{
  "content": {
    "icon": "bi-file-earmark-code",
    "id": "templates",
    "label": "Templates",
    "layout": "sectioned",
    "sections": [
      {
        "icon": "bi-file-earmark-code",
        "id": "templates-core",
        "intro": "This section covers the template and how an instance is raised from it. A template record has four parts, a declared document type, the slots an instance fills, the constraints every instance must satisfy, and a body in which every slot appears by name, as shown in [template record]. [template and sibling] shows how a template differs from a sibling instance. Raising an instance is a resolution in which each slot is substituted, a slot left unresolved is reported rather than guessed, and a value outside a slot's declared set is a violation. [resolution] lists the three outcomes. The record and [workflow body] are the grammar's own workflow template, read from its records rather than restated here.",
        "subsections": [
          {
            "blocks": [
              {
                "application": "In practice, a template is written the second time a shape occurs, before the second instance is written, in the order shown in [second instance]. It declares its type, names every slot with whether it is required and, where the values form a closed set, that set, and it names the constraints every instance must satisfy so a check can read them. The body keeps only what every instance shares, with every varying value as a slot. Each new instance is raised by resolving the slots, and an instance whose resolution reports an unresolved slot or a violation is refused.",
                "boundary": "A shape seen once has no template, because one instance cannot show which of its parts are invariant. A template raised from one instance is [premature abstraction](/records/architecture/premature-abstraction).",
                "cause": "A sibling carries one instance's choices and a template carries the constraint, and a reader copying a sibling cannot tell which is which.",
                "decision": "Shared structure is extracted once a pattern repeats, rather than copied from an earlier example.",
                "failureMode": "Four parties produce four formats for one surface, each derived from a different sibling, and the check that later reads them derives its schema from a fifth.",
                "kind": "lesson",
                "principle": "For this reason what every instance must share is stated once, where a tool can hold each new one to it.",
                "problem": "An instance derived from a sibling inherits that sibling's accidents as a contract.",
                "validation": "To check this, take a template and find a value in it that would be wrong for the next instance. That value is content rather than contract, and a slot is the repair. Then resolve the template with one slot missing, and a resolution that raises the instance anyway has guessed."
              },
              {
                "kind": "text",
                "text": "The slots fall into two kinds by who supplies the value. An instance slot is what this document is for, supplied when it is raised. A host slot is a fact about the tree the document will be walked in, namespaced by its subject and filled by the adapter, so one template works in any tree."
              },
              {
                "kind": "text",
                "text": "The constraints are the family's acceptance criteria, and a check over an instance reads them from the template, as [the drop-in](/disciplined-methodology#onboarding) describes. What the template excludes is as deliberate as what it carries, so it names no model, no path and no tool, for the reasons described in [semantic operations](/pag/guide#tool-invocation). A correction lands in the template and reaches every later instance, never in the instance where only its author would see it."
              },
              {
                "code": "template:\n  type:        WORKFLOW                       # a declared document type · nothing else\n  title:       <what the family is for>\n  slots:\n    - name:        {WORKFLOW_NAME}             # the value an instance supplies\n      description: <what the slot holds>\n      required:    true\n      kind:        string\n    - name:        {project.governance_policy}   # a host fact · resolved by the adapter, never typed\n      required:    true\n    - name:        {limits.max_lines}            # a bound · resolved from the host's limits\n      required:    false\n    - name:        {scope}\n      required:    true\n      enum:        [<investigate>, <action>]     # a closed set · a value outside it is a violation\n  constraints:                                  # what every instance must satisfy · named, checkable\n    - declaration_required\n    - gate_per_node\n    - contract_reads_prior_output\n    - population_declared\n    - refusal_before_write\n    - invariant_has_objector\n    - no_autonomous_spawn\n    - single_source_of_truth\n  body: |\n    <the document, with every slot as {name}>",
                "kind": "code",
                "language": "text",
                "title": "template record"
              },
              {
                "code": "---\nname: {WORKFLOW_NAME}\ntype: WORKFLOW\nversion: 1.0.0\n---\n\nTHIS WORKFLOW EXECUTES {WORKFLOW_PURPOSE}\n\n%% META %%:\n    intent: \"{WORKFLOW_INTENT}\"\n    objective: \"{OBJECTIVE}\"\n    jurisdiction: {INPUT_SOURCE} and {OUTPUT_TARGET} | external: every other surface\n    recursion_limit: 2\n\n# NODE 1 — {NODE_ONE_TITLE}   [epistemic · analysis · set-theory · yields: set]\n@purpose: \"read the input and see it through the analysis the workflow is for\"\n@genesis: existence\nCONTRACT:\n  input:     {INPUT_SOURCE}\n  transform: READ_RESOURCE {INPUT_SOURCE} INTO input; ANALYZE_CONTENT input AGAINST {ANALYSIS_TARGET} INTO analysis\n  output:    analysis\nHANDOFF GATE (evidence-bearing):\n  [check] input read from {INPUT_SOURCE} (evidence: the read returned content) over: {INPUT_SOURCE} measured: <read> / <declared>\n  [check] analysis produced (evidence: a count above zero)\n  [check] every entry of analysis names its source in input (evidence: no entry with an empty source)\n  result: pass → NODE 2 | empty → REPAIR (owner: NODE 1) | unknown → BLOCKED\n\n# NODE 2 — {NODE_TWO_TITLE}   [epistemic · formalization · computation · yields: procedure]\n@purpose: \"transform every item by one rule, preserving what the next node needs\"\n@genesis: transformation\nCONTRACT:\n  input:     analysis from NODE 1\n  transform: FOR EACH item IN analysis: COMPOSE_ARTIFACT result FROM item USING {TRANSFORM_RULE}; APPEND result TO results\n  preserves: the source of every item\n  output:    results\nHANDOFF GATE:\n  [check] one result per item (evidence: the two counts match) over: analysis measured: <transformed> / <items>\n  [check] every result conforms to {TRANSFORM_RULE} (evidence: VALIDATE_ARTIFACT passed on each)\n  [check] analysis unchanged (evidence: a witness read)\n  result: pass → NODE 3 | mismatch → REPAIR (owner: NODE 2) | unknown → BLOCKED\n\n# NODE 3 — FINALIZATION   [evaluative · representation · information-theory · yields: artifact]\n@purpose: \"persist the results once, refuse a stale destination, and report to the parties whose next work they create\"\n@genesis: constraint\nCONTRACT:\n  input:     results from NODE 2\n  transform: PERSIST_ARTIFACT results TO {OUTPUT_TARGET}; REPORT_RESULT completion TO <the parties whose next work it creates>\n  output:    {OUTPUT_TARGET}\n  freshness: fingerprint(results) + fingerprint(this document)\nHANDOFF GATE:\n  [check] {OUTPUT_TARGET} persisted (evidence: a read returns it) over: results measured: <persisted> / <results>\n  [check] completion reported (evidence: the report)\n  [check] entry count of {OUTPUT_TARGET} matches results (evidence: the two numbers)\n  refuse: {OUTPUT_TARGET} changed since it was read before PERSIST_ARTIFACT\n  standing: moved-set none\n  result: pass → TERMINATE | loss → REPAIR (owner: NODE 3) | unknown → BLOCKED\n\n# CROSS-NODE INVARIANTS\nINVARIANT prior-output-only: a node reads only the prior node's output over: every node binds: the workflow objector: [check] input names NODE n-1 or a slot\nINVARIANT one-truth: one fact has one home across the nodes over: every artifact binds: the workflow objector: [check] entry count of the output matches results\nINVARIANT no-spawn: no autonomous party is spawned over: every node binds: the workflow objector: none\n\nREPORT:\n  subject: NODE 3\n  verdict: pass | fail | unknown\n  domain: declared <results> measured <persisted>\n  completion: saturated <bool> complete <bool> verified <bool>\n",
                "kind": "code",
                "language": "pag",
                "title": "workflow body"
              },
              {
                "code": "resolve <template> WITH <the values an instance supplies>\n\n  substituted   every {name} the instance supplied, replaced in the body\n  unresolved    [{OUTPUT_TARGET}]                        # still in the body · the instance is not ready\n  violations    [missing_required_slot:{OBJECTIVE},       # a required slot with no value\n                 enum_violation:{scope}]                  # a value outside the slot's closed set\n\n# an instance with a non-empty unresolved or violations list is not raised · nothing guesses a value",
                "kind": "code",
                "language": "text",
                "title": "resolution"
              },
              {
                "caption": "template and sibling",
                "kind": "mermaid",
                "text": "flowchart TB\n    template[\"A template record · type, slots, constraints, body\"]\n    raised[\"An instance · raised by resolving every slot\"]\n    check[\"A check · reads the constraints and the slot declarations\"]\n    sibling[\"A sibling instance\"]\n    copied[\"An instance copied from the sibling · inherits its accidents\"]\n    template --> raised\n    template --> check\n    sibling -. the tempting path .-> copied"
              },
              {
                "caption": "second instance",
                "kind": "mermaid",
                "text": "flowchart LR\n    one[\"One instance · an artifact\"]\n    two[\"A second · the invariant half is now visible\"]\n    template[\"The template is written before the second is\"]\n    later[\"Every later instance is raised from it\"]\n    one --> two --> template --> later"
              }
            ],
            "title": "Contract, not content"
          }
        ],
        "title": "Core templates"
      },
      {
        "icon": "bi-diagram-2",
        "id": "templates-coordination",
        "intro": "This section covers the two templates for coordination between parties, [surface protocol] and [decision protocol]. They share one transport and have opposite lifetimes, as described in [the board and the venue](/disciplined-methodology/collaborate#the-board-and-the-venue) and shown in [one transport]. Each is a template record whose slots are drawn from closed sets, and it is raised into an instance by resolving them. [two lifetimes] shows why the fields of one never transfer to the other.",
        "subsections": [
          {
            "blocks": [
              {
                "application": "In practice, a surface protocol is raised by resolving its key and its three lifetime values from their closed sets, and its rules are kept as written, so every party reads the surface whole, writes inside its own record, derives every state and extracts before removal. A decision protocol is raised by stating the question and an exit condition the tree can decide, a successor is declared by name where one exists, and the closure is absorption rather than agreement. Where the adapter cannot resolve a named slot, the absence is declared rather than filled.",
                "boundary": "With one writer there is nothing to converge on, and the decision is simply made.",
                "cause": "A description in words has no closed set a mechanism can join on, so each party implements the words it read.",
                "decision": "The protocol is raised from a template whose values come from closed sets, rather than from a description each collaboration writes fresh.",
                "failureMode": "A surface is described as append-only, a mechanism implements the word faithfully, and a settled argument is deleted rather than archived because no removal axis was ever declared.",
                "kind": "lesson",
                "principle": "For this reason coordination is raised from templates whose slots are the surfaces, their lifetimes and their closures.",
                "problem": "Each collaboration invents its own vocabulary for the surfaces its parties share.",
                "validation": "To check this, name for each [shared surface](/pag/orchestration#shared-surfaces) its three lifetime values and the party that may remove from it. A surface with a one-word lifetime has an undeclared axis, and the mechanism that implements the word acts on the axis it never saw."
              },
              {
                "kind": "text",
                "text": "The surface protocol puts the lifetime first, because every later rule depends on it, and its three axes are the ones described in shared surfaces. The rules that follow are one writer per record, [derived record state](/records/architecture/derived-record-state), a function over the edges, and a removal that refuses without a reference naming where the extraction landed. The check decides presence and never fidelity, because an extraction is a compression and a text comparison would fail every correct one."
              },
              {
                "kind": "text",
                "text": "The decision protocol declares its own exit condition, because without one the decision halts indefinitely. A position without evidence is an opinion, so every position carries evidence, and its author states what the proposal makes worse, because a position that cannot be attacked converges by exhaustion rather than by agreement. What convergence is, and why the archive follows absorption, is described in the board and the venue."
              },
              {
                "code": "template:\n  type:        PROTOCOL\n  title:       <how parties share one surface>\n  slots:\n    - name: {SURFACE_KEY}          required: true    kind: string\n    - name: {RETENTION}            required: true    enum: [<current-truth>, <accumulating>, <discharged>]\n    - name: {MUTABILITY}           required: true    enum: [<owner-rewritable>, <append-only>, <frozen>]\n    - name: {REMOVAL}              required: true    enum: [<handler>, <author>, <producer>, <none>]\n  constraints:\n    - declaration_required\n    - one_writer_per_record\n    - state_derived_never_written\n    - removal_declares_its_extraction\n  body: |\n    THIS PROTOCOL DEFINES how parties share {SURFACE_KEY}\n\n    DECLARE lifetime: object\n    SET lifetime = {retention: {RETENTION}, mutability: {MUTABILITY}, removal: {REMOVAL}}\n\n    # RULE 1: one writer per record\n    WHEN <party> writes {SURFACE_KEY}:\n        READ_RESOURCE {SURFACE_KEY} whole INTO <current>\n        EDIT {SURFACE_KEY} inside <party>.<record> only\n\n    # RULE 2: state is derived\n    WHEN a state is asked: RETURN state_of(<item>)     # a function over the edges, never a field\n\n    # RULE 3: removal declares its extraction\n    WHEN <item> is absorbed AND <party> IN <item>.<to>:\n        EXTRACT_FACTS <item>.<durable half> INTO <the one home history has>\n        REMOVE <item> BY <item>.<id>",
                "kind": "code",
                "language": "text",
                "title": "surface protocol"
              },
              {
                "code": "template:\n  type:        PROTOCOL\n  title:       \n  slots:\n    - name: {QUESTION}             required: true    kind: string\n    - name: {EXIT_CONDITION}       required: true    kind: string     # checkable against the tree, never judged\n    - name: {SUCCESSOR}            required: false   kind: string     # declared by name, never derived from a number\n  constraints:\n    - declaration_required\n    - exit_condition_stated\n    - positions_accumulate_until_convergence\n    - converged_is_absorbed_before_archived\n  body: |\n    THIS PROTOCOL DEFINES how {QUESTION} is decided\n\n    # a position carries evidence or it is an opinion · it stands until read and signed\n    DECLARE position: object\n    SET position = {claim: <one line>, axis: <the design question>, evidence: <an observation the other parties can reproduce>, proposes: <the mechanism>, costs: <what it makes harder, by its own author>, contradicts: , signed: <the author, or nothing>}\n\n    FUNCTION converged(venue):\n      RETURN every_party_stated_its_needs(venue) AND every_need_is_empty(venue) AND every_position_signed(venue) AND {EXIT_CONDITION}\n\n    # NODE 10 — TERMINATE   [evaluative · termination · set-theory · yields: ter-stop boolean]\n    CONTRACT:\n      input:        the venue + the distribution its outcome implies\n      transform:    converge → distribute the implied work as a plan with an owner per item → land it → move the venue whole into the archive\n      constraints:  convergence certifies agreement and nothing about the tree; leaving the active tree and leaving the repository are different operations\n      output:       the outcome in the surviving documents, the argument in the archive\n      handoff:      absorbed (yields: boolean)",
                "kind": "code",
                "language": "text",
                "title": "decision protocol"
              },
              {
                "code": "# the same transport, opposite lifetimes · the fields belong to the concern and never transfer\n   carries STATE     who owns what, what is directed at whom      swept · a resolved item is deleted\n<an argument>              carries POSITIONS where each party stands, what it still needs   accumulates · moved whole when absorbed\n\n# a position written onto the coordination surface is accumulation on the surface built to be swept\n# a state written into an argument is ownership described in a document about a decision",
                "kind": "code",
                "language": "pag",
                "title": "two lifetimes"
              },
              {
                "caption": "one transport",
                "kind": "mermaid",
                "text": "flowchart TB\n    surface[\"Surface protocol · one writer per record, derived state, lifetime on three axes, extraction before removal\"]\n    venue[\"Decision protocol · positions with evidence, an exit condition, convergence then absorption then the archive\"]\n    transport[\"One transport · fenced records, allocated ids, compare-and-swap\"]\n    surface -.-> transport\n    venue -.-> transport"
              }
            ],
            "title": "Surface and decision"
          }
        ],
        "title": "Coordination templates"
      },
      {
        "icon": "bi-clipboard-check",
        "id": "templates-planning",
        "intro": "This section covers the checklist template and the ten nodes of [the loop](/disciplined-methodology#the-loop) that produce a checklist, each owning one kind of decision and closed by a gate, with the repair edge running between them, as shown in [the ten nodes]. [checklist generator] is the grammar's own checklist template record, and [rendered checklist] is the surface it emits. That surface carries what is true now and what remains, as described in [derived state](/disciplined-methodology/verify#derived-state), and [verification report] is the verdict that travels with it.",
        "subsections": [
          {
            "blocks": [
              {
                "application": "In practice, the nodes are walked in order and no node makes a decision another node owns. A task leaves the surface only once it is both done and verified, and the walk stops when the objective sentence reads true against the tree.",
                "boundary": "A one-task change still walks every node, because a one-line fix can be a fix the project did not need, and orientation is what finds that out. What scales down is the size of each node's output, never the node set.",
                "cause": "A decision made by the wrong node is made without the evidence the owning node would have gathered.",
                "decision": "A closed task is deleted rather than ticked, so the remaining set is the work and never a count.",
                "failureMode": "A checklist says most of the units are done, two were undone by a later change, the bar still reads the same, and the next reader re-implements finished work while skipping the undone.",
                "kind": "lesson",
                "principle": "For this reason a checklist is produced by owned, gated nodes, and its state is derived rather than typed.",
                "problem": "A checklist written in one sitting records the plan its author imagined.",
                "validation": "To check this, name for each unit of a rendered checklist the node that decided it and the evidence that node read. A unit that cannot be traced to a node was authored, and a status marker on the surface stopped being true the first time the tree changed."
              },
              {
                "kind": "text",
                "text": "The nodes are the derivation loop applied to a plan. [Verification](/records/architecture/verification) judges the reasoning, not the implementation, and its result line routes findings to the repair edge rather than forward, and an unknown to blocked. The commit node numbers the tasks only once the order is stable, and every phase it renders carries the [genesis stage](/pag/patterns#genesis-stages) its node derived rather than a role label written beside it."
              },
              {
                "kind": "text",
                "text": "A task's contract has five fields, and none of them is inferred. They are the change, the file, the evidence that proves it landed, the verifier that reads the evidence, and the non-goal, which lets the next reader refuse the addition that would have widened the task. A report carries the verdict with its standing, the domain it was measured over, and the reach it covered. The standing is derived in [verify the verifier](/disciplined-methodology/verify#verify-the-verifier), and the reach is read as coverage, as described in [a report, not a checkbox](/disciplined-methodology/verify#a-report-not-a-checkbox). A pass rate is a count no step derived, and the template has no field for one."
              },
              {
                "code": "---\nname: {task_name}\ntype: CHECKLIST\nversion: 1.0.0\n---\n\nTHIS CHECKLIST GENERATES a dependency-ordered, evidence-bearing implementation checklist whose framing, worth, seeing, derivation, projection, formalization, admissibility, verification, commitment and termination are each produced and gated by the node that owns that decision.\n\n%% META %%:\n    priority: {project.governance_policy} > {project.principle_ontology} > this template > {project.architecture_rules} > {task_description}\n    trust: tool_output = TRUSTED, prior_knowledge = UNTRUSTED\n    objective: {task_description}\n    jurisdiction: {task_description} and the tree the governing documents declare | external: every surface the governing documents do not name\n    recursion_limit: 3\n\n# NODE 1 — ORIENT   [epistemic · ontology · set-theory · yields: entity-set + evidence]\n@purpose: \"establish authority, trust and current-system evidence by framing the task through the ontological dimensions\"\n@axis_question: \"What is it?\"\n@genesis: existence\n@cue: \"OBSERVE_BEFORE_PLAN\"\nCONTRACT:\n  input:     {task_description}\n  transform: READ_RESOURCE {project.governance_policy} INTO policy; READ_RESOURCE {project.principle_ontology} INTO ontology; DISCOVER_RESOURCES <the artifacts the task names> INTO discovered; EXTRACT_FACTS change_relation FROM {task_description} INTO change\n  constraints: {project.architecture_rules} is read on an algorithm, protocol, pattern, decomposition, principle or contract task; {project.design_guide} on a style, token, layout, surface or ui task; {project.component_docs} on a component, module, element, render or boundary task; a dimension is walked only when relevant\n  output:    context_bundle\nDECLARE context_bundle: object\nSET context_bundle = {intent: change.requested_outcome, change_relation: change.change_relation, dimensions: <the relevant ontological dimensions>, sources: [policy, ontology], discovered: discovered, evidence: <every discovery with its source>, unresolved: change.ambiguity}\nHANDOFF GATE (evidence-bearing):\n  rule_id: \"ORIENT\"   yields: boolean\n  [check] core authority loaded (evidence: context_bundle.sources) over: the governing documents measured: <read> / <declared>\n  [check] change_relation resolved (evidence: change.change_relation is not unknown)\n  [check] every always-relevant dimension has a readout and the evidence inventory is non-empty (evidence: context_bundle.evidence)\n  result: pass → NODE 2 | missing authority → REPAIR (owner: NODE 1) | unknown → BLOCKED\n\n# NODE 2 — INTENT   [conative · teleology · optimization · yields: objective + branch-ranking]\n@purpose: \"resolve what the work is for, enumerate admissible branches, and gate on the highest-worth one before any seeing\"\n@axis_question: \"What is it for?\"   @mandatory\n@genesis: difference\n@cue: \"WORTH_BEFORE_WORK\"\nCONTRACT:\n  input:     context_bundle from NODE 1\n  transform: ANALYZE_CONTENT context_bundle FOR candidate branches INTO branches; FOR EACH branch IN branches: CALCULATE_METRIC utility minus cost FROM branch INTO branch.worth; RANK branches BY worth\n  constraints: a branch is admissible only when it satisfies the change_relation and the hard constraints; the selected branch is the highest-worth admissible one\n  output:    teleology_bundle\nDECLARE teleology_bundle: object\nSET teleology_bundle = {objective: context_bundle.intent, branches: branches, selected: <the argmax admissible branch>}\nHANDOFF GATE (tel-priority injection-gate):\n  rule_id: \"INTENT\"   yields: boolean over ranking\n  [check] objective stated (evidence: teleology_bundle.objective)\n  [check] an admissible branch exists (evidence: branches with admissible true) over: branches measured: <admissible> / <branches>\n  [check] selected is the argmax of utility minus cost (evidence: the ranking's first entry)\n  result: pass → NODE 3 | no admissible branch → REPAIR (owner: NODE 1) | selected is not argmax → REPAIR (owner: NODE 2) | unknown → BLOCKED\n\n# NODE 3 — SEE   [epistemic · analysis · graph · yields: lens-set + analytic edges]\n@purpose: \"select the analytical lenses relevant to the selected branch and read the system through them\"\n@axis_question: \"How is it to be seen?\"\n@genesis: relation\n@cue: \"SELECT_LENSES_BEFORE_DERIVING\"\nCONTRACT:\n  input:     teleology_bundle from NODE 2\n  transform: ANALYZE_CONTENT context_bundle.discovered AGAINST <each relevant lens> INTO observations; EXTRACT_FACTS relational edges FROM observations INTO relational_edges\n  output:    analysis_bundle\nDECLARE analysis_bundle: object\nSET analysis_bundle = {lenses: <the relevant lenses>, observations: observations, relational_edges: relational_edges}\nHANDOFF GATE (evidence-bearing):\n  rule_id: \"SEE\"   yields: edge-list + boolean\n  [check] every active lens has an observation (evidence: observations) over: analysis_bundle.lenses measured: <observed> / <lenses>\n  [check] relational edges present where dependencies were discovered (evidence: relational_edges against discovered registrations)\n  [check] no observation is inferred from a name alone (evidence: every observation cites a read)\n  result: pass → NODE 4 | gap → REPAIR (owner: NODE 3) | unknown → BLOCKED\n\n# NODE 4 — DERIVE   [epistemic · reasoning · logic · yields: principle and protocol truths]\n@purpose: \"activate the principles that govern the seen decision surfaces and select protocols by semantic fit\"\n@axis_question: \"Why, and what follows?\"\n@genesis: relation\n@cue: \"DERIVE_FROM_EVIDENCE\"\nCONTRACT:\n  input:     analysis_bundle from NODE 3\n  transform: FOR EACH principle IN {project.principle_ontology}: ANALYZE_CONTENT analysis_bundle.observations AGAINST principle.activate_when INTO fit; APPEND {principle, fit, validator} TO active_principles; ANALYZE_CONTENT teleology_bundle.selected AGAINST <each protocol's use-when> INTO selected_protocols\n  constraints: every active principle binds a decision test and a validator; a protocol is selected by semantic fit, never by a trigger word; the verification protocol is always present\n  output:    derivation_bundle\nDECLARE derivation_bundle: object\nSET derivation_bundle = {active_principles: active_principles, selected_protocols: selected_protocols}\nHANDOFF GATE (evidence-bearing):\n  rule_id: \"DERIVE\"   yields: boolean\n  [check] every active mandatory principle binds a validator (evidence: active_principles) over: active_principles measured: <bound> / <active>\n  [check] every selected protocol carries a semantic reason (evidence: selected_protocols.reason)\n  [check] the verification protocol is present (evidence: selected_protocols)\n  result: pass → NODE 5 | gap → REPAIR (owner: NODE 4) | unknown → BLOCKED\n\n# NODE 5 — PROJECT   [epistemic · reasoning · logic · yields: 4D graph edge-list]\n@purpose: \"decompose into phases whose order is the substrate genesis of the artifacts, and project the dependency and ripple graph\"\n@axis_question: \"What follows downstream?\"\n@genesis: structure\n@cue: \"DECOMPOSE_AS_GENESIS\"\nCONTRACT:\n  input:     derivation_bundle from NODE 4\n  transform: FOR EACH protocol IN derivation_bundle.selected_protocols: COMPOSE_ARTIFACT phase FROM protocol USING <its genesis stage>; APPEND phase TO phases; COMPOSE_ARTIFACT graph FROM phases USING <Z sequential, X lateral, Y diagonal, W propagation>; ORDER phases BY topological Z then genesis rank\n  constraints: a phase never depends on a later-genesis output than it produces; severity is metadata that routes failure, never an ordering axis; an empty W carries the evidence it was assessed\n  preserves: every relational edge from NODE 3\n  output:    phase_records\nDECLARE phase_records: array\nSET phase_records = <the ordered phases, each with its four axes and its genesis stage>\nHANDOFF GATE (evidence-bearing):\n  rule_id: \"PROJECT\"   yields: edge-list + boolean\n  [check] the Z graph is acyclic and genesis-consistent (evidence: zero cycles, zero inversions) over: phase_records measured: <ordered> / <phases>\n  [check] every phase declares inputs, outputs, a genesis stage and all four axes (evidence: phase_records)\n  [check] order is dependency-topological then genesis with severity as metadata only (evidence: no severity grouping)\n  result: pass → NODE 6 | cycle or inversion → REPAIR (owner: NODE 5) | unknown → BLOCKED\n\n# NODE 6 — ACT   [epistemic · formalization · computation · yields: task procedures]\n@purpose: \"formalize phases into atomic, target-specific tasks under binding execution constraints, with full ripple chains\"\n@axis_question: \"What does it resolve to?\"\n@genesis: transformation\n@cue: \"FORMALIZE_EXECUTABLE_TASKS\"\nCONTRACT:\n  input:     phase_records from NODE 5\n  transform: FOR EACH phase IN phase_records: COMPOSE_ARTIFACT tasks FROM phase USING <the task template of its verb>; FOR EACH task IN tasks: ANALYZE_CONTENT task FOR <the ripple dimensions> INTO task.ripple; APPEND task TO task_records\n  constraints: the host's patterns bind every step, dependency through {registry}, observability through {logger}, size within {limits.max_lines} and {limits.max_files}; a build or verify task runs {toolchain.build.execute} or {verify_cmd} as a blocking step; a ripple names entities, never counts\n  output:    task_records\nDECLARE task_records: array\nSET task_records = <atomic, target-specific tasks with an evidence contract and named ripple, numbered N.M.K>\nHANDOFF GATE (evidence-bearing):\n  rule_id: \"ACT\"   yields: procedure + set-cardinality\n  [check] at least one task per phase (evidence: task_records against phase_records) over: phase_records measured: <with tasks> / <phases>\n  [check] every task is atomic and target-specific with an evidence contract (evidence: expected evidence per task)\n  [check] every task carries every ripple dimension with names (evidence: task.ripple)\n  result: pass → NODE 7 | non-atomic or missing ripple → REPAIR (owner: NODE 6) | unknown → BLOCKED\n\n# NODE 7 — CONSTRAIN   [conative · teleology · optimization · yields: admissibility boolean]\n@purpose: \"gate the formalized plan on admissibility before verification: still worth executing, still on the selected branch, within the hard limits\"\n@axis_question: \"Is it still worth it, and is it allowed?\"   @mandatory\n@genesis: constraint\n@cue: \"ADMISSIBLE_BEFORE_VERIFY\"\nCONTRACT:\n  input:     task_records from NODE 6\n  transform: CALCULATE_METRIC realized cost FROM task_records INTO realized_cost; FOR EACH task IN task_records: ANALYZE_CONTENT task AGAINST teleology_bundle.selected INTO trace; COMPARE realized_cost AGAINST teleology_bundle.selected.cost\n  output:    admissibility\nDECLARE admissibility: object\nSET admissibility = {ok: <cost within budget and nothing off branch and no limit breached>, realized_cost: realized_cost, off_branch: <tasks that do not trace>, limit_breaches: <phases over a hard limit>}\nHANDOFF GATE (teleology admissibility gate):\n  rule_id: \"CONSTRAIN\"   yields: boolean\n  [check] realized cost within the branch budget (evidence: realized_cost against the budget)\n  [check] every task traces to the selected branch (evidence: admissibility.off_branch empty) over: task_records measured: <on branch> / <tasks>\n  [check] no hard limit breached (evidence: admissibility.limit_breaches empty)\n  result: pass → NODE 8 | cost over budget or off branch → REPAIR (owner: NODE 2) | limit breach → REPAIR (owner: NODE 6) | unknown → BLOCKED\n\n# NODE 8 — VERIFY   [evaluative · verification · logic + probability · yields: validation report]\n@purpose: \"judge the generated reasoning against evidence, falsification, confidence and semantic policy before commitment\"\n@axis_question: \"Is it real?\"   @mandatory\n@genesis: constraint\n@cue: \"VERIFY_REASONING_NOT_IMPLEMENTATION\"\nCONTRACT:\n  input:     admissibility from NODE 7\n  transform: EXTRACT_FACTS material claims FROM {phase_records, task_records} INTO claims; FOR EACH claim IN claims: SEARCH_CONTENT context_bundle.evidence FOR claim.support INTO support; VALIDATE_ARTIFACT {phase_records, task_records} AGAINST <the validation suites> INTO findings\n  constraints: a claim is supported only with evidence, never by the absence of a contradiction; confidence is a number tested against a threshold; policy is semantic, never a substring ban; an unmeasured claim is unknown, and unknown is not pass\n  output:    validation_report\nDECLARE validation_report: object\nSET validation_report = {status: <pass, repair_required or blocked>, findings: findings, confidence: <the minimum claim confidence>, examined: context_bundle.evidence, unresolved: context_bundle.unresolved}\nHANDOFF GATE (ver-stop gate):\n  rule_id: \"VERIFY\"   yields: boolean\n  [check] every finding names what it examined (evidence: findings carry evidence and a rule id)\n  [check] every material claim has non-empty evidence and a named refuter (evidence: claims) over: claims measured: <supported> / <claims>\n  [check] confidence is at or above the threshold (evidence: validation_report.confidence)\n  [check] status is pass with zero blocking findings (evidence: validation_report.findings)\n  standing: moved-set <the surfaces re-read since NODE 1>\n  result: pass → NODE 9 | repair_required → REPAIR (owner: <the earliest node named by a finding>) | unknown → BLOCKED\n\n# REPAIR EDGE  (verify refutes back to the earliest invalid node, bounded by the recursion limit)\nCONTRACT:\n  input:     validation_report.findings, or a failed admissibility\n  transform: FOR EACH finding IN findings: ORDER finding BY <the node order>; <re-run from the earliest owning node forward, invalidating every dependent record>\n  constraints: bounded by recursion_limit; severity orders the repairs among failures and never softens a verdict; a downstream record is never restored after an upstream repair\n  output:    repaired records at pass, or a blocked terminal with the remaining findings\n\n# NODE 9 — COMMIT   [evaluative · representation · information-theory · yields: rendered artifact]\n@purpose: \"serialize only validated records into the one canonical representation, deduplicated, adding no new decision\"\n@axis_question: \"How is it encoded?\"\n@genesis: emergence\n@cue: \"COMMIT_WITHOUT_NEW_DECISIONS\"\nCONTRACT:\n  input:     validation_report from NODE 8\n  transform: COMPOSE_ARTIFACT rendered FROM {context_bundle, teleology_bundle, phase_records, task_records, validation_report} USING <the checklist shape>; REDUCE rendered TO <one entry per phase and task>\n  constraints: rendering adds no architecture decision; identical content collapses to one representation; a future execution checkbox stays unchecked; every phase carries its genesis stage and its four axes\n  preserves: every ripple impact by name\n  output:    rendered\n  freshness: fingerprint(validation_report) + fingerprint(this document)\nHANDOFF GATE (evidence-bearing):\n  rule_id: \"COMMIT\"   yields: hash + boolean\n  [check] no phase or task encoded twice (evidence: the deduplication pass) over: phase_records and task_records measured: <encoded once> / <records>\n  [check] no future execution checkbox pre-checked (evidence: a render scan)\n  [check] no architecture decision introduced at render (evidence: the rendering rules)\n  result: pass → NODE 10 | integrity defect → REPAIR (owner: NODE 9) | unknown → BLOCKED\n\n# NODE 10 — TERMINATE   [evaluative · termination · set-theory · yields: artifact]\n@purpose: \"stop only on saturation and completion and verification; otherwise block on external input, never a self-assessed stop\"\n@axis_question: \"Is it done?\"   @mandatory\n@genesis: emergence\n@cue: \"TERMINATE_EXPLICITLY\"\nCONTRACT:\n  input:     rendered from NODE 9\n  transform: VALIDATE_ARTIFACT rendered AGAINST <every phase and task once, contiguous numbering, no pre-checked execution box> INTO render_check; PERSIST_ARTIFACT rendered TO <{task_name} checklist>; REPORT_RESULT generation_result TO <the parties whose next work it creates>\n  constraints: exactly one terminal, success or blocked; ter-block routes to REQUEST_DECISION; a self-assessed done is not ter-stop\n  output:    generation_result\n  freshness: fingerprint(rendered) + fingerprint(this document)\nHANDOFF GATE (ter-stop gate):\n  rule_id: \"TERMINATE\"   yields: boolean\n  [check] status is success or blocked and an output file is named (evidence: generation_result)\n  [check] success only when saturation and completion and verification all hold (evidence: the termination set) over: the termination set measured: <holding> / <three>\n  [check] repair cycles within recursion_limit (evidence: the repair count)\n  [check] no future execution checkbox pre-checked (evidence: render_check)\n  refuse: the destination changed since it was read before PERSIST_ARTIFACT\n  standing: moved-set <the surfaces re-read since NODE 8>\n  result: pass → TERMINATE | integrity defect → REPAIR (owner: NODE 9) | unknown → BLOCKED\n\n# CROSS-NODE INVARIANTS\nINVARIANT ontology-before-teleology: authority, trust and the ontology of the change are resolved before its teleology, and both before any seeing over: every generation binds: the generator objector: [check] core authority loaded at NODE 1\nINVARIANT four-gates-always: the worth, admissibility, evidence and termination gates run on every generation over: every generation binds: the generator objector: [check] status is success or blocked at NODE 10\nINVARIANT typed-decisions: every decision resolves to its declared shape, a ranking never satisfied by a boolean over: every node binds: the generator objector: [check] selected is the argmax at NODE 2\nINVARIANT genesis-order: a phase never depends on a later-genesis output than it produces over: phase_records binds: the generator objector: [check] the Z graph is acyclic and genesis-consistent at NODE 5\nINVARIANT prior-output-only: a node reads only the prior node's output contract over: every node binds: the generator objector: [check] input names NODE n-1 or a declared variable\nINVARIANT evidence-not-absence: a claim is supported only with evidence, never by the absence of a contradiction, and unknown is not pass over: every claim binds: the generator objector: [check] every material claim has non-empty evidence at NODE 8\nINVARIANT repair-from-earliest: a failed gate repairs from the earliest owning node and never restores a downstream record over: every repair binds: the generator objector: [check] repair cycles within recursion_limit at NODE 10\nINVARIANT generation-not-execution: a gate resolved while generating is separate from a gate that runs when the checklist is executed, and the latter ships unchecked over: every rendered gate binds: the generator objector: [check] no future execution checkbox pre-checked at NODE 10\n\nREPORT:\n  subject: NODE 10\n  verdict: pass | fail | unknown\n  domain: declared <phase and task records> measured <encoded once>\n  populations: phases <n>, tasks <n>, claims supported <n>, claims unknown <n>\n  inputs: {task_description} <fingerprint>, {project.governance_policy} <fingerprint>, {project.principle_ontology} <fingerprint>\n  code: this document <fingerprint>\n  output: {task_name} checklist <fingerprint>\n  refusals: <n> [<reason>]\n  unresolved: <n> [<reason>]\n  completion: saturated <bool> complete <bool> verified <bool>\n",
                "kind": "code",
                "language": "pag",
                "title": "checklist generator"
              },
              {
                "code": "# <the rendered checklist · what the generator emits, every box unchecked>\n\n## Worth\nObjective: <the outcome, named so the result can be checked against it>\nNot in scope: <the nearest things this change will not do>\nBranches ranked: <the way chosen, and why the others lost>\n\n## Admissible\nHard limits: <what no node may cross>\nCost: <what this is allowed to take, and the point past which it stops>\n\n## PHASE 1 — <name>                   [genesis: <stage> · severity: <routes the repair>]\nReads: nothing.\nRipple: <what this phase's output reaches, by name>\nGate: <the evidence PHASE 2 reads before it starts, over what set>\n- [ ] 1.1 <one change> · file: <where> · evidence: <what proves it> · verifier: <who reads it> · not: <what this task leaves alone>\n\n## PHASE 2 — <name>                   [genesis: <stage> · severity: <routes the repair>]\nReads: the output of PHASE 1.\nRipple: <what this phase's output reaches, by name>\nGate: <the evidence PHASE 3 reads, over what set>\n- [ ] 2.1 <one change> · file: <where> · evidence: <what proves it> · verifier: <who reads it> · not: <what this task leaves alone>\n\n## Termination\nThe run stops when the objective sentence reads true against the tree, not when the boxes are ticked.",
                "kind": "code",
                "language": "markdown",
                "title": "rendered checklist"
              },
              {
                "code": "# a verification report · a verdict with its standing, its domain and its reach\nsubject:   <the run>\nverdict:   <pass | fail | unknown>\nstanding:  <authoritative | withdrawn>      # withdrawn where a read surface moved beneath the run\ndomain:    declared <N> measured <n>         # what the run claimed to cover, and what it reached\nreached:   [<every surface the run read>]\nmoved:     [<surfaces that changed mid-run, if any>]\nrefusals:  <n> [<why the run declined to continue, if it did>]\nunresolved: <n> [<what stays open>]\n\n## NODE 1 — <name>\n### Gate: <what it checks>\n- status:   <pass | fail | unknown>\n- evidence: <file and locus, for every check>\n- over:     <the set the check ranged over, n of N>\n- failure:  <which check, what was found · only on fail>\n- owner:    <the node or party that owns the repair · only on fail>",
                "kind": "code",
                "language": "markdown",
                "title": "verification report"
              },
              {
                "caption": "the ten nodes",
                "kind": "mermaid",
                "text": "flowchart TB\n    orient[\"Orient · observe before plan\"]\n    intent[\"Intent · worth before work\"]\n    see[\"See · the lenses, the relational edges\"]\n    derive[\"Derive · principles and protocols by fit\"]\n    project[\"Project · phases in genesis order, the four axes\"]\n    act[\"Act · atomic tasks with evidence contracts and named ripple\"]\n    constrain[\"Constrain · admissible, on budget, on branch\"]\n    verify[\"Verify · the reasoning, against evidence, with its population\"]\n    commit[\"Commit · one terminal, every box unchecked\"]\n    terminate[\"Terminate · saturated, complete, verified\"]\n    orient --> intent --> see --> derive --> project --> act --> constrain --> verify --> commit --> terminate\n    verify -. the repair edge · back to the earliest owning node, bounded .-> derive"
              }
            ],
            "title": "Produced by nodes, derived by deletion"
          }
        ],
        "title": "Planning templates"
      },
      {
        "icon": "bi-file-earmark-text",
        "id": "templates-families",
        "intro": "This section covers the template families, which [the families] lists with the genesis question each answers. A family document has no runtime, so it is walked by the reasoning model its type declares, on the axis its type names, and an adapter performs the effects, as shown in [type to artifact]. Every node states its layer, its axis, the shape its decision yields, the contract it transforms and one evidence-bearing gate, as shown in [one node] beneath [family header]. The transitions are declared once in [loop spine], and every node cites it. A template is used by walking its nodes as the spine declares, as described in [execute the template](/disciplined-methodology/plan#execute-the-template), and [walk or read] shows the difference that decides whether its guarantees hold.",
        "subsections": [
          {
            "blocks": [
              {
                "application": "In practice, a family document opens by declaring its type, its trust anchor, its recursion limit and the slots every host fact resolves through. It states the four layers with the question each answers about this document, and the shape legend every decision is typed by. Each node has a purpose, an axis question, a cue and a contract, its decisions are typed, and it closes on a gate whose checks carry their evidence. The spine is declared once, and every handoff cites it.",
                "boundary": "A template family fits only an artifact that will be walked, and an artifact that is read rather than walked is described in [from intent to structure](/pag/patterns#intent-to-structure).",
                "cause": "A node that reads only the prior node's output cannot skip a decision, and a gate that owes a shape cannot be satisfied by a different one.",
                "decision": "The family is selected by the genesis question the artifact answers, and the type declares who walks it and on which axis, rather than the reader picking.",
                "failureMode": "A debugging document is walked as a plan, the ranking of candidate lines is skipped, and the first hypothesis is traced to the end.",
                "kind": "lesson",
                "principle": "For this reason a template family is a document type whose nodes are typed contracts, walked by the reasoning model its type declares.",
                "problem": "A family document that does not say who walks it and on which axis leaves the reader to pick.",
                "validation": "To check this, name for each node the layer, the axis and the shape its header declares, and the gate that carries evidence. A node missing any of the four is prose written in the family's format."
              },
              {
                "kind": "text",
                "text": "The trust anchor says which inputs are evidence and which are claims, so a hypothesis is untrusted until it is scored and prior knowledge is untrusted throughout."
              },
              {
                "kind": "text",
                "text": "A node is [design by contract](/records/architecture/design-by-contract) at the scale of one decision. The repair edge is the one a fixed pipeline lacks, and what it does is described in [validation gates](/pag/validation#validation-gates)."
              },
              {
                "kind": "text",
                "text": "Families are selected by the genesis question, and each inlines its whole structure rather than importing a shared spine. Duplication is deliberate here and nowhere else, because [independence](/records/architecture/independence) is what makes each family walkable on its own. A family's loop, its typing and its gates are domain-neutral and transfer to any tree unchanged. Its catalogs, the taxonomies it cites and the thresholds it names, are slots the adapter resolves, as described in [limits](/pag/validation#limitations)."
              },
              {
                "code": "---\nname: {task_name}\ntype: DEBUG\nversion: 1.0.0\n---\n\nTHIS DEBUG RESOLVES a symptom to an evidence-scored root cause and one minimal fix by walking the ten-node loop across four reasoning layers\n\n%% META %%:\n    priority: EVIDENCE > ROOT_CAUSE > SPEED\n    trust: procedural_trace = TRUSTED, test_result = TRUSTED, prior_knowledge = UNTRUSTED, a_hypothesis = UNTRUSTED_UNTIL_SCORED\n    objective: {bug_report}\n    recursion_limit: {limits.max_fix_attempts}\n    parameters: every taxonomy, threshold and command resolves from {convention.*}, {limits.*} and {toolchain.*}, never typed\n\nTHE FOUR LAYERS · each answers one question about this document\n    substrate    how does a fix come to be            grounds the path from differential to fix\n    epistemic    how is the bug known                 orient · see · derive · project · act\n    conative     which line is worth pursuing         intent · constrain          mandatory, always\n    evaluative   is it fixed, and are we done         verify · commit · terminate mandatory, always\n\nYIELDS-SHAPE LEGEND · every decision resolves to a typed shape\n    set-theory → set or boolean   logic → boolean   graph → edge-list   optimization → boolean or ranking\n    analysis → operation   computation → procedure   probability → a number in zero to one   dynamical-systems → boolean or counter",
                "kind": "code",
                "language": "pag",
                "title": "family header"
              },
              {
                "code": "# NODE 2 — INTENT   [conative · teleology · optimization · yields: ranking]\n@purpose: \"extract the differential and rank the candidate lines by worth, so one line is traced and the rest are not\"\n@axis_question: \"which line is worth pursuing?\"\n@cue: \"rank before you trace\"\n@mandatory\n\nCONTRACT:\n  input:        the session from NODE 1 · the symptom, what works, what breaks\n  transform:    detect the works-versus-breaks differential; rank the candidate lines by probability times severity minus cost\n  constraints:  a line is admissible only inside {limits.max_fix_attempts}\n  output:       <ranked>, and the selected line\n  handoff:      the selected line is the argmax of the admissible · yields a boolean over a ranking\n\nDECLARE tel: object\nSET tel = {\n  objective: \"find and fix the root cause\",          # yields: a set\n  utility:   FUNCTION(line) → probability(line) * severity(line),   # yields: a number\n  cost:      FUNCTION(line) → what tracing it costs,                # yields: a number\n  priority:  FUNCTION(ranked) → ranked[0] is admissible             # yields: a boolean over a ranking\n}\n\n# OUTPUT CONTRACT\nSET <ranked> = RANK <candidate lines> BY tel.utility - tel.cost\n\nHANDOFF GATE (evidence-bearing):\n  rule_id: \"INTENT\"   yields: ranking\n  [check] the selected line is the argmax of utility minus cost (evidence: the ranking)\n  [check] <ranked> holds more than one admissible line (evidence: a count above one)\n  [check] no line was traced before the ranking existed (evidence: the trace log starts after this gate)\n  result: pass → NODE 3 | one admissible line → REPAIR (owner: NODE 1) | unknown → BLOCKED",
                "kind": "code",
                "language": "pag",
                "title": "one node"
              },
              {
                "code": "# THE LOOP SPINE · declared once, every node cites it\n# node        layer       axis            yields                     transition out\n# orient      epistemic   ontology        a set, with evidence       sequences → intent\n# intent      conative    teleology       an objective, a ranking    GATE worth → see | redirect\n# see         epistemic   analysis        lenses, edges              sequences → derive\n# derive      epistemic   reasoning       claims                     sequences → project\n# project     epistemic   reasoning       an ordered graph           sequences → act\n# act         epistemic   formalization   procedures                 sequences → constrain\n# constrain   conative    teleology       admissibility              GATE → verify | repair\n# verify      evaluative  verification    a report                   GATE evidence · refutes back to the earliest owner\n# commit      evaluative  representation  the artifact               sequences → terminate\n# terminate   evaluative  termination     stop                       GATE stop → STOP | blocked → ask\n\n# REPAIR EDGE · verify fails backward to the earliest node that can supply the missing evidence, bounded by {recursion_limit}\n# a repair invalidates every dependent record forward · nothing downstream is restored",
                "kind": "code",
                "language": "pag",
                "title": "loop spine"
              },
              {
                "code": "# the families · each a document type, each walked by the model and axis its type declares\nCHECKLIST      pattern-cycle  formalization   a plan, produced by owned nodes\nDEBUG          epistemology   analysis        a symptom to an evidence-scored cause and one fix\nVERIFICATION   epistemology   verification    claims adjudicated against implementation evidence\nAUDIT          epistemology   verification    an agent measured against its contract, then corrected\nDISTILLATION   epistemology   reasoning       repeated behavior to one proven base\nTRANSLATION    epistemology   representation  a rendering audited line by line against its source\nCOMPOSITION    pattern-cycle  formalization   a structure rendered from anchors and modifiers\n\n# the genesis question each answers · one question, one family\n\"how does a plan come to be?\"      → CHECKLIST\n\"how does a fix come to be?\"       → DEBUG\n\"how does a verdict come to be?\"   → VERIFICATION, AUDIT\n\"how does a base come to be?\"      → DISTILLATION\n\"how does a rendering come to be?\" → TRANSLATION, COMPOSITION",
                "kind": "code",
                "language": "pag",
                "title": "the families"
              },
              {
                "caption": "type to artifact",
                "kind": "mermaid",
                "text": "flowchart TB\n    type[\"The document type · declares the model and the axis\"]\n    layers[\"Four layers · substrate, epistemic, conative, evaluative\"]\n    nodes[\"Nodes · each typed to the shape it yields, each reading the prior output\"]\n    gate[\"One evidence-bearing gate per node\"]\n    spine[\"The spine · transitions declared once\"]\n    artifact[\"The artifact the loop terminates on\"]\n    type --> layers --> nodes --> gate --> artifact\n    spine --> nodes\n    gate -. repairs back, bounded .-> nodes"
              },
              {
                "caption": "walk or read",
                "kind": "mermaid",
                "text": "flowchart LR\n    read[\"Read a template for ideas\"]\n    shaped[\"Write something template-shaped\"]\n    none[\"None of its guarantees\"]\n    walk[\"Walk its nodes as the spine declares\"]\n    artifact[\"The artifact the loop terminates on\"]\n    read -. the tempting path .-> shaped --> none\n    walk --> artifact"
              }
            ],
            "title": "Typed nodes, one gate each"
          }
        ],
        "title": "Template families"
      },
      {
        "icon": "bi-robot",
        "id": "templates-agents",
        "intro": "This section covers how a document expresses an agent, a verifier and a creator. An agent is a document of the agent type, a cognition walked on the reasoning axis, as shown in [an agent], and a verifier is a document of the [verification](/records/architecture/verification) type, an epistemology walked on the verification axis, as shown in [a verifier]. A creator is a template that generates an agent, as shown in [a creator], and the first two bodies are the grammar's own template records. What an agent is, why it is a walked loop and never a persona, and how a verifier earns trust are described in [agents as executed contracts](/disciplined-methodology/collaborate#agents-as-executed-contracts) and [verify the verifier](/disciplined-methodology/verify#verify-the-verifier), and [where guarantees live] maps where each guarantee is expressed.",
        "subsections": [
          {
            "blocks": [
              {
                "application": "In practice, the trust anchor is the trust line of the meta block, the jurisdiction sits beneath it, and the phase kind is bound in the orient node. The self-audit is a node whose contract reads the agent's own definition and tests every capability it claims on a positive and a negative case. A decision request resolves absent for a bounded reader, so the terminal node yields the artifact and never a question. The creator's proof is a gate that runs the rendered agent on a planted contradiction and on a clean case before the persist line, and it refuses the persist while either run is missing.",
                "boundary": "An agent written for a bounded invocation returns instead of asking, which is the inversion derived in [composing a collaboration](/pag/orchestration#composing-a-workflow).",
                "cause": "A capability stated in prose has no node that exercises it, so nothing in the document can show the claim false.",
                "decision": "Each guarantee of the agent is expressed as a node with a gate, rather than as a sentence about the agent in its description.",
                "failureMode": "An agent's description says it calibrates its detectors, no node reads a fixture, and the description is the only place calibration ever happened.",
                "kind": "lesson",
                "principle": "For this reason an agent document carries its guarantees as nodes and gates, so each one can be walked and can fail.",
                "problem": "An agent's guarantees stated in its description are read, never walked.",
                "validation": "To check this, name for each capability the agent's description claims the node whose gate exercises it. A capability with no node was adopted from the description, and the document has not shown it."
              },
              {
                "kind": "text",
                "text": "A claim's kind decides the evidence that can settle it, because a claim of existence needs a presence search and a claim of behavior needs an execution, so the orient node assigns each claim its kind and the evidence shape that kind requires before anything is probed. The identity the agent writes under is declared in the body the runtime delivers, for the reason described in agents as executed contracts."
              },
              {
                "code": "---\nname: {AGENT_NAME}\ntype: AGENT\nversion: 1.0.0\n---\n\nTHIS AGENT PERFORMS {PRIMARY_PURPOSE}\n\n%% META %%:\n    intent: \"{AGENT_DESCRIPTION}\"\n    objective: \"{OBJECTIVE}\"\n    jurisdiction: {DOMAIN_SCOPE} | external: everything the scope does not name\n    recursion_limit: 2\n\n# NODE 1 — DISCOVERY   [epistemic · ontology · set-theory · yields: set]\n@purpose: \"read the scope before claiming anything about it\"\n@genesis: existence\nCONTRACT:\n  input:     {DOMAIN_SCOPE}\n  transform: READ_RESOURCE {DOMAIN_SCOPE} INTO context; ANALYZE_CONTENT context FOR patterns INTO findings\n  output:    findings\nHANDOFF GATE (evidence-bearing):\n  [check] context read from {DOMAIN_SCOPE} (evidence: the read returned content) over: {DOMAIN_SCOPE} measured: <read> / <declared>\n  [check] findings populated (evidence: a count above zero)\n  [check] every finding names its source in context (evidence: no finding with an empty source)\n  result: pass → NODE 2 | empty → REPAIR (owner: NODE 1) | unknown → BLOCKED\n\n# NODE 2 — EXECUTION   [epistemic · formalization · computation · yields: procedure]\n@purpose: \"act on every finding, once, with the evidence of each act recorded\"\n@genesis: transformation\nCONTRACT:\n  input:     findings from NODE 1\n  transform: FOR EACH item IN findings: EXECUTE_TOOL {PRIMARY_ACTION} WITH item INTO outcome; APPEND outcome TO outcomes\n  output:    outcomes\nHANDOFF GATE:\n  [check] one outcome per finding (evidence: the two counts match) over: findings measured: <acted> / <findings>\n  [check] no outcome rests on an assumption (evidence: every outcome cites the finding it acted on)\n  [check] findings unchanged (evidence: a witness read)\n  refuse: a finding whose source cannot be re-read before EXECUTE_TOOL\n  result: pass → NODE 3 | mismatch → REPAIR (owner: NODE 2) | unknown → BLOCKED\n\n# NODE 3 — VERIFICATION   [evaluative · verification · logic · yields: artifact]\n@purpose: \"validate the outcomes against the criteria and report to the parties whose next work they create\"\n@genesis: constraint\nCONTRACT:\n  input:     outcomes from NODE 2\n  transform: VALIDATE_ARTIFACT outcomes AGAINST {SUCCESS_CRITERIA} INTO verdict; REPORT_RESULT verdict TO <the parties whose next work it creates>\n  output:    verdict\n  freshness: fingerprint(outcomes) + fingerprint(this document)\nHANDOFF GATE:\n  [check] outcomes validated against {SUCCESS_CRITERIA} (evidence: the validator's report) over: outcomes measured: <validated> / <outcomes>\n  [check] verdict reported (evidence: the report)\n  [check] no residual failure (evidence: zero failing outcomes in the report)\n  standing: moved-set none\n  result: pass → TERMINATE | residual → REPAIR (owner: NODE 2) | unknown → BLOCKED\n\n# CROSS-NODE INVARIANTS\nINVARIANT read-before-write: a node reads its input before it writes anything over: every node binds: the agent objector: [check] context read at NODE 1\nINVARIANT one-gate-per-node: a node hands off through exactly one evidence-bearing gate over: every node binds: the agent objector: [check] result line present\nINVARIANT no-spawn: no autonomous party is spawned over: every node binds: the agent objector: none\n\nREPORT:\n  subject: NODE 3\n  verdict: pass | fail | unknown\n  domain: declared <outcomes> measured <validated>\n  completion: saturated <bool> complete <bool> verified <bool>\n",
                "kind": "code",
                "language": "pag",
                "title": "an agent"
              },
              {
                "code": "---\nname: {task_name}\ntype: VERIFICATION\nversion: 1.0.0\n---\n\nTHIS VERIFICATION PERFORMS a forensic adjudication that classifies every context claim verified, contradicted or unverified against observable implementation evidence, with detectors calibrated and adversarially tested before any claim is trusted.\n\n%% META %%:\n    priority: EVIDENCE > TRUST_ANCHOR > TASK\n    trust: implementation_observation = TRUSTED, prior_knowledge = UNTRUSTED, a_claim = UNTRUSTED_UNTIL_MAPPED\n    objective: {context_claims}\n    jurisdiction: {context_claims} about {target} | external: the runtime, filesystem, command execution and tool io the trust anchor discloses\n    recursion_limit: {convention.max_recursion_depth}\n\n# NODE 1 — ORIENT   [epistemic · ontology · set-theory · yields: set]\n@purpose: \"disclose the trust anchor, bind one op-set, and kind every claim by its ontological dimension before touching any claim\"\n@genesis: existence\nCONTRACT:\n  input:     {context_claims} about {target}\n  transform: EXTRACT_FACTS <the minimal assumptions and the cannot-verify-the-verifier boundary> FROM <this document> INTO anchor; DETERMINE <INVESTIGATE or ACTION> INTO op_set; FOR EACH claim IN {context_claims}: CLASSIFY claim BY <its ontological dimension and evidence shape>\n  constraints: the anchor is disclosed, never verified; INVESTIGATE allows gap discovery, testing and documentation and forbids mutation; ACTION allows a bounded fix and forbids discovery; the two are disjoint\n  output:    run_context\nDECLARE run_context: object\nSET run_context = {anchor: anchor, op_set: op_set, claims: <every claim with its kind, evidence shape and math type>}\nHANDOFF GATE (evidence-bearing):\n  rule_id: \"ORIENT\"   yields: boolean\n  [check] the trust anchor is disclosed with its assumptions and boundary (evidence: run_context.anchor)\n  [check] exactly one op-set is bound and its allowed and forbidden operations are disjoint (evidence: run_context.op_set)\n  [check] every claim carries a kind and an evidence shape (evidence: run_context.claims) over: {context_claims} measured: <kinded> / <claims>\n  result: pass → NODE 2 | unkinded claim → REPAIR (owner: NODE 1) | unknown → BLOCKED\n\n# NODE 2 — INTENT   [conative · teleology · optimization · yields: ranking]\n@purpose: \"rank claims by verification worth and choose the method per claim by utility minus cost before probing anything\"\n@genesis: difference\n@mandatory\nCONTRACT:\n  input:     run_context from NODE 1\n  transform: FOR EACH claim IN run_context.claims: CALCULATE_METRIC risk times uncertainty FROM claim INTO claim.worth; FOR EACH claim IN run_context.claims: RANK <its admissible methods> BY risk-weighted coverage minus cost\n  constraints: a method is admissible only when its capability is available; a high-worth claim with no admissible method is marked will-be-unverified, never inverted below a low-worth escalation\n  output:    methods\nDECLARE methods: array\nSET methods = <one chosen method per claim, the argmax admissible one>\nHANDOFF GATE (tel-priority injection-gate):\n  rule_id: \"INTENT\"   yields: boolean over ranking\n  [check] every claim carries a worth and a chosen method (evidence: methods) over: run_context.claims measured: <with method> / <claims>\n  [check] each chosen method is the argmax of risk-weighted coverage minus cost (evidence: the per-claim ranking)\n  [check] no high-worth claim is left unmapped while a low-worth claim escalates (evidence: the worth order against the escalations)\n  result: pass → NODE 3 | priority inversion → REPAIR (owner: NODE 2) | unknown → BLOCKED\n\n# NODE 3 — CALIBRATE   [epistemic · analysis · graph · yields: set + boolean]\n@purpose: \"probe the runtime, calibrate every detector the chosen methods use against both controls, and arm the defenses before trusting any tool\"\n@genesis: relation\nCONTRACT:\n  input:     methods from NODE 2\n  transform: EXECUTE_TOOL <capability probes> WITH timeout: <bound> INTO capability; FOR EACH detector IN <the detectors the methods need>: EXECUTE_TOOL detector WITH  INTO detector.reliability; <arm sanitize, safe arithmetic and recursion control to {convention.max_recursion_depth}>\n  constraints: a detector is untrusted until it passes both controls; probing is by capability, never by an operating-system string\n  output:    capability_plan\nDECLARE capability_plan: object\nSET capability_plan = {mode: <full, degraded or blocked>, detectors: <each with its reliability>, defenses: <armed>}\nHANDOFF GATE (evidence-bearing):\n  rule_id: \"CALIBRATE\"   yields: boolean\n  [check] capabilities probed and classified (evidence: capability_plan.mode)\n  [check] every needed detector ran both the false-positive and the false-negative control (evidence: detector.reliability) over: needed detectors measured: <calibrated> / <detectors>\n  [check] the defenses are armed (evidence: capability_plan.defenses)\n  refuse: a probe that would mutate the target before EXECUTE_TOOL\n  result: pass → NODE 4 | unreliable detector → REPAIR (owner: NODE 2) | unknown → BLOCKED\n\n# NODE 4 — GATHER   [epistemic · formalization · computation · yields: set]\n@purpose: \"resolve each claim to an observable evidence requirement, order by verdict genesis, gather observations from the implementation, and hold the op-set\"\n@genesis: transformation\nCONTRACT:\n  input:     capability_plan from NODE 3\n  transform: FOR EACH claim IN run_context.claims: EXTRACT_FACTS <the observation that would settle it> FROM claim INTO requirement; ORDER requirements BY genesis rank then dependency; FOR EACH requirement IN requirements: READ_RESOURCE <the implementation it names> INTO observation\n  constraints: a requirement names the settling observation, never a presumed verdict; an observation is gathered, never inferred; a string crosses a boundary only after sanitize; a mutation under INVESTIGATE or a discovery under ACTION is inadmissible\n  preserves: the distinction between observed, pending escalation and absent\n  output:    observations\nDECLARE observations: array\nSET observations = <one per direct requirement, each bound to real implementation, escalations flagged pending>\nHANDOFF GATE (evidence-bearing):\n  rule_id: \"GATHER\"   yields: boolean\n  [check] every claim resolves to an observable requirement naming the settling observation (evidence: requirements) over: run_context.claims measured: <mapped> / <claims>\n  [check] every direct requirement produced an observation from the implementation and none was inferred (evidence: observations)\n  [check] the op-set was honored, every boundary cross was sanitized and recursion stayed bounded (evidence: the admissibility record)\n  result: pass → NODE 5 | inadmissible act → REPAIR (owner: NODE 1) | unknown → BLOCKED\n\n# NODE 5 — ADJUDICATE   [evaluative · verification · logic + probability · yields: set + number]\n@purpose: \"judge each observation against evidence, behavioral contract and hostile inputs, judge this agent's own claims, and resolve escalations without inference\"\n@genesis: constraint\n@mandatory\nCONTRACT:\n  input:     observations from NODE 4\n  transform: FOR EACH observation IN observations: CLASSIFY observation BY <verified, contradicted or unverified>; EXECUTE_TOOL <the detectors> WITH <traversal, null-byte, homoglyph, comment and spoof inputs> INTO adversarial; ANALYZE_CONTENT {self.definition} AGAINST <its own must and always claims> INTO self_audit; FOR EACH escalation IN <pending escalations>: <build a bounded tool or mark the claim unverified>\n  constraints: a match is not evidence until the calibration and adversarial verdicts hold; an overclaim downgrades confidence below threshold; an escalation is never resolved by inference; a stale write is rewritten as complete state\n  output:    adjudication\nDECLARE adjudication: object\nSET adjudication = {verdicts: <one per claim>, adversarial: adversarial, self_audit: self_audit, confidence: , refuter: <what would flip a verdict>}\nHANDOFF GATE (ver-stop gate):\n  rule_id: \"ADJUDICATE\"   yields: boolean\n  [check] every claim is classified with its evidence and a refuter is named (evidence: adjudication.verdicts) over: run_context.claims measured: <classified> / <claims>\n  [check] every detector survived the adversarial inputs with the expected outcome (evidence: adjudication.adversarial)\n  [check] the recursive self-audit ran and an overclaim downgraded confidence (evidence: adjudication.self_audit)\n  [check] no pending escalation remains unresolved by tool or by an unverified mark (evidence: the escalation record)\n  refuse: an adversarial input that would escape the intended root before EXECUTE_TOOL\n  standing: moved-set <the implementation files re-read since NODE 4>\n  result: pass → NODE 6 | untested match → REPAIR (owner: NODE 3) | unknown → BLOCKED\n\n# NODE 6 — TERMINATE   [evaluative · termination · set-theory · yields: artifact]\n@purpose: \"emit exactly one typed artifact, deduplicated, naming every limitation, and stop only on saturation and completion and verification\"\n@genesis: emergence\n@mandatory\nCONTRACT:\n  input:     adjudication from NODE 5\n  transform: COMPOSE_ARTIFACT artifact FROM {run_context, adjudication} USING <the investigation report, the action log, or the blocked report>; REDUCE artifact.findings TO <one per claim and verdict>; PERSIST_ARTIFACT artifact TO <{task_name} report>; REPORT_RESULT artifact TO <the parties whose next work it creates>\n  constraints: exactly one artifact, bound at orientation; a self-assessed done is not ter-stop\n  output:    artifact\n  freshness: fingerprint(adjudication) + fingerprint(this document)\nHANDOFF GATE (ter-stop gate):\n  rule_id: \"TERMINATE\"   yields: boolean\n  [check] exactly one typed artifact names every limitation, warning and vulnerability (evidence: artifact)\n  [check] success only when saturation and completion and verification all hold (evidence: the termination set) over: the termination set measured: <holding> / <three>\n  [check] findings are deduplicated by claim and verdict (evidence: the reduction pass)\n  refuse: a report destination that changed since it was read before PERSIST_ARTIFACT\n  result: pass → TERMINATE | integrity defect → REPAIR (owner: NODE 6) | unknown → BLOCKED\n\n# CROSS-NODE INVARIANTS\nINVARIANT anchor-disclosed: the trust anchor is disclosed, never verified, and everything above it is verified over: every run binds: the verifier objector: [check] the trust anchor is disclosed at NODE 1\nINVARIANT op-sets-disjoint: INVESTIGATE never mutates and ACTION never discovers new scope over: every operation binds: the verifier objector: [check] the op-set was honored at NODE 4\nINVARIANT calibrate-before-trust: no detector output is trusted before both controls pass over: every detector binds: the verifier objector: [check] every needed detector ran both controls at NODE 3\nINVARIANT gathered-never-inferred: an observation comes from the implementation, never from inference over: every observation binds: the verifier objector: [check] none was inferred at NODE 4\nINVARIANT match-is-not-evidence: a match counts only after calibration and adversarial survival over: every verdict binds: the verifier objector: [check] every detector survived the adversarial inputs at NODE 5\nINVARIANT self-not-exempt: this agent's own claims are audited by the same rules over: every run binds: the verifier objector: [check] the recursive self-audit ran at NODE 5\nINVARIANT escalate-never-infer: a missing capability builds a tool or marks the claim unverified over: every escalation binds: the verifier objector: [check] no pending escalation remains at NODE 5\n\nREPORT:\n  subject: NODE 6\n  verdict: pass | fail | unknown\n  domain: declared <claims> measured <classified>\n  populations: verified <n>, contradicted <n>, unverified <n>\n  refusals: <n> [<reason>]\n  unresolved: <n> [<reason>]\n  completion: saturated <bool> complete <bool> verified <bool>\n",
                "kind": "code",
                "language": "pag",
                "title": "a verifier"
              },
              {
                "code": "---\nname: {creator_name}\ntype: TEMPLATE\nversion: 1.0.0\n---\n\nTHIS TEMPLATE GENERATES an agent from inspected evidence\n\n%% META %%:\n    objective: \"an agent whose every claimed capability traces to evidence and has failed on purpose once\"\n    jurisdiction: <the domain the agent will investigate> and {project.agent_registry} | external: every other agent\n    recursion_limit: 2\n\n# NODE 1 — EVIDENCE       [epistemic · ontology · set-theory · yields: set]\n@genesis: existence\nCONTRACT:\n  input:     <the domain the agent will investigate>\n  transform: DISCOVER_RESOURCES \"<the domain>\" INTO <sources>; FOR EACH <source> IN <sources>: READ_RESOURCE <source> INTO <content>; EXTRACT_FACTS <the shapes the agent must detect> FROM <content> INTO <evidence>\n  output:    <evidence>\nHANDOFF GATE:\n  [check] <sources> is non-empty because a search was run (evidence: the search log) over: <the domain> measured: <read> / <sources>\n  [check] every capability the agent will claim traces to an item in <evidence> (evidence: one item per capability)\n  [check] nothing in <evidence> came from prior knowledge (evidence: a source per item)\n  result: pass → NODE 2 | unsourced item → REPAIR (owner: NODE 1) | unknown → BLOCKED\n\n# NODE 2 — THE PORTABLE CONTRACT   [epistemic · formalization · computation · yields: procedure]\n@genesis: structure\nCONTRACT:\n  input:     <evidence> from NODE 1\n  transform: COMPOSE_ARTIFACT <contract> FROM <evidence> · semantic operations only; slots for every host fact, {project.*} {convention.*} {limits.*} {toolchain.*}; no runtime, no tool name, no path, no model\n  preserves: every capability's trace to its evidence\n  output:    <contract>\nHANDOFF GATE:\n  [check] <contract> names no harness feature (evidence: a scan of its literals) over: its literals measured: <neutral> / <literals>\n  [check] every host fact in <contract> is a slot (evidence: no literal path or command)\n  [check] every operation in <contract> is one an adapter can map (evidence: the operation set)\n  result: pass → NODE 3 | harness name → REPAIR (owner: NODE 2) | unknown → BLOCKED\n\n# NODE 3 — RENDERING      [evaluative · representation · information-theory · yields: artifact]\n@genesis: transformation\nCONTRACT:\n  input:     <contract> from NODE 2\n  transform: COMPOSE_ARTIFACT <artifact> FROM <contract> USING <the adapter for one runtime>\n  output:    <artifact>\n  freshness: fingerprint(<contract>) + fingerprint(<the adapter>)\nHANDOFF GATE:\n  [check] every operation resolved to a tool (evidence: the adapter's map) over: operations measured: <mapped> / <operations>\n  [check] every slot resolved to a value or a declared absence (evidence: no unresolved slot)\n  [check] the identity the agent writes under is declared in the body the runtime delivers (evidence: the body)\n  result: pass → NODE 4 | unresolved slot → REPAIR (owner: NODE 2) | unknown → BLOCKED\n\n# NODE 4 — PROOF BEFORE PERSISTENCE   [evaluative · verification · logic · yields: boolean]\n@genesis: constraint\nCONTRACT:\n  input:     <artifact> from NODE 3\n  transform: EXECUTE_TOOL <artifact> ON  INTO <fail-run>; EXECUTE_TOOL <artifact> ON  INTO <pass-run>; VALIDATE_ARTIFACT <fail-run>, <pass-run> AGAINST <fails on purpose, passes for the right reason>; PERSIST_ARTIFACT <artifact> TO {project.agent_registry}\n  output:    the persisted agent\nHANDOFF GATE:\n  [check] the contradiction reported with its evidence (evidence: <fail-run>)\n  [check] the clean case passed for the right reason (evidence: <pass-run> names the check it passed) over: the two cases measured: <as expected> / <two>\n  [check] <artifact> persisted only after both cases ran (evidence: the two runs precede the write)\n  refuse: either run missing before PERSIST_ARTIFACT\n  result: pass → TERMINATE | silent contradiction → REPAIR (owner: NODE 2) | unknown → BLOCKED\n\n# CROSS-NODE INVARIANTS\nINVARIANT evidence-first: an agent is generated from inspected evidence, never from intent alone over: every generated agent binds: the creator objector: [check] nothing in evidence came from prior knowledge at NODE 1\nINVARIANT fail-on-purpose: no agent is persisted before it has failed on a planted contradiction over: every generated agent binds: the creator objector: [check] the contradiction reported at NODE 4",
                "kind": "code",
                "language": "pag",
                "title": "a creator"
              },
              {
                "caption": "where guarantees live",
                "kind": "mermaid",
                "text": "flowchart TB\n    meta[\"META · the trust anchor as a trust line, the jurisdiction, the phase kind bound at ORIENT\"]\n    self[\"A node that reads {self.definition} · the self-audit as a contract\"]\n    decision[\"REQUEST_DECISION · resolves ABSENT for a bounded reader\"]\n    proof[\"The creator's proof gate · fails on purpose, passes for the right reason, then persists\"]\n    artifact[\"The terminal node · one typed artifact with its report, never a question\"]\n    meta --> self --> decision --> proof --> artifact"
              }
            ],
            "title": "Walked, not adopted"
          }
        ],
        "title": "Agent templates"
      }
    ]
  },
  "description": "This section covers the template and how an instance is raised from it.",
  "id": "pag",
  "label": "Templates",
  "tab": "templates",
  "title": "Templates — PAG — Bane's Lab",
  "url": "https://banes-lab.com/pag/templates"
}