that owns the fix rather than repaired in place, because a repair made in place is the same breach, committed by the node that found it."
                  },
                  {
                    "code": "# NODE 1 — ORIENT   [epistemic · ontology · set-theory · yields: run-context]\n@purpose: \"Bind the run to exactly one phase kind before touching anything, so the op-set is a contract rather than restraint\"\n@cue: \"DISCLOSE_THEN_BIND\"\n\nCONTRACT:\n  input:        <the invocation>\n  transform:    detect the phase kind → bind its allowed and forbidden operations → bind the one artifact it emits\n  constraints:  INVESTIGATE and ACTION are mutually exclusive; the checks that heal rewrite the tree, so they belong to ACTION\n  output:       run_context { phase, allowed_ops, forbidden_ops, artifact }\n  handoff:      phase bound to exactly one AND the two op-sets disjoint (yields: boolean)\n\nFUNCTION bind_phase(invocation):\n  DETERMINE kind FROM invocation   # INVESTIGATE | ACTION\n  IF kind == \"INVESTIGATE\":\n    RETURN {phase: \"INVESTIGATE\", allowed_ops: [DISCOVER_RESOURCES, READ_RESOURCE, SEARCH_CONTENT, ANALYZE_CONTENT], forbidden_ops: [<mutation>, <gap fixing>], artifact: <investigation report>}\n  IF kind == \"ACTION\":\n    RETURN {phase: \"ACTION\", allowed_ops: [<bounded fix>, PERSIST_ARTIFACT, EXECUTE_TOOL], forbidden_ops: [<gap discovery>], artifact: <action log>}\n\nHANDOFF GATE (evidence-bearing):\n  rule_id: \"ORIENT\"   yields: boolean\n  [check] phase bound to exactly one of INVESTIGATE | ACTION (evidence: run_context.phase)\n  [check] allowed and forbidden op-sets are disjoint (evidence: run_context.allowed_ops, forbidden_ops)\n  [check] the artifact the phase emits is the one its kind emits (evidence: run_context.artifact)\n  result: pass → NODE 2 | undetectable kind → REPAIR (owner: NODE 1) | unknown → BLOCKED",
                    "kind": "code",
                    "language": "pag",
                    "title": "binding the kind"
                  },
                  {
                    "code": "# NODE 7 — CONSTRAIN   [conative · teleology · optimisation · yields: admissibility boolean]\n@purpose: \"Ask after the operations exist whether they stayed inside the bound op-set · a declaration is not evidence that it held\"\n@cue: \"ADMISSIBLE_BEFORE_VERIFY\"\n\nCONTRACT:\n  input:        observations + run_context\n  transform:    for each observation → did it mutate under INVESTIGATE, did it discover under ACTION\n  constraints:  a breach routes to the node that owns the fix, never a repair in place, because repairing in place is the same breach in the node that found it\n  output:       admissibility { ok, op_violations[] }\n  handoff:      GATE — op-sets honoured (yields: boolean)\n\nFUNCTION assess_admissibility(observations, run_context):\n  DECLARE op_violations: array\n  SET op_violations = []\n  FOR EACH o IN observations:\n    IF run_context.phase == \"INVESTIGATE\" AND o CAUSED <mutation>: APPEND {claim: o.claim, violation: \"mutation under INVESTIGATE\"} TO op_violations\n    IF run_context.phase == \"ACTION\" AND o DISCOVERED <new scope>: APPEND {claim: o.claim, violation: \"discovery under ACTION\"} TO op_violations\n  RETURN {ok: op_violations.length == 0, op_violations: op_violations}\n\nHANDOFF GATE (teleology admissibility gate):\n  rule_id: \"CONSTRAIN\"   yields: boolean\n  [check] admissibility.op_violations.length == 0 (evidence: INVESTIGATE no mutation / ACTION no discovery)\n  [check] every observation was classified against the phase (evidence: one verdict per observation) over: observations measured: <classified> / <observations>\n  [check] every breach names the node that owns the fix (evidence: op_violations[].owner)\n  result: pass → NODE 8 | a breach → REPAIR (owner: NODE 6) | unknown → BLOCKED",
                    "kind": "code",
                    "language": "pag",
                    "title": "admissibility"
                  },
                  {
                    "code": "# the shape that follows is a cycle rather than a line · the edge back is where a missed repair is caught\nINVESTIGATE  → \nACTION       → \nINVESTIGATE  → <the same report, with what is settled removed>\nSTOP when    <every gap is resolved or carried forward with a reason>",
                    "kind": "code",
                    "language": "pag",
                    "title": "the cycle"
                  },
                  {
                    "caption": "two kinds",
                    "kind": "mermaid",
                    "text": "flowchart TB\n    phase[\"A run\"]\n    kind{\"Bound to which?\"}\n    inv[\"INVESTIGATE · discovers, never fixes · emits a report\"]\n    act[\"ACTION · fixes against known evidence, never discovers · emits a log\"]\n    mixed[\"Both · mutated under a read-only contract, findings describe a tree that moved\"]\n    phase --> kind\n    kind -- one --> inv\n    kind -- the other --> act\n    kind -. neither, or both .-> mixed"
                  },
                  {
                    "caption": "cycle, not line",
                    "kind": "mermaid",
                    "text": "flowchart LR\n    i1[\"Investigate\"]\n    a1[\"Act\"]\n    i2[\"Investigate · verify\"]\n    stop[\"Stop · every gap resolved or carried with a reason\"]\n    i1 --> a1 --> i2\n    i2 -- gaps remain --> a1\n    i2 -- none --> stop"
                  }
                ],
                "title": "Investigate or act"
              }
            ],
            "title": "Phase binding"
          },
          {
            "icon": "bi-arrow-left-right",
            "id": "handoff-signals",
            "intro": "A handoff is an item addressed to the parties that need it, with an allocated id, a declared kind and a closure the kind selects, as written in [an item] and shown in [kind selects closure]. An artifact item asks for something that can exist, and it closes when a typed reference to that thing resolves. A judgement item asks for a reading, and it closes when its acknowledger marks it; [closing an item] shows the closure in either case. A failure is a finding rather than a halt, and it follows the route shown in [failure routes] and [failure to finding]. A report goes to the parties whose next work it creates, never to the developer as a closing summary.",
            "subsections": [
              {
                "blocks": [
                  {
                    "application": "In practice, a handoff is posted as an item with an id the surface allocates, a kind, the parties it is addressed to, and a body carrying the finding's surface, location, and observed and expected values. An artifact item closes through a reference that has to resolve and stay true while the work is done, and a judgement item closes through its acknowledger. A failure is routed by what it binds: a decision goes to the party whose surface it binds, a question about the purpose of the work goes to the developer with a recommendation first, and everything else goes to the next open item.",
                    "boundary": "The handoff protocol is for parties that share a surface; what a bounded reader does instead is described in [composing a collaboration](/pag/orchestration#composing-a-workflow).",
                    "cause": "A closure that a reference decides can be checked by any party, while a closure that a party declares can be checked only by that party.",
                    "decision": "The kind decides the closure, either a reference that has to resolve or an acknowledger named on the item, rather than the author's word that the work is done.",
                    "failureMode": "A party declares an item handled, nothing points at the thing it asked for, the item is removed, and the work it named was never done.",
                    "kind": "lesson",
                    "principle": "For this reason a handoff is a typed item whose closure can be checked by a party other than its author.",
                    "problem": "A handoff closed by the party that wrote it closes whether or not the work exists.",
                    "validation": "To check this, name for each closed item the reference that closed it or the party that acknowledged it. An item that its own author closed with no reference was declared done, not shown to be done."
                  },
                  {
                    "kind": "text",
                    "text": "The kind is on the item, and it selects the closure. An artifact item names something that can exist, such as a file, a gate or a record, so it closes with a typed reference that has to resolve. The reference names a condition that can turn out wrong rather than a path, because a path resolves as soon as the file exists, and the item would read as closed while the defect is still open. The reference also moves with the work: it is true when the work is done and false when it is not, so a citation that points at the findings themselves is refused, since a broken tree would satisfy it. A judgement item closes when its declared acknowledger signs it off, with no reference, and why one kind requires an acknowledger and the other forbids one is explained in [the board and the venue](/disciplined-methodology/collaborate#the-board-and-the-venue)."
                  },
                  {
                    "kind": "text",
                    "text": "A failure travels through the same channel as any other item and is routed along the same three paths, as derived in [a turn never ends to wait](/disciplined-methodology/collaborate#a-turn-never-ends-to-wait). A gate's result line is the same routing in miniature, with a third arm that the item channel also needs. An unknown, meaning a claim the run could not measure, is blocked rather than passed, and blocked is a state that names the party who owes the answer. The commit node carries the rule that a report goes to the parties whose next work it creates."
                  },
                  {
                    "kind": "text",
                    "text": "The handler removes the item by its id, after extraction, as the board and the venue requires. An item whose readers have all gone is re-addressed rather than left, because an item that no party can handle reads as live traffic forever."
                  },
                  {
                    "code": "# an item is a typed span · its kind selects how it closes, and the closure is checked by a party other than its author\nDECLARE item: object\nSET item = {\n  id:    <allocated by the surface, never by hand>,\n  kind:  <artifact | judgement>,\n  from:  <this party>,\n  to:    [<the parties that need it>],\n  body:  {surface: <where>, locus: <what part>, observed: <what was seen>, expected: <what should hold>}\n}\n\nFUNCTION closes(item):\n  # an artifact item asks for something that can exist · it closes when a typed reference resolves\n  IF item.kind == artifact: RETURN resolves(item.satisfied_by) AND monotone_with_the_work(item.satisfied_by)\n  # a judgement item asks for a reading · it closes by its declared acknowledger, with nothing to point at\n  IF item.kind == judgement: RETURN acknowledged_by(item.acknowledger)\n\nFUNCTION may_close(party, item):\n  RETURN party IN item.to   # a reader, never the author",
                    "kind": "code",
                    "language": "pag",
                    "title": "an item"
                  },
                  {
                    "code": "# a failure is a finding, not a halt · it flows through the same channel and routes by what it binds\nFUNCTION route(failure):\n  SET finding = {surface: failure.surface, locus: failure.locus, observed: failure.observed, expected: failure.expected}\n  IF failure.blocks_a_decision:\n    RETURN SEND finding TO <the party whose surface the decision binds>\n  IF failure.asks_what_the_work_is_for:\n    RETURN SEND finding TO <the developer> AS \n  RETURN <the next open item>\n\n# NODE 9 — COMMIT   [evaluative · representation · information-theory · yields: one typed artifact]\nCONTRACT:\n  input:        findings + run_context\n  transform:    emit exactly one artifact of the kind bound at orientation, deduplicated, naming every limitation\n  constraints:  a report goes to the parties whose next work it creates, never to the developer as a closing summary\n  output:       committed { artifact_type, output }\n  handoff:      one typed artifact emitted (yields: hash + boolean)\n\nHANDOFF GATE (evidence-bearing):\n  rule_id: \"COMMIT\"   yields: hash + boolean\n  [check] exactly one artifact emitted, of the kind bound at orientation (evidence: committed.artifact_type)\n  [check] every finding addressed to a party that needs it (evidence: findings[].to) over: findings measured: <addressed> / <findings>\n  [check] no finding recorded twice (evidence: dedup)\n  refuse: the artifact's destination changed since it was read before PERSIST_ARTIFACT\n  result: pass → NODE 10 | duplicate or unaddressed → REPAIR (owner: NODE 9) | unknown → BLOCKED",
                    "kind": "code",
                    "language": "pag",
                    "title": "failure routes"
                  },
                  {
                    "code": "# closing an item · the handler removes it, never the author, and extraction comes first\nWHEN <party> handles <item>:\n    VALIDATE <party> IN <item>.<to>\n    VALIDATE closes(<item>)\n    EXTRACT_FACTS <item>.<durable half> INTO <the one home history has>\n    PERSIST_ARTIFACT <the extraction> TO <that home>\n    REMOVE <item> BY <item>.<id>       # the span, never a matched line",
                    "kind": "code",
                    "language": "pag",
                    "title": "closing an item"
                  },
                  {
                    "caption": "kind selects closure",
                    "kind": "mermaid",
                    "text": "flowchart TB\n    posted[\"An item is posted · id allocated, kind set, readers named\"]\n    kind{\"Which kind?\"}\n    artifact[\"Artifact · closes when its reference resolves\"]\n    judgement[\"Judgement · closes when its acknowledger marks it\"]\n    handler[\"Removed by a party in its reader set · never its author\"]\n    extract[\"Its durable half extracted first\"]\n    posted --> kind\n    kind -- artifact --> artifact --> handler\n    kind -- judgement --> judgement --> handler\n    handler --> extract"
                  },
                  {
                    "caption": "failure to finding",
                    "kind": "mermaid",
                    "text": "flowchart LR\n    fails[\"A gate fails\"]\n    finding[\"A finding · surface, locus, observed, expected\"]\n    binds{\"What does it bind?\"}\n    owner[\"The party whose surface the decision binds\"]\n    person[\"The developer · what the work is for, a recommendation first\"]\n    next[\"The next open item\"]\n    fails --> finding --> binds\n    binds -- a decision --> owner\n    binds -- the purpose --> person\n    binds -- nothing --> next"
                  }
                ],
                "title": "Typed items, falsifiable closures"
              }
            ],
            "title": "Handoff signals"
          },
          {
            "icon": "bi-shield-check",
            "id": "orchestration-invariants",
            "intro": "A collaboration relies on invariants, and what each invariant has to carry is described in [stating an invariant](/disciplined-methodology/collaborate#stating-an-invariant): the property in a form that could be false, the set it ranges over, the parties it binds, and the objector that would disagree if it stopped holding. [invariant records] shows the records, [gate cites records] shows a gate pointing at them, and [three homes] shows where each record is read.",
            "subsections": [
              {
                "blocks": [
                  {
                    "application": "In practice, every invariant a collaboration relies on is declared as a record with four slots, and where nothing in any artifact would disagree, the objector is written as none, so the debt is declared rather than hidden. A gate check cites the record it holds, and a role names the invariants its party protects, as described in [a seat is a contract](/disciplined-methodology#a-seat-is-a-contract). A block is never headed with a bare modifier and a list of bullets, because a bullet carries no set, no parties and no objector, which is why the scan refuses it.",
                    "boundary": "The number of invariants grows with the number of parties and [shared surfaces](/pag/orchestration#shared-surfaces).",
                    "cause": "A restatement is a copy, and a copy carries no edge back to the statement it copied; a bullet is a restatement with even the statement's slots dropped.",
                    "decision": "Each invariant is declared once as a record with four slots and pointed at from every place that needs it, rather than restated wherever a party reads it.",
                    "failureMode": "A document's closing lines, a role and a check each carry their own wording of one rule, one of them is edited, and the other two keep binding the old rule.",
                    "kind": "lesson",
                    "principle": "For this reason an invariant has one statement, and every other mention of it is a pointer to that statement.",
                    "problem": "An invariant restated in every document that needs it becomes a set of copies that drift.",
                    "validation": "To check this, name for each gate check and role entry the invariant record it points at. A line that points at nothing is a copy, and the record it should point at is the finding. A record whose objector is none is the debt described in [a tension has a mechanism](/software-architecture/principles#a-tension-has-a-mechanism), for a rule with no check."
                  },
                  {
                    "kind": "text",
                    "text": "One statement has three homes that point at it. A document's invariant block holds the records, a role lists by name the invariants its party protects, and a gate check holds the half that an artifact can observe; where the objector is none, that check is the only watcher, and it says so. An invariant has to reach every party that needs it, and pointing is how it reaches them without a copy that can disagree, so the record is the unit that is derived again whenever the invariant changes."
                  },
                  {
                    "code": "# CROSS-NODE INVARIANTS  (each a record with four slots · a property nothing would object to declares its objector as none)\nINVARIANT one-writer-per-record: a record is written only by the party named on it over: every record on every shared surface binds: every party that writes a surface objector: [check] the anchored edit refuses a write outside the caller's span\nINVARIANT no-written-state: no party writes a status marker over: every item on the coordination surface binds: every party objector: [check] a scan for markers on every run\nINVARIANT handler-removes: an item is removed by a party in its reader set over: every closed item binds: every party objector: none\n\n# the scan reads the four slots and refuses a record missing one\n[check] every invariant names its set, its parties and its objector (evidence: the defect scan) over: <invariants> measured: <complete> / <invariants>",
                    "kind": "code",
                    "language": "pag",
                    "title": "invariant records"
                  },
                  {
                    "code": "# a node's gate cites the invariant it holds rather than restating it\nHANDOFF GATE:\n  [check] the write landed inside the caller's span (evidence: the anchored edit's report)     # <one-writer-per-record>\n  [check] no marker written (evidence: the marker scan)                                          # <no-written-state>\n  [check] the removed item named this party in its reader set (evidence: the item's fence)     # <handler-removes> · objector none, so this check is the only watcher\n  result: pass → NODE 4 | span breached → REPAIR (owner: NODE 3) | unknown → BLOCKED",
                    "kind": "code",
                    "language": "pag",
                    "title": "gate cites records"
                  },
                  {
                    "caption": "three homes",
                    "kind": "mermaid",
                    "text": "flowchart LR\n    stated[\"One record per invariant · property, set, parties, objector\"]\n    closing[\"The document's invariant block · holds it\"]\n    role[\"The role · the invariants this party protects, by name\"]\n    check[\"A gate check · the half an artifact can observe\"]\n    closing --> stated\n    role --> stated\n    check --> stated"
                  }
                ],
                "title": "Declared once, cited thrice"
              }
            ],
            "title": "Orchestration invariants"
          }
        ]
      },
      {
        "icon": "bi-puzzle",
        "id": "patterns",
        "label": "Patterns",
        "sections": [
          {
            "icon": "bi-puzzle",
            "id": "instruction-patterns",
            "intro": "This section covers the verbs and prepositions a document is written with. Each verb carries a [semantic contract](/ontology#arch-semantic-contracts), and a document relies on that contract rather than on what a particular tool happens to do; a read, for example, leaves its source unchanged whichever tool performs it. [input verbs] lists what each input verb promises about its source, [output verbs] what each output verb promises about its result, and [control verbs] what each control verb promises about its effects. [three readers] shows who a contract serves, and [the prepositions] declares the relations the prepositions carry between the operands. A verb's contract together with its preposition is the whole meaning of a line.",
            "subsections": [
              {
                "blocks": [
                  {
                    "application": "In practice, a read is used when the source must survive, an extract when its meaning must, a find when only existence matters, a filter when order must hold, and an execute when a side effect is the point. The operands are bound with the preposition that names their relation, and the guarantee is relied on downstream.",
                    "boundary": "A contract is a promise the grammar makes about the intent; whether the model or the tool executing the line keeps it is what [verification](/ontology#arch-verification) is for.",
                    "cause": "A verb the model has seen carry one guarantee across many contexts is likely to carry it into the completion; a verb used loosely carries every meaning it has ever had.",
                    "decision": "The verb is chosen by the guarantee the line needs, rather than by the tool that will perform it.",
                    "failureMode": "A document says process the items, the model reads, filters, writes and deletes under that one word, and the reviewer cannot say which of those the author meant.",
                    "kind": "lesson",
                    "principle": "For this reason every line relies on its verb's contract and its preposition's relation, and a line whose behaviour breaks them is a defect in the line.",
                    "problem": "A verb with no stated guarantee means whatever the model completes it as.",
                    "validation": "To check this, read a line and state what it promises about its source and its result. A line whose promise you cannot state uses its verb loosely, and the repair is the verb whose guarantee matches the intent."
                  },
                  {
                    "kind": "text",
                    "text": "A contract promises one of three things: what happens to the source, what the result is, or what effects the line may have. Two contracts carry the most weight. An execute may have side effects, and saying so is what keeps each of them from being a [hidden side effect](/ontology#arch-hidden-side-effect). A report is a statement to a reader, never a state that anything later reads as the truth."
                  },
                  {
                    "kind": "text",
                    "text": "A line with the wrong preposition puts its operands in the wrong relation, and the model is asked to complete the relation it was given."
                  },
                  {
                    "code": "READ <file> FROM <path> INTO <content>        # non-destructive · the source is unchanged\nLOAD <settings> FROM <file>                    # acquisition with parsing\nEXTRACT <fields> FROM <record> INTO <values>   # isolation · the source keeps its meaning\nFIND <pattern> IN <scope> INTO <found>          # existence · boolean, non-invasive\nGLOB \"<pattern>\" INTO <files>                  # discovery by shape\nGREP \"<term>\" IN <path> INTO <matches>          # discovery by content",
                    "kind": "code",
                    "language": "pag",
                    "title": "input verbs"
                  },
                  {
                    "code": "WRITE <content> TO <file>                       # idempotent where it overwrites\nCREATE <report> FROM <data> USING <template>     # a candidate set or an artifact\nAPPEND <item> TO <collection>                    # growth without retraction\nREPORT <status>                                  # a statement to a reader, never a state\n\nCONVERT <data> TO <format>\nFILTER <items> TO <kept> WHERE <condition>       # removes, preserves order\nMERGE <sources> INTO <target>\nSPLIT <data> BY <delimiter> INTO <segments>",
                    "kind": "code",
                    "language": "pag",
                    "title": "output verbs"
                  },
                  {
                    "code": "VALIDATE <data> AGAINST <schema>                 # conformance\nVERIFY <condition>                               # a boolean, non-modifying\nANALYZE <state> FOR <errors> INTO <found>        # deep examination, may delegate\nCOMPARE <actual> AGAINST <expected> INTO <diff>\nRANK <candidates> BY <score> INTO <ordered>       # score-driven ordering\n\nEXECUTE <command> WITH <params>                  # side effects possible\nTASK \"<objective>\" WITH agent: <role> → <result>\nSEND <message> TO <recipient>\nAWAIT <response> INTO <result>\nSET <state> = <value>                            # assignment · idempotent\nLINK <source> TO <target>                        # a bidirectional association",
                    "kind": "code",
                    "language": "pag",
                    "title": "control verbs"
                  },
                  {
                    "caption": "three readers",
                    "kind": "mermaid",
                    "text": "flowchart TB\n    verb[\"A verb\"]\n    guarantee[\"Its semantic contract · what it promises about the source and the result\"]\n    reader[\"A reader relies on the contract\"]\n    model[\"The model is asked to complete the pattern the contract names\"]\n    check[\"A scan can hold the contract · a READ that mutates is a defect\"]\n    verb --> guarantee\n    guarantee --> reader\n    guarantee --> model\n    guarantee --> check"
                  },
                  {
                    "caption": "the prepositions",
                    "kind": "mermaid",
                    "text": "flowchart LR\n    from[\"FROM · the origin\"]\n    in[\"IN · the container searched\"]\n    into[\"INTO · the destination bound\"]\n    to[\"TO · the destination intended\"]\n    using[\"USING · the mechanism\"]\n    against[\"AGAINST · the reference\"]\n    for[\"FOR · the purpose\"]\n    with[\"WITH · the parameters\"]\n    from ~~~ in ~~~ into ~~~ to\n    using ~~~ against ~~~ for ~~~ with"
                  }
                ],
                "title": "Verbs and their contracts"
              }
            ],
            "title": "Instruction patterns"
          },
          {
            "icon": "bi-signpost-split",
            "id": "intent-to-structure",
            "intro": "This section covers how a request is turned into structure: by walking [the loop](/disciplined-methodology#the-loop) rather than by matching a word, as shown in [fit, not word] and written in [selection by fit]. Each of the loop's nodes yields a decision of a declared shape. Intent yields a ranking, never a yes; verify yields a boolean over evidence; and terminate yields a stop only when the work is saturated, complete and verified, which are the three gates written in [typed gates]. A document that walks the loop writes each node with its contract, and with a gate wherever the node owes one, as shown in full in [ten nodes], and [the loop] shows the edge a refutation takes back.",
            "subsections": [
              {
                "blocks": [
                  {
                    "application": "In practice, a request is turned into nodes by walking the loop in order and closing each node on the gate it owes. The objective is stated before anything is examined, and the admissible ways of reaching it are ranked, so intent yields a ranking with more than one entry. A protocol is selected by comparing the transition the request asks for with what each protocol is for, and the reason is recorded. Every gate is typed to the shape its decision yields, and a refuted claim goes back to derive with its evidence, rather than forward with a caveat.",
                    "boundary": "A descriptive artifact, such as a reference, a note or a contract, is read rather than walked, and forcing the full loop onto it fits it to a shape it does not have. Only an artifact that will be walked takes every node.",
                    "cause": "A trigger word is the cheapest possible match and the least reliable one, because the same word appears in requests that have nothing else in common.",
                    "decision": "The structure is derived from the transition the request asks for, rather than from the words it uses.",
                    "failureMode": "A request to analyze a plan is routed to the analysis protocol because it said analyze, but the plan needed a decision between two designs, and the output is a thorough analysis of the wrong question.",
                    "kind": "lesson",
                    "principle": "For this reason I treat the words of a request as evidence about it, never as its subject.",
                    "problem": "A structure chosen from a trigger word answers the word rather than the request.",
                    "validation": "To check this, name for each node the stage it realises and the shape its gate yields. A gate that owes a ranking and returns a yes has folded, and a protocol whose selection cites a word rather than a reason was matched, not chosen."
                  },
                  {
                    "kind": "text",
                    "text": "The four gates the loop names never fold, whatever the size of the task, and a document writes each as a typed gate. Worth is a ranking with more than one entry, as described in [worth before work](/disciplined-methodology/plan#worth-before-work). Admissibility is asked after the operations exist. Evidence is a non-empty set, and finding no contradiction is not evidence. Termination requires saturation, completion and [verification](/ontology#arch-verification) together. Every other node runs when the subject calls for it."
                  },
                  {
                    "kind": "text",
                    "text": "The reason for a selection travels with it, so a reader can contest it."
                  },
                  {
                    "code": "# the ten nodes · each closes on the gate it owes, and each reads only the prior node's output\n# NODE 1 — ORIENT      [epistemic · ontology · set-theory · yields: set]\n@purpose: \"name what exists before anything is done with it\"\nCONTRACT:\n  input:     <the declaration's objective>\n  transform: READ_RESOURCE <the governing documents> INTO <authority>; DISCOVER_RESOURCES \"<pattern>\" INTO <what exists>\n  output:    <what exists>, under <authority>\nHANDOFF GATE:\n  [check] <authority> read before any claim (evidence: the read precedes the first claim)\n  [check] every claim about the tree has a location (evidence: no claim without a path)\n  [check] <what exists> is non-empty, or the empty set is reported (evidence: a count, or the report)\n  result: pass → NODE 2 | unlocated claim → REPAIR (owner: NODE 1) | unknown → BLOCKED\n\n# NODE 2 — INTENT      [conative · teleology · optimisation · yields: ranking]\n@purpose: \"decide what is worth doing before any effort is spent\"\nCONTRACT:\n  input:     <what exists> from NODE 1\n  transform: SET <objective> = \"<one sentence the result is checked against>\"; COMPOSE_ARTIFACT <branches> FROM <objective>; RANK <branches> BY <utility minus cost> INTO <ranked>\n  output:    <ranked>, and the chosen branch\nHANDOFF GATE:\n  [check] <objective> is one sentence a result can be checked against (evidence: the sentence)\n  [check] <ranked> holds more than one admissible branch (evidence: a count above one) over: <branches> measured: <admissible> / <branches>\n  [check] the chosen branch is the first of <ranked> (evidence: the ranking)\n  result: pass → NODE 3 | one branch → REPAIR (owner: NODE 2) | unknown → BLOCKED\n\n# NODE 3 — SEE         [epistemic · analysis · graph · yields: edge-list]\nCONTRACT:\n  input:     <what exists> from NODE 1, under the chosen branch\n  transform: ANALYZE_CONTENT <what exists> AGAINST <the lenses the subject warrants> INTO <observations>\n  output:    <observations>\nHANDOFF GATE:\n  [check] every observation names its lens (evidence: one lens per entry) over: <observations> measured: <lensed> / <observations>\n  [check] every observation has a location (evidence: no entry without a path)\n  result: pass → NODE 4 | unlensed observation → REPAIR (owner: NODE 3) | unknown → BLOCKED\n\n# NODE 4 — DERIVE      [epistemic · reasoning · logic · yields: boolean]\nCONTRACT:\n  input:     <observations> from NODE 3\n  transform: EXTRACT_FACTS <claims> FROM <observations> INTO <claims>\n  output:    <claims>\nHANDOFF GATE:\n  [check] every claim names the observation it rests on (evidence: a source per claim) over: <claims> measured: <sourced> / <claims>\n  [check] no claim rests on prior knowledge (evidence: every source is in <observations>)\n  result: pass → NODE 5 | unsourced claim → REPAIR (owner: NODE 3) | unknown → BLOCKED\n\n# NODE 5 — PROJECT     [epistemic · reasoning · graph · yields: edge-list]\nCONTRACT:\n  input:     <claims> from NODE 4\n  transform: COMPOSE_ARTIFACT <plan> FROM <claims> USING <dependency order>\n  output:    <plan>\nHANDOFF GATE:\n  [check] <plan> is acyclic (evidence: a topological order exists)\n  [check] every step of <plan> names its inputs and outputs (evidence: no empty contract) over: <plan> steps measured: <contracted> / <steps>\n  result: pass → NODE 6 | a cycle → REPAIR (owner: NODE 5) | unknown → BLOCKED\n\n# NODE 6 — ACT         [epistemic · formalisation · computation · yields: procedure]\nCONTRACT:\n  input:     <plan> from NODE 5\n  transform: EXECUTE_TOOL <plan> INTO <realised>\n  output:    <realised>\nHANDOFF GATE:\n  [check] every step ran or is reported as blocked (evidence: one status per step) over: <plan> steps measured: <ran or blocked> / <steps>\n  [check] every step traces to the chosen branch (evidence: the trace)\n  [check] <realised> names every artifact a step produced (evidence: one entry per step)\n  refuse: a step that would write outside the chosen branch before EXECUTE_TOOL\n  result: pass → NODE 7 | untraced step → REPAIR (owner: NODE 6) | unknown → BLOCKED\n\n# NODE 7 — CONSTRAIN   [conative · teleology · optimisation · yields: boolean]\nCONTRACT:\n  input:     <realised> from NODE 6\n  transform: VALIDATE_ARTIFACT <realised> AGAINST <the chosen branch's cost and the hard limits>\n  output:    the admissibility verdict\nHANDOFF GATE:\n  [check] nothing ran outside the chosen branch (evidence: every step traces to it) over: <realised> measured: <inside> / <steps>\n  [check] the realised cost is within the branch's cost (evidence: the two numbers)\n  [check] no step crossed a hard limit (evidence: the limits, each checked)\n  result: pass → NODE 8 | a limit crossed → REPAIR (owner: NODE 5) | unknown → BLOCKED\n\n# NODE 8 — VERIFY      [evaluative · verification · logic · yields: boolean]\nCONTRACT:\n  input:     <claims> from NODE 4, and <realised> from NODE 6\n  transform: VALIDATE_ARTIFACT every <claim> AGAINST <evidence>\n  output:    the verdicts\nHANDOFF GATE:\n  [check] evidence non-empty for every claim (evidence: the evidence set) over: <claims> measured: <evidenced> / <claims>\n  [check] every claim names its refuter (evidence: one refuter per claim)\n  [check] no claim rests on the absence of a contradiction (evidence: each claim's evidence is an observation)\n  standing: moved-set <the surfaces that changed since NODE 3>\n  result: pass → NODE 9 | refuted → REPAIR (owner: NODE 4) | unknown → BLOCKED\n\n# NODE 9 — COMMIT      [evaluative · representation · information-theory · yields: artifact]\nCONTRACT:\n  input:     the verdicts from NODE 8\n  transform: PERSIST_ARTIFACT <result> TO <the surface the next cycle reads>\n  output:    <result>\n  freshness: fingerprint(<claims>) + fingerprint(<realised>)\nHANDOFF GATE:\n  [check] <result> persisted where the next cycle reads (evidence: a read returns it)\n  [check] <result> carries its derivations (evidence: the evidence set travels with it) over: <claims> measured: <carried> / <claims>\n  [check] nothing earlier was rewritten by the commit (evidence: a witness read)\n  refuse: <the surface the next cycle reads> changed since it was read before PERSIST_ARTIFACT\n  result: pass → NODE 10 | a rewrite → REPAIR (owner: NODE 9) | unknown → BLOCKED\n\n# NODE 10 — TERMINATE  [evaluative · termination · set-theory · yields: boolean]\nCONTRACT:\n  input:     <result> from NODE 9\n  transform: VALIDATE_ARTIFACT <result> AGAINST <saturated, complete, verified>\n  output:    the stop\nHANDOFF GATE:\n  [check] saturated · nothing remains to examine (evidence: the open set is empty) over: the open set measured: <examined> / <open>\n  [check] complete · the objective sentence reads true against the tree (evidence: the sentence, checked)\n  [check] verified · every claim passed NODE 8 (evidence: the verdicts)\n  result: pass → TERMINATE | not saturated → REPAIR (owner: NODE 1) | unknown → BLOCKED",
                    "kind": "code",
                    "language": "pag",
                    "title": "ten nodes"
                  },
                  {
                    "code": "# selection by semantic fit · never by a word in the request\nANALYZE <request> AGAINST <each protocol's use-when> INTO <fit>\nFOR EACH <protocol> IN <protocols>:\n    IF <fit>[<protocol>].<semantic-match>:\n        APPEND <protocol> TO <selected> WITH reason: <fit>[<protocol>].<reason>\n\n# what a trigger word would have done\n# \"analyze\" in the request → the analysis protocol, whatever the request was for",
                    "kind": "code",
                    "language": "pag",
                    "title": "selection by fit"
                  },
                  {
                    "code": "# a decision typed to its shape · a gate owing a ranking is not satisfied by a yes\nHANDOFF GATE (evidence-bearing):\n  rule_id: \"INTENT\"      yields: ranking\n  [check] the chosen branch is the argmax over admissible branches (evidence: the ranking)\n  [check] more than one branch was admissible (evidence: a count above one)\n  [check] every branch carries what it advances and what it costs (evidence: no branch with an empty field)\n  result: pass → NODE 3 | one branch → REPAIR (owner: NODE 2) | unknown → BLOCKED\n\nHANDOFF GATE (evidence-bearing):\n  rule_id: \"VERIFY\"      yields: boolean\n  [check] the evidence set is non-empty for every claim (evidence: the set) over: <claims> measured: <evidenced> / <claims>\n  [check] every claim names what would refute it (evidence: one refuter per claim)\n  [check] every claim's evidence is an observation, never an absence (evidence: each entry's source)\n  result: pass → NODE 9 | refuted → REPAIR (owner: NODE 4) | unknown → BLOCKED\n\nHANDOFF GATE (evidence-bearing):\n  rule_id: \"TERMINATE\"   yields: boolean\n  [check] saturation (evidence: the open set is empty) over: the open set measured: <examined> / <open>\n  [check] completion (evidence: the objective sentence, checked against the tree)\n  [check] verification (evidence: every claim's verdict)\n  result: pass → TERMINATE | not saturated → REPAIR (owner: NODE 1) | unknown → BLOCKED",
                    "kind": "code",
                    "language": "pag",
                    "title": "typed gates"
                  },
                  {
                    "caption": "the loop",
                    "kind": "mermaid",
                    "text": "flowchart TB\n    orient[\"Orient · what exists\"]\n    intent[\"Intent · worth, a ranking\"]\n    see[\"See · lenses\"]\n    derive[\"Derive · claims\"]\n    project[\"Project · an ordered plan\"]\n    act[\"Act · procedures\"]\n    constrain[\"Constrain · admissible?\"]\n    verify[\"Verify · evidence\"]\n    commit[\"Commit · an artifact\"]\n    terminate[\"Terminate · stop?\"]\n    orient --> intent -- gate --> see --> derive --> project --> act --> constrain -- gate --> verify -- gate --> commit --> terminate\n    verify -. refuted, with the evidence .-> derive\n    terminate -- gate --> orient"
                  },
                  {
                    "caption": "fit, not word",
                    "kind": "mermaid",
                    "text": "flowchart LR\n    request[\"A request\"]\n    word[\"A trigger word · analyze, choose, debug\"]\n    fit[\"Semantic fit · the transition requested against each protocol's use-when\"]\n    wrong[\"The protocol the word names\"]\n    right[\"The protocol the transition needs, with its reason\"]\n    request -. the cheap path .-> word --> wrong\n    request --> fit --> right"
                  }
                ],
                "title": "Walk the loop, select by fit"
              }
            ],
            "title": "From intent to structure"
          },
          {
            "icon": "bi-arrow-repeat",
            "id": "genesis-stages",
            "intro": "This section covers the genesis stage every node carries. The stage is derived from the node's verb rather than chosen, as shown in [verb to stage], because the verb names where in the substrate cycle the node's artifact comes to be; [genesis stages] lists the stages, so one word decides the node's legal position. A protocol is a chain of such verbs, and [protocols] shows four. A protocol is selected as described in [from intent to structure](/pag/patterns#intent-to-structure) and shown in [request to nodes], and a document instantiates its chain as tagged, gated nodes in genesis order, as shown in [chain expanded].",
            "subsections": [
              {
                "blocks": [
                  {
                    "application": "In practice, every node is tagged with the stage its verb derives, and a chosen chain is expanded into nodes in genesis order, each with a contract that reads the previous output and a gate of its own, and the [verification](/ontology#arch-verification) gate protocol closes the chain. Where a node's stage disagrees with its verb, the node is mislabelled, and where a node depends on a later genesis than it produces, the order is wrong.",
                    "boundary": "A one-step task has no chain to instantiate. A single read with a single gate is a directive, and tagging it adds a name to nothing.",
                    "cause": "A verb is a contract about what a node does, so a stage written beside it is a second declaration of the same fact, and a catalogue of roles beside the verbs is a second vocabulary that the ontology does not carry.",
                    "decision": "The stage is derived from the verb's grounding in the substrate cycle, rather than written as a role label beside the verb.",
                    "failureMode": "A node's tag says structure while its only directive reads a file, and the reviewer approves a build step that builds nothing.",
                    "kind": "lesson",
                    "principle": "For this reason the header carries one dialect, and nothing is written beside the verb that the verb already says.",
                    "problem": "A node labelled by hand carries a role its verb does not derive.",
                    "validation": "To check this, read each node's verb and state the stage it implies. A stage that does not follow from the verb was written by hand, and a header whose bracket carries anything other than the layer, the axis, the math type and the yields is a second dialect."
                  },
                  {
                    "kind": "text",
                    "text": "The stage is a tag beneath the header, so a reader can see a document's construction order from its tags alone while the header keeps one shape. The header's four slots, the layer, the axis, the math type and the yields, come from [the loop](/disciplined-methodology#the-loop), and the same verb names the genesis stage used to order the nodes, as described in [node design](/pag/guide#node-design). Every action verb grounds to a reasoning record and the stage follows from that record, so a verb grounded in observation realises existence, one grounded in construction realises structure, and one grounded in a verification node realises constraint, which makes the derivation a lookup rather than a judgement."
                  },
                  {
                    "kind": "text",
                    "text": "A protocol is a chain with a use-when and the principles it serves. The use-when names the transition the chain is for, from one state of the tree to another, and the principles name what the chain must leave true, so a selected protocol carries its own acceptance criteria into the nodes it expands to. The verification gate protocol is appended to every plan, because every plan ends by checking its own reasoning against the tree."
                  },
                  {
                    "code": "# a genesis stage · where in the substrate cycle a node's artifact comes to be, derived from its verb\nexistence       FIND, READ, DISCOVER_RESOURCES, READ_RESOURCE     does the thing exist, is it scaffolded\ndifference      ANALYZE, FILTER, SPLIT, REMOVE                    what boundary makes it distinct\nrelation        EXTRACT, LINK, SEARCH_CONTENT, EXTRACT_FACTS      what it depends on and connects to\nstructure       CREATE, INSERT, COMPOSE_ARTIFACT                  how its parts are arranged under its laws\ntransformation  EXECUTE, CONVERT, ITERATE, EXECUTE_TOOL           what operation it performs\nconstraint      VERIFY, VALIDATE, ENFORCE, VALIDATE_ARTIFACT      what invariants and gates bound it\nemergence       FINALIZE, REPORT, PERSIST_ARTIFACT, REPORT_RESULT does it integrate and stabilise\n\n# the stage is a tag on the node, beneath the header's four slots · one dialect, one header shape\n# NODE <n> — <NAME>   [<layer> · <axis> · <math type> · yields: <shape>]\n@genesis: <existence | difference | relation | structure | transformation | constraint | emergence>",
                    "kind": "code",
                    "language": "pag",
                    "title": "genesis stages"
                  },
                  {
                    "code": "# a protocol · a verb chain with the transition it is for and the principles it serves\n<separate-a-unit>:\n    use_when:   \"a unit mixes concerns or exceeds a bounded complexity\"\n    chain:      ANALYZE → FIND → EXTRACT → CREATE → VERIFY\n    principles: [<the principles it serves>]\n\n<extend-without-modifying>:\n    use_when:   \"a new variant extends a stable system\"\n    chain:      ANALYZE → FIND → CREATE → LINK → VERIFY\n    principles: [<the principles it serves>]\n\n<replace-a-path>:\n    use_when:   \"an existing production path is replaced\"\n    chain:      FIND → ANALYZE → CREATE → EXECUTE → VERIFY\n    principles: [<the principles it serves>]\n\n<author-an-enforcement>:\n    use_when:   \"a new invariant needs automated protection\"\n    chain:      ANALYZE → CREATE → LINK → EXECUTE → VERIFY\n    principles: [<the principles it serves>]\n\n<verification-gate>:                     # always appended · every plan ends in it\n    use_when:   \"every plan requires a final reasoning and checklist validation\"\n    chain:      ANALYZE → VERIFY → REPORT\n    principles: [<every active principle>]",
                    "kind": "code",
                    "language": "pag",
                    "title": "protocols"
                  },
                  {
                    "code": "# a chain expanded into nodes · each header carries its layer, axis, math type and yields, and each node its genesis stage\n# NODE 1 — ANALYZE THE UNIT       [epistemic · analysis · logic · yields: set]\n@genesis: difference\n# NODE 2 — FIND THE SEAMS         [epistemic · ontology · set-theory · yields: set]\n@genesis: existence\n# NODE 3 — EXTRACT THE CONCERN    [epistemic · reasoning · graph · yields: edge-list]\n@genesis: relation\n# NODE 4 — CREATE THE NEW UNIT    [epistemic · formalisation · computation · yields: procedure]\n@genesis: structure\n# NODE 5 — VERIFY THE SPLIT       [evaluative · verification · logic · yields: boolean]\n@genesis: constraint\n\n# the stage is derived from the verb · a node whose stage disagrees with its verb is mislabelled\n# a node that depends on a later genesis than it produces is a genesis inversion",
                    "kind": "code",
                    "language": "pag",
                    "title": "chain expanded"
                  },
                  {
                    "caption": "verb to stage",
                    "kind": "mermaid",
                    "text": "flowchart TB\n    verb[\"A node's verb\"]\n    ground[\"The reasoning record the verb grounds to\"]\n    genesis[\"Its genesis stage · the position in how the artifact comes to be\"]\n    order[\"The order of the nodes · no node depends on a later stage than it produces\"]\n    verb --> ground\n    verb --> genesis --> order"
                  },
                  {
                    "caption": "request to nodes",
                    "kind": "mermaid",
                    "text": "flowchart LR\n    request[\"A request\"]\n    transition[\"The transition it asks for · from one state of the tree to another\"]\n    fit[\"Semantic fit against each protocol's use-when\"]\n    chain[\"The chosen chain, with its reason\"]\n    nodes[\"Nodes · each with its stage, each closed by a gate\"]\n    gate[\"The verification gate protocol · always last\"]\n    request --> transition --> fit --> chain --> nodes --> gate"
                  }
                ],
                "title": "Derived from the verb"
              }
            ],
            "title": "Genesis stages"
          },
          {
            "icon": "bi-code-square",
            "id": "algorithm-examples",
            "intro": "This section shows three algorithms, each a protocol instantiated: [separate a unit], [author an enforcement] and [verification gate]. In each, the chain is expanded into nodes, every node is headed by its layer, axis, math type and yields and tagged with its [genesis stage](/pag/patterns#genesis-stages), every contract reads the previous node's output and ends on a gate that carries evidence, and every placeholder is bound to the task's own nouns. [beyond the chain] shows what every instance carries beyond its chain, and [transfers or bound] shows what transfers between instances and what is bound per task.",
            "subsections": [
              {
                "blocks": [
                  {
                    "application": "In practice, the chain is written above the nodes with the reason it was chosen, so a reader sees the protocol before the instance. The chain is expanded into one node per verb, each node is tagged with the stage its verb derives, and each placeholder is bound to a noun from the task, so no placeholder survives into the document. Each node has a contract whose input names the previous output, and it closes on three to five checks that name its output, the evidence that settles each check and the set that at least one check ranged over. A failure is routed to the earliest node that can supply the missing evidence and an unknown to blocked, every write is preceded by a refusal, an empty result is a finding rather than a silent skip, and every command and location is named as a slot the adapter resolves.",
                    "boundary": "A node with two decisions is two nodes, and the examples are not a license to collapse them.",
                    "cause": "The chain is the protocol's contract and the gates are how the contract is checked, so the two transfer together and the nouns do not.",
                    "decision": "The task's nouns are bound into the protocol's shape, rather than an example being edited until it fits.",
                    "failureMode": "A seam search returns nothing, the node is skipped without an entry, the extraction runs over an empty set, and the count that would have exposed the gap is taken over the wrong population.",
                    "kind": "lesson",
                    "principle": "For this reason an algorithm is treated as an instance of a protocol, never as a copy of another algorithm.",
                    "problem": "An algorithm copied from an example keeps the example's nouns and loses the task's.",
                    "validation": "To check this, look for a placeholder that survived into the document, a node whose stage disagrees with its verb, a contract whose input names nothing from its predecessor, or a gate whose count is taken over a set smaller than the one it claims. Any of the four marks an instance that was copied rather than bound."
                  },
                  {
                    "kind": "text",
                    "text": "In the first instance, the seam gate reports an empty set of seams as a unit that does not split, because a pass over an empty population measures nothing, and the population shown beside the verdict is what makes that visible. The repair owner on the extraction gate is the seam node, because a bad extraction usually comes from a bad seam."
                  },
                  {
                    "kind": "text",
                    "text": "The second instance is the shape every rule held by attention takes before it can be trusted. The analysis names a shape rather than an instance, because a check that names an instance fails on the next case. The check is proven to fire as described in [the check comes first](/disciplined-methodology/build#the-check-comes-first), and a failure there routes back to the node that composed the check, not to the probe; the probe's own write is refused wherever it would land on a real file."
                  },
                  {
                    "kind": "text",
                    "text": "The third instance is appended to every plan rather than chosen. Its gate is the evidence gate described in [from intent to structure](/pag/patterns#intent-to-structure), applied to the plan's own reasoning, and its standing line names what moved beneath the plan while it was being checked."
                  },
                  {
                    "code": "# <separate-a-unit> · ANALYZE → FIND → EXTRACT → CREATE → VERIFY\n# chosen because the request asks to split a unit that mixes two concerns\n\n# NODE 1 — ANALYZE THE UNIT       [epistemic · analysis · logic · yields: set]\n@genesis: difference\nCONTRACT:\n  input:     <unit>\n  transform: READ_RESOURCE <unit> INTO <source>; ANALYZE_CONTENT <source> AGAINST <responsibilities> INTO <concerns>\n  output:    <concerns>, each naming the lines that carry it\nHANDOFF GATE:\n  [check] <source> read from <unit> (evidence: the read returned content)\n  [check] <concerns> holds more than one entry (evidence: a count above one) over: <source> lines measured: <assigned> / <lines>\n  [check] every <concern> names its lines (evidence: no concern with an empty range)\n  result: pass → NODE 2 | unread → REPAIR (owner: NODE 1) | unknown → BLOCKED\n\n# NODE 2 — FIND THE SEAMS         [epistemic · ontology · set-theory · yields: set]\n@genesis: existence\nCONTRACT:\n  input:     <concerns> from NODE 1\n  transform: SEARCH_CONTENT <source> FOR <boundaries between concerns> INTO <seams>\n  output:    <seams>\nHANDOFF GATE:\n  [check] every <seam> lies between two <concerns> (evidence: two concern ids per seam) over: <seams> measured: <between two> / <seams>\n  [check] no <seam> cuts a single statement (evidence: each seam on a statement boundary)\n  [check] <seams> is non-empty, or the unit is reported as one that does not split (evidence: a count, or the report)\n  result: pass → NODE 3 | does not split → TERMINATE | unknown → BLOCKED\n\n# NODE 3 — EXTRACT THE CONCERN    [epistemic · reasoning · graph · yields: edge-list]\n@genesis: relation\nCONTRACT:\n  input:     <seams> from NODE 2\n  transform: EXTRACT_FACTS <concern> FROM <source> INTO <extracted>\n  preserves: every reference between <extracted> and the rest\n  output:    <extracted>, and every reference between it and the rest\nHANDOFF GATE:\n  [check] <extracted> carries every line of <concern> (evidence: the line ranges match) over: <concern> lines measured: <carried> / <lines>\n  [check] <source> minus <extracted> carries the rest (evidence: the two ranges partition the source)\n  [check] every reference between the two is named (evidence: an edge per reference)\n  result: pass → NODE 4 | partition broken → REPAIR (owner: NODE 2) | unknown → BLOCKED\n\n# NODE 4 — CREATE THE NEW UNIT    [epistemic · formalisation · computation · yields: artifact]\n@genesis: structure\nCONTRACT:\n  input:     <extracted> from NODE 3\n  transform: COMPOSE_ARTIFACT <new-unit> FROM <extracted> USING <the shape units take here>; PERSIST_ARTIFACT <new-unit> TO <destination>\n  output:    <new-unit>\n  freshness: fingerprint(<extracted>) + fingerprint(this document)\nHANDOFF GATE:\n  [check] <new-unit> persisted (evidence: a read of <destination> returns it)\n  [check] <new-unit> declares what it imports from <unit> (evidence: the import list) over: references measured: <declared> / <references>\n  [check] <unit> declares what it imports from <new-unit> (evidence: the import list)\n  refuse: <destination> exists and was not read before PERSIST_ARTIFACT\n  result: pass → NODE 5 | undeclared import → REPAIR (owner: NODE 4) | unknown → BLOCKED\n\n# NODE 5 — VERIFY THE SPLIT       [evaluative · verification · logic · yields: boolean]\n@genesis: constraint\nCONTRACT:\n  input:     <new-unit> from NODE 4\n  transform: EXECUTE_TOOL {toolchain.verify_command} INTO <verdict>; VALIDATE_ARTIFACT <verdict> AGAINST <green on one full run>\n  output:    <verdict>\nHANDOFF GATE:\n  [check] <verdict> green on one full run (evidence: the run's own output) over: the run's steps measured: <green> / <steps>\n  [check] no circular dependency between <unit> and <new-unit> (evidence: the import graph)\n  [check] every consumer of <unit> resolves (evidence: the typecheck)\n  refuse: a run that would mutate the tree before EXECUTE_TOOL\n  standing: moved-set <the files changed since NODE 4>\n  result: pass → TERMINATE | red → REPAIR (owner: NODE 3) | unknown → BLOCKED",
                    "kind": "code",
                    "language": "pag",
                    "title": "separate a unit"
                  },
                  {
                    "code": "# <author-an-enforcement> · ANALYZE → CREATE → LINK → EXECUTE → VERIFY\n# chosen because a rule held by attention needs a check that holds it\n\n# NODE 1 — ANALYZE THE SHAPE      [epistemic · analysis · logic · yields: set]\n@genesis: difference\nCONTRACT:\n  input:     <the violations seen so far>\n  transform: ANALYZE_CONTENT <the violations> AGAINST <the shape they share> INTO <shape>\n  output:    <shape>, with its one fix\nHANDOFF GATE:\n  [check] <shape> names a structure, never an instance (evidence: no vendor, symbol or path in it)\n  [check] every violation seen is an instance of <shape> (evidence: one match per violation) over: <the violations> measured: <matched> / <violations>\n  [check] one fix is stated for <shape> (evidence: the fix sentence)\n  result: pass → NODE 2 | instance named → REPAIR (owner: NODE 1) | unknown → BLOCKED\n\n# NODE 2 — CREATE THE CHECK       [epistemic · formalisation · computation · yields: artifact]\n@genesis: structure\nCONTRACT:\n  input:     <shape> from NODE 1\n  transform: COMPOSE_ARTIFACT <check> FROM <shape> USING <the form checks take here>; PERSIST_ARTIFACT <check> TO {project.rule_home}\n  output:    <check>\n  freshness: fingerprint(<shape>) + fingerprint(this document)\nHANDOFF GATE:\n  [check] <check> persisted (evidence: a read of {project.rule_home} returns it)\n  [check] <check> reports <shape> and states its fix (evidence: its message)\n  [check] <check> names no vendor, symbol or path (evidence: a scan of its literals) over: its literals measured: <neutral> / <literals>\n  refuse: {project.rule_home} already holds a check of that name before PERSIST_ARTIFACT\n  result: pass → NODE 3 | instance literal → REPAIR (owner: NODE 2) | unknown → BLOCKED\n\n# NODE 3 — LINK THE CHECK         [epistemic · reasoning · graph · yields: edge-list]\n@genesis: relation\nCONTRACT:\n  input:     <check> from NODE 2\n  transform: LINK <check> TO <the registry the gate reads>\n  output:    the registry entry\nHANDOFF GATE:\n  [check] <check> resolves from the registry (evidence: a lookup returns it)\n  [check] <check> is active (evidence: the entry)\n  [check] nothing else in the registry changed (evidence: a diff of the entries) over: registry entries measured: <unchanged> / <entries>\n  result: pass → NODE 4 | unresolved → REPAIR (owner: NODE 3) | unknown → BLOCKED\n\n# NODE 4 — PROVE IT FIRES         [epistemic · formalisation · analysis · yields: procedure]\n@genesis: transformation\nCONTRACT:\n  input:     the registry entry from NODE 3\n  transform: PERSIST_ARTIFACT  TO ; EXECUTE_TOOL {toolchain.lint_command} INTO <report>; RESTORE \n  output:    <report>\nHANDOFF GATE:\n  [check] <report> names  under <check> (evidence: the report line)\n  [check] <report> carries the expected message (evidence: the message text)\n  [check]  restored (evidence: a read returns the original) over: probes measured: <restored> / <planted>\n  refuse:  names a real file before PERSIST_ARTIFACT\n  result: pass → NODE 5 | silent → REPAIR (owner: NODE 2) | unknown → BLOCKED\n\n# NODE 5 — VERIFY THE TREE        [evaluative · verification · logic · yields: boolean]\n@genesis: constraint\nCONTRACT:\n  input:     <report> from NODE 4\n  transform: EXECUTE_TOOL {toolchain.verify_command} INTO <verdict>; VALIDATE_ARTIFACT <verdict> AGAINST <green on one full run>\n  output:    <verdict>\nHANDOFF GATE:\n  [check] <verdict> green on one full run (evidence: the run's own output)\n  [check] every real occurrence of <shape> repaired in this change (evidence: the check reports none) over: occurrences measured: <repaired> / <occurrences>\n  [check] <check> caught each of them before the repair (evidence: the first run's report)\n  refuse: a run that would mutate the tree before EXECUTE_TOOL\n  standing: moved-set <the files changed since NODE 2>\n  result: pass → TERMINATE | occurrence remains → REPAIR (owner: NODE 1) | unknown → BLOCKED",
                    "kind": "code",
                    "language": "pag",
                    "title": "author an enforcement"
                  },
                  {
                    "code": "# <verification-gate> · ANALYZE → VERIFY → REPORT · appended to every plan\n\n# NODE N — VERIFY THE REASONING   [evaluative · verification · logic · yields: boolean]\n@genesis: constraint\nCONTRACT:\n  input:     every node above\n  transform: ANALYZE_CONTENT <every gate above> AGAINST  INTO <weak-gates>; VALIDATE_ARTIFACT every <claim> IN <the plan> AGAINST <the tree>; REPORT_RESULT <verdict> TO <the parties whose next work it creates>\n  output:    <verdict>, with every gate, its evidence, and what it reached\nHANDOFF GATE:\n  [check] <weak-gates> is empty (evidence: a count of zero) over: <every gate above> measured: <sound> / <gates>\n  [check] every <claim> supported by evidence, none by the absence of a contradiction (evidence: an evidence entry per claim)\n  [check] <verdict> names what the run reached before what it found (evidence: the report's first line)\n  standing: moved-set <the surfaces re-read since the plan began>\n  result: pass → TERMINATE | weak gate → REPAIR (owner: the earliest node whose gate is weak) | unknown → BLOCKED",
                    "kind": "code",
                    "language": "pag",
                    "title": "verification gate"
                  },
                  {
                    "caption": "beyond the chain",
                    "kind": "mermaid",
                    "text": "flowchart TB\n    chain[\"A verb chain\"]\n    nodes[\"Nodes · one per verb, tagged with the stage its verb derives\"]\n    contract[\"A contract · reads the prior output, yields one record\"]\n    gate[\"A gate · three to five checks over the node's output, each with its evidence and its set\"]\n    empty[\"An empty result is a finding · never a skip\"]\n    slot[\"A command or a location is a slot · the adapter resolves it\"]\n    chain --> nodes --> contract --> gate\n    gate --> empty\n    nodes --> slot"
                  },
                  {
                    "caption": "transfers or bound",
                    "kind": "mermaid",
                    "text": "flowchart LR\n    transfers[\"Transfers to any task of the shape · the chain, the tags, the contract and gate shape\"]\n    bound[\"Bound per task · the nouns, the sources, the thresholds\"]\n    instance[\"An instance\"]\n    example[\"An example · another task's nouns still inside\"]\n    transfers --> instance\n    bound --> instance\n    transfers -. nouns not rebound .-> example"
                  }
                ],
                "title": "Three instances"
              }
            ],
            "title": "Algorithm examples"
          },
          {
            "icon": "bi-gear-wide-connected",
            "id": "algorithm-integration",
            "intro": "This section covers the two ways protocols connect to work. Instantiation takes a request to a chain of nodes, in the order shown in [instantiation order] and written in [instantiation]: the transition the request asks for is named, the protocol is chosen by fit, its placeholders are bound to the task's nouns, and its chain is expanded into tagged nodes, each with a contract and a gate. Distillation takes repeated behaviour to one shared base, and it is a document type of its own. It is an epistemology walked on the reasoning axis, gated on evidence that the base is universal, invariant, foundational, enforceable and load-reducing, the five properties named in [boundary principles]. A distillation is incomplete until the old pattern is proven gone, as shown in [distillation order], and [distillation] is the grammar's own template for it.",
            "subsections": [
              {
                "blocks": [
                  {
                    "application": "In practice, instantiation names the transition first, chooses the protocol whose use-when fits it and records the reason, binds each placeholder to a noun the task owns, and expands the chain into nodes whose contracts read the previous output and whose gates carry three to five checks with evidence. Distillation starts only after what exists has been measured and the candidates ranked by worth. Every class is signed from its behaviour, each of the five boundary principles is proven with the evidence that shows it, the base is composed within its size limit, each target is migrated reversibly starting from the simplest, and the whole scope is scanned for the old pattern before anything is declared complete.",
                    "boundary": "Distillation decides whether a shared base is justified, and when a shape earns a template at all is described in [core templates](/pag/templates#templates-core).",
                    "cause": "A base is a promise that every future instance shares one behaviour, and a promise made from one instance or from a naming resemblance has nothing to be checked against.",
                    "decision": "The classes are signed from their behaviour and the five principles decide, rather than a base being raised from what the names have in common.",
                    "failureMode": "A base is raised from two classes whose names rhyme, three later classes are forced to extend it, and each one overrides most of what it inherited because the shared half was the name.",
                    "kind": "lesson",
                    "principle": "For this reason a shared base has to be earned by behaviour shown in more than one place, and a resemblance between names earns nothing.",
                    "problem": "A base promoted from one instance, or from a resemblance, carries that instance's accidents into everything that extends it.",
                    "validation": "To check this, name for a base the second instance that justified it, the behavioural signature each class was signed with, and the evidence behind each of the five principles. A base with one instance, a signature based on names, or an unproven principle is a base its next class overrides more than it inherits."
                  },
                  {
                    "kind": "text",
                    "text": "The transition comes first because the protocol is selected by it, as described in [from intent to structure](/pag/patterns#intent-to-structure), and instantiation ends when no placeholder survives."
                  },
                  {
                    "kind": "text",
                    "text": "Distillation measures before it proposes, because a missing adoption of an existing base looks like a missing [abstraction](/ontology#arch-abstraction) until the registry has been read. A class's signature covers initialisation, lifecycle, [error handling](/ontology#arch-error-handling), state and dependencies. The base consists of concrete responsibilities plus abstract hooks, which is the [template method pattern](/ontology#arch-template-method-pattern), and a single stray occurrence outside the approved locations is a refutation whose result line routes back to composition. The last gate measures the reduction rather than asserting it, so the [single source of truth](/ontology#arch-single-source-of-truth) for which bases exist is the registry, never the memory of the model or the developer that did the distilling."
                  },
                  {
                    "code": "# instantiation · from a request to a gated node chain\n\n# STEP 1: the transition · what state of the tree the request asks for\n    Request:    \"route each incoming request to the handler that owns it\"\n    Transition: \n\n# STEP 2: the protocol · by semantic fit against each use-when, with the reason\n    Chosen:     <resolve-through-a-registry>\n    Reason:     \"keyed resolution is justified · handlers vary, the key does not\"\n    Chain:      ANALYZE → FIND → CREATE → LINK → VERIFY\n\n# STEP 3: the nouns · the task's own, so no placeholder survives\n    <candidates> = the handlers declared in {project.handler_registry}\n    <key>        = <request>.<type>\n\n# STEP 4: the nodes · one per verb, tagged with its stage, each contract reading the prior output\n# NODE 1 — ANALYZE THE REQUESTS   [epistemic · analysis · logic · yields: set]\n@genesis: difference\nCONTRACT:\n  input:     <queue>\n  transform: READ_RESOURCE <queue> INTO <incoming>; EXTRACT_FACTS <type> FROM <incoming> INTO <keys>\n  output:    <keys>, one per request\nHANDOFF GATE:\n  [check] <incoming> read from <queue> (evidence: the read returned requests)\n  [check] a <key> resolved for every <request> (evidence: the two counts match) over: <incoming> measured: <keyed> / <requests>\n  [check] no <request> carries an unknown <type> (evidence: every key in the declared set)\n  result: pass → NODE 2 | unknown type → REPAIR (owner: NODE 1) | unknown → BLOCKED\n\n# NODE 2 — FIND THE HANDLER       [epistemic · ontology · set-theory · yields: set]\n@genesis: existence\nCONTRACT:\n  input:     <keys> from NODE 1\n  transform: FOR EACH <key> IN <keys>: FIND <handler> IN <candidates> WHERE <handler>.<owns> == <key> INTO <matched>\n  output:    <matched>\nHANDOFF GATE:\n  [check] exactly one <handler> per <request> (evidence: the two counts match, no duplicates) over: <keys> measured: <matched> / <keys>\n  [check] every <handler> in <matched> is declared in {project.handler_registry} (evidence: a lookup per handler)\n  [check] an unmatched <request> reported, never dropped (evidence: the report names each)\n  result: pass → NODE 3 | duplicate handler → REPAIR (owner: NODE 2) | unknown → BLOCKED\n\n# NODE 3 — CREATE THE ROUTE       [epistemic · formalisation · computation · yields: procedure]\n@genesis: structure\nCONTRACT:\n  input:     <matched> from NODE 2\n  transform: COMPOSE_ARTIFACT <route> FROM <matched> USING <the route shape here>\n  output:    <route>\nHANDOFF GATE:\n  [check] <route> names its <handler> and its <key> (evidence: both fields non-empty)\n  [check] one <route> per <matched> entry (evidence: the two counts match) over: <matched> measured: <routed> / <entries>\n  [check] <route> conforms to <the route shape here> (evidence: VALIDATE_ARTIFACT passed)\n  result: pass → NODE 4 | nonconforming → REPAIR (owner: NODE 3) | unknown → BLOCKED\n\n# NODE 4 — LINK THE ROUTE         [epistemic · reasoning · graph · yields: edge-list]\n@genesis: relation\nCONTRACT:\n  input:     <route> from NODE 3\n  transform: LINK <route> TO <the dispatch table>\n  output:    the dispatch entry\nHANDOFF GATE:\n  [check] <route> resolves from <the dispatch table> (evidence: a lookup returns it)\n  [check] no earlier <route> for <key> remains (evidence: one entry per key) over: dispatch entries measured: <one per key> / <keys>\n  [check] nothing else in <the dispatch table> changed (evidence: a diff of the entries)\n  result: pass → NODE 5 | stale entry → REPAIR (owner: NODE 4) | unknown → BLOCKED\n\n# NODE 5 — VERIFY THE DISPATCH    [evaluative · verification · logic · yields: boolean]\n@genesis: constraint\nCONTRACT:\n  input:     the dispatch entry from NODE 4\n  transform: EXECUTE_TOOL <route> WITH <request> INTO <response>; PERSIST_ARTIFACT <response> TO <outbox>; EXECUTE_TOOL {toolchain.verify_command} INTO <verdict>; VALIDATE_ARTIFACT <verdict> AGAINST <green on one full run>\n  output:    <verdict>\nHANDOFF GATE:\n  [check] <response> persisted (evidence: a read of <outbox> returns it)\n  [check] <response>.<handled-by> equals <matched>.<handler> (evidence: the two values) over: <requests> measured: <handled by the matched handler> / <requests>\n  [check] <verdict> green on one full run (evidence: the run's own output)\n  refuse: <outbox> changed since it was read before PERSIST_ARTIFACT\n  standing: moved-set <the files changed since NODE 4>\n  result: pass → TERMINATE | wrong handler → REPAIR (owner: NODE 2) | unknown → BLOCKED",
                    "kind": "code",
                    "language": "pag",
                    "title": "instantiation"
                  },
                  {
                    "code": "---\nname: {task_name}\ntype: DISTILLATION\nversion: 1.0.0\n---\n\nTHIS DISTILLATION DISTILLS repeated behavioural evidence into one justified shared abstraction, and is incomplete until the old pattern is proven gone.\n\n%% META %%:\n    priority: BEHAVIORAL_EVIDENCE > BOUNDARY_PRINCIPLES > TASK\n    trust: procedural_scan = TRUSTED, naming_similarity = UNTRUSTED, prior_knowledge = UNTRUSTED\n    objective: {task_description}\n    jurisdiction: {task_description} across the role families {convention.role_taxonomy} names | external: every family the scope does not name\n    recursion_limit: 3\n\n# NODE 1 — ORIENT   [epistemic · ontology · set-theory · yields: set]\n@purpose: \"load the registry and rule sources, probe capabilities, and measure the existing baseline before proposing any base\"\n@genesis: existence\nCONTRACT:\n  input:     {task_description}\n  transform: READ_RESOURCE {project.architecture_registry} INTO registry; READ_RESOURCE {project.rule_sources} INTO rules; EXECUTE_TOOL <capability probes> WITH timeout: <bound> INTO capability; EXTRACT_FACTS <existing bases, implementation counts, hierarchy depth> FROM registry INTO baseline; FOR EACH role IN {convention.role_taxonomy}: ANALYZE_CONTENT <its classes> AGAINST <the expected base> INTO gap\n  constraints: compare against existing bases before proposing a new one; a missing adoption is not a missing abstraction\n  output:    baseline_bundle\nDECLARE baseline_bundle: object\nSET baseline_bundle = {registry: registry, rules: rules, capability: capability, baseline: baseline, gap: <adoption versus abstraction per role>}\nHANDOFF GATE (evidence-bearing):\n  rule_id: \"ORIENT\"   yields: boolean\n  [check] the registry and rule sources are loaded with provenance (evidence: baseline_bundle.registry and rules)\n  [check] the existing architecture is measured (evidence: baseline_bundle.baseline) over: existing bases measured: <measured> / <bases>\n  [check] the compliance gap distinguishes adoption from abstraction (evidence: baseline_bundle.gap)\n  refuse: a probe that would mutate the tree before EXECUTE_TOOL\n  result: pass → NODE 2 | context unavailable → BLOCKED | unknown → BLOCKED\n\n# NODE 2 — INTENT   [conative · teleology · optimisation · yields: ranking]\n@purpose: \"score every candidate anti-pattern by worth and gate on the highest-worth one and its highest-worth remediation before any composition\"\n@genesis: difference\n@mandatory\nCONTRACT:\n  input:     baseline_bundle from NODE 1\n  transform: EXTRACT_FACTS candidate anti-patterns FROM baseline_bundle.gap INTO candidates; FOR EACH candidate IN candidates: CALCULATE_METRIC impact minus effort FROM candidate INTO candidate.worth; FILTER candidates WHERE <not already covered by an existing base>; RANK candidates BY worth\n  constraints: the verdict create-base, prefer-composition, prefer-utility or reject-abstraction is a worth decision, never a reflex\n  output:    selected\nDECLARE selected: object\nSET selected = <the argmax admissible candidate with its remediation verdict, or a redirect to adopting an existing base>\nHANDOFF GATE (tel-priority injection-gate):\n  rule_id: \"INTENT\"   yields: boolean over ranking\n  [check] every candidate carries impact, effort and an admissibility verdict (evidence: candidates) over: candidates measured: <scored> / <candidates>\n  [check] the selected candidate is the argmax of impact minus effort among admissible ones (evidence: the ranking's first entry)\n  [check] no candidate already covered by an existing base is selected (evidence: the coverage filter)\n  result: pass → NODE 3 | none admissible → REPAIR (owner: NODE 1) | unknown → BLOCKED\n\n# NODE 3 — SIGN   [epistemic · analysis · graph · yields: edge-list + boolean]\n@purpose: \"sign each class's behaviour from evidence, surface repeated structure and inconsistency, and reason to the boundary verdict\"\n@genesis: relation\nCONTRACT:\n  input:     selected from NODE 2\n  transform: FOR EACH class IN <the selected role family>: EXTRACT_FACTS <initialization, lifecycle, error handling, state, dependencies, orchestration> FROM class INTO signature; ANALYZE_CONTENT signatures FOR <repeated structure with occurrence counts and competing implementations> INTO patterns; ANALYZE_CONTENT patterns AGAINST <universal, invariant, foundational, enforcing, load-reducing, and domain coverage> INTO verdict\n  constraints: a base needs behavioural evidence, never naming similarity; without sufficient boundary principles the verdict is composition, utility or a local refactor\n  output:    boundary_verdict\nDECLARE boundary_verdict: object\nSET boundary_verdict = {signatures: signatures, patterns: patterns, verdict: verdict}\nHANDOFF GATE (evidence-bearing):\n  rule_id: \"SIGN\"   yields: boolean\n  [check] every class in the family is signed from evidence, not names (evidence: signatures) over: the family measured: <signed> / <classes>\n  [check] repeated structure and inconsistency are surfaced with counts (evidence: patterns)\n  [check] a base verdict rests on sufficient boundary principles and coverage (evidence: boundary_verdict.verdict)\n  result: pass → NODE 4 | insufficient boundary → REPAIR (owner: NODE 2) | unknown → BLOCKED\n\n# NODE 4 — COMPOSE AND MIGRATE   [epistemic · formalisation · computation · yields: procedure]\n@purpose: \"split concrete from abstract, design the template-method lifecycle, compose the base within limits, and migrate targets simple-first and reversibly\"\n@genesis: structure\nCONTRACT:\n  input:     boundary_verdict from NODE 3\n  transform: COMPOSE_ARTIFACT base FROM boundary_verdict USING <concrete constructor, initialize, destroy, handle-error and dependency setup; abstract on-initialize, on-destroy, on-error, configure and execute-core; guard then shared then hook then error policy>; ORDER targets BY ascending complexity then dependency; FOR EACH target IN targets: PERSIST_ARTIFACT  TO <the checkpoint store>; PERSIST_ARTIFACT <the migrated target> TO target; EXECUTE_TOOL {toolchain.verify.execute} WITH timeout: <bound> INTO removal\n  constraints: a base over {limits.max_lines} is split; a failed migration restores its checkpoint; a base whose boundary collapsed or that blew the effort budget is inadmissible\n  preserves: every behaviour signed at NODE 3\n  output:    migration\nDECLARE migration: object\nSET migration = {base: base, targets: <each with checkpoint, outcome and removal verdict>, admissible: <boundary still sufficient, size within limit, effort within budget, every target reversible>}\nHANDOFF GATE (evidence-bearing):\n  rule_id: \"COMPOSE\"   yields: boolean\n  [check] concrete and abstract responsibilities are split and the lifecycle is defined (evidence: base)\n  [check] the base is within {limits.max_lines} with a compliant name and location (evidence: the base's size and path)\n  [check] every target migrated or restored from its checkpoint (evidence: migration.targets) over: targets measured: <migrated> / <targets>\n  [check] the base is admissible (evidence: migration.admissible)\n  refuse: a target whose checkpoint cannot be read back before PERSIST_ARTIFACT\n  result: pass → NODE 5 | inadmissible → REPAIR (owner: NODE 3) | unknown → BLOCKED\n\n# NODE 5 — ELIMINATE   [evaluative · verification · logic + probability · yields: number]\n@purpose: \"prove the old pattern is eliminated across the whole scope from real source, and migrate any straggler reversibly\"\n@genesis: constraint\n@mandatory\nCONTRACT:\n  input:     migration from NODE 4\n  transform: SEARCH_CONTENT <the whole scope> FOR <the old pattern> INTO occurrences; FILTER occurrences WHERE <outside the approved base locations>; CALCULATE_METRIC completeness FROM occurrences INTO completeness; ANALYZE_CONTENT occurrences FOR  INTO refuter\n  constraints: the scan reads real source, never the migration log; a stray occurrence refutes back to NODE 4, bounded by recursion_limit\n  output:    elimination\nDECLARE elimination: object\nSET elimination = {occurrences: occurrences, completeness: completeness, refuter: refuter}\nHANDOFF GATE (ver-stop gate):\n  rule_id: \"ELIMINATE\"   yields: boolean\n  [check] the scan ran over the whole scope from real source (evidence: the scanned file set) over: the scope measured: <scanned> / <files>\n  [check] only approved base-location occurrences remain (evidence: elimination.occurrences)\n  [check] a refuter is named and completeness meets its threshold (evidence: elimination.refuter and completeness)\n  standing: moved-set <the files changed since NODE 4>\n  result: pass → NODE 6 | stray occurrence → REPAIR (owner: NODE 4) | unknown → BLOCKED\n\n# NODE 6 — TERMINATE   [evaluative · termination · set-theory · yields: artifact]\n@purpose: \"regenerate the registry to the new truth, persist measured ROI deduplicated, and stop only on saturation and completion and verification\"\n@genesis: emergence\n@mandatory\nCONTRACT:\n  input:     elimination from NODE 5\n  transform: EXECUTE_TOOL {project.registry_regenerate} WITH timeout: <bound> INTO regenerated; READ_RESOURCE {project.architecture_registry} INTO registry_after; CALCULATE_METRIC <duplication, code, adoption, lines saved, load> FROM {baseline_bundle, migration, registry_after} INTO roi; COMPOSE_ARTIFACT report FROM {migration, elimination, roi} USING <the success or blocked shape>; PERSIST_ARTIFACT report TO <{task_name} report>; REPORT_RESULT report TO <the parties whose next work it creates>\n  constraints: ROI is measured, never asserted; the registry reflects the new base and the migrated implementations; a self-assessed done is not ter-stop\n  output:    report\n  freshness: fingerprint(registry_after) + fingerprint(this document)\nHANDOFF GATE (ter-stop gate):\n  rule_id: \"TERMINATE\"   yields: boolean\n  [check] the registry is regenerated and reflects the new truth (evidence: registry_after names the base and the migrated implementations) over: migrated implementations measured: <represented> / <migrated>\n  [check] ROI is computed from measurements and history is persisted deduplicated (evidence: roi and the history read back)\n  [check] success only when saturation and completion and verification all hold (evidence: the termination set)\n  refuse: a report destination that changed since it was read before PERSIST_ARTIFACT\n  result: pass → TERMINATE | registry stale → REPAIR (owner: NODE 6) | unknown → BLOCKED\n\n# CROSS-NODE INVARIANTS\nINVARIANT measure-before-propose: the existing baseline is measured before any base is proposed over: every distillation binds: the distiller objector: [check] the existing architecture is measured at NODE 1\nINVARIANT worth-before-base: the selected candidate is the highest-worth admissible one over: candidates binds: the distiller objector: [check] the selected candidate is the argmax at NODE 2\nINVARIANT evidence-not-names: a base rests on behavioural evidence, never on naming similarity over: every base binds: the distiller objector: [check] every class is signed from evidence at NODE 3\nINVARIANT reversible-migration: every target migrates through a checkpoint and restores on failure over: targets binds: the distiller objector: [check] every target migrated or restored at NODE 4\nINVARIANT gone-means-scanned: elimination is proven over the whole scope from real source over: the scope binds: the distiller objector: [check] the scan ran over the whole scope at NODE 5\nINVARIANT roi-measured: ROI is a measurement over the regenerated registry, never an assertion over: every report binds: the distiller objector: [check] ROI is computed from measurements at NODE 6\n\nREPORT:\n  subject: NODE 6\n  verdict: pass | fail | unknown\n  domain: declared <files in scope> measured <scanned>\n  populations: targets migrated <n>, targets restored <n>, occurrences remaining <n>\n  refusals: <n> [<reason>]\n  unresolved: <n> [<reason>]\n  completion: saturated <bool> complete <bool> verified <bool>\n",
                    "kind": "code",
                    "language": "pag",
                    "title": "distillation"
                  },
                  {
                    "code": "# the boundary principles · a base is justified only when every one holds, with the evidence that shows it\nuniversal       every instance in the family is an instance of the shared behaviour\ninvariant       the shared half does not vary across them\nfoundational    other behaviour composes from it\nenforceable     a check can hold it\nload-reducing   it removes work rather than adding a layer\n\n# otherwise the verdict is compose, a utility, or a local refactor · never a base",
                    "kind": "code",
                    "language": "pag",
                    "title": "boundary principles"
                  },
                  {
                    "caption": "instantiation order",
                    "kind": "mermaid",
                    "text": "flowchart LR\n    request[\"A request\"]\n    transition[\"The transition it asks for\"]\n    protocol[\"The protocol that fits, with its reason\"]\n    nouns[\"Placeholders bound to the task's nouns\"]\n    nodes[\"Nodes · tagged, contracted, gated\"]\n    request --> transition --> protocol --> nouns --> nodes"
                  },
                  {
                    "caption": "distillation order",
                    "kind": "mermaid",
                    "text": "flowchart TB\n    measure[\"Measure what exists\"]\n    worth[\"Rank candidates by worth\"]\n    sign[\"Sign each class from behaviour\"]\n    boundary{\"Universal, invariant, foundational, enforceable, load-reducing?\"}\n    base[\"Compose the base · migrate reversibly\"]\n    gone{\"Old pattern gone from the whole scope?\"}\n    registry[\"Regenerate the registry · measure the reduction\"]\n    other[\"Compose, a utility, or a local refactor\"]\n    measure --> worth --> sign --> boundary\n    boundary -- all five --> base --> gone\n    boundary -- any fails --> other\n    gone -- no --> base\n    gone -- yes --> registry"
                  }
                ],
                "title": "Instantiate and distil"
              }
            ],
            "title": "Integrating algorithms"
          }
        ]
      },
      {
        "icon": "bi-list-ul",
        "id": "keywords",
        "label": "Keywords",
        "layout": "grid",
        "sections": [
          {
            "icon": "bi-list-ul",
            "id": "keyword-ontology",
            "intro": "The keywords fall into categories by the job they do in a line, and every keyword is uppercase because that is the form the model has seen most in code. Every keyword outside the prepositions grounds to a record in the ontology's reasoning face, so the vocabulary is derived rather than invented, and the lists below are read from the grammar's own records.",
            "subsections": [
              {
                "blocks": [
                  {
                    "keywords": [
                      {
                        "description": "Find resources by pattern · the adapter maps GLOB to it",
                        "example": "DISCOVER_RESOURCES \"<pattern>\" INTO <resources>",
                        "name": "DISCOVER_RESOURCES"
                      },
                      {
                        "description": "Read one resource · the adapter maps READ to it",
                        "example": "READ_RESOURCE <resource> INTO <content>",
                        "name": "READ_RESOURCE"
                      },
                      {
                        "description": "Search content for a term · the adapter maps GREP to it",
                        "example": "SEARCH_CONTENT <content> FOR <term> INTO <matches>",
                        "name": "SEARCH_CONTENT"
                      },
                      {
                        "description": "Analyze content against criteria",
                        "example": "ANALYZE_CONTENT <content> AGAINST <criteria> INTO <findings>",
                        "name": "ANALYZE_CONTENT"
                      },
                      {
                        "description": "Isolate fields from content, preserving its meaning",
                        "example": "EXTRACT_FACTS <fields> FROM <content> INTO <facts>",
                        "name": "EXTRACT_FACTS"
                      },
                      {
                        "description": "Derive a measure from facts",
                        "example": "CALCULATE_METRIC <measure> FROM <facts> INTO <value>",
                        "name": "CALCULATE_METRIC"
                      },
                      {
                        "description": "Compose an artifact from facts using a shape",
                        "example": "COMPOSE_ARTIFACT <artifact> FROM <facts> USING <shape>",
                        "name": "COMPOSE_ARTIFACT"
                      },
                      {
                        "description": "Validate an artifact against a schema",
                        "example": "VALIDATE_ARTIFACT <artifact> AGAINST <schema>",
                        "name": "VALIDATE_ARTIFACT"
                      },
                      {
                        "description": "Persist an artifact to a destination · the adapter maps WRITE and EDIT to it; a refusal is named before it",
                        "example": "PERSIST_ARTIFACT <artifact> TO <destination>",
                        "name": "PERSIST_ARTIFACT"
                      },
                      {
                        "description": "Execute a command with a bound · the adapter maps BASH to it",
                        "example": "EXECUTE_TOOL <command> WITH timeout: <bound> INTO <result>",
                        "name": "EXECUTE_TOOL"
                      },
                      {
                        "description": "Ask a party to decide · the adapter maps ASK_USER to it, and resolves it absent for a bounded reader",
                        "example": "REQUEST_DECISION <party> WITH options: [, **] INTO ****<choice>**",
                        "name": "REQUEST_DECISION"
                      },
                      {
                        "description": "Report an artifact to the parties whose next work it creates",
                        "example": "REPORT_RESULT <artifact> TO <parties>",
                        "name": "REPORT_RESULT"
                      }
                    ],
                    "kind": "keyword"
                  }
                ],
                "content": "A document names one of the [semantic operations](/pag/guide#tool-invocation) for every external effect. One adapter per harness maps each operation to a tool, and the short tool forms an adapter accepts are its aliases, never the grammar's vocabulary.",
                "title": "Semantic operations"
              },
              {
                "blocks": [
                  {
                    "keywords": [
                      {
                        "description": "A node header · the unit of a document, one decision, one gate",
                        "example": "# NODE <n> — <NAME>   [<layer> · <axis> · <math type> · yields: <shape>]",
                        "name": "NODE"
                      },
                      {
                        "description": "A node's contract · input, transform, constraints, output, handoff",
                        "example": "CONTRACT:",
                        "name": "CONTRACT"
                      },
                      {
                        "description": "The shape a node's decision resolves to",
                        "example": "yields: <set | boolean | edge-list | ranking | procedure | artifact>",
                        "name": "YIELDS"
                      },
                      {
                        "description": "The substrate stage the node's artifact comes to be at · phase order follows it",
                        "example": "@genesis: <existence | difference | relation | structure | transformation | constraint | emergence>",
                        "name": "GENESIS"
                      },
                      {
                        "description": "The distinctions a transform keeps · a lowering names what a later check needs",
                        "example": "preserves: <distinction>, <distinction>",
                        "name": "PRESERVES"
                      },
                      {
                        "description": "The one record the next node reads, as an assignment",
                        "example": "# OUTPUT CONTRACT",
                        "name": "OUTPUT_CONTRACT"
                      },
                      {
                        "description": "A declared limit · stated where a reader would otherwise assume the opposite",
                        "example": "LIMIT <name>: \"<what the document cannot do>\"",
                        "name": "LIMIT"
                      },
                      {
                        "description": "A slot's state · resolved, absent or deferred, declared by the adapter",
                        "example": "SLOT {<namespace>.<name>}: RESOLVED | ABSENT | DEFERRED",
                        "name": "SLOT"
                      }
                    ],
                    "kind": "keyword"
                  }
                ],
                "content": "These tokens make up the node form, which is the unit of a document. They cover the header with its four-slot tag, the contract, the substrate stage at which the node's artifact comes to be, and the slots and limits a document declares.",
                "title": "Node keywords"
              },
              {
                "blocks": [
                  {
                    "keywords": [
                      {
                        "description": "Hard assertion",
                        "example": "ASSERT condition",
                        "name": "ASSERT"
                      },
                      {
                        "description": "Prerequisite check",
                        "example": "REQUIRE dependency",
                        "name": "REQUIRE"
                      },
                      {
                        "description": "Gate marker · the evidence-bearing gate that closes a node",
                        "example": "HANDOFF GATE (evidence-bearing):",
                        "name": "HANDOFF"
                      },
                      {
                        "description": "Checkpoint marker",
                        "example": "HANDOFF GATE:",
                        "name": "GATE"
                      },
                      {
                        "description": "A check in a gate · a claim about the output with the evidence that settles it",
                        "example": "[check] <claim> (evidence: <what settles it>)",
                        "name": "CHECK"
                      },
                      {
                        "description": "The set a check ranges over, measured · zero of zero is not evidence",
                        "example": "over: <set> measured: <n> / <N>",
                        "name": "POPULATION"
                      },
                      {
                        "description": "Where a node refuses to continue · named before the irreversible write",
                        "example": "refuse: <condition> before <write>",
                        "name": "REFUSE"
                      },
                      {
                        "description": "The fingerprints an artifact was derived from · a semantic property, never a timestamp",
                        "example": "freshness: <inputs fingerprint> + ",
                        "name": "FRESHNESS"
                      },
                      {
                        "description": "Whether the read set moved beneath the verdict · a non-empty moved set withdraws the standing, never the verdict",
                        "example": "standing: moved-set <set>",
                        "name": "STANDING"
                      },
                      {
                        "description": "The third verdict · an unmeasured or unevidenced claim, never a pass",
                        "example": "unknown → BLOCKED",
                        "name": "UNKNOWN"
                      },
                      {
                        "description": "The closure of an unknown or an unanswered decision · external input is owed",
                        "example": "result: ... | unknown → BLOCKED",
                        "name": "BLOCKED"
                      },
                      {
                        "description": "Move a candidate into accepted state · only on a clean verdict, never on production",
                        "example": "promote: <candidate> ON clean verdict",
                        "name": "PROMOTE"
                      },
                      {
                        "description": "Cross the boundary to the external system · the party that crosses it is named",
                        "example": "publish: <artifact> BY <party>",
                        "name": "PUBLISH"
                      },
                      {
                        "description": "The result line · the next node on pass, the repair owner on failure, blocked on unknown",
                        "example": "result: pass → NODE <n+1> | <failure> → REPAIR (owner: <node>) | unknown → BLOCKED",
                        "name": "RESULT"
                      },
                      {
                        "description": "The repair edge · re-enters at the earliest node that can supply the missing evidence",
                        "example": "REPAIR (owner: NODE <n>)",
                        "name": "REPAIR"
                      },
                      {
                        "description": "The gate's identity, the node it closes",
                        "example": "rule_id: \"<NODE NAME>\"",
                        "name": "RULE_ID"
                      }
                    ],
                    "kind": "keyword"
                  }
                ],
                "content": "These tokens make up the handoff gate. They cover a check with its evidence and the population it was measured over, the refusal before a write, the standing of the read set, and the three verdicts, with unknown routed to blocked.",
                "title": "Validation keywords"
              },
              {
                "blocks": [
                  {
                    "keywords": [
                      {
                        "description": "The node or stage the report is about",
                        "example": "subject: <node>",
                        "name": "SUBJECT"
                      },
                      {
                        "description": "The value returned · pass, fail or unknown",
                        "example": "verdict: pass | fail | unknown",
                        "name": "VERDICT"
                      },
                      {
                        "description": "The population declared and the population measured",
                        "example": "domain: declared <N> measured <n>",
                        "name": "DOMAIN"
                      },
                      {
                        "description": "The partitions, each measured · their sum is the whole",
                        "example": "populations: <part> <n>, <part> <n>",
                        "name": "POPULATIONS"
                      },
                      {
                        "description": "The inputs read, by identity and fingerprint",
                        "example": "inputs: <identity> <fingerprint>",
                        "name": "INPUTS"
                      },
                      {
                        "description": "The fingerprint of the code that produced the verdict",
                        "example": "code: <fingerprint>",
                        "name": "CODE"
                      },
                      {
                        "description": "The artifact written, by identity and fingerprint",
                        "example": "output: <identity> <fingerprint>",
                        "name": "OUTPUT"
                      },
                      {
                        "description": "How many times the stage refused, and why",
                        "example": "refusals: <n> [<reason>]",
                        "name": "REFUSALS"
                      },
                      {
                        "description": "What stays open, and why",
                        "example": "unresolved: <n> [<reason>]",
                        "name": "UNRESOLVED"
                      },
                      {
                        "description": "Saturated, complete and verified · the three that must coincide",
                        "example": "completion: saturated <bool> complete <bool> verified <bool>",
                        "name": "COMPLETION"
                      }
                    ],
                    "kind": "keyword"
                  }
                ],
                "content": "A verdict is written as a report so that a later checker can challenge it. The report's fields record what was measured, over what, from which inputs, and whether the three termination conditions coincide.",
                "title": "Report keywords"
              },
              {
                "blocks": [
                  {
                    "keywords": [
                      {
                        "description": "The record head · a property the topology relies on, with its set, its parties and its objector",
                        "example": "INVARIANT <name>: <property> over: <set> binds: <parties> objector: <check | none>",
                        "name": "INVARIANT"
                      },
                      {
                        "description": "The property, in a form that could be false",
                        "example": "INVARIANT one-writer: a record has exactly one writer ...",
                        "name": "PROPERTY"
                      },
                      {
                        "description": "The set the property quantifies over",
                        "example": "over: every record on the surface",
                        "name": "OVER"
                      },
                      {
                        "description": "The parties the property constrains · who must receive it",
                        "example": "binds: every party writing there",
                        "name": "BINDS"
                      },
                      {
                        "description": "What would disagree if the property stopped holding · a check, or none as declared debt",
                        "example": "objector: [check] one open fence per record | none",
                        "name": "OBJECTOR"
                      }
                    ],
                    "kind": "keyword"
                  }
                ],
                "content": "An invariant record states a property in a form that could be false, the set it quantifies over, the parties it binds, and the objector that would disagree if it stopped holding. A record with no objector declares none, and the missing check stands as declared debt.",
                "title": "Invariant keywords"
              },
              {
                "blocks": [
                  {
                    "keywords": [
                      {
                        "description": "Metadata block",
                        "example": "%% META %%:",
                        "name": "META"
                      },
                      {
                        "description": "Template usage",
                        "example": "USE TEMPLATE name",
                        "name": "USE"
                      },
                      {
                        "description": "Template reference",
                        "example": "USE TEMPLATE validation",
                        "name": "TEMPLATE"
                      },
                      {
                        "description": "The one-line reminder a reader executes at a node",
                        "example": "@cue: \"<reminder>\"",
                        "name": "CUE"
                      },
                      {
                        "description": "A bound on repair, declared in the meta block",
                        "example": "recursion_limit: <bound>",
                        "name": "RECURSION_LIMIT"
                      },
                      {
                        "description": "What a node decides, in one sentence",
                        "example": "@purpose: \"<what this node decides>\"",
                        "name": "PURPOSE"
                      },
                      {
                        "description": "The question a node's axis asks",
                        "example": "@axis_question: \"<the question>\"",
                        "name": "AXIS_QUESTION"
                      },
                      {
                        "description": "The authority tiers · which source grounds which, highest first",
                        "example": "priority: <governing document> > <ontology> > <template> > <task>",
                        "name": "PRIORITY"
                      },
                      {
                        "description": "What is trusted as evidence and what stays a claim",
                        "example": "trust: tool_output = TRUSTED, prior_knowledge = UNTRUSTED",
                        "name": "TRUST"
                      },
                      {
                        "description": "What the document may touch, and what is declared outside it",
                        "example": "jurisdiction: <in scope> | external: <declared outside>",
                        "name": "JURISDICTION"
                      }
                    ],
                    "kind": "keyword"
                  }
                ],
                "content": "The meta block and the node tags state what the document is for, which source grounds which, what it trusts, what it may touch and what it declares outside itself, and how far repair may recurse.",
                "title": "Meta keywords"
              },
              {
                "blocks": [
                  {
                    "keywords": [
                      {
                        "description": "Input acquisition · lowers to READ_RESOURCE",
                        "example": "READ file INTO data",
                        "name": "READ"
                      },
                      {
                        "description": "Output generation · lowers to PERSIST_ARTIFACT",
                        "example": "WRITE content TO file",
                        "name": "WRITE"
                      },
                      {
                        "description": "Action invocation · lowers to EXECUTE_TOOL",
                        "example": "EXECUTE command WITH params",
                        "name": "EXECUTE"
                      },
                      {
                        "description": "Construction · lowers to COMPOSE_ARTIFACT",
                        "example": "CREATE artifact FROM template",
                        "name": "CREATE"
                      },
                      {
                        "description": "Removal · an irreversible write, refused before it lands",
                        "example": "DELETE file_path",
                        "name": "DELETE"
                      },
                      {
                        "description": "Discovery · lowers to DISCOVER_RESOURCES",
                        "example": "FIND pattern IN scope",
                        "name": "FIND"
                      },
                      {
                        "description": "Inspection · lowers to ANALYZE_CONTENT",
                        "example": "ANALYZE target FOR condition",
                        "name": "ANALYZE"
                      },
                      {
                        "description": "Verification · lowers to VALIDATE_ARTIFACT",
                        "example": "VALIDATE state AGAINST schema",
                        "name": "VALIDATE"
                      },
                      {
                        "description": "Confirmation against evidence",
                        "example": "VERIFY condition",
                        "name": "VERIFY"
                      },
                      {
                        "description": "Isolation · lowers to EXTRACT_FACTS",
                        "example": "EXTRACT data FROM source",
                        "name": "EXTRACT"
                      },
                      {
                        "description": "Aggregation",
                        "example": "COLLECT items INTO container",
                        "name": "COLLECT"
                      },
                      {
                        "description": "Selection",
                        "example": "FILTER items WHERE condition",
                        "name": "FILTER"
                      },
                      {
                        "description": "Comparison",
                        "example": "COMPARE a AGAINST b",
                        "name": "COMPARE"
                      },
                      {
                        "description": "Transformation · a lowering that names what it preserves",
                        "example": "CONVERT data TO format",
                        "name": "CONVERT"
                      },
                      {
                        "description": "Combination",
                        "example": "MERGE sources INTO target",
                        "name": "MERGE"
                      },
                      {
                        "description": "Division",
                        "example": "SPLIT data BY delimiter",
                        "name": "SPLIT"
                      },
                      {
                        "description": "Ordering",
                        "example": "SORT items BY criteria",
                        "name": "SORT"
                      },
                      {
                        "description": "Prioritization · the ranking a worth gate reads",
                        "example": "RANK items BY score",
                        "name": "RANK"
                      },
                      {
                        "description": "Association · a declared edge, never a name match",
                        "example": "LINK source TO target",
                        "name": "LINK"
                      },
                      {
                        "description": "Output · lowers to REPORT_RESULT",
                        "example": "REPORT findings",
                        "name": "REPORT"
                      },
                      {
                        "description": "Add to collection",
                        "example": "ADD item TO list",
                        "name": "ADD"
                      },
                      {
                        "description": "Append to end",
                        "example": "APPEND value TO array",
                        "name": "APPEND"
                      },
                      {
                        "description": "Insert at position",
                        "example": "INSERT item AT index",
                        "name": "INSERT"
                      },
                      {
                        "description": "Remove from collection",
                        "example": "REMOVE item FROM list",
                        "name": "REMOVE"
                      },
                      {
                        "description": "Relocation · a create at the destination, read before it lands",
                        "example": "MOVE file TO destination",
                        "name": "MOVE"
                      },
                      {
                        "description": "Duplication · a second derivation of one fact, declared as such",
                        "example": "COPY file TO backup",
                        "name": "COPY"
                      },
                      {
                        "description": "Preservation of the last accepted state before a mutation",
                        "example": "BACKUP file TO location",
                        "name": "BACKUP"
                      },
                      {
                        "description": "Recovery of the last accepted state",
                        "example": "RESTORE FROM backup",
                        "name": "RESTORE"
                      },
                      {
                        "description": "Resource acquisition · lowers to READ_RESOURCE",
                        "example": "LOAD config FROM file",
                        "name": "LOAD"
                      },
                      {
                        "description": "Communication · lowers to REPORT_RESULT",
                        "example": "SEND message TO recipient",
                        "name": "SEND"
                      },
                      {
                        "description": "Timing control · waiting has a command",
                        "example": "WAIT FOR condition",
                        "name": "WAIT"
                      },
                      {
                        "description": "Trial operation",
                        "example": "ATTEMPT operation",
                        "name": "ATTEMPT"
                      },
                      {
                        "description": "Error termination · loud at the boundary",
                        "example": "FAIL WITH message",
                        "name": "FAIL"
                      },
                      {
                        "description": "Exit execution",
                        "example": "EXIT 1",
                        "name": "EXIT"
                      },
                      {
                        "description": "Return value · how a bounded reader ends",
                        "example": "RETURN result",
                        "name": "RETURN"
                      },
                      {
                        "description": "Repetition",
                        "example": "ITERATE operation",
                        "name": "ITERATE"
                      },
                      {
                        "description": "Deep analysis",
                        "example": "INVESTIGATE issue",
                        "name": "INVESTIGATE"
                      },
                      {
                        "description": "Decision making",
                        "example": "DETERMINE outcome",
                        "name": "DETERMINE"
                      },
                      {
                        "description": "Constraint application",
                        "example": "ENFORCE rule",
                        "name": "ENFORCE"
                      },
                      {
                        "description": "Proof provision",
                        "example": "EVIDENCE claim",
                        "name": "EVIDENCE"
                      },
                      {
                        "description": "Change distribution · the ripple through declared dependencies",
                        "example": "PROPAGATE updates",
                        "name": "PROPAGATE"
                      },
                      {
                        "description": "Completion",
                        "example": "FINALIZE operation",
                        "name": "FINALIZE"
                      },
                      {
                        "description": "Aggregation · a fusion that drops nothing live",
                        "example": "REDUCE items TO value",
                        "name": "REDUCE"
                      },
                      {
                        "description": "Name modification · every referencing surface enumerated first",
                        "example": "RENAME file TO newname",
                        "name": "RENAME"
                      },
                      {
                        "description": "Arrangement",
                        "example": "ORDER items BY key",
                        "name": "ORDER"
                      },
                      {
                        "description": "Annotation",
                        "example": "MARK item AS complete",
                        "name": "MARK"
                      },
                      {
                        "description": "Infer a future state",
                        "example": "PREDICT outcome FROM model",
                        "name": "PREDICT"
                      },
                      {
                        "description": "Group by kind",
                        "example": "CLASSIFY item BY type",
                        "name": "CLASSIFY"
                      },
                      {
                        "description": "Identify the mechanism",
                        "example": "EXPLAIN behavior",
                        "name": "EXPLAIN"
                      },
                      {
                        "description": "Discover the principle behind the examples",
                        "example": "REFLECT ON outcome",
                        "name": "REFLECT"
                      },
                      {
                        "description": "Remove irrelevant detail",
                        "example": "ABSTRACT pattern FROM cases",
                        "name": "ABSTRACT"
                      },
                      {
                        "description": "Extend examples into a principle",
                        "example": "GENERALISE FROM examples",
                        "name": "GENERALISE"
                      },
                      {
                        "description": "Characterise an object",
                        "example": "DESCRIBE structure",
                        "name": "DESCRIBE"
                      },
                      {
                        "description": "Express symbolically",
                        "example": "FORMALISE rule AS predicate",
                        "name": "FORMALISE"
                      }
                    ],
                    "kind": "keyword"
                  }
                ],
                "content": "A directive inside a node's transform opens with one of these verbs. Each grounds to a reasoning mode or a loop node, and the ones that name an effect lower to a semantic operation.",
                "title": "Action keywords"
              },
              {
                "blocks": [
                  {
                    "keywords": [
                      {
                        "description": "Conditional execution",
                        "example": "IF condition: action",
                        "name": "IF"
                      },
                      {
                        "description": "Alternative branch",
                        "example": "ELSE: alternative",
                        "name": "ELSE"
                      },
                      {
                        "description": "Iteration start",
                        "example": "FOR EACH item IN list:",
                        "name": "FOR"
                      },
                      {
                        "description": "Iterator marker",
                        "example": "FOR EACH x IN items:",
                        "name": "EACH"
                      },
                      {
                        "description": "Conditional loop",
                        "example": "WHILE condition: action",
                        "name": "WHILE"
                      },
                      {
                        "description": "Exception handling start",
                        "example": "TRY: risky_op",
                        "name": "TRY"
                      },
                      {
                        "description": "Exception handler",
                        "example": "CATCH: handle_error",
                        "name": "CATCH"
                      },
                      {
                        "description": "Exception alternative",
                        "example": "EXCEPT: recovery",
                        "name": "EXCEPT"
                      },
                      {
                        "description": "Cleanup block",
                        "example": "FINALLY: cleanup",
                        "name": "FINALLY"
                      },
                      {
                        "description": "Pattern matching",
                        "example": "MATCH value:",
                        "name": "MATCH"
                      },
                      {
                        "description": "Match branch",
                        "example": "CASE pattern: action",
                        "name": "CASE"
                      },
                      {
                        "description": "Fallback case · a declared default, never a masked failure",
                        "example": "DEFAULT: fallback",
                        "name": "DEFAULT"
                      },
                      {
                        "description": "Event trigger",
                        "example": "WHEN event: action",
                        "name": "WHEN"
                      },
                      {
                        "description": "Negated conditional",
                        "example": "UNLESS condition: action",
                        "name": "UNLESS"
                      },
                      {
                        "description": "Loop terminator",
                        "example": "UNTIL done",
                        "name": "UNTIL"
                      },
                      {
                        "description": "Early exit check",
                        "example": "GUARD cond ELSE: exit",
                        "name": "GUARD"
                      },
                      {
                        "description": "Exit loop",
                        "example": "BREAK",
                        "name": "BREAK"
                      },
                      {
                        "description": "Skip iteration",
                        "example": "CONTINUE",
                        "name": "CONTINUE"
                      },
                      {
                        "description": "Jump to label",
                        "example": "GOTO label",
                        "name": "GOTO"
                      },
                      {
                        "description": "Flow start marker",
                        "example": "START process",
                        "name": "START"
                      },
                      {
                        "description": "Flow end marker",
                        "example": "END",
                        "name": "END"
                      },
                      {
                        "description": "Termination",
                        "example": "STOP",
                        "name": "STOP"
                      },
                      {
                        "description": "Loop marker",
                        "example": "LOOP BACKTO step",
                        "name": "LOOP"
                      },
                      {
                        "description": "Step marker",
                        "example": "STEP 1: action",
                        "name": "STEP"
                      },
                      {
                        "description": "Rule definition",
                        "example": "RULE name: body",
                        "name": "RULE"
                      },
                      {
                        "description": "Containment test",
                        "example": "item IN collection",
                        "name": "IN"
                      },
                      {
                        "description": "Pattern test",
                        "example": "value MATCHES pattern",
                        "name": "MATCHES"
                      }
                    ],
                    "kind": "keyword"
                  }
                ],
                "content": "These keywords mirror the flow control constructs of programming languages.",
                "title": "Control flow keywords"
              },
              {
                "blocks": [
                  {
                    "keywords": [
                      {
                        "description": "Variable assignment",
                        "example": "SET name = value",
                        "name": "SET"
                      },
                      {
                        "description": "Typed declaration",
                        "example": "DECLARE x: string",
                        "name": "DECLARE"
                      },
                      {
                        "description": "Constant definition",
                        "example": "DEFINE PI = 3.14",
                        "name": "DEFINE"
                      },
                      {
                        "description": "Local binding",
                        "example": "LET temp = expr",
                        "name": "LET"
                      },
                      {
                        "description": "Immutable value",
                        "example": "CONST MAX = 100",
                        "name": "CONST"
                      }
                    ],
                    "kind": "keyword"
                  }
                ],
                "content": "These keywords declare the variables and types that hold a document's state.",
                "title": "Declaration keywords"
              },
              {
                "blocks": [
                  {
                    "keywords": [
                      {
                        "description": "Mandatory requirement · a modifier inside a property",
                        "example": "MUST validate first",
                        "name": "MUST"
                      },
                      {
                        "description": "Prohibition · a modifier inside a property",
                        "example": "NEVER delete without backup",
                        "name": "NEVER"
                      },
                      {
                        "description": "Invariance · a modifier inside a property",
                        "example": "ALWAYS log changes",
                        "name": "ALWAYS"
                      },
                      {
                        "description": "Necessity marker",
                        "example": "REQUIRED field",
                        "name": "REQUIRED"
                      },
                      {
                        "description": "Obligation marker",
                        "example": "MANDATORY check",
                        "name": "MANDATORY"
                      },
                      {
                        "description": "Repair ordering among failures, never a softer verdict",
                        "example": "CRITICAL validation",
                        "name": "CRITICAL"
                      },
                      {
                        "description": "No exceptions",
                        "example": "ABSOLUTE rule",
                        "name": "ABSOLUTE"
                      },
                      {
                        "description": "Absolute prohibition",
                        "example": "FORBIDDEN: direct DB",
                        "name": "FORBIDDEN"
                      }
                    ],
                    "kind": "keyword"
                  }
                ],
                "content": "A modifier qualifies and strengthens a line inside a property. It never heads a block, because a block head states no set, no parties and no objector, and the invariant record carries all three.",
                "title": "Modifier keywords"
              },
              {
                "blocks": [
                  {
                    "keywords": [
                      {
                        "description": "Async wait · waiting has a command, a turn never ends to wait",
                        "example": "AWAIT op INTO result",
                        "name": "AWAIT"
                      },
                      {
                        "description": "Concurrent execution",
                        "example": "PARALLEL: tasks END",
                        "name": "PARALLEL"
                      },
                      {
                        "description": "Task handoff · a bounded reader receives a task and returns",
                        "example": "DELEGATE task TO reader",
                        "name": "DELEGATE"
                      },
                      {
                        "description": "Task queuing",
                        "example": "QUEUE operation",
                        "name": "QUEUE"
                      },
                      {
                        "description": "Retry on failure · bounded by a declared limit",
                        "example": "RETRY operation",
                        "name": "RETRY"
                      },
                      {
                        "description": "Resource lock · the barrier around an exclusive write",
                        "example": "LOCK resource",
                        "name": "LOCK"
                      },
                      {
                        "description": "Release lock",
                        "example": "UNLOCK resource",
                        "name": "UNLOCK"
                      },
                      {
                        "description": "A file parties read and write · its key declared in the header, never derived from the path",
                        "example": "SURFACE <key>:",
                        "name": "SURFACE"
                      },
                      {
                        "description": "One addressable claim inside a surface · exactly one writer",
                        "example": "RECORD <id> subject: <key>",
                        "name": "RECORD"
                      },
                      {
                        "description": "An addressed span inside a record · its id allocated by the tool",
                        "example": "ITEM <id> TO <reader>: <claim>",
                        "name": "ITEM"
                      },
                      {
                        "description": "Edge · the target reduces this surface upward",
                        "example": "PARENT <surface>",
                        "name": "PARENT"
                      },
                      {
                        "description": "Edge · the record resolves when the artifact exists",
                        "example": "SATISFIED_BY <artifact>",
                        "name": "SATISFIED_BY"
                      },
                      {
                        "description": "Edge · the target cannot close first",
                        "example": "BLOCKS <record>",
                        "name": "BLOCKS"
                      },
                      {
                        "description": "Edge · this record acts on the target",
                        "example": "ANSWERS <record>",
                        "name": "ANSWERS"
                      },
                      {
                        "description": "Edge · this record contradicts the target with evidence",
                        "example": "REFUTES <record>",
                        "name": "REFUTES"
                      },
                      {
                        "description": "Edge · this record replaces the target",
                        "example": "SUPERSEDES <record>",
                        "name": "SUPERSEDES"
                      },
                      {
                        "description": "Derived state · an unresolved outbound edge, never written",
                        "example": "state: OPEN",
                        "name": "OPEN"
                      },
                      {
                        "description": "Derived state · the satisfying artifact exists; extract, then delete",
                        "example": "state: ABSORBED",
                        "name": "ABSORBED"
                      },
                      {
                        "description": "A party's class, derived from what it received · participant or bounded",
                        "example": "READER <party> AS participant | bounded",
                        "name": "READER"
                      },
                      {
                        "description": "Post and wait as one operation · reports the diff since this reader last looked",
                        "example": "WAIT ON <surface> AS <reader> INTO <diff>",
                        "name": "WAIT"
                      },
                      {
                        "description": "Proceed with an exclusive write only once every peer is parked",
                        "example": "BARRIER ON <surface>",
                        "name": "BARRIER"
                      },
                      {
                        "description": "Compare-and-swap on the writer's own span · refuses an overlap with its diff",
                        "example": "SWAP ** AGAINST ****<read>**",
                        "name": "SWAP"
                      }
                    ],
                    "kind": "keyword"
                  }
                ],
                "content": "A [shared surface](/pag/orchestration#shared-surfaces) makes this structure explicit. It consists of the surface, its records, each with exactly one writer, the addressed items inside them, the typed edges between records, the states derived from those edges, the reader classes, and the one operation that posts and waits. The waiting, locking and retry tokens describe the same model from one party's turn.",
                "title": "Coordination keywords"
              },
              {
                "blocks": [
                  {
                    "keywords": [
                      {
                        "description": "Machine declaration · makes a lifetime or a derived-state set explicit",
                        "example": "STATE_MACHINE workflow:",
                        "name": "STATE_MACHINE"
                      },
                      {
                        "description": "State definition · a state is derived from the graph, never written",
                        "example": "STATE pending:",
                        "name": "STATE"
                      },
                      {
                        "description": "State change rule",
                        "example": "TRANSITION FROM a TO b",
                        "name": "TRANSITION"
                      },
                      {
                        "description": "Event trigger",
                        "example": "ON approval",
                        "name": "ON"
                      },
                      {
                        "description": "Source state",
                        "example": "FROM pending",
                        "name": "FROM"
                      },
                      {
                        "description": "Target state",
                        "example": "TO approved",
                        "name": "TO"
                      },
                      {
                        "description": "Entry action",
                        "example": "ENTRY: notify",
                        "name": "ENTRY"
                      },
                      {
                        "description": "Exit action",
                        "example": "EXIT: cleanup",
                        "name": "EXIT"
                      }
                    ],
                    "kind": "keyword"
                  }
                ],
                "content": "A state machine makes a lifetime explicit, meaning the states a thing can be in and the transitions that are legal between them. In a coordinated document a state is derived from the graph and never written, so the machine declares what may happen, not what has.",
                "title": "State machine keywords"
              },
              {
                "blocks": [
                  {
                    "keywords": [
                      {
                        "description": "Graph declaration · makes a dependency graph explicit; the loop spine is one",
                        "example": "DAG pipeline:",
                        "name": "DAG"
                      },
                      {
                        "description": "Node definition",
                        "example": "NODE build:",
                        "name": "NODE"
                      },
                      {
                        "description": "Dependencies · declared by the referent, never inferred from a name",
                        "example": "DEPENDS_ON [a, b]",
                        "name": "DEPENDS_ON"
                      },
                      {
                        "description": "Sequencing",
                        "example": "AFTER compile",
                        "name": "AFTER"
                      },
                      {
                        "description": "Reverse sequencing",
                        "example": "BEFORE deploy",
                        "name": "BEFORE"
                      },
                      {
                        "description": "Parallel nodes · peers with no edge between them",
                        "example": "PARALLEL_GROUP: a, b",
                        "name": "PARALLEL_GROUP"
                      }
                    ],
                    "kind": "keyword"
                  }
                ],
                "content": "A [dependency graph](/ontology#arch-dependency-graph) makes explicit what depends on what, as declared by the referent and never inferred from a name. [The loop](/disciplined-methodology#the-loop) spine of a document is one such graph, and a repair edge is a back-edge on it.",
                "title": "DAG keywords"
              },
              {
                "blocks": [
                  {
                    "keywords": [
                      {
                        "description": "Queue declaration · makes a ranking explicit; the branch ranking a worth gate emits is one",
                        "example": "PRIORITY_QUEUE branches:",
                        "name": "PRIORITY_QUEUE"
                      },
                      {
                        "description": "Priority value · utility minus cost",
                        "example": "PRIORITY = 10",
                        "name": "PRIORITY"
                      },
                      {
                        "description": "Add to queue",
                        "example": "ENQUEUE task TO q",
                        "name": "ENQUEUE"
                      },
                      {
                        "description": "Remove from queue",
                        "example": "DEQUEUE FROM q",
                        "name": "DEQUEUE"
                      },
                      {
                        "description": "View top item · the selected branch",
                        "example": "PEEK queue",
                        "name": "PEEK"
                      },
                      {
                        "description": "Reorder queue",
                        "example": "HEAPIFY queue",
                        "name": "HEAPIFY"
                      },
                      {
                        "description": "Comparison function",
                        "example": "COMPARE_BY priority",
                        "name": "COMPARE_BY"
                      }
                    ],
                    "kind": "keyword"
                  }
                ],
                "content": "A priority queue makes a ranking explicit, with the candidates ordered by a declared worth. The branch ranking a worth gate emits is one, and a peek returns the selected branch.",
                "title": "Priority queue keywords"
              },
              {
                "blocks": [
                  {
                    "keywords": [
                      {
                        "description": "Flow declaration · the rendered projection of a declared structure",
                        "example": "FLOWCHART process:",
                        "name": "FLOWCHART"
                      },
                      {
                        "description": "Diagram syntax · a rendering, never the structure itself",
                        "example": "MERMAID flowchart:",
                        "name": "MERMAID"
                      },
                      {
                        "description": "Flow direction",
                        "example": "LAYOUT vertical",
                        "name": "LAYOUT"
                      },
                      {
                        "description": "Nested group",
                        "example": "SUBGRAPH auth:",
                        "name": "SUBGRAPH"
                      }
                    ],
                    "kind": "keyword"
                  }
                ],
                "content": "A flowchart is the rendered projection of a declared structure. It shows a graph, a lifetime or a ranking to a reader, and it never carries a structure the document did not declare elsewhere.",
                "title": "Flowchart keywords"
              },
              {
                "blocks": [
                  {
                    "keywords": [
                      {
                        "description": "Agent definition",
                        "example": "THIS AGENT PERFORMS...",
                        "name": "AGENT"
                      },
                      {
                        "description": "Multi-node process",
                        "example": "THIS WORKFLOW EXECUTES...",
                        "name": "WORKFLOW"
                      },
                      {
                        "description": "Standard procedures",
                        "example": "THIS PROTOCOL DEFINES...",
                        "name": "PROTOCOL"
                      },
                      {
                        "description": "Constraint system",
                        "example": "THIS POLICY ENFORCES...",
                        "name": "POLICY"
                      },
                      {
                        "description": "Task tracking",
                        "example": "THIS CHECKLIST PROVIDES...",
                        "name": "CHECKLIST"
                      },
                      {
                        "description": "Reusable pattern",
                        "example": "THIS TEMPLATE IMPLEMENTS...",
                        "name": "TEMPLATE"
                      },
                      {
                        "description": "Single objective",
                        "example": "THIS TASK EXECUTES...",
                        "name": "TASK"
                      },
                      {
                        "description": "General guidance",
                        "example": "THIS INSTRUCTION IS...",
                        "name": "INSTRUCTION"
                      },
                      {
                        "description": "Model interaction",
                        "example": "THIS PROMPT IS...",
                        "name": "PROMPT"
                      },
                      {
                        "description": "Executable command",
                        "example": "THIS COMMAND EXECUTES...",
                        "name": "COMMAND"
                      },
                      {
                        "description": "Test specification",
                        "example": "THIS TEST PERFORMS...",
                        "name": "TEST"
                      },
                      {
                        "description": "Debugging session",
                        "example": "THIS DEBUG RESOLVES...",
                        "name": "DEBUG"
                      },
                      {
                        "description": "Compliance verification",
                        "example": "THIS VERIFICATION PERFORMS...",
                        "name": "VERIFICATION"
                      },
                      {
                        "description": "Pattern distillation",
                        "example": "THIS DISTILLATION DISTILLS...",
                        "name": "DISTILLATION"
                      },
                      {
                        "description": "Forensic audit",
                        "example": "THIS AUDIT AUDITS...",
                        "name": "AUDIT"
                      },
                      {
                        "description": "Translation audit",
                        "example": "THIS TRANSLATION AUDITS...",
                        "name": "TRANSLATION"
                      },
                      {
                        "description": "Document composition",
                        "example": "THIS COMPOSITION RENDERS...",
                        "name": "COMPOSITION"
                      }
                    ],
                    "kind": "keyword"
                  }
                ],
                "content": "These keywords name the document type in a declaration of the form THIS {TYPE} {VERB} description.",
                "title": "Document type keywords"
              },
              {
                "blocks": [
                  {
                    "keywords": [
                      {
                        "description": "Identity",
                        "example": "THIS INSTRUCTION IS...",
                        "name": "IS"
                      },
                      {
                        "description": "Constraint",
                        "example": "THIS POLICY ENFORCES...",
                        "name": "ENFORCES"
                      },
                      {
                        "description": "Action",
                        "example": "THIS WORKFLOW EXECUTES...",
                        "name": "EXECUTES"
                      },
                      {
                        "description": "Possession",
                        "example": "THIS AGENT HAS...",
                        "name": "HAS"
                      },
                      {
                        "description": "Behavior",
                        "example": "THIS AGENT PERFORMS...",
                        "name": "PERFORMS"
                      },
                      {
                        "description": "Offering",
                        "example": "THIS CHECKLIST PROVIDES...",
                        "name": "PROVIDES"
                      },
                      {
                        "description": "Realization",
                        "example": "THIS TEMPLATE IMPLEMENTS...",
                        "name": "IMPLEMENTS"
                      },
                      {
                        "description": "Specification",
                        "example": "THIS PROTOCOL DEFINES...",
                        "name": "DEFINES"
                      },
                      {
                        "description": "Control",
                        "example": "THIS AGENT MANAGES...",
                        "name": "MANAGES"
                      },
                      {
                        "description": "Orchestration",
                        "example": "THIS WORKFLOW COORDINATES...",
                        "name": "COORDINATES"
                      },
                      {
                        "description": "Creation",
                        "example": "THIS TEMPLATE GENERATES...",
                        "name": "GENERATES"
                      },
                      {
                        "description": "Resolution",
                        "example": "THIS DEBUG RESOLVES...",
                        "name": "RESOLVES"
                      },
                      {
                        "description": "Discovery",
                        "example": "THIS DEBUG FINDS...",
                        "name": "FINDS"
                      },
                      {
                        "description": "Correction",
                        "example": "THIS DEBUG FIXES...",
                        "name": "FIXES"
                      },
                      {
                        "description": "Verification",
                        "example": "THIS VERIFICATION VERIFIES...",
                        "name": "VERIFIES"
                      },
                      {
                        "description": "Classification",
                        "example": "THIS VERIFICATION CLASSIFIES...",
                        "name": "CLASSIFIES"
                      },
                      {
                        "description": "Distillation",
                        "example": "THIS DISTILLATION DISTILLS...",
                        "name": "DISTILLS"
                      },
                      {
                        "description": "Abstraction",
                        "example": "THIS DISTILLATION ABSTRACTS...",
                        "name": "ABSTRACTS"
                      },
                      {
                        "description": "Elimination",
                        "example": "THIS DISTILLATION ELIMINATES...",
                        "name": "ELIMINATES"
                      },
                      {
                        "description": "Audit",
                        "example": "THIS AUDIT AUDITS...",
                        "name": "AUDITS"
                      },
                      {
                        "description": "Measurement",
                        "example": "THIS AUDIT MEASURES...",
                        "name": "MEASURES"
                      },
                      {
                        "description": "Scoring",
                        "example": "THIS AUDIT SCORES...",
                        "name": "SCORES"
                      },
                      {
                        "description": "Correction",
                        "example": "THIS TRANSLATION CORRECTS...",
                        "name": "CORRECTS"
                      },
                      {
                        "description": "Rendering",
                        "example": "THIS COMPOSITION RENDERS...",
                        "name": "RENDERS"
                      },
                      {
                        "description": "Composition",
                        "example": "THIS COMPOSITION COMPOSES...",
                        "name": "COMPOSES"
                      },
                      {
                        "description": "Folding",
                        "example": "THIS COMPOSITION FOLDS...",
                        "name": "FOLDS"
                      }
                    ],
                    "kind": "keyword"
                  }
                ],
                "content": "These verbs follow the type in a document declaration.",
                "title": "Document verbs"
              },
              {
                "blocks": [
                  {
                    "keywords": [
                      {
                        "description": "Destination",
                        "example": "READ file INTO data",
                        "name": "INTO"
                      },
                      {
                        "description": "Source",
                        "example": "EXTRACT FROM response",
                        "name": "FROM"
                      },
                      {
                        "description": "Association",
                        "example": "EXECUTE WITH params",
                        "name": "WITH"
                      },
                      {
                        "description": "Instrument",
                        "example": "VALIDATE USING schema",
                        "name": "USING"
                      },
                      {
                        "description": "Purpose/Iteration",
                        "example": "SEARCH FOR pattern",
                        "name": "FOR"
                      },
                      {
                        "description": "Containment",
                        "example": "FIND key IN object",
                        "name": "IN"
                      },
                      {
                        "description": "Target",
                        "example": "WRITE TO file",
                        "name": "TO"
                      },
                      {
                        "description": "Alias/Role",
                        "example": "BIND result AS alias",
                        "name": "AS"
                      },
                      {
                        "description": "Range",
                        "example": "value BETWEEN 1 AND 10",
                        "name": "BETWEEN"
                      },
                      {
                        "description": "Comparison target",
                        "example": "VALIDATE AGAINST schema",
                        "name": "AGAINST"
                      },
                      {
                        "description": "Foundation",
                        "example": "CREATE BASED_ON template",
                        "name": "BASED_ON"
                      },
                      {
                        "description": "Exclusion",
                        "example": "EXECUTE WITHOUT logging",
                        "name": "WITHOUT"
                      },
                      {
                        "description": "Filter condition",
                        "example": "FIND WHERE x > 0",
                        "name": "WHERE"
                      },
                      {
                        "description": "Data marker",
                        "example": "WRITE CONTENT data",
                        "name": "CONTENT"
                      },
                      {
                        "description": "Negation",
                        "example": "NOT condition",
                        "name": "NOT"
                      },
                      {
                        "description": "Formatting",
                        "example": "STYLE output",
                        "name": "STYLE"
                      }
                    ],
                    "kind": "keyword"
                  }
                ],
                "content": "These prepositions and connectors state the relation between the operands of a line.",
                "title": "Contextual keywords"
              },
              {
                "blocks": [
                  {
                    "keywords": [
                      {
                        "description": "An alias for READ_RESOURCE",
                        "example": "READ \"<file>\" INTO <content>",
                        "name": "READ"
                      },
                      {
                        "description": "An alias for PERSIST_ARTIFACT",
                        "example": "WRITE <content> TO <file>",
                        "name": "WRITE"
                      },
                      {
                        "description": "An alias for PERSIST_ARTIFACT over a span",
                        "example": "EDIT <file> WITH before: \"**\", after: \"****\"**",
                        "name": "EDIT"
                      },
                      {
                        "description": "An alias for DISCOVER_RESOURCES",
                        "example": "GLOB \"<pattern>\" INTO <files>",
                        "name": "GLOB"
                      },
                      {
                        "description": "An alias for SEARCH_CONTENT",
                        "example": "GREP \"<term>\" IN <scope> INTO <matches>",
                        "name": "GREP"
                      },
                      {
                        "description": "An alias for EXECUTE_TOOL",
                        "example": "BASH \"<command>\" WITH timeout: <bound>",
                        "name": "BASH"
                      },
                      {
                        "description": "An alias for READ_RESOURCE over a remote address",
                        "example": "WEB_FETCH \"<address>\" INTO <content>",
                        "name": "WEB_FETCH"
                      },
                      {
                        "description": "An alias for DISCOVER_RESOURCES over the web",
                        "example": "WEB_SEARCH \"<query>\" INTO <hits>",
                        "name": "WEB_SEARCH"
                      },
                      {
                        "description": "An alias for DELEGATE to a bounded reader",
                        "example": "TASK \"<objective>\" WITH agent: <role> → <result>",
                        "name": "TASK"
                      },
                      {
                        "description": "An alias for REQUEST_DECISION",
                        "example": "ASK_USER \"<question>\" WITH options: [, **]**",
                        "name": "ASK_USER"
                      }
                    ],
                    "kind": "keyword"
                  }
                ],
                "content": "The aliases below belong to one adapter, and they are shown as an instance of a binding rather than as grammar. The grammar carries no tool name, so a document names the operation, and the binding for a harness maps its short forms to the operation and the operation to whichever tool performs it there. Another harness ships another table, and the document does not change.",
                "title": "An adapter's aliases"
              }
            ],
            "title": "Keywords"
          }
        ]
      },
      {
        "icon": "bi-braces",
        "id": "grammar",
        "label": "Grammar",
        "layout": "grid",
        "sections": [
          {
            "icon": "bi-braces",
            "id": "bnf-grammar",
            "intro": "PAG is defined by a context-free grammar written in Backus–Naur form (BNF), and its rules fall into five categories. The planning and coordination productions are the grammar's own records, each grounded to a reasoning record, and the statement, expression and flowchart rules expand the terminals those records leave open. The scan described in [well-formedness](/pag/guide#well-formedness) reads tokens rather than patterns, although the grammar itself admits a pattern literal in a condition.",
            "subsections": [
              {
                "blocks": [
                  {
                    "code": "# Instruction\n<instruction> ::= <frontmatter> <optional_meta_block> <optional_document_declaration> <body>\n<frontmatter> ::= \"---\" <yaml_content> \"---\"\n<optional_meta_block> ::= <meta_block> | ε\n<optional_document_declaration> ::= <document_declaration> | ε\n<document_declaration> ::= \"THIS\" <document_type> <document_verb> <description>\n<document_type> ::= \"AGENT\" | \"WORKFLOW\" | \"PROTOCOL\" | \"POLICY\" | \"CHECKLIST\" | \"TEMPLATE\" | \"TASK\" | \"INSTRUCTION\" | \"PROMPT\" | \"COMMAND\" | \"TEST\"\n| \"DEBUG\" | \"VERIFICATION\" | \"DISTILLATION\" | \"AUDIT\" | \"TRANSLATION\" | \"COMPOSITION\"\n<document_verb> ::= \"IS\" | \"ENFORCES\" | \"EXECUTES\" | \"HAS\" | \"PERFORMS\" | \"PROVIDES\" | \"IMPLEMENTS\" | \"DEFINES\" | \"MANAGES\" | \"COORDINATES\" | \"GENERATES\"\n| \"RESOLVES\" | \"FINDS\" | \"FIXES\" | \"VERIFIES\" | \"CLASSIFIES\" | \"DISTILLS\" | \"ABSTRACTS\" | \"ELIMINATES\" | \"AUDITS\" | \"MEASURES\" | \"SCORES\" | \"CORRECTS\" | \"RENDERS\" | \"COMPOSES\" | \"FOLDS\"\n<description> ::= <text>\n<body> ::= <node>+ <repair_edge>* <optional_invariant_block> <optional_report_block>\n<optional_invariant_block> ::= <invariant_block> | ε\n<optional_report_block> ::= <report_block> | ε\n\n# Meta block\n<meta_block> ::= \"%%\" \"META\" \"%%\" \":\" <meta_field>+\n<meta_field> ::= \"objective\" \":\" <string>\n| \"priority\" \":\" <authority_chain>\n| \"trust\" \":\" <trust_assignment> (\",\" <trust_assignment>)*\n| \"jurisdiction\" \":\" <scope> \"|\" \"external\" \":\" <scope>\n| \"recursion_limit\" \":\" <number>\n<authority_chain> ::= <identifier> (\">\" <identifier>)*\n<trust_assignment> ::= <identifier> \"=\" (\"TRUSTED\" | \"UNTRUSTED\" | <identifier>)\n<scope> ::= <text>\n\n# Node\n<node> ::= <node_header> <node_meta_tag>* <contract> <optional_output_contract> <handoff_gate>\n<node_header> ::= \"#\" \"NODE\" <node_number> \"—\" <node_title> \"[\" <layer> \"·\" <axis> \"·\" <math_type> \"·\" \"yields:\" <shape> \"]\"\n<node_number> ::= <digit>+\n<node_title> ::= <text>\n<layer> ::= \"epistemic\" | \"conative\" | \"evaluative\"\n<axis> ::= \"ontology\" | \"teleology\" | \"analysis\" | \"reasoning\" | \"formalisation\" | \"verification\" | \"representation\" | \"termination\"\n<math_type> ::= \"set-theory\" | \"logic\" | \"graph\" | \"algebra\" | \"analysis\" | \"optimisation\" | \"topology\" | \"computation\" | \"probability\" | \"information-theory\" | \"dynamical-systems\"\n<shape> ::= \"set\" | \"boolean\" | \"edge-list\" | \"ranking\" | \"procedure\" | \"artifact\" | <text>\n<node_meta_tag> ::= \"@purpose\" \":\" <string>\n| \"@axis_question\" \":\" <string>\n| \"@cue\" \":\" <string>\n| \"@genesis\" \":\" <substrate_stage>\n| \"@mandatory\"\n<substrate_stage> ::= \"existence\" | \"difference\" | \"relation\" | \"structure\" | \"transformation\" | \"constraint\" | \"emergence\"\n\n# Contract\n<contract> ::= \"CONTRACT\" \":\" \"input\" \":\" <contract_input> \"transform\" \":\" <directive>+ <optional_preserves> <optional_constraints> \"output\" \":\" <text> <optional_freshness> <optional_handoff_summary>\n<contract_input> ::= \"NODE\" <node_number> <text> | <slot> | <declared_variable> | <text>\n<optional_preserves> ::= (\"preserves\" \":\" <distinction_set>) | ε\n<distinction_set> ::= <text> (\",\" <text>)*\n<optional_constraints> ::= (\"constraints\" \":\" <text>) | ε\n<optional_freshness> ::= (\"freshness\" \":\" <fingerprint> \"+\" <fingerprint>) | ε\n<fingerprint> ::= <text>\n<optional_handoff_summary> ::= (\"handoff\" \":\" <text>) | ε\n<optional_output_contract> ::= (\"#\" \"OUTPUT\" \"CONTRACT\" <declaration_statement>+) | ε\n<slot> ::= \"{\" <identifier> (\".\" <identifier>)* \"}\"\n<declared_variable> ::= <variable_name>\n\n# Handoff gate\n<handoff_gate> ::= \"HANDOFF\" \"GATE\" <optional_gate_qualifier> \":\" <optional_rule_id> <check_line>+ <optional_refusal_line> <optional_standing_line> <result_line>\n<optional_gate_qualifier> ::= (\"(\" <text> \")\") | ε\n<optional_rule_id> ::= (\"rule_id\" \":\" <string> \"yields\" \":\" <shape>) | ε\n<check_line> ::= <check_marker> <check_condition> \"(\" \"evidence\" \":\" <text> \")\" <optional_population_clause>\n<check_marker> ::= \"[check]\" | \"ASSERT\" | \"REQUIRE\"\n<check_condition> ::= <boolean_expr>\n<optional_population_clause> ::= <population_clause> | ε\n<population_clause> ::= \"over\" \":\" <set> \"measured\" \":\" <count> \"/\" <count>\n<set> ::= <text>\n<count> ::= <number> | <text>\n<optional_refusal_line> ::= (\"refuse\" \":\" <condition> \"before\" <write>) | ε\n<write> ::= <semantic_operation> | <text>\n<optional_standing_line> ::= (\"standing\" \":\" \"moved-set\" <set>) | ε\n<result_line> ::= \"result\" \":\" \"pass\" \"->\" <next_node> (\"|\" <failure_name> \"->\" \"REPAIR\" \"(\" \"owner\" \":\" <owner_node> \")\")+ \"|\" \"unknown\" \"->\" \"BLOCKED\"\n<verdict> ::= \"pass\" | \"fail\" | \"unknown\"\n<next_node> ::= \"NODE\" <node_number> | \"TERMINATE\"\n<failure_name> ::= <text>\n<owner_node> ::= \"NODE\" <node_number> | <identifier>\n<repair_edge> ::= \"#\" \"REPAIR\" \"EDGE\" <text>\n\n# Invariant block\n<invariant_block> ::= \"#\" \"CROSS-NODE\" \"INVARIANTS\" <invariant_record>+\n<invariant_record> ::= \"INVARIANT\" <name> \":\" <property> \"over\" \":\" <set> \"binds\" \":\" <parties> \"objector\" \":\" (<check_ref> | \"none\")\n<name> ::= <identifier>\n<property> ::= <text>\n<parties> ::= <text>\n<check_ref> ::= \"[check]\" <text>\n\n# Report block\n<report_block> ::= \"REPORT\" \":\" <report_field>+\n<report_field> ::= \"subject\" \":\" <node_ref>\n| \"verdict\" \":\" <verdict>\n| \"domain\" \":\" \"declared\" <count> \"measured\" <count>\n| \"populations\" \":\" <partition_list>\n| \"inputs\" \":\" <fingerprint_list>\n| \"code\" \":\" <fingerprint>\n| \"output\" \":\" <fingerprint>\n| \"refusals\" \":\" <count> <reason_list>\n| \"unresolved\" \":\" <count> <reason_list>\n| \"completion\" \":\" \"saturated\" <boolean> \"complete\" <boolean> \"verified\" <boolean>\n<node_ref> ::= \"NODE\" <node_number>\n<partition_list> ::= <text> <count> (\",\" <text> <count>)*\n<fingerprint_list> ::= <text> <fingerprint> (\",\" <text> <fingerprint>)*\n<reason_list> ::= \"[\" <text> (\",\" <text>)* \"]\"\n\n# Macro\n<macro> ::= \"USE\" \"TEMPLATE\" <template_name>\n<template_name> ::= <identifier>\n\n# Rule\n<rule_declaration> ::= \"RULE\" <rule_name> \":\" <rule_body>\n<rule_name> ::= <identifier>\n<rule_body> ::= <when_clause>* <directive>+\n<when_clause> ::= \"WHEN\" <condition> \":\" <directive>+",
                    "kind": "code",
                    "language": "bnf",
                    "title": "BNF grammar"
                  }
                ],
                "content": "These rules cover [document structure](/pag/guide#document-structure), the meta block, nodes, contracts, handoff gates, invariant records and the report.",
                "title": "Planning rules"
              },
              {
                "blocks": [
                  {
                    "code": "# Directive\n<directive> ::= <optional_task_marker> <optional_meta_tag> <optional_context_cue> <directive_body>\n<directive_body> ::= <action_expr>\n| <control_flow>\n| <declaration_statement>\n| <transform_statement>\n| <discovery_statement>\n| <iteration_statement>\n| <function_declaration>\n| <announcement_statement>\n| <state_machine_declaration>\n| <dag_declaration>\n| <priority_queue_declaration>\n| <priority_queue_operation>\n| <surface_declaration>\n| <wait_statement>\n| <flowchart_declaration>\n| <mermaid_declaration>\n| <ascii_flowchart_block>\n| <macro>\n<optional_task_marker> ::= <task_marker> | ε\n<task_marker> ::= \"[\" <task_state> \"]\"\n<task_state> ::= \" \" | \"x\" | \">\"\n<optional_meta_tag> ::= <node_meta_tag> | ε\n<optional_context_cue> ::= (\"@cue\" \":\" <string>) | ε\n\n# Action expression\n<action_expr> ::= <action_verb> <modifier>* <action_target> <optional_action_args>\n<action_verb> ::= <semantic_operation>\n| \"EXECUTE\" | \"READ\" | \"WRITE\" | \"DELETE\" | \"REMOVE\" | \"ANALYZE\"\n| \"CREATE\" | \"FIND\" | \"REPORT\" | \"VALIDATE\" | \"VERIFY\"\n| \"COLLECT\" | \"EXTRACT\" | \"LINK\" | \"DETERMINE\" | \"CLASSIFY\"\n| \"INVESTIGATE\" | \"FILTER\" | \"COMPARE\" | \"CONVERT\" | \"MERGE\" | \"SPLIT\" | \"MARK\"\n| \"SORT\" | \"RANK\" | \"ORDER\" | \"INSERT\" | \"APPEND\"\n| \"ADD\" | \"MOVE\" | \"COPY\" | \"BACKUP\" | \"RESTORE\" | \"LOAD\"\n| \"ITERATE\" | \"ATTEMPT\" | \"ENFORCE\" | \"RENAME\"\n| \"FAIL\" | \"EXIT\" | \"RETURN\" | \"WAIT\" | \"SEND\"\n| \"REDUCE\" | \"PROPAGATE\" | \"FINALIZE\" | \"EVIDENCE\"\n| \"PREDICT\" | \"EXPLAIN\" | \"REFLECT\" | \"ABSTRACT\" | \"GENERALISE\" | \"DESCRIBE\" | \"FORMALISE\"\n<semantic_operation> ::= \"DISCOVER_RESOURCES\" | \"READ_RESOURCE\" | \"SEARCH_CONTENT\" | \"ANALYZE_CONTENT\" | \"EXTRACT_FACTS\" | \"CALCULATE_METRIC\"\n| \"COMPOSE_ARTIFACT\" | \"VALIDATE_ARTIFACT\" | \"PERSIST_ARTIFACT\" | \"EXECUTE_TOOL\" | \"REQUEST_DECISION\" | \"REPORT_RESULT\"\n<modifier> ::= \"MUST\" | \"NEVER\" | \"ALWAYS\" | \"REQUIRED\" | \"MANDATORY\"\n<action_target> ::= <tool_name> | <path> | <variable_name>\n<tool_name> ::= \"SYSTEM\" | \"USER\" | \"SERVICE\"\n<optional_action_args> ::= <parenthesized_args> | <bare_args> | ε\n<parenthesized_args> ::= \"(\" <arg_list> \")\"\n<bare_args> ::= <arg_list>\n<arg_list> ::= <arg> (\",\" <arg>)*\n<arg> ::= <identifier> | <literal> | <expression>\n\n# Control flow\n<control_flow> ::= <if_statement>\n| <for_loop>\n| <while_loop>\n| <try_catch>\n| <goto_statement>\n| <label_declaration>\n| <flow_marker>\n<if_statement> ::= \"IF\" <condition> \":\" <directive>+\n(\"ELSE\" \"IF\" <condition> \":\" <directive>+)*\n<optional_else_clause>\n<optional_else_clause> ::= (\"ELSE\" \":\" <directive>+) | ε\n<for_loop> ::= \"FOR\" \"EACH\" <iterator> \"IN\" <collection> \":\" <directive>+\n<while_loop> ::= \"WHILE\" <condition> \":\" <directive>+\n<try_catch> ::= \"TRY\" \":\" <directive>+\n\"CATCH\" <optional_exception_var> \":\" <directive>+\n<optional_exception_var> ::= <exception_var> | ε\n<exception_var> ::= <identifier>\n<goto_statement> ::= \"GOTO\" <label_identifier>\n<label_declaration> ::= <label_identifier> \":\"\n<label_identifier> ::= <identifier>\n<flow_marker> ::= \"START\" <optional_label>\n| \"LOOP\" <optional_backto>\n| \"END\"\n| \"STOP\"\n<optional_label> ::= <identifier> | ε\n<optional_backto> ::= (\"BACKTO\" <identifier>) | ε\n\n# Declaration statement\n<declaration_statement> ::= \"SET\" <variable_name> \"=\" <expression>\n| \"DECLARE\" <variable_name> \":\" <type_annotation>\n<type_annotation> ::= \"string\" | \"number\" | \"boolean\" | \"array\" | \"object\" | \"file\" | \"context\"\n\n# Transform statement\n<transform_statement> ::= <backup_directive> <edit_directive> <optional_analyze_directive>\n<backup_directive> ::= \"BACKUP\" <path> \"TO\" <backup_location>\n| \"COPY\" <path> \"TO\" <backup_location>\n<edit_directive> ::= \"PERSIST_ARTIFACT\" <artifact> \"TO\" <destination>\n| \"WRITE\" <path> <write_spec>\n| \"EXECUTE_TOOL\" <edit_command> \"WITH\" \"timeout\" \":\" <number>\n<edit_command> ::= <identifier>\n<artifact> ::= <variable_name>\n<analyze_directive> ::= \"VALIDATE_ARTIFACT\" <artifact> \"AGAINST\" <verification_condition>\n<optional_analyze_directive> ::= <analyze_directive> | ε\n<backup_location> ::= <path>\n<write_spec> ::= \"CONTENT\" <string>\n| \"FROM\" <source_file>\n| \"INTO\" <destination>\n| <string>\n<source_file> ::= <path>\n<destination> ::= <path>\n<verification_condition> ::= <condition>\n\n# Discovery statement\n<discovery_statement> ::= <discovery_action> <optional_verification_check>\n<discovery_action> ::= \"DISCOVER_RESOURCES\" <pattern> <optional_scope> \"INTO\" <collection_var>\n| \"SEARCH_CONTENT\" <search_scope> \"FOR\" <search_term> \"INTO\" <collection_var>\n| \"FIND\" <search_term> \"IN\" <search_location>\n<verification_check> ::= \"IF\" \"exists\" \":\" <directive>+\n| \"ANALYZE\" <expression> <comparison_op> <expression>\n<optional_verification_check> ::= <verification_check> | ε\n<optional_scope> ::= \"IN\" <search_scope> | ε\n<search_scope> ::= <path>\n<search_location> ::= <path>\n<search_term> ::= <string>\n<collection_var> ::= <variable_name>",
                    "kind": "code",
                    "language": "bnf",
                    "title": "BNF grammar"
                  }
                ],
                "content": "These rules cover directives, actions, control flow and declarations.",
                "title": "Statement rules"
              },
              {
                "blocks": [
                  {
                    "code": "# Expressions\n<expression> ::= <pipeline_expr>\n<pipeline_expr> ::= <logical_or_expr> (\"|>\" <logical_or_expr>)*\n<logical_or_expr> ::= <logical_and_expr> (\"OR\" <logical_and_expr>)*\n<logical_and_expr> ::= <equality_expr> (\"AND\" <equality_expr>)*\n<equality_expr> ::= <relational_expr> ((\"===\" | \"!==\") <relational_expr>)*\n<relational_expr> ::= <additive_expr> ((\"<\" | \">\" | \"<=\" | \">=\") <additive_expr>)*\n| <additive_expr> \"MATCHES\" <pattern>\n| <additive_expr> \"FOR\" <expression>\n| <additive_expr> \"BETWEEN\" <expression>\n<additive_expr> ::= <multiplicative_expr> ((\"+\" | \"-\") <multiplicative_expr>)*\n<multiplicative_expr> ::= <unary_expr> ((\"*\" | \"/\" | \"%\") <unary_expr>)*\n<unary_expr> ::= (\"!\" | \"NOT\" | \"-\" | \"+\") <postfix_expr>\n| <postfix_expr>\n<postfix_expr> ::= <primary_expr> <postfix_op>*\n<postfix_op> ::= \"[\" <expression> \"]\"\n| \".\" <identifier>\n| \"(\" <optional_arg_list> \")\"\n<primary_expr> ::= <array_literal>\n| <object_literal>\n| <literal>\n| <identifier>\n| \"(\" <expression> \")\"\n<array_literal> ::= \"[\" <optional_expression_list> \"]\"\n<object_literal> ::= \"{\" <optional_key_value_pairs> \"}\"\n<expression_list> ::= <expression> (\",\" <expression>)*\n<optional_expression_list> ::= <expression_list> | ε\n<key_value_pair> ::= <object_key> \":\" <expression>\n<object_key> ::= <identifier> | <string> | <number>\n<key_value_pairs> ::= <key_value_pair> (\",\" <key_value_pair>)*\n<optional_key_value_pairs> ::= <key_value_pairs> | ε\n<function_call> ::= <function_name> \"(\" <optional_arg_list> \")\"\n<optional_arg_list> ::= <arg_list> | ε\n<condition> ::= <expression>\n<boolean_expr> ::= <logical_or_expr>\n<verification_expr> ::= <expression>\n<term> ::= <multiplicative_expr>\n<factor> ::= <primary_expr>\n<pattern> ::= <string> | <regex_literal>\n<regex_literal> ::= \"/\" <regex_pattern> \"/\" <optional_regex_flags>\n<optional_regex_flags> ::= <regex_flags> | ε\n<regex_pattern> ::= <any_regex_character>+\n<regex_flags> ::= <letter>+\n<comparison_op> ::= \"===\" | \"!==\" | \"<\" | \">\" | \"<=\" | \">=\"\n\n# Lexical\n<identifier> ::= <letter> (<letter> | <digit> | \"_\" | \"-\")*\n<variable_name> ::= <identifier>\n<function_name> ::= <identifier>\n<node_name> ::= <identifier>\n<path> ::= <directory_path> | <file_path>\n<directory_path> ::= <path_segment> (\"/\" <path_segment>)* \"/\"\n<file_path> ::= <path_segment> (\"/\" <path_segment>)* <optional_file_extension>\n<path_segment> ::= <identifier>\n<optional_file_extension> ::= (\".\" <identifier>) | ε\n<literal> ::= <number> | <string> | <boolean>\n<number> ::= <digit>+ <optional_decimal>\n<optional_decimal> ::= (\".\" <digit>+) | ε\n<string> ::= '\"' <char>* '\"' | \"'\" <char>* \"'\"\n<boolean> ::= \"true\" | \"false\"\n<digit> ::= \"0\" | \"1\" | \"2\" | \"3\" | \"4\" | \"5\" | \"6\" | \"7\" | \"8\" | \"9\"\n<letter> ::= \"a\"..\"z\" | \"A\"..\"Z\"\n<char> ::= <any_character>\n<text> ::= <char>+\n<yaml_content> ::= <text>\n<any_character> ::= <letter> | <digit> | <whitespace> | <symbol>\n<symbol> ::= \"_\" | \"-\" | \".\" | \",\" | \":\" | \";\" | \"!\" | \"?\" | \"@\" | \"#\" | \"$\" | \"%\" | \"^\" | \"&\" | \"*\" | \"(\" | \")\" | \"[\" | \"]\" | \"{\" | \"}\" | \"<\" | \">\" | \"/\" | \"\\\" | \"|\" | \"=\" | \"+\" | \"`\" | \"~\"\n<any_regex_character> ::= <letter> | <digit> | <symbol>\n<whitespace> ::= \" \" | \"\t\" | \"\n\" | \"\r\"\n\n# Iteration statement\n<iteration_statement> ::= <loop_header> <loop_body>\n<loop_header> ::= \"FOR\" \"EACH\" <iterator> \"IN\" <collection>\n<loop_body> ::= \":\" <directive>+ <optional_accumulation> <optional_recursion_limit>\n<accumulation_statement> ::= \"APPEND\" <value> \"TO\" <accumulator>\n| \"CREATE\" <structure> \"FROM\" <iterator>\n| \"EXTRACT\" <components> \"INTO\" <structure>\n| \"WRITE\" <data> \"INTO\" <storage>\n| \"COLLECT\" <items> \"INTO\" <collection>\n| \"SET\" <state_var> \"=\" <state_expr>\n<recursion_limit> ::= \"recursion_limit\" \":\" <number>\n<optional_accumulation> ::= <accumulation_statement> | ε\n<optional_recursion_limit> ::= <recursion_limit> | ε\n<iterator> ::= <variable_name>\n<collection> ::= <variable_name> | <expression>\n<value> ::= <expression>\n<accumulator> ::= <variable_name>\n<structure> ::= <variable_name>\n<components> ::= <expression>\n<data> ::= <expression>\n<items> ::= <expression>\n<storage> ::= <variable_name>\n<state_var> ::= <variable_name>\n<state_expr> ::= <expression>\n\n# Function declaration\n<function_declaration> ::= \"FUNCTION\" <function_name> \"(\" <optional_param_list> \")\" \":\" <directive>+\n<optional_param_list> ::= <param_list> | ε\n<param_list> ::= <parameter> (\",\" <parameter>)*\n<parameter> ::= <variable_name>\n\n# Announcement statement\n<announcement_statement> ::= \"REPORT\" <message>\n<message> ::= <string> | <expression>",
                    "kind": "code",
                    "language": "bnf",
                    "title": "BNF grammar"
                  }
                ],
                "content": "These rules cover expressions, operators, literals and lexical elements.",
                "title": "Expression rules"
              },
              {
                "blocks": [
                  {
                    "code": "# Await\n<await_statement> ::= \"AWAIT\" <awaitable_expression> <optional_result_binding>\n<awaitable_expression> ::= <identifier> | <string> | <tool_invocation>\n<optional_result_binding> ::= \"INTO\" <identifier> | ε\n\n# Parallel\n<parallel_block> ::= \"PARALLEL\" \":\" <directive>+ \"END\"\n\n# Surface\n<surface_declaration> ::= \"SURFACE\" <surface_key> \":\" <record_declaration>+\n<record_declaration> ::= \"RECORD\" <record_id> \"subject\" \":\" <subject_key> <edge_clause>* <item>*\n<item> ::= \"ITEM\" <item_id> \"TO\" <reader> \":\" <text>\n<edge_clause> ::= <edge_kind> <target_id>\n<edge_kind> ::= \"PARENT\" | \"SATISFIED_BY\" | \"BLOCKS\" | \"ANSWERS\" | \"REFUTES\" | \"SUPERSEDES\"\n<derived_state> ::= \"OPEN\" | \"BLOCKED\" | \"ABSORBED\"\n<wait_statement> ::= \"WAIT\" \"ON\" <surface_key> \"AS\" <reader> \"INTO\" <diff_binding>\n<barrier_statement> ::= \"BARRIER\" \"ON\" <surface_key>\n<swap_statement> ::= \"SWAP\" ** \"AGAINST\" ****<read>****\n****<reader>**** ::= \"participant\" | \"bounded\" | ****<identifier>****\n****<surface_key>**** ::= ****<identifier>****\n****<record_id>**** ::= ****<surface_key>**** \"-\" ****<number>****\n****<item_id>**** ::= ****<record_id>**** \"-\" ****<number>****\n****<subject_key>**** ::= ****<identifier>****\n****<target_id>**** ::= ****<record_id>**** | ****<path>****\n****<diff_binding>**** ::= ****<variable_name>****\n**** ::= ****<text>****\n****<read>**** ::= ****<variable_name>****\n\n# State machine\n****<state_machine_declaration>**** ::= \"STATE_MACHINE\" ****<machine_name>**** \":\" ****<state_definition>****+ ****<transition_definition>****+\n****<state_definition>**** ::= \"STATE\" ****<state_name>**** ****<optional_state_type>****\n****<optional_entry_actions>****\n****<optional_exit_actions>****\n****<transition_definition>**** ::= \"TRANSITION\" \"FROM\" ****<state_name>**** \"TO\" ****<state_name>****\n\"ON\" ****<event_name>****\n****<optional_guard>****\n****<optional_transition_actions>****\n****<optional_state_type>**** ::= \":\" ****<state_type>**** | ε\n****<optional_entry_actions>**** ::= \"ENTRY\" \":\" ****<directive>****+ | ε\n****<optional_exit_actions>**** ::= \"EXIT\" \":\" ****<directive>****+ | ε\n****<optional_guard>**** ::= \"GUARD\" \":\" ****<condition>**** | ε\n****<optional_transition_actions>**** ::= \":\" ****<directive>****+ | ε\n****<machine_name>**** ::= ****<variable_name>****\n****<state_name>**** ::= ****<variable_name>****\n****<state_type>**** ::= ****<identifier>****\n****<event_name>**** ::= ****<variable_name>****\n\n# DAG\n****<dag_declaration>**** ::= \"DAG\" ****<dag_name>**** \":\" ****<dag_item>****+\n****<dag_item>**** ::= ****<node_definition>**** | ****<parallel_group>****\n****<node_definition>**** ::= \"NODE\" ****<node_name>**** ****<optional_node_type>****\n****<optional_depends_on>****\n****<optional_after>****\n****<optional_before>****\n\":\" ****<directive>****+\n****<parallel_group>**** ::= \"PARALLEL_GROUP\" \":\" ****<node_name_list>****\n****<dependency_list>**** ::= ****<node_name>**** (\",\" ****<node_name>****)*\n****<dependent_list>**** ::= ****<node_name>**** (\",\" ****<node_name>****)*\n****<node_name_list>**** ::= ****<node_name>**** (\",\" ****<node_name>****)*\n****<optional_node_type>**** ::= \":\" ****<node_type>**** | ε\n****<optional_depends_on>**** ::= \"DEPENDS_ON\" \"[\" ****<dependency_list>**** \"]\" | ε\n****<optional_after>**** ::= \"AFTER\" ****<dependency_list>**** | ε\n****<optional_before>**** ::= \"BEFORE\" ****<dependent_list>**** | ε\n****<dag_name>**** ::= ****<variable_name>****\n****<node_type>**** ::= ****<identifier>****\n\n# Priority queue\n****<priority_queue_declaration>**** ::= \"PRIORITY_QUEUE\" ****<queue_name>****\n****<optional_comparison>****\n\":\"\n****<priority_queue_operation>**** ::= ****<enqueue_statement>****\n| ****<dequeue_statement>****\n| ****<peek_statement>****\n| ****<heapify_statement>****\n****<enqueue_statement>**** ::= \"ENQUEUE\" ****<value>**** \"TO\" ****<queue_name>****\n****<optional_priority>****\n****<dequeue_statement>**** ::= \"DEQUEUE\" \"FROM\" ****<queue_name>****\n****<optional_target>****\n****<peek_statement>**** ::= \"PEEK\" ****<queue_name>****\n****<optional_target>****\n****<heapify_statement>**** ::= \"HEAPIFY\" ****<queue_name>****\n****<comparison_function>**** ::= ****<function_name>****\n| \"(\" ****<optional_param_list>**** \")\" \"→\" ****<expression>****\n****<optional_comparison>**** ::= \"COMPARE_BY\" ****<comparison_function>**** | ε\n****<optional_priority>**** ::= \"PRIORITY\" \"=\" ****<priority_value>**** | ε\n****<optional_target>**** ::= \"TO\" ****<target_variable>**** | ε\n****<queue_name>**** ::= ****<variable_name>****\n****<priority_value>**** ::= ****<number>**** | ****<expression>****\n****<target_variable>**** ::= ****<variable_name>****\n\n# Cross reference\n****<cross_reference_statement>**** ::= ****<collect_from_statement>****\n| ****<find_in_statement>****\n| ****<reference_statement>****\n| ****<link_statement>****\n****<collect_from_statement>**** ::= \"FROM\" ****<file_path_pattern>**** \"COLLECT\" ****<selector>**** \"TO\" ****<target_variable>****\n****<find_in_statement>**** ::= \"FROM\" ****<file_path_pattern>**** \"FIND\" ****<search_term>**** \"TO\" ****<target_variable>****\n****<reference_statement>**** ::= \"REFERENCE\" ****<file_path_pattern>**** ****<optional_alias>****\n****<link_statement>**** ::= \"LINK\" ****<source_expression>**** \"TO\" ****<file_reference>****\n****<file_path_pattern>**** ::= ****<string>**** | ****<glob_pattern>****\n****<glob_pattern>**** ::= ****<string>****\n****<file_reference>**** ::= ****<string>**** ****<optional_anchor>****\n****<optional_anchor>**** ::= \"#\" ****<identifier>**** | ε\n****<selector>**** ::= ****<expression>**** | \"*\"\n****<search_term>**** ::= ****<string>**** | ****<regex_literal>****\n****<target_variable>**** ::= ****<variable_name>****\n****<source_expression>**** ::= ****<expression>****\n****<alias>**** ::= ****<identifier>****\n****<optional_alias>**** ::= \"AS\" ****<alias>**** | ε\n\n# Semantic operation\n****<tool_invocation>**** ::= ****<semantic_operation>**** ****<tool_target>**** ****<optional_tool_param_clause>**** ****<optional_tool_result_clause>****\n****<tool_target>**** ::= ****<string>**** | ****<identifier>**** | ****<file_path>**** | ****<expression>****\n****<optional_tool_param_clause>**** ::= ****<tool_param_clause>**** | ε\n****<tool_param_clause>**** ::= \"WITH\" ****<tool_param_list>****\n| \"USING\" ****<tool_param_list>****\n****<tool_param_list>**** ::= ****<tool_param_pair>**** (\",\" ****<tool_param_pair>****)*\n****<tool_param_pair>**** ::= ****<tool_param_name>**** \":\" ****<tool_param_value>****\n| ****<tool_param_name>**** \"=\" ****<tool_param_value>****\n| ****<tool_param_name>****\n****<tool_param_name>**** ::= ****<identifier>****\n****<tool_param_value>**** ::= ****<string>****\n| ****<number>****\n| ****<boolean>****\n| ****<identifier>****\n| ****<array_literal>****\n| ****<object_literal>****\n****<optional_tool_result_clause>**** ::= ****<tool_result_clause>**** | ε\n****<tool_result_clause>**** ::= \"->\" ****<tool_result_binding>****\n| \"INTO\" ****<tool_result_binding>****\n| \"AS\" ****<tool_result_binding>****\n****<tool_result_binding>**** ::= ****<identifier>**",
                    "kind": "code",
                    "language": "bnf",
                    "title": "BNF grammar"
                  }
                ],
                "content": "These rules cover the structure declarations, the [shared surface](/pag/orchestration#shared-surfaces) and the [semantic operations](/pag/guide#tool-invocation).",
                "title": "Coordination rules"
              },
              {
                "blocks": [
                  {
                    "code": "# Flowchart\n<flowchart_declaration> ::= \"FLOWCHART\" <flowchart_name> <optional_flowchart_state> <optional_flowchart_layout> \":\" <flowchart_body>\n<optional_flowchart_layout> ::= \"LAYOUT\" <flowchart_layout> | ε\n<flowchart_body> ::= <flowchart_line>+ <optional_error_handler>\n<optional_error_handler> ::= <error_handler> | ε\n<error_handler> ::= \"ON\" \"ERROR\" \":\" <directive>+\n<flowchart_line> ::= <flowchart_node>\n| <flowchart_edge>\n| <flowchart_branch>\n| <flowchart_merge>\n| <flowchart_loop>\n<flowchart_node> ::= <node_label> <node_shape> <optional_shape_type> <optional_node_content>\n<node_label> ::= <identifier> | <string>\n<node_shape> ::= \"[\" <text> \"]\"\n| \"(\" <text> \")\"\n| \"{\" <text> \"}\"\n| \"<\" <text> \">\"\n| \"((\" <text> \"))\"\n| \"[[\" <text> \"]]\"\n<optional_shape_type> ::= \":\" <flowchart_shape_types> | ε\n<optional_node_content> ::= <node_content> | ε\n<node_content> ::= \":\" <node_block>\n<node_block> ::= <directive>+\n| \"EVALUATE\" <condition>\n| \"EXECUTE\" <function_call>\n| \"TRY\" \":\" <directive>+ \"CATCH\" \":\" <directive>+\n<optional_flowchart_state> ::= \"WITH\" \"STATE\" <state_declaration>+ | ε\n<state_declaration> ::= <variable_name> \":\" <type_annotation> \"=\" <expression>\n<flowchart_edge> ::= <edge_source> <edge_arrow> <edge_target> <optional_edge_label>\n<edge_source> ::= <identifier>\n<edge_target> ::= <identifier>\n<edge_arrow> ::= \"→\" | \"↓\" | \"↑\" | \"←\" | \"↔\"\n| \"-->\" | \"--->\" | \"==>\" | \"-.->>\"\n| \"|\"\n<optional_edge_label> ::= \":\" <string> | ε\n<flowchart_branch> ::= <branch_source> \"/\" <branch_option>+\n<branch_source> ::= <identifier>\n<branch_option> ::= <branch_condition> \"→\" <branch_target>\n<branch_condition> ::= <condition> | <string>\n<branch_target> ::= <identifier>\n<flowchart_merge> ::= <merge_source>+ \"◄\" <merge_target>\n<merge_source> ::= <identifier>\n<merge_target> ::= <identifier>\n<flowchart_loop> ::= \"LOOP\" <loop_source> \"→\" <loop_target> <optional_loop_limit>\n<loop_source> ::= <identifier>\n<loop_target> ::= <identifier>\n<optional_loop_limit> ::= \"MAX\" <number> | ε\n<flowchart_shape_types> ::= \"process\"\n| \"decision\"\n| \"start_end\"\n| \"input_output\"\n| \"subprocess\"\n| \"database\"\n<flowchart_layout> ::= \"vertical\" | \"horizontal\" | \"lr\" | \"rl\" | \"tb\" | \"bt\"\n<flowchart_name> ::= <variable_name>\n\n# ASCII flowchart\n<ascii_flowchart_block> ::= <ascii_flowchart_line>+\n<ascii_flowchart_line> ::= <ascii_node_line>\n| <ascii_connector_line>\n| <ascii_branch_line>\n| <ascii_merge_line>\n<ascii_node_line> ::= <indent> <ascii_node>\n<ascii_node> ::= \"[\" <text> \"]\"\n| \"(\" <text> \")\"\n| \"{\" <text> \"}\"\n| \"<\" <text> \">\"\n<ascii_connector_line> ::= <indent> \"|\"\n| <indent> \"│\"\n| <indent> \"▼\"\n| <indent> \"▲\"\n| <indent> \"►\"\n| <indent> \"◄\"\n<ascii_branch_line> ::= <indent> \"/\" <indent> \"\\\"\n| <indent> \"▼\" <indent> \"▼\"\n<ascii_merge_line> ::= <indent> \"\\\" <indent> \"/\"\n| <indent> \"◄\" \"─\" \"┘\"\n<indent> ::= <whitespace>*\n\n# Mermaid flowchart\n<mermaid_declaration> ::= \"MERMAID\" <mermaid_type> \":\" <mermaid_body>\n<mermaid_type> ::= \"flowchart\" | \"graph\" | \"sequence\" | \"class\" | \"state\" | \"er\"\n<mermaid_body> ::= <mermaid_line>+\n<mermaid_line> ::= <mermaid_node_def>\n| <mermaid_connection>\n| <mermaid_subgraph>\n| <mermaid_style>\n<mermaid_node_def> ::= <node_id> <mermaid_node_shape> <optional_node_text>\n<node_id> ::= <identifier>\n<mermaid_node_shape> ::= \"[\" <text> \"]\"\n| \"(\" <text> \")\"\n| \"{\" <text> \"}\"\n| \"((\" <text> \"))\"\n| \"[[\" <text> \"]]\"\n| \"[/\" <text> \"/]\"\n| \"[\\\" <text> \"\\]\"\n<optional_node_text> ::= <text> | ε\n<mermaid_connection> ::= <node_id> <mermaid_arrow> <node_id> <optional_connection_text>\n<mermaid_arrow> ::= \"-->\" | \"--->\" | \"==>\" | \"-.->\" | \"--\"\n<optional_connection_text> ::= \"|\" <text> \"|\" | ε\n<mermaid_subgraph> ::= \"subgraph\" <subgraph_title> <mermaid_line>+ \"end\"\n<subgraph_title> ::= <string>\n<mermaid_style> ::= \"style\" <node_id> <style_properties>\n<style_properties> ::= <style_property> (\",\" <style_property>)*\n<style_property> ::= <identifier> \":\" <string>",
                    "kind": "code",
                    "language": "bnf",
                    "title": "BNF grammar"
                  }
                ],
                "content": "These rules cover flowcharts written in PAG's own form, in ASCII and in Mermaid.",
                "title": "Flowchart rules"
              }
            ],
            "title": "BNF grammar"
          }
        ]
      },
      {
        "icon": "bi-check2-circle",
        "id": "validation",
        "label": "Validation",
        "sections": [
          {
            "icon": "bi-check2-circle",
            "id": "validation-gates",
            "intro": "This section covers the handoff gate that closes every node. A gate holds three to five checks, each compared against the node's output and each carrying the evidence that decided it and the set it was measured over, as shown in [a gate] and [at the boundary]. Its result line has three arms, which send a pass to the next node, a failure to the node that owns the repair, and an unknown to blocked, as shown in [verdict and domain]. A judgement is rewritten as a comparison in [judgement or check], and [who decides] shows the difference between the two. The gate is the verify stage of [the loop](/disciplined-methodology#the-loop), and its third arm is the rule described in [unknown is not pass](/disciplined-methodology/verify#unknown-is-not-pass).",
            "subsections": [
              {
                "blocks": [
                  {
                    "application": "In practice, every node closes on a gate of three to five checks, each written as a comparison against the node's output. A hard assertion and a prerequisite are marked as such, and where the node writes, the condition under which it refuses is named before the write. The result line carries all three arms, so a failed check names what was found and routes to the earliest node that can supply the missing evidence, and an unmeasured claim routes to blocked rather than reading as pass. The next node's contract reads exactly the output the gate confirmed.",
                    "boundary": "A gate checks outcomes, never confidence. How sure the model is, or whether it understood, is not observable from outside, so a check about either belongs under [limits](/pag/validation#limitations) rather than in a gate.",
                    "cause": "A condition that compares an artifact to a value gives the model, the developer and a script the same answer, while a condition that asks whether something looks right can give each of them a different one, and a verdict with no domain cannot say what it was true of.",
                    "decision": "The evidence is written beside each check, together with the set and the count measured over it wherever a check ranges over a set, rather than the verdict standing alone, so a green reads as coverage and not as silence.",
                    "failureMode": "A gate reads that the data looks good, the model reports the gate passed because the data looked good to it, and the next node consumes records that never matched the schema.",
                    "kind": "lesson",
                    "principle": "For this reason a check is a comparison against the node's output, with its evidence, its population and its repair owner beside it, and unknown is a verdict of its own.",
                    "problem": "A vague check passes whatever the reader is inclined to pass, and a check with no domain passes over nothing.",
                    "validation": "To check this, rewrite each check as a comparison and name the artifact on each side and the set it ranged over. A check with no artifact on one side is a judgement and a check with no set is a verdict about nothing, so in either case the gate's green does not say whether the node closed."
                  },
                  {
                    "kind": "text",
                    "text": "The count is bounded on both sides. With fewer than three checks the gate shows that something ran rather than that a unit closed, and with more than five the node holds several decisions and is several nodes. A gate that passes and a gate that was never evaluated produce the same silence, and the evidence beside each check tells them apart. A gate that passed over an empty set produces the same silence with a number attached, and the population beside the verdict exposes it. The result line applies [fail fast](/ontology#arch-fail-fast) at the node boundary, as described for a whole system in [fail at the boundary](/disciplined-methodology/build#fail-at-the-boundary), and its owner is the earliest node that can supply what the check lacked, so a repair invalidates forward from there and nothing earlier is redone."
                  },
                  {
                    "kind": "text",
                    "text": "The refusal line stops the node before an irreversible write, because that is the only moment a refusal costs nothing. The standing line names the surfaces that moved beneath the verdict, and a non-empty moved set withdraws the verdict's standing to be quoted without touching the verdict itself, as derived in [a report, not a checkbox](/disciplined-methodology/verify#a-report-not-a-checkbox). The markers form a closed set with one meaning each, marking a check, a hard assertion, or a prerequisite that a prior node must have yielded. Severity is not a marker, because severity orders repairs among failures and never softens a verdict, and there is no tier between fail and pass."
                  },
                  {
                    "code": "HANDOFF GATE (evidence-bearing):\n  rule_id: \"<NODE NAME>\"   yields: <shape>\n  [check] <file> exists at <path>                    (evidence: the listing that shows it)\n  [check] <settings> conforms to <schema>            (evidence: the validator's report) over: <settings files> measured: <conforming> / <files>\n  [check] every <dependency> in <settings> resolves  (evidence: the resolution log)\n  ASSERT <count> above 0\n  REQUIRE <prior-node>.<output>\n  refuse: <destination> changed since it was read before PERSIST_ARTIFACT\n  standing: moved-set <the surfaces re-read since the node began>\n  result: pass → NODE <n+1> | <which check failed, what was found> → REPAIR (owner: <the earliest node that can supply the evidence>) | unknown → BLOCKED",
                    "kind": "code",
                    "language": "pag",
                    "title": "a gate"
                  },
                  {
                    "code": "# a verdict with no domain · passed over what?\n[check] every settings file conforms                (evidence: the validator's report)\n\n# a verdict beside its domain · zero of zero is not evidence\n[check] every settings file conforms                (evidence: the validator's report) over: <settings files> measured: 12 / 12\n[check] every settings file conforms                (evidence: the validator's report) over: <settings files> measured: 0 / 0    # empty · the gate fails\n\n# the three verdicts · unknown is routed, never absorbed into pass\nresult: pass → NODE 4 | schema mismatch → REPAIR (owner: NODE 2) | unknown → BLOCKED",
                    "kind": "code",
                    "language": "pag",
                    "title": "verdict and domain"
                  },
                  {
                    "code": "# a judgement · its truth depends on the reader\n[check] the email looks valid\n[check] the data is good\n[check] everything worked\n\n# a condition · true or false against the artifact, with what settles it and what it ranged over\n[check] <record>.<email> matches <pattern>          (evidence: the match returned true)\n[check] <records> is non-empty                       (evidence: a count above zero)\n[check] every required field present in <record>    (evidence: no missing field named) over: <records> measured: <complete> / <records>\n[check] <output>.<count> equals <input>.<count>      (evidence: the two numbers)",
                    "kind": "code",
                    "language": "pag",
                    "title": "judgement or check"
                  },
                  {
                    "caption": "at the boundary",
                    "kind": "mermaid",
                    "text": "flowchart TB\n    node[\"A node yields its output\"]\n    conditions[\"Three to five checks · each against the output\"]\n    evidence[\"Each carries the evidence that decided it and the set it ranged over\"]\n    refuse[\"A write is refused before it lands when its condition holds\"]\n    verdict{\"pass · fail · unknown\"}\n    next[\"The next node's contract reads exactly that output\"]\n    action[\"The result line · which check, what was found, which node owns the repair\"]\n    blocked[\"BLOCKED · the answer is owed from outside the run\"]\n    node --> conditions --> evidence --> refuse --> verdict\n    verdict -- pass --> next\n    verdict -- fail --> action\n    verdict -- unknown --> blocked"
                  },
                  {
                    "caption": "who decides",
                    "kind": "mermaid",
                    "text": "flowchart LR\n    judgement[\"looks valid · a judgement\"]\n    who[\"Its truth depends on the reader\"]\n    condition[\"matches the pattern · a condition\"]\n    what[\"True or false against the artifact\"]\n    domain[\"Over a declared set · n of N\"]\n    judgement --> who\n    condition --> what --> domain"
                  }
                ],
                "title": "Checkable, with evidence"
              }
            ],
            "title": "Validation gates"
          },
          {
            "icon": "bi-exclamation-triangle",
            "id": "limitations",
            "intro": "This section covers what a document cannot do and how it says so. The limits a document declares are written in [declared limits], and [what it never reaches] shows what lies beyond a document's reach. A slot resolves to one of three states, as written in [slot states] and shown in [three states], and a reading larger than one session is split as shown in [size and time]. Each limit is one to design for rather than a flaw to route around.",
            "subsections": [
              {
                "blocks": [
                  {
                    "application": "In practice, each limit is declared beside the mechanism a reader would otherwise expect to cover it. A document that exceeds one reading is split into nodes the reader takes one at a time, and only what a directive persists to a surface is carried across sessions.",
                    "boundary": "Declaring a limit does not remove it. Stating that output is probabilistic is the reason the gates exist, so the declaration is not a disclaimer.",
                    "cause": "A branch runs against a value unless the adapter declares there is none, so a missing declaration reads as a value.",
                    "decision": "An adapter that resolves everything is refused, and each branch is routed by the slot's declared state rather than by whether a value happens to exist.",
                    "failureMode": "A workflow declares a parallel group and a watch on a surface, the harness has neither, both branches run against a guess, and the workflow reports every gate green over work that never happened.",
                    "kind": "lesson",
                    "principle": "For this reason an absence is declared where it would otherwise be assumed, and a slot with no analogue is marked absent rather than faked.",
                    "problem": "A directive names a capability the harness may not have.",
                    "validation": "To check this, find the state of each slot a document names in its adapter. A slot with no state is a branch running against a guess, and the repair is a declaration rather than a value."
                  },
                  {
                    "kind": "text",
                    "text": "The limits divide by what a document can and cannot reach. A document reaches the input a reasoning loop reads, and nothing past that. Output is a sample from a distribution on every run, so [reproducibility](/ontology#arch-reproducibility) is not on offer, and the model's confidence is not observable from outside, so a gate cannot condition on it. A document that names its model has written a claim into a slot the harness owns."
                  },
                  {
                    "kind": "text",
                    "text": "The states other than resolved keep a document from running against a guess. An adapter is a [capability declaration](/ontology#arch-capability-declaration), and one that resolves every slot is claiming at least one capability its harness does not have. Size and time are facts about the model reading the document. Its context is bounded, so what crosses a node boundary is the output the next contract reads rather than the whole history, and its session ends, so what the next session needs is persisted rather than remembered."
                  },
                  {
                    "code": "# what a document cannot do · declared where a reader would otherwise assume it\nLIMIT <execution>:      \"a document has no runtime · a reasoning loop walks it and an adapter performs its effects\"\nLIMIT <determinism>:    \"the same document may produce different results across runs\"\nLIMIT <introspection>:  \"a gate checks an outcome · never the model's confidence\"\nLIMIT <portability>:    \"a document written for one model behaves differently under another\"\nLIMIT <persistence>:    \"nothing survives a session unless a directive writes it\"\nLIMIT <concurrency>:    \"a parallel group declares independence · the harness decides what runs together\"\nLIMIT <availability>:   \"an operation assumes the adapter resolves it · an absent resolution is declared, never assumed\"\nLIMIT <feedback>:       \"a document describes a linear or branching flow · watching for change needs a tool\"",
                    "kind": "code",
                    "language": "pag",
                    "title": "declared limits"
                  },
                  {
                    "code": "# a slot resolves to one of three states, and the third is the load-bearing one\nSLOT {toolchain.watch}:    ABSENT    \"this harness cannot block on a surface · the branch does not run\"\nSLOT {toolchain.parallel}: RESOLVED  \"the harness runs a parallel group together\"\nSLOT {project.checkpoint}: DEFERRED  \"a reversible checkpoint will exist · the branch is blocked, not skipped\"\n\nWHEN :\n    IF <slot> is ABSENT:   DECLARE the absence · SKIP the branch\n    IF <slot> is DEFERRED: DECLARE the deferral · BLOCK the branch\n    IF <slot> is RESOLVED: RUN the branch",
                    "kind": "code",
                    "language": "pag",
                    "title": "slot states"
                  },
                  {
                    "code": "# a bounded context is a limit, not a surprise\nWHEN <document> exceeds <what one reading consumes>:\n    SPLIT <document> INTO <nodes the reader takes one at a time>\n    CARRY <the output the next node's contract reads> · never the whole history\n\nWHEN :\n    PERSIST_ARTIFACT <what the next session reads> TO \n    READ_RESOURCE <it> at the start of the next · the document itself remembers nothing",
                    "kind": "code",
                    "language": "pag",
                    "title": "size and time"
                  },
                  {
                    "caption": "what it never reaches",
                    "kind": "mermaid",
                    "text": "flowchart TB\n    doc[\"A document\"]\n    reaches[\"Reaches · the input the loop reads\"]\n    not[\"Does not reach\"]\n    exec[\"Execution · the binding performs the effects\"]\n    out[\"Output · a sample, every run\"]\n    inner[\"The model's confidence\"]\n    other[\"Another model's behaviour\"]\n    doc --> reaches\n    doc -. never .-> not\n    not --> exec\n    not --> out\n    not --> inner\n    not --> other"
                  },
                  {
                    "caption": "three states",
                    "kind": "mermaid",
                    "text": "flowchart LR\n    slot[\"A slot a directive names\"]\n    adapter{\"What does the adapter say?\"}\n    resolved[\"RESOLVED · the branch runs\"]\n    absent[\"ABSENT · declared, the branch does not run\"]\n    deferred[\"DEFERRED · declared, the branch is blocked\"]\n    faked[\"Nothing declared · the branch runs against a guess\"]\n    slot --> adapter\n    adapter -- a value --> resolved\n    adapter -- absent --> absent\n    adapter -- deferred --> deferred\n    adapter -. no declaration .-> faked"
                  }
                ],
                "title": "Declared, never assumed"
              }
            ],
            "title": "Limits"
          }
        ]
      },
      {
        "icon": "bi-file-earmark-code",
        "id": "templates",
        "label": "Templates",
        "sections": [
          {
            "icon": "bi-file-earmark-code",
            "id": "templates-core",
            "intro": "This section covers the template and how an instance is raised from it. A template record has four parts, a declared document type, the slots an instance fills, the constraints every instance must satisfy, and a body in which every slot appears by name, as shown in [template record]. [template and sibling] shows how a template differs from a sibling instance. Raising an instance is a resolution in which each slot is substituted, a slot left unresolved is reported rather than guessed, and a value outside a slot's declared set is a violation. [resolution] lists the three outcomes. The record and [workflow body] are the grammar's own workflow template, read from its records rather than restated here.",
            "subsections": [
              {
                "blocks": [
                  {
                    "application": "In practice, a template is written the second time a shape occurs, before the second instance is written, in the order shown in [second instance]. It declares its type, names every slot with whether it is required and, where the values form a closed set, that set, and it names the constraints every instance must satisfy so a check can read them. The body keeps only what every instance shares, with every varying value as a slot. Each new instance is raised by resolving the slots, and an instance whose resolution reports an unresolved slot or a violation is refused.",
                    "boundary": "A shape seen once has no template, because one instance cannot show which of its parts are invariant. A template raised from one instance is [premature abstraction](/ontology#arch-premature-abstraction).",
                    "cause": "A sibling carries one instance's choices and a template carries the constraint, and a reader copying a sibling cannot tell which is which.",
                    "decision": "The second instance is raised from a template written for it, rather than from the first instance.",
                    "failureMode": "Four parties produce four formats for one surface, each derived from a different sibling, and the check that later reads them derives its schema from a fifth.",
                    "kind": "lesson",
                    "principle": "For this reason a template carries the contract, an instance resolves its slots, and a check reads the template.",
                    "problem": "An instance derived from a sibling inherits that sibling's accidents as a contract.",
                    "validation": "To check this, take a template and find a value in it that would be wrong for the next instance. That value is content rather than contract, and a slot is the repair. Then resolve the template with one slot missing, and a resolution that raises the instance anyway has guessed."
                  },
                  {
                    "kind": "text",
                    "text": "The slots fall into two kinds by who supplies the value. An instance slot is what this document is for, supplied when it is raised. A host slot is a fact about the tree the document will be walked in, namespaced by what it is a fact about, and resolved by the adapter rather than typed into an instance, so one template can be raised in any tree."
                  },
                  {
                    "kind": "text",
                    "text": "The constraints are the family's acceptance criteria, and a check over an instance reads them from the template, as [the drop-in](/disciplined-methodology#onboarding) describes. What the template excludes is as deliberate as what it carries, so it names no model, no path and no tool, for the reasons described in [semantic operations](/pag/guide#tool-invocation). A correction lands in the template and reaches every later instance, never in the instance where only its author would see it."
                  },
                  {
                    "code": "template:\n  type:        WORKFLOW                       # a declared document type · nothing else\n  title:       <what the family is for>\n  slots:\n    - name:        {WORKFLOW_NAME}             # the value an instance supplies\n      description: <what the slot holds>\n      required:    true\n      kind:        string\n    - name:        {project.governance_policy}   # a host fact · resolved by the adapter, never typed\n      required:    true\n    - name:        {limits.max_lines}            # a bound · resolved from the host's limits\n      required:    false\n    - name:        {scope}\n      required:    true\n      enum:        [<investigate>, <action>]     # a closed set · a value outside it is a violation\n  constraints:                                  # what every instance must satisfy · named, checkable\n    - declaration_required\n    - gate_per_node\n    - contract_reads_prior_output\n    - population_declared\n    - refusal_before_write\n    - invariant_has_objector\n    - no_autonomous_spawn\n    - single_source_of_truth\n  body: |\n    <the document, with every slot as {name}>",
                    "kind": "code",
                    "language": "text",
                    "title": "template record"
                  },
                  {
                    "code": "---\nname: {WORKFLOW_NAME}\ntype: WORKFLOW\nversion: 1.0.0\n---\n\nTHIS WORKFLOW EXECUTES {WORKFLOW_PURPOSE}\n\n%% META %%:\n    intent: \"{WORKFLOW_INTENT}\"\n    objective: \"{OBJECTIVE}\"\n    jurisdiction: {INPUT_SOURCE} and {OUTPUT_TARGET} | external: every other surface\n    recursion_limit: 2\n\n# NODE 1 — {NODE_ONE_TITLE}   [epistemic · analysis · set-theory · yields: set]\n@purpose: \"read the input and see it through the analysis the workflow is for\"\n@genesis: existence\nCONTRACT:\n  input:     {INPUT_SOURCE}\n  transform: READ_RESOURCE {INPUT_SOURCE} INTO input; ANALYZE_CONTENT input AGAINST {ANALYSIS_TARGET} INTO analysis\n  output:    analysis\nHANDOFF GATE (evidence-bearing):\n  [check] input read from {INPUT_SOURCE} (evidence: the read returned content) over: {INPUT_SOURCE} measured: <read> / <declared>\n  [check] analysis produced (evidence: a count above zero)\n  [check] every entry of analysis names its source in input (evidence: no entry with an empty source)\n  result: pass → NODE 2 | empty → REPAIR (owner: NODE 1) | unknown → BLOCKED\n\n# NODE 2 — {NODE_TWO_TITLE}   [epistemic · formalisation · computation · yields: procedure]\n@purpose: \"transform every item by one rule, preserving what the next node needs\"\n@genesis: transformation\nCONTRACT:\n  input:     analysis from NODE 1\n  transform: FOR EACH item IN analysis: COMPOSE_ARTIFACT result FROM item USING {TRANSFORM_RULE}; APPEND result TO results\n  preserves: the source of every item\n  output:    results\nHANDOFF GATE:\n  [check] one result per item (evidence: the two counts match) over: analysis measured: <transformed> / <items>\n  [check] every result conforms to {TRANSFORM_RULE} (evidence: VALIDATE_ARTIFACT passed on each)\n  [check] analysis unchanged (evidence: a witness read)\n  result: pass → NODE 3 | mismatch → REPAIR (owner: NODE 2) | unknown → BLOCKED\n\n# NODE 3 — FINALISATION   [evaluative · representation · information-theory · yields: artifact]\n@purpose: \"persist the results once, refuse a stale destination, and report to the parties whose next work they create\"\n@genesis: constraint\nCONTRACT:\n  input:     results from NODE 2\n  transform: PERSIST_ARTIFACT results TO {OUTPUT_TARGET}; REPORT_RESULT completion TO <the parties whose next work it creates>\n  output:    {OUTPUT_TARGET}\n  freshness: fingerprint(results) + fingerprint(this document)\nHANDOFF GATE:\n  [check] {OUTPUT_TARGET} persisted (evidence: a read returns it) over: results measured: <persisted> / <results>\n  [check] completion reported (evidence: the report)\n  [check] entry count of {OUTPUT_TARGET} matches results (evidence: the two numbers)\n  refuse: {OUTPUT_TARGET} changed since it was read before PERSIST_ARTIFACT\n  standing: moved-set none\n  result: pass → TERMINATE | loss → REPAIR (owner: NODE 3) | unknown → BLOCKED\n\n# CROSS-NODE INVARIANTS\nINVARIANT prior-output-only: a node reads only the prior node's output over: every node binds: the workflow objector: [check] input names NODE n-1 or a slot\nINVARIANT one-truth: one fact has one home across the nodes over: every artifact binds: the workflow objector: [check] entry count of the output matches results\nINVARIANT no-spawn: no autonomous party is spawned over: every node binds: the workflow objector: none\n\nREPORT:\n  subject: NODE 3\n  verdict: pass | fail | unknown\n  domain: declared <results> measured <persisted>\n  completion: saturated <bool> complete <bool> verified <bool>\n",
                    "kind": "code",
                    "language": "pag",
                    "title": "workflow body"
                  },
                  {
                    "code": "resolve <template> WITH <the values an instance supplies>\n\n  substituted   every {name} the instance supplied, replaced in the body\n  unresolved    [{OUTPUT_TARGET}]                        # still in the body · the instance is not ready\n  violations    [missing_required_slot:{OBJECTIVE},       # a required slot with no value\n                 enum_violation:{scope}]                  # a value outside the slot's closed set\n\n# an instance with a non-empty unresolved or violations list is not raised · nothing guesses a value",
                    "kind": "code",
                    "language": "text",
                    "title": "resolution"
                  },
                  {
                    "caption": "template and sibling",
                    "kind": "mermaid",
                    "text": "flowchart TB\n    template[\"A template record · type, slots, constraints, body\"]\n    raised[\"An instance · raised by resolving every slot\"]\n    check[\"A check · reads the constraints and the slot declarations\"]\n    sibling[\"A sibling instance\"]\n    copied[\"An instance copied from the sibling · inherits its accidents\"]\n    template --> raised\n    template --> check\n    sibling -. the tempting path .-> copied"
                  },
                  {
                    "caption": "second instance",
                    "kind": "mermaid",
                    "text": "flowchart LR\n    one[\"One instance · an artifact\"]\n    two[\"A second · the invariant half is now visible\"]\n    template[\"The template is written before the second is\"]\n    later[\"Every later instance is raised from it\"]\n    one --> two --> template --> later"
                  }
                ],
                "title": "Contract, not content"
              }
            ],
            "title": "Core templates"
          },
          {
            "icon": "bi-diagram-2",
            "id": "templates-coordination",
            "intro": "This section covers the two templates for coordination between parties, [surface protocol] and [decision protocol]. They share one transport and have opposite lifetimes, as described in [the board and the venue](/disciplined-methodology/collaborate#the-board-and-the-venue) and shown in [one transport]. Each is a template record whose slots are drawn from closed sets, and it is raised into an instance by resolving them. [two lifetimes] shows why the fields of one never transfer to the other.",
            "subsections": [
              {
                "blocks": [
                  {
                    "application": "In practice, a surface protocol is raised by resolving its key and its three lifetime values from their closed sets, and its rules are kept as written, so every party reads the surface whole, writes inside its own record, derives every state and extracts before removal. A decision protocol is raised by stating the question and an exit condition the tree can decide, a successor is declared by name where one exists, and the closure is absorption rather than agreement. Where the adapter cannot resolve a named slot, the absence is declared rather than filled.",
                    "boundary": "A decision protocol needs more than one party, because a decision with one party is a choice.",
                    "cause": "A description in words has no closed set a mechanism can join on, so each party implements the words it read.",
                    "decision": "The protocol is raised from a template whose values come from closed sets, rather than from a description each collaboration writes fresh.",
                    "failureMode": "A surface is described as append-only, a mechanism implements the word faithfully, and a settled argument is deleted rather than archived because no removal axis was ever declared.",
                    "kind": "lesson",
                    "principle": "For this reason coordination is raised from templates whose slots are the surfaces, their lifetimes and their closures.",
                    "problem": "Each collaboration describes its [shared surfaces](/pag/orchestration#shared-surfaces) in its own words.",
                    "validation": "To check this, name for each shared surface its three lifetime values and the party that may remove from it. A surface with a one-word lifetime has an undeclared axis, and the mechanism that implements the word acts on the axis it never saw."
                  },
                  {
                    "kind": "text",
                    "text": "The surface protocol puts the lifetime first, because every later rule depends on it, and its three axes are the ones described in shared surfaces. The rules that follow are one writer per record, a state that is a function over the edges, and a removal that refuses without a reference naming where the extraction landed. The check decides presence and never fidelity, because an extraction is a compression and a text comparison would fail every correct one."
                  },
                  {
                    "kind": "text",
                    "text": "The decision protocol declares its own exit condition, because without one the decision halts indefinitely. A position without evidence is an opinion, so every position carries evidence, and its author states what the proposal makes worse, because a position that cannot be attacked converges by exhaustion rather than by agreement. What convergence is, and why the archive follows absorption, is described in the board and the venue."
                  },
                  {
                    "code": "template:\n  type:        PROTOCOL\n  title:       <how parties share one surface>\n  slots:\n    - name: {SURFACE_KEY}          required: true    kind: string\n    - name: {RETENTION}            required: true    enum: [<current-truth>, <accumulating>, <discharged>]\n    - name: {MUTABILITY}           required: true    enum: [<owner-rewritable>, <append-only>, <frozen>]\n    - name: {REMOVAL}              required: true    enum: [<handler>, <author>, <producer>, <none>]\n  constraints:\n    - declaration_required\n    - one_writer_per_record\n    - state_derived_never_written\n    - removal_declares_its_extraction\n  body: |\n    THIS PROTOCOL DEFINES how parties share {SURFACE_KEY}\n\n    DECLARE lifetime: object\n    SET lifetime = {retention: {RETENTION}, mutability: {MUTABILITY}, removal: {REMOVAL}}\n\n    # RULE 1: one writer per record\n    WHEN <party> writes {SURFACE_KEY}:\n        READ_RESOURCE {SURFACE_KEY} whole INTO <current>\n        EDIT {SURFACE_KEY} inside <party>.<record> only\n\n    # RULE 2: state is derived\n    WHEN a state is asked: RETURN state_of(<item>)     # a function over the edges, never a field\n\n    # RULE 3: removal declares its extraction\n    WHEN <item> is absorbed AND <party> IN <item>.<to>:\n        EXTRACT_FACTS <item>.<durable half> INTO <the one home history has>\n        REMOVE <item> BY <item>.<id>",
                    "kind": "code",
                    "language": "text",
                    "title": "surface protocol"
                  },
                  {
                    "code": "template:\n  type:        PROTOCOL\n  title:       \n  slots:\n    - name: {QUESTION}             required: true    kind: string\n    - name: {EXIT_CONDITION}       required: true    kind: string     # checkable against the tree, never judged\n    - name: {SUCCESSOR}            required: false   kind: string     # declared by name, never derived from a number\n  constraints:\n    - declaration_required\n    - exit_condition_stated\n    - positions_accumulate_until_convergence\n    - converged_is_absorbed_before_archived\n  body: |\n    THIS PROTOCOL DEFINES how {QUESTION} is decided\n\n    # a position carries evidence or it is an opinion · it stands until read and signed\n    DECLARE position: object\n    SET position = {claim: <one line>, axis: <the design question>, evidence: <an observation the other parties can reproduce>, proposes: <the mechanism>, costs: <what it makes harder, by its own author>, contradicts: , signed: <the author, or nothing>}\n\n    FUNCTION converged(venue):\n      RETURN every_party_stated_its_needs(venue) AND every_need_is_empty(venue) AND every_position_signed(venue) AND {EXIT_CONDITION}\n\n    # NODE 10 — TERMINATE   [evaluative · termination · set-theory · yields: ter-stop boolean]\n    CONTRACT:\n      input:        the venue + the distribution its outcome implies\n      transform:    converge → distribute the implied work as a plan with an owner per item → land it → move the venue whole into the archive\n      constraints:  convergence certifies agreement and nothing about the tree; leaving the active tree and leaving the repository are different operations\n      output:       the outcome in the surviving documents, the argument in the archive\n      handoff:      absorbed (yields: boolean)",
                    "kind": "code",
                    "language": "text",
                    "title": "decision protocol"
                  },
                  {
                    "code": "# the same transport, opposite lifetimes · the fields belong to the concern and never transfer\n   carries STATE     who owns what, what is directed at whom      swept · a resolved item is deleted\n<an argument>              carries POSITIONS where each party stands, what it still needs   accumulates · moved whole when absorbed\n\n# a position written onto the coordination surface is accumulation on the surface built to be swept\n# a state written into an argument is ownership described in a document about a decision",
                    "kind": "code",
                    "language": "pag",
                    "title": "two lifetimes"
                  },
                  {
                    "caption": "one transport",
                    "kind": "mermaid",
                    "text": "flowchart TB\n    surface[\"Surface protocol · one writer per record, derived state, lifetime on three axes, extraction before removal\"]\n    venue[\"Decision protocol · positions with evidence, an exit condition, convergence then absorption then the archive\"]\n    transport[\"One transport · fenced records, allocated ids, compare-and-swap\"]\n    surface -.-> transport\n    venue -.-> transport"
                  }
                ],
                "title": "Surface and decision"
              }
            ],
            "title": "Coordination templates"
          },
          {
            "icon": "bi-clipboard-check",
            "id": "templates-planning",
            "intro": "This section covers the checklist template and the ten nodes of [the loop](/disciplined-methodology#the-loop) that produce a checklist, each owning one kind of decision and closed by a gate, with the repair edge running between them, as shown in [the ten nodes]. [checklist generator] is the grammar's own checklist template record, and [rendered checklist] is the surface it emits. That surface carries what is true now and what remains, as described in [derived state](/disciplined-methodology/verify#derived-state), and [verification report] is the verdict that travels with it.",
            "subsections": [
              {
                "blocks": [
                  {
                    "application": "In practice, the nodes are walked in order and no node makes a decision another node owns. A task leaves the surface only once it is both done and verified, and the walk stops when the objective sentence reads true against the tree.",
                    "boundary": "A one-task change still walks every node, because a one-line fix can be a fix the project did not need, and orientation is what finds that out. What scales down is the size of each node's output, never the node set.",
                    "cause": "A decision made by the wrong node is made without the evidence the owning node would have gathered.",
                    "decision": "A closed task is deleted rather than ticked, so the remaining set is the work and never a count.",
                    "failureMode": "A checklist says most of the units are done, two were undone by a later change, the bar still reads the same, and the next reader re-implements finished work while skipping the undone.",
                    "kind": "lesson",
                    "principle": "For this reason a checklist is produced by owned, gated nodes, and its state is derived rather than typed.",
                    "problem": "A checklist written in one sitting records the plan its author imagined.",
                    "validation": "To check this, name for each unit of a rendered checklist the node that decided it and the evidence that node read. A unit that cannot be traced to a node was authored, and a status marker on the surface stopped being true the first time the tree changed."
                  },
                  {
                    "kind": "text",
                    "text": "The nodes are the derivation loop applied to a plan. [Verification](/ontology#arch-verification) judges the reasoning, not the implementation, and its result line routes findings to the repair edge rather than forward, and an unknown to blocked. The commit node numbers the tasks only once the order is stable, and every phase it renders carries the [genesis stage](/pag/patterns#genesis-stages) its node derived rather than a role label written beside it."
                  },
                  {
                    "kind": "text",
                    "text": "A task's contract has five fields, and none of them is inferred. They are the change, the file, the evidence that proves it landed, the verifier that reads the evidence, and the non-goal, which lets the next reader refuse the addition that would have widened the task. A report carries the verdict with its standing, the domain it was measured over, and the reach it covered. The standing is derived in [verify the verifier](/disciplined-methodology/verify#verify-the-verifier), and the reach is read as coverage, as described in [a report, not a checkbox](/disciplined-methodology/verify#a-report-not-a-checkbox). A pass rate is a count no step derived, and the template has no field for one."
                  },
                  {
                    "code": "---\nname: {task_name}\ntype: CHECKLIST\nversion: 1.0.0\n---\n\nTHIS CHECKLIST GENERATES a dependency-ordered, evidence-bearing implementation checklist whose framing, worth, seeing, derivation, projection, formalisation, admissibility, verification, commitment and termination are each produced and gated by the node that owns that decision.\n\n%% META %%:\n    priority: {project.governance_policy} > {project.principle_ontology} > this template > {project.architecture_rules} > {task_description}\n    trust: tool_output = TRUSTED, prior_knowledge = UNTRUSTED\n    objective: {task_description}\n    jurisdiction: {task_description} and the tree the governing documents declare | external: every surface the governing documents do not name\n    recursion_limit: 3\n\n# NODE 1 — ORIENT   [epistemic · ontology · set-theory · yields: entity-set + evidence]\n@purpose: \"establish authority, trust and current-system evidence by framing the task through the ontological dimensions\"\n@axis_question: \"What is it?\"\n@genesis: existence\n@cue: \"OBSERVE_BEFORE_PLAN\"\nCONTRACT:\n  input:     {task_description}\n  transform: READ_RESOURCE {project.governance_policy} INTO policy; READ_RESOURCE {project.principle_ontology} INTO ontology; DISCOVER_RESOURCES <the artifacts the task names> INTO discovered; EXTRACT_FACTS change_relation FROM {task_description} INTO change\n  constraints: {project.architecture_rules} is read on an algorithm, protocol, pattern, decomposition, principle or contract task; {project.design_guide} on a style, token, layout, surface or ui task; {project.component_docs} on a component, module, element, render or boundary task; a dimension is walked only when relevant\n  output:    context_bundle\nDECLARE context_bundle: object\nSET context_bundle = {intent: change.requested_outcome, change_relation: change.change_relation, dimensions: <the relevant ontological dimensions>, sources: [policy, ontology], discovered: discovered, evidence: <every discovery with its source>, unresolved: change.ambiguity}\nHANDOFF GATE (evidence-bearing):\n  rule_id: \"ORIENT\"   yields: boolean\n  [check] core authority loaded (evidence: context_bundle.sources) over: the governing documents measured: <read> / <declared>\n  [check] change_relation resolved (evidence: change.change_relation is not unknown)\n  [check] every always-relevant dimension has a readout and the evidence inventory is non-empty (evidence: context_bundle.evidence)\n  result: pass → NODE 2 | missing authority → REPAIR (owner: NODE 1) | unknown → BLOCKED\n\n# NODE 2 — INTENT   [conative · teleology · optimisation · yields: objective + branch-ranking]\n@purpose: \"resolve what the work is for, enumerate admissible branches, and gate on the highest-worth one before any seeing\"\n@axis_question: \"What is it for?\"   @mandatory\n@genesis: difference\n@cue: \"WORTH_BEFORE_WORK\"\nCONTRACT:\n  input:     context_bundle from NODE 1\n  transform: ANALYZE_CONTENT context_bundle FOR candidate branches INTO branches; FOR EACH branch IN branches: CALCULATE_METRIC utility minus cost FROM branch INTO branch.worth; RANK branches BY worth\n  constraints: a branch is admissible only when it satisfies the change_relation and the hard constraints; the selected branch is the highest-worth admissible one\n  output:    teleology_bundle\nDECLARE teleology_bundle: object\nSET teleology_bundle = {objective: context_bundle.intent, branches: branches, selected: <the argmax admissible branch>}\nHANDOFF GATE (tel-priority injection-gate):\n  rule_id: \"INTENT\"   yields: boolean over ranking\n  [check] objective stated (evidence: teleology_bundle.objective)\n  [check] an admissible branch exists (evidence: branches with admissible true) over: branches measured: <admissible> / <branches>\n  [check] selected is the argmax of utility minus cost (evidence: the ranking's first entry)\n  result: pass → NODE 3 | no admissible branch → REPAIR (owner: NODE 1) | selected is not argmax → REPAIR (owner: NODE 2) | unknown → BLOCKED\n\n# NODE 3 — SEE   [epistemic · analysis · graph · yields: lens-set + analytic edges]\n@purpose: \"select the analytical lenses relevant to the selected branch and read the system through them\"\n@axis_question: \"How is it to be seen?\"\n@genesis: relation\n@cue: \"SELECT_LENSES_BEFORE_DERIVING\"\nCONTRACT:\n  input:     teleology_bundle from NODE 2\n  transform: ANALYZE_CONTENT context_bundle.discovered AGAINST <each relevant lens> INTO observations; EXTRACT_FACTS relational edges FROM observations INTO relational_edges\n  output:    analysis_bundle\nDECLARE analysis_bundle: object\nSET analysis_bundle = {lenses: <the relevant lenses>, observations: observations, relational_edges: relational_edges}\nHANDOFF GATE (evidence-bearing):\n  rule_id: \"SEE\"   yields: edge-list + boolean\n  [check] every active lens has an observation (evidence: observations) over: analysis_bundle.lenses measured: <observed> / <lenses>\n  [check] relational edges present where dependencies were discovered (evidence: relational_edges against discovered registrations)\n  [check] no observation is inferred from a name alone (evidence: every observation cites a read)\n  result: pass → NODE 4 | gap → REPAIR (owner: NODE 3) | unknown → BLOCKED\n\n# NODE 4 — DERIVE   [epistemic · reasoning · logic · yields: principle and protocol truths]\n@purpose: \"activate the principles that govern the seen decision surfaces and select protocols by semantic fit\"\n@axis_question: \"Why, and what follows?\"\n@genesis: relation\n@cue: \"DERIVE_FROM_EVIDENCE\"\nCONTRACT:\n  input:     analysis_bundle from NODE 3\n  transform: FOR EACH principle IN {project.principle_ontology}: ANALYZE_CONTENT analysis_bundle.observations AGAINST principle.activate_when INTO fit; APPEND {principle, fit, validator} TO active_principles; ANALYZE_CONTENT teleology_bundle.selected AGAINST <each protocol's use-when> INTO selected_protocols\n  constraints: every active principle binds a decision test and a validator; a protocol is selected by semantic fit, never by a trigger word; the verification protocol is always present\n  output:    derivation_bundle\nDECLARE derivation_bundle: object\nSET derivation_bundle = {active_principles: active_principles, selected_protocols: selected_protocols}\nHANDOFF GATE (evidence-bearing):\n  rule_id: \"DERIVE\"   yields: boolean\n  [check] every active mandatory principle binds a validator (evidence: active_principles) over: active_principles measured: <bound> / <active>\n  [check] every selected protocol carries a semantic reason (evidence: selected_protocols.reason)\n  [check] the verification protocol is present (evidence: selected_protocols)\n  result: pass → NODE 5 | gap → REPAIR (owner: NODE 4) | unknown → BLOCKED\n\n# NODE 5 — PROJECT   [epistemic · reasoning · logic · yields: 4D graph edge-list]\n@purpose: \"decompose into phases whose order is the substrate genesis of the artifacts, and project the dependency and ripple graph\"\n@axis_question: \"What follows downstream?\"\n@genesis: structure\n@cue: \"DECOMPOSE_AS_GENESIS\"\nCONTRACT:\n  input:     derivation_bundle from NODE 4\n  transform: FOR EACH protocol IN derivation_bundle.selected_protocols: COMPOSE_ARTIFACT phase FROM protocol USING <its genesis stage>; APPEND phase TO phases; COMPOSE_ARTIFACT graph FROM phases USING <Z sequential, X lateral, Y diagonal, W propagation>; ORDER phases BY topological Z then genesis rank\n  constraints: a phase never depends on a later-genesis output than it produces; severity is metadata that routes failure, never an ordering axis; an empty W carries the evidence it was assessed\n  preserves: every relational edge from NODE 3\n  output:    phase_records\nDECLARE phase_records: array\nSET phase_records = <the ordered phases, each with its four axes and its genesis stage>\nHANDOFF GATE (evidence-bearing):\n  rule_id: \"PROJECT\"   yields: edge-list + boolean\n  [check] the Z graph is acyclic and genesis-consistent (evidence: zero cycles, zero inversions) over: phase_records measured: <ordered> / <phases>\n  [check] every phase declares inputs, outputs, a genesis stage and all four axes (evidence: phase_records)\n  [check] order is dependency-topological then genesis with severity as metadata only (evidence: no severity grouping)\n  result: pass → NODE 6 | cycle or inversion → REPAIR (owner: NODE 5) | unknown → BLOCKED\n\n# NODE 6 — ACT   [epistemic · formalisation · computation · yields: task procedures]\n@purpose: \"formalise phases into atomic, target-specific tasks under binding execution constraints, with full ripple chains\"\n@axis_question: \"What does it resolve to?\"\n@genesis: transformation\n@cue: \"FORMALISE_EXECUTABLE_TASKS\"\nCONTRACT:\n  input:     phase_records from NODE 5\n  transform: FOR EACH phase IN phase_records: COMPOSE_ARTIFACT tasks FROM phase USING <the task template of its verb>; FOR EACH task IN tasks: ANALYZE_CONTENT task FOR <the ripple dimensions> INTO task.ripple; APPEND task TO task_records\n  constraints: the host's patterns bind every step, dependency through {registry}, observability through {logger}, size within {limits.max_lines} and {limits.max_files}; a build or verify task runs {toolchain.build.execute} or {verify_cmd} as a blocking step; a ripple names entities, never counts\n  output:    task_records\nDECLARE task_records: array\nSET task_records = <atomic, target-specific tasks with an evidence contract and named ripple, numbered N.M.K>\nHANDOFF GATE (evidence-bearing):\n  rule_id: \"ACT\"   yields: procedure + set-cardinality\n  [check] at least one task per phase (evidence: task_records against phase_records) over: phase_records measured: <with tasks> / <phases>\n  [check] every task is atomic and target-specific with an evidence contract (evidence: expected evidence per task)\n  [check] every task carries every ripple dimension with names (evidence: task.ripple)\n  result: pass → NODE 7 | non-atomic or missing ripple → REPAIR (owner: NODE 6) | unknown → BLOCKED\n\n# NODE 7 — CONSTRAIN   [conative · teleology · optimisation · yields: admissibility boolean]\n@purpose: \"gate the formalised plan on admissibility before verification: still worth executing, still on the selected branch, within the hard limits\"\n@axis_question: \"Is it still worth it, and is it allowed?\"   @mandatory\n@genesis: constraint\n@cue: \"ADMISSIBLE_BEFORE_VERIFY\"\nCONTRACT:\n  input:     task_records from NODE 6\n  transform: CALCULATE_METRIC realised cost FROM task_records INTO realised_cost; FOR EACH task IN task_records: ANALYZE_CONTENT task AGAINST teleology_bundle.selected INTO trace; COMPARE realised_cost AGAINST teleology_bundle.selected.cost\n  output:    admissibility\nDECLARE admissibility: object\nSET admissibility = {ok: <cost within budget and nothing off branch and no limit breached>, realised_cost: realised_cost, off_branch: <tasks that do not trace>, limit_breaches: <phases over a hard limit>}\nHANDOFF GATE (teleology admissibility gate):\n  rule_id: \"CONSTRAIN\"   yields: boolean\n  [check] realised cost within the branch budget (evidence: realised_cost against the budget)\n  [check] every task traces to the selected branch (evidence: admissibility.off_branch empty) over: task_records measured: <on branch> / <tasks>\n  [check] no hard limit breached (evidence: admissibility.limit_breaches empty)\n  result: pass → NODE 8 | cost over budget or off branch → REPAIR (owner: NODE 2) | limit breach → REPAIR (owner: NODE 6) | unknown → BLOCKED\n\n# NODE 8 — VERIFY   [evaluative · verification · logic + probability · yields: validation report]\n@purpose: \"judge the generated reasoning against evidence, falsification, confidence and semantic policy before commitment\"\n@axis_question: \"Is it real?\"   @mandatory\n@genesis: constraint\n@cue: \"VERIFY_REASONING_NOT_IMPLEMENTATION\"\nCONTRACT:\n  input:     admissibility from NODE 7\n  transform: EXTRACT_FACTS material claims FROM {phase_records, task_records} INTO claims; FOR EACH claim IN claims: SEARCH_CONTENT context_bundle.evidence FOR claim.support INTO support; VALIDATE_ARTIFACT {phase_records, task_records} AGAINST <the validation suites> INTO findings\n  constraints: a claim is supported only with evidence, never by the absence of a contradiction; confidence is a number tested against a threshold; policy is semantic, never a substring ban; an unmeasured claim is unknown, and unknown is not pass\n  output:    validation_report\nDECLARE validation_report: object\nSET validation_report = {status: <pass, repair_required or blocked>, findings: findings, confidence: <the minimum claim confidence>, examined: context_bundle.evidence, unresolved: context_bundle.unresolved}\nHANDOFF GATE (ver-stop gate):\n  rule_id: \"VERIFY\"   yields: boolean\n  [check] every finding names what it examined (evidence: findings carry evidence and a rule id)\n  [check] every material claim has non-empty evidence and a named refuter (evidence: claims) over: claims measured: <supported> / <claims>\n  [check] confidence is at or above the threshold (evidence: validation_report.confidence)\n  [check] status is pass with zero blocking findings (evidence: validation_report.findings)\n  standing: moved-set <the surfaces re-read since NODE 1>\n  result: pass → NODE 9 | repair_required → REPAIR (owner: <the earliest node named by a finding>) | unknown → BLOCKED\n\n# REPAIR EDGE  (verify refutes back to the earliest invalid node, bounded by the recursion limit)\nCONTRACT:\n  input:     validation_report.findings, or a failed admissibility\n  transform: FOR EACH finding IN findings: ORDER finding BY <the node order>; <re-run from the earliest owning node forward, invalidating every dependent record>\n  constraints: bounded by recursion_limit; severity orders the repairs among failures and never softens a verdict; a downstream record is never restored after an upstream repair\n  output:    repaired records at pass, or a blocked terminal with the remaining findings\n\n# NODE 9 — COMMIT   [evaluative · representation · information-theory · yields: rendered artifact]\n@purpose: \"serialise only validated records into the one canonical representation, deduplicated, adding no new decision\"\n@axis_question: \"How is it encoded?\"\n@genesis: emergence\n@cue: \"COMMIT_WITHOUT_NEW_DECISIONS\"\nCONTRACT:\n  input:     validation_report from NODE 8\n  transform: COMPOSE_ARTIFACT rendered FROM {context_bundle, teleology_bundle, phase_records, task_records, validation_report} USING <the checklist shape>; REDUCE rendered TO <one entry per phase and task>\n  constraints: rendering adds no architecture decision; identical content collapses to one representation; a future execution checkbox stays unchecked; every phase carries its genesis stage and its four axes\n  preserves: every ripple impact by name\n  output:    rendered\n  freshness: fingerprint(validation_report) + fingerprint(this document)\nHANDOFF GATE (evidence-bearing):\n  rule_id: \"COMMIT\"   yields: hash + boolean\n  [check] no phase or task encoded twice (evidence: the deduplication pass) over: phase_records and task_records measured: <encoded once> / <records>\n  [check] no future execution checkbox pre-checked (evidence: a render scan)\n  [check] no architecture decision introduced at render (evidence: the rendering rules)\n  result: pass → NODE 10 | integrity defect → REPAIR (owner: NODE 9) | unknown → BLOCKED\n\n# NODE 10 — TERMINATE   [evaluative · termination · set-theory · yields: artifact]\n@purpose: \"stop only on saturation and completion and verification; otherwise block on external input, never a self-assessed stop\"\n@axis_question: \"Is it done?\"   @mandatory\n@genesis: emergence\n@cue: \"TERMINATE_EXPLICITLY\"\nCONTRACT:\n  input:     rendered from NODE 9\n  transform: VALIDATE_ARTIFACT rendered AGAINST <every phase and task once, contiguous numbering, no pre-checked execution box> INTO render_check; PERSIST_ARTIFACT rendered TO <{task_name} checklist>; REPORT_RESULT generation_result TO <the parties whose next work it creates>\n  constraints: exactly one terminal, success or blocked; ter-block routes to REQUEST_DECISION; a self-assessed done is not ter-stop\n  output:    generation_result\n  freshness: fingerprint(rendered) + fingerprint(this document)\nHANDOFF GATE (ter-stop gate):\n  rule_id: \"TERMINATE\"   yields: boolean\n  [check] status is success or blocked and an output file is named (evidence: generation_result)\n  [check] success only when saturation and completion and verification all hold (evidence: the termination set) over: the termination set measured: <holding> / <three>\n  [check] repair cycles within recursion_limit (evidence: the repair count)\n  [check] no future execution checkbox pre-checked (evidence: render_check)\n  refuse: the destination changed since it was read before PERSIST_ARTIFACT\n  standing: moved-set <the surfaces re-read since NODE 8>\n  result: pass → TERMINATE | integrity defect → REPAIR (owner: NODE 9) | unknown → BLOCKED\n\n# CROSS-NODE INVARIANTS\nINVARIANT ontology-before-teleology: authority, trust and the ontology of the change are resolved before its teleology, and both before any seeing over: every generation binds: the generator objector: [check] core authority loaded at NODE 1\nINVARIANT four-gates-always: the worth, admissibility, evidence and termination gates run on every generation over: every generation binds: the generator objector: [check] status is success or blocked at NODE 10\nINVARIANT typed-decisions: every decision resolves to its declared shape, a ranking never satisfied by a boolean over: every node binds: the generator objector: [check] selected is the argmax at NODE 2\nINVARIANT genesis-order: a phase never depends on a later-genesis output than it produces over: phase_records binds: the generator objector: [check] the Z graph is acyclic and genesis-consistent at NODE 5\nINVARIANT prior-output-only: a node reads only the prior node's output contract over: every node binds: the generator objector: [check] input names NODE n-1 or a declared variable\nINVARIANT evidence-not-absence: a claim is supported only with evidence, never by the absence of a contradiction, and unknown is not pass over: every claim binds: the generator objector: [check] every material claim has non-empty evidence at NODE 8\nINVARIANT repair-from-earliest: a failed gate repairs from the earliest owning node and never restores a downstream record over: every repair binds: the generator objector: [check] repair cycles within recursion_limit at NODE 10\nINVARIANT generation-not-execution: a gate resolved while generating is separate from a gate that runs when the checklist is executed, and the latter ships unchecked over: every rendered gate binds: the generator objector: [check] no future execution checkbox pre-checked at NODE 10\n\nREPORT:\n  subject: NODE 10\n  verdict: pass | fail | unknown\n  domain: declared <phase and task records> measured <encoded once>\n  populations: phases <n>, tasks <n>, claims supported <n>, claims unknown <n>\n  inputs: {task_description} <fingerprint>, {project.governance_policy} <fingerprint>, {project.principle_ontology} <fingerprint>\n  code: this document <fingerprint>\n  output: {task_name} checklist <fingerprint>\n  refusals: <n> [<reason>]\n  unresolved: <n> [<reason>]\n  completion: saturated <bool> complete <bool> verified <bool>\n",
                    "kind": "code",
                    "language": "pag",
                    "title": "checklist generator"
                  },
                  {
                    "code": "# <the rendered checklist · what the generator emits, every box unchecked>\n\n## Worth\nObjective: <the outcome, named so the result can be checked against it>\nNot in scope: <the nearest things this change will not do>\nBranches ranked: <the way chosen, and why the others lost>\n\n## Admissible\nHard limits: <what no node may cross>\nCost: <what this is allowed to take, and the point past which it stops>\n\n## PHASE 1 — <name>                   [genesis: <stage> · severity: <routes the repair>]\nReads: nothing.\nRipple: <what this phase's output reaches, by name>\nGate: <the evidence PHASE 2 reads before it starts, over what set>\n- [ ] 1.1 <one change> · file: <where> · evidence: <what proves it> · verifier: <who reads it> · not: <what this task leaves alone>\n\n## PHASE 2 — <name>                   [genesis: <stage> · severity: <routes the repair>]\nReads: the output of PHASE 1.\nRipple: <what this phase's output reaches, by name>\nGate: <the evidence PHASE 3 reads, over what set>\n- [ ] 2.1 <one change> · file: <where> · evidence: <what proves it> · verifier: <who reads it> · not: <what this task leaves alone>\n\n## Termination\nThe run stops when the objective sentence reads true against the tree, not when the boxes are ticked.",
                    "kind": "code",
                    "language": "markdown",
                    "title": "rendered checklist"
                  },
                  {
                    "code": "# a verification report · a verdict with its standing, its domain and its reach\nsubject:   <the run>\nverdict:   <pass | fail | unknown>\nstanding:  <authoritative | withdrawn>      # withdrawn where a read surface moved beneath the run\ndomain:    declared <N> measured <n>         # what the run claimed to cover, and what it reached\nreached:   [<every surface the run read>]\nmoved:     [<surfaces that changed mid-run, if any>]\nrefusals:  <n> [<why the run declined to continue, if it did>]\nunresolved: <n> [<what stays open>]\n\n## NODE 1 — <name>\n### Gate: <what it checks>\n- status:   <pass | fail | unknown>\n- evidence: <file and locus, for every check>\n- over:     <the set the check ranged over, n of N>\n- failure:  <which check, what was found · only on fail>\n- owner:    <the node or party that owns the repair · only on fail>",
                    "kind": "code",
                    "language": "markdown",
                    "title": "verification report"
                  },
                  {
                    "caption": "the ten nodes",
                    "kind": "mermaid",
                    "text": "flowchart TB\n    orient[\"Orient · observe before plan\"]\n    intent[\"Intent · worth before work\"]\n    see[\"See · the lenses, the relational edges\"]\n    derive[\"Derive · principles and protocols by fit\"]\n    project[\"Project · phases in genesis order, the four axes\"]\n    act[\"Act · atomic tasks with evidence contracts and named ripple\"]\n    constrain[\"Constrain · admissible, on budget, on branch\"]\n    verify[\"Verify · the reasoning, against evidence, with its population\"]\n    commit[\"Commit · one terminal, every box unchecked\"]\n    terminate[\"Terminate · saturated, complete, verified\"]\n    orient --> intent --> see --> derive --> project --> act --> constrain --> verify --> commit --> terminate\n    verify -. the repair edge · back to the earliest owning node, bounded .-> derive"
                  }
                ],
                "title": "Produced by nodes, derived by deletion"
              }
            ],
            "title": "Planning templates"
          },
          {
            "icon": "bi-file-earmark-text",
            "id": "templates-families",
            "intro": "This section covers the template families, which [the families] lists with the genesis question each answers. A family document has no runtime, so it is walked by the reasoning model its type declares, on the axis its type names, and an adapter performs the effects, as shown in [type to artifact]. Every node states its layer, its axis, the shape its decision yields, the contract it transforms and one evidence-bearing gate, as shown in [one node] beneath [family header]. The transitions are declared once in [loop spine], and every node cites it. A template is used by walking its nodes as the spine declares, as described in [execute the template](/disciplined-methodology/plan#execute-the-template), and [walk or read] shows the difference that decides whether its guarantees hold.",
            "subsections": [
              {
                "blocks": [
                  {
                    "application": "In practice, a family document opens by declaring its type, its trust anchor, its recursion limit and the slots every host fact resolves through. It states the four layers with the question each answers about this document, and the shape legend every decision is typed by. Each node has a purpose, an axis question, a cue and a contract, its decisions are typed, and it closes on a gate whose checks carry their evidence. The spine is declared once, and every handoff cites it.",
                    "boundary": "A template family fits only an artifact that will be walked, and an artifact that is read rather than walked is described in [from intent to structure](/pag/patterns#intent-to-structure).",
                    "cause": "A node that reads only the prior node's output cannot skip a decision, and a gate that owes a shape cannot be satisfied by a different one.",
                    "decision": "The family is selected by the genesis question the artifact answers, and the type declares who walks it and on which axis, rather than the reader picking.",
                    "failureMode": "A debugging document is walked as a plan, the ranking of candidate lines is skipped, and the first hypothesis is traced to the end.",
                    "kind": "lesson",
                    "principle": "For this reason a template family is a document type whose nodes are typed contracts, walked by the reasoning model its type declares.",
                    "problem": "A family document that does not say who walks it and on which axis leaves the reader to pick.",
                    "validation": "To check this, name for each node the layer, the axis and the shape its header declares, and the gate that carries evidence. A node missing any of the four is prose written in the family's format."
                  },
                  {
                    "kind": "text",
                    "text": "The trust anchor says which inputs are evidence and which are claims, so a hypothesis is untrusted until it is scored and prior knowledge is untrusted throughout."
                  },
                  {
                    "kind": "text",
                    "text": "A node is [design by contract](/ontology#arch-design-by-contract) at the scale of one decision. The repair edge is the one a fixed pipeline lacks, and what it does is described in [validation gates](/pag/validation#validation-gates)."
                  },
                  {
                    "kind": "text",
                    "text": "Families are selected by the genesis question, and each inlines its whole structure rather than importing a shared spine. Duplication is deliberate here and nowhere else, because [independence](/ontology#arch-independence) is what makes each family walkable on its own. A family's loop, its typing and its gates are domain-neutral and transfer to any tree unchanged. Its catalogues, the taxonomies it cites and the thresholds it names, are slots the adapter resolves, as described in [limits](/pag/validation#limitations)."
                  },
                  {
                    "code": "---\nname: {task_name}\ntype: DEBUG\nversion: 1.0.0\n---\n\nTHIS DEBUG RESOLVES a symptom to an evidence-scored root cause and one minimal fix by walking the ten-node loop across four reasoning layers\n\n%% META %%:\n    priority: EVIDENCE > ROOT_CAUSE > SPEED\n    trust: procedural_trace = TRUSTED, test_result = TRUSTED, prior_knowledge = UNTRUSTED, a_hypothesis = UNTRUSTED_UNTIL_SCORED\n    objective: {bug_report}\n    recursion_limit: {limits.max_fix_attempts}\n    parameters: every taxonomy, threshold and command resolves from {convention.*}, {limits.*} and {toolchain.*}, never typed\n\nTHE FOUR LAYERS · each answers one question about this document\n    substrate    how does a fix come to be            grounds the path from differential to fix\n    epistemic    how is the bug known                 orient · see · derive · project · act\n    conative     which line is worth pursuing         intent · constrain          mandatory, always\n    evaluative   is it fixed, and are we done         verify · commit · terminate mandatory, always\n\nYIELDS-SHAPE LEGEND · every decision resolves to a typed shape\n    set-theory → set or boolean   logic → boolean   graph → edge-list   optimisation → boolean or ranking\n    analysis → operation   computation → procedure   probability → a number in zero to one   dynamical-systems → boolean or counter",
                    "kind": "code",
                    "language": "pag",
                    "title": "family header"
                  },
                  {
                    "code": "# NODE 2 — INTENT   [conative · teleology · optimisation · yields: ranking]\n@purpose: \"extract the differential and rank the candidate lines by worth, so one line is traced and the rest are not\"\n@axis_question: \"which line is worth pursuing?\"\n@cue: \"rank before you trace\"\n@mandatory\n\nCONTRACT:\n  input:        the session from NODE 1 · the symptom, what works, what breaks\n  transform:    detect the works-versus-breaks differential; rank the candidate lines by probability times severity minus cost\n  constraints:  a line is admissible only inside {limits.max_fix_attempts}\n  output:       <ranked>, and the selected line\n  handoff:      the selected line is the argmax of the admissible · yields a boolean over a ranking\n\nDECLARE tel: object\nSET tel = {\n  objective: \"find and fix the root cause\",          # yields: a set\n  utility:   FUNCTION(line) → probability(line) * severity(line),   # yields: a number\n  cost:      FUNCTION(line) → what tracing it costs,                # yields: a number\n  priority:  FUNCTION(ranked) → ranked[0] is admissible             # yields: a boolean over a ranking\n}\n\n# OUTPUT CONTRACT\nSET <ranked> = RANK <candidate lines> BY tel.utility - tel.cost\n\nHANDOFF GATE (evidence-bearing):\n  rule_id: \"INTENT\"   yields: ranking\n  [check] the selected line is the argmax of utility minus cost (evidence: the ranking)\n  [check] <ranked> holds more than one admissible line (evidence: a count above one)\n  [check] no line was traced before the ranking existed (evidence: the trace log starts after this gate)\n  result: pass → NODE 3 | one admissible line → REPAIR (owner: NODE 1) | unknown → BLOCKED",
                    "kind": "code",
                    "language": "pag",
                    "title": "one node"
                  },
                  {
                    "code": "# THE LOOP SPINE · declared once, every node cites it\n# node        layer       axis            yields                     transition out\n# orient      epistemic   ontology        a set, with evidence       sequences → intent\n# intent      conative    teleology       an objective, a ranking    GATE worth → see | redirect\n# see         epistemic   analysis        lenses, edges              sequences → derive\n# derive      epistemic   reasoning       claims                     sequences → project\n# project     epistemic   reasoning       an ordered graph           sequences → act\n# act         epistemic   formalisation   procedures                 sequences → constrain\n# constrain   conative    teleology       admissibility              GATE → verify | repair\n# verify      evaluative  verification    a report                   GATE evidence · refutes back to the earliest owner\n# commit      evaluative  representation  the artifact               sequences → terminate\n# terminate   evaluative  termination     stop                       GATE stop → STOP | blocked → ask\n\n# REPAIR EDGE · verify fails backward to the earliest node that can supply the missing evidence, bounded by {recursion_limit}\n# a repair invalidates every dependent record forward · nothing downstream is restored",
                    "kind": "code",
                    "language": "pag",
                    "title": "loop spine"
                  },
                  {
                    "code": "# the families · each a document type, each walked by the model and axis its type declares\nCHECKLIST      pattern-cycle  formalisation   a plan, produced by owned nodes\nDEBUG          epistemology   analysis        a symptom to an evidence-scored cause and one fix\nVERIFICATION   epistemology   verification    claims adjudicated against implementation evidence\nAUDIT          epistemology   verification    an agent measured against its contract, then corrected\nDISTILLATION   epistemology   reasoning       repeated behaviour to one proven base\nTRANSLATION    epistemology   representation  a rendering audited line by line against its source\nCOMPOSITION    pattern-cycle  formalisation   a structure rendered from anchors and modifiers\n\n# the genesis question each answers · one question, one family\n\"how does a plan come to be?\"      → CHECKLIST\n\"how does a fix come to be?\"       → DEBUG\n\"how does a verdict come to be?\"   → VERIFICATION, AUDIT\n\"how does a base come to be?\"      → DISTILLATION\n\"how does a rendering come to be?\" → TRANSLATION, COMPOSITION",
                    "kind": "code",
                    "language": "pag",
                    "title": "the families"
                  },
                  {
                    "caption": "type to artifact",
                    "kind": "mermaid",
                    "text": "flowchart TB\n    type[\"The document type · declares the model and the axis\"]\n    layers[\"Four layers · substrate, epistemic, conative, evaluative\"]\n    nodes[\"Nodes · each typed to the shape it yields, each reading the prior output\"]\n    gate[\"One evidence-bearing gate per node\"]\n    spine[\"The spine · transitions declared once\"]\n    artifact[\"The artifact the loop terminates on\"]\n    type --> layers --> nodes --> gate --> artifact\n    spine --> nodes\n    gate -. repairs back, bounded .-> nodes"
                  },
                  {
                    "caption": "walk or read",
                    "kind": "mermaid",
                    "text": "flowchart LR\n    read[\"Read a template for ideas\"]\n    shaped[\"Write something template-shaped\"]\n    none[\"None of its guarantees\"]\n    walk[\"Walk its nodes as the spine declares\"]\n    artifact[\"The artifact the loop terminates on\"]\n    read -. the tempting path .-> shaped --> none\n    walk --> artifact"
                  }
                ],
                "title": "Typed nodes, one gate each"
              }
            ],
            "title": "Template families"
          },
          {
            "icon": "bi-robot",
            "id": "templates-agents",
            "intro": "This section covers how a document expresses an agent, a verifier and a creator. An agent is a document of the agent type, a cognition walked on the reasoning axis, as shown in [an agent], and a verifier is a document of the [verification](/ontology#arch-verification) type, an epistemology walked on the verification axis, as shown in [a verifier]. A creator is a template that generates an agent, as shown in [a creator], and the first two bodies are the grammar's own template records. What an agent is, why it is a walked loop and never a persona, and how a verifier earns trust are described in [agents as executed contracts](/disciplined-methodology/collaborate#agents-as-executed-contracts) and [verify the verifier](/disciplined-methodology/verify#verify-the-verifier), and [where guarantees live] maps where each guarantee is expressed.",
            "subsections": [
              {
                "blocks": [
                  {
                    "application": "In practice, the trust anchor is the trust line of the meta block, the jurisdiction sits beneath it, and the phase kind is bound in the orient node. The self-audit is a node whose contract reads the agent's own definition and tests every capability it claims on a positive and a negative case. A decision request resolves absent for a bounded reader, so the terminal node yields the artifact and never a question. The creator's proof is a gate that runs the rendered agent on a planted contradiction and on a clean case before the persist line, and it refuses the persist while either run is missing.",
                    "boundary": "An agent written for a bounded invocation returns instead of asking, which is the inversion derived in [composing a collaboration](/pag/orchestration#composing-a-workflow).",
                    "cause": "A capability stated in prose has no node that exercises it, so nothing in the document can show the claim false.",
                    "decision": "Each guarantee of the agent is expressed as a node with a gate, rather than as a sentence about the agent in its description.",
                    "failureMode": "An agent's description says it calibrates its detectors, no node reads a fixture, and the description is the only place calibration ever happened.",
                    "kind": "lesson",
                    "principle": "For this reason an agent document carries its guarantees as nodes and gates, so each one can be walked and can fail.",
                    "problem": "An agent's guarantees stated in its description are read, never walked.",
                    "validation": "To check this, name for each capability the agent's description claims the node whose gate exercises it. A capability with no node was adopted from the description, and the document has not shown it."
                  },
                  {
                    "kind": "text",
                    "text": "A claim's kind decides the evidence that can settle it, because a claim of existence needs a presence search and a claim of behaviour needs an execution, so the orient node assigns each claim its kind and the evidence shape that kind requires before anything is probed. The identity the agent writes under is declared in the body the runtime delivers, for the reason described in agents as executed contracts."
                  },
                  {
                    "code": "---\nname: {AGENT_NAME}\ntype: AGENT\nversion: 1.0.0\n---\n\nTHIS AGENT PERFORMS {PRIMARY_PURPOSE}\n\n%% META %%:\n    intent: \"{AGENT_DESCRIPTION}\"\n    objective: \"{OBJECTIVE}\"\n    jurisdiction: {DOMAIN_SCOPE} | external: everything the scope does not name\n    recursion_limit: 2\n\n# NODE 1 — DISCOVERY   [epistemic · ontology · set-theory · yields: set]\n@purpose: \"read the scope before claiming anything about it\"\n@genesis: existence\nCONTRACT:\n  input:     {DOMAIN_SCOPE}\n  transform: READ_RESOURCE {DOMAIN_SCOPE} INTO context; ANALYZE_CONTENT context FOR patterns INTO findings\n  output:    findings\nHANDOFF GATE (evidence-bearing):\n  [check] context read from {DOMAIN_SCOPE} (evidence: the read returned content) over: {DOMAIN_SCOPE} measured: <read> / <declared>\n  [check] findings populated (evidence: a count above zero)\n  [check] every finding names its source in context (evidence: no finding with an empty source)\n  result: pass → NODE 2 | empty → REPAIR (owner: NODE 1) | unknown → BLOCKED\n\n# NODE 2 — EXECUTION   [epistemic · formalisation · computation · yields: procedure]\n@purpose: \"act on every finding, once, with the evidence of each act recorded\"\n@genesis: transformation\nCONTRACT:\n  input:     findings from NODE 1\n  transform: FOR EACH item IN findings: EXECUTE_TOOL {PRIMARY_ACTION} WITH item INTO outcome; APPEND outcome TO outcomes\n  output:    outcomes\nHANDOFF GATE:\n  [check] one outcome per finding (evidence: the two counts match) over: findings measured: <acted> / <findings>\n  [check] no outcome rests on an assumption (evidence: every outcome cites the finding it acted on)\n  [check] findings unchanged (evidence: a witness read)\n  refuse: a finding whose source cannot be re-read before EXECUTE_TOOL\n  result: pass → NODE 3 | mismatch → REPAIR (owner: NODE 2) | unknown → BLOCKED\n\n# NODE 3 — VERIFICATION   [evaluative · verification · logic · yields: artifact]\n@purpose: \"validate the outcomes against the criteria and report to the parties whose next work they create\"\n@genesis: constraint\nCONTRACT:\n  input:     outcomes from NODE 2\n  transform: VALIDATE_ARTIFACT outcomes AGAINST {SUCCESS_CRITERIA} INTO verdict; REPORT_RESULT verdict TO <the parties whose next work it creates>\n  output:    verdict\n  freshness: fingerprint(outcomes) + fingerprint(this document)\nHANDOFF GATE:\n  [check] outcomes validated against {SUCCESS_CRITERIA} (evidence: the validator's report) over: outcomes measured: <validated> / <outcomes>\n  [check] verdict reported (evidence: the report)\n  [check] no residual failure (evidence: zero failing outcomes in the report)\n  standing: moved-set none\n  result: pass → TERMINATE | residual → REPAIR (owner: NODE 2) | unknown → BLOCKED\n\n# CROSS-NODE INVARIANTS\nINVARIANT read-before-write: a node reads its input before it writes anything over: every node binds: the agent objector: [check] context read at NODE 1\nINVARIANT one-gate-per-node: a node hands off through exactly one evidence-bearing gate over: every node binds: the agent objector: [check] result line present\nINVARIANT no-spawn: no autonomous party is spawned over: every node binds: the agent objector: none\n\nREPORT:\n  subject: NODE 3\n  verdict: pass | fail | unknown\n  domain: declared <outcomes> measured <validated>\n  completion: saturated <bool> complete <bool> verified <bool>\n",
                    "kind": "code",
                    "language": "pag",
                    "title": "an agent"
                  },
                  {
                    "code": "---\nname: {task_name}\ntype: VERIFICATION\nversion: 1.0.0\n---\n\nTHIS VERIFICATION PERFORMS a forensic adjudication that classifies every context claim verified, contradicted or unverified against observable implementation evidence, with detectors calibrated and adversarially tested before any claim is trusted.\n\n%% META %%:\n    priority: EVIDENCE > TRUST_ANCHOR > TASK\n    trust: implementation_observation = TRUSTED, prior_knowledge = UNTRUSTED, a_claim = UNTRUSTED_UNTIL_MAPPED\n    objective: {context_claims}\n    jurisdiction: {context_claims} about {target} | external: the runtime, filesystem, command execution and tool io the trust anchor discloses\n    recursion_limit: {convention.max_recursion_depth}\n\n# NODE 1 — ORIENT   [epistemic · ontology · set-theory · yields: set]\n@purpose: \"disclose the trust anchor, bind one op-set, and kind every claim by its ontological dimension before touching any claim\"\n@genesis: existence\nCONTRACT:\n  input:     {context_claims} about {target}\n  transform: EXTRACT_FACTS <the minimal assumptions and the cannot-verify-the-verifier boundary> FROM <this document> INTO anchor; DETERMINE <INVESTIGATE or ACTION> INTO op_set; FOR EACH claim IN {context_claims}: CLASSIFY claim BY <its ontological dimension and evidence shape>\n  constraints: the anchor is disclosed, never verified; INVESTIGATE allows gap discovery, testing and documentation and forbids mutation; ACTION allows a bounded fix and forbids discovery; the two are disjoint\n  output:    run_context\nDECLARE run_context: object\nSET run_context = {anchor: anchor, op_set: op_set, claims: <every claim with its kind, evidence shape and math type>}\nHANDOFF GATE (evidence-bearing):\n  rule_id: \"ORIENT\"   yields: boolean\n  [check] the trust anchor is disclosed with its assumptions and boundary (evidence: run_context.anchor)\n  [check] exactly one op-set is bound and its allowed and forbidden operations are disjoint (evidence: run_context.op_set)\n  [check] every claim carries a kind and an evidence shape (evidence: run_context.claims) over: {context_claims} measured: <kinded> / <claims>\n  result: pass → NODE 2 | unkinded claim → REPAIR (owner: NODE 1) | unknown → BLOCKED\n\n# NODE 2 — INTENT   [conative · teleology · optimisation · yields: ranking]\n@purpose: \"rank claims by verification worth and choose the method per claim by utility minus cost before probing anything\"\n@genesis: difference\n@mandatory\nCONTRACT:\n  input:     run_context from NODE 1\n  transform: FOR EACH claim IN run_context.claims: CALCULATE_METRIC risk times uncertainty FROM claim INTO claim.worth; FOR EACH claim IN run_context.claims: RANK <its admissible methods> BY risk-weighted coverage minus cost\n  constraints: a method is admissible only when its capability is available; a high-worth claim with no admissible method is marked will-be-unverified, never inverted below a low-worth escalation\n  output:    methods\nDECLARE methods: array\nSET methods = <one chosen method per claim, the argmax admissible one>\nHANDOFF GATE (tel-priority injection-gate):\n  rule_id: \"INTENT\"   yields: boolean over ranking\n  [check] every claim carries a worth and a chosen method (evidence: methods) over: run_context.claims measured: <with method> / <claims>\n  [check] each chosen method is the argmax of risk-weighted coverage minus cost (evidence: the per-claim ranking)\n  [check] no high-worth claim is left unmapped while a low-worth claim escalates (evidence: the worth order against the escalations)\n  result: pass → NODE 3 | priority inversion → REPAIR (owner: NODE 2) | unknown → BLOCKED\n\n# NODE 3 — CALIBRATE   [epistemic · analysis · graph · yields: set + boolean]\n@purpose: \"probe the runtime, calibrate every detector the chosen methods use against both controls, and arm the defenses before trusting any tool\"\n@genesis: relation\nCONTRACT:\n  input:     methods from NODE 2\n  transform: EXECUTE_TOOL <capability probes> WITH timeout: <bound> INTO capability; FOR EACH detector IN <the detectors the methods need>: EXECUTE_TOOL detector WITH  INTO detector.reliability; <arm sanitize, safe arithmetic and recursion control to {convention.max_recursion_depth}>\n  constraints: a detector is untrusted until it passes both controls; probing is by capability, never by an operating-system string\n  output:    capability_plan\nDECLARE capability_plan: object\nSET capability_plan = {mode: <full, degraded or blocked>, detectors: <each with its reliability>, defenses: <armed>}\nHANDOFF GATE (evidence-bearing):\n  rule_id: \"CALIBRATE\"   yields: boolean\n  [check] capabilities probed and classified (evidence: capability_plan.mode)\n  [check] every needed detector ran both the false-positive and the false-negative control (evidence: detector.reliability) over: needed detectors measured: <calibrated> / <detectors>\n  [check] the defenses are armed (evidence: capability_plan.defenses)\n  refuse: a probe that would mutate the target before EXECUTE_TOOL\n  result: pass → NODE 4 | unreliable detector → REPAIR (owner: NODE 2) | unknown → BLOCKED\n\n# NODE 4 — GATHER   [epistemic · formalisation · computation · yields: set]\n@purpose: \"resolve each claim to an observable evidence requirement, order by verdict genesis, gather observations from the implementation, and hold the op-set\"\n@genesis: transformation\nCONTRACT:\n  input:     capability_plan from NODE 3\n  transform: FOR EACH claim IN run_context.claims: EXTRACT_FACTS <the observation that would settle it> FROM claim INTO requirement; ORDER requirements BY genesis rank then dependency; FOR EACH requirement IN requirements: READ_RESOURCE <the implementation it names> INTO observation\n  constraints: a requirement names the settling observation, never a presumed verdict; an observation is gathered, never inferred; a string crosses a boundary only after sanitize; a mutation under INVESTIGATE or a discovery under ACTION is inadmissible\n  preserves: the distinction between observed, pending escalation and absent\n  output:    observations\nDECLARE observations: array\nSET observations = <one per direct requirement, each bound to real implementation, escalations flagged pending>\nHANDOFF GATE (evidence-bearing):\n  rule_id: \"GATHER\"   yields: boolean\n  [check] every claim resolves to an observable requirement naming the settling observation (evidence: requirements) over: run_context.claims measured: <mapped> / <claims>\n  [check] every direct requirement produced an observation from the implementation and none was inferred (evidence: observations)\n  [check] the op-set was honoured, every boundary cross was sanitized and recursion stayed bounded (evidence: the admissibility record)\n  result: pass → NODE 5 | inadmissible act → REPAIR (owner: NODE 1) | unknown → BLOCKED\n\n# NODE 5 — ADJUDICATE   [evaluative · verification · logic + probability · yields: set + number]\n@purpose: \"judge each observation against evidence, behavioural contract and hostile inputs, judge this agent's own claims, and resolve escalations without inference\"\n@genesis: constraint\n@mandatory\nCONTRACT:\n  input:     observations from NODE 4\n  transform: FOR EACH observation IN observations: CLASSIFY observation BY <verified, contradicted or unverified>; EXECUTE_TOOL <the detectors> WITH <traversal, null-byte, homoglyph, comment and spoof inputs> INTO adversarial; ANALYZE_CONTENT {self.definition} AGAINST <its own must and always claims> INTO self_audit; FOR EACH escalation IN <pending escalations>: <build a bounded tool or mark the claim unverified>\n  constraints: a match is not evidence until the calibration and adversarial verdicts hold; an overclaim downgrades confidence below threshold; an escalation is never resolved by inference; a stale write is rewritten as complete state\n  output:    adjudication\nDECLARE adjudication: object\nSET adjudication = {verdicts: <one per claim>, adversarial: adversarial, self_audit: self_audit, confidence: , refuter: <what would flip a verdict>}\nHANDOFF GATE (ver-stop gate):\n  rule_id: \"ADJUDICATE\"   yields: boolean\n  [check] every claim is classified with its evidence and a refuter is named (evidence: adjudication.verdicts) over: run_context.claims measured: <classified> / <claims>\n  [check] every detector survived the adversarial inputs with the expected outcome (evidence: adjudication.adversarial)\n  [check] the recursive self-audit ran and an overclaim downgraded confidence (evidence: adjudication.self_audit)\n  [check] no pending escalation remains unresolved by tool or by an unverified mark (evidence: the escalation record)\n  refuse: an adversarial input that would escape the intended root before EXECUTE_TOOL\n  standing: moved-set <the implementation files re-read since NODE 4>\n  result: pass → NODE 6 | untested match → REPAIR (owner: NODE 3) | unknown → BLOCKED\n\n# NODE 6 — TERMINATE   [evaluative · termination · set-theory · yields: artifact]\n@purpose: \"emit exactly one typed artifact, deduplicated, naming every limitation, and stop only on saturation and completion and verification\"\n@genesis: emergence\n@mandatory\nCONTRACT:\n  input:     adjudication from NODE 5\n  transform: COMPOSE_ARTIFACT artifact FROM {run_context, adjudication} USING <the investigation report, the action log, or the blocked report>; REDUCE artifact.findings TO <one per claim and verdict>; PERSIST_ARTIFACT artifact TO <{task_name} report>; REPORT_RESULT artifact TO <the parties whose next work it creates>\n  constraints: exactly one artifact, bound at orientation; a self-assessed done is not ter-stop\n  output:    artifact\n  freshness: fingerprint(adjudication) + fingerprint(this document)\nHANDOFF GATE (ter-stop gate):\n  rule_id: \"TERMINATE\"   yields: boolean\n  [check] exactly one typed artifact names every limitation, warning and vulnerability (evidence: artifact)\n  [check] success only when saturation and completion and verification all hold (evidence: the termination set) over: the termination set measured: <holding> / <three>\n  [check] findings are deduplicated by claim and verdict (evidence: the reduction pass)\n  refuse: a report destination that changed since it was read before PERSIST_ARTIFACT\n  result: pass → TERMINATE | integrity defect → REPAIR (owner: NODE 6) | unknown → BLOCKED\n\n# CROSS-NODE INVARIANTS\nINVARIANT anchor-disclosed: the trust anchor is disclosed, never verified, and everything above it is verified over: every run binds: the verifier objector: [check] the trust anchor is disclosed at NODE 1\nINVARIANT op-sets-disjoint: INVESTIGATE never mutates and ACTION never discovers new scope over: every operation binds: the verifier objector: [check] the op-set was honoured at NODE 4\nINVARIANT calibrate-before-trust: no detector output is trusted before both controls pass over: every detector binds: the verifier objector: [check] every needed detector ran both controls at NODE 3\nINVARIANT gathered-never-inferred: an observation comes from the implementation, never from inference over: every observation binds: the verifier objector: [check] none was inferred at NODE 4\nINVARIANT match-is-not-evidence: a match counts only after calibration and adversarial survival over: every verdict binds: the verifier objector: [check] every detector survived the adversarial inputs at NODE 5\nINVARIANT self-not-exempt: this agent's own claims are audited by the same rules over: every run binds: the verifier objector: [check] the recursive self-audit ran at NODE 5\nINVARIANT escalate-never-infer: a missing capability builds a tool or marks the claim unverified over: every escalation binds: the verifier objector: [check] no pending escalation remains at NODE 5\n\nREPORT:\n  subject: NODE 6\n  verdict: pass | fail | unknown\n  domain: declared <claims> measured <classified>\n  populations: verified <n>, contradicted <n>, unverified <n>\n  refusals: <n> [<reason>]\n  unresolved: <n> [<reason>]\n  completion: saturated <bool> complete <bool> verified <bool>\n",
                    "kind": "code",
                    "language": "pag",
                    "title": "a verifier"
                  },
                  {
                    "code": "---\nname: {creator_name}\ntype: TEMPLATE\nversion: 1.0.0\n---\n\nTHIS TEMPLATE GENERATES an agent from inspected evidence\n\n%% META %%:\n    objective: \"an agent whose every claimed capability traces to evidence and has failed on purpose once\"\n    jurisdiction: <the domain the agent will investigate> and {project.agent_registry} | external: every other agent\n    recursion_limit: 2\n\n# NODE 1 — EVIDENCE       [epistemic · ontology · set-theory · yields: set]\n@genesis: existence\nCONTRACT:\n  input:     <the domain the agent will investigate>\n  transform: DISCOVER_RESOURCES \"<the domain>\" INTO <sources>; FOR EACH <source> IN <sources>: READ_RESOURCE <source> INTO <content>; EXTRACT_FACTS <the shapes the agent must detect> FROM <content> INTO <evidence>\n  output:    <evidence>\nHANDOFF GATE:\n  [check] <sources> is non-empty because a search was run (evidence: the search log) over: <the domain> measured: <read> / <sources>\n  [check] every capability the agent will claim traces to an item in <evidence> (evidence: one item per capability)\n  [check] nothing in <evidence> came from prior knowledge (evidence: a source per item)\n  result: pass → NODE 2 | unsourced item → REPAIR (owner: NODE 1) | unknown → BLOCKED\n\n# NODE 2 — THE PORTABLE CONTRACT   [epistemic · formalisation · computation · yields: procedure]\n@genesis: structure\nCONTRACT:\n  input:     <evidence> from NODE 1\n  transform: COMPOSE_ARTIFACT <contract> FROM <evidence> · semantic operations only; slots for every host fact, {project.*} {convention.*} {limits.*} {toolchain.*}; no runtime, no tool name, no path, no model\n  preserves: every capability's trace to its evidence\n  output:    <contract>\nHANDOFF GATE:\n  [check] <contract> names no harness feature (evidence: a scan of its literals) over: its literals measured: <neutral> / <literals>\n  [check] every host fact in <contract> is a slot (evidence: no literal path or command)\n  [check] every operation in <contract> is one an adapter can map (evidence: the operation set)\n  result: pass → NODE 3 | harness name → REPAIR (owner: NODE 2) | unknown → BLOCKED\n\n# NODE 3 — RENDERING      [evaluative · representation · information-theory · yields: artifact]\n@genesis: transformation\nCONTRACT:\n  input:     <contract> from NODE 2\n  transform: COMPOSE_ARTIFACT <artifact> FROM <contract> USING <the adapter for one runtime>\n  output:    <artifact>\n  freshness: fingerprint(<contract>) + fingerprint(<the adapter>)\nHANDOFF GATE:\n  [check] every operation resolved to a tool (evidence: the adapter's map) over: operations measured: <mapped> / <operations>\n  [check] every slot resolved to a value or a declared absence (evidence: no unresolved slot)\n  [check] the identity the agent writes under is declared in the body the runtime delivers (evidence: the body)\n  result: pass → NODE 4 | unresolved slot → REPAIR (owner: NODE 2) | unknown → BLOCKED\n\n# NODE 4 — PROOF BEFORE PERSISTENCE   [evaluative · verification · logic · yields: boolean]\n@genesis: constraint\nCONTRACT:\n  input:     <artifact> from NODE 3\n  transform: EXECUTE_TOOL <artifact> ON  INTO <fail-run>; EXECUTE_TOOL <artifact> ON  INTO <pass-run>; VALIDATE_ARTIFACT <fail-run>, <pass-run> AGAINST <fails on purpose, passes for the right reason>; PERSIST_ARTIFACT <artifact> TO {project.agent_registry}\n  output:    the persisted agent\nHANDOFF GATE:\n  [check] the contradiction reported with its evidence (evidence: <fail-run>)\n  [check] the clean case passed for the right reason (evidence: <pass-run> names the check it passed) over: the two cases measured: <as expected> / <two>\n  [check] <artifact> persisted only after both cases ran (evidence: the two runs precede the write)\n  refuse: either run missing before PERSIST_ARTIFACT\n  result: pass → TERMINATE | silent contradiction → REPAIR (owner: NODE 2) | unknown → BLOCKED\n\n# CROSS-NODE INVARIANTS\nINVARIANT evidence-first: an agent is generated from inspected evidence, never from intent alone over: every generated agent binds: the creator objector: [check] nothing in evidence came from prior knowledge at NODE 1\nINVARIANT fail-on-purpose: no agent is persisted before it has failed on a planted contradiction over: every generated agent binds: the creator objector: [check] the contradiction reported at NODE 4",
                    "kind": "code",
                    "language": "pag",
                    "title": "a creator"
                  },
                  {
                    "caption": "where guarantees live",
                    "kind": "mermaid",
                    "text": "flowchart TB\n    meta[\"META · the trust anchor as a trust line, the jurisdiction, the phase kind bound at ORIENT\"]\n    self[\"A node that reads {self.definition} · the self-audit as a contract\"]\n    decision[\"REQUEST_DECISION · resolves ABSENT for a bounded reader\"]\n    proof[\"The creator's proof gate · fails on purpose, passes for the right reason, then persists\"]\n    artifact[\"The terminal node · one typed artifact with its report, never a question\"]\n    meta --> self --> decision --> proof --> artifact"
                  }
                ],
                "title": "Walked, not adopted"
              }
            ],
            "title": "Agent templates"
          }
        ]
      }
    ],
    "tone": "grammar"
  },
  "description": "Pattern Abstract Grammar (PAG) is a structured format for writing instructions to LLMs, defined by a formal grammar that is grounded in a reasoning ontology and published with a guide and a set of templates.",
  "id": "pag",
  "label": "PAG",
  "tab": null,
  "title": "PAG — Bane's Lab",
  "url": "https://banes-lab.com/pag"
}